joyce8/EMBER2024-capa huggingface dataset:
Function at 0x738454
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
neg edx
ror edx, 3
sal ecx, cl
bts eax, ecx
dec edx
xor cx, 0x43b7
neg edx
xor ebx, edx
or ecx, 0x72172710
adc ebp, edx
mov ax, word [edi + eax - 0x1fdc3c01]
mov dx, word [edi + ecx - 0x7b9767b5]
call fcn.0064783f
xor edx, ebx
not ecx
bswap edx
inc edx
xchg ah, cl
call fcn.007a49b9
mov eax, 0xf011e20d
mov ecx, eax
inc cl
mov edx, dword [esi]
add ecx, eax
sub eax, eax
not cl
lea esi, [esi + eax*2 + 4]
add eax, eax
xor edx, ebx
bts eax, eax
setb cl
xor edx, 0x3aae7d05
sub eax, ecx
or cx, 0x5c17
jle 0x673372
mov dword [esp + ecx - 0x2c940000], edx
add dl, byte [esp + ecx*2 - 0x5927fffd]
not al
adc al, 0x3f
sub dl, ch
xor bl, al
btc ecx, edx
lea eax, [esp + eax + 4]
adc cx, word [eax + ecx - 0x2c950000]
movsx eax, dl
or al, 0xa
lea edi, [edi + edx*4 - 0x77c42]
or edx, eax
pop eax
mov word [edx + edi - 0x1df1a], cx
mul edx
movsx ecx, al
neg edx
mov edx, dword [ebp]
lea ecx, [eax*4 - 0x6b768356]
adc ebp, 3
jmp 0x78d88e
cmp edx, dword [edx + 0xf]
stosd dword es:[edi], eax
enter 0x448d, 0x24
and al, 0x50
sal cl, 0xe4
js 0x68beb0
push edx
loop 0x78d8f1
div byte [edi - 0x75]
push ebx
cli
mov byte [esi - 0x60], cl
fsubr qword [esi]
inc esp
dec edx
loop 0x78d870
pushal
xchg edi, eax
cmp al, 0x3b
int3
sbb al, 0xa0
loope 0x78d8f4
inc dword [ecx + 0x1feb1ce9]
sub al, cl
rol dword [ebx], 0x81
jmp 0xcb0079a9

Function at 0x74dd52
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x779b3d
push dword [esp + 8]
popfd
lea esp, [esp + 0x14]
call fcn.00634874
mov edx, edi
mov eax, 0x3c13180c
jmp 0x5bb9a3
je 0x77038d
jl 0x770388
not word [esp + 4]
add dword [esp], 0xff9cf71c
shl dword [esp + 4], 0x4c
not dword [esp + 4]
jne 0x65b0c3
lea edi, [edi + eax - 0x3c131810]
mov ecx, eax
mov dword [edi + ecx*2 - 0x78263018], edx
mov eax, dword [ebp + eax - 0x3c13180c]
push ecx
imul ecx, ecx
lea ebp, [ebp + ecx - 0x340a408c]
xor eax, ebx
inc dword [esp + ecx - 0x340a4090]
dec eax
jmp 0x6937f2

Function at 0x75019e
Capabilities:
Encode data using xor

Disassembly:
ret
int1
dec dword [edi]
enter 0xfffffffffffff180, 0xffffffffffffff9d
push esi
call fcn.006a982e
jae 0x75015f
loope 0x7501d5
test eax, 0x8e5ed329
pop ss
lock xchg byte [ebx + 0x93ed1c3], ch
add eax, 0x2af11a4f
inc ebx
ljmp 0x45cf
ja 0x750192
sbb byte [eax - 0x3370a25d], dh
int1
dec esi
add ebp, ecx
imul dword [esi + 3]
dec edi
push es
sub al, byte [esi + 0x5e1e796c]
fstp xword [ecx + 0x21]
pop es
xchg esp, eax
jbe 0x750222
invalid
xor bh, byte [ebx + 0x6c]
cdq
invalid

Function at 0x754b28
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
mov dword [esp + ecx - 0x448df300], eax
add edi, edx
xchg byte [esp + eax - 0x448df2fd], al
sub dword [esp + ecx - 0x448df300], 0xe8200ab
add dword [esp + ecx - 0x448df300], ecx
mov dx, word [ebp + eax - 0x448df344]
or cl, byte [ecx + ebp - 0x448df2fe]
and word [esp + eax - 0x448df342], ax
lea ebp, [ebp + eax - 0x448df342]
shr dx, cl
call fcn.0066d281
cmovp si, sp

Function at 0x756550
Capabilities:
Read file on windows

Disassembly:
pop edx
pop ecx
pop edx
jno fcn.00647291
Function at 0x75a0f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub eax, ecx
push 0x672a13b0
call fcn.005c0f31
mov edx, 0x2061a07
lea ecx, [edx + edx*8 - 0x356e615d]
mov eax, dword [edx + esi - 0x2061a07]
call fcn.006cca38

Function at 0x764631
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax - 0x49], bh
mov ch, 0xf5
jmp ebx
invalid
mov ah, 0xbc
popal
stosb byte es:[edi], al
add dword [esi], 0x7998f58a
adc byte [eax], bh
cld
mov byte [0xa67778ad], al
cmp dword [ebx - 0xc], 0xe
ja 0x69909c
pop es
sub cl, dl
jp 0x6990b5
outsw dx, word [esi]
xchg esp, eax
push 0xfd6baba2
add byte [esi - 1], 0x29
test edx, edx
hlt
fsubr st(3), st(0)
inc ebp
das
push ebp
sub al, 0
jnp 0x699116
add byte [ebx - 3], bh
or al, 0
std
or dword [esi - 0x39fff18c], eax
push ebp
hlt
loopne 0x6990c6
lodsb al, byte [esi]
sub dword [eax], ebx
dec ecx
cmp al, 0x87
xor edx, ebx
call fcn.006e028c
mov ecx, dword [ebp + ecx*4 - 0x4087e01c]
add ebp, 4
mov eax, 0xb2bbdf9e
mov edx, eax
xor ecx, ebx
xor edx, dword [esp]
neg ecx
cbw
lea ecx, [ecx + eax - 0x4fccd18]
mul ax
lea eax, [eax + 0x61ab0794]
ror ecx, 1
call fcn.0071fd96
jnp 0x69910f
or eax, 0x64dd783f
mov byte [ebx - 0x35], ch
cwde
pushal
push eax
jae 0x699141
sti
fcom dword fs:[ecx + edx]
wait
add eax, 0x64b719a1
arpl word [edi], di
sbb ebp, eax
jl 0x699137
scasb al, byte es:[edi]
test byte [edi - 0x65], bh
int1
xchg edx, eax
push es
cmp dword [ebx + 0x1a12d1d5], ebx
push ebx
wait
push esp
retf 0x2069
call 0x5a708c
mov edx, 0x1a1b728c
mov ax, word [edx + edi - 0x1a1b728c]
dec dl
lea edx, [edx*2 - 0x3cee616c]
mov dx, word [edi + 2]
mov ecx, 0x1021c1b0
sar cx, 0xc3
lea edi, [edi + ecx*2 - 0x2043f06a]
sar cl, 0xc3
add ax, dx
inc cx
push ecx
mov word [edi + ecx - 0x1021f807], ax
jne 0x699146

Function at 0x76e74d
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edx + ebp - 0x64000000]
xor edx, ebx
pop ecx
add edx, 0x683ba329
mov ecx, 0x52991db9
ror edx, 1
xor edx, 0xcebadb8a
call fcn.006d49cf
stosb byte es:[edi], al
invalid

Function at 0x76ebc6
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x6a3de3
mov dword [ebx + 0x14], ecx
test dx, 0x12b
rcl eax, cl
mov dword [ebx + 0x10], 8
test bp, ax
rcl ax, cl
mov eax, dword [edi + 0x10]
cmp sp, 0x5932
cmp sp, bp
cmp eax, ecx
jmp 0x76b7af
je 0x647a21
mov edx, dword [eax + 4]
shr edx, 8
add ax, 0x303a
cwde
mov dword [ebx + 0xc], edx
bts ax, di
lahf
mov eax, dword [ebp + 4]
cmp eax, ecx
jmp 0x5b84c4
not ecx
xor eax, ebx
mov dword [esp + edx - 1], edx
ror eax, 2
add eax, edx
call fcn.00684805
je 0x76ec4e
cmp dword [esi + 0x1cc], 0
mov ecx, eax
jne 0x76ebef
shr ecx, 1
mov eax, dword [esi + 0x334]
mov dx, di
sbb dx, di
and edx, esi
add eax, ecx
mov ecx, dword [esi + 0x144]
setae dh
xor dx, bp
xor ecx, dword [eax]
sar dh, 0xa8
sbb dh, al
rcr dl, 3
add eax, 4
stc
mov dword [edi + 0x70], eax
bt dx, 0x17
cmp dx, si
shrd eax, esp, 0x91
mov dword [edi + 0x74], ecx
btc dx, dx
bts eax, ecx
mov edx, dword [ebp]
sbb ax, 0x5816
bts eax, ecx
mov eax, dword [edx + 4]
stc
and eax, 1
mov dword [edi + 0x78], eax
clc
btr ax, 0xab
sar ah, cl
mov eax, dword [ebp + 4]
clc
sub ecx, ecx
cmp ch, 0x84
cmp eax, ecx
jmp 0x647a08
Function at 0x77307b
Capabilities:
Create thread

Disassembly:
push ecx
jmp 0x66ccca
call fcn.0043ab89
mov edx, dword [esp + 0xc]
add esp, 4
jmp 0x5e5a6c
push 0xffffffffffffffff
jmp 0x5b2f98
call fcn.00419700
mov esi, dword [0x5a1ab4]
movsx eax, sp
xchg di, dx
rdtsc
mov edi, dword [0x5a1b8c]
movsx ax, ch
cbw
movsx edx, sp
mov edx, dword [esi + 0x44]
movzx eax, si
mov eax, edi
jmp 0x6d49f8
push edx
jmp 0x730dec
call fcn.0043a911
mov ecx, dword [esp + 0x14]
test si, dx
test sp, 0xe014
add esp, 0xc
jmp 0x5c593b
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push method.CHVMEEHlpr.virtual_12
jmp 0x5c2035
call fcn.004150e0
mov eax, dword [esi + 0x44]
jmp 0x41eaef
push 0x41f430
jmp 0x7410dc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x5a1b8c]
mov ecx, dword [esi + 0x34]
xadd eax, eax
mov dword [esi + 0x18], ecx
adc ax, 0xda99
sbb dx, 0x9c22
sal ah, 0x3d
mov eax, dword [ecx + 0x3c]
movzx edx, word [eax + ecx + 0x14]
test ebp, 0xb9bd407
jmp 0x788fbb
mov dword [esp + 0x18], 0x41f360
jmp 0x6180d8
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x20]
call fcn.004207fd
push 0
jmp 0x71cad2
add eax, ecx
cmp bx, si
test cx, bp
cmp word [eax + 0x18], 0x20b
test si, si
lea eax, [edx + eax + 0x18]
mov edx, dword [eax + 0xc]
stc
add edx, ecx
mov dword [esi + 0x18], edx
xchg ch, dl
not dh
mov ecx, dword [eax + 0x10]
movsx edx, bp
mov dword [esi + 0x14], ecx
bswap dx
cmovge dx, dx
mov edx, dword [eax + 0x14]
push edx
jmp 0x5e5606

Function at 0x7920f7
Capabilities:
Load windows common language runtime

Disassembly:
push 0x4571f0
jmp 0x67c511
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jmp 0x758ae9
call fcn.0040e8f0
lea esp, [esp + 4]
sbb bl, 0x13
test dl, 0x8e
clc
sub eax, eax
pop ebx
jmp 0x402ad6
push 0x45719c
push eax
jmp 0x5d5dfe
mov ecx, dword [esp + 8]
jmp 0x6edb1a
call eax
test eax, eax
jge 0x76cabd
push str.Unable_to_load_the_CLR_v2_n
mov ebx, 0xcd09ef2b
mov ebx, eax
jmp 0x6289ae
push 0x4571e8
jmp 0x5abf31
push 3
jmp 0x690b7b
push 0x45733c
push 0x45732c
jmp 0x6ce9ee
push ecx
jmp 0x6e3c8e
jne 0x63d131
push str.Cant_load_mscoree.dll_for_.net_framework_v2.0.50727_n
stc
sub ebx, ebx
jmp 0x5e28b7
push ebx
jmp 0x63a7f6

Function at 0x79a0ad
Capabilities:
Set environment variable

Disassembly:
push edx
mov dword [esp + 0xc], 0xaba133d2
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.005f0875

Function at 0x79a0c4
Capabilities:
Set environment variable

Disassembly:
push 0xe4a5c302
mov esi, dword [esp + 0x10]
push 0x25003b93
mov edi, dword [esp + 0x18]
lea esp, [esp + 0x1c]
call fcn.005cd17c
Function at 0x7a981c
Capabilities:
Get file version info

Disassembly:
call fcn.006642fc
inc cl
xor ax, bx
mov dword [esp + 4], ecx
not ax
inc ax
mov dword [esp], ecx
xor ax, 0x7e98
dec ax
pop ecx
ror ax, 1
sar cl, 0x65
pop edx
inc ax
add dl, 0xad
xor bx, ax
xor edx, ecx
bswap ecx
lea edi, [edi + edx*2 - 0x158]
jge 0x647442
mov edx, 0x6a2812a1
mov ecx, dword [edi + edx - 0x6a2812a1]
bswap edx
lea eax, [edx*8 - 0x4fe6b650]
btc ax, dx
adc edi, 3
btc eax, edx
xor ecx, ebx
ror ecx, 1
bswap ecx
inc ecx
sar dl, 0xc4
shl eax, 0x2d
xadd eax, edx
rol ecx, 2
and eax, 0x5a122327
call fcn.007700eb
mov ecx, 0x4e089f88
mov ax, word [edi + ecx - 0x4e089f88]
movzx edx, cx
mov dx, word [edi + edx*2 - 0x13f0e]

Function at 0x251b210
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0251b360
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x251b236
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x251b222
add dl, dl
jne 0x251b241
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x251b294
xor eax, eax
add dl, dl
jne 0x251b24e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x251b335
add dl, dl
jne 0x251b25d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x251b268
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x251b273
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x251b27e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x251b28a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x251b22d
mov eax, 1
add dl, dl
jne 0x251b2a2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x251b2ad
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x251b299
sub eax, ebx
mov ebx, 1
jne 0x251b2e0
mov ecx, 1
add dl, dl
jne 0x251b2c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x251b2d1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x251b2bd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x251b22d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x251b2f7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x251b302
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x251b2ee
cmp eax, 0x7d00
jae 0x251b325
cmp eax, 0x500
jb 0x251b320
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x251b22d
cmp eax, 0x7f
ja 0x251b328
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x251b22d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x251b356
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x251b22d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4056c0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push 0x5040d1
push 0x504088
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.USER32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0xd94ba4
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x824
mov eax, dword [0xe24244]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
mov ebx, dword [esp + 0x838]
lea ecx, [esp + 8]
push ebp
mov ebp, dword [esp + 0x838]
push esi
push edi
mov edi, dword [esp + 0x838]
xor esi, esi
push esi
call fcn.00da9a04
cmp dword [esp + 0x83c], 2
jae 0xd94bf5
push str.jusched_Error:_Events_array_too_small
call fcn.00da98f9
pop ecx
push 0xffffffffffffff9d
pop esi
and dword [edi], 0
call fcn.00da2842
mov dword [edi], eax
test eax, eax
jne 0xd94c11
push str.ERROR:_ShutdownEvent_handle_is_NULL
call fcn.00da98f9
pop ecx
push 0xfffffffffffffffe
pop esi
push 0
push ebx
call fcn.00da2cc9
pop ecx
pop ecx
test eax, eax
jne 0xd94c2e
push str.jusched_ERROR:_Could_not_open_Policy_key_for_reading
call fcn.00da98f9
pop ecx
push 0xfffffffffffffffd
jmp 0xd94c4a
push dword [ebx]
call fcn.00d955f1
mov dword [edi + 4], eax
pop ecx
test eax, eax
jne 0xd94c4b
push str.jusched_main:_ERROR_creating_registry_watch_event_notifier
call fcn.00da98f9
pop ecx
push 0xfffffffffffffffe
pop esi
and dword [ebp], 0
push str.SunJavaUpdateSchedulerMutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp], eax
test eax, eax
jne 0xd94cbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x800
mov esi, eax
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00dd2690
add esp, 0xc
lea eax, [esp + 0x30]
cmp esi, 0xb7
jne 0xd94c9d
push str.Error:_Scheduler_Mutex_already_exists_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
jmp 0xd94cad
push esi
push str.Error:_Error_creating_scheduler_mutex:__d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x30]
push eax
call fcn.00da98f9
pop ecx
or esi, 0xffffffff
jmp 0xd94cc1
test esi, esi
je 0xd94ce8
push dword [ebp]
push dword [esp + 0x840]
push edi
call fcn.00d94808
add esp, 0xc
lea ecx, [esp + 0x14]
push dword [ebx]
call fcn.00da9a42
lea ecx, [esp + 0x14]
call fcn.00da9a4c
mov ecx, dword [esp + 0x830]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00dd0ce3
add esp, 0x824
ret
Function at 0xd97127
Capabilities:
Set registry value

Disassembly:
cmp dword [esp + 8], 0
push ebp
mov ebp, ecx
jne 0xd97136
push 0xd
pop eax
jmp 0xd97167
push ebx
mov ebx, dword [esp + 0x10]
push edi
xor edi, edi
push ebx
call fcn.00dd6690
inc eax
add ebx, eax
add edi, eax
pop ecx
cmp eax, 1
jne 0xd9713e
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop ebx
pop ebp
ret 8
Function at 0xd9a3b3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0xe24244]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
push ebx
push ebx
push 1
mov dword [edi + 0xc], 0xbc2
mov eax, dword [0xe26e30]
push ebx
mov dword [edi + 0x18], eax
call esi
push ebx
push ebx
push 1
push ebx
mov dword [edi + 0x20], eax
call esi
push ebx
push ebx
push 1
push ebx
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x38], eax
call fcn.00da2842
mov dword [edi + 0x3c], eax
call fcn.00d9ca79
push dword [edi + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [edi + 0x40], eax
call esi
push dword [edi + 0x24]
call esi
push dword [edi + 0x38]
call esi
lea eax, [ebp - 0x10c]
push eax
push ebx
push edi
push 0xd9a1f5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0xd9a447
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0x20]
call esi
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [edi + 0x54]
mov ebx, 0x104
push ebx
push eax
push 0x7b
push dword [edi + 0x18]
call esi
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x7c
push dword [edi + 0x18]
call esi
lea eax, [ebp - 0x108]
mov ecx, edi
push eax
call fcn.00d9a4d9
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00dd0ce3
leave
ret 4

Function at 0xd9b663
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
lea ecx, [eax - 1]
push esi
mov ebx, ecx
push edi
mov edi, dword [esp + 0x1c]
mov esi, edi
sar ebx, 1
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ecx
cmp edi, ebx
jge 0xd9b6bf
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x30
add ecx, ebp
lea eax, [ecx - 0x30]
push eax
call fcn.00d9a075
movzx eax, al
xor eax, 1
imul ecx, edi, 0x30
inc eax
add esi, eax
imul eax, esi, 0x30
add ecx, ebp
add eax, ebp
push eax
call fcn.00d9c3ec
mov edi, esi
cmp esi, ebx
jl 0xd9b689
mov eax, dword [esp + 0x20]
cmp esi, ebx
jne 0xd9b6de
test al, 1
jne 0xd9b6de
imul eax, eax, 0x30
imul ecx, edi, 0x30
add eax, 0xffffffd0
add eax, ebp
add ecx, ebp
push eax
call fcn.00d9c3ec
mov edi, dword [esp + 0x1c]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x18]
push edi
push ebp
call fcn.00d9b784
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xd9f451
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0xe24244]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0xd9f476
xor eax, eax
jmp 0xd9f546
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0xd9f4a4
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0xd9f4a4
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0xd9f545
cmp dword [esi + 0x4c], 0
je 0xd9f543
mov ecx, esi
call fcn.00d9e874
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0xd9f4d0
push dword [esi + 0x4c]
push eax
call fcn.00d9b083
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0xd9f543
mov byte [esp + 0x10], al
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0xd9f514
sub eax, 1
je 0xd9f514
dec eax
sub eax, 1
jne 0xd9f543
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0xd9f4c2
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x1c]
sub ebp, eax
je 0xd9f533
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.00ddb1d4
add esp, 0x10
cmp ebp, eax
jne 0xd9f543
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x18], eax
mov eax, ebx
jne 0xd9f545
mov eax, edi
pop ebp
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00dd0ce3
add esp, 0x30
ret 4
Function at 0xd9fadc
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
test ebp, ebp
jg 0xd9fb01
jl 0xd9faf8
test ebx, ebx
jne 0xd9fb01
xor eax, eax
xor edx, edx
jmp 0xd9fbc6
cmp dword [esi + 0x38], 0
je 0xd9fb17
push ebp
push ebx
push dword [esp + 0x1c]
call fcn.00d99020
jmp 0xd9fbc6
mov eax, dword [esi + 0x1c]
push edi
mov edi, ebx
mov ecx, dword [eax]
test ecx, ecx
je 0xd9fb5d
mov eax, dword [esi + 0x2c]
cmp dword [eax], 0
jbe 0xd9fb5d
cmp dword [eax], ebx
mov esi, ebx
mov edi, dword [esp + 0x18]
cmovb esi, dword [eax]
push esi
push ecx
push edi
call fcn.00d985ad
mov ecx, dword [esp + 0x1c]
add edi, esi
mov dword [esp + 0x24], edi
add esp, 0xc
mov edi, ebx
sub edi, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, ecx
jmp 0xd9fb65
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
cmp dword [esi + 0x4c], 0
je 0xd9fbbc
mov ecx, esi
call fcn.00d9e874
mov ecx, dword [esp + 0x18]
mov edx, edi
mov eax, 0xfff
cmp edi, eax
jbe 0xd9fba7
push dword [esi + 0x4c]
push eax
push 1
push ecx
call fcn.00ddab4d
mov ecx, dword [esp + 0x28]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [esp + 0x18], ecx
mov edx, edi
cmp eax, 0xfff
jne 0xd9fbbc
jmp 0xd9fb78
test edx, edx
je 0xd9fbbc
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.00ddab4d
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb ebp, 0
mov edx, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0xd9fbcd
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0xd9fbef
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.00d9910d
jmp 0xd9fcc1
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x20], edi
test ecx, ecx
je 0xd9fc1c
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0xd9fc22
xor ecx, ecx
mov dword [esp + 0x14], eax
mov eax, ecx
cdq
mov dword [esp + 0x2c], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0xd9fc8a
jg 0xd9fc39
test esi, esi
je 0xd9fc8a
test ecx, ecx
jl 0xd9fc84
jg 0xd9fc43
test eax, eax
je 0xd9fc84
cmp edi, ecx
jg 0xd9fc57
jl 0xd9fc4d
cmp esi, eax
jae 0xd9fc57
mov eax, esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x10], edi
mov ebp, dword [esp + 0x28]
push eax
push ebp
push dword [esp + 0x20]
call fcn.00d985ad
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x2c]
add ebp, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0xd9fc8e
mov ebp, dword [esp + 0x28]
jmp 0xd9fc98
mov ebp, dword [esp + 0x28]
test edi, edi
jl 0xd9fcb2
jg 0xd9fc98
test esi, esi
je 0xd9fcb2
cmp dword [ebx + 0x4c], 0
je 0xd9fcb2
push dword [ebx + 0x4c]
push esi
push 1
push ebp
call fcn.00ddb1d4
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc