joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2782
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x4c278a
mov dword [ecx*4 + 0x48fca0], eax
inc ecx
cmp ecx, 0x100
jb 0x4c2785
mov edx, 0x800
jmp 0x4c27d7
mov eax, dword [ecx*4 + 0x48f8a0]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x48fca0]
inc ecx
mov dword [ecx*4 + 0x48fc9c], eax
cmp ecx, edx
jb 0x4c27b6
mov dword [fcn.0048e390], 0x4026d1
call fcn.004d14f1
test eax, eax
jne 0x4c27f8
mov dword [fcn.0048e390], 0x40276d
pop esi
ret

Function at 0x4c2883
Capabilities:
Encode data using xor

Disassembly:
movzx edi, byte [ecx]
xor edi, eax
and edi, edx
shr eax, 8
xor eax, dword [esi + edi*4]
dec dword [ebp + 8]
inc ecx
cmp dword [ebp + 8], 0
ja 0x4c2879
pop edi
pop esi
pop ebp
ret 8

Function at 0x4d106f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x4d1086
leave
ret
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x4d10a5
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x4d10aa
inc edi
cmp edi, dword [ebp - 8]
jb 0x4d109c
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x4d1199
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x4d112c
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x4d10d6
cmp cl, 0xff
jne 0x4d115b
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
sub esi, 5
mov ebx, esi
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x4d116c
movzx esi, byte [edx + 0x462bc0]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
test bl, bl
je 0x4d111c
cmp bl, 0xff
jne 0x4d1169
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x4d10f4
dec ecx
shl edx, cl
and edx, 7
je 0x4d10c3
movzx ecx, byte [edx + 0x462bc0]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x462bb8], 0
mov cl, byte [ebx + 4]
je 0x4d1158
test cl, cl
je 0x4d1158
cmp cl, 0xff
jne 0x4d10c3
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x4d1097
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x4d1097
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0xc]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x1000bb40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 6]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x1000bbc7
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx + 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x14]
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
and eax, 0x20000000
je 0x1000bbbc
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x28
mov dword [ebp - 0x10], edx
jmp 0x1000bb63
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000c23d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
mov eax, ecx
cdq
idiv dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov al, byte [edx + eax]
xor byte [ecx + str.._._._..._._._.v._._...], al
inc ecx
cmp ecx, 0x1800
jl 0x1000c242
pop ebp
ret

Function at 0x1000c25f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x1000c286
mov eax, dword [ebp + 8]
lea ecx, [esi + eax]
mov eax, esi
cdq
idiv edi
mov eax, dword [ebp + 0x10]
sub eax, edx
mov al, byte [eax + edi - 1]
xor byte [ecx], al
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x1000c26a
pop esi
pop ebp
ret
Function at 0x1000c7ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push str.._._._..._._._.v._._...
mov esi, 0x800
push esi
mov ebx, 0x10037828
push ebx
mov edi, 0x1800
call fcn.1000c25f
add esp, 0xc
xor eax, eax
xor byte [eax + 0x10037828], 0x8a
inc eax
cmp eax, esi
jl 0x1000c7e3
push esi
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.10008237
lea eax, [ebp - 0x10]
push eax
call fcn.10008293
movzx edi, ax
add esp, 0x10
test di, di
jle 0x1000c8b2
lea eax, [ebp - 0x10]
push eax
call fcn.10008293
movzx esi, ax
lea eax, [ebp - 0x10]
push eax
call fcn.10008293
movsx ebx, di
pop ecx
pop ecx
movzx ecx, ax
mov eax, dword [0x10043a0c]
shl ebx, 3
lea edi, [ebx + eax]
movsx eax, si
dec eax
mov word [edi], si
je 0x1000c87d
dec eax
je 0x1000c867
dec eax
jne 0x1000c892
movsx eax, cx
push eax
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10008382
pop ecx
pop ecx
push eax
push dword [edi + 4]
call fcn.1001f330
add esp, 0xc
jmp 0x1000c892
lea eax, [ebp - 0x10]
push eax
call fcn.10008250
pop ecx
mov ecx, dword [0x10043a0c]
mov dword [ebx + ecx + 4], eax
jmp 0x1000c892
lea eax, [ebp - 0x10]
push eax
call fcn.10008293
pop ecx
mov ecx, dword [0x10043a0c]
mov word [ebx + ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
call fcn.10008293
movzx edi, ax
pop ecx
test di, di
jg 0x1000c812
mov esi, 0x800
mov ebx, 0x10037828
push esi
push 0
push ebx
call fcn.10020520
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000cf14
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx], 0
mov eax, 0x52964ee9
je 0x1000cf35
push esi
movzx edx, word [ecx]
mov esi, eax
movzx edx, dx
ror esi, 8
add esi, edx
inc ecx
xor eax, esi
cmp byte [ecx], 0
jne 0x1000cf1f
pop esi
ret
Function at 0x421056
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub eax, 0xed24a8da
adc ch, byte [ebx - 0x1f]
cdq
jge 0x42102d
adc dword [ecx], ecx
jmp 0x4210a5
adc dword [eax], 0xfffffffc
dec esi
lea edi, [ebx - 0x29e5634e]
add eax, 0x7a618162
mov edx, 0x89c4643d
dec ecx
mov dh, 0xa8
repne stosd dword es:[edi], eax
xchg bx, ax
pushal
lea esi, [ecx - 0x73]
mov ah, 0xdc
dec edi
pushal
pop ecx
mov ebx, 0xc87277ae
in al, 0x5f
jno 0x421077
jge 0x42109e
imul byte [ebp + 0x71]
loope 0x42104f
in eax, dx
push esp
xor esp, eax
push ds
pop ds
xor esp, ecx
lea edx, [edx + 0x22]
daa
stosd dword es:[edi], eax
dec ebx
dec eax
xchg byte [ecx], cl
mov cl, 0x59
xchg ecx, eax
adc ch, bh
std
push esp
jl 0x42101c
sbb bl, byte [ebx + 0x2ece5b5]
hlt
or dword [eax], edx
lodsd eax, dword [esi]
out 0x35, eax
or al, 0xa4
jp 0x421121
mov bh, 0xbb
push 0xffffffffffffffba
arpl word [esi], bx
cdq
test eax, 0xd4817dd
and eax, dword [esi + 0x5ecd35be]
and edi, edx
sub byte [eax], dl
push 0x2f
cmp ebx, esp
pop esi
test cl, dh
insb byte es:[edi], dx
dec byte [edi - 0x282fb5e9]
add ecx, ecx
dec ecx
outsd dx, dword es:[esi]
stosd dword es:[edi], eax
out 0x21, al
cmp dword [esi + 0x2979f9b6], 0x20
bound esp, qword [edi + 0x57]
scasb al, byte es:[edi]
mov al, byte [esi + ebx*8 + 0x22]
out 0x2f, eax
sbb eax, 0x30fdf594
mov ecx, 0x77d0f5fb
std
xor byte [ecx + 0x77d0f5fb], bh
inc ebx
xlatb
jnp 0x4210de
lea ecx, [ecx]
shl dword [edx - 0x26], 0x5e
sub eax, ebp
push ss
aaa
arpl word [ecx], dx
jecxz 0x421138
adc al, byte [esi - 1]
pop edi
in eax, 0xa
pop esi
hlt
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x75da3377
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x2c025fdc
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x10005a7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10005a89
pop dword [ebp - 0x2c]
mov eax, 0xa3b06319
add eax, 0x6c4ff770
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x14b3cfe2
add dword [ebp - 0x3c], 0x399e7569
mov dword [ebp - 0x38], 0xfa171b4d
sub dword [ebp - 0x38], 0xc7e3cf08
mov dword [ebp - 0x34], 0x955753ff
sub dword [ebp - 0x34], 0x490b0fd1
mov dword [ebp - 0x30], 0x85f4b52e
add dword [ebp - 0x30], 0x7a0b4ad2
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xdfa8ec8a
add eax, 0x3057d39a
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xff5a3ad0
sub dword [ebp - 0x3c], 0x8ae7d17a
mov dword [ebp - 0x38], 0x60de1bc0
add dword [ebp - 0x38], 0xe08e45b5
mov dword [ebp - 0x34], 0xccb926a0
add dword [ebp - 0x34], 0x96b645cc
mov dword [ebp - 0x30], 0x455586d4
sub dword [ebp - 0x30], 0x455586d4
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xee6c4ea4
add eax, 0x21947188
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x389a2
push 0
call eax
mov ecx, 0x143a851b
add ecx, 0xebc5c541
mov edx, eax
mov edi, 0xe567854f
sub edi, 0xd563114f
add edi, dword [ebp - 0x2c]
mov esi, 0xeeef0e09
xor dword [ebp - 0x1c], 0x7d8071a2
mov ebx, dword [edi]
xor dword [ebp - 0x24], 0xbae6b970
add ebx, esi
add dword [ebp - 0x1c], edi
mov dword [edx], ebx
mov dword [ebp - 4], 0x948f790f
add edx, 0xdcf01d67
sub edx, 0xdcf01d63
add edi, 0xde04a1f4
add edi, 0x21fb5e10
loop 0x10005ba5
add eax, 0x3f94b65f
add eax, 0xc06c65e4
xor ebx, ebx
add ebx, eax
add eax, 0x3f8088e4
sub eax, 0x3f8088df
mov ecx, 0x56e87c9f
add ecx, 0xb9178361
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40b4d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40b517
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40b4e6
jmp 0x40b517
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40b507
pop esi
pop ebp
ret

Function at 0x40c437
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40c46c
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40c496
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40c496
test edi, edi
je 0x40c463
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c463
test edi, edi
je 0x40c49e
mov eax, edi
jmp 0x40c465
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40c465
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0041002e
add esp, 0xc
int3
Function at 0x410062
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestArrayUtils.exe_gMozillaPoisonSize], eax
call fcn.0040c437
pop ecx
mov ecx, dword [sym.TestArrayUtils.exe_gMozillaPoisonSize]
mov dword [sym.TestArrayUtils.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x41009a
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestArrayUtils.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x1000c3a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000c3b2
pop dword [ebp - 0x24]
mov eax, 0x1000c3b2
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x8906f7d0
sub dword [ebp - 0x34], 0x3ab4b285
mov dword [ebp - 0x30], 0x3d84324e
add dword [ebp - 0x30], 0xf4af19f7
mov dword [ebp - 0x2c], 0x34c9df7e
add dword [ebp - 0x2c], 0x178264b0
mov dword [ebp - 0x28], 0x4334c621
sub dword [ebp - 0x28], 0x4334c621
lea eax, [ebp - 0x34]
push eax
mov eax, 0x17493ac7
sub eax, 0x7492a6f
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xa9bc3e76
sub dword [ebp - 0x34], 0x3549d520
mov dword [ebp - 0x30], 0xacfca917
sub dword [ebp - 0x30], 0x6b9047a2
mov dword [ebp - 0x2c], 0xbbf92c
sub dword [ebp - 0x2c], 0x9d4c8cc0
mov dword [ebp - 0x28], 0x41c79fc5
sub dword [ebp - 0x28], 0x41c79fc5
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x666be405
add eax, 0xa9942c03
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x397dc
push 0
call eax
mov ecx, 0xf81c7741
sub ecx, 0xf81c2cc6
xor edx, edx
add edx, eax
mov edi, 0xc3afd5f6
sub edi, 0xb3adb3f6
add edi, dword [ebp - 0x24]
mov esi, 0x6000b5e3
add esi, 0xff721ede
sub dword [ebp - 0x18], eax
mov ebx, dword [edi]
xor dword [ebp - 0x10], 0x5250f735
add ebx, esi
sub dword [ebp - 0x1c], edi
mov dword [edx], ebx
add dword [ebp - 0x1c], 0xd06ad03c
add edx, 0x1b4f56be
add edx, 0xe4b0a946
add edi, 4
loop 0x1000c4d1
add eax, 0x11cbf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x13862f6e
sub ecx, 0x3862f6e
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x1000cdef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100024d0]
jne 0x1000d4b4
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10011e48], eax
mov dword [0x10011e44], ecx
mov dword [0x10011e40], edx
mov dword [0x10011e3c], ebx
mov dword [0x10011e38], esi
mov dword [0x10011e34], edi
mov word [0x10011e60], ss
mov word [0x10011e54], cs
mov word [0x10011e30], ds
mov word [0x10011e2c], es
mov word [0x10011e28], fs
mov word [0x10011e24], gs
pushfd
pop dword [0x10011e58]
mov eax, dword [ebp]
mov dword [0x10011e4c], eax
mov eax, dword [ebp + 4]
mov dword [0x10011e50], eax
lea eax, [ebp + 8]
mov dword [0x10011e5c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10011d98], 0x10001
mov eax, dword [0x10011e50]
mov dword [0x10011d4c], eax
mov dword [0x10011d40], 0xc0000409
mov dword [0x10011d44], 1
mov eax, dword [0x100024d0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10011c40]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10011d90], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100024e0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10011d90], 0
jne 0x1000d5a0
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x6d5d64bc
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6d5d650a
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d5d651b
push 0xd
pop eax
jmp 0x6d5d6545
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d5d651e
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x6d5d6ad6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d5ec420]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d5db37b
mov ebx, eax
cmp ebx, esi
je 0x6d5d6b49
lea ecx, [ebp - 0x74]
call fcn.6d5d4db9
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d5df9b2
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d5d6b61
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d5d6ad6
cmp eax, esi
jne 0x6d5d6b93
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], pe_nt_image_headers32
call ebx
test eax, eax
je 0x6d5d6b51
lea ecx, [ebp - 0x74]
call fcn.6d5d4db9
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d5d63e5
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d5d4db9
mov eax, esi
jmp 0x6d5d6b2f
Function at 0x6d5da76d
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x6d5da777
lea esi, [ecx - 0x78]
jmp 0x6d5da779
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x50]
test esi, esi
je 0x6d5da795
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x6d5dadf2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
test eax, eax
je 0x6d5dae04
add eax, 0xffffff84
jmp 0x6d5dae06
xor eax, eax
and dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0x6d5e2c58
lea ecx, [eax + 4]
call fcn.6d5d8c68
test eax, eax
js 0x6d5dae6f
cmp dword [ebp + 8], 0
je 0x6d5dae6c
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call esi
test ax, ax
jns 0x6d5dae44
inc edi
push 0x11
call esi
test ax, ax
jns 0x6d5dae50
add edi, 2
push 0x12
call esi
test ax, ax
jns 0x6d5dae5c
add edi, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x1c]
jmp 0x6d5dae6f
xor eax, eax
inc eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov esi, ecx
test eax, eax
je 0x6d5dae85
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x6d5db37b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x6d5db38a
pop dword [ebp - 0xc]
mov eax, 0x84e71747
add eax, 0xe8769c43
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3bd78
push 0
mov eax, 0x5ffa84e1
sub eax, 0xf29c63fd
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xcc2f27e6
add ecx, 0x33d13003
xor edx, edx
add edx, eax
mov ebx, 0x6d5f2600
add ebx, dword [ebp - 0xc]
mov esi, 0xce095e60
mov dword [ebp - 8], 0x43d0dfed
mov edi, dword [ebx]
add dword [ebp - 8], 0x2e2323bf
add edi, esi
xor dword [ebp - 4], eax
mov dword [edx], edi
sub dword [ebp - 8], esi
add edx, 0xefd005fa
sub edx, 0xefd005f6
add ebx, 4
loop 0x6d5db3df
add eax, 0x4e099c50
add eax, 0xb1f7b627
xor ebx, ebx
add ebx, eax
add eax, 0x2b9814f8
add eax, 0xd467eb0d
mov ecx, 0xf7e44099
add ecx, 0x7578bf67
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x6d5df62d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x6d5ecaec], 0
push esi
push edi
jne 0x6d5df5a3
call fcn.6d5df50f
test eax, eax
je 0x6d5df5e8
mov eax, dword [0x6d5ecaec]
cmp eax, 1
jne 0x6d5df5c4
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d5df5e8
jmp 0x6d5df62a
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x6d5df62a
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x6d5df5ec
xor eax, eax
jmp 0x6d5df62a
mov eax, dword [esi]
push dword [0x6d5ecaec]
call edi
mov edi, eax
test edi, edi
je 0x6d5df60e
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x6d5df62a
lea edi, [esi + 0xff0]
push esi
push dword [0x6d5ecaec]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x6d5df614
mov eax, esi
pop edi
pop esi
ret
jmp 0x6d5df58f

Function at 0x6d5df9b2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d5ec420]
jne 0x6d5df9bc
repz ret
jmp fcn.6d5e005e
Function at 0x4065b6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4065da
xor eax, eax
test eax, eax
je 0x4065ed
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4065ed
xor ecx, ecx
jmp 0x4065f0
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406719
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427d8c], 0
push esi
jne 0x406750
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40672a
mov dword [ecx*4 + 0x427d88], eax
inc ecx
cmp ecx, 0x100
jl 0x406725
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406781
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427d88]
xor eax, esi
inc ecx
dec edx
jne 0x406763
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx