joyce8/EMBER2024-capa huggingface dataset:
Function at 0x770f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x770ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x771035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00770e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x770fc5
mov edi, 0x78b8b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x771035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00770e00
add edi, 4
add esp, 0xc
cmp edi, 0x78b8c0
jb 0x771000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x771070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00777082
mov esi, eax
add esp, 8
test esi, esi
je 0x771107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x771102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00776946
add esp, 8
test eax, eax
je 0x7710e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x7710e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00776946
add esp, 8
test eax, eax
jne 0x7710c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x771102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x771f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x7869fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x772002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00775dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x772002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.0076d6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0077620b
push 0x10
call fcn.007761d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x771fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.007621c0
jmp 0x771fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00771b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x771ff0
mov ecx, edi
call fcn.007622c0
push edi
call fcn.007761c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x772021
inc ebx
cmp ebx, 0x20
jb 0x771f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x773250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x787808
push 0x777288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x773329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x773329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.007761d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x773329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x773329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x77332c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00773351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x774000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x774131
push esi
call fcn.00777145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00766080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x774131
push 0
push ebp
call fcn.007663a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00766260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x77408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.007662f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x774121
push 0x78c918
push edi
call fcn.007753f0
push eax
push ebx
push esi
call fcn.00773f60
push 0x78c8f8
push edi
call fcn.007753f0
push eax
push ebx
push esi
call fcn.00773f60
push 0x78c8d8
push edi
call fcn.007753f0
push eax
push ebx
push esi
call fcn.00773f60
push 0x78c8c0
push edi
call fcn.007753f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00773f60
push 0x78c8a0
push edi
call fcn.007753f0
push eax
push ebx
push esi
call fcn.00773f60
push 0x78c888
push edi
call fcn.007753f0
push eax
push ebx
push esi
call fcn.00773f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7751b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00775140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00775140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00775140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00775140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x775bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x775c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x78787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x775c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x775c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x417c1b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417a98
Function at 0x10002c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
lea edx, [ebp - 0x1c]
push 1
call fcn.10002880
mov ebx, eax
add esp, 4
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x10002dce
mov cx, word [0x100151f8]
movq xmm0, qword [0x100151f0]
movq qword [ebp - 0x14], xmm0
mov word [ebp - 0xc], cx
test ch, ch
je 0x10002ce6
xor ebx, ebx
nop dword [eax]
mov eax, 0xcccccccd
mul ebx
mov al, bl
shr edx, 3
mov cl, dl
shl dl, 2
add cl, dl
add cl, cl
sub al, cl
add al, 0x35
xor byte [ebp + ebx - 0x14], al
inc ebx
cmp ebx, 0xa
jl 0x10002cc0
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push edi
push eax
push 0x51
mov edx, 1
call fcn.10001030
add esp, 4
call eax
push eax
lea edx, [ebp - 0x14]
mov ecx, ebx
call fcn.10003520
add esp, 8
mov edx, 1
push esi
push 0x2e
call fcn.10001030
add esp, 4
call eax
cmp eax, 0xffffffff
jne 0x10002d37
push 0x30
mov edx, 1
call fcn.10001030
add esp, 4
call eax
jmp 0x10002d4d
test al, 0x10
jne 0x10002d4d
push esi
push 0x19
mov edx, 1
call fcn.10001030
add esp, 4
call eax
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
push 0xc
mov edx, 1
call fcn.10001030
add esp, 4
call eax
mov esi, eax
test esi, esi
je 0x10002dce
cmp esi, 0xffffffff
je 0x10002dce
push 0
lea eax, [ebp - 8]
mov edx, 1
push eax
push edi
push ebx
push esi
push 0x9e
call fcn.10001030
add esp, 4
call eax
test eax, eax
je 0x10002dce
cmp edi, dword [ebp - 8]
jne 0x10002dce
push esi
push 4
mov edx, 1
call fcn.10001030
add esp, 4
call eax
test eax, eax
je 0x10002dce
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000552b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000552b
mov esp, ebp
pop ebp
ret
Function at 0x10002df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movups xmm0, xmmword [0x1001523c]
mov ax, word [0x10015254]
xor ecx, ecx
cmp dword [0x10017bfc], 2
movups xmmword [ebp - 0x1c], xmm0
mov word [ebp - 4], ax
movq xmm0, qword [0x1001524c]
movq qword [ebp - 0xc], xmm0
jl 0x10002f11
movaps xmm2, xmmword [0x10015890]
mov eax, 2
movaps xmm3, xmmword [0x10015910]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
movd xmm4, eax
mov eax, 0x1f
psrad xmm1, xmm4
movaps xmm0, xmm1
movd xmm5, eax
mov eax, 0x1001523c
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x100158b0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x100158a0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
paddw xmm1, xmmword [0x100158e0]
movq xmm0, qword [eax]
pxor xmm1, xmm0
movaps xmm0, xmm2
movq qword [ebp - 0x1c], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm4
movaps xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x100158b0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, qword [ebp - 0x14]
paddw xmm1, xmmword [0x100158e0]
pxor xmm1, xmm0
movq qword [ebp - 0x14], xmm1
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*4]
add eax, eax
sub edx, eax
add edx, 0x36
xor word [ebp + ecx*2 - 0x1c], dx
inc ecx
cmp ecx, 0xd
jl 0x10002f11
push 0
push 0x40000080
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x1c]
mov edx, 1
push eax
push 0xc
call fcn.10001030
add esp, 4
call eax
test eax, eax
je 0x10002f69
cmp eax, 0xffffffff
jne 0x10002f6b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002f70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10015cf0
push 0x10006160
mov eax, dword fs:[0]
push eax
sub esp, 0xa54
mov eax, dword [0x10017004]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0xa5c], esi
push esi
push 2
push 0x12
lea edx, [esi + 1]
call fcn.10001030
add esp, 4
call eax
mov ebx, eax
mov dword [ebp - 0xa64], ebx
call fcn.10002df0
mov edi, eax
mov dword [ebp - 0xa58], edi
test edi, edi
je 0x100031cc
cmp ebx, 0xffffffff
je 0x100031b8
mov dword [ebp - 0xa54], 0x22c
lea eax, [ebp - 0xa54]
push eax
push ebx
push 0x64
mov edx, 1
call fcn.10001030
add esp, 4
call eax
test eax, eax
je 0x100031a6
nop dword [eax]
nop dword [eax + eax]
cmp dword [0x100182b0], 0
jne 0x100031a0
mov dword [ebp - 0xa60], 0
xor ebx, ebx
mov cx, word [ebp - 0xa30]
lea edi, [ebp - 0xa30]
mov eax, dword [0x100182ac]
test cx, cx
je 0x1000307f
movzx edx, cx
movzx esi, dx
lea ecx, [edx - 0x61]
lea edx, [esi + 0x20]
cmp cx, 0x19
cmova esi, edx
imul ecx, esi, 0x1000193
xor eax, ecx
lea edi, [edi + 2]
movzx ecx, word [edi]
mov edx, ecx
test cx, cx
jne 0x10003053
mov cx, word [ebp - 0xa30]
shr eax, 2
cmp eax, dword [ebx + 0x10014ef0]
je 0x1000309d
add ebx, 4
cmp ebx, 0x194
jb 0x10003040
mov eax, dword [ebp - 0xa60]
jmp 0x100030a2
mov eax, 1
test eax, eax
je 0x10003173
mov dword [ebp - 0x828], 1
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x824], eax
push eax
push 0
push 0x1000
push 0x5e
mov edx, 1
call fcn.10001030
add esp, 4
call eax
mov esi, eax
test esi, esi
je 0x10003173
lea eax, [ebp - 0x20]
push eax
push esi
push 0x2d
mov edx, 1
call fcn.10001030
add esp, 4
call eax
test eax, eax
je 0x10003173
cmp dword [ebp - 0x20], 0x103
jne 0x10003173
push esi
push 4
mov edx, 1
call fcn.10001030
add esp, 4
call eax
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push 0x808
lea eax, [ebp - 0x828]
push eax
push 0x22e010
mov edi, dword [ebp - 0xa58]
push edi
push 0x1d
mov edx, 1
call fcn.10001030
add esp, 4
call eax
test eax, eax
je 0x1000315a
inc dword [ebp - 0xa5c]
mov dword [ebp - 4], 0xfffffffe
jmp 0x10003179
mov edi, dword [ebp - 0xa58]
lea eax, [ebp - 0xa54]
push eax
mov ebx, dword [ebp - 0xa64]
push ebx
push 0x66
mov edx, 1
call fcn.10001030
add esp, 4
call eax
test eax, eax
jne 0x10003020
mov esi, dword [ebp - 0xa5c]
push ebx
push 4
mov edx, 1
call fcn.10001030
add esp, 4
call eax
push edi
push 4
mov edx, 1
call fcn.10001030
add esp, 4
call eax
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000552b
mov esp, ebp
pop ebp
ret
Function at 0x10003520
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov edx, 1
push 0x36
mov dword [ebp - 0x18], ecx
call fcn.10001030
add esp, 4
call eax
push 0x100
mov ebx, eax
xor edx, edx
push 0
push ebx
push 0x7b
mov dword [ebp - 0x1c], ebx
call fcn.10001030
add esp, 4
call eax
push 0x100
push 0
push ebx
push 0x7b
xor edx, edx
mov dword [ebp - 4], eax
call fcn.10001030
add esp, 4
call eax
xor edi, edi
mov ebx, eax
mov dword [ebp - 0x14], edi
xor ecx, ecx
mov edi, dword [ebp - 4]
mov dword [ebp - 0x10], ebx
sub ebx, edi
mov eax, ecx
lea esi, [ecx + edi]
xor edx, edx
mov edi, dword [ebp - 0xc]
div dword [ebp + 8]
mov byte [ebx + esi], cl
inc ecx
mov al, byte [edx + edi]
mov edi, dword [ebp - 4]
mov byte [esi], al
cmp ecx, 0x100
jl 0x10003585
mov ebx, dword [ebp - 0x10]
mov eax, edi
mov edi, dword [ebp - 0x14]
sub eax, ebx
mov esi, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0x100
nop dword [eax]
mov dl, byte [esi]
movzx eax, byte [eax + esi]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x100035dd
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + ebx]
mov byte [edi + ebx], dl
mov byte [esi], al
inc esi
sub dword [ebp - 8], 1
mov eax, dword [ebp - 0x10]
jne 0x100035c0
xor edx, edx
xor esi, esi
cmp dword [ebp + 0xc], edx
jbe 0x1000364e
xor edi, edi
nop word [eax + eax]
inc edi
and edi, 0x800000ff
jns 0x10003611
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [edi + ebx]
movzx eax, cl
add edx, eax
and edx, 0x800000ff
jns 0x10003629
dec edx
or edx, 0xffffff00
inc edx
mov al, byte [edx + ebx]
mov byte [edx + ebx], cl
mov byte [edi + ebx], al
movzx ecx, al
movzx eax, byte [edx + ebx]
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp - 0x18]
movzx eax, byte [eax + ebx]
xor byte [esi + ecx], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x10003600
mov eax, dword [ebp - 4]
xor edx, edx
mov esi, dword [ebp - 0x1c]
push eax
push 0
push esi
push 0x7c
call fcn.10001030
add esp, 4
call eax
push ebx
push 0
push esi
push 0x7c
xor edx, edx
call fcn.10001030
add esp, 4
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push 0x36
mov edx, 1
call fcn.10001030
add esp, 4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100037d6
push 0xa
movzx ecx, di
mov edx, 1
push ecx
push esi
push 0x21
call fcn.10001030
add esp, 4
call eax
mov edi, eax
test edi, edi
je 0x100037d6
push edi
push esi
push 0x48
mov edx, 1
call fcn.10001030
add esp, 4
call eax
mov ebx, eax
test ebx, ebx
je 0x100037d6
push edi
push esi
push 0x86
mov edx, 1
call fcn.10001030
add esp, 4
call eax
mov edi, dword [ebp + 8]
mov dword [edi], eax
test eax, eax
je 0x100037d6
push ebx
push 0x4b
mov edx, 1
call fcn.10001030
add esp, 4
call eax
mov dword [ebp - 8], eax
test eax, eax
je 0x100037d6
push dword [edi]
xor edx, edx
push 0
push dword [ebp - 4]
push 0x7b
call fcn.10001030
add esp, 4
call eax
mov esi, eax
test esi, esi
je 0x100037d6
push dword [edi]
xor edx, edx
push dword [ebp - 8]
push esi
push 0x7f
call fcn.10001030
add esp, 4
call eax
push ebx
push 0x24
mov edx, 1
call fcn.10001030
add esp, 4
call eax
mov ax, word [0x10015260]
movq xmm0, qword [str.z_by_t_b_a_rsAB]
movq qword [ebp - 0x14], xmm0
mov word [ebp - 0xc], ax
test ah, ah
je 0x100037b3
xor ebx, ebx
nop word [eax + eax]
mov eax, 0xcccccccd
mul ebx
mov al, bl
shr edx, 3
mov cl, dl
shl dl, 2
add cl, dl
add cl, cl
sub al, cl
add al, 0x39
xor byte [ebp + ebx - 0x14], al
inc ebx
cmp ebx, 0xa
jl 0x10003790
push dword [edi]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0x14]
mov ecx, esi
call fcn.10003520
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005370
Capabilities:
Encode data using xor
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10017004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x100156ce], 0
xorps xmm0, xmm0
mov eax, dword [0x100156cc]
movq qword [ebp - 0x10], xmm0
movups xmm0, xmmword [0x100156b4]
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], eax
movups xmmword [ebp - 0x30], xmm0
movq xmm0, qword [0x100156c4]
movq qword [ebp - 0x20], xmm0
je 0x100054de
xor ecx, ecx
cmp dword [0x10017bfc], 2
jl 0x100054b6
movaps xmm2, xmmword [0x10015890]
mov eax, 2
movaps xmm3, xmmword [0x10015910]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
movd xmm4, eax
mov eax, 0x1f
psrad xmm1, xmm4
movaps xmm0, xmm1
movd xmm5, eax
mov eax, 0x100156b4
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x100158b0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x100158a0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
paddw xmm1, xmmword [0x100158c0]
movq xmm0, qword [eax]
pxor xmm1, xmm0
movaps xmm0, xmm2
movq qword [ebp - 0x30], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm4
movaps xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x100158b0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, qword [ebp - 0x28]
paddw xmm1, xmmword [0x100158c0]
pxor xmm1, xmm0
movq qword [ebp - 0x28], xmm1
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*4]
add eax, eax
sub edx, eax
add edx, 0x30
xor word [ebp + ecx*2 - 0x30], dx
inc ecx
cmp ecx, 0xe
jl 0x100054b6
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], 0x10005150
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
je 0x10005512
push str._UpdateServeice__started
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000552b
mov esp, ebp
pop ebp
ret
push str._UpdateServeice__failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000552b
mov esp, ebp
pop ebp
ret
Function at 0x401f78
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x404230
call fcn.004020dc
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x405478
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x401d39
cmp eax, esi
jne 0x401d2c
xor esi, esi
inc esi
mov ebx, esi
jmp 0x401d3c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401d13
xor esi, esi
inc esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401d4f
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401d7e
mov eax, dword [0x405474]
test eax, eax
jne 0x401d78
mov dword [0x405474], esi
push 0x4030e4
push 0x4030d8
call fcn.00401c82
pop ecx
pop ecx
test eax, eax
je 0x401d7e
jmp 0x401ea6
mov dword [0x40513c], esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401da2
push 0x4030d4
push 0x4030cc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x405474], 2
test ebx, ebx
jne 0x401dae
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40547c], 0
je 0x401dd2
push 0x40547c
call fcn.00402064
pop ecx
test eax, eax
je 0x401dd2
push 0
push 2
push 0
call dword [0x40547c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x401e2e
test al, al
je 0x401dec
cmp dword [ebp - 0x1c], 0
jne 0x401e2e
mov al, byte [esi]
test al, al
je 0x401dfc
cmp al, 0x20
ja 0x401dfc
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401dec
test byte [ebp - 0x3c], 1
je 0x401e08
movzx eax, word [ebp - 0x38]
jmp 0x401e0b
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x405138], eax
cmp dword [0x40512c], 0
jne 0x401e82
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x401e3d
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x401e50
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x401dd9
cmp dword [0x40513c], 0
jne 0x401e91
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x405138]
jmp 0x401eb2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00402121
ret
call fcn.0040220b
jmp 0x401cd9

Function at 0x402756
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x402756
lcall 0x5de5, 0x8b10c483
jmp loc.007ed6fc