joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f823522
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
jmp 0x5f823536
push dword [ebp + 8]
call fcn.5f81fb5b
pop ecx
test eax, eax
je 0x5f823545
push dword [ebp + 8]
call fcn.5f81c2fd
pop ecx
test eax, eax
je 0x5f823529
pop ebp
ret
cmp dword [ebp + 8], 0xffffffff
je 0x5f823d7b
jmp 0x5f823d5c
cmp dword [eax], ebx
je 0x5f823d8f
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x5f823d8a
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x5f823d74
xor byte [eax], al
add byte [ebp + 0x13], dh
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x5f823d7c
cmp edx, ebx
jne 0x5f823eca
add byte [ebx + 0x45830448], cl
or byte [edx], al
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x5f823d4b
add eax, dword [eax + 4]
jmp 0x5f823d38
mov dword [ebp + 0xc], ebx
jmp 0x5f823d9a
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x5f823db2
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x5f823dd0
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x5f823e2e
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x5f823e15
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x5f823e1e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x5f823e28
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x5f823e0a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x5f823d94
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x5f823e7b
dec eax
je 0x5f823e72
sub eax, 3
je 0x5f823e69
mov dword [ebp - 4], 0x40
jmp 0x5f823e98
mov dword [ebp - 4], 4
jmp 0x5f823e7e
mov dword [ebp - 4], 0x20
jmp 0x5f823e7e
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x5f823eca
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x5f823e4a
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.5f8236db
les esi, [ebp + 0x75ff44d7]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x5f823ed6
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5f824f96
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x73a], 0x9f
mov byte [ebp - 0x739], 0x8f
mov byte [ebp - 0x738], 0x9c
mov byte [ebp - 0x737], 0x8f
mov byte [ebp - 0x736], 0x84
mov byte [ebp - 0x735], 0xbc
mov byte [ebp - 0x734], 0xfd
lea eax, [ebp - 0x744]
push eax
call fcn.5f8236eb
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.5f8236a0
add esp, 0xc
mov dword [ebp - 0x704], eax
and byte [ebp - 0x6f4], 0
and byte [ebp - 0x6f3], 0
mov byte [ebp - 0x6f2], 0x43
and byte [ebp - 0x6f1], 0
mov byte [ebp - 0x6f0], 0xeb
mov byte [ebp - 0x6ef], 0xce
mov byte [ebp - 0x6ee], 0xd5
mov byte [ebp - 0x6ed], 0xc8
mov byte [ebp - 0x6ec], 0xd9
mov byte [ebp - 0x6eb], 0xfa
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.5f8236db
psubusb mm1, qword [esp]
lea eax, [ebp - 0x6f4]
push eax
call fcn.5f8236eb
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.5f8236a0
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
pop eax
test eax, eax
je 0x5f825781
lea eax, [ebp - 0x230]
invalid
invalid

Function at 0x5f82e320
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x5f82e35e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x5f82e356
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x5f82e360
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x5f82e346
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5f82e430
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x5f82e461
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x5f82e461
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x5f82e461
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
movsx eax, al
push eax
call fcn.00402e10
mov esi, eax
cmp dword [0x407e7c], 0xffffffff
je 0x402fd1
mov eax, dword [ebp + 0x14]
cmp eax, dword [0x407e78]
jne 0x402fd1
lea eax, [ebp - 0x1c]
push eax
push dword [0x407e78]
call sub.kernel32.dll_GetConsoleScreenBufferInfo
movsx eax, word [ebp - 0x18]
mov dword [0x407e84], eax
movsx eax, word [ebp - 0x16]
mov dword [0x407e88], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4030e8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x4089cc
call fcn.00406430
mov esi, dword [eax]
push 0x4089cc
call fcn.00406430
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.00405c98
call fcn.00405b14
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.00405ba0
call fcn.00404574
test eax, eax
jne 0x403229
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.00405c78
call fcn.00404574
test eax, eax
jne 0x40319f
cmp word [ebp - 0x190], 0x5a4d
jne 0x40319f
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405bbc
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.00405c78
jmp 0x4031a9
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405bbc
call fcn.00404574
test eax, eax
jne 0x40320d
cmp word [ebp - 0x190], 0x4550
jne 0x40320d
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.00405c78
call fcn.00404574
test eax, eax
jne 0x40320d
cmp dword [ebp - 0x288], 0x4550
jne 0x40320d
cmp word [ebp - 0x22c], 3
jne 0x40320d
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.00405bec
push 0x4089c4
call fcn.00406430
mov dword [eax], 0
push 0x4089cc
call fcn.00406430
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call sub.kernel32.dll_CreateThread
mov esi, eax
push esi
call sub.kernel32.dll_CloseHandle
test esi, esi
setne al
movsx eax, al
push eax
call fcn.00402e10
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x403324
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
cmp dword [0x407f1c], 0
je 0x403346
mov eax, dword [0x407f1c]
mov dword [ebp - 4], eax
jmp 0x4033db
push 0x104
call fcn.00404648
mov dword [ebp - 4], eax
push 0x104
push dword [ebp - 4]
push 0
call sub.kernel32.dll_GetModuleFileNameA
push dword [ebp - 4]
call fcn.00404110
inc eax
mov ebx, eax
call sub.kernel32.dll_GetCommandLineA
mov esi, eax
mov al, byte [esi]
dec al
cmp al, 0x1f
jbe 0x40338b
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.004032bc
mov esi, eax
inc esi
push esi
call fcn.00404110
inc eax
mov edi, eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
add eax, edi
inc eax
push eax
call fcn.004046a8
call sub.kernel32.dll_AreFileApisANSI
test eax, eax
jne 0x4033bc
push edi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push esi
call sub.user32.dll_CharToOemBuffA
jmp 0x4033c9
push esi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push edi
call fcn.004050a8
mov eax, dword [ebp - 4]
add eax, ebx
add eax, edi
mov byte [eax], 0
mov eax, dword [ebp - 4]
mov dword [0x407f1c], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4034b8
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x52414853
mov dword [ebp - 0x20], 0x454d4445
mov dword [ebp - 0x1c], 0x5356354d
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0xb
call fcn.0040501c
xor eax, eax
mov bl, 0
cmp dword [0x407ec0], 0
jne 0x403506
push 0x407c10
push 1
call fcn.00402d1c
mov dword [0x407ec0], eax
cmp dword [0x407ec0], 0
jne 0x40351f
push 0x8000
call fcn.00404648
mov esi, eax
mov bl, 1
jmp 0x403559
lea eax, [ebp - 0x24]
push eax
push 0
push 6
call dword [0x407ec0]
test eax, eax
jne 0x403549
lea eax, [ebp - 0x24]
push eax
push 0x8000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test bl, bl
je 0x403582
push esi
push 0x8000
push 0xff
call fcn.00405104
push esi
push 0x24
push 0
call fcn.00405104
mov eax, esi
add eax, 0xc
push eax
call fcn.00404730
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403930
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push esi
call fcn.004038bc
lea edx, [ebp - 0x400]
movzx ecx, word [ebp + 0x14]
dec ecx
xor esi, esi
jmp 0x403968
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov word [edx + 2], ax
mov eax, dword [ebp + 0x18]
movzx eax, byte [eax]
mov word [edx], ax
inc dword [ebp + 0x18]
add edx, 4
inc esi
cmp ecx, esi
jge 0x40394e
mov ax, word [ebp + 0x14]
mov word [ebp - 0x404], ax
mov word [ebp - 0x402], 1
mov word [ebp - 0x408], 0
mov word [ebp - 0x406], 0
mov ax, word [ebp + 0x10]
mov word [ebp - 0x410], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40e], ax
movzx ecx, word [ebp + 0x10]
movzx eax, word [ebp + 0x14]
add ecx, eax
dec ecx
mov word [ebp - 0x40c], cx
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40a], ax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x408]
push dword [ebp - 0x404]
lea eax, [ebp - 0x400]
push eax
push dword [0x407e78]
call sub.kernel32.dll_WriteConsoleOutputA
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x403d10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x403d30
mov al, byte [ebp - 4]
jmp 0x403d33
mov al, byte [ebp + 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
or edi, 0xffffffff
or eax, 0xffffffff
mov dword [ebp - 0x24], 0
xor esi, esi
mov edx, dword [0x408270]
add edx, 0x24
mov esi, edx
cmp dword [edx], 0xffffffff
je 0x405f8e
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x405f89
mov ecx, dword [edx + 8]
cmp ecx, dword [esi + 8]
jbe 0x405f89
mov esi, edx
add edx, 0x10
jmp 0x405f72
mov edx, esi
cmp dword [edx], 0xffffffff
je 0x4060a2
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x4060a2
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x4060a0
mov ecx, dword [edx + 8]
sub dword [ebp + 0x10], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [edx + 0xc]
test edx, edx
je 0x4060a0
mov cl, byte [edx]
sub cl, 0x3c
jne 0x405fd6
jmp 0x4060a0
sub cl, 3
jne 0x405ff0
inc edx
mov dword [ebp - 0xc], edx
movzx ecx, byte [edx]
inc ecx
add edx, ecx
mov byte [ebp - 0x25], 1
jmp 0x40609b
inc cl
jne 0x406004
movzx ecx, word [edx + 1]
add edi, ecx
add edx, 3
jmp 0x40609b
inc cl
jne 0x406018
movzx ecx, word [edx + 1]
add edi, ecx
mov ecx, dword [edx + 3]
add eax, ecx
add edx, 7
jmp 0x40602b
movzx ecx, byte [edx]
shr ecx, 6
add edi, ecx
mov cl, byte [edx]
and cl, 0x3f
movzx ecx, cl
add eax, ecx
inc edx
cmp eax, dword [ebp + 0x10]
jne 0x406035
mov esi, eax
mov dword [ebp - 0x24], edi
cmp eax, dword [ebp + 0x10]
jl 0x406092
sub eax, dword [ebp + 0x10]
cmp eax, 0xa
jle 0x406048
cmp byte [ebp - 0x25], 0
jne 0x406090
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov eax, dword [ebp + 0xc]
mov byte [eax], cl
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp eax, dword [ebp - 0x14]
jle 0x40607e
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dl, byte [eax + ecx]
xor dl, 0xaa
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov byte [eax + ecx], dl
jmp 0x406059
movzx eax, word [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
add esi, dword [ebp - 0x18]
mov eax, esi
jmp 0x4060a2
jmp 0x4060a0
mov esi, eax
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x25], 0
jmp 0x405fc8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x406578
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
cld
push ecx
call fcn.00406554
call fcn.004034b8
mov dword [0x408270], eax
lea edx, [eax + 0x18]
mov dword [0x4082d0], edx
pop edx
call fcn.004063d4
call sub.kernel32.dll_GetEnvironmentStrings
mov dword [0x40829c], eax
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x4082b0], eax
mov dword [0x4082d8], eax
call fcn.004030e8
cmp eax, 3
setb byte [0x408279]
call fcn.00404108
lea eax, [esp]
xor edx, edx
mov ecx, dword fs:[edx]
mov dword fs:[edx], eax
mov dword [eax], ecx
mov dword [eax + 4], 0x406804
mov dword [eax + 8], ebp
jmp dword [esp + 0x10]
Function at 0x2e001992
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2e03da4c]
jne 0x2e00199c
repz ret
jmp fcn.2e027a26

Function at 0x2e010c88
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e028d1f
call fcn.2e001440
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call fcn.2e023456
test ax, ax
je 0x2e010d3c
lea eax, [ebp - 0x14]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e010d3c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
mov edi, str.progid
push edi
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x2e010d30
mov eax, dword [ebp - 0x18]
inc eax
push eax
call fcn.2e023456
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x18]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call esi
test eax, eax
jne 0x2e010d24
push dword [ebp - 0x10]
call sub.MSVCR100.dll_strlen
pop ecx
mov ecx, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.2e023456
push dword [ebp - 0x10]
mov byte [ebp - 4], bl
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x1c]
mov eax, esi
call fcn.2e001489
ret

Function at 0x2e010d44
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e028d4a
call fcn.2e0276dc
mov eax, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov byte [ebp - 0x2d], 0
cmp dword [eax + 0x10], edi
jbe 0x2e010e1f
push eax
lea ecx, [ebp - 0x2c]
call fcn.2e023456
push esi
mov dword [ebp - 4], edi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.2e023456
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x2e010d90
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x34]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e010e0f
lea eax, [ebp - 0x38]
push eax
push edi
mov esi, 0x2e02b538
push esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e010e06
mov eax, dword [ebp - 0x38]
inc eax
push eax
call fcn.2e023456
mov edi, eax
pop ecx
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x38]
push eax
push edi
push 0
push 0
push esi
push dword [ebp - 0x34]
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e010dfb
push edi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push edi
mov ecx, ebx
call fcn.2e023456
mov byte [ebp - 0x2d], 1
push edi
mov byte [ebp - 4], 0
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2e023456
mov al, byte [ebp - 0x2d]
call fcn.2e02774b
ret 8
Function at 0x2e010e2a
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x2e028d77
call fcn.2e001440
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor ebx, ebx
push 0x80000001
call esi
cmp eax, ebx
je 0x2e010e62
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call esi
cmp eax, ebx
jne 0x2e010ecd
lea eax, [ebp + 8]
push eax
push ebx
mov esi, 0x2e02b538
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e010ec4
mov eax, dword [ebp + 8]
cmp eax, ebx
jl 0x2e010ec4
inc eax
push eax
call fcn.2e023456
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp + 8]
push eax
push edi
push ebx
push ebx
push esi
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e010eb9
push edi
call sub.MSVCR100.dll_strlen
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push edi
call fcn.2e023456
mov bl, 1
or dword [ebp - 4], 0xffffffff
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001489
ret 8
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401c66
pop dword [ebp - 0x24]
mov eax, 0xc67046f7
add eax, 0x39cfd56f
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x1e7a3419
sub dword [ebp - 0x34], 0xd027eece
mov dword [ebp - 0x30], 0x2fce4eeb
sub dword [ebp - 0x30], 0xfd9b02a6
mov dword [ebp - 0x2c], 0xcdbbb8f6
add dword [ebp - 0x2c], 0x7e908b38
mov dword [ebp - 0x28], 0x4020fe81
add dword [ebp - 0x28], 0xbfdf017f
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x9f00f03b
sub dword [ebp - 0x34], 0x2a8e86e5
mov dword [ebp - 0x30], 0xc605eb46
add dword [ebp - 0x30], 0x7b66762f
mov dword [ebp - 0x2c], 0x938ea66c
add dword [ebp - 0x2c], 0xcfe0c600
mov dword [ebp - 0x28], 0xcb7a524
add dword [ebp - 0x28], 0xf3485adc
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xc6e332bf
add eax, 0x395cfd6d
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x34a8e
push 0
call eax
mov ecx, 0x5aeae68d
add ecx, 0xa5155a2a
mov ebx, eax
mov esi, 0x659fc6f1
add esi, 0x9aa0a90f
add esi, dword [ebp - 0x24]
mov edi, 0x969eb30e
mov dword [ebp - 0x18], 0x78531f52
mov edx, dword [esi]
xor dword [ebp - 0xc], edi
sub edx, edi
xor dword [ebp - 0x18], 0xec762527
mov dword [ebx], edx
xor dword [ebp - 0x1c], eax
add ebx, 4
add esi, 0xb25b9672
add esi, 0x4da46992
loop 0x401d7d
add eax, 0x896d1b60
add eax, 0x7693da4f
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x402c00
pop dword [ebp - 0x20]
mov eax, 0x402c00
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x22627a0
sub dword [ebp - 0x30], 0xb3d3e255
mov dword [ebp - 0x2c], 0xbdf240f5
sub dword [ebp - 0x2c], 0x8bbef4b0
mov dword [ebp - 0x28], 0xb8ed3fee
add dword [ebp - 0x28], 0x935f0440
mov dword [ebp - 0x24], 0x63f00f87
sub dword [ebp - 0x24], 0x63f00f87
lea eax, [ebp - 0x30]
push eax
mov eax, 0x7a91eb1f
add eax, 0x85ae956d
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x6063b891
sub dword [ebp - 0x30], 0xebf14f3b
mov dword [ebp - 0x2c], 0x61a05c28
add dword [ebp - 0x2c], 0xdfcc054d
mov dword [ebp - 0x28], 0xbe58979b
add dword [ebp - 0x28], 0xa516d4d1
mov dword [ebp - 0x24], 0xb09c591d
sub dword [ebp - 0x24], 0xb09c591d
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x9ebe952b
add eax, 0x6181eba9
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x35b4a
push 0
call eax
mov ecx, 0x54fc1563
sub ecx, 0x54fbd152
xor edx, edx
add edx, eax
mov edi, 0x411000
add edi, dword [ebp - 0x20]
mov esi, 0xeb775838
add esi, 0xa11a25cc
xor dword [ebp - 8], 0x1509225b
mov ebx, dword [edi]
add dword [ebp - 0xc], ecx
xor ebx, esi
xor dword [ebp - 0x14], 0xfae5ee99
mov dword [edx], ebx
xor dword [ebp - 0x10], ebx
add edx, 0xc32d8731
add edx, 0x3cd278d3
add edi, 4
loop 0x402d19
add eax, 0x10317
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret