joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408260
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x427050]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x421284
push str.kernel32
mov dword [ebp - 0x428], eax
mov edi, 0x20019
mov dword [ebp - 0x430], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x420], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x42c], 0
test esi, esi
je 0x4082dc
lea ecx, [ebp - 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x42c], 0
je 0x4082dc
mov edi, 0x20119
lea edx, [ebp - 0x424]
push edx
push edi
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4083a7
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x434]
push edx
push 0
push str.Identifier
push eax
mov dword [ebp - 0x420], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x408369
mov edx, dword [ebp - 0x428]
xor ecx, ecx
mov word [edx], cx
mov edx, dword [ebp - 0x424]
push edx
mov dword [ebp - 0x420], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x420]
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040845c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x428]
lea eax, [ebp - 0x41c]
push eax
push 0x104
push ecx
call fcn.004087c6
mov edx, dword [ebp - 0x424]
add esp, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x420]
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040845c
mov esp, ebp
pop ebp
ret
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push eax
push str.GetRegValueString___Open_registry_error____ld_for__s_n
mov dword [ebp - 0x420], 0
call fcn.00402410
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x420]
add esp, 0xc
pop edi
xor ecx, ebp
pop esi
call fcn.0040845c
mov esp, ebp
pop ebp
ret

Function at 0x40845c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427050]
jne 0x408466
repz ret
jmp fcn.00409e76
Function at 0x41400d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a9f6
and dword [ebp - 4], 0
cmp dword [0x429e5c], 0
mov ebx, eax
jne 0x4140be
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41416f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41416f
push eax
call fcn.0040a984
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x429e5c], eax
call esi
push eax
call fcn.0040a984
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x429e60], eax
call esi
push eax
call fcn.0040a984
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x429e64], eax
call esi
push eax
call fcn.0040a984
pop ecx
mov dword [0x429e6c], eax
test eax, eax
je 0x4140be
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a984
pop ecx
mov dword [0x429e68], eax
mov eax, dword [0x429e68]
cmp eax, ebx
je 0x414116
cmp dword [0x429e6c], ebx
je 0x414116
push eax
call fcn.0040a9ff
push dword [0x429e6c]
mov esi, eax
call fcn.0040a9ff
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x414116
test edi, edi
je 0x414116
call esi
test eax, eax
je 0x41410d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41410d
test byte [ebp - 0xc], 1
jne 0x414116
or dword [ebp + 0x10], 0x200000
jmp 0x41414f
mov eax, dword [0x429e60]
cmp eax, ebx
je 0x41414f
push eax
call fcn.0040a9ff
pop ecx
test eax, eax
je 0x41414f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41414f
mov eax, dword [0x429e64]
cmp eax, ebx
je 0x41414f
push eax
call fcn.0040a9ff
pop ecx
test eax, eax
je 0x41414f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429e5c]
call fcn.0040a9ff
pop ecx
test eax, eax
je 0x41416f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x414171
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x405a12
pop dword [ebp - 0x10]
mov eax, 0x3c04abe3
add eax, 0xc43bae2f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x4e8f1cd1
add dword [ebp - 0x20], 0xffc3287a
mov dword [ebp - 0x1c], 0xb9cfcf5
sub dword [ebp - 0x1c], 0xd969b0b0
mov dword [ebp - 0x18], 0x9dd6b4a0
sub dword [ebp - 0x18], 0x518a7072
mov dword [ebp - 0x14], 0xeb0c8322
add dword [ebp - 0x14], 0x14f37cde
lea eax, [ebp - 0x20]
push eax
mov eax, 0xfc18ddbb
add eax, 0x427a349
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xc42df2e5
sub dword [ebp - 0x20], 0x4fbb898f
mov dword [ebp - 0x1c], 0xe9f9711c
sub dword [ebp - 0x1c], 0xa88d0fa7
mov dword [ebp - 0x18], 0x5ecc301a
sub dword [ebp - 0x18], 0xfb5cc3ae
mov dword [ebp - 0x14], 0x2e4fd61e
add dword [ebp - 0x14], 0xd1b029e2
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39290
push 0
call eax
mov ecx, 0x50b8
xor edi, edi
add edi, eax
mov edx, 0xefccad43
sub edx, 0xef85c943
add edx, dword [ebp - 0x10]
mov esi, 0x94445075
add dword [ebp - 0xc], 0x9d98a10
mov ebx, dword [edx]
xor dword [ebp - 0xc], 0x890dbc0c
xor ebx, esi
sub dword [ebp - 8], 0xd8fb3452
mov dword [edi], ebx
add dword [ebp - 4], 0x39c8acc5
add edi, 0x468bc3ad
add edi, 0xb9743c57
add edx, 4
loop 0x405b25
add eax, 0x640aa323
add eax, 0x9bf69290
mov ebx, eax
add eax, 0x7cea442c
add eax, 0x8315bbd9
mov ecx, 0x75449c8a
sub ecx, 0x75049c8a
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x44cd40
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453310
push 0x44f060
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x45a0e0], eax
xor eax, eax
mov al, byte [0x45a0e1]
mov dword [0x45a0ec], eax
mov eax, dword [0x45a0e0]
shr dword [0x45a0e0], 0x10
and eax, 0xff
mov dword [0x45a0e8], eax
shl eax, 8
add eax, dword [0x45a0ec]
mov dword [0x45a0e4], eax
call fcn.0051b000
test eax, eax
jne 0x44cdb4
push 0x1c
call fcn.0044cee0
add esp, 4
mov dword [ebp - 4], 0
call fcn.0044ee80
call fcn.0044ee70
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4656c4], eax
call fcn.0044ea20
mov dword [0x4594d0], eax
test eax, eax
je 0x44cde7
cmp dword [0x4656c4], 0
jne 0x44cdf1
push 0xffffffffffffffff
call fcn.0044e630
add esp, 4
call fcn.00412640
call fcn.0044e930
call fcn.0044e600
mov esi, dword [0x4656c4]
mov al, byte [esi]
cmp al, 0x22
je 0x44ce18
cmp al, 0x20
jbe 0x44ce45
inc esi
cmp byte [esi], 0x20
ja 0x44ce10
jmp 0x44ce45
inc esi
cmp byte [esi], 0x22
je 0x44ce44
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x44ce3f
xor eax, eax
mov al, bl
push eax
call fcn.0044e8d0
add esp, 4
test eax, eax
je 0x44ce39
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x44ce21
cmp byte [esi], 0x22
jne 0x44ce45
inc esi
cmp byte [esi], 0
je 0x44ce55
cmp byte [esi], 0x20
ja 0x44ce55
inc esi
cmp byte [esi], 0
jne 0x44ce4a
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x44ce79
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0044e630
jmp 0x44ceba
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44e670
Capabilities:
Terminate process

Disassembly:
cmp dword [0x45a11c], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x44e68e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x45a118], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x45a114], bl
jne 0x44e6e8
cmp dword [0x4656b8], 0
je 0x44e6d6
mov edi, dword [0x4656b4]
sub edi, 4
cmp edi, dword [0x4656b8]
jb 0x44e6d6
mov eax, dword [edi]
test eax, eax
je 0x44e6cb
call eax
sub edi, 4
cmp edi, dword [0x4656b8]
jae 0x44e6c3
push 0x45401c
push 0x454014
call fcn.0044e720
add esp, 8
push 0x454024
push 0x454020
call fcn.0044e720
add esp, 8
test ebx, ebx
jne 0x44e70f
mov dword [0x45a11c], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x40d578
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d2c
mov dword [ebp - 0x14], eax
cmp dword [0x4b2f58], esi
jne 0x40d66b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d5f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d74b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d74b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d74b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4b2f58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4b2f5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4b2f60], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b2f68], eax
test eax, eax
je 0x40d668
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b2f64], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d690
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d683
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6a5
push 4
pop eax
jmp 0x40d74d
cmp dword [ebp - 0x14], esi
je 0x40d6a5
push dword [0x4b2f58]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d68a
mov eax, dword [0x4b2f64]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d703
cmp dword [0x4b2f68], edi
je 0x40d703
push eax
call ebx
push dword [0x4b2f68]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d703
test eax, eax
je 0x40d703
call ecx
test eax, eax
je 0x40d6f8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d6f8
test byte [ebp - 8], 1
jne 0x40d703
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d733
mov eax, dword [0x4b2f5c]
cmp eax, edi
je 0x40d730
push eax
call ebx
test eax, eax
je 0x40d730
call eax
mov esi, eax
test esi, esi
je 0x40d730
mov eax, dword [0x4b2f60]
cmp eax, edi
je 0x40d730
push eax
call ebx
test eax, eax
je 0x40d730
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4b2f58]
call ebx
test eax, eax
je 0x40d74b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d74d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040e0
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x73b246df
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1e171853
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10007660
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
lea ebx, [eax + 0x1225]
push esi
mov esi, dword [esp + 0x24]
lea eax, [edx - 0xc18]
xor ebp, 0x1451
mov dword [esp + 0x18], eax
push edi
mov edi, dword [esp + 0x18]
lea ecx, [edx - 0x92a]
add edi, 0xffffdb4c
mov dword [esp + 0x10], ecx
lea eax, [ebp + 0x295e]
mov dword [esp + 0x24], edi
xor edx, 0x3bfa
cmp edi, eax
je 0x10007725
lea eax, [ebp + 0x1b81]
cmp dword [esp + 0x1c], eax
jge 0x10007725
lea eax, [edx - 0xe90]
cmp ecx, eax
jl 0x100076d0
mov dword [esi + 0x38], 0xb6db7f8b
jmp 0x10007725
mov eax, dword [0x1008a74c]
mov ecx, ebx
imul ecx, dword [esp + 0x10]
cmp dword [eax + 0x94], ecx
jae 0x10007725
mov eax, dword [0x100a3b3c]
mov ecx, dword [esi + 0x80]
and eax, 0x16bd
mov edx, dword [0x100a3afc]
xor ecx, 0x24b4
sub edx, dword [esi + 0xf4]
sub edi, dword [0x100a3a70]
push eax
mov eax, dword [esp + 0x28]
imul eax, dword [esp + 0x20]
push ecx
push eax
push esi
push edx
push edi
call fcn.10017f40
add esp, 0x18
mov edx, eax
mov eax, dword [0x1008a74c]
mov ecx, ebx
xor ecx, 0x39af
cmp edx, ecx
je 0x10007864
mov eax, dword [eax + 0x80]
cmp eax, dword [esi + 0xb0]
jb 0x10007760
mov eax, dword [0x100a3b24]
sub eax, dword [0x100a3b14]
sub eax, 0x23867
add dword [esi + 0x8c], eax
jmp 0x1000776e
mov eax, 0xffffee2c
sub eax, dword [esi + 0xe8]
add dword [esi + 0x38], eax
mov dword [esi + 0x50], 0x1008cc08
xor ebp, ebp
mov ecx, dword [0x1008a74c]
nop dword [eax]
mov eax, dword [ecx + 0xe8]
or dword [0x100a3a88], eax
mov eax, dword [0x100a3aa0]
xor dword [esi + 0xa4], eax
mov eax, dword [esi + 0x50]
mov edi, dword [eax + ebp]
add ebp, 4
mov eax, dword [0x1008a74c]
mov ecx, dword [eax + 0xcc]
mov eax, dword [esi + 0x94]
add ecx, 0xfffffffe
add eax, ecx
xor dword [esi + 0x24], eax
mov eax, dword [esi + 0xb0]
add eax, dword [0x100a3aa0]
mov edx, dword [esi + 0x38]
xor eax, 0xbe7cf
or dword [esi + 0x40], eax
mov eax, dword [esi + 0xf4]
xor dword [0x100a3b1c], eax
mov ecx, dword [esi + 0x54]
mov eax, dword [0x100a3a84]
imul edx, edi
mov byte [eax + ecx], dl
mov eax, dword [0x100a3abc]
inc dword [0x100a3a84]
add eax, 0xfffb2178
xor dword [0x100a3b3c], eax
mov eax, dword [0x1008a74c]
mov eax, dword [eax + 0x80]
xor eax, dword [esi + 0x74]
sub eax, 0x55bbb
add dword [esi + 0x2c], eax
mov ecx, dword [0x1008a74c]
mov eax, dword [ecx + 0xc]
xor eax, dword [esi + 0xdc]
xor eax, 0x1840f9
imul eax, dword [0x100a3b30]
mov dword [0x100a3b30], eax
mov eax, dword [esi + 0xc0]
xor eax, dword [0x100a3b3c]
xor eax, 0x19217b
mov dword [0x100a3b3c], eax
cmp ebp, 0x16710
jl 0x10007780
pop edi
pop esi
pop ebp
lea eax, [ebx - 0x1340]
pop ebx
pop ecx
ret
mov eax, dword [eax + 0xe8]
imul eax, dword [esi + 0x10]
imul eax, eax, 0x295e
cmp dword [esp + 0x10], eax
jae 0x100078a2
mov eax, ebp
sub eax, dword [esp + 0x1c]
add eax, 0x1336
push eax
lea eax, [ebx + ebp]
push eax
mov eax, dword [esi + 0xd8]
and eax, dword [esi + 0xb0]
and eax, 0x16bd
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
pop edi
pop esi
pop ebp
lea eax, [ebx - 0x1340]
pop ebx
pop ecx
ret
Function at 0x100078b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
add edx, 0xffffecca
push ebx
mov ebx, dword [esp + 0xc]
add ecx, 0x330
push ebp
mov ebp, dword [esp + 0x1c]
add ebx, 0xffffe357
push esi
push edi
mov dword [esp + 0x18], edx
mov edi, ebx
lea esi, [ebp - 0x1624]
mov dword [esp + 0x24], ecx
xor ebp, 0x3e0
mov dword [esp + 0x10], esi
lea eax, [ebp + 0x7c7]
cmp esi, eax
mov esi, dword [esp + 0x28]
je 0x10007936
mov eax, dword [0x1008a74c]
cmp dword [eax + 0x58], 0x51d3
ja 0x10007925
mov eax, dword [eax + 0xa4]
xor eax, dword [0x100a3b24]
xor eax, 0xd7a19
mov dword [0x100a3b24], eax
jmp 0x10007975
mov eax, dword [0x1008a74c]
add dword [eax + 0xdc], 0xffff0df7
jmp 0x10007975
lea eax, [ecx + ebx]
imul eax, dword [esi + 0xd4]
cmp dword [esi + 0x64], eax
je 0x10007975
mov ecx, dword [0x100a3b1c]
mov eax, dword [0x100a3b24]
or ecx, edx
sub ecx, 0x2676
cmp eax, ecx
jb 0x10007971
mov edx, dword [esi + 0xc0]
sub edx, dword [esp + 0x24]
inc eax
add edi, edx
cmp eax, ecx
jae 0x10007966
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
add eax, 0x16bd
cmp edx, eax
jg 0x10007a8e
cmp ebp, ecx
je 0x10007a2c
lea eax, [ebp - 0x173]
xor ecx, 0x9fd
push eax
push ecx
lea eax, [ebp + 0xf9]
xor edi, 0x1451
push eax
push esi
push edi
call fcn.10007b50
mov ecx, dword [0x1008a74c]
add esp, 0x14
mov edi, eax
mov ecx, dword [ecx + 0x24]
xor ecx, dword [0x100a3a54]
push 0x40
xor ecx, 0x14606f94
push ecx
push dword [0x100a3a60]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add eax, 0x1000
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0xa4]
mov dword [esi + 0x3c], eax
lea eax, [ebx + 0x1624]
push eax
lea eax, [ebx + 0x1785]
xor ebx, 0x1f4e
push eax
mov eax, dword [esp + 0x28]
add eax, 0x728
push eax
mov eax, dword [esp + 0x24]
push esi
xor eax, 0x295e
push ebx
push eax
call fcn.10018070
add esp, 0x18
xor edi, 0x5f8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esi + 0xf4]
and eax, 0x15c4
add eax, 0x1785
cmp dword [0x100a3b3c], eax
jb 0x10007a8e
mov edx, dword [esi + 0x40]
mov ecx, dword [0x100a3a74]
add edx, edi
cmp ecx, edx
jbe 0x10007a8e
mov ebp, dword [esi + 0xc4]
nop dword [eax]
mov eax, dword [0x1008a74c]
mov eax, dword [eax + 0xc4]
xor eax, ebp
or eax, dword [esi + 0xac]
cmp dword [esi + 0xc], eax
jbe 0x10007a87
mov eax, dword [esi + 0x14]
and eax, ebx
imul eax, dword [esi + 0x64]
sub dword [esi + 0xb8], eax
add ecx, 3
cmp ecx, edx
ja 0x10007a60
xor edi, 0x5f8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10007b50
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, ecx
push esi
lea esi, [ecx - 0x16bd]
xor ebx, 0x30cb
xor ecx, 0x16bd
mov eax, esi
lea edx, [ebp - 0x1624]
xor eax, 0x295e
add ecx, 0x2676
cmp edx, eax
je 0x10007c17
lea eax, [esi + 0x18eb]
cmp esi, eax
je 0x10007bc4
cmp dword [0x100a3a88], 0x3778
jae 0x10007c17
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x8c]
xor eax, dword [0x100a3a6c]
add eax, 0x9fa4778
xor dword [ecx + 0x18], eax
xor esi, 0x214c
mov eax, esi
pop esi
pop ebp
pop ebx
ret
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 0xb0]
and eax, edx
sub eax, 0x18eb
cmp esi, eax
jb 0x10007c16
mov eax, esi
or edx, 0x1f4e
sub eax, ebx
push eax
mov eax, dword [edi + 0xc4]
xor eax, ebp
xor eax, 0x1624
add eax, 0x2676
push eax
mov eax, dword [0x100a3ab8]
and eax, esi
imul eax, ecx
push eax
mov eax, dword [0x1008a74c]
mov ecx, dword [eax + 0x40]
imul ecx, esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
xor esi, 0x214c
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x10007c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
xor edx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov ebp, esi
and ebp, eax
mov ecx, dword [0x100ad2ec]
div esi
movzx edx, word [0x100ad2d0]
mov ebx, dword [0x100ad2fc]
mov dword [esp + 0x18], eax
mov eax, dword [0x100ad2f4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
push edi
mov edi, dword [ecx + edx*4]
mov byte [esp + 0x13], bl
movzx eax, word [eax + 0x35dc]
mov dword [esp + 0x20], eax
cmp edi, 0x95b
jl 0x10007cf6
lea eax, [eax + esi*4]
add eax, 0x10
mov dword [esp + 0x18], eax
nop
mov eax, dword [0x100ad2bc]
mov edx, dword [esp + 0x14]
mov esi, dword [ebp]
movzx ecx, word [edx + eax*2]
movzx eax, word [edx + 0x2102]
xor edx, edx
div ecx
movzx ecx, byte [esi + 0x9b1]
or eax, ebx
cdq
idiv ecx
mov eax, dword [esp + 0x18]
mov byte [esi + 0x9b1], dl
xor edx, edx
mov eax, dword [eax]
and eax, 0x9dc
div dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov word [eax + edi*2], dx
inc edi
mov al, byte [esp + 0x13]
sub al, byte [0x100ad2c9]
mov byte [0x100ad2c9], al
cmp edi, 0x95b
jl 0x10007cf6
mov ebx, dword [0x100ad2fc]
jmp 0x10007c90
movzx eax, word [0x100ad2c0]
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x100ad30c]
mov edx, dword [esp + 0x14]
mov word [0x100ad2d0], ax
lea eax, [ebx + ebx*2]
lea esi, [edi + eax*2]
mov eax, dword [ebp]
movzx ecx, word [edx + ecx*2]
xor edx, edx
movzx eax, word [edi + eax*2]
div ecx
mov edx, dword [esp + 0x20]
or eax, 0x1934
sub ax, word [esi]
mov word [esi], ax
movzx eax, byte [esp + 0x13]
add dword [0x100ad30c], eax
mov eax, dword [0x100ad304]
movzx ecx, byte [0x1f6d]
lea esi, [edi + eax*2]
mov eax, dword [edx + 0x11d0]
sub eax, ecx
movzx ecx, word [esi + 2]
xor eax, dword [edx + ebx*4]
xor edx, edx
div ecx
mov word [esi + 2], ax
dec dword [0x100ad304]
mov ecx, dword [ebp]
movzx eax, word [ebp + 0x1674]
mov word [edi + ecx*2 + 0xc], ax
mov eax, dword [0x100ad300]
lea ecx, [eax + ebx*4]
mov eax, dword [ebp]
movzx eax, word [edi + eax*2 + 8]
imul eax, dword [ebp + 0x6530]
pop edi
pop esi
pop ebp
pop ebx
sub eax, dword [ecx]
mov dword [ecx], eax
mov eax, dword [0x100ad2dc]
xor eax, dword [0x100ad2c0]
add esp, 0x14
ret