joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004f290
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x1014a968]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x1004f381
mov eax, dword [0x1014a960]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x1004f2d5
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x1004f2b8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x1004f381
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.1004f040
mov ecx, dword [0x1014a968]
add esp, 4
cmp esi, ecx
jae 0x1004f335
imul edi, esi, 0x2c
mov eax, dword [0x1014a960]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x1004f32a
mov edx, ebx
mov ecx, esi
call fcn.1004f190
mov dword [ebp - 4], eax
test eax, eax
jne 0x1004f332
mov ecx, dword [0x1014a968]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x1004f301
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1004f381
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1004f372
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1004f366
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x1004f345
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x10149274]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10050df0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x1007c00c]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
push 0x40
lea eax, [esp + 0x24]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0x20
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x2c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x18], 0xefcdab89
add ecx, eax
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
sub edx, eax
mov dword [esp + 0x28], 0
add esp, 0xc
mov dword [esp + 0x20], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x10050e92
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.10050770
push 0x38
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x10050ea1
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x58], eax
lea ecx, [esp + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.10050770
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0xe]
pop esi
xor ecx, esp
call fcn.10064b60
mov esp, ebp
pop ebp
ret

Function at 0x10054060
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [0x1014a5ec]
add ecx, 4
push esi
mov esi, dword [eax + 0x34]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
call eax
mov edx, dword [esi]
mov ecx, esi
push eax
mov edx, dword [edx + 0xc]
call edx
pop esi
mov cl, byte [eax]
test cl, cl
je 0x100540b9
movsx ecx, cl
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
lea ecx, [eax + 1]
call fcn.10013740
cmp eax, 0x7c4a5426
ja 0x100540bc
je 0x100540fa
cmp eax, 0x19acc50e
je 0x100540fa
cmp eax, 0x43d6266e
je 0x100540fa
cmp eax, 0x4d7aa8c1
je 0x100540fa
xor al, al
ret
cmp eax, 0xc941ff64
ja 0x100540e3
je 0x100540fa
cmp eax, 0x9d08c4c8
ja 0x100540dc
je 0x100540fa
cmp eax, 0x7f11af2d
je 0x100540fa
cmp eax, 0x84ea2fe5
jmp 0x100540b7
cmp eax, 0xa7eab73f
jmp 0x100540b7
cmp eax, 0xe80bc214
ja 0x100540fd
je 0x100540fa
cmp eax, 0xd614ea2e
je 0x100540fa
cmp eax, 0xe1525a25
jne 0x100540b9
mov al, 1
ret
cmp eax, 0xf8573d98
sete al
ret

Function at 0x10054110
Capabilities:
Hash data using fnv

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 8]
lea ecx, [edi + 8]
mov eax, dword [eax + 8]
call eax
cmp dword [eax + 0x14], 0xb5
je 0x10054195
mov eax, dword [0x1014a5ec]
lea ecx, [edi + 4]
push esi
mov esi, dword [eax + 0x34]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
call eax
mov edx, dword [esi]
mov ecx, esi
push eax
mov edx, dword [edx + 0xc]
call edx
pop esi
mov cl, byte [eax]
test cl, cl
je 0x10054180
movsx ecx, cl
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
lea ecx, [eax + 1]
call fcn.10013740
cmp eax, 0x5978b32e
ja 0x10054184
je 0x10054195
cmp eax, 0x1b20e275
je 0x10054195
cmp eax, 0x3cb8abb3
je 0x10054195
cmp eax, 0x4c849f3c
je 0x10054195
xor al, al
pop edi
ret
cmp eax, 0x97113ea7
je 0x10054195
cmp eax, 0xa8d619ea
pop edi
sete al
ret
mov al, 1
pop edi
ret
Function at 0x10062990
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [ebp + 0xc], 1
jne 0x100629c3
push 0
push 0
push dword [ebp + 8]
push 0x10062920
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100629c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc

Function at 0x43b642
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
add ebx, 0x856fa550
push 0x451cef8f
pop ebx
mov ebx, ebx
call fcn.0043b679
mov ebx, 0x55ba3586
xor dword [edx], esi
sub ebx, ecx
inc edx
sub ecx, ecx
dec ebx
cmp edx, edi
jne fcn.0043b642
push 0xe6a27d53
mov ebx, dword [esp]
add esp, 4
ret

Function at 0x13a4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x13a41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x13a407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13a406a
add dl, dl
jne 0x13a4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13a40dc
xor eax, eax
add dl, dl
jne 0x13a4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13a417d
add dl, dl
jne 0x13a40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13a40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13a40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13a40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x13a40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x13a4075
mov eax, 1
add dl, dl
jne 0x13a40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13a40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13a40e1
sub eax, ebx
mov ebx, 1
jne 0x13a4128
mov ecx, 1
add dl, dl
jne 0x13a410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x13a4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13a4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13a4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x13a413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x13a414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13a4136
cmp eax, 0x7d00
jae 0x13a416d
cmp eax, 0x500
jb 0x13a4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13a4075
cmp eax, 0x7f
ja 0x13a4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13a4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x13a419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x13a4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412eaa
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x2a
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xcd
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x56
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x12
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc4
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x22
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc5
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb9
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x25
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x62
add esp, 0x40
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x58
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x35
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe7
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xaf
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d20
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451ba9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451bba
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405907
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b052
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b063
pop esi
ret
push ebx
push edi
push esi
call fcn.0049af39
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b08b
push ebx
push esi
push edi
call fcn.004056fa
add esp, 0xc
push 0
call fcn.00406244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x39
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x20
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xb1
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc3
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xcc
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x30
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa8
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x76
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xeb
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x72
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xd8
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x97
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x85
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x412e87
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
nop dword [eax]
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 7
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x4d
push 0
push 0
push 0
call esi
sub byte [edi + ebp], 0x80
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xb8
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x8d
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x99
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x54
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xbe
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xc3
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xc4
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x29
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x78
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x7b
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x16
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x2b
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xe
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x43
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x50
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x9e
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x94
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x9d
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x8c
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xed
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x23
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x24
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x90
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x7c
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xd4
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x2e
inc edi
cmp edi, ebx
jb 0x412d20
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451c59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451c6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405902
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b112
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b123
pop esi
ret
push ebx
push edi
push esi
call fcn.0049aff9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fd5
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b14b
push ebx
push esi
push edi
call fcn.004056f5
add esp, 0xc
push 0
call fcn.0040623f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x401130
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x20f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x210], bl
call fcn.00403b08
push 0xff
lea ecx, [ebp - 0x313]
push ebx
push ecx
mov dword [ebp - 8], 0xff0ff
mov byte [ebp - 0x314], bl
call fcn.00403b08
xor edx, edx
add esp, 0x18
mov word [ebp - 0x214], dx
cmp esi, ebx
je 0x4012ce
call dword [0x404160]
test eax, eax
je 0x401280
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x102
push ebx
push ebx
push ebx
push str.softwaremicrosoftwindows_ntcurrentversionwinlogon
push 0x80000002
call dword [section..rdata]
test eax, eax
jne 0x4012b6
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
push str.SystemDrive
call dword [0x40406c]
lea edx, [ebp - 0x10c]
push edx
call dword [0x40416c]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x10c]
push ecx
call dword [0x404068]
mov edx, dword [ebp - 8]
push edx
push 0x40452c
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [0x404138]
lea edx, [ebp - 0x210]
add esp, 0x10
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x401221
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401234
sub eax, edx
push edi
mov edi, eax
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 0x314]
call fcn.00401690
lea edx, [ebp - 0x210]
mov ecx, edx
call fcn.004016d0
mov eax, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push 0
mov edx, ebx
push edx
push eax
call dword [0x404004]
xor ebx, ebx
pop edi
jmp 0x4012b6
lea ecx, [ebp - 4]
push ecx
push 0x102
push ebx
push str.softwaremicrosoftwindowscurrentversion_run
push 0x80000001
call dword [0x40400c]
test eax, eax
jne 0x4012b6
mov edx, dword [ebp - 4]
push 0x104
push esi
push 1
push ebx
push str.userinit
push edx
call dword [0x404004]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x4012ce
push eax
call dword [0x404010]
mov eax, dword [ebp - 4]
push eax
call dword [0x404014]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4021b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 3
push ebx
push ebx
push ebx
push str..KmxAgent
mov dword [ebp - 0xb4], 0xb4
mov dword [ebp - 0xb0], 0x10
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], 0x7b761e52
mov dword [ebp - 0x88], 0x1c94cc7
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], 0x20000000
mov dword [ebp - 0x60], 0x1210064
mov dword [ebp - 0x5c], 0x22
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], 0x4d0007
mov dword [ebp - 0x50], 0x730065
mov dword [ebp - 0x4c], 0x610073
mov dword [ebp - 0x48], 0x650067
mov dword [ebp - 0x44], 0x420000
mov dword [ebp - 0x40], 0xb0022
mov dword [ebp - 0x3c], 0x490000
mov dword [ebp - 0x38], 0x530053
mov dword [ebp - 0x34], 0x560045
mov dword [ebp - 0x30], 0x4e0045
mov dword [ebp - 0x2c], 0x490054
mov dword [ebp - 0x28], 0x3d0044
mov dword [ebp - 0x24], 0x300034
mov dword [ebp - 0x20], 0x320030
mov dword [ebp - 0x1c], 0x650000
mov dword [ebp - 0x18], 0x70006d
mov dword [ebp - 0x14], 0x790074
mov dword [ebp - 0x10], 0x45003d
mov dword [ebp - 0xc], 0x70006d
mov dword [ebp - 8], 0x790074
mov dword [ebp - 4], ebx
call dword [0x404074]
mov esi, eax
cmp esi, 0xffffffff
je 0x402330
push ebx
lea eax, [ebp - 0xbc]
push eax
push 4
lea ecx, [ebp - 0xb8]
push ecx
push 0xb4
lea edx, [ebp - 0xb4]
push edx
push 0x86000054
push esi
call dword [0x404038]
push esi
call dword [0x404118]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x675370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x67538e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x69e074
push ecx
mov edi, eax
call fcn.00689198
mov esi, eax
add esp, 8
test esi, esi
jne 0x6753cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0068902e
push esi
call fcn.00688fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x678850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x6788ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x6a3720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x6788ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.006891e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x6788ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x6a3720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x67892a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0068a082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x678957
mov word [eax], si
add eax, 2
push eax
call fcn.0068a030
add esp, 4
jmp 0x678959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x6788ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x6788b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x678ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret