joyce8/EMBER2024-capa huggingface dataset:
Function at 0x185b7a80
Capabilities:
Encode data using xor

Disassembly:
pop dword [ebx + ecx*2]
outsb dx, byte fs:[esi]
outsb dx, byte [esi]
adc dword [edx], 0xfffffff6
sub byte [eax + ebp*2 + 6], al
ja 0x185b7a74
fcom dword [eax - 0x46]
xor dword [edi - 0x5488e5b2], 0xffffffeb
or eax, esp
add byte [ecx - 0x601f961b], bh
sub bh, bh
shl byte [eax + 0x2f], 1
fcompi st(2)
lds eax, [ebx - 0x15d46329]
sbb byte [ebx - 0x3fcb90db], 0xca
movsb byte es:[edi], byte [esi]
ror byte [ecx], 0x44
xchg ebp, eax
lahf
push edi
jge 0x185b7b10
outsd dx, dword [esi]
xor al, 0xc0
retf 0xc0a4
sub cl, byte [ebp + 0x11]
shr dword [esi], cl
loope 0x185b7b0b
pop es
into
jno 0x185b7b35
mov ah, 0x15
inc eax
add eax, 0x9a9d5c6c
scasd eax, dword es:[edi]
jecxz 0x185b7b3c
jno 0x185b7aa0
xchg esp, eax
daa
js 0x185b7ab6
pop eax
out dx, al
invalid
push edx
std
lodsb al, byte [esi]
cmp esp, 0xffffffc4
pushal
dec ecx
mov ch, 0x88
mov al, 0x3d
inc esp
rol bh, 0xde
mov word [edi - 0x6e2b556a], si
cmp byte [esi - 0x3c89e175], bl
cmp al, 0x81
leave
cmp al, 0xb
xor ecx, dword [eax]
rcl byte [edi]
out 0x32, eax
lahf
cwde
invalid
xchg ebp, eax
jbe 0x185b7ab5
pop ebp
mov cl, 0x3c
in eax, dx
sahf
stosb byte es:[edi], al
or al, 0x8e
push ebp
adc al, 0x32
jge 0x185b7ad3
in al, 0xc6
mov ebp, 0xbf64fe55
xchg edi, eax
enter 0xffffffffffffd363, 0x5b
xchg byte [esi - 0x37], al
scasd eax, dword es:[edi]
nop
sbb eax, 0x8189160c
dec edi
stc
pop ebp
invalid
mov eax, 0x499a0dc6
xchg byte [0x45478602], dh
nop
stosb byte es:[edi], al
sbb eax, 0x3d87e3ff
cmp byte [ebp + 0x6a], dl
invalid

Function at 0x185b9f4b
Capabilities:
Encode data using xor

Disassembly:
jge 0x185b9fb1
sbb al, ch
xor ah, cl
add eax, 0x3de1cc00
loope 0x185b9f8a
loope 0x185b9f8a
leave
mov esp, 0x92d5969e
mov dl, 0x65
cmpsw word [esi], word es:[edi]
outsd dx, dword [esi]
pop ss
pushfd
mov ah, 0x30
loop 0x185b9f42
invalid
add byte [ebp - 0x75], dl
in al, dx
add ah, byte [esi - 0x75]
add al, byte [ebx - 0x7a99fd3e]
sal byte [ebp - 0xb], 0x2b
salc
sar edx, 1
push edx
push dword [ebp + 8]
call fcn.185b9fcf
pop esi
pop ebp
ret 4

Function at 0x185c1710
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x185c1781
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x185c174f
cmp eax, 2
jne 0x185c176b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x185c177b
test ecx, ecx
je 0x185c1776
test cl, 1
jne 0x185c176b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x185c177b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x185c21e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x185c21f5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x185c2200
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x185c2556
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push 0x185c254c
push ecx
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
leave
ret

Function at 0x185c36bb
Capabilities:
Encode data using xor

Disassembly:
pop dword [esi + 0x3387bcd5]
and dword [ecx - 2], esi
push 0x62
daa
mov byte [edx], dl
mov esp, 0x387090f3
invalid
Function at 0x185c67a1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0x10], ebx
je 0x185c6816
push esi
push 0x34
call fcn.1861577c
mov esi, eax
pop ecx
test esi, esi
je 0x185c67df
push 0x34
push ebx
push esi
call fcn.1863cad0
add esp, 0xc
push 7
pop eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x30], eax
xor eax, eax
mov dword [esi + 0x2c], ebx
mov word [esi + 0x1c], ax
jmp 0x185c67e1
mov esi, ebx
push edi
mov ecx, esi
call fcn.185b9653
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x1c]
push dword [ebp + 0x10]
mov dword [esi + 0x18], eax
call fcn.185b9653
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push ebx
push esi
push 0x185c20d9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1885e9d4], eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x185cc033
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
xor edx, edx
lea eax, [ebp - 4]
push eax
push edx
push ecx
push 0x185ca817
push edx
push edx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret
Function at 0x185cfcd2
Capabilities:
Encode data using xor

Disassembly:
std
mov byte [0x33e3bc20], al
mov eax, ds
test dword [edi - 0x201f5fa8], 0x50e5c429
mov al, byte [0xc429dfe0]
in eax, 0x50
wait
push ecx
shr byte [edx], 0xfa
mov esi, 0x4e442d8d
inc edi
add byte [edi + 0x65], ch
lds esp, [esi - 0x2672faca]
xor byte [eax], dl
mov al, byte [0x9cbed0f7]
loope 0x185cfcdd
mov ah, dl
movsb byte es:[edi], byte [esi]
invalid
Function at 0x185dc021
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push 3
pop eax
mov ebp, ecx
cmp dword [ebx], eax
je 0x185dc0aa
push esi
push 0x38
mov dword [ebx], eax
call fcn.1861577c
mov esi, eax
pop ecx
test esi, esi
je 0x185dc06a
push 0x38
push 0
push esi
call fcn.1863cad0
and dword [esi + 0x14], 0
add esp, 0xc
xor eax, eax
push 7
pop ecx
mov dword [esi + 0x18], ecx
mov word [esi + 4], ax
and dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov word [esi + 0x20], ax
jmp 0x185dc06c
xor esi, esi
push dword [esp + 0x14]
lea ecx, [esi + 4]
mov dword [esi], ebp
call fcn.185b9653
push dword [esp + 0x18]
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], ebx
call fcn.185b9653
lea eax, [esp + 0x10]
push eax
push 4
push esi
push 0x185dd4fa
push 0
push 0
call fcn.1864db03
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x185dd213
Capabilities:
Create process on windows
Move file

Disassembly:
sub esp, 0x3c
push ebp
xor ebp, ebp
push esi
mov esi, dword [esp + 0x4c]
inc ebp
cmp esi, ebp
jbe 0x185dd369
push ebx
push edi
call fcn.18682520
movzx ecx, byte [esp + 0x60]
lea ebx, [esi + 1]
test al, al
mov esi, 0x186d9d42
push esi
cmove ecx, ebp
mov eax, ebx
mov dword [esp + 0x58], ecx
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1861637c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x185dd367
push esi
xor ecx, ecx
mov eax, ebx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1861637c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x185dd360
push dword [esp + 0x50]
push ebx
push edi
call fcn.185dd370
push dword [esp + 0x50]
push ebx
push esi
call fcn.185dd370
push 0x1885f20c
push edi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
push edi
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor edx, edx
mov dword [esp + 0x10], 0x3c
xor ecx, ecx
mov dword [esp + 0x48], edx
cmp byte [esp + 0x54], cl
mov eax, 0x1885f8dc
xorps xmm0, xmm0
mov dword [esp + 0x14], 0x40
cmovne eax, ecx
movlpd qword [esp + 0x30], xmm0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], eax
movzx eax, byte [esp + 0x5c]
push 6
xor eax, ebp
movlpd qword [esp + 0x3c], xmm0
push edx
movlpd qword [esp + 0x48], xmm0
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x185dd359
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x185dd353
cmp dword [esp + 0x48], 0
je 0x185dd353
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call fcn.18615a4a
pop ecx
push edi
call fcn.18615a4a
pop ecx
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x3c
ret
Function at 0x185ff8d7
Capabilities:
Read .ini file

Disassembly:
push 0x804
mov eax, 0x186bcdab
call fcn.18615cb5
mov edi, ecx
lea ecx, [edi + 0x30]
call fcn.185c5ca0
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.1863cad0
add esp, 0xc
lea eax, [ebp - 0x810]
push dword [edi]
push 0x400
push eax
push 0x1885e1f8
push str.NotifyIfThereIsUpdate
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x1885ea18
lea eax, [ebp - 0x810]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x185ff958
test dx, dx
je 0x185ff954
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x185ff958
add eax, 4
add ecx, 4
test dx, dx
jne 0x185ff932
xor eax, eax
jmp 0x185ff95d
sbb eax, eax
or eax, 1
mov ecx, dword [edi + 8]
test eax, eax
mov eax, dword [ecx]
jne 0x185ff96c
btr eax, 0xa
jmp 0x185ff970
bts eax, 0xa
mov dword [ecx], eax
mov eax, dword [edi + 8]
mov ebx, dword [eax]
shr ebx, 0xa
and bl, 1
and dword [ebp - 4], 0
lea ecx, [edi + 0x30]
call fcn.185c70a0
mov al, bl
call fcn.18615c5f
ret
Function at 0x1860ad00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x186bddb6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x1870626c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x1860adac
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x1860adac
call fcn.186090a0
mov edi, eax
jmp 0x1860aecb
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x1860adcf
call fcn.186090a0
jmp 0x1860aebe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x1860aded
call fcn.186090a0
jmp 0x1860aebe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x1860ae0e
mov edi, 0x8007000e
jmp 0x1860aec0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x1860af04
jb 0x1860ae2c
cmp eax, 0xffffffff
ja 0x1860af04
cmp eax, 0x400
jbe 0x1860ae41
push eax
lea ecx, [ebp - 0x418]
call fcn.18608fcb
jmp 0x1860ae67
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x1860ae67
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x1860ae7e
mov edi, 0x8007000e
jmp 0x1860aec0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x1860ae9e
call fcn.186090a0
jmp 0x1860aebe
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1860ab60
mov edi, eax
test esi, esi
je 0x1860aecb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1860aee4
lea ecx, [ebp - 0x418]
call fcn.18609390
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.18615399
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.185b08f0
int3
Function at 0x1861a475
Capabilities:
Create thread

Disassembly:
loope 0x1861a4b4
leave
sahf
pop ds
xor al, 0xac
adc esi, dword [ecx]
jecxz 0x1861a4e4
retf
and ebp, edx
leave
inc ax
cmp dl, ch
pop ecx
shr dword [edi], 0xf
inc esi
cmp byte [edx - 0x5fa3e9e9], 0xac
cwde
push 0x4e
aaa
invalid
invalid
cwde

Function at 0x1861d25e
Capabilities:
Encode data using xor

Disassembly:
or ebp, dword [edx - 0x50]
mov esp, 0xf0b3c5ef
sub esi, dword [ebx + 0x6c]
lds esi, [ebx + 0x6c732bf0]
mov cl, 0x31
and eax, 0xf092c7d1
mov byte [0xea5a081c], al
outsb dx, byte [esi]
xor dh, byte [ecx + 0x3b]
outsd dx, dword [esi]
leave
cmp bh, ah
mov bl, 0xa3
neg edi
ja 0x1861d263
lodsb al, byte [esi]
iretd

Function at 0x1861dc03
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub eax, edx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edx
sbb esi, esi
not esi
and esi, eax
je 0x1861dc32
movzx eax, byte [edx]
xor eax, dword [ecx]
imul eax, eax, 0x1000193
inc edx
inc edi
mov dword [ecx], eax
cmp edi, esi
jne 0x1861dc1d
jmp 0x1861dc34
mov eax, dword [ecx]
pop edi
pop esi
pop ebp
ret 8

Function at 0x1862dddd
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x1870626c]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push ebp
push esi
push edi
mov edi, 0x1885e744
mov ebx, ecx
mov edx, edi
xor ebp, ebp
lea ecx, [ebx + 0x18]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bp
jne 0x1862de06
sub edx, esi
sar edx, 1
push edx
push edi
call fcn.185b0f02
push 0x208
lea eax, [esp + 0x21c]
push ebp
push eax
call fcn.1863cad0
add esp, 0xc
lea eax, [esp + 0x218]
push 0x104
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [esp + 0x218]
push eax
call esi
lea edx, [esp + 0x218]
lea ecx, [ebx + 0x1c]
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bp
jne 0x1862de71
sub edx, edi
lea eax, [esp + 0x218]
sar edx, 1
push edx
push eax
call fcn.185b0f02
push 0x208
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.1863cad0
add esp, 0xc
lea eax, [esp + 0x10]
push 1
push 0x1a
push eax
push ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1862def7
lea eax, [esp + 0x10]
push eax
call esi
push 0x1885e744
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x10]
push eax
call esi
lea edx, [esp + 0x10]
lea ecx, [ebx + 0x20]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bp
jne 0x1862dedd
sub edx, esi
lea eax, [esp + 0x10]
sar edx, 1
push edx
push eax
call fcn.185b0f02
push 0x18867d4c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1862df2f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x18867d68
push edi
call esi
push 0x18867d88
push edi
mov dword [ebx + 8], eax
call esi
push str.W_IU
push edi
mov dword [ebx + 0xc], eax
call esi
mov dword [ebx + 4], eax
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.18615399
add esp, 0x414
ret
Function at 0x18632e13
Capabilities:
Encode data using xor

Disassembly:
cwde
push es
add byte [ebx + 0x1feb1477], cl
or dword [ecx + 0x37], 0xffffffbc
mov bh, 0x77
jle 0x18632dd9
mov esp, 0xbe7e77b7
dec edx
mov dh, 0x1c
clc
mov dh, cl
add bh, bh
cld
inc ebp
enter 0xffffffffffff8749, 0xffffffffffffffa0
lodsd eax, dword [esi]
xor byte [ebx], 0x3f
xchg ebx, eax
pop eax
imul dword [eax - 0x1d]
xchg ecx, eax
loopne 0x18632e16
fnstsw word [esi - 0x2a504613]
clc
or dh, byte [edx + ecx*8 + 0x6aafcf73]
daa
sal byte [edx - 0x6d], 0x77
shr dword ds:[edx + 0x48], 0xcd
pop ds
pop edx
pop ds
add edi, esi
xchg ecx, eax
pop ebx
inc edi

Function at 0x186382c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x186382e6
call fcn.186090a0
test eax, eax
js 0x186382f3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x18638e79
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x186c35cb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1870626c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.1863a4e7
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 0x14]
mov byte [eax + 0xd], 0
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.1863a031
add esp, 0xc
jmp 0x18638f13
push esp
cwde
test eax, 0x8f4681bf
jns 0x18638f56
mov ebx, 0x7870bcbe
or byte [ecx], al
sub dword [ecx + 0x26], ebx
mov cl, 0xbb
xor bh, dh
pop esp
jbe 0x18638f15
invalid
cdq
add al, bl
invalid

Function at 0x18655e44
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.18655b07

Function at 0x18655e4f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.18655c88
Function at 0x186c95f0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x186c9611
mov dword [esi + 0x194], 7
mov eax, dword [ecx]
push 7
call dword [eax + 4]
call fcn.18682520
movzx ecx, byte [ebp + 0x18]
test al, al
mov edx, 1
mov dword [ebp - 4], 0
cmove ecx, edx
mov dword [ebp - 0x3c], 0x3c
xor edx, edx
mov dword [ebp - 0x38], 0x40
test cl, cl
mov dword [ebp - 0x34], 0
mov eax, 0x1885f8dc
xorps xmm0, xmm0
cmovne eax, edx
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
cmp dword [eax + 0x14], 8
jb 0x186c966c
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 8
jb 0x186c967a
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x186c9688
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx eax, byte [ebp + 0x14]
xor eax, 1
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x186c96e9
mov eax, dword [ebp - 4]
test eax, eax
je 0x186c96e9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x186c96e1
mov dword [esi + 0x194], 8
mov eax, dword [ecx]
push 8
call dword [eax + 4]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x186c96e1
mov dword [esi + 0x194], 0xa
mov eax, dword [ecx]
push 0xa
call dword [eax + 4]
push 0xffffffffffffffd6
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x186c9701
mov dword [esi + 0x194], 9
mov eax, dword [ecx]
push 9
call dword [eax + 4]
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x186c9c30
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x186b8edb
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1870626c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], 0
call fcn.1862e3cd
mov ecx, eax
call fcn.1862dd7a
mov edx, dword [eax]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x2c], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x186c9c80
sub ecx, dword [ebp - 0x2c]
add esi, 0x164
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.185ac6d0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x186c9ca9
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x186c9cc7
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x186c9cbe
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x186d9d42
push 0x54
call fcn.1861632c
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x186c9cef
push edi
push esi
mov ecx, eax
call fcn.1867f0f0
jmp 0x186c9cf1
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
mov dword [ecx + 0x10], eax
test eax, eax
je 0x186c9db6
xor eax, eax
mov dword [ebp - 4], 1
mov word [ebp - 0x28], ax
lea ecx, [edi + 0x10]
lea eax, [esi + 0x10]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
mov eax, dword [eax]
add eax, dword [ecx]
lea ecx, [ebp - 0x28]
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x2c], 1
call fcn.185bbcb0
cmp dword [esi + 0x14], 8
jb 0x186c9d49
mov esi, dword [esi]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x28]
push dword [eax]
push esi
call fcn.185b9fcf
cmp dword [edi + 0x14], 8
jb 0x186c9d5f
mov edi, dword [edi]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
push dword [eax]
push edi
call fcn.185b9fcf
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
add esi, 0x14c
cmp esi, eax
je 0x186c9da9
mov ecx, esi
call fcn.185ac1f0
movups xmm0, xmmword [ebp - 0x28]
xor eax, eax
mov word [ebp - 0x28], ax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
lea ecx, [ebp - 0x28]
call fcn.185ab500
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.18615399
mov esp, ebp
pop ebp
ret 4

Function at 0x186ca890
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x186ca8a0
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x186ca8b0
Capabilities:
Hide graphical window

Disassembly:
rol dword [ebx - 0x77c0340], 0x1f
or edi, dword [ecx + 0x62]
ja 0x186ca86b
pop edi
xchg dword [ebx + edi*2 + 0x77346454], esi
neg al
push eax

Function at 0x186ca8c0
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x186ca8d0
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x186cb8c2
Capabilities:
Encode data using xor

Disassembly:
test dword [edi - 0x23], ebp
mov bl, 0x6d
salc
mov eax, dword [0xedf1f04a]
fisttp word [ecx]
sub edi, dword [esi]
fcom dword [ebp - 0x7d]
adc bl, ch
and edi, dword [ebx + 0x1d]
invalid

Function at 0x186cba21
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x186cba49
push 0
lea ecx, [ebp - 4]
add eax, eax
push ecx
push eax
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret 4

Function at 0x186cbacd
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
push 0xff
mov esi, ecx
call fcn.186cba05
push 0xfe
mov ecx, esi
call fcn.186cba05
push 0x188684a8
mov ecx, esi
call fcn.186cba21
mov ecx, esi
call fcn.186cbb01
mov ecx, esi
pop esi
jmp fcn.186cbb01