joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100274b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100342d8]
xor eax, ebp
mov dword [ebp - 0x14], eax
call fcn.10026e50
mov dword [ebp - 4], str.SoftwareBaiduBaiduSd
mov dword [ebp - 0xc], str.SupplyID
mov dword [ebp - 0x21c], 0x100
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10027558
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10027548
lea ecx, [ebp - 0x218]
push ecx
push 0x1002f06c
mov edx, dword [ebp + 8]
push edx
call fcn.10005c20
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10027556
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10027566
jmp 0x1002755c
xor eax, eax
jmp 0x10027566
call fcn.10026c80
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000de98
mov esp, ebp
pop ebp
ret
Function at 0x10027800
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100291c3
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x100342d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.100262c0
mov word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.1000e4b0
add esp, 0xc
mov dword [ebp - 0x228], 0
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push str._TEMP_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x228], eax
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x260]
call fcn.10004860
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.10004830
mov byte [ebp - 4], 1
lea eax, [ebp - 0x244]
push eax
call fcn.100273d0
add esp, 4
push 0x1002efe4
lea ecx, [ebp - 0x260]
call fcn.10004960
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x260]
call fcn.10004940
lea edx, [ebp - 0x260]
push edx
mov ecx, dword [ebp + 8]
call fcn.10004900
push 0
lea ecx, [ebp - 0x260]
call fcn.10004a40
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.100048e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.100048e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000de98
mov esp, ebp
pop ebp
ret
Function at 0x10028030
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10028061
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1002806e
push str.Open_Key_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x10028090
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10031d10
push 0x10014a80
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x100342d8]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x19]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x10028110
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10028130
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x100342d8]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x8c], 0x7f
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100281e5
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x88]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x88]
push ecx
call fcn.1000e37d
add esp, 4
push eax
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.USER32.dll_CharLowerBuffW]
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x88]
push edx
call fcn.10003bf0
add esp, 8
test eax, eax
je 0x100281d9
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x100281f2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100281f0
push 0x1002f228
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000de98
mov esp, ebp
pop ebp
ret

Function at 0x10028200
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10031d30
push 0x10014a80
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x100342d8]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0
push ebx
mov ebx, 0
mov eax, 1
invalid
Function at 0x10028480
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x100342d8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 0
jne 0x100284a1
xor al, al
jmp 0x10028511
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100284b7
xor al, al
jmp 0x10028511
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10028504
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100284f0
mov byte [ebp - 1], 1
jmp 0x10028504
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100284d5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000de98
mov esp, ebp
pop ebp
ret
Function at 0x4c9ed0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x63000]
push edi
or ebp, 0xffffffff
jmp 0x4c9ef2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c9ef9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c9ee8
mov eax, 1
add ebx, ebx
jne 0x4c9f0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c9f00
jne 0x4c9f1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c9f00
xor ecx, ecx
sub eax, 3
jb 0x4c9f30
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c9fa2
mov ebp, eax
add ebx, ebx
jne 0x4c9f3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4c9f48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4c9f6c
inc ecx
add ebx, ebx
jne 0x4c9f58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c9f4d
jne 0x4c9f69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c9f4d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c9f8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c9f7d
jmp 0x4c9eee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c9f8c
add edi, ecx
jmp 0x4c9eee
pop esi
mov edi, esi
mov ecx, 0x2c01
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c9faa
cmp byte [edi], 0x1e
jne 0x4c9faa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c9faf
lea edi, [esi + 0xc6000]
mov eax, dword [edi]
or eax, eax
je 0x4ca027
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd2fc8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd30cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c9fdc
mov ecx, edi
jns 0x4ca00b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd30d0]
or eax, eax
je 0x4ca021
mov dword [ebx], eax
add ebx, 4
jmp 0x4c9ff9
call dword [esi + 0xd30e0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4ca058
cmp al, 0xef
ja 0x4ca04b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4ca02d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4ca03a
mov ebp, dword [esi + 0xd30d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ca08c
sub esp, 0xffffff80
jmp 0x45d7b5
Function at 0x4f7f70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x5f9200]
xor edx, edx
test eax, eax
push esi
mov esi, dword [esp + 8]
jne 0x4f7f85
call fcn.004f7ed0
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x4f7fae
push edi
mov edi, edi
movzx edi, byte [esi]
mov ecx, edx
and ecx, 0xff
xor ecx, edi
mov edi, dword [ecx*4 + 0x5f8e00]
shr edx, 8
xor edx, edi
inc esi
dec eax
jne 0x4f7f90
pop edi
mov eax, edx
not eax
pop esi
ret

Function at 0x4fa440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe0
push esi
mov dword [esp + 0xc], ecx
push edi
lea ecx, [esp + 0xa8]
call fcn.005035c0
lea ecx, [esp + 0xb4]
call fcn.005035c0
lea esi, [esp + 0xc4]
mov edi, 3
mov ecx, esi
call fcn.005035c0
add esi, 0xc
dec edi
jne 0x4fa470
lea ecx, [esp + 0x14]
call fcn.005035c0
mov eax, dword [esp + 0xf4]
test eax, eax
mov dword [esp + 8], 0x7f7fffff
jle 0x4fa5f4
push ebx
mov ebx, dword [esp + 0xf0]
push ebp
mov ebp, dword [esp + 0xf8]
sub ebp, ebx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x60]
call fcn.005035c0
lea ecx, [esp + 0x6c]
call fcn.005035c0
lea ecx, [esp + 0x78]
call fcn.005035c0
lea esi, [esp + 0x88]
mov edi, 3
lea ebx, [ebx]
mov ecx, esi
call fcn.005035c0
add esi, 0xc
dec edi
jne 0x4fa4e0
lea eax, [ebx + ebp]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x28]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x100]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x104]
push eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x1c]
mov ecx, eax
push 0x4f9e60
mov dword [esp + 0x50], eax
mov eax, dword [edx]
push ecx
push eax
mov dword [esp + 0xbc], 0
mov dword [esp + 0x50], 3
mov dword [esp + 0x54], ebx
mov dword [esp + 0x6c], 0x7f7fffff
call fcn.005108f0
fld dword [esp + 0x6c]
fcomp dword [esp + 0x20]
add esp, 0x10
fnstsw ax
test ah, 5
jp 0x4fa5a1
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x10], ecx
mov ecx, 0x10
lea esi, [esp + 0x6c]
lea edi, [esp + 0xb0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x14]
add ebx, 0x10
dec eax
mov dword [esp + 0x14], eax
jne 0x4fa4b3
fld dword [0x5b866c]
pop ebp
fld dword [esp + 0xc]
pop ebx
fucompp
fnstsw ax
test ah, 0x44
jnp 0x4fa5f4
mov esi, dword [0x5d811c]
mov ecx, dword [esp + 0xf8]
mov edx, dword [ecx]
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0xc8]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + esi]
push eax
call dword [edx]
pop edi
pop esi
add esp, 0xe0
ret 0x14
Function at 0x4fed40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x84]
mov eax, dword [esp + 0x74]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x90]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x90]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x7c]
mov dword [esp], eax
movzx eax, byte [esp + 0xa0]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x88]
shl eax, 0x18
or eax, 0xffffff
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x98]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x60], eax
push 4
lea eax, [esp + 4]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0xa0]
push eax
mov dword [esp + 0x70], ecx
mov ecx, dword [0x614720]
push 4
mov dword [esp + 0x78], edx
call dword [ecx + 0x30]
mov eax, 1
add esp, 0x7c
ret
Function at 0x5028d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
xor eax, eax
push ebx
mov dword [ecx + 0x90], eax
mov dword [ecx + 0x8c], eax
mov dword [ecx + 0x88], eax
mov eax, dword [ecx]
sub eax, 0x61c88647
push ebp
push esi
push edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov edi, eax
mov edx, eax
mov ebx, eax
mov esi, eax
mov ecx, eax
mov dword [esp + 0x1c], 4
mov ebp, esi
shl ebp, 0xb
xor ecx, ebp
add esi, ebx
mov ebp, ebx
shr ebp, 2
xor esi, ebp
add edx, ecx
lea ebp, [edx + ebx]
mov ebx, edx
shl ebx, 8
xor ebp, ebx
mov ebx, dword [esp + 0x18]
add ebx, ebp
mov dword [esp + 0x14], ebp
add edi, esi
mov ebp, edi
shr ebp, 0x10
add edx, edi
xor edx, ebp
add dword [esp + 0x10], edx
mov ebp, ebx
add edi, ebx
shl ebp, 0xa
xor edi, ebp
mov ebp, dword [esp + 0x10]
add ebx, ebp
shr ebp, 4
xor ebx, ebp
add ecx, ebx
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x10]
add eax, edi
add ebx, eax
mov ebp, eax
shl ebp, 8
xor ebx, ebp
mov ebp, dword [esp + 0x1c]
add esi, ebx
mov dword [esp + 0x10], ebx
mov ebx, ecx
shr ebx, 9
add eax, ecx
xor eax, ebx
mov ebx, dword [esp + 0x14]
add ebx, eax
add ecx, esi
dec ebp
mov dword [esp + 0x1c], ebp
jne 0x502910
mov ebp, dword [esp + 0x24]
add ebp, 0x50
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 2
jmp 0x5029b0
mov ebx, dword [esp + 0x14]
lea esp, [esp]
mov ebp, esi
shl ebp, 0xb
xor ecx, ebp
mov ebp, ebx
shr ebp, 2
add esi, ebx
xor esi, ebp
add edx, ecx
lea ebp, [edx + ebx]
mov ebx, edx
shl ebx, 8
xor ebp, ebx
mov ebx, dword [esp + 0x18]
add ebx, ebp
mov dword [esp + 0x14], ebp
add edi, esi
mov ebp, edi
shr ebp, 0x10
add edx, edi
xor edx, ebp
add dword [esp + 0x10], edx
mov ebp, ebx
add edi, ebx
shl ebp, 0xa
xor edi, ebp
mov ebp, dword [esp + 0x10]
add ebx, ebp
shr ebp, 4
xor ebx, ebp
add ecx, ebx
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x10]
add eax, edi
add ebx, eax
mov ebp, eax
shl ebp, 8
xor ebx, ebp
mov ebp, dword [esp + 0x14]
add esi, ebx
mov dword [esp + 0x10], ebx
mov ebx, ecx
shr ebx, 9
add eax, ecx
xor eax, ebx
mov ebx, dword [esp + 0x1c]
add ebp, eax
mov dword [ebx], ebp
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x18]
mov dword [ebx + 0xc], ebp
mov ebp, dword [esp + 0x10]
add ecx, esi
mov dword [ebx - 8], ecx
mov dword [ebx - 4], esi
mov dword [ebx + 4], edx
mov dword [ebx + 8], edi
mov dword [ebx + 0x10], ebp
mov dword [ebx + 0x14], eax
add ebx, 0x20
mov dword [esp + 0x1c], ebx
dec dword [esp + 0x20]
jne 0x5029a5
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.00502630
pop edi
mov dword [esi + 4], 0x10
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x599d80
Capabilities:
Encode data using xor

Disassembly:
inc esi
invalid
add byte [ebx - 0x5f2b627], ch
sbb al, 0xbb
loopne 0x599de5
mov dh, bl
xor dword [ebx - 0x244642bc], edi
out 0x5e, al
cmpsb byte [esi], byte es:[edi]
push edx
mov bh, byte [ebp + 0x49]
add eax, dword [ecx]
dec edi
loope 0x599d3a
aaa
sbb eax, 0x2267b73b
rol edi, 0x43
invalid
sbb ch, 0x70
xor edx, dword [ecx]
mov ebx, 0x52be55d0
rcl byte [ebp - 0x42]
push edx
cli
test eax, 0x296d55a9
enter 0xffffffffffffb03e, 7
lea esi, [ebx]
inc edi
idiv ebx
cli
std
loop 0x599ddf
add bh, bh
xchg ebp, eax
Function at 0x6768d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.006d6e00
add esp, 8
cmp dword [ebp + 8], 0
je 0x676920
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x7372f0
call fcn.0068abb0
add esp, 4
push eax
lea ecx, [ebp - 0x148]
push ecx
call fcn.006d6ef0
add esp, 0x10
jmp 0x676945
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x73731c
call fcn.0068abb0
add esp, 4
push eax
lea ecx, [ebp - 0x148]
push ecx
call fcn.006d6ef0
add esp, 0x10
jmp 0x67696e
push 0
lea edx, [ebp - 0x48]
push edx
push 0
push 0x20006
push 0
push 0x7c6f90
push 0
lea eax, [ebp - 0x148]
push eax
push 0x80000001
call dword [0x7dbcac]
test eax, eax
jne 0x6769c9
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push 3
push 0
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
test eax, eax
jne 0x6769bf
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x48]
push edx
call dword [0x7d78ec]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x682cb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.0068a010
mov eax, dword [0x7dafee]
and eax, 0x2000000
test eax, eax
je 0x682ccb
call fcn.00688400
cmp dword [0x735968], 0
je 0x682cec
cmp dword [0x73596c], 0
je 0x682cec
call fcn.00676090
mov dword [0x73596c], 0
cmp dword [0x7c6d80], 0
je 0x682d07
push 0
call dword [0x7d9aac]
mov dword [0x7c6d80], 0
cmp dword [0x7c6d84], 0
je 0x682d3a
cmp dword [0x7c6d88], 0
je 0x682d30
mov ecx, dword [0x7c6d88]
push ecx
call dword [0x7d7000]
mov dword [0x7c6d88], 0
mov dword [0x7c6d84], 0
cmp dword [0x7c6d64], 0
je 0x682d5c
mov edx, dword [0x7c6d64]
push edx
call dword [0x7d7784]
mov eax, dword [0x7c6d64]
push eax
call dword [0x7d6f74]
cmp dword [0x7c6d48], 0
je 0x682d72
mov ecx, dword [0x7c6d48]
push ecx
call dword [0x7d6f74]
cmp dword [0x7df3ec], 0
je 0x682d88
mov edx, dword [0x7df3ec]
push edx
call dword [0x7d6f74]
cmp dword [0x7c6f58], 0
je 0x682d9d
mov eax, dword [0x7c6f58]
push eax
call dword [0x7d6f74]
cmp dword [0x7c6ecc], 0
je 0x682db3
mov ecx, dword [0x7c6ecc]
push ecx
call dword [0x7d7000]
cmp dword [0x7c6d60], 0
je 0x682dc9
mov edx, dword [0x7c6d60]
push edx
call dword [0x7d6f74]
cmp dword [0x7c6d4c], 0
je 0x682dde
mov eax, dword [0x7c6d4c]
push eax
call dword [0x7d6f74]
cmp dword [0x7c6d50], 0
je 0x682df4
mov ecx, dword [0x7c6d50]
push ecx
call dword [0x7d6f74]
cmp dword [0x7c6d54], 0
je 0x682e0a
mov edx, dword [0x7c6d54]
push edx
call dword [0x7d6f74]
cmp dword [0x7c6d58], 0
je 0x682e1f
mov eax, dword [0x7c6d58]
push eax
call dword [0x7d6f74]
cmp dword [0x7c6d64], 0
je 0x682e35
mov ecx, dword [0x7c6d64]
push ecx
call dword [0x7d6f74]
cmp dword [0x718240], 0
je 0x682e4d
push 0x7438d0
push 3
call fcn.00688440
add esp, 8
xor edx, edx
test edx, edx
jne 0x682e35
cmp dword [0x718240], 0
je 0x682e6b
push 0x7c6fd8
push 4
call fcn.00688440
add esp, 8
xor eax, eax
test eax, eax
jne 0x682e53
mov ecx, dword [ebp + 8]
push ecx
call fcn.006d6982
pop ebp
ret

Function at 0x683bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0x40
push 0x1000
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x683beb
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.006d6a60
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x686900
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.006d70a0
mov dword [ebp - 0x914], 0
lea ecx, [ebp - 0x910]
call fcn.00686b70
push 0x13dd
push 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.006d6da0
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
cmp dword [ebp + 0xc], 0
je 0x686a23
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.006974e0
add esp, 8
test eax, eax
je 0x686a1e
push 0x751a88
lea ecx, [ebp - 0xd14]
call fcn.00686b30
mov ecx, eax
call fcn.00686b60
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.006d6e10
add esp, 8
mov edx, dword [ebp + 0x10]
add edx, 0x381
push edx
lea eax, [ebp - 0x100]
push eax
call fcn.006d6e10
add esp, 8
mov ecx, dword [ebp + 0x10]
add ecx, 0x7dd
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.00695c90
add esp, 8
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x910]
call fcn.00687310
mov ecx, dword [ebp - 0x914]
or ecx, eax
mov dword [ebp - 0x914], ecx
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x68d], 0
je 0x686a1e
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x685], 0
je 0x686a1e
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x695], 0
jne 0x686a1e
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x699], 0
jne 0x686a1e
mov eax, dword [ebp - 0x914]
or ah, 1
mov dword [ebp - 0x914], eax
jmp 0x686aae
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov dl, byte [ebp + 8]
push edx
call fcn.00696e40
add esp, 0xc
test eax, eax
je 0x686aae
push 0x751a98
lea ecx, [ebp - 0x1114]
call fcn.00686b30
mov ecx, eax
call fcn.00686b60
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.006d6e10
add esp, 8
mov ecx, dword [ebp + 0x10]
add ecx, 0x381
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.006d6e10
add esp, 8
mov eax, dword [ebp + 0x10]
add eax, 0x7dd
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.00695c90
add esp, 8
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x910]
call fcn.00687310
mov ecx, dword [ebp - 0x914]
or ecx, eax
mov dword [ebp - 0x914], ecx
cmp dword [ebp + 0x14], 0
je 0x686ae3
cmp dword [ebp + 0x18], 0
jle 0x686ae3
mov edx, dword [ebp + 0x18]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
call fcn.006d6da0
add esp, 0xc
lea ecx, [ebp - 0x900]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.006860b0
add esp, 0xc
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.006861c0
add esp, 0x10
mov edx, dword [ebp - 0x914]
or edx, eax
mov dword [ebp - 0x914], edx
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x1118], eax
lea ecx, [ebp - 0x910]
call fcn.00687820
mov eax, dword [ebp - 0x1118]
mov esp, ebp
pop ebp
ret