joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec7be47
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cx, word [ebp + 0x14]
or word [eax + 0x84], 0xffff
push ebx
push esi
push edi
mov word [eax + 0x32], cx
mov cx, word [ebp + 0x10]
xor edx, edx
mov word [eax + 0x20], cx
push 9
pop ecx
mov ebx, 0x4ec7bf30
mov esi, ebx
lea edi, [eax + 0x44]
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [ebp + 0x14]
mov esi, dword [ebp + 0xc]
imul ecx, ecx, 0x38
mov byte [eax], 0x47
mov byte [eax + 1], 0x44
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x1c], 3
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x6c], edx
mov dword [eax + 0x70], edx
mov dword [eax + 0x68], edx
mov word [eax + 0x22], 0x7fff
mov word [eax + 0x24], 0x7fff
mov word [eax + 0x26], 0x8000
mov word [eax + 0x28], 0x8000
mov word [eax + 0x86], dx
mov dword [eax + 0x88], edx
mov word [eax + 0x2a], dx
mov word [eax + 0x2e], dx
mov dword [eax + 0x34], 2
mov dword [eax + 0x38], edx
mov word [eax + 0x3c], dx
mov word [eax + 0x3e], dx
mov word [eax + 0x40], dx
mov word [eax + 0x42], dx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov dword [eax + 0x80], edx
mov esi, dword [esi + 8]
add ecx, esi
push 9
mov dword [eax + 0x8c], ecx
mov word [ecx + 0x28], dx
pop ecx
mov esi, ebx
lea edi, [eax + 0x90]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [eax + 0xb4], 1
pop ebx
pop ebp
ret 0x10

Function at 0x4ec7df56
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4ec7df91
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4ec7df78
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4ec7df89
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4ec7df93
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4ec7df6e
xor eax, eax
pop edi
pop esi
ret
Function at 0x4ec7e74d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ecx + 0x40fffffc], esi
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.4ec7df26
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.4ec7dedb
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.4ec7df26
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.4ec7dedb
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.4ec7df26
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.4ec7dedb
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.4ec7df16
int3
Function at 0x4ec7ee2d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.4ec7def4
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov al, byte [0x38fffffc]
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.4ec7df26
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.4ec7dedb
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.4ec7df16
xchg esp, eax
inc edi
in eax, dx
sub byte [eax + 4], 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.4ec7df16
and dword [eax + edi*8], esi
dec ebp
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.4ec7df26
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.4ec7dedb
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x4ec7efc2
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x4ec7efe2
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
inc dword [eax]
Function at 0x4ec7ee95
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.4ec7def4
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov al, byte [0x38fffffc]
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.4ec7df26
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.4ec7dedb
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.4ec7df16
xchg esp, eax
inc edi
in eax, dx
sub byte [eax + 4], 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.4ec7df16
and dword [eax + edi*8], esi
dec ebp
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.4ec7df26
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.4ec7dedb
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x4ec7efc2
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x4ec7efe2
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
inc dword [eax]
Function at 0x4ec80912
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
cmp dword [0x4edd02cc], 0
mov eax, dword [section..data]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
je 0x4ecd4399
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x21c]
push ecx
push edi
lea ecx, [ebp - 0x218]
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ecd440e
cmp dword [ebp - 0x218], 1
jne 0x4ecd43ec
jmp 0x4ecd440e
leave
ret 0x10
push eax
lea ecx, [ebp - 0x214]
call fcn.4ec8681d
cmp dword [ebp - 0x214], 0x55464131
jne 0x4ecd43ec
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x210]
mov dword [ebp - 0x21c], 0x104
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ecd440e
cmp dword [ebp - 0x218], 1
je 0x4ecd43f1
push 0xd
pop eax
jmp 0x4ecd440e
mov eax, dword [ebp + 0x14]
shr eax, 1
push eax
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.4ecff6cb
neg eax
sbb eax, eax
and eax, 0xfffffff3
add eax, 0xd
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.4ecfd994
jmp 0x4ec80979

Function at 0x4ec86918
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.4ec865fb
xor ebx, ebx
cmp eax, ebx
mov dword [esi + 0x20], eax
je 0x4ecd4468
push 0x80
push 3
push 1
push 0x80000000
push dword [ebp + 8]
call fcn.4ec866c8
cmp eax, 0xffffffff
mov dword [esi + 0x1c], eax
jne 0x4ecd4472
call fcn.4ec8696c
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, 0x8007000e
jmp 0x4ec86960
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x4ec8695b
cmp dword [ebp - 4], ebx
jne 0x4ec8695b
push ebx
push ebx
push ebx
push 2
push ebx
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x4ec8695b
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x4ec8695b
mov eax, dword [ebp - 8]
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 4
xor eax, eax
jmp 0x4ec86960
Function at 0x4eca2968
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push edi
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, eax
cmp ebx, edi
je 0x4ecc0d18
push esi
mov esi, 0x4edd09b8
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [0x4edd0a18], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4edd0a14
push edi
push edi
push 0x4ec672b0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [0x4edd097c], eax
pop esi
je 0x4ecc0d18
xor eax, eax
inc eax
mov dword [0x4edd0a10], eax
pop edi
pop ebx
ret
call fcn.4ec6720e
xor eax, eax
jmp 0x4eca29c7

Function at 0x4eca7c2e
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
push esi
xor esi, esi
cmp dword [0x4edd1710], esi
mov dword [ebp - 4], eax
je 0x4ecd2d7a
push 0x400
mov dword [ebp - 0x30], esi
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
cmp dword [0x4edd01d8], esi
mov dword [0x4edd1d98], eax
je 0x4eca7c7d
push 0x14
lea ecx, [ebp - 0x2c]
push ecx
push 0x1014
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
je 0x4ecd2d07
movzx eax, word [ebp - 0x2c]
sub eax, 0x31
jne 0x4ecd2d5d
mov dword [0x4edd1d9c], 1
mov dword [0x4edd1710], esi
jmp 0x4ecd2d7a
leave
ret
lea eax, [ebp - 0x34]
push eax
push 0x20019
push esi
push 0x4ecd2d9c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4eca7c86
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
push esi
push 0x4ecd2d90
push dword [ebp - 0x34]
mov word [ebp - 0x2c], si
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4ecd2d4f
mov dword [ebp - 0x30], esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4eca7c86
dec eax
je 0x4ecd2d6b
mov dword [0x4edd1d9c], esi
jmp 0x4eca7c9d
mov dword [0x4edd1d9c], 2
jmp 0x4eca7c9d
mov ecx, dword [ebp - 4]
mov ax, word [0x4edd1d98]
pop esi
call fcn.4ecfd994
jmp 0x4eca7ca8
Function at 0x4eca7e79
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [section..data]
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x418]
push eax
push 9
xor edi, edi
push edi
push 0x4eca8008
push 0x80000002
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ecc9df8
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x424]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x418]
mov dword [ebp - 0x424], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
jne 0x4ecc9dec
mov eax, dword [ebp - 0x424]
cmp eax, edi
je 0x4ecc9dec
imul eax, eax, 0x210
push eax
call fcn.4ec52209
cmp eax, edi
mov dword [esi + 0xc], eax
je 0x4ecc9dec
mov dword [ebp - 0x420], edi
push ebx
mov eax, 0x104
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x420]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
jne 0x4eca9a2a
inc dword [ebp - 0x420]
mov eax, dword [ebp - 0x428]
dec eax
cmp eax, edi
jl 0x4eca7f77
cmp word [ebp + eax*2 - 0x20c], 0x2c
je 0x4eca8084
dec eax
jns 0x4eca7f65
mov eax, dword [0x4edd0950]
mov ecx, dword [eax + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.4ec7d890
cmp eax, edi
je 0x4eca7f0b
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
imul ecx, ecx, 0x210
mov dword [ecx + edx + 0x20c], eax
xor eax, eax
cmp dword [ebp - 0x41c], edi
jbe 0x4eca7fd9
mov cx, word [ebp + eax*2 - 0x414]
cmp cx, 0x2c
je 0x4eca7fd9
mov edx, dword [esi + 0x10]
mov ebx, dword [esi + 0xc]
imul edx, edx, 0x108
add edx, eax
inc eax
mov word [ebx + edx*2], cx
cmp eax, dword [ebp - 0x41c]
jb 0x4eca7fb0
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
imul ecx, ecx, 0x108
add ecx, eax
mov word [edx + ecx*2], di
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
imul ecx, ecx, 0x210
mov dword [ecx + edx + 0x208], eax
inc dword [esi + 0x10]
jmp 0x4eca7f0b
mov word [ebp + eax*2 - 0x20c], di
jmp 0x4eca7f77
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
jmp 0x4ecc9df8
leave
ret
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.4ecfd994
jmp 0x4eca9a3c
Function at 0x4eca92b3
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [0x4edd1da0], edx
mov dword [0x4edd0804], edi
call ebx
mov dword [0x4edd1da4], eax
jmp 0x4eca92e6
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
xor edi, edi
cmp dword [0x4edd09b0], edi
mov dword [0x4edd0804], edi
je 0x4eca92ea
call ebx
sub eax, dword [0x4edd1da4]
cmp eax, 0x7530
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
jne 0x4eca92ef
pop edi
pop ebx
leave
ret
call fcn.4eca9a43
cmp dword [0x4edd177c], edi
je 0x4ecd37c0
cmp dword [0x4edd0804], edi
je 0x4eca92a5
mov eax, dword [0x4edd09b0]
xor edx, edx
cmp eax, edi
je 0x4eca9299
mov ecx, dword [eax + 0x40]
cmp ecx, edx
ja 0x4eca931a
mov eax, dword [eax + 0x4c]
jmp 0x4eca930a
mov edx, ecx
jmp 0x4eca9315
push esi
push 0x20000
push 0x4edda088
mov esi, 0x4ece5770
push esi
push 0x80000002
call fcn.4ed4d7db
push 0x40000
push 0x4edda084
push esi
push 0x80000001
call fcn.4ed4d7db
pop esi
jmp 0x4eca92fb
Function at 0x4eca979b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [section..data]
push ebx
push esi
push 8
mov dword [ebp - 4], eax
mov esi, ecx
call fcn.4ec52209
xor ebx, ebx
cmp eax, ebx
mov dword [esi + 4], eax
je 0x4ecc9f11
push edi
mov dword [eax], ebx
mov eax, dword [esi + 4]
push 0x45
mov dword [eax + 4], ebx
xor edi, edi
xor eax, eax
pop ecx
mov word [ebp + eax - 0x218], cx
inc edi
lea eax, [edi + edi]
xor ecx, ecx
mov cx, word [eax + 0x4eca9824]
cmp cx, bx
jne 0x4eca97d6
call dword [sym.imp.KERNEL32.dll_GetACP]
test eax, eax
jbe 0x4eca980f
xor edx, edx
push 0xa
pop ecx
div ecx
add edx, 0x30
mov word [ebp + ebx*2 - 0x10], dx
inc ebx
cmp ebx, 5
jl 0x4eca97f6
dec ebx
js 0x4eca9830
mov ax, word [ebp + ebx*2 - 0x10]
mov word [ebp + edi*2 - 0x218], ax
inc edi
jmp 0x4eca980f
xor eax, eax
lea ecx, [ebp - 0x424]
push ecx
push 9
push eax
mov word [ebp + edi*2 - 0x218], ax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x218]
push eax
push 0x80000001
mov dword [ebp - 0x42c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4ecc9e07
cmp dword [ebp - 0x424], 0
pop edi
jne 0x4ecc9f05
jmp 0x4ecc9f11
leave
ret
mov eax, 0x104
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
xor edi, edi
push edi
push edi
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x428]
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
mov dword [ebp - 0x434], eax
jne 0x4ecc9eed
cmp dword [ebp - 0x42c], edi
je 0x4ecc9e94
push 0x4ece1c50
lea eax, [ebp - 0x420]
push eax
call fcn.4ec6260d
test eax, eax
jne 0x4ecc9e94
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
mov dword [ebp - 0x42c], edi
call fcn.4ed113fa
cmp eax, edi
je 0x4ecc9eed
mov ecx, dword [esi + 4]
mov dword [ecx], eax
jmp 0x4ecc9eed
mov eax, dword [0x4edd0950]
mov ecx, dword [eax + 8]
lea eax, [ebp - 0x420]
push eax
call fcn.4ec7d890
mov ebx, eax
cmp ebx, edi
je 0x4ecc9eed
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.4ed113fa
mov edi, eax
test edi, edi
je 0x4ecc9eed
push 0xc
call fcn.4ec52209
test eax, eax
je 0x4ecc9eed
mov dword [eax], ebx
mov dword [eax + 4], edi
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x4ecc9ee4
mov dword [ecx + 4], eax
and dword [eax + 8], edx
jmp 0x4ecc9eed
mov dword [eax + 8], edx
mov ecx, dword [esi + 4]
mov dword [ecx + 4], eax
inc dword [ebp - 0x428]
cmp dword [ebp - 0x434], 0
jne 0x4eca9874
jmp 0x4ecc9e07
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.4ecfd994
jmp 0x4eca9887
Function at 0x4ecb2e53
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [ecx + 0x48]
and ecx, 0x20000
jmp 0x4ecb2ea5
mov ecx, dword [ecx + 0x48]
and ecx, 0x40000
jmp 0x4ecb2ea5
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, 0x365
cmp eax, edx
jbe 0x4ecc0f22
mov edx, 0x4e4
cmp eax, edx
ja 0x4ecc107b
je 0x4ecb2ec0
sub eax, 0x36a
je 0x4ecc106d
sub eax, 0x3a
je 0x4ecad28e
sub eax, 4
je 0x4ecb2e43
sub eax, 0xd
je 0x4ecb2eb5
dec eax
jne 0x4ecc1049
mov ecx, dword [ecx + 0x48]
and ecx, 0x100000
xor eax, eax
or ecx, eax
jne 0x4ecc10df
xor eax, eax
pop ebp
ret 4
mov ecx, dword [ecx + 0x48]
and ecx, 0x80000
jmp 0x4ecb2ea5
mov ecx, dword [ecx + 0x48]
and ecx, 1
jmp 0x4ecb2ea5
je 0x4ecc1037
add edx, 0xfffffff4
cmp eax, edx
ja 0x4ecc0fcd
je 0x4ecc0fc2
sub eax, 0x1b5
je 0x4ecc0fb7
sub eax, 0x10f
je 0x4ecc0fa9
sub eax, 0x1d
je 0x4ecc0f9b
sub eax, 0x26
je 0x4ecc0f8d
sub eax, 0x4b
je 0x4ecc0f7f
dec eax
dec eax
je 0x4ecc0f71
sub eax, 3
jne 0x4ecb2eaf
mov ecx, dword [ecx + 0x4c]
and ecx, 0x2000000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x4000000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x40000000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x8000000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x10000000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x20000000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x80000000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x1000000
jmp 0x4ecc1040
sub eax, 0x35c
je 0x4ecc102c
dec eax
je 0x4ecc1021
dec eax
je 0x4ecc1016
dec eax
je 0x4ecc100b
dec eax
je 0x4ecc1000
dec eax
je 0x4ecc0ff5
dec eax
jne 0x4ecb2eaf
mov ecx, dword [ecx + 0x4c]
and ecx, 0x20000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x40000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x80000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x100000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x200000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x400000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x800000
jmp 0x4ecc1040
mov ecx, dword [ecx + 0x4c]
and ecx, 0x10000
xor eax, eax
or eax, ecx
jmp 0x4ecb2ea9
sub eax, 0x12c
je 0x4ecc1062
dec eax
jne 0x4ecb2eaf
mov ecx, dword [ecx + 0x48]
and ecx, 4
jmp 0x4ecb2ea5
mov ecx, dword [ecx + 0x48]
and ecx, 2
jmp 0x4ecb2ea5
mov ecx, dword [ecx + 0x48]
and ecx, 0x10000
jmp 0x4ecb2ea5
sub eax, 0x4e5
je 0x4ecc10d4
dec eax
je 0x4ecc10c9
dec eax
je 0x4ecc10be
dec eax
je 0x4ecc10b3
dec eax
je 0x4ecc10a5
sub eax, 0x68
jne 0x4ecb2eaf
mov ecx, dword [ecx + 0x48]
and ecx, 0x200000
jmp 0x4ecb2ea5
mov ecx, dword [ecx + 0x48]
and ecx, 0x80
jmp 0x4ecb2ea5
mov ecx, dword [ecx + 0x48]
and ecx, 0x40
jmp 0x4ecb2ea5
mov ecx, dword [ecx + 0x48]
and ecx, 0x20
jmp 0x4ecb2ea5
mov ecx, dword [ecx + 0x48]
and ecx, 0x10
jmp 0x4ecb2ea5
mov ecx, dword [ecx + 0x48]
and ecx, 8
jmp 0x4ecb2ea5
xor eax, eax
inc eax
jmp 0x4ecb2eb1
Function at 0x4ecfddc9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
mov eax, dword [ebp + 8]
je 0x4ecfddfb
push esi
mov esi, dword [ebp + 0x10]
xor edx, edx
mov dl, byte [eax]
shr esi, 8
xor edx, dword [ebp + 0x10]
and edx, 0xff
xor esi, dword [edx*4 + 0x4ecfde08]
inc eax
dec ecx
mov dword [ebp + 0x10], esi
jne 0x4ecfddd9
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc
Function at 0x4ed09f9f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
push 9
pop edx
mov dword [ebp + 8], ecx
lea ecx, [eax + 2]
mov ax, word [ebp + 8]
xor ax, word [ecx]
inc ecx
inc ecx
dec edx
jne 0x4ed09fb9
pop ebp
ret 4