joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c2354c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push 4
pop ebx
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ebx
push eax
push 1
xor edi, edi
mov dword [ebp - 0x10], ebx
push edi
push str.SOFTWAREPoliciesChromium
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1c235bd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push str.MetricsReportingEnabled
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1c235aa
cmp dword [ebp - 8], edi
mov eax, dword [ebp + 8]
setne cl
mov byte [eax], cl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
jmp 0x1c235da
lea eax, [ebp - 4]
push eax
push 1
push edi
push str.SOFTWAREPoliciesChromium
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1c23580
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1c235e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1c3c114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x118
xor ebx, ebx
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x11c]
mov esi, ecx
push ebx
push eax
call fcn.01c26b60
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x114]
mov di, word [ebp - 0xc]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
cmp edx, 5
jne 0x1c23686
test ecx, ecx
jle 0x1c23664
xor eax, eax
cmp ecx, 1
setne al
inc eax
mov dword [esi], eax
cmp eax, 1
jne 0x1c23666
cmp di, 2
jae 0x1c23666
mov dword [esi], ebx
movzx ecx, di
mov eax, esi
mov dword [esi + 0x10], ecx
movzx ecx, word [ebp - 0xa]
mov dword [esi + 0x14], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01c256c8
mov esp, ebp
pop ebp
ret
push 6
pop eax
cmp edx, eax
jne 0x1c236b7
sub ecx, ebx
je 0x1c236af
sub ecx, 1
je 0x1c236a7
sub ecx, 1
je 0x1c2369f
mov dword [esi], eax
jmp 0x1c23666
mov dword [esi], 5
jmp 0x1c23666
mov dword [esi], 4
jmp 0x1c23666
mov dword [esi], 3
jmp 0x1c23666
cmp edx, 0xa
jne 0x1c236c4
mov dword [esi], 7
jmp 0x1c23666
cmp edx, eax
jle 0x1c23664
mov dword [esi], 8
jmp 0x1c23666

Function at 0x1c2951d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
invalid

Function at 0x1c2953c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35
Function at 0x1c29554
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
cmpsb byte [esi], byte es:[edi]
inc ecx
call fcn.01c29160
push eax
push esi
push dword [ebp + 8]
call fcn.01c29115
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.01c29160
push eax
push esi
push dword [ebp + 8]
call fcn.01c29115
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.01c29150
inc esi
adc ecx, esp
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb 0x1c295e6
inc ebp
invalid
invalid

Function at 0x1c297af
Capabilities:
Inspect section memory permissions

Disassembly:
je 0x1c29804
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1c297ff
mov dword [ebp + 0xc], ebx
jmp 0x1c2980f

Function at 0x1c297d6
Capabilities:
Inspect section memory permissions

Disassembly:
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1c297f1

Function at 0x1c297fa
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1c297e9
cmp edx, ebx
jne 0x1c2993f
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1c297c0
add eax, dword [eax + 4]
jmp 0x1c297ad
push 0x8000
push ebx
Function at 0x1c29de5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01c29115
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.01c29150
dec edx
xchg dword [ebp + 0x71], ecx
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x1c29e44
cmp dword [ebp - 0x398], 0
je 0x1c2a00e
cmp dword [ebp + 0xc], 1
je 0x1c2a00e
cmp dword [ebp + 0xc], 8
jne 0x1c29fd6
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.01c29160
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01c29115
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.01c29150
xchg ebp, eax
dec edx
int3
call fcn.01c29150
jle 0x1c2a03d
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
movsd dword es:[edi], dword [esi]
lodsb al, byte [esi]
stc
invalid

Function at 0x1c2a065
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.01c2912e
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
invalid
movsd dword es:[edi], dword [esi]
Function at 0x1c2a0d5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ecx + 0x11fffffc], esp
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.01c29160
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01c29115
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.01c29150
in eax, 0xd0
insd dword es:[edi], dx
mov ch, byte [eax + 4]
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2cdb28e7
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x627022b6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4149c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], eax
push esi
push edi
test ebx, ebx
je 0x4481ff
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov eax, dword [esi]
mov ecx, dword [esi + 0x50]
mov dword [ebp - 0x24], ecx
cmp eax, dword [esi + 4]
jae 0x450158
mov edx, dword [ebp - 8]
cmp dword [ebp + 0x18], 0
lea ecx, [ebp + 0x18]
jne 0x448221
push 1
push 0
push 0
push 0
push 0
xor edx, edx
call fcn.004149c0
add esp, 0x14
jmp 0x414b3d
sub ecx, eax
test ecx, ecx
jle 0x448229
neg ecx
Function at 0x414ea7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, ecx
and eax, 0xfc00
cmp eax, 0xd800
je 0x449bc7
mov eax, ecx
cdq
and edx, 0x7f
add eax, edx
mov edx, dword [ebp - 0x14]
sar eax, 7
movzx ecx, byte [eax + 0x4b3b40]
mov eax, edx
shl ecx, 7
and eax, 0x8000007f
jns 0x414edf
dec eax
or eax, 0xffffff80
inc eax
add ecx, eax
movzx eax, word [ebx + 2]
movzx ecx, word [ecx*2 + 0x4a5840]
mov dword [ebp - 0x14], ecx
cmp eax, 9
jne 0x449bef
movzx eax, word [ebx + 4]
mov ecx, dword [eax*4 + 0x4a45d0]
lea eax, [eax*4 + 0x4a45d0]
cmp edx, ecx
jb 0x449df1
lea eax, [eax + 4]
cmp edx, ecx
je 0x414f25
mov ecx, dword [eax]
cmp edx, ecx
jae 0x414f13
jmp 0x449df1
cmp edi, 0x10
jne case.0x414a45.157
mov edx, dword [ebp - 8]
add ebx, 6
mov dword [ebp - 0x30], ebx
jmp 0x414a1f
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
mov eax, dword [ebp - 8]
and ecx, 0x3ff
shl ecx, 0xa
movzx eax, word [eax]
and eax, 0x3ff
or ecx, eax
add ecx, 0x10000
add dword [ebp - 8], 2
mov dword [ebp - 0x14], ecx
jmp 0x414eb9
cmp eax, 0xa
ja case.default.0x449bf8
jmp dword [eax*4 + 0x450193]
mov al, byte [ecx*8 + 0x4a2f51]
cmp al, 9
je 0x449c24
cmp al, 5
je 0x449c24
cmp al, 8
je 0x449c24
xor ecx, ecx
jmp 0x449c40
cmp edi, 0xf
je case.0x414a45.157
jmp 0x414f2e
mov ecx, 1
jmp 0x449c40
movzx eax, byte [ecx*8 + 0x4a2f51]
xor ecx, ecx
cmp dword [eax*4 + 0x4b89a0], 6
sete cl
xor eax, eax
cmp edi, 0xf
sete al
cmp ecx, eax
je case.0x414a45.157
jmp 0x414f2e
mov eax, dword [ebp - 0x14]
xor edx, edx
movzx ecx, word [ebx + 4]
movzx eax, byte [eax*8 + 0x4a2f51]
cmp ecx, dword [eax*4 + 0x4b89a0]
setne dl
xor eax, eax
cmp edi, 0x10
sete al
cmp edx, eax
je case.0x414a45.157
jmp 0x414f2e
movzx eax, byte [ecx*8 + 0x4a2f51]
jmp 0x449c97
movzx eax, byte [ecx*8 + str._GUI_CTRLHANDLE]
xor ecx, ecx
cmp word [ebx + 4], ax
setne cl
xor eax, eax
cmp edi, 0x10
sete al
cmp ecx, eax
je case.0x414a45.157
jmp 0x414f2e
movzx eax, byte [ecx*8 + 0x4a2f51]
mov eax, dword [eax*4 + 0x4b89a0]
cmp eax, 1
je 0x449c24
cmp eax, 3
je 0x449c24
xor ecx, ecx
jmp 0x449c40
cmp edx, 0x180e
ja 0x449d36
je case.0x449bf8.0
cmp edx, 0x85
ja 0x449d19
je case.0x449bf8.0
cmp edx, 9
jb case.0x449d5a.8203
cmp edx, 0xd
jbe case.0x449bf8.0
cmp edx, 0x20
je case.0x449bf8.0
jmp case.0x449d5a.8203
cmp edx, 0xa0
je case.0x449bf8.0
cmp edx, 0x1680
je case.0x449bf8.0
jmp case.0x449d5a.8203
cmp edx, 0x202f
ja 0x449d61
je case.0x449bf8.0
add edx, 0xffffe000
cmp edx, 0x29
ja case.0x449d5a.8203
movzx eax, byte [edx + 0x4501c7]
jmp dword [eax*4 + 0x4501bf]
cmp edx, 0x205f
je case.0x449bf8.0
cmp edx, 0x3000
je case.0x449bf8.0
jmp case.0x449d5a.8203
movzx eax, byte [ecx*8 + 0x4a2f51]
mov eax, dword [eax*4 + 0x4b89a0]
cmp eax, 1
je 0x449c24
cmp eax, 3
je 0x449c24
cmp edx, 0x5f
je 0x449c24
xor ecx, ecx
jmp 0x449c40
cmp edx, 0x24
je 0x449c24
cmp edx, 0x40
je 0x449c24
cmp edx, 0x60
je 0x449c24
cmp edx, 0xa0
jb 0x449dde
cmp edx, 0xd7ff
jbe 0x449c24
cmp edx, 0xe000
jae 0x449c24
xor ecx, ecx
jmp 0x449c40
cmp edi, 0x10
je case.0x414a45.157
jmp 0x414f2e
mov eax, 0xfffffff2
jmp 0x414b3d
Function at 0x41780b
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x24]
xor eax, eax
mov edi, dword [ebp - 8]
jge 0x417805
jge 0x417805
cmp ecx, edx
push 0x6e
pop edx
setne al
add eax, edx
push 2
pop edx
mov word [edi], ax
add edi, edx
test ebx, ebx
je 0x417c37
push 0x20
pop eax
add edi, eax
mov dword [ebp - 8], edi
jmp 0x417515
test ecx, ecx
jne 0x4182e2
push 0x20
pop eax
push eax
lea eax, [ebp - 0xd4]
push eax
push edi
call fcn.00421080
add esp, 0xc
jmp 0x417827
push 0x20
xor eax, eax
pop ecx
jmp 0x454548
not byte [ebp + eax - 0xd4]
inc eax
cmp eax, ecx
jb 0x454548
jmp 0x417c3f

Function at 0x420bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c6283]
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], al
push 0x8000
push esi
mov edi, edx
call fcn.00424916
pop ecx
push eax
call fcn.00424744
cmp dword [edi + 0xc], 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x456305
lea ecx, [ebp - 0x18]
call fcn.00405c18
mov ecx, edi
call fcn.00409997
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.00405b75
push dword [ebp - 0x18]
push 0x491d28
push esi
call fcn.00424b15
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x456325
lea ecx, [ebp - 0x18]
call fcn.00405a64
mov edi, dword [ebp - 8]
push esi
call fcn.00424cda
pop ecx
cmp ebx, 0xffffffff
je 0x420c6e
push ebx
push esi
call fcn.00424916
pop ecx
push eax
call fcn.00424744
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4000
jmp 0x420c56
push esi
mov ecx, edi
call fcn.004689e2
push eax
push 1
call fcn.0046899f
push eax
call fcn.00424a93
add esp, 0x10
mov edi, eax
jmp 0x420c49
mov ecx, edi
call fcn.00409997
mov eax, dword [edi + 8]
push dword [eax]
call dword [0x48f248]
jmp 0x420c3e

Function at 0x45fcb1
Capabilities:
Encode data using xor

Disassembly:
jle 0x45fcbc
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x45fcb3
xrstors [edi + 0x5e]
pop ebx
pop ebp
ret 8

Function at 0x468aea
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4c7530], ecx
inc esi
mov ecx, 0x4c7530
mov dh, 0xd6
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c7eec
jl 0x468afb
mov dword [0x4c4190], esi
mov dword [0x4c7518], esi
pop esi
ret

Function at 0x48e06a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
inc ebp
call 0xfad43862
movzx ebx, word [esi + 2]
add esi, 4
movzx eax, word [esi]
add byte [ebx + 0x5d6a5866], al
pop edx
cmp ax, 0x5c
jne 0x48e094
cmp word [esi + 2], dx
jne 0x48e094
add esi, 2
jmp 0x48e0cd
cmp ax, dx
je 0x48e0d8
cmp ax, bx
jne 0x48e0a4
cmp word [esi + 2], dx
je 0x48e0de
cmp ax, 0x5b
jne 0x48e0cd
invalid
movzx eax, word [esi + 2]
cmp eax, 0x3a
je 0x48e0bd
jne 0x48e0df
jne 0x48e0e5
mov dword [edi], esi
inc eax
jmp 0x48e0da
Function at 0x10002490
Capabilities:
Access peb ldr_data
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1005a218]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
push esi
mov esi, dword [ebp + 8]
jne 0x10002560
push esi
call fcn.10001ff0
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 0xc]
add ecx, 0xc
cmp eax, ecx
je 0x1000258e
nop dword [eax + eax]
test eax, eax
je 0x1000258e
mov edx, dword [eax]
cmp dword [eax + 0x18], esi
je 0x100024eb
mov eax, edx
cmp eax, ecx
je 0x1000258e
jmp 0x100024d0
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [edx + 4], ecx
mov edx, dword [eax + 0x14]
mov ecx, dword [eax + 0x10]
mov dword [edx], ecx
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ecx], eax
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x10002576
movzx eax, word [eax + esi + 0x14]
test ax, ax
je 0x10002576
push edi
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, edi
mov eax, esi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10002545
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.1000916f
mov esp, ebp
pop ebp
ret 0xc
push str.Failed_to_remove_PE_Header
push 0x11
push str.C:Usersd3adc0de.DESKTOP_I2I5892_source_reposThreateningYetiThreateningYetidllmain.cpp
push str.CHECK_FAILED:__ty::hide_module::remove_pe_header_hModule_
push 0
call fcn.10004330
push str.Failed_to_unlink_from_PEB
push 0x10
push str.C:Usersd3adc0de.DESKTOP_I2I5892_source_reposThreateningYetiThreateningYetidllmain.cpp
push str.CHECK_FAILED:__ty::hide_module::unlink_module_peb_hModule_
push 0
call fcn.10004330
int3
Function at 0x10004e10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push esi
imul esi, dword [esp + 0xc], 0x2c
push edi
add esi, dword [0x1005ec90]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10004e52
pop edi
pop esi
mov eax, 0xa
pop ebp
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x10004e78
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10004e99
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10004e99
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10004e93
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10004e99
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
xor eax, eax
and cl, 0xfb
or cl, bl
pop ebx
pop edi
mov byte [esi + 0x14], cl
pop esi
pop ebp
ret