joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004a54a0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x1014]
test ebx, ebx
rep stosd dword es:[edi], eax
jle 0x4b71fd
mov eax, dword [ebp + 8]
mov edi, ebx
lea edx, [eax + 8]
mov eax, dword [edx]
test eax, 0x80000000
mov dword [ebp - 4], eax
jne 0x4b71a2
xor eax, 0x7fffffff
mov dword [ebp - 4], eax
mov ecx, eax
mov dword [edx], eax
and ecx, 0xff
add edx, 0xc
mov esi, dword [ebp + ecx*4 - 0x1014]
lea ecx, [ebp + ecx*4 - 0x1014]
inc esi
mov dword [ecx], esi
xor ecx, ecx
mov cl, ah
shr eax, 0x18
mov esi, dword [ebp + ecx*4 - 0xc14]
lea ecx, [ebp + ecx*4 - 0xc14]
inc esi
lea eax, [ebp + eax*4 - 0x414]
mov dword [ecx], esi
xor ecx, ecx
mov cl, byte [ebp - 2]
mov esi, dword [ebp + ecx*4 - 0x814]
lea ecx, [ebp + ecx*4 - 0x814]
inc esi
mov dword [ecx], esi
mov esi, dword [eax]
inc esi
dec edi
mov dword [eax], esi
jne 0x4b718e
lea edx, [ebp - 0x1014]
mov esi, 4
xor ecx, ecx
mov edi, pe_nt_image_headers32
mov eax, ecx
add eax, dword [edx]
mov dword [edx], ecx
add edx, 4
dec edi
mov ecx, eax
jne 0x4b720f
dec esi
jne 0x4b7208
lea eax, [ebx + ebx*2]
shl eax, 2
add eax, 3
and al, 0xfc
call fcn.004a54a0
mov esi, dword [ebp + 8]
mov edi, esp
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
lea edx, [ebp - 0x1014]
mov dword [ebp + 8], 0
mov dword [ebp - 0x10], 4
test ebx, ebx
jle 0x4b729f
mov dword [ebp - 4], ebx
jmp 0x4b725e
mov edi, dword [ebp - 0x14]
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 8]
sar eax, cl
and eax, 0xff
mov ecx, dword [edx + eax*4]
lea ecx, [ecx + ecx*2]
lea ecx, [edi + ecx*4]
mov edi, esi
add esi, 0xc
mov ebx, dword [edi]
mov dword [ecx], ebx
mov ebx, dword [edi + 4]
mov dword [ecx + 4], ebx
mov edi, dword [edi + 8]
mov dword [ecx + 8], edi
mov edi, dword [edx + eax*4]
inc edi
mov dword [edx + eax*4], edi
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
jne 0x4b725b
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov edi, esi
mov esi, dword [ebp - 0xc]
add edx, 0x400
add ecx, 8
dec eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], ecx
mov dword [ebp - 0x10], eax
jne 0x4b7252
lea esp, [ebp - 0x1020]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c0530
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x4c054e
and ecx, 0xff
inc edx
shl eax, 5
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4c053c
xor edx, edx
div dword [esp + 8]
mov eax, edx
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401c66
pop dword [ebp - 0x34]
mov eax, 0xba991a40
sub eax, 0xba58fdda
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xec8b5e1d
add dword [ebp - 0x44], 0x61c6e72e
mov dword [ebp - 0x40], 0xf0783023
add dword [ebp - 0x40], 0x41bb1c22
mov dword [ebp - 0x3c], 0x8abcd035
add dword [ebp - 0x3c], 0xc18f73f9
mov dword [ebp - 0x38], 0x294f7b34
add dword [ebp - 0x38], 0xd6b084cc
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x2af2c756
sub dword [ebp - 0x44], 0xb6805e00
mov dword [ebp - 0x40], 0xcbda3319
sub dword [ebp - 0x40], 0x8a6dd1a4
mov dword [ebp - 0x3c], 0x5742f9fd
sub dword [ebp - 0x3c], 0xf3d38d91
mov dword [ebp - 0x38], 0x1470f53
add dword [ebp - 0x38], 0xfeb8f0ad
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x37d2e
push 0
call eax
mov ecx, 0xdcf49ce4
sub ecx, 0xdcf44f85
mov edi, eax
mov ebx, 0x9a960660
sub ebx, 0x9a559660
add ebx, dword [ebp - 0x34]
mov esi, 0xc99c2a91
xor dword [ebp - 0x20], 0xdfa1d6f7
mov edx, dword [ebx]
xor edx, esi
sub dword [ebp - 0x2c], esi
mov dword [edi], edx
add dword [ebp - 0x2c], 0xd9821b5a
add edi, 0x6af61e30
add edi, 0x9509e1d4
add ebx, 0x2a7e8560
add ebx, 0xd5817aa4
loop 0x401d78
add eax, 0x1284f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1002784
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x10027ad
mov al, byte [esi + 1]
inc esi
test al, al
je 0x10027a5
cmp al, 0x22
jne 0x1002799
cmp byte [esi], 0x22
jne 0x10027b7
inc esi
jmp 0x10027b7
cmp al, 0x20
jle 0x10027b7
inc esi
cmp byte [esi], 0x20
jg 0x10027b1
mov al, byte [esi]
test al, al
je 0x10027c4
cmp al, 0x20
jg 0x10027c4
inc esi
jmp 0x10027b7
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x10027de
movzx eax, word [ebp - 0x14]
jmp 0x10027e1
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1002860
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x100b6dc], eax
mov ecx, 0x23f
xor eax, eax
mov edi, 0x100ade0
rep stosd dword es:[edi], eax
mov ecx, 0xcb
mov edi, 0x100aaa0
rep stosd dword es:[edi], eax
push 0x41
mov edi, 0x100b720
pop ecx
mov esi, 0x100adf4
rep stosd dword es:[edi], eax
push 1
xor ebx, ebx
pop edi
mov dword [ebp - 4], ebx
push 0x7f
push esi
push 0x10013b4
mov dword [0x100b08c], edi
call fcn.01003e52
cmp eax, ebx
je 0x1002a7f
cmp eax, 0x80
ja 0x1002a7f
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x100aa7c], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
push 0x100b6d4
push 0x10013a8
call fcn.01003e52
test eax, eax
je 0x100291d
test byte [0x100b6d4], 0xc0
je 0x10029ad
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0x1001398
call fcn.01003e52
test eax, eax
jne 0x100293c
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003cff
mov dword [0x100b704], 0x80070714
jmp 0x1002a8f
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x100aa80], eax
je 0x10029ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10029ad
test byte [0x100b6d4], 0x80
je 0x100297c
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.01003cff
jmp 0x1002992
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.01003cff
cmp eax, 6
je 0x10029ad
push dword [0x100aa80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100b704], 0x800700b7
jmp 0x1002a8f
push dword [ebp + 0xc]
mov dword [0x100b824], ebx
call fcn.01005247
test eax, eax
jne 0x10029ce
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x1002a89
cmp byte [0x100aaba], bl
je 0x10029e5
push 0x100aaba
call fcn.01001f8e
jmp 0x1002a8f
push 0xa
push 0x100138c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x1002a06
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [0x100a2f8], ebx
je 0x1002a14
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100aaa4], ebx
jne 0x1002a7b
push dword [ebp - 4]
call fcn.01003183
test eax, eax
je 0x1002a8f
mov ax, word [0x100bc04]
cmp ax, di
je 0x1002a39
cmp ax, 2
jne 0x1002a7b
test byte [0x100b6d5], 1
je 0x1002a7b
test byte [0x100aab8], 1
jne 0x1002a7b
call fcn.01001602
test eax, eax
jne 0x1002a7b
push 0x83e
push 0x547
push 0x100170c
push ebx
push 0x7d6
push dword [0x100b6dc]
call fcn.01005979
cmp eax, 0x83d
jne 0x1002a8f
mov eax, edi
jmp 0x1002a91
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003cff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002b98
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
jmp 0x10049df
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [0x100ae80]
xor ebp, ebp
push edi
cmp esi, ebp
mov edi, esi
je 0x1004a32
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x100aaa4], ebp
jne 0x1004a22
cmp dword [0x100b6d0], ebp
jne 0x1004a22
push 0x80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [edi]
mov esi, dword [esi + 4]
call ebx
push edi
call ebx
cmp esi, ebp
mov edi, esi
jne 0x10049fd
cmp dword [0x100aaa0], ebp
je 0x1004a82
cmp dword [0x100aaa4], ebp
jne 0x1004a82
cmp dword [0x100b6d0], ebp
jne 0x1004a82
lea eax, [esp + 0x10]
push 0x100ae84
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100b6d4], 0x20
je 0x1004a6d
lea eax, [esp + 0x10]
push eax
call fcn.01005ada
push 0x1001328
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x10]
push eax
call fcn.01001f8e
cmp word [0x100bc04], 1
je 0x1004a99
cmp dword [0x100aaa0], ebp
je 0x1004a99
call fcn.01001c59
pop edi
mov dword [0x100aaa0], ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x1005b33
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
cmp byte [ecx], al
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
je 0x1005b69
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1005b6d
xor eax, eax
jmp 0x1005b83
mov eax, dword [ebp - 8]
push 0x400
imul eax, dword [ebp - 0xc]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
leave
ret 4

Function at 0x1006e0e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, eax
dec eax
test edi, edi
jle 0x1006e4e
lea edi, [eax + 1]
movzx eax, byte [ecx]
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or eax, ebx
inc ecx
xor edx, eax
dec edi
jne 0x1006e2c
and esi, 3
xor eax, eax
dec esi
je 0x1006e6a
dec esi
je 0x1006e63
dec esi
jne 0x1006e6f
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
pop esi
xor eax, edx
pop ebx
ret 0xc
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0040ead0
push str._JAVA_LAUNCHER_DEBUG
mov eax, dword [eax]
mov dword [0x434780], eax
call fcn.0041103f
xor ebp, ebp
pop ecx
test eax, eax
je 0x401059
push str.Windows_original_main_args:_n
call fcn.00401116
pop ecx
mov esi, ebp
call fcn.0040e61f
cmp dword [eax], ebp
jle 0x401059
call fcn.0040e625
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401116
add esp, 0xc
inc esi
call fcn.0040e61f
cmp esi, dword [eax]
jl 0x401037
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.00401221
call fcn.00401289
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401139
pop ecx
pop ecx
mov esi, eax
call fcn.0040128f
mov edx, ebp
test ebx, ebx
jle 0x401097
mov edi, esi
mov ecx, dword [eax + edx*8]
inc edx
mov dword [edi], ecx
lea edi, [edi + 4]
cmp edx, ebx
jl 0x40108a
mov edi, dword [str.java]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010a6
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010b2
mov edx, dword [esi]
mov ecx, dword [0x433a90]
push ebp
xor ebp, ebp
inc ebp
test ecx, ecx
push ebp
push ebp
setne al
movzx eax, al
push eax
push edi
push edx
push 0x426284
push 0x426288
push dword [0x433a94]
push ebp
push ecx
push ebp
push esi
push ebx
call fcn.00401d6f
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x404337
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.0041103f
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x4044aa
jg 0x404366
test esi, esi
jb 0x4044aa
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.004175ef
add esp, 0xc
test eax, eax
js 0x4044aa
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x4043c8
push edi
call fcn.004048b9
pop ecx
test eax, eax
je 0x4043bf
push ebx
push esi
push edi
push ebp
call fcn.0041103f
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x4044af
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.0041103f
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x4044aa
jg 0x4043f1
cmp ebp, ebx
jb 0x4044aa
mov ecx, 0x10015
cmp eax, ebx
jg 0x404406
jl 0x404400
cmp ebp, ecx
jae 0x404406
mov esi, ebp
mov ecx, eax
jmp 0x40440a
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.0041103f
add esp, 0x10
cmp edx, ebx
jl 0x4044aa
jg 0x404430
cmp eax, ebx
jb 0x4044aa
push 0x10015
call fcn.0041103f
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4044aa
push esi
push ebx
push dword [esp + 0x24]
call fcn.004175ef
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x4044a3
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40449f
cmp byte [esi], 0x50
jne 0x40449e
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40449e
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x4044b6
dec esi
cmp esi, ebx
jae 0x40445f
push ebx
call fcn.0041103f
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a020
push ebx
call fcn.0041103f
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.004048b9
add esp, 0x14
test eax, eax
je 0x4044f6
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.0041103f
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x4044af
Function at 0x408a7f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
push 4
pop edx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4285e0]
sub edx, 1
jne 0x408a86
ret

Function at 0x409cec
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x409d2b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409d2b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409d2b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409d2b
cmp dword [ecx + 0x74], 0xe
jbe 0x409d2b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41103f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x41104e
pop dword [ebp - 0x44]
mov eax, 0x41104e
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x7b5a91d2
add dword [ebp - 0x54], 0xd2f7b379
mov dword [ebp - 0x50], 0xea976a99
add dword [ebp - 0x50], 0x479be1ac
mov dword [ebp - 0x4c], 0xae7e5975
add dword [ebp - 0x4c], 0x9dcdeab9
mov dword [ebp - 0x48], 0x864dab32
add dword [ebp - 0x48], 0x79b254ce
lea eax, [ebp - 0x54]
push eax
mov eax, 0x9e488d89
add eax, 0x61f9d2cb
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xb73fd42c
add dword [ebp - 0x54], 0xbd32952a
mov dword [ebp - 0x50], 0x7c34abdf
add dword [ebp - 0x50], 0xc537b596
mov dword [ebp - 0x4c], 0x6016b72
sub dword [ebp - 0x4c], 0xa291ff06
mov dword [ebp - 0x48], 0x5904c0e4
sub dword [ebp - 0x48], 0x5904c0e4
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xda093945
sub eax, 0xd9c6d8ed
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3e86b
push 0
call eax
mov ecx, 0x43f8
mov esi, eax
mov edx, 0x3fdb784d
sub edx, 0x3f977e4d
add edx, dword [ebp - 0x44]
mov ebx, 0xa5ab72e
add dword [ebp - 8], 0xf404545d
mov edi, dword [edx]
sub dword [ebp - 0x38], ebx
add edi, ebx
xor dword [ebp - 0x18], 0x690d1db2
mov dword [esi], edi
add esi, 4
add edx, 0x5d8c0f28
sub edx, 0x5d8c0f24
loop 0x41115f
add eax, 0xfb35b66b
add eax, 0x4cb4c48
xor ebx, ebx
add ebx, eax
add eax, 0x66cb022e
sub eax, 0x66cb0229
mov ecx, 0x15de15a
sub ecx, 0x11de15a
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10009220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000922f
pop dword [ebp - 0x30]
mov eax, 0xd7722bf0
sub eax, 0xc77199c1
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x4758461e
sub dword [ebp - 0x40], 0xf90600d3
mov dword [ebp - 0x3c], 0x2f3e6d8c
sub dword [ebp - 0x3c], 0xfd0b2147
mov dword [ebp - 0x38], 0xb46494fc
add dword [ebp - 0x38], 0x97e7af32
mov dword [ebp - 0x34], 0x6f7c624e
sub dword [ebp - 0x34], 0x6f7c624e
lea eax, [ebp - 0x40]
push eax
mov eax, 0x10441eb1
add eax, 0xffbc8207
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x3f5e633a
sub dword [ebp - 0x40], 0xcaebf9e4
mov dword [ebp - 0x3c], 0x515e9b50
sub dword [ebp - 0x3c], 0xff239db
mov dword [ebp - 0x38], 0xcb46d507
sub dword [ebp - 0x38], 0x67d7689b
mov dword [ebp - 0x34], 0x87c86d28
add dword [ebp - 0x34], 0x783792d8
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3b67c
push 0
call eax
mov ecx, 0x5593
mov esi, eax
mov edi, 0x272d3a66
sub edi, 0x172c0866
add edi, dword [ebp - 0x30]
mov edx, 0x4d567261
sub dword [ebp - 0xc], esi
mov ebx, dword [edi]
sub dword [ebp - 0x20], edi
xor ebx, edx
sub dword [ebp - 0x18], ecx
mov dword [esi], ebx
mov dword [ebp - 0x24], 0x840fa685
add esi, 4
add edi, 4
loop 0x10009340
add eax, 0x1491f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xdf4a6330
sub ecx, 0xcf4a6330
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x50871be5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x50871bf4
pop dword [ebp - 0x24]
mov eax, 0x50871bf4
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xeb3e48c3
sub dword [ebp - 0x34], 0x9cec0378
mov dword [ebp - 0x30], 0x43b55189
sub dword [ebp - 0x30], 0x11820544
mov dword [ebp - 0x2c], 0x223e8f57
add dword [ebp - 0x2c], 0x2a0db4d7
mov dword [ebp - 0x28], 0xddb363ed
add dword [ebp - 0x28], 0x224c9c13
lea eax, [ebp - 0x34]
push eax
mov eax, 0xd69d3b0a
add eax, 0x79e9d576
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x4d3ac6b9
sub dword [ebp - 0x34], 0xd8c85d63
mov dword [ebp - 0x30], 0x9886ecd
add dword [ebp - 0x30], 0x37e3f2a8
mov dword [ebp - 0x2c], 0x6ad7cbfb
sub dword [ebp - 0x2c], 0x7685f8f
mov dword [ebp - 0x28], 0xf45ec8d7
sub dword [ebp - 0x28], 0xf45ec8d7
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x5672e52e
add eax, 0xfa142b3a
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3629a
push 0
call eax
mov ecx, 0x761d52de
sub ecx, 0x761d0d8e
mov edx, eax
mov ebx, 0xc733cf3f
add ebx, 0x8953c0c1
add ebx, dword [ebp - 0x24]
mov esi, 0xa867e146
mov edi, dword [ebx]
add dword [ebp - 0x1c], 0x337eeea3
xor edi, esi
xor dword [ebp - 4], ecx
mov dword [edx], edi
add dword [ebp - 4], ecx
add edx, 0xd2357dbc
sub edx, 0xd2357db8
add ebx, 4
loop 0x50871d0b
add eax, 0x10813
mov ebx, eax
add eax, 0xfa838885
sub eax, 0xfa838880
mov ecx, 0x5589ffe5
add ecx, 0xfafd001b
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x50872f7f
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x50872f8a
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x5087472e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.50874717
and byte [esi + 0xc], 0
mov eax, 0x50870000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x50874788
cmp dword [ebp - 0x18], 5
jb 0x508747a0
jmp 0x5087479c
cmp dword [ebp - 0xc], 1
jne 0x508747a0
cmp dword [ebp - 0x18], 4
ja 0x5087479c
jne 0x508747a0
cmp dword [ebp - 0x14], 0
jbe 0x508747a0
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x50875050
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40596d
pop dword [ebp - 0x3c]
mov eax, 0x40596d
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xa7725d6a
sub dword [ebp - 0x4c], 0x5920181f
mov dword [ebp - 0x48], 0x9f1fc6e5
add dword [ebp - 0x48], 0x93138560
mov dword [ebp - 0x44], 0x7faa390e
add dword [ebp - 0x44], 0xcca20b20
mov dword [ebp - 0x40], 0x7e561dd6
add dword [ebp - 0x40], 0x81a9e22a
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x1f779126
add dword [ebp - 0x4c], 0x54fad830
mov dword [ebp - 0x48], 0x32e5a24d
sub dword [ebp - 0x48], 0xf17940d8
mov dword [ebp - 0x44], 0x14fc5962
add dword [ebp - 0x44], 0x4e73130a
mov dword [ebp - 0x40], 0xe1df9459
add dword [ebp - 0x40], 0x1e206ba7
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x38047
push 0
call eax
mov ecx, 0x323d2617
sub ecx, 0x323cd8e3
xor edx, edx
add edx, eax
mov esi, 0x7a93f851
sub esi, 0x7a52f851
add esi, dword [ebp - 0x3c]
mov ebx, 0x32532787
add ebx, 0xdbfb8f0d
xor dword [ebp - 4], eax
mov edi, dword [esi]
add dword [ebp - 0x28], 0x76da9b38
xor edi, ebx
xor dword [ebp - 0x18], 0x519d058a
mov dword [edx], edi
add dword [ebp - 0x28], eax
add edx, 4
add esi, 0xd2f340cf
add esi, 0x2d0cbf35
loop 0x405a82
add eax, 0x296da756
sub eax, 0x296c7fb3
xor ebx, ebx
add ebx, eax
add eax, 0x4b0635ae
add eax, 0xb4f9ca57
mov ecx, 0xe039ab86
sub ecx, 0xdff9ab86
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941