joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031ed0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xbc], 0
je 0x10031e06
mov ecx, dword [esi + 0xb8]
test ecx, ecx
je 0x10031e06
call fcn.10001a90
test al, al
je 0x10031dfa
mov ecx, dword [esi + 0xb8]
call fcn.100019d0
mov ecx, dword [esi + 0xb8]
pop esi
jmp fcn.10001940
pop esi
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov dword [0x1007fddc], eax
mov eax, dword [esp + 0x14]
mov dword [0x1007fdd8], ecx
mov dword [0x1007fde0], edx
mov dword [0x1007fde4], eax
mov ecx, 0x1007fde8
jmp 0x10031dd0

Function at 0x10032a60
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0x10
push esi
mov esi, dword [eax + 0x14]
jb 0x10032a73
mov eax, dword [eax + 4]
jmp 0x10032a76
add eax, 4
mov edx, dword [esp + 8]
cmp dword [edx + 0x18], 0x10
jb 0x10032a85
mov edx, dword [edx + 4]
jmp 0x10032a88
add edx, 4
add esi, 1
push esi
push eax
mov eax, dword [ecx]
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
add eax, 1
pop esi
ret 8

Function at 0x10032e00
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1006a598
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1007d1f8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, ecx
mov edi, dword [esp + 0x34]
xor ecx, ecx
cmp dword [edi + 0x18], 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
lea esi, [edi + 4]
jb 0x10032e44
mov eax, dword [esi]
jmp 0x10032e46
mov eax, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x14]
push edx
push ecx
push ecx
push ecx
push eax
mov eax, dword [ebp]
push eax
call ebx
test eax, eax
jne 0x10032f25
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1004109b
add esp, 4
mov byte [esp + 0x34], 0
mov edx, dword [esp + 0x34]
push edx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], eax
call fcn.10032b00
cmp dword [edi + 0x18], 0x10
mov dword [esp + 0x2c], 0
jb 0x10032e98
mov esi, dword [esi]
mov edi, dword [esp + 0x1c]
mov edx, dword [ebp]
lea eax, [esp + 0x14]
push eax
push edi
lea ecx, [esp + 0x20]
push ecx
push 0
push esi
push edx
call ebx
test eax, eax
jne 0x10032eeb
cmp dword [esp + 0x18], 1
jne 0x10032eeb
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10032ec0
mov ecx, dword [esp + 0x38]
sub eax, edx
push eax
push edi
call fcn.10003ca0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0xffffffff
call fcn.100329e0
mov al, 1
jmp 0x10032f27
mov esi, dword [esp + 0x20]
test esi, esi
mov dword [esp + 0x2c], 0xffffffff
je 0x10032f25
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10032f25
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10032f25
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x100370f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006aa00
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
mov eax, dword [0x1007d1f8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call fcn.10032920
xor ebx, ebx
push 0x10
push str.Software360safe
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.10003ca0
push ebx
push 0xf003f
lea eax, [esp + 0x18]
push eax
push SysReAllocString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 1
call fcn.10032b90
test al, al
sete byte [esp + 0xb]
cmp dword [esp + 0x28], 0x10
jb 0x1003717c
mov ecx, dword [esp + 0x14]
push ecx
call fcn.10040f62
add esp, 4
cmp byte [esp + 0xb], bl
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0x34], 0xffffffff
lea ecx, [esp + 0xc]
je 0x100371b6
call fcn.100329d0
xor al, al
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x30
ret
cmp dword [0x100800f0], ebx
je 0x1003719e
call fcn.100329d0
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x30
ret
Function at 0x100371e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1006aa38
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1007d1f8]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov edi, dword [esp + 0xa0]
xor ebx, ebx
cmp dword [edi + 0x14], ebx
je 0x100373d3
push 0x13
mov ebp, 0xf
push str.www.hao123.com__tn
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.10003ca0
push ebx
lea eax, [esp + 0x20]
push eax
push edi
mov dword [esp + 0xa4], ebx
call fcn.1000b6f0
add esp, 0xc
cmp dword [esp + 0x34], 0x10
mov esi, eax
mov dword [esp + 0x98], 0xffffffff
jb 0x10037274
mov ecx, dword [esp + 0x20]
push ecx
call fcn.10040f62
add esp, 4
cmp esi, 0xffffffff
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
je 0x100373d3
cmp dword [edi + 0x18], 0x10
jb 0x10037294
mov edi, dword [edi + 4]
jmp 0x10037297
add edi, 4
lea ebp, [edi + esi + 0x13]
mov dword [esp + 0x70], str.82013038_13_hao_pg
mov dword [esp + 0x74], str.82013038_32_hao_pg
mov dword [esp + 0x78], str.82033038_5_hao_pg
mov dword [esp + 0x7c], str.82033038_12_hao_pg
mov dword [esp + 0x80], str.29065018_45_hao_pg
mov dword [esp + 0x84], str.29065018_46_hao_pg
mov dword [esp + 0x88], str.29065018_47_hao_pg
mov dword [esp + 0x8c], str.29065018_48_hao_pg
mov dword [esp + 0x18], ebx
mov edx, dword [esp + 0x18]
mov esi, dword [esp + edx*4 + 0x70]
mov eax, esi
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10037308
sub eax, edi
push eax
push esi
lea ecx, [esp + 0x5c]
call fcn.10003ca0
mov edi, 0xf
mov eax, ebp
mov dword [esp + 0x98], 1
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
lea esi, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10037340
sub eax, esi
push eax
push ebp
lea ecx, [esp + 0x40]
call fcn.10003ca0
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov byte [esp + 0xa0], 2
call fcn.1000a4a0
add esp, 8
test eax, eax
mov esi, 0x10
sete byte [esp + 0x17]
cmp dword [esp + 0x50], esi
jb 0x1003738f
mov edx, dword [esp + 0x3c]
push edx
call fcn.10040f62
add esp, 4
cmp dword [esp + 0x6c], esi
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x98], 0xffffffff
jb 0x100373b9
mov eax, dword [esp + 0x58]
push eax
call fcn.10040f62
add esp, 4
cmp byte [esp + 0x17], bl
jne 0x100373ef
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, 8
mov dword [esp + 0x18], eax
jb 0x100372eb
xor al, al
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
mov al, 1
jmp 0x100373d5
Function at 0x10038d70
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1006acc0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x1007d1f8]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x1007d1f8]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, 0xf
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x80], 1
call fcn.10008f10
add esp, 4
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea ecx, [esp + 0x50]
mov byte [esp + 0x7c], 2
call fcn.10008680
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x58]
mov byte [esp + 0x84], 3
call fcn.10008730
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x88]
push ecx
call fcn.1002c110
add esp, 8
test al, al
jne 0x10038e8c
lea ecx, [esp + 0x50]
mov byte [esp + 0x7c], 2
call fcn.100086a0
mov edi, 0x10
cmp dword [esp + 0x30], edi
jb 0x10038e41
mov edx, dword [esp + 0x1c]
push edx
call fcn.10040f62
add esp, 4
cmp dword [esp + 0x4c], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
jb 0x10038e60
mov eax, dword [esp + 0x38]
push eax
call fcn.10040f62
add esp, 4
cmp dword [esp + 0x9c], edi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
jb 0x10038e85
mov ecx, dword [esp + 0x88]
push ecx
call fcn.10040f62
add esp, 4
xor al, al
jmp 0x10038f25
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x3c]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.10003960
call fcn.10038130
add esp, 0x1c
lea ecx, [esp + 0x50]
mov byte [esp + 0x13], al
mov byte [esp + 0x7c], 2
call fcn.100086a0
mov edi, 0x10
cmp dword [esp + 0x30], edi
jb 0x10038edd
mov eax, dword [esp + 0x1c]
push eax
call fcn.10040f62
add esp, 4
cmp dword [esp + 0x4c], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
jb 0x10038efc
mov ecx, dword [esp + 0x38]
push ecx
call fcn.10040f62
add esp, 4
cmp dword [esp + 0x9c], edi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
jb 0x10038f21
mov edx, dword [esp + 0x88]
push edx
call fcn.10040f62
add esp, 4
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.10040be4
add esp, 0x70
ret
Function at 0x10039080
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x10081260], ecx
add edx, 1
cmp edx, 0x100
jb 0x10039082
cmp edx, 0x800
jae 0x1003916b
mov edi, edi
mov eax, dword [edx*4 + 0x10080e60]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x10081260]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x1008125c], eax
jb 0x10039140
mov dword [0x10080218], 0x10039190
call fcn.1003d0c0
test eax, eax
jne 0x10039188
mov dword [0x10080218], 0x10039240
ret

Function at 0x10039cd0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
je 0x10039d32
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [edi], 0
lea esp, [esp]
cmp esi, 0x400000
mov eax, 0x400000
ja 0x10039cff
mov eax, esi
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x10039d37
test ecx, ecx
je 0x10039d30
test esi, esi
ja 0x10039cf0
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1003ce10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x1003ce29
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
jmp 0x1003ce50
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx]
cmp edi, edx
jae 0x1003ce6f
jmp 0x1003ce60
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x1003ce6f
add edi, 1
cmp edi, edx
jb 0x1003ce60
mov eax, edi
sub eax, ecx
mov ecx, eax
sub ecx, dword [esp + 0x1c]
cmp edi, edx
jae 0x1003cf85
cmp ecx, 3
jbe 0x1003cea5
xor ebp, ebp
mov cl, byte [edi + 4]
test cl, cl
mov dword [esp + 0x1c], eax
je 0x1003cee3
cmp cl, 0xff
je 0x1003cee3
and ebp, 3
add ebp, ebp
or ebp, 1
add eax, 1
jmp 0x1003ce50
add ecx, 0xffffffff
shl ebp, cl
and ebp, 7
je 0x1003ce88
movzx ecx, byte [ebp + 0x1006f870]
mov ebx, edi
sub ebx, ecx
cmp byte [ebp + 0x1006f868], 0
mov cl, byte [ebx + 4]
je 0x1003cecf
test cl, cl
je 0x1003cecf
cmp cl, 0xff
jne 0x1003ce88
and ebp, 3
add ebp, ebp
mov dword [esp + 0x1c], eax
or ebp, 1
add eax, 1
jmp 0x1003ce50
xor edx, edx
mov dh, cl
movzx ecx, byte [edi + 2]
mov dl, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
lea esp, [esp]
cmp dword [esp + 0x28], 0
je 0x1003cf0e
lea ebx, [edx + eax]
add ebx, esi
jmp 0x1003cf14
sub edx, eax
sub edx, esi
mov ebx, edx
test ebp, ebp
je 0x1003cf56
movzx esi, byte [ebp + 0x1006f870]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x1003cf39
cmp dl, 0xff
jne 0x1003cf52
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
sub edx, 1
xor edx, ebx
jmp 0x1003cf00
mov esi, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x18
and dl, 1
sub dl, 1
not dl
mov byte [edi + 4], dl
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 3], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x1003ce50
cmp ecx, 3
pop edi
pop esi
pop ebx
jbe 0x1003cf98
mov ecx, dword [esp + 0x18]
xor ebp, ebp
mov dword [ecx], ebp
pop ebp
pop ecx
ret
add ecx, 0xffffffff
shl ebp, cl
mov ecx, dword [esp + 0x18]
and ebp, 7
mov dword [ecx], ebp
pop ebp
pop ecx
ret

Function at 0x10040be4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007d1f8]
jne 0x10040bee
repz ret
jmp fcn.10045376
Function at 0x10045a79
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x1007d408]
je 0x10045a94
inc edi
cmp edi, 0x17
jb 0x10045a85
cmp edi, 0x17
jae 0x10045c14
push ebp
push 3
call fcn.10059709
cmp eax, 1
pop ecx
je 0x10045be0
push 3
call fcn.10059709
test eax, eax
pop ecx
jne 0x10045ac8
cmp dword [0x10080240], 1
je 0x10045be0
cmp ebx, 0xfc
je 0x10045c13
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10080578
push ebp
call fcn.1004547a
add esp, 0xc
test eax, eax
je 0x10045afe
push esi
push esi
push esi
push esi
push esi
call fcn.10041bce
add esp, 0x14
push 0x104
mov esi, 0x10080591
push esi
push 0
mov byte [0x10080695], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10045b42
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1004547a
add esp, 0xc
test eax, eax
je 0x10045b42
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10041bce
add esp, 0x14
push esi
call fcn.100454e0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10045b87
push esi
call fcn.100454e0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1008088c
push 0x1007129c
sub ecx, eax
push ecx
push eax
call fcn.10059656
add esp, 0x14
test eax, eax
je 0x10045b87
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10041bce
add esp, 0x14
jmp 0x10045b89
xor esi, esi
push 0x10071298
push ebx
push ebp
call fcn.100595e5
add esp, 0xc
test eax, eax
je 0x10045ba9
push esi
push esi
push esi
push esi
push esi
call fcn.10041bce
add esp, 0x14
push dword [edi*8 + 0x1007d40c]
push ebx
push ebp
call fcn.100595e5
add esp, 0xc
test eax, eax
je 0x10045bcb
push esi
push esi
push esi
push esi
push esi
call fcn.10041bce
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10059428
add esp, 0xc
jmp 0x10045c13
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10045c13
cmp ebp, 0xffffffff
je 0x10045c13
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1007d40c]
push dword [esi]
call fcn.100454e0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10059428
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10045d4c
xor ebx, ebx
cmp dword [0x10080c18], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x100594fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100595de
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x100595de
push eax
call fcn.10045cde
mov dword [esp], 0x10072070
push edi
mov dword [0x10080c18], eax
call esi
push eax
call fcn.10045cde
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10080c1c], eax
call esi
push eax
call fcn.10045cde
mov dword [0x10080c20], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10049804
test eax, eax
pop ecx
pop ecx
je 0x100594cc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10041bce
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x100594fe
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10045cde
cmp eax, ebx
pop ecx
mov dword [0x10080c28], eax
je 0x100594fe
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10045cde
pop ecx
mov dword [0x10080c24], eax
mov eax, dword [0x10080c24]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x10059583
cmp dword [0x10080c28], ecx
je 0x10059583
push eax
call fcn.10045d55
push dword [0x10080c28]
mov esi, eax
call fcn.10045d55
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x10059583
cmp edi, ebx
je 0x10059583
call esi
cmp eax, ebx
je 0x10059550
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10059550
test byte [ebp - 0x18], 1
jne 0x10059583
lea eax, [ebp - 0x10]
push eax
call fcn.100498b3
test eax, eax
pop ecx
je 0x1005956b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10041bce
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1005957a
or dword [ebp + 0x10], 0x200000
jmp 0x100595be
or dword [ebp + 0x10], 0x40000
jmp 0x100595be
mov eax, dword [0x10080c1c]
cmp eax, dword [ebp - 8]
je 0x100595be
push eax
call fcn.10045d55
cmp eax, ebx
pop ecx
je 0x100595be
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x100595be
mov eax, dword [0x10080c20]
cmp eax, dword [ebp - 8]
je 0x100595be
push eax
call fcn.10045d55
cmp eax, ebx
pop ecx
je 0x100595be
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10080c18]
call fcn.10045d55
cmp eax, ebx
pop ecx
je 0x100595de
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100595e0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001204a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10012059
pop dword [ebp - 0x3c]
mov eax, 0xc781775a
sub eax, 0xb7805701
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3d984
push 0
mov eax, 0x44829064
add eax, 0xcb8000a8
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x53db
mov esi, eax
mov edx, 0x9990f34e
sub edx, 0x898c874e
add edx, dword [ebp - 0x3c]
mov ebx, 0xccb0239d
sub ebx, 0xfae6d943
mov dword [ebp - 0x1c], 0x78bed7fc
mov edi, dword [edx]
sub dword [ebp - 0x14], 0x56bf9a
xor edi, ebx
xor dword [ebp - 0x38], 0xa3a9db9d
mov dword [esi], edi
add dword [ebp - 0x24], 0x789f6e25
add esi, 4
add edx, 0x52b1dbb6
add edx, 0xad4e244e
loop 0x100120b2
add eax, 0xec22fc1d
add eax, 0x13de4622
mov ebx, eax
add eax, 5
mov ecx, 0xe1d64dd3
add ecx, 0x2e29b22d
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x43cf0f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x43cf1e
pop dword [ebp - 8]
mov eax, 0xd72222ad
sub eax, 0xd6de538f
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x51b0b
push 0
mov eax, 0x8e72beec
add eax, 0x71d1f3c4
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x92e31fa
add ecx, 0xf6d21c52
mov ebx, eax
mov esi, 0xf0887c76
sub esi, 0xf03fee76
add esi, dword [ebp - 8]
mov edi, 0xbdc1c96d
add edi, 0x9b455d92
xor dword [ebp - 4], edi
mov edx, dword [esi]
sub dword [ebp - 4], edx
xor edx, edi
sub dword [ebp - 4], ecx
mov dword [ebx], edx
add dword [ebp - 4], 0xf3fa73ce
add ebx, 0x77094f99
sub ebx, 0x77094f95
add esi, 0x4c131f0
sub esi, 0x4c131ec
loop 0x43cf7d
add eax, 0xb71ec7d5
add eax, 0x48e2642e
mov ebx, eax
add eax, 0xee499f58
add eax, 0x11b660ad
mov ecx, 0x717ae281
sub ecx, 0x713ae281
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret