joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402320
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.004040a8
add esp, 0x10
test eax, eax
js 0x40237c
cmp eax, 0x103
ja 0x40237c
jne 0x402361
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040401b
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebp - 6], ax
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040401b
mov esp, ebp
pop ebp
ret

Function at 0x402480
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor bl, bl
mov dword [0x41b1a4], eax
lea eax, [esp + 0xc]
push eax
mov dword [0x41b3d4], 0x309
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
test esi, esi
js 0x402598
push 0
push 0x20070
mov bl, 1
call dword [sym.imp.MFPlat.DLL_MFStartup]
mov esi, eax
test esi, esi
js 0x402598
mov ecx, edi
call fcn.00403d50
test eax, eax
jne 0x402544
push esi
push str.CreateMainWindow_failed.
push 0x416990
lea eax, [esp + 0x3c]
push 0x100
push eax
call fcn.00401ff0
add esp, 0x14
test eax, eax
js 0x402590
push 0x10
push 0
lea eax, [esp + 0x38]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.MFPlat.DLL_MFShutdown]
jmp 0x4025ce
push dword [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x14]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x402590
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x14]
push eax
call edi
lea eax, [esp + 0x14]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jne 0x402571
call dword [sym.imp.MFPlat.DLL_MFShutdown]
jmp 0x4025ce
push esi
push str.Failed_to_start_application
push 0x416990
lea eax, [esp + 0x3c]
push 0x100
push eax
call fcn.00401ff0
add esp, 0x14
test eax, eax
js 0x4025ca
push 0x10
push 0
lea eax, [esp + 0x38]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test bl, bl
je 0x4025d4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x234]
mov eax, dword [0x41b3d4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040401b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b1e8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407641
mov dword [ebp - 0x14], eax
cmp dword [0x41b168], esi
jne 0x40b2db
push 0x800
push esi
push 0x413dcc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40b268
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40b3bb
push esi
push esi
push 0x413dcc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40b3bb
push 0x413de4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b3bb
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41b168], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x41b16c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41b170], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41b178], eax
test eax, eax
je 0x40b2d8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41b174], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40b300
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40b2f3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40b315
push 4
pop eax
jmp 0x40b3bd
cmp dword [ebp - 0x14], esi
je 0x40b315
push dword [0x41b168]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40b2fa
mov eax, dword [0x41b174]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40b373
cmp dword [0x41b178], edi
je 0x40b373
push eax
call ebx
push dword [0x41b178]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40b373
test eax, eax
je 0x40b373
call ecx
test eax, eax
je 0x40b368
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40b368
test byte [ebp - 8], 1
jne 0x40b373
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40b3a3
mov eax, dword [0x41b16c]
cmp eax, edi
je 0x40b3a0
push eax
call ebx
test eax, eax
je 0x40b3a0
call eax
mov esi, eax
test esi, esi
je 0x40b3a0
mov eax, dword [0x41b170]
cmp eax, edi
je 0x40b3a0
push eax
call ebx
test eax, eax
je 0x40b3a0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x41b168]
call ebx
test eax, eax
je 0x40b3bb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40b3bd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040401b
mov esp, ebp
pop ebp
ret
Function at 0x40ef98
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f035
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f035
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f035
push 4
push 0xffffffffffffffff
push esi
push 0x40f74f
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f035
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f000
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f035
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f03b
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f037

Function at 0x413985
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413995
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x41399b
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x4139c3
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x4139aa
mov esi, ecx
jmp 0x4139c6
movzx esi, si
pop edi
cmp cx, si
je 0x4139e3
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x4139c7
mov eax, 0x437348
jmp 0x4139eb
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x414a7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x414a8b
pop dword [ebp - 0x38]
mov eax, 0x414a8b
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3de5f
push 0
mov eax, 0xa2215e62
sub eax, 0xa1de9b6a
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x3c904c71
sub ecx, 0x3c901844
xor esi, esi
add esi, eax
mov edi, 0xd56682fe
add edi, 0x2ade1502
add edi, dword [ebp - 0x38]
mov ebx, 0x40482cad
add ebx, 0x50509338
add dword [ebp - 8], 0x260ba7c5
mov edx, dword [edi]
add edx, ebx
xor dword [ebp - 0x2c], 0x46a849a6
mov dword [esi], edx
add dword [ebp - 0x34], edx
add esi, 0x9f3ac23d
sub esi, 0x9f3ac239
add edi, 0x534d8791
add edi, 0xacb27873
loop 0x414ae7
add eax, 0x3b6399de
sub eax, 0x3b62d657
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x41592c
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
sub esp, 0xc
lea edx, [ebx + 0x1c]
lea ecx, [ebx + 0x40]
mov esi, eax
lea eax, [ebx + 0x38]
push edx
push ecx
lea ecx, [ebx + 0x3c]
push ecx
push eax
push edi
push esi
push ecx
lea ecx, [ebp - 0x88]
call main
lea ecx, [ebp - 0x30]
call fcn.0040ed59
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push 0x2c
mov eax, ecx
mov dword [ebp - 4], esi
push eax
push 0x2c
lea eax, [ebp - 0x88]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_TransactNamedPipe]
test eax, eax
je 0x4159ef
cmp dword [ebp - 0x30], 2
jne 0x4159ef
cmp dword [ebp - 0x2c], esi
je 0x4159ef
cmp dword [ebp - 0x10], esi
je 0x4159ef
cmp dword [ebp - 0xc], esi
je 0x4159ef
cmp dword [ebp - 8], esi
je 0x4159ef
lea ecx, [ebp - 0x5c]
call fcn.0040ed59
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0x5c], 3
push eax
push 0x2c
mov eax, ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x4159ef
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x34], eax
mov al, 1
jmp 0x4159f1
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x818030]
jne 0x40107a
repz ret
jmp fcn.00401b61

Function at 0x4086bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040255c
and dword [ebp - 4], 0
cmp dword [0x81a7b4], 0
mov ebx, eax
jne 0x40876c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40881d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40881d
push eax
call fcn.004024ea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81a7b4], eax
call esi
push eax
call fcn.004024ea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81a7b8], eax
call esi
push eax
call fcn.004024ea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81a7bc], eax
call esi
push eax
call fcn.004024ea
pop ecx
mov dword [0x81a7c4], eax
test eax, eax
je 0x40876c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004024ea
pop ecx
mov dword [0x81a7c0], eax
mov eax, dword [0x81a7c0]
cmp eax, ebx
je 0x4087c4
cmp dword [0x81a7c4], ebx
je 0x4087c4
push eax
call fcn.00402565
push dword [0x81a7c4]
mov esi, eax
call fcn.00402565
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4087c4
test edi, edi
je 0x4087c4
call esi
test eax, eax
je 0x4087bb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4087bb
test byte [ebp - 0xc], 1
jne 0x4087c4
or dword [ebp + 0x10], 0x200000
jmp 0x4087fd
mov eax, dword [0x81a7b8]
cmp eax, ebx
je 0x4087fd
push eax
call fcn.00402565
pop ecx
test eax, eax
je 0x4087fd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4087fd
mov eax, dword [0x81a7bc]
cmp eax, ebx
je 0x4087fd
push eax
call fcn.00402565
pop ecx
test eax, eax
je 0x4087fd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81a7b4]
call fcn.00402565
pop ecx
test eax, eax
je 0x40881d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40881f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10024a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10024a7f
pop dword [ebp - 0x40]
mov eax, 0x8b2deffc
sub eax, 0x7b2ba57d
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x35d78
push 0
mov eax, 0x3a114a92
sub eax, 0x2a0eb986
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x34ad
xor edi, edi
add edi, eax
mov edx, 0x90c026e4
add edx, 0x7f44451c
add edx, dword [ebp - 0x40]
mov esi, 0xba996df1
sub esi, 0xaf01dbd6
mov ebx, dword [edx]
add dword [ebp - 0x2c], edi
xor ebx, esi
sub dword [ebp - 0x34], edi
mov dword [edi], ebx
xor dword [ebp - 0x3c], edi
add edi, 4
add edx, 0xd23cb12
add edx, 0xf2dc34f2
loop 0x10024ada
add eax, 0xeaac0966
sub eax, 0xeaab43df
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe92ff5ba
sub ecx, 0xd92ff5ba
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x40bde6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40be25
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40be25
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40be25
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40be25
cmp dword [ecx + 0x74], 0xe
jbe 0x40be25
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x416610
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41663d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41663d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x3080194f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x308249ec]
jne 0x30801959
repz ret
jmp fcn.3081a014

Function at 0x30807ed2
Capabilities:
Get file attributes

Disassembly:
push 0x58
mov eax, 0x3081ac18
call fcn.3081997e
mov eax, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], cx
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov dword [ebp - 4], esi
xor ebx, ebx
call fcn.30807c9a
pop ecx
pop ecx
test eax, eax
je 0x30807f69
push str.__
lea ecx, [ebp - 0x64]
call fcn.30814d3d
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 1
call fcn.30814d3d
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.30814d3d
push esi
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.30814d3d
push esi
push 1
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.30814d3d
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x30807f60
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea ecx, [ebp - 0x2c]
and bl, 1
call fcn.30814d3d
mov al, bl
call fcn.308199b4
ret
Function at 0x30807f83
Capabilities:
Create directory

Disassembly:
push 0x88
mov eax, 0x3081ac6d
call fcn.3081997e
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x10]
push str.__
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x8c], eax
call fcn.30814d3d
push esi
push eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.30814d3d
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.30814d3d
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x30807fe2
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
push 0x5c
pop esi
cmp word [eax + ecx*2 - 2], si
je 0x30807ffa
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.30814d3d
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x94], esi
or edi, 0xffffffff
mov ecx, dword [ebp - 0x90]
push 1
push dword [ebp - 0x88]
lea eax, [ebp - 0x94]
push eax
call fcn.30814d3d
mov ecx, dword [ebp - 0x90]
mov esi, eax
cmp esi, edi
je 0x30808078
sub eax, dword [ebp - 0x88]
push eax
push dword [ebp - 0x88]
lea eax, [ebp - 0x48]
push eax
call fcn.30814d3d
push edi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.30814d3d
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.30814d3d
push 0x5c
push 1
lea ecx, [ebp - 0x2c]
call fcn.30814d3d
inc esi
mov dword [ebp - 0x88], esi
jmp 0x308080ac
push edi
push dword [ebp - 0x88]
lea eax, [ebp - 0x48]
push eax
call fcn.30814d3d
push edi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.30814d3d
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.30814d3d
mov dword [ebp - 0x88], edi
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x308080b8
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
setne byte [ebp - 0x81]
cmp byte [ebp - 0x81], bl
je 0x308080f5
push edi
push 4
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.30814d3d
mov ecx, dword [ebp - 0x8c]
push eax
mov byte [ebp - 4], 5
call fcn.30814d3d
lea ecx, [ebp - 0x48]
jmp 0x30808153
mov eax, dword [ebp - 0x8c]
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ebx
jb 0x30808106
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x88], edi
jne 0x30808009
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
sete byte [ebp - 0x81]
cmp byte [ebp - 0x81], bl
je 0x3080816b
push edi
push 4
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
call fcn.30814d3d
mov ecx, dword [ebp - 0x8c]
push eax
mov byte [ebp - 4], 6
call fcn.30814d3d
lea ecx, [ebp - 0x64]
push ebx
push 1
mov byte [ebp - 4], 2
call fcn.30814d3d
cmp dword [ebp - 0x88], edi
jne 0x30808009
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.30814d3d
mov al, byte [ebp - 0x81]
call fcn.308199b4
ret
Function at 0x30808ae4
Capabilities:
Enumerate process modules

Disassembly:
push 0x20
mov eax, 0x3081ae31
call fcn.30801ee1
push dword [ebp + 8]
xor edi, edi
push edi
push 0x410
mov dword [ebp - 0x14], edi
call dword [sym.imp.kernel32.dll_OpenProcess]
mov ebx, eax
cmp ebx, edi
je 0x30808b87
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], edi
call sub.psapi.dll_EnumProcessModules
test eax, eax
je 0x30808b87
push 0x20
pop esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
push edi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.30814d3d
push esi
push dword [ebp - 0x2c]
push dword [ebp - 0x10]
push ebx
call sub.psapi.dll_GetModuleBaseNameA
cmp eax, esi
jb 0x30808b62
push edi
add esi, esi
push esi
lea ecx, [ebp - 0x2c]
call fcn.30814d3d
cmp esi, 0x208
jbe 0x30808b3d
push dword [ebp - 0x2c]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll__mbsstr]
pop ecx
pop ecx
test eax, eax
je 0x30808b7b
mov dword [ebp - 0x14], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.30806a0c
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
call fcn.30801fc6
ret

Function at 0x30808c2f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x138
mov eax, 0x3081ae8b
call fcn.3081997e
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x138], edi
cmp ebx, edi
je 0x30808d1c
lea eax, [ebp - 0x134]
push eax
call fcn.30808b97
pop ecx
cmp dword [ebp - 0x120], 0x10
mov eax, dword [ebp - 0x134]
mov dword [ebp - 4], edi
jae 0x30808c76
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x13c]
push ecx
push 1
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x30808d0a
mov esi, 0x105
push esi
lea eax, [ebp - 0x118]
push edi
push eax
mov dword [ebp - 0x140], 0x104
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push ebx
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x30808cfe
mov eax, dword [0x30825cd8]
push esi
call dword [eax + 4]
pop ecx
mov dword [ebp - 0x138], eax
cmp eax, edi
je 0x30808cfe
push esi
lea ecx, [ebp - 0x118]
push ecx
push esi
push eax
call dword [sym.imp.MSVCR100.dll_strncpy_s]
add esp, 0x10
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x134]
call fcn.30814d3d
mov eax, dword [ebp - 0x138]
call fcn.308199b4
ret
Function at 0x30809222
Capabilities:
Enumerate process modules

Disassembly:
push 0x24
mov eax, 0x3081af3b
call fcn.30801ee1
xor ebx, ebx
push 8
pop esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
push ebx
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.30814d3d
push 0x20
pop edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 1
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x30]
call sub.psapi.dll_EnumProcesses
test eax, eax
je 0x3080928c
mov eax, dword [ebp - 0x18]
cmp eax, edi
jb 0x30809285
push ebx
add esi, esi
push esi
lea ecx, [ebp - 0x30]
call fcn.30814d3d
mov edi, esi
shl edi, 2
jmp 0x30809294
shr eax, 2
mov esi, eax
jmp 0x30809291
xor esi, esi
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
jne 0x3080925a
cmp dword [ebp - 0x14], ebx
je 0x308092c8
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.30814d3d
cmp esi, ebx
jbe 0x308092c8
mov ebx, dword [ebp - 0x30]
push ebx
mov ecx, edi
call fcn.30814d3d
add ebx, 4
dec esi
jne 0x308092ba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.30806a0c
mov eax, dword [ebp - 0x14]
call fcn.30801fc6
ret

Function at 0x30814d3d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x30814d4c
pop dword [ebp - 0x34]
mov eax, 0x30814d4c
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x56e4ced2
add dword [ebp - 0x44], 0xf76d7679
mov dword [ebp - 0x40], 0xe13744d7
add dword [ebp - 0x40], 0x50fc076e
mov dword [ebp - 0x3c], 0x56296457
sub dword [ebp - 0x3c], 0x9dd2029
mov dword [ebp - 0x38], 0x7b102c24
add dword [ebp - 0x38], 0x84efd3dc
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x5afa70cf
sub dword [ebp - 0x44], 0xe6880779
mov dword [ebp - 0x40], 0x952d87bc
add dword [ebp - 0x40], 0xac3ed9b9
mov dword [ebp - 0x3c], 0x25288eb4
sub dword [ebp - 0x3c], 0xc1b92248
mov dword [ebp - 0x38], 0x3bffbce1
add dword [ebp - 0x38], 0xc400431f
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3b8c1
push 0
call eax
mov ecx, 0xa7e0d6e1
add ecx, 0x581f6a47
xor esi, esi
add esi, eax
mov edi, 0xd2855dee
add edi, 0x5dfd9412
add edi, dword [ebp - 0x34]
mov ebx, 0xfd9fc2e8
add dword [ebp - 0x28], ecx
mov edx, dword [edi]
add dword [ebp - 0x1c], ebx
xor edx, ebx
add dword [ebp - 0x28], 0x6805de98
mov dword [esi], edx
add dword [ebp - 0x1c], 0x6d54b089
add esi, 0x2bd94e10
add esi, 0xd426b1f4
add edi, 4
loop 0x30814e5b
add eax, 0x790c5bc8
sub eax, 0x790b6455
xor ebx, ebx
add ebx, eax
add eax, 0x55c2ace3
add eax, 0xaa3d5322
mov ecx, 0xea749802
add ecx, 0x460b67fe
add ecx, dword [ebp - 0x34]
call ebx
leave
ret