joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ab70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5bcccc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48ad5a
sub esp, 0x48
mov eax, dword [0x5766d4]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.004878c0
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.00467b1e
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.00467b1e
call fcn.00487190
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.004602e0
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x48ac47
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x48ac61
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x48acd8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x48acae
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x48acaa
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x48aca3
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x48acb0
mov ebx, 0x1d
jmp 0x48acce
mov ebp, eax
jmp 0x48acb0
mov ebp, eax
cmp ebp, 0xd
jae 0x48ad4d
lea eax, [ebp - 1]
lea edx, [0x571700]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x48ad43
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x48acd8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x48ad0a
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x48ad12
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call fcn.00467500
mov eax, ebp
mov ecx, 0xd
call fcn.00467500
nop
call fcn.00466080
jmp fcn.0048ab70
Function at 0x4a29d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5bcccc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a2aca
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x4a2a10
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x4a2a49
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.0046b8c0
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4a2a03
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x4a2a53
inc eax
cmp eax, 4
jge 0x4a2a69
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x4a2ac3
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.0046b910
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x4a2a8c
jmp 0x4a2a52
call fcn.00466080
jmp fcn.004a29d0
Function at 0x419eeb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x419efa
pop dword [ebp - 0xc]
mov eax, 0xdb6c74d1
sub eax, 0xdb2ad5d7
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x4177e
push 0
mov eax, 0xf5c0e26e
sub eax, 0xf57f106e
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xa3349459
sub ecx, 0xa3343e8d
mov ebx, eax
mov esi, 0x436000
add esi, dword [ebp - 0xc]
mov edi, 0xeb0220c1
mov dword [ebp - 8], 0x528e6598
mov edx, dword [esi]
xor dword [ebp - 8], ecx
sub edx, edi
mov dword [ebp - 8], 0x2772f258
mov dword [ebx], edx
mov dword [ebp - 8], 0xb7e979fd
add ebx, 0x42313bdb
sub ebx, 0x42313bd7
add esi, 0xc8310ff7
sub esi, 0xc8310ff3
loop 0x419f4d
add eax, 0x8e1373c8
add eax, 0x71edd63b
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x6d4a2e1d
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6d4a2e6b
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d4a2e7c
push 0xd
pop eax
jmp 0x6d4a2ea6
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d4a2e7f
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x6d4a343c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d4b3fd0]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d4ab5a7
mov ebx, eax
cmp ebx, esi
je 0x6d4a34af
lea ecx, [ebp - 0x74]
call fcn.6d4a2d4b
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d4ab202
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d4a34c7
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d4a343c
cmp eax, esi
jne 0x6d4a34f9
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], pe_nt_image_headers32
call ebx
test eax, eax
je 0x6d4a34b7
lea ecx, [ebp - 0x74]
call fcn.6d4a2d4b
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d4a2cdc
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d4a2d4b
mov eax, esi
jmp 0x6d4a3495
Function at 0x6d4ab202
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d4b3fd0]
jne 0x6d4ab20c
repz ret
jmp fcn.6d4ab8f0
Function at 0x40ba52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40ba9c
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40ba6b
jmp 0x40ba9c
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40ba8c
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40cb32
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40cb67
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40cb91
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40cb91
test edi, edi
je 0x40cb5e
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40cb5e
test edi, edi
je 0x40cb99
mov eax, edi
jmp 0x40cb60
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40cb60
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.004108a5
add esp, 0xc
int3
Function at 0x4108d9
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestWeakPtr.exe_gMozillaPoisonSize], eax
call fcn.0040cb32
pop ecx
mov ecx, dword [sym.TestWeakPtr.exe_gMozillaPoisonSize]
mov dword [sym.TestWeakPtr.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x410911
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestWeakPtr.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406ac2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x406ad1
pop dword [ebp - 0x4c]
mov eax, 0x21b5f8c6
sub eax, 0x21758df5
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xb75f5770
sub dword [ebp - 0x5c], 0x690d1225
mov dword [ebp - 0x58], 0x1ef207e1
add dword [ebp - 0x58], 0x13414464
mov dword [ebp - 0x54], 0x242fbba0
add dword [ebp - 0x54], 0x281c888e
mov dword [ebp - 0x50], 0xa97e5ca6
add dword [ebp - 0x50], 0x5681a35a
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xae9874d1
add eax, 0x51a85b83
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xc82f281f
add dword [ebp - 0x5c], 0xac434137
mov dword [ebp - 0x58], 0x494ca67a
sub dword [ebp - 0x58], 0x7e04505
mov dword [ebp - 0x54], 0x3703dcab
add dword [ebp - 0x54], 0x2c6b8fc1
mov dword [ebp - 0x50], 0x9882f3ab
sub dword [ebp - 0x50], 0x9882f3ab
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3af76
push 0
call eax
mov ecx, 0x4cb6
xor ebx, ebx
add ebx, eax
mov esi, 0x358acf07
sub esi, 0x35491f07
add esi, dword [ebp - 0x4c]
mov edx, 0x8de220c2
xor dword [ebp - 8], ebx
mov edi, dword [esi]
add dword [ebp - 0x34], 0xb4baa999
add edi, edx
mov dword [ebp - 0x1c], 0xf0396484
mov dword [ebx], edi
add dword [ebp - 0x38], ecx
add ebx, 4
add esi, 4
loop 0x406be4
add eax, 0x125ab
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7579a991
add ecx, 0x8ac6566f
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
jmp section..htext

Function at 0x80039fd
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043a0], 0x30
mov dword [0x80043a8], 0x80032e8
mov dword [0x80043a4], 2
mov dword [0x80043ac], 0
mov dword [0x80043b0], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003a40
mov dword [0x80043b4], eax
mov dword [0x80043c8], 0x80041d4
mov dword [0x80043c0], 0xf
mov dword [0x80040f6], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043b8], eax
mov dword [0x80043cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040fe], ebp
mov dword [0x80043bc], eax
push 0x80043a0
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004420], eax
push 0
push dword [0x80040f6]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004418], eax
push 1
push dword [0x8004418]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004418]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003afe
xor edi, edi
lea ebx, [0x80043d0]
jmp 0x8003b16
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003b08
jmp 0x8003b2a
mov eax, dword [0x80043d8]
call 0x80029cd
ret
Function at 0x1000beaf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000bebe
pop dword [ebp - 0x24]
mov eax, 0xbcb19b1a
add eax, 0x534f23a4
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3431d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xe6a011d2
add ecx, 0x1960236a
xor edx, edx
add edx, eax
mov ebx, 0x1001c400
add ebx, dword [ebp - 0x24]
mov edi, 0x950e2693
xor dword [ebp - 0xc], 0xcf5227ab
mov esi, dword [ebx]
xor dword [ebp - 0x18], 0x73c676c3
add esi, edi
add dword [ebp - 0xc], 0x8cadac15
mov dword [edx], esi
add dword [ebp - 4], 0xecc177fe
add edx, 0x7d9daac2
add edx, 0x82625542
add ebx, 4
loop 0x1000bf0e
add eax, 0xbc1bb7dd
sub eax, 0xbc1af01a
mov ebx, eax
add eax, 0xb10f8a24
add eax, 0x4ef075e1
mov ecx, 0x31240df
sub ecx, 0xf31240df
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x4137ba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov edx, dword [ecx]
and edx, 7
cmp dword [ebp + 0xc], 5
jae 0x4137d1
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
lea esi, [eax + ecx]
mov eax, dword [ebp + 0xc]
lea edi, [ecx + eax - 4]
cmp esi, edi
jae 0x4137f8
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x4137f8
inc esi
jmp 0x4137e9
mov eax, esi
sub eax, ecx
cmp esi, edi
mov dword [ebp - 8], eax
jae 0x4138e8
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x41382d
xor edx, edx
mov cl, byte [esi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x41385a
cmp cl, 0xff
je 0x41385a
and edx, 3
shl edx, 1
or edx, 1
inc eax
jmp 0x4137dc
dec ecx
shl edx, cl
and edx, 7
je 0x413813
movzx ecx, byte [edx + 0x4179e0]
mov edi, esi
sub edi, ecx
cmp byte [edx + 0x4179d8], 0
mov cl, byte [edi + 4]
je 0x413855
test cl, cl
je 0x413855
cmp cl, 0xff
jne 0x413813
mov dword [ebp - 4], eax
jmp 0x413822
xor ebx, ebx
mov bh, cl
mov bl, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x413883
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x41388a
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x4138be
movzx edi, byte [edx + 0x4179e0]
push 0x18
mov eax, ebx
shl edi, 3
pop ecx
sub ecx, edi
shr eax, cl
test al, al
je 0x4138a9
cmp al, 0xff
jne 0x4138bb
push 0x20
mov eax, dword [ebp - 8]
pop ecx
push 1
sub ecx, edi
pop edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x413875
mov eax, dword [ebp - 8]
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
add eax, 5
jmp 0x4137dc
mov esi, eax
push 3
sub esi, dword [ebp - 4]
pop edi
lea ecx, [esi - 1]
shl edx, cl
and edx, 7
cmp edi, esi
sbb ecx, ecx
pop edi
not ecx
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
pop ebx
mov dword [edx], ecx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4014b0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push str.patcher
push 0
call fcn.00410cf8
mov esi, eax
push esi
push edi
call fcn.00404c30
mov eax, dword [ebp + 8]
push edi
push eax
call fcn.00404c30
add esp, 0x18
test eax, eax
je 0x4014ef
push edi
push esi
call fcn.00404c30
push esi
call fcn.00404ce7
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret
push esi
call fcn.004111a2
add esp, 4
test eax, eax
je 0x401507
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
call fcn.00404ce7
add esp, 4
mov eax, 1
pop esi
pop ebp
ret

Function at 0x401520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x413ddc
push str.drivers_atikmdag.sys.new
call fcn.00404fb9
mov esi, eax
add esp, 8
test esi, esi
je 0x401563
mov eax, dword [ebp + 8]
push esi
push edi
push 1
push eax
call fcn.0040538e
add esp, 0x10
push esi
cmp eax, edi
je 0x401568
call fcn.00405682
push str.drivers_atikmdag.sys.new
call fcn.004111a2
add esp, 8
xor eax, eax
pop esi
pop ebp
ret
call fcn.00405682
add esp, 4
test eax, eax
je 0x401586
push str.drivers_atikmdag.sys.new
call fcn.004111a2
add esp, 4
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret
Function at 0x403110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
xor esi, esi
push edi
cmp dword [str.SYSTEMCurrentControlSetServices_amdwddmg], esi
je 0x403189
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x417030
mov edx, dword [eax]
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push edx
push 0x80000002
call edi
test eax, eax
jne 0x403177
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push 0x4192a8
push 0
push 0
push str.ImagePath
push ecx
mov dword [ebp - 8], 0x104
call ebx
test eax, eax
je 0x403192
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp dword [esi*4 + 0x417030], 0
lea eax, [esi*4 + 0x417030]
jne 0x403134
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xc
mov esi, 0x4192a8
push str.SystemRoot_
push esi
call fcn.004103ad
add esp, 0xc
test eax, eax
jne 0x4031ba
mov esi, 0x4192b4
push 9
push str.System32_
push esi
call fcn.004103ad
add esp, 0xc
test eax, eax
jne 0x4031d1
add esi, 9
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4031e0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x416174]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push edi
cmp dword [str.SYSTEMCurrentControlSetServices_amdwddmg], esi
je 0x4032cf
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x417030
mov edx, dword [eax]
lea ecx, [ebp - 0x10c]
push ecx
push 3
push 0
push edx
push 0x80000002
call edi
test eax, eax
jne 0x40326e
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x114]
push edx
push 0
push str.ImagePath
push eax
mov dword [ebp - 0x110], 0x104
call ebx
test eax, eax
je 0x403293
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp dword [esi*4 + 0x417030], 0
lea eax, [esi*4 + 0x417030]
jne 0x403215
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404c21
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x114]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edx
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
push eax
push ecx
push 0
push str.ImagePath.bak
push edx
call ebx
test eax, eax
je 0x4032e2
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404c21
mov esp, ebp
pop ebp
ret
mov ecx, dword [str.SystemRootSystem32_]
mov edx, dword [0x413f74]
mov eax, dword [0x413f78]
mov dword [ebp - 0x108], ecx
mov ecx, dword [0x413f7c]
mov dword [ebp - 0x104], edx
mov edx, dword [0x413f80]
mov dword [ebp - 0x100], eax
mov ax, word [0x413f84]
lea edi, [ebp - 0x108]
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], edx
mov word [ebp - 0xf4], ax
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403331
mov ecx, 9
mov esi, str.drivers_atikmdag_patched_atikmdag.sys
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x108]
movsw word es:[edi], word [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403350
sub eax, edx
mov edx, dword [ebp - 0x114]
inc eax
push eax
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x10c]
push str.ImagePath
push eax
call ebx
test eax, eax
je 0x40338f
mov ecx, dword [ebp - 0x10c]
push ecx
jmp 0x4032c9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00404c21
mov esp, ebp
pop ebp
ret