joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12ab222
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
mov esi, ecx
je 0x12ab3f7
cmp dword [ebp + 0xc], ebx
je 0x12ab3f7
push dword [esi + 0x14]
call fcn.01043bb7
push dword [esi + 0xc]
mov dword [esi + 0x14], ebx
call fcn.01043bb7
mov eax, dword [esi + 0x20]
cmp eax, ebx
pop ecx
pop ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
je 0x12ab26c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [esi + 0x20], ebx
lea eax, [esi + 0x24]
cmp dword [eax], ebx
jne 0x12ab2a3
push 0xf0000000
push 0x18
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x12ab2a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x12ab29b
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 0xc], eax
jmp 0x12ab3fe
push dword [esi + 0xc]
call fcn.01043bb7
mov eax, dword [ebp + 0xc]
pop ecx
mov dword [esi + 0xc], ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x12ab2b5
sub eax, ecx
sar eax, 1
mov dword [esi + 0x10], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01043ba8
cmp eax, ebx
pop ecx
mov dword [esi + 0xc], eax
jne 0x12ab2ef
mov dword [ebp + 0xc], 0x8007000e
jmp 0x12ab403
push dword [ebp + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
push ecx
push eax
call fcn.01050bf6
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x12ab3fe
mov eax, dword [ebp + 8]
push 4
mov ecx, 0x1021090
pop edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12ab337
cmp dx, bx
je 0x12ab333
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12ab337
add eax, edi
add ecx, edi
cmp dx, bx
jne 0x12ab313
xor eax, eax
jmp 0x12ab33c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x12ab351
mov eax, 0x660e
mov dword [esi + 8], 1
jmp 0x12ab3d5
mov eax, dword [ebp + 8]
mov ecx, 0x1021038
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12ab37d
cmp dx, bx
je 0x12ab379
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12ab37d
add eax, edi
add ecx, edi
cmp dx, bx
jne 0x12ab359
xor eax, eax
jmp 0x12ab382
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x12ab394
mov eax, 0x660f
mov dword [esi + 8], 2
jmp 0x12ab3d5
mov eax, dword [ebp + 8]
mov ecx, 0x1020fe0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12ab3c0
cmp dx, bx
je 0x12ab3bc
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12ab3c0
add eax, edi
add ecx, edi
cmp dx, bx
jne 0x12ab39c
xor eax, eax
jmp 0x12ab3c5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x12ab3ee
mov eax, 0x6610
mov dword [esi + 8], 3
lea ecx, [esi + 0x20]
push ecx
push 1
push eax
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x12ab3fe
jmp 0x12ab287
mov dword [ebp + 0xc], 0x80049e2e
jmp 0x12ab403
mov dword [ebp + 0xc], 0x80070057
cmp dword [ebp + 0xc], ebx
jge 0x12ab41e
push dword [esi + 0x14]
call fcn.01043bb7
push dword [esi + 0xc]
mov dword [esi + 0x14], ebx
call fcn.01043bb7
pop ecx
pop ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x12b0314
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
jne 0x12b0336
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
leave
ret 0xc
cmp dword [ebp + 0xc], edi
push esi
je 0x12b0367
lea ecx, [ebp - 4]
push ecx
push 0x20019
push edi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x12b0359
cmp dword [ebp - 4], edi
jne 0x12b036a
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
jmp 0x12b0331
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], edi
je 0x12b0388
push edi
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x12b038b
xor esi, esi
inc esi
cmp dword [ebp + 0xc], edi
je 0x12b035b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x12b035b

Function at 0x12b039b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], esi
jne 0x12b03c9
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x12b0436
cmp dword [ebp + 0xc], esi
je 0x12b03ee
lea ecx, [ebp - 4]
push ecx
push 0x20019
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x12b03eb
cmp dword [ebp - 4], esi
jne 0x12b03f1
push eax
jmp 0x12b03bf
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
jne 0x12b041a
cmp dword [ebp - 0xc], 4
je 0x12b041d
push 0xd
pop edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0xc], esi
je 0x12b042b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0xc
Function at 0x12b0743
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
xor esi, esi
xor eax, eax
cmp dword [ebp + 0x1c], esi
push edi
setne al
mov edi, 0x80
inc eax
mov dword [ebp + 0x1c], eax
add edi, edi
test esi, esi
je 0x12b0776
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [edi + edi]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x12b07c1
cmp dword [ebp + 0x18], 0
je 0x12b07a1
push dword [ebp + 8]
push edi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x12b07c3
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x12b07ad
mov eax, 0x1007204
push dword [ebp + 8]
push edi
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x12b07c3
xor eax, eax
mov ecx, edi
sub ecx, dword [ebp + 0x1c]
cmp eax, ecx
jae 0x12b0764
cmp dword [ebp + 0x14], 0
jne 0x12b07eb
test esi, esi
je 0x12b07f8
test eax, eax
jne 0x12b07eb
push esi
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x12b07eb
xor esi, esi
test esi, esi
je 0x12b07f8
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x12b07f8
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x1c

Function at 0x1334792
Capabilities:
Parse pe header

Disassembly:
push ebp
mov edi, edi
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x13347a5
pop ebp
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x13347a1
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
pop ebp
mov eax, ecx
ret

Function at 0x135e7d5
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x135e86a
lea eax, [ecx + 0x110]
mov dword [ebp - 0x10], eax
movzx eax, byte [eax]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x111]
mov dword [ebp - 0x14], eax
movzx eax, byte [eax]
add ecx, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov esi, edi
add esi, dword [ebp + 0xc]
push ebp
mov ebp, dword [ebp - 0xc]
add eax, 1
and eax, 0xff
movzx ecx, byte [eax + ebp]
add ebx, ecx
and ebx, 0xff
movzx edx, byte [ebx + ebp]
mov byte [eax + ebp], dl
add edx, ecx
mov byte [ebx + ebp], cl
and edx, 0xff
movzx ecx, byte [edx + ebp]
xor byte [edi], cl
add edi, 1
cmp edi, esi
jb 0x135e820
pop ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov al, byte [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov byte [ecx], al
mov al, byte [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov byte [ecx], al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x135eab1
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], esi
jbe 0x135eb02
push ebx
push edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [eax + esi]
call fcn.0132bab4
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov byte [ebp - 1], al
mov eax, dword [ebp + 0xc]
lea ebx, [eax + esi]
call fcn.0135e947
xor al, byte [ebp - 1]
mov edx, ebx
mov byte [ebp - 0xc], al
push dword [ebp - 0xc]
mov ecx, edi
call fcn.0132baf7
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x135eac6
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x1368578
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ecx]
dec eax
je 0x136859d
dec eax
je 0x1368597
dec eax
je 0x1368591
mov eax, 0xc004d104
pop ebp
ret 0x10
pop ebp
jmp fcn.0136ee6c
pop ebp
jmp fcn.0136f5a0
pop ebp
jmp fcn.0136f77d
Function at 0x1368ba8
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x88], esi
cmp dword [ebp + 8], edi
jne 0x1368c17
cmp esi, edi
je 0x1368c1b
mov edi, 0x80070057
test edi, edi
jge 0x1368c04
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x1368c04
test byte [eax + 0x1c], 2
je 0x1368c04
push edi
push 0x10280f0
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01043c41
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01043035
leave
ret 0xc
cmp esi, edi
je 0x1368bd6
mov eax, dword [ebx]
dec eax
je 0x1368c34
dec eax
je 0x1368c2d
dec eax
jne 0x1368c45
call fcn.0136ee5d
jmp 0x1368c39
call fcn.0136f591
jmp 0x1368c39
call fcn.0136f76e
mov edi, eax
test edi, edi
jl 0x1368bdf
mov esi, dword [ebp - 0x88]
test esi, esi
je 0x1368bdb
cmp esi, 0x40
jbe 0x1368cab
push esi
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp + 8]
call fcn.01368687
mov edi, eax
xor esi, esi
cmp edi, esi
jl 0x1368bdf
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, ebx
mov dword [ebp - 0x88], 0x40
call fcn.01368810
mov edi, eax
cmp edi, esi
jl 0x1368bdf
push esi
push ecx
push ecx
mov eax, esp
mov ecx, ebx
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.01368ba8
mov edi, eax
cmp edi, esi
jl 0x1368bdf
jmp 0x1368ce1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x44]
mov dword [ebp - 0x8c], eax
test esi, esi
jbe 0x1368ce7
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x90]
inc dword [ebp - 0x8c]
call fcn.0132bab4
mov byte [edi], al
inc edi
dec esi
jne 0x1368cc4
mov esi, dword [ebp - 0x88]
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
push eax
call sub.msvcrt.dll_memcpy
push 0x40
pop edi
sub edi, esi
push edi
lea eax, [ebp + esi - 0x44]
push 0x36
push eax
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp + esi - 0x84]
push 0x5c
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
xor eax, eax
test esi, esi
jbe 0x1368d35
xor byte [ebp + eax - 0x44], 0x36
xor byte [ebp + eax - 0x84], 0x5c
inc eax
cmp eax, esi
jb 0x1368d23
and dword [ebp - 0x8c], 0
lea eax, [ebp - 0x84]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x90], eax
call fcn.0132bbe7
push 0x40
push ecx
push ecx
mov ecx, esp
and dword [ecx + 4], 0
mov dword [ecx], eax
mov ecx, ebx
call fcn.01368687
mov edi, eax
xor edx, edx
cmp edi, edx
jl 0x1368bdf
push 0x10
pop ecx
lea esi, [ebx + 0x54]
lea edi, [ebx + 0x9c]
rep movsd dword es:[edi], dword [esi]
push edx
push ecx
push ecx
mov eax, esp
mov ecx, ebx
mov dword [eax], edx
mov dword [eax + 4], edx
call fcn.01368ba8
mov edi, eax
test edi, edi
jl 0x1368bdf
and dword [ebp - 0x8c], 0
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x90], eax
call fcn.0132bbe7
push 0x40
push ecx
push ecx
mov ecx, esp
and dword [ecx + 4], 0
mov dword [ecx], eax
mov ecx, ebx
call fcn.01368687
mov edi, eax
test edi, edi
jl 0x1368bdf
mov byte [ebx + 0x9a], 1
jmp 0x1368bdb
Function at 0x13706a8
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x10283c4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.01044c5f
cmp dword [ebp - 4], 0
jge 0x13706f7
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x13706f7
test byte [eax + 0x1c], 2
je 0x13706f7
push dword [ebp - 4]
push 0x10283a4
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01043c41
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x1370911
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
cmp dword [ebp + 8], esi
jne 0x1370939
mov edi, 0x80070057
jmp 0x1370a48
cmp dword [ebp + 0xc], esi
je 0x137092f
cmp dword [ebp + 0x10], esi
je 0x137092f
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push esi
mov ebx, 0x10283c4
push ebx
push dword [ebp + 8]
call edi
push eax
call fcn.01044c5f
test eax, eax
je 0x1370a41
cmp dword [ebp - 0x18], 1
je 0x1370980
mov edi, 0x8007000d
jmp 0x1370a48
push dword [ebp - 0x14]
call fcn.01043ba8
pop ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
call fcn.0108349d
mov eax, dword [ebp - 0x1c]
cmp eax, esi
jne 0x13709a8
mov dword [ebp - 0xc], esi
mov edi, 0x8007000e
jmp 0x1370a48
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
push dword [ebp + 8]
call edi
push eax
call fcn.01044c5f
test eax, eax
je 0x1370a41
mov edi, dword [ebp - 0x1c]
push 0x7c
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
pop ecx
pop ecx
cmp ebx, esi
je 0x1370a1f
lea eax, [ebp - 8]
push eax
mov eax, ebx
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.010600cb
mov edi, eax
cmp edi, esi
jl 0x1370a48
lea eax, [ebp - 4]
push eax
add ebx, 2
push ebx
call fcn.010467e1
mov edi, eax
cmp edi, esi
jl 0x1370a48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ecx], eax
jmp 0x1370a44
lea eax, [ebp - 4]
push eax
push edi
call fcn.010467e1
mov edi, eax
cmp edi, esi
jl 0x1370a48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], esi
mov dword [eax], esi
jmp 0x1370a44
mov edi, dword [ebp - 0x10]
cmp edi, esi
jge 0x1370a6d
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x1370a6d
test byte [eax + 0x1c], 2
je 0x1370a6d
push edi
push 0x10283a4
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01043c41
lea ecx, [ebp - 8]
call fcn.010454cc
lea ecx, [ebp - 4]
call fcn.010454cc
lea ecx, [ebp - 0xc]
call fcn.0108349d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1370bea
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov edi, 0x1426c54
cmp dword [ebp + 0xc], ebx
jne 0x1370c0c
mov esi, 0x80070057
jmp 0x1370cd4
lea eax, [ebp - 4]
cmp dword [ebp + 0x10], ebx
jne 0x1370c1f
push eax
push dword [ebp + 0xc]
call fcn.010467e1
jmp 0x1370c33
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0x10283d8
push eax
call fcn.01046b10
add esp, 0x10
mov esi, eax
cmp esi, ebx
jl 0x1370cd4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp + 0xc]
push ecx
push 1
push eax
mov dword [ebp + 0xc], eax
call fcn.01043e7f
mov esi, eax
cmp esi, ebx
jl 0x1370cd4
mov ecx, dword [ebp + 0xc]
xor esi, esi
cmp ecx, ebx
je 0x1370d0c
lea eax, [ecx + ecx]
mov edx, eax
shr edx, 1
cmp edx, ecx
je 0x1370d07
mov ecx, 0x80070216
mov esi, ecx
mov eax, dword [0x1426c54]
cmp eax, edi
je 0x1370ca5
test byte [eax + 0x1c], 2
je 0x1370ca5
push ecx
push 0x10283b4
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01043c41
mov eax, dword [0x1426c54]
cmp esi, ebx
mov dword [ebp + 0x10], esi
jl 0x1370cd9
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push 1
push ebx
push 0x10283c4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.01044c5f
mov esi, dword [ebp + 0x10]
cmp esi, ebx
jge 0x1370cf6
mov eax, dword [0x1426c54]
cmp eax, edi
je 0x1370cf6
test byte [eax + 0x1c], 2
je 0x1370cf6
push esi
push 0x10283a4
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01043c41
lea ecx, [ebp - 4]
call fcn.010454cc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
mov dword [ebp + 0xc], eax
jmp 0x1370ca0
mov dword [ebp + 0xc], ebx
xor esi, esi
jmp 0x1370ca0
Function at 0x13715b0
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea ecx, [ebp - 0x118]
call fcn.0135e771
xor edi, edi
cmp dword [ebp + 0x10], edi
jne 0x13715f8
xor esi, esi
lea ecx, [ebp - 0x118]
call fcn.0135e783
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01043035
leave
ret 0xc
cmp dword [ebp + 8], edi
jne 0x1371604
mov esi, 0xc004d104
jmp 0x13715db
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ebx
lea eax, [ebp - 0x124]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor dword [ebp - 0x120], eax
mov ebx, dword [ebp - 0x124]
xor ebx, dword [ebp - 0x120]
push 1
push 8
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x118]
call fcn.0132c6c5
cmp dword [ebp + 0x10], edi
jbe 0x13716bf
lea eax, [ebp - 0x124]
push eax
call esi
mov eax, dword [ebp - 0x124]
xor eax, ebx
mov cl, bl
rol eax, cl
lea ecx, [ebp - 0x118]
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
add eax, edi
mov dword [ebp - 0x128], eax
call fcn.0135e947
mov edx, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
xor al, bl
mov byte [ebp - 0x11c], al
call fcn.0132bab4
xor al, byte [ebp - 0x11c]
mov edx, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
mov byte [ebp - 0x130], al
push dword [ebp - 0x130]
call fcn.0132baf7
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x1371647
pop ebx
jmp 0x13715d9
Function at 0x13720bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
faddp st(6)
inc ebp
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.01371d3e
push eax
push esi
push dword [ebp + 8]
call fcn.01371cf3
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.01371d3e
push eax
push esi
push dword [ebp + 8]
call fcn.01371cf3
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.01371d3e
push eax
push esi
push dword [ebp + 8]
call fcn.01371cf3
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.01371d2e
outsb dx, byte [esi]
mov esi, 0x9d883af9
jl 0x13721b3
invalid
invalid

Function at 0x1372400
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1372405
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
add byte [eax], al
pushal
jmp 0x1372423
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
mov ch, 0x54
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja 0x1372481
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1372468
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1372471
or byte [eax + ecx], 2
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
cmp dword [ebp + 0x10], ebx
je 0x137247b
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x137245d
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x13723e7
mov dword [ebp + 8], esi
xor edi, edi