joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a6c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x508
push ebx
push ebp
mov ebp, dword [esp + 0x514]
push esi
test ebp, ebp
push edi
je 0x44a879
mov ebx, dword [esp + 0x520]
cmp ebx, 0x20
jb 0x44a879
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x118]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x118]
push eax
push ecx
push edx
push 0x45d36c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x44a879
lea edi, [esp + 0x118]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x40
jne 0x44a879
lea edx, [esp + 0x118]
lea ecx, [esp + 0x18]
mov esi, 0x80
lea eax, [esp + 0x18]
sub edx, ecx
lea ecx, [esi - 0x60]
test ecx, ecx
je 0x44a77c
mov cl, byte [edx + eax]
test cl, cl
je 0x44a77c
mov byte [eax], cl
inc eax
dec esi
jne 0x44a766
jmp 0x44a780
test esi, esi
jne 0x44a781
dec eax
lea edx, [esp + 0x138]
lea ecx, [esp + 0x98]
mov byte [eax], 0
mov esi, 0x80
lea eax, [esp + 0x98]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x44a7af
mov byte [eax], cl
inc eax
dec esi
jne 0x44a7a0
jmp 0x44a7b3
test esi, esi
jne 0x44a7b4
dec eax
mov byte [eax], 0
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x118]
push 0x400
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.0044a4d0
add esp, 0xc
lea ecx, [esp + 0x98]
lea edx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x44a879
cmp ebx, 0x7fffffff
jbe 0x44a81c
mov eax, 0x80070057
xor ecx, ecx
test eax, eax
pop edi
pop esi
sete cl
pop ebp
mov eax, ecx
pop ebx
add esp, 0x508
ret
xor edi, edi
mov edx, ebx
test ebx, ebx
mov eax, ebp
jne 0x44a841
mov edi, 0x80070057
xor ecx, ecx
mov eax, edi
pop edi
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x508
ret
lea esi, [esp + 0x18]
sub esi, ebp
mov cl, byte [esi + eax]
test cl, cl
je 0x44a856
mov byte [eax], cl
inc eax
dec edx
jne 0x44a847
jmp 0x44a85a
test edx, edx
jne 0x44a860
dec eax
mov edi, 0x8007007a
mov byte [eax], 0
mov eax, edi
xor ecx, ecx
pop edi
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x508
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x508
ret
Function at 0x44a890
Capabilities:
Set registry value

Disassembly:
sub esp, 0x188
mov ecx, 0x20
xor eax, eax
push esi
mov esi, dword [esp + 0x190]
push edi
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push 0x80
push eax
push esi
call fcn.0044a4d0
mov edx, esi
lea ecx, [esp + 0x98]
add esp, 0xc
mov edi, 0x104
lea eax, [esp + 0x8c]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x44a8e5
mov byte [eax], cl
inc eax
dec edi
jne 0x44a8d6
jmp 0x44a8e9
test edi, edi
jne 0x44a8ea
dec eax
mov byte [eax], 0
mov ecx, 0x104
lea eax, [esp + 0x8c]
cmp byte [eax], 0
je 0x44a904
inc eax
dec ecx
jne 0x44a8f9
jmp 0x44a94a
test ecx, ecx
je 0x44a94a
lea edx, [esp + 8]
test edx, edx
je 0x44a919
mov eax, 0x104
sub eax, ecx
jmp 0x44a91d
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x8c]
je 0x44a94a
lea esi, [esp + 0xc]
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x44a942
mov byte [eax], cl
inc eax
dec edx
jne 0x44a933
jmp 0x44a946
test edx, edx
jne 0x44a947
dec eax
mov byte [eax], 0
lea edi, [esp + 0x8c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x8c]
push ecx
push eax
push 1
push 0x45d36c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
pop esi
add esp, 0x188
ret
Function at 0x44d7bb
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x44d807
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x44d7ec
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x44d7fc
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44d817
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x44d856
test ebx, ebx
je 0x44d82b
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x44d820
cmp ecx, 0xfff1
jb 0x44d839
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x44d941
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x44d87b
Function at 0x4e27fb
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x4e2847
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x4e282c
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x4e283c
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4e2857
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4e2896
test ebx, ebx
je 0x4e286b
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x4e2860
cmp ecx, 0xfff1
jb 0x4e2879
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4e2981
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4e28bb
Function at 0x5439bb
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x44
xor ah, byte [eax - 0x585f4061]
dec ebp
fdivr st(1)
mov esp, 0xe9f2bd1c
xchg edx, eax
ret 0xdd22
je 0x543985
aaa
mov fs, word [edx]
sub al, 0x16
mov edx, 0x12732155
push edi
loope 0x543a27
pushal
or dword [edx + 0x70], edx
inc eax
movsb byte es:[edi], byte [esi]
push esi
mov eax, 0xc48c8feb
add dword [edx], eax
jecxz 0x5439d9
lodsb al, byte [esi]
stc
imul esp, dword [ecx], 0xffffffff
or bl, dl
cmp dword [ebx - 0x4d163cdc], 0xffffff8c
mov ds, word [esi + ebx*4 - 0x152396d5]
aam 0x7f
les ebx, [ebx + 0x47]
xchg byte [ebp - 0x1c], bh
cmp byte [edi], dh
dec esp
add dword [esi - 8], edx
sub eax, 0x5bb65cfb
bound ecx, qword [edi - 0x44]
push edx
pop ds
jo 0x543a66
xchg ebp, eax
fcmovne st(0), st(1)
lea esi, [ecx]
iretd
test dword [esi + 0x72], 0x5e5aee7c
popal
cmp al, 0xb2
movsd dword es:[edi], dword [esi]
pop edi
scasd eax, dword es:[edi]
ret
Function at 0x596ebb
Capabilities:
Encode data using xor

Disassembly:
call 0x4afa1118
test eax, 0x1895b685
mov dword [edx + 0x12], ecx
invalid
invalid
invalid
Function at 0x6225cb
Capabilities:
Encode data using xor

Disassembly:
dec ecx
adc dword [ebx - 0x4e], ebx
adc esi, ebp
scasd eax, dword es:[edi]
fdivp st(6)
xacquire xchg dword [ebx], esi
jne 0x62258f
mov byte [0x8fe2b2ba], al
inc ecx
mov bh, 0x53
push ecx
adc eax, 0xb0856565
add al, bh
in eax, 0x17
int1
mov word [eax + 0x3c], ss
invalid
invalid
pop ss
clc
in al, dx
pop ds
push 0xffffffffffffffa3
aad 0xc
sub byte [edx - 0x56543a37], cl
ret 0x7c3
leave
lds ebp, [ebx + 0x7c3c2a9]
bound esp, qword ds:[ebx - 0x51fcb37f]
cmp eax, 0xf94596d0
aad 0x83
fild word [edx - 0x1f3cc1e3]
dec ebx
cmp dword [eax + 0x37b79953], esi
push ebx
cdq
mov bh, 0x37
adc bh, 0x30
and dword gs:[esp + ebx + 0x11], 0x4a30e132
div dword [edi + 0x119e66d2]
sahf
adc dword [ecx], eax
sbb esi, esi
mov eax, dword [0xa78759b4]
sahf
adc dword [ecx], eax
sbb esi, esi
mov eax, dword [0xa78759b4]
jbe 0x622565
rcr byte [ecx], 1
or bh, cl
jo 0x6225fb
add dword [edi + 0x53732d69], ebx
cmp al, 0x82
dec ebx
shl byte [edx + ebp*8 - 0x4f609693], 1
push ecx
ror dword [esi], cl
popfd
out dx, al
add eax, 0xaa2300c8
push 0xba7a11ca
jp 0x6225b7
sahf
jb 0x622582
cli
lds edx, [ebx - 0x606bae8d]
lodsd eax, dword [esi]
sal al, 1
xchg edx, eax
js 0x622599
pop edx
sbb dword [edx + 0x411e9e7f], edx
invalid
Function at 0x62d2db
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
mov ecx, 0xc1a213c0
xchg edi, eax
or edx, eax
call 0x90a3f93e
dec ebp
sbb eax, 0x659ec8a1
invalid
push ecx
sbb byte [ebp + 0x61812b01], cl
mov al, 0xb1
dec eax
cmp byte [ebp + 0x3d2dd08b], cl
pushal
fst st(6)
and dword [ecx - 0x50], 0x8d3848b1
mov edx, eax
sub eax, 0xd6dd603d
das
sbb eax, 0x1031562d
xor dword [ecx], esi
fbld tbyte [ecx]
inc esi
loope 0x62d356
imul ecx, dword [ebp + 0x30], 0xb690169
js 0x62d291
enter 0x5cb5, 0x19
inc esi
dec ecx
mov ch, 0x5c
sbb dword [esi + 0x49], eax
rcl cl, 0x1a
jecxz 0x62d2e0
add ah, dl
jge 0x62d305
ret 0x2fd1
and byte [0x2a1387ea], 0x49
insd dword es:[edi], dx
or eax, 0x3281fe22
aad 0xdd
stosd dword es:[edi], eax
invalid
popal
test eax, 0xeb4d1931
pop ecx
mov eax, dword [0xaf144481]
xchg ecx, eax
cmp dword [ecx - 7], edx
stc
mov dl, 0x39
mov dh, 0x41
xor cl, byte [esi - 0xe70a761]
pop esp
shl dword [ecx + edi*4 + 0x5f], 1
mov esp, 0xf4f0960
push esi
xchg ebp, eax
cmp dword es:[eax + 0x12b0b931], esi
pop esi
lds eax, [eax]
push edx
je 0x62d3b4
ja 0x62d329
mov ecx, 0x5ffc3294
cmp esp, dword [esi + 0x36]
rcr dword [edi - 0x7f], 1
sar byte [ebp + 0x6823f331], cl
add dword [edx + 0x1ea12331], edx
and ebx, dword [0x519710dd]
div dword [ecx]
push ecx
push cs
cmp dword [esi], 0x397cf947
pop ecx
sahf
arpl cx, di
push ecx
out 0xd5, eax
invalid
jb 0xc9f4e8
popal
mov ch, 0x1d
mov bl, 0x5e
leave
jbe 0x62d347
and dh, al
lcall 0xcf18, 0x939afe2
jno 0x62d39c
and dl, cl
mov dh, 0xde
stc
hlt
fsubr dword [ebp + 0x1d]
ror ebx, cl
add edx, esi
nop dword [ebp + 0x433142b8]
jno 0xc9f45e
test al, 0x9b
stosd dword es:[edi], eax
push eax
sbb dword [edx - 0x51], 0xeef5cac9
jo 0xc9f4a2
jnp 0xc9f428
mov ebp, 0x72b907b5
jae 0xc9f4b9
and dword [edi], 0xffffffc3
fisttp qword [ebx + 0x316aaceb]
int 0x1b
fcmovbe st(0), st(0)
les edi, [edx]
mov dh, 0x69
adc bh, byte [esi + 0xcd86a2e]
jle 0xc9f4a5
or al, 0x7e
dec edx
rcr dword [eax], 1
cdq
or edi, esp
push esp
out 0x84, eax
pop esp
push ebp
xor bh, dh
xchg edi, eax
or bh, byte [eax + ebx + 0x38]
dec ebx
mov ecx, 0x8d2a3ca3
inc esp
in al, dx
outsd dx, dword [esi]
xchg esi, eax
arpl word [esi + 0x36], di
leave
mov esi, 0x1b9fba6e
out 0xc3, al
pop es
cmp ecx, eax
pop es
push ds
test eax, 0xa8143ca8
sub dword [esi + 0x36], ecx
inc edi
in al, 0x82
push ss
pop edi
into
jbe 0xc9f41a
cmp byte ss:[ecx - 0x67], ah
inc edi
jae 0xc9f4cc
int 0x2b
mov esp, edi
or byte [0x5baa43a2], cl
inc ebx
stosb byte es:[edi], al
pop ebx
in al, dx
jecxz 0xc9f44e
xchg esi, eax
arpl word [edi - 0x73], di
out 0x51, al
ffree st(5)
jno 0xc9f4c3
jmp 0xc9f458
test eax, 0x58b67eea
mov cl, 0xe0
xchg ecx, eax
adc eax, 0xf36d2f34
mov edi, 0x3510e232
xor al, 0x2f
insd dword es:[edi], dx
mov edi, 0x3510e232
stc
mov al, byte [0xaeae7b5b]
pop ebp
invalid
mov cl, 0x61
push ebx
mov byte [edx + esi + 0x7f], al
jl 0xc9f493
outsb dx, byte [esi]
mov ds, word [ebp + 0x323d173b]
dec ecx
push ebx
imul esi, dword [edx - 0x5c], 0x1b56096a
fisubr dword [ebx - 0x40]
retf
Function at 0x657e1d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x661378
cmp edx, dword [eax]
je 0x657e3f
add eax, 8
inc ecx
cmp eax, 0x661408
jl 0x657e30
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x661378]
jne 0x657f6d
mov eax, dword [0xa66ce0]
cmp eax, 1
je 0x657f47
test eax, eax
jne 0x657e70
cmp dword [0x6612a4], 1
je 0x657f47
cmp edx, 0xfc
je 0x657f6d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657ea7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00658800
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658c90
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657eea
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658c90
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65dc64
push edi
call fcn.0065ab60
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00658800
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658810
lea eax, [ebp - 0xa0]
push 0x65dc44
push eax
call fcn.00658810
push dword [esi + 0x66137c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658810
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065aad4
add esp, 0x2c
pop edi
jmp 0x657f6d
lea eax, [ebp + 8]
lea esi, [esi + 0x66137c]
push 0
push eax
push dword [esi]
call fcn.00658c90
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x100ec287
Capabilities:
Authenticate hmac

Disassembly:
pushfd
mov dword [ebp - 0x10], ecx
sar cx, cl
rcl cl, 7
mov ecx, dword [ebp + 0xc]
mov byte [esp], 0x36
push dword [esp]
call fcn.101a955a
Function at 0x101b5a1d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
neg al
test bl, 0x4c
test ah, 0xb9
test ch, 0xba
cmp al, byte [edi]
setle al
bswap ax
mov ax, cx
call fcn.100f0b46
lodsb al, byte [esi]
cmp al, 0xc5
stc
sub al, 0x8c
pushfd
cmc
bt ecx, 0x11
jmp 0x101b3efe
jmp 0x101a6dd8
ror al, 4
clc
bt cx, di
mov byte [esp + 0xc], cl
sub al, 0x7f
mov dword [esp], ebp
push 0x5ba02ad
jmp 0x101a9b2e
pushfd
jmp 0x101a965b
Function at 0x1006225
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
je 0x100625b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x100625f
xor eax, eax
jmp 0x1006275
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
leave
ret 4

Function at 0x1007528
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1007563
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1007540
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x100757f
dec esi
je 0x1007578
dec esi
jne 0x1007584
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc

Function at 0x401b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor edx, edx
cmp edi, 4
jle 0x401b74
lea esi, [edi - 1]
mov ecx, dword [esp + 0x10]
shr esi, 2
mov eax, esi
push ebx
neg eax
lea edi, [edi + eax*4]
mov eax, dword [esp + 0x18]
mov ebx, dword [ecx]
mov ebp, dword [eax]
xor ebx, ebp
mov ebp, dword [eax + 4]
add eax, 4
add ecx, 4
or edx, ebx
add eax, 4
mov ebx, dword [ecx]
add ecx, 4
xor ebx, ebp
mov ebp, dword [eax]
or edx, ebx
mov ebx, dword [ecx]
xor ebx, ebp
mov ebp, dword [eax + 4]
add eax, 4
add ecx, 4
or edx, ebx
add eax, 4
mov ebx, dword [ecx]
add ecx, 4
xor ebx, ebp
or edx, ebx
dec esi
jne 0x401b34
pop ebx
jmp 0x401b7c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
test edi, edi
jle 0x401b93
mov esi, edi
mov edi, dword [ecx]
mov ebp, dword [eax]
xor edi, ebp
add eax, 4
or edx, edi
add ecx, 4
dec esi
jne 0x401b82
xor eax, eax
pop edi
test edx, edx
pop esi
pop ebp
setne al
ret
Function at 0x1db77f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
sub ecx, dword [edx + 0x10]
stc
call fcn.02039fbf
push 0xcf8b456f
push 0x78f72c31
pushal
lea esp, [esp + 0x30]
je 0x1db1e1c
inc dh
mov esi, dword [eax + 0x3c]
sub dh, ah
test esi, esp
shld dx, bx, 2
push 0x694515db
add esi, eax
bswap dx
mov edx, dword [esi + 0x78]
clc
test edx, edx
mov word [esp], ax
push dword [esp]
push ebp
pushal
lea esp, [esp + 0x2c]
je 0x1db1e1c
bsr cx, cx
mov ecx, 0x8464c19b
movsx ecx, al
ror cl, cl
add edx, eax
stc
shl cl, 2
cmc
shr cx, cl
mov ecx, dword [esi + 0x7c]
pushal
jmp 0x1dc6239
ror cx, 8
bt bx, sp
cmp ah, 0x5f
rcl cl, 1
add ebx, eax
jmp 0x1dc19ff
pushal
pushal
lea esp, [esp + 0x40]
jbe 0x1db5c06
jmp 0x1dcc057
bswap cx
rcl cx, cl
xor cx, dx
mov ecx, dword [edx + 0x18]
pushal
btr bx, dx
mov ebx, dword [edx + 0x20]
call fcn.01db1d7a
lea ecx, [esp - 0x19c3f2ef]
stc
ror cx, 9
mov dword [ebp - 8], 0
add ecx, edx
mov byte [esp + 0x14], bl
cmp dx, 0xb8a9
mov dword [ebp - 0x10], ecx
ror ch, 1
bsr cx, ax
sar ch, cl
dec ecx
mov ecx, dword [ebp + 0xc]
cmp dl, 0x3d
mov byte [esp + 0x10], bh
bt sp, 0xb
pushal
cmp ecx, 0xffff
mov byte [esp + 8], 0x90
lea esp, [esp + 0x40]
jbe 0x1dbaf8a
jbe 0x1db5c06
inc bl
xchg bx, di
xor di, 0x20fc
test ch, 0xd4
mov edi, dword [edx + 0x24]
bsf cx, dx
dec ch
add edi, eax
rcr cx, cl
jae 0x1dc139f
bsf cx, si
ror bh, 2
mov ebx, dword [edx + 0x20]
cmc
jo 0x1dbaf76
add ebx, eax
sbb ch, 0xb8
rcr ch, cl
setbe ch
mov dword [ebp - 8], 0
jmp 0x1dbec24
xor bl, bl
mov edi, dword [edx + 0x24]
add bx, 0xe3c4
bsf cx, si
add ch, ch
add edi, eax
setae cl
sal cx, cl
mov ebx, dword [edx + 0x20]
inc cx
stc
shl ch, cl
or cl, 0x84
add ebx, eax
bt si, ax
dec cx
movsx cx, bl
shld ecx, edx, 0x1f
mov dword [ebp - 8], 0
sal ecx, 0x12
mov ecx, dword [edx + 0x18]
push esi
jmp 0x203a005
cmp ecx, dword [ebp - 8]
call fcn.01dbb03f

Function at 0x1dbda45
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub ebx, edi
add di, si
add di, 0xf0f4
shld edi, ecx, 7
add ebx, esp
bsr di, bx
mov edi, ebx
stc
sbb al, cl
mov al, 0x2e
push 0x21aa13e1
lea esp, [esp + 4]
jns 0x1dc4d1c
repne scasb al, byte es:[edi]
pushal
lea esp, [esp + 0x20]
jne 0x1dca64f
not al
movsx ax, cl
mov ah, ah
mov byte [edi - 1], 0
pushal
setle ah
cwde
mov byte [esp + 8], 0xd5
mov dword [esp + 0x1c], ebx
call fcn.02039f83
mov byte [0x566a88f6], al
invalid
push dword [edi]
pop dword [esp]
push 0xa772944d
cmc
test bh, 0x93
bt eax, 6
cmp edi, ebx
jmp 0x1dc2487
lea esp, [esp + 4]
ja 0x1dcba54
neg al
jmp 0x1db33d4
push 0x154d5811
bt ebx, edx
repne scasb al, byte es:[edi]
push 0x4ae8b24c
lea esp, [esp + 8]
jne 0x1dca64f
pushfd
movzx eax, bl
pushal
not ax
mov byte [edi - 1], 0
not al
cwde
pushal
mov dword [esp + 0x40], ebx
setbe al
lea eax, [0x1dbc948]
pushfd
mov byte [esp], 0x1e
mov dword [esp + 0x40], 0x1dc78b1
mov dword [esp + 0x14], edi
jmp fcn.01dbc6d5
Function at 0xe7f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00e7f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00e7f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00e7f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00e7f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xe7fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xe7fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xe9187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xe7fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xe7fc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401056
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40c5fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
call sub.MFC42.DLL_CString::CString_2
xor edi, edi
lea ecx, [esi + 8]
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0xc]
mov byte [esp + 0x14], 1
call fcn.0040bea2
lea ecx, [esi + 0x20]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 3
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], 0x40f500
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], 0x11
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], 0xa
mov dword [esi + 0x24], edi
mov dword [esi + 0x4c], edi
mov dword [esi], fcn.004012a0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, 0x413688
jmp 0x401040
Function at 0x401100
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x40c68e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], fcn.004012a0
mov ecx, dword [esi + 0x48]
xor edi, edi
cmp ecx, edi
mov dword [esp + 0x24], 5
je 0x40113f
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov eax, dword [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ebx, [esi + 0x2c]
mov dword [esi + 0x4c], edi
mov dword [esp + 0x18], ebx
mov dword [ebx], 0x40f500
mov eax, dword [ebx + 4]
mov byte [esp + 0x24], 6
cmp eax, edi
je 0x40121a
mov ecx, dword [ebx + 8]
xor eax, eax
cmp ecx, edi
mov dword [esp + 0xc], eax
jbe 0x40121a
push ebp
jmp 0x40117f
xor edi, edi
mov ecx, dword [ebx + 4]
mov ebp, dword [ecx + eax*4]
cmp ebp, edi
je 0x401207
lea esi, [ebp + 0xc]
xor edi, edi
mov dword [esp + 0x14], esi
lea ecx, [esi + 0x14]
mov byte [esp + 0x28], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x10]
mov byte [esp + 0x28], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0xc]
mov byte [esp + 0x28], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 8]
mov byte [esp + 0x28], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 4]
mov byte [esp + 0x28], 7
call sub.MFC42.DLL_CString::CString
mov ecx, esi
mov byte [esp + 0x28], 6
call sub.MFC42.DLL_CString::CString
add esi, 0x1c
mov edx, edi
dec edi
mov dword [esp + 0x14], esi
test edx, edx
jne 0x401192
lea eax, [ebp + 8]
push 1
push eax
call sub.MFC42.DLL_DestructElements
mov ebp, dword [ebp]
test ebp, ebp
jne 0x401189
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
mov ecx, dword [ebx + 8]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x40117d
xor edi, edi
pop ebp
mov eax, dword [ebx + 4]
push eax
call sub.MFC42.DLL_operatordelete
mov ecx, dword [ebx + 0x14]
add esp, 4
mov dword [ebx + 4], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
call sub.MFC42.DLL_CPlex::FreeDataChain
lea ecx, [esi + 0x28]
mov dword [ebx + 0x14], edi
mov dword [ebx], 0x40f514
mov byte [esp + 0x24], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x20]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0xc]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esi + 8]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 4]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret