joyce8/EMBER2024-capa huggingface dataset:
Function at 0x791258f8
Capabilities:
Packed with generic packer

Disassembly:
mov al, bh
shld ax, di, 1
push ebp
aad 0xaa
clc
rcl bp, 9
xor al, 0xf3
mov ebp, esp
setg ah
shr ax, 0xf
sub esp, 0x58
aas
bswap ax
add ah, al
mov eax, dword [0x79069330]
call fcn.790fa617

Function at 0x79128383
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
pushal
pushfd
lea esp, [esp + 0x28]
call fcn.7903b710
movsx cx, bl
sar cx, cl
aad 0x3e
add esp, 0xc
sal al, 4
sal cx, 5
daa
mov eax, 0x5f
sub ch, 0xa4
or dx, sp
mov word [ebp - 0x84], ax
or ax, 0x8052
bswap cx
bsf eax, ebp
mov eax, 0x65
btr dx, sp
mov word [ebp - 0x82], ax
sar cl, 6
bsf dx, sp
bt di, 3
btc ax, 0xe
mov eax, 0x76
xadd dh, ch
add cl, ah
jmp fcn.790ce88e
bsf edx, ecx
mov eax, 0x65
add esp, 8
lea esp, [esp + 4]
jo 0x790aaed9
push eax
jmp 0x790a4901
jmp loc.790163de
pushfd
jmp 0x7908585f
pushfd
mov dword [esp], eax
jmp 0x790846e8
pushfd
lea esp, [esp + 8]
call fcn.7903b710
sbb ax, cx
add esp, 0xc
rdtsc
sbb ah, 0x59
rcl ah, 3
mov eax, 0x5f
pushfd
adc dh, 0xde
sar cl, cl
pushfd
mov word [ebp - 0x84], ax
jmp 0x7908491b
push ecx
pushfd
cwde
not al
lea eax, [ebp - 0x2c]
lea esp, [esp + 8]
jge 0x790a6649
push edx
mov dword [esp], eax
pushfd
mov word [esp], 0x1293
jmp 0x790bdfd5
lea esp, [esp + 0x10]
call fcn.7903b710
clc
clc
stc
push 0xab46ecb6
add esp, 0x10
jmp 0x791230b4
push 0xc
pushfd
mov dword [esp], 0
pushfd
mov byte [esp], ch
lea esp, [esp + 4]
jmp 0x790c43df
mov dword [esp + 0xc], eax
push edx
jmp 0x791032e6

Function at 0x7912ec72
Capabilities:
Encrypt data using rc4 prga
Packed with generic packer

Disassembly:
movzx bp, al
movzx bp, dl
call fcn.791156a2
push esp
xchg ebx, eax
sbb ebx, dword [ebp + 0x59a1fb63]
push ds
cwde
rcl dword [esi + esi], 0x52
jbe 0x7908bfe2
inc ebx
dec esi
shr byte [esi + ebp*8 + 0x40], 1
fsubr dword [esi + ebp*8 - 0x4a]
dec eax
invalid
or ebx, dword [ebp - 0x23]
imul edi, ecx, 0x41
inc ecx
sbb al, 0xd9
pop esi
out 0x4a, al
aam 0x14
mov edi, 0x3f0e9e79
lds edi, [ecx - 0x563e3b98]
test eax, 0xcd011658
jbe 0x7908c02a
sub ecx, dword [ecx + 0x12ed3fc1]
call 0x9e9deb57
cmp dword [eax - 0x24], 0xffffffed
jp 0x7908c043
leave
push esi
lcall 0x38ac, 0x9d0f8949
movsd dword es:[edi], dword [esi]
in al, dx
push ss
scasb al, byte es:[edi]
in eax, dx
inc ebx
fild dword [eax]
mov bl, 0x7c
inc eax
sbb edi, dword [ebp - 0x38c1e8c3]
inc eax
pushfd
mov ebx, 0xb687b17b
mov edx, 0x575cb92
int1
invalid
jnp 0x7908bfdd
xchg dword [esi + 0x75cb92ba], esi
add eax, 0xefde62f1
imul edx, dword [esp + ecx*2], 0x52
mov al, byte [0x6e8b1f13]
mov edx, 0x5397d3e3
xchg edi, eax
push ebx
clc
mov ecx, 0xa58ad9a8
pop eax
sub ah, byte [eax + 0x5f]
xchg esp, eax
xlatb
or edi, dword [ecx + edi + 0x72e26574]
xor al, byte [ebx]
rcl dword [esi + esi - 0x3d], 0x66
popal
loope 0x7908c0d9
lds edi, [edx]
adc dword [ecx], edx
invalid
leave
push ebx
btr ecx, ecx
btr eax, 8
shrd cx, dx, cl
push esi
btr eax, esp
or ecx, 0x11c7bd7b
bsf ecx, esi
aad 0x79
push edi
setno ch
daa
jmp 0x790314e6
mov esp, ebp
jmp 0x7908bf74
Function at 0x7913349b
Capabilities:
Packed with generic packer

Disassembly:
mov edi, 0x373d2d0
add ecx, dword [ebx]
imul dword [edi - 0x5d45c39a]
lea esp, [esp + 0x28]
je 0x791475f7
pushal
clc
call fcn.790945e7
adc al, 0x9b
pop ds
inc ebx
outsb dx, byte [esi]
insd dword es:[edi], dx
fcmovu st(0), st(2)
push ss
ja 0x791334f0
cmp eax, 0x72850ba4
xchg edi, eax
out dx, eax
jg 0x79133481
mov bh, 0x3c
in al, dx
invalid
popal
xlatb
pop ecx
mov eax, dword [0x4f340b0e]
jp 0x7913348f
mov byte es:[esi - 0x17], bl
dec esp
pop ebx
cmp byte [ecx + eax*8 - 0x6d], 0x59
sub al, 0x90
rcl byte [edi - 0x65]
out dx, eax
adc ebx, dword [ecx + 0x4bfce248]
add cl, byte [esi]
push ds
and eax, 0x215ac2aa
mov edx, 0x8705fac5
pop esi
pcmpeqb mm6, qword [edi - 0x57]
pop ebx
mov ah, 8
pop es
pop edx
movsb byte es:[edi], byte [esi]
sbb dword [edx], edx
xchg edi, eax
adc dword [ecx + 0x49], esp
retf 0x2dbe

Function at 0x791338b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x8c], eax
rdtsc
mov al, 0xd7
mov eax, 1
bts cx, bp
imul ecx, eax, 0x2a
cwde
rcl dh, cl
mov edx, dword [ebp - 0x2c]
cwde
cmc
cwde
movzx eax, word [edx + ecx]
btr ecx, 0x10
bt bp, 0xb
not dh
mov dword [ebp - 0x90], eax
bts ax, 0xf
cdq
bts cx, bp
seta ah
mov eax, 1
pop ecx
bswap cx
imul ecx, eax, 0x2c
cmc
rdtsc
mov edx, dword [ebp - 0x2c]
lahf
movzx eax, word [edx + ecx]
lea edx, [ebx + 0x2b87ab67]
mov dh, byte [esp + 8]
bswap ecx
clc
mov dword [ebp - 0x94], eax
stc
mov eax, 1
movzx cx, cl
lea ecx, [edx*4 - 0x1dccceff]
push 0xdeadaa39
imul ecx, eax, 0x2e
pushfd
mov edx, dword [ebp - 0x2c]
pop eax
movzx eax, word [edx + ecx]
btc cx, 9
setp ch
seto ch
clc
mov dword [ebp - 0x98], eax
xchg ah, ch
bt dx, dx
btr ax, bp
mov eax, 1
call fcn.7911000e

Function at 0x79133aa6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xa72c125c
mov byte [ebp - 0x6e], 0x11
pushal
push ecx
mov byte [ebp - 0x6d], 0x76
push dword [esp]
pushfd
push ecx
pushfd
lea esp, [esp + 0x38]
jmp fcn.790f7092
jmp 0x790dac25
lea esp, [esp + 0x5c]
jbe 0x790e0181
mov byte [ebp - 0x6e], 0x11
push 0x402006e6
pushal
call fcn.7910729a

Function at 0x79134cb0
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
jne fcn.790e2f9b
jmp 0x7914cac4
cmc
movsx bx, al
mov byte [0x7907049d], 1
xor di, si
bsf bx, bx
movsx edi, bl
pop edi
or bx, 0x4c2f
call fcn.790f0f7b
Function at 0x7913a290
Capabilities:
Packed with generic packer

Disassembly:
push edx
pushfd
jmp 0x790960ac
cmp bl, cl
pushal
pushal
mov dword [esp + 0x3c], ebp
jmp 0x7913b4a8
call fcn.7912edb1
mov ecx, dword [ebp + 8]
call fcn.790ab903
jmp 0x790fac96
push 0x7890adca
call fcn.7911674e
lea eax, [ebp - 0x18]
pushal
mov dword [esp + 0x20], eax
pushal
mov word [esp + 4], 0xf196
jmp 0x7911cc3e
add bp, si
bts bp, si
movzx ebp, al
lea ebp, [esp + 0x3c]
mov dword [esp + 4], ecx
cmc
pushfd
clc
sub esp, 0
clc
push ebx
cmp bl, 0xa0
push esi
cmp bx, bp
push edi
cmc
cmp ch, al
cmp dword [0x790704e0], 0
pushal
pushal
lea esp, [esp + 0x40]
je 0x7913a6fd
push 0x801498bd
pop eax
not ax
mov al, dh
mov eax, dword [0x790704e0]
pushal
push dword [esp + 0xc]
mov byte [esp + 0x10], dl
mov dword [esp + 0x20], eax
pushfd
lea esp, [esp + 0x24]
jg 0x79033309
pushal
mov dword [esp + 0x1c], 0x7913a6fd
call fcn.790d4741

Function at 0x7913ed12
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x10]
jne 0x790b1edb
aam 0x5d
shl eax, cl
lea eax, [0x4b33339d]
movzx eax, byte [ebp - 5]
bt si, bp
jmp 0x791416c9
cmp eax, 1
call fcn.79088833

Function at 0x7914c86c
Capabilities:
Packed with generic packer

Disassembly:
cmp bx, bx
pushal
bt cx, 9
mov dword [eax], 1
pushfd
jmp 0x79030f3d
pushfd
push dword [esp + 0xc]
lea esp, [esp + 0x34]
call fcn.79019cf0
clc
push 0x3d64b467
sub esp, 0xfffffffc
js 0x790de712
mov dword [eax], 1
jmp 0x7910b1e5

Function at 0x7914caa1
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ah, ch
jmp 0x79126e1e
cmp eax, dword [0x790705b8]
pushal
lea esp, [esp + 0x24]
je 0x79121904
jmp 0x790a994a

Function at 0x79150059
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], sp
push ebp
lea esp, [esp + 0x2c]
je 0x790f53c7
lea esp, [esp + 8]
call fcn.79008c40
push ebp
movsx cx, al
movzx ecx, al
cmc
pushal
stc
pushfd
test ecx, ecx
jmp 0x7909465e

Function at 0x79151719
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movzx ax, cl
mov byte [ebp - 0x13], 0x72
setbe al
lahf
lea esp, [esp + 8]
js 0x791061c1
pushfd
mov byte [ebp - 0x12], 0x74
setnp ah
lahf
call fcn.790289ed
push esi
mov byte [ebp - 0x12], 0x74
not ax
movsx ax, cl
mov ah, byte [esp]
pop eax
mov byte [ebp - 0x11], 0x75
movzx eax, bl
bswap ax
mov byte [ebp - 0x10], 0x61
pushfd
mov byte [ebp - 0xf], 0x6c
setno ah
movsx ax, bl
bswap ax
lea eax, [edi*8 - 0x21b9525]
mov byte [ebp - 0xe], 0x4d
cwde
push dword [esp]
pop eax
mov byte [esp], 0x6d
mov byte [ebp - 0xd], 0x65
lahf
mov byte [ebp - 0xc], 0x6d
pushal
mov byte [ebp - 0xb], 0x6f
call fcn.79105a40
not ax
lahf
mov byte [ebp - 0x14], 0x69
push eax
lahf
jmp 0x790a0344
Function at 0x4db500
Capabilities:
Create http request
Initialize winsock library
Read data from internet
Receive data

Disassembly:
sub esp, 0x394
lea eax, [esp + 4]
push ebp
push esi
push edi
push str._PUK3_newest.txt
push str.http:__127.0.0.1_s
push eax
call fcn.0050543d
add esp, 0xc
push 0
push 0
push 0
push 0
push str.CROSSGATE
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebp, eax
test ebp, ebp
je 0x4db55d
push 0
push closesocket
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
jne 0x4db58b
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea eax, [esp + 0x210]
xor esi, esi
push eax
push 0x101
mov dword [0xc30798], esi
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x4db696
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x394
ret
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [0xc307a0], eax
lea edx, [eax + 0x800]
mov dword [esp + 0xc], 0x800
cmp edx, 0x4000
ja 0x4db5dc
lea ecx, [esp + 0xc]
lea edx, [eax + 0xc307a4]
push ecx
push 0x800
push edx
push esi
call edi
test eax, eax
je 0x4db60c
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4db61d
mov eax, dword [0xc307a0]
add eax, ecx
mov dword [0xc307a0], eax
jmp 0x4db598
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebp
call esi
mov eax, dword [0x8e53fc]
push 0x10
push str.NewestInitNetWork
push str.newest.txt_read
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x394
ret
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebp
call esi
jmp 0x4db55d
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebp
call esi
mov ecx, dword [0xc307a0]
mov byte [ecx + 0xc307a4], 0
movsx ecx, word [0x54a164]
lea eax, [ecx + ecx*2]
shl eax, 6
add eax, ecx
lea ecx, [esp + 0x110]
lea edx, [eax + 0xc1fef0]
lea eax, [eax + 0xc1fe70]
push edx
push eax
push str._s:_s
push ecx
call fcn.0050543d
lea edx, [esp + 0x120]
push edx
push 0xc307a4
call fcn.00505660
add esp, 0x18
test eax, eax
je 0x4db55d
mov eax, 1
pop edi
pop esi
mov dword [0xc30798], eax
pop ebp
add esp, 0x394
ret
mov dword [0xc307a0], esi
pop edi
pop esi
mov byte [0xc307a4], 0
mov eax, 1
pop ebp
add esp, 0x394
ret
Function at 0x4db6c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
mov eax, dword [0xc30798]
sub esp, 0x20
test eax, eax
jne 0x4db79f
mov eax, dword [str.127.0.0.1]
mov ecx, dword [0x54a534]
mov edx, dword [0x54a538]
mov dword [esp], eax
mov eax, dword [0x54a53c]
push 0
push 1
push 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [0xc3079c], eax
jne 0x4db714
mov eax, 0xfffffffd
add esp, 0x20
ret
push 0x50
mov word [esp + 0x14], 2
call sub.WSOCK32.dll_htons
lea ecx, [esp]
mov word [esp + 0x12], ax
push ecx
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x4db767
lea edx, [esp]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x4db75c
mov eax, dword [0xc3079c]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, 0xfffffffc
add esp, 0x20
ret
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esp + 0x14], eax
mov edx, dword [0xc3079c]
lea ecx, [esp + 0x10]
push 0x10
push ecx
push edx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x4db79f
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4db79f
mov eax, dword [0xc3079c]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, 0xfffffffb
add esp, 0x20
ret
mov eax, 1
add esp, 0x20
ret

Function at 0x4db7b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0xc30798]
sub esp, 0x100
test eax, eax
jne 0x4db7fa
push edi
push str._PUK3_newest.txt
lea eax, [esp + 8]
push 0x54a540
push eax
call fcn.0050543d
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0xc3079c]
push 0
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xc]
push ecx
push edx
call sub.WSOCK32.dll_send
pop edi
add esp, 0x100
ret
Function at 0x504e70
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov eax, 0x1008
call fcn.005067e0
mov eax, dword [esp + 0x100c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x101c]
mov ebp, ecx
test eax, eax
mov dword [esi], 0xffffffff
je 0x504f81
cmp byte [eax], 0
je 0x504f81
push 0
push 0x80
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
jne 0x504ee0
mov dword [ebp + 0x400], 2
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1008
ret 8
push edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 0x1000
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x504f5b
mov edx, dword [esp + 0x10]
test edx, edx
je 0x504f57
lea edi, [esp + edx + 0x18]
lea edx, [esp + 0x18]
cmp edx, edi
lea ecx, [esp + 0x18]
jae 0x504f39
mov eax, dword [esi]
xor ebx, ebx
mov bl, byte [ecx]
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [ebp + edx*4]
xor edx, eax
inc ecx
cmp ecx, edi
mov dword [esi], edx
jb 0x504f15
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 0x1000
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x504efd
jmp 0x504f5b
test eax, eax
jne 0x504f65
mov dword [ebp + 0x400], 3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi]
pop edi
not edx
mov dword [esi], edx
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x1008
ret 8
mov dword [ebp + 0x400], 1
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1008
ret 8

Function at 0x508229
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x508249
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00506183
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x50826c
test byte [esp + 8], 2
je 0x50826c
call fcn.005061f6
mov dword [eax], 0xd
call fcn.005061ff
mov dword [eax], 5
jmp 0x508245
xor eax, eax
ret

Function at 0x40b1be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [eax]
add ecx, edi
mov dword [ebp + 0xc], ecx
cmp edi, ecx
jae 0x40b255
movzx edx, byte [edi]
xor ecx, ecx
inc ecx
cmp edx, 0xc0
jl 0x40b228
mov eax, edx
and eax, 0xe0
cmp al, 0xc0
jne 0x40b1fb
movzx eax, byte [edi + 1]
push 2
jmp 0x40b222
movzx ecx, byte [edi + 1]
mov eax, edx
shl edx, 8
and eax, 0xf0
or edx, ecx
shl edx, 8
cmp al, 0xe0
movzx eax, byte [edi + 2]
jne 0x40b21a
push 3
jmp 0x40b225
or edx, eax
movzx eax, byte [edi + 3]
push 4
shl edx, 8
or edx, eax
pop ecx
mov eax, dword [ebp + 0x14]
add edi, ecx
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0x14]
mov eax, dword [eax + esi*4]
mov dword [edi + esi*4], edx
mov edi, dword [ebp + 8]
cmp edx, eax
jne 0x40b242
add ebx, ecx
shl esi, 4
xor esi, edx
and esi, 0xfff
cmp edi, dword [ebp + 0xc]
jb 0x40b1da
mov eax, dword [ebp + 0x10]
pop edi
mov dword [eax], esi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x100032f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x10177f4b
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101cf40c]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x140]
xor esi, esi
mov ebp, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x138], esi
mov eax, dword [ebp]
lea ecx, [esp + 0x1c]
push ecx
push 0x2001f
push esi
push ebx
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp edi, esi
jne 0x10003422
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, esi
je 0x1000337e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
cmp eax, esi
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x14], ecx
jne 0x10003422
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea edx, [esp + 0x24]
push edx
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x40]
push edx
push esi
push ecx
mov dword [esp + 0x38], pe_nt_image_headers32
call edi
test eax, eax
jne 0x10003402
jmp 0x100033c0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.100032f0
mov ebx, eax
cmp ebx, esi
jne 0x1000346c
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push esi
push esi
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x40]
push eax
push esi
push ecx
mov dword [esp + 0x38], pe_nt_image_headers32
call edi
test eax, eax
je 0x100033c0
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x10003415
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov edx, dword [ebp]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x10003440
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov eax, edi
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.101179ba
add esp, 0x128
ret 4
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x1000348a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov eax, ebx
jmp 0x10003442
Function at 0x10009060
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x20
push 0x101834c4
mov eax, dword [ebp + 8]
push eax
call fcn.101191b9
add esp, 0xc
mov dword [ebp - 8], eax
mov ecx, ecx
cmp dword [ebp - 8], 0
jne 0x1000908b
xor al, al
jmp 0x10009124
push 2
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10119134
add esp, 0xc
mov esi, esi
mov edx, dword [ebp - 8]
push edx
call fcn.1011903f
add esp, 4
mov dword [ebp - 4], eax
push edx
pop edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.10119134
add esp, 0xc
nop
mov ecx, dword [ebp - 4]
push ecx
call fcn.1011741c
add esp, 4
mov dword [ebp - 0xc], eax
mov dl, dl
cmp dword [ebp - 0xc], 0
jne 0x100090e8
mov edx, dword [ebp - 8]
push edx
call fcn.10118b74
add esp, 4
mov ch, ch
xor al, al
jmp 0x10009124
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 0xc]
push edx
call fcn.10118e8c
add esp, 0x10
mov eax, eax
mov eax, dword [ebp - 8]
push eax
call fcn.10118b74
add esp, 4
mov ch, ch
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
push eax
pop eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov ecx, ecx
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1000b4d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x50
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
push ebp
mov dword [esp + 0x24], eax
mov eax, 0x6c
mov dword [esp + 0x20], edx
mov edx, 0x64
push esi
push edi
mov dword [esp + 0x24], ecx
mov word [esp + 0x44], 0x6e
mov word [esp + 0x46], 0x74
mov word [esp + 0x48], dx
mov word [esp + 0x4a], ax
mov word [esp + 0x4c], ax
mov word [esp + 0x4e], 0x2e
mov word [esp + 0x50], dx
mov word [esp + 0x52], ax
mov word [esp + 0x54], ax
mov word [esp + 0x56], 0
mov dl, dl
mov cl, 0x72
mov byte [esp + 0x32], al
mov al, 0x65
mov byte [esp + 0x30], 0x52
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x33], 0x43
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], al
mov byte [esp + 0x36], 0x61
mov byte [esp + 0x37], 0x74
mov byte [esp + 0x38], al
mov byte [esp + 0x39], 0x55
mov byte [esp + 0x3a], 0x73
mov byte [esp + 0x3b], al
mov byte [esp + 0x3c], cl
mov byte [esp + 0x3d], 0x54
mov byte [esp + 0x3e], 0x68
mov byte [esp + 0x3f], cl
mov byte [esp + 0x40], al
mov byte [esp + 0x41], 0x61
mov byte [esp + 0x42], dl
mov byte [esp + 0x43], 0
nop
lea eax, [esp + 0x44]
push eax
call fcn.100f5550
add esp, 4
mov esi, eax
mov edi, edx
mov esi, esi
lea ecx, [esp + 0x30]
push ecx
push edi
push esi
call fcn.100f5db0
add esp, 0xc
mov ecx, eax
mov ebp, edx
mov al, al
or esi, edi
je 0x1000b62a
mov edx, ecx
or edx, ebp
je 0x1000b62a
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov bl, bl
mov al, al
lea eax, [esp + 0x14]
cdq
push edx
push eax
lea eax, [esp + 0x14]
cdq
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push esi
push esi
push eax
push edx
mov eax, dword [esp + 0x4c]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
cdq
push edx
push eax
push 0xa
push ebp
push ecx
call fcn.100f52e0
add esp, 0x5c
cmp eax, esi
jne 0x1000b61e
cmp edx, esi
je 0x1000b63e
push edx
push eax
call fcn.100f5ce0
add esp, 8
mov bh, bh
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.101179ba
add esp, 0x50
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0xffffffff
neg eax
sbb eax, eax
pop edi
and eax, ecx
mov ecx, dword [esp + 0x54]
pop esi
pop ebp
xor ecx, esp
call fcn.101179ba
add esp, 0x50
ret

Function at 0x1000c678
Capabilities:
Create thread

Disassembly:
push dword [ebp + 0x10]
push dword [ebp - 0x148]
push dword [0x102e4b6c]
jmp fcn.1000b400
Function at 0x1001c2e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], eax
mov al, 0x64
push ebp
mov ebp, dword [esp + 0x34]
mov cl, 0x61
mov byte [esp + 0xd], al
mov byte [esp + 0x15], al
mov al, 0x6c
push esi
push edi
mov byte [esp + 0x14], cl
mov byte [esp + 0x16], 0x76
mov byte [esp + 0x17], cl
mov byte [esp + 0x18], 0x70
mov byte [esp + 0x19], 0x69
mov byte [esp + 0x1a], 0x33
mov byte [esp + 0x1b], 0x32
mov byte [esp + 0x1c], 0x2e
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], 0
mov edx, edx
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
mov dl, dl
push ebx
pop ebx
test esi, esi
je 0x1001c3ea
mov al, 0x65
mov byte [esp + 0x24], 0x52
mov byte [esp + 0x25], al
mov byte [esp + 0x26], 0x67
mov byte [esp + 0x27], 0x4f
mov byte [esp + 0x28], 0x70
mov byte [esp + 0x29], al
mov byte [esp + 0x2a], 0x6e
mov byte [esp + 0x2b], 0x4b
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], 0x79
mov byte [esp + 0x2e], 0x45
mov byte [esp + 0x2f], 0x78
mov byte [esp + 0x30], 0x41
mov byte [esp + 0x31], 0
push ebx
pop ebx
lea edx, [esp + 0x24]
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
mov al, al
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push edx
pop edx
test edi, edi
je 0x1001c3ea
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
push ebx
push ebp
call edi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.101179ba
add esp, 0x28
ret 0x14
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.101179ba
add esp, 0x28
ret 0x14

Function at 0x1001e070
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push esi
push edi
mov ah, ah
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
mov esi, esi
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], ecx
mov eax, eax
mov dword [esp + 0x10], 0
push ecx
pop ecx
call fcn.1003e860
mov edi, eax
mov dl, dl
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0x1001dfe0
push 0
push 0
call fcn.10119ed7
add esp, 0x18
mov esi, eax
mov ecx, ecx
push edi
call fcn.1003e920
add esp, 4
mov cl, cl
test esi, esi
jne 0x1001e0d3
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ecx, ecx
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, edx
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0xc
ret