joyce8/EMBER2024-capa huggingface dataset:
Function at 0x207d4d40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [0x2072f8f4]
mov ecx, dword [0x2072f8e8]
push ebx
mov edx, dword [0x2072f8f0]
push ebp
push esi
push edi
push 0x20718260
push 0x20716418
push 4
push 0xd7
push eax
mov eax, dword [0x2072f8ec]
push ecx
push edx
push eax
push 1
xor ebp, ebp
call fcn.207921f0
mov ebx, dword [esp + 0x54]
xor ecx, ecx
mov dword [esp + 0x3c], ecx
xor edx, edx
mov dword [esp + 0x40], ecx
add esp, 0x24
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], edx
test ebx, ebx
mov dword [esp + 0x28], ecx
jne 0x207d4dbc
mov esi, 0x80000065
mov ebp, 0x66
mov edi, esi
mov ebx, 0xe0
jmp 0x207d4f3a
cmp dword [esp + 0x34], 3
jae 0x207d4dd9
mov esi, 0x80000066
mov ebp, 0x73
mov edi, esi
mov ebx, 0xe2
jmp 0x207d4f3a
mov edi, dword [esp + 0x44]
test edi, edi
jne 0x207d4df7
mov esi, 0x8000006a
mov ebp, 0x66
mov edi, esi
mov ebx, 0xe4
jmp 0x207d4f3a
mov esi, dword [esp + 0x48]
test esi, esi
jle 0x207d4f29
cmp esi, 3
jge 0x207d4f29
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x207d4e21
mov dword [edi], 0x14
xor esi, esi
jmp 0x207d4f63
mov eax, dword [edi]
cmp eax, 0x14
jae 0x207d4e44
mov esi, 0x80000079
mov dword [edi], 0x14
mov ebp, 0x68
mov edi, esi
mov ebx, 0xf6
jmp 0x207d4f3a
jbe 0x207d4e4c
mov dword [edi], 0x14
lea eax, [esp + 0x10]
push 1
push eax
call fcn.207981e0
add esp, 8
test eax, eax
je 0x207d4e76
push eax
mov ebx, 0x103
mov edi, eax
call fcn.207b24d0
add esp, 4
mov esi, eax
jmp 0x207d4f3a
mov eax, esi
dec eax
je 0x207d4e9b
dec eax
je 0x207d4e94
mov esi, 0x8000006b
mov ebp, 0x138f
mov edi, esi
mov ebx, 0x112
jmp 0x207d4f3a
mov esi, 0x20721d70
jmp 0x207d4ea0
mov esi, 0x20721d48
mov al, 0xbe
xor ecx, ecx
mov dl, byte [esi]
xor al, 0x73
add al, 0x2c
add esi, 2
xor dl, al
mov byte [esp + ecx + 0x18], dl
inc ecx
cmp ecx, 0x14
jl 0x207d4ea4
lea eax, [esp + 0x18]
push 0x14
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.207982b0
mov eax, dword [esp + 0x40]
xor edx, edx
mov dword [esp + 0x24], edx
push eax
mov dword [esp + 0x2c], edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], edx
push ebx
mov dword [esp + 0x38], edx
push ecx
mov dword [esp + 0x40], edx
call fcn.207982b0
mov eax, dword [esp + 0x50]
add esp, 0x18
test eax, eax
je 0x207d4f12
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jbe 0x207d4f12
push ecx
lea edx, [esp + 0x14]
push eax
push edx
call fcn.207982b0
add esp, 0xc
mov eax, dword [esp + 0x40]
push edi
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.20798340
add esp, 0xc
xor esi, esi
jmp 0x207d4f63
mov esi, 0x8000006b
mov ebp, 0x138f
mov edi, esi
mov ebx, 0xe6
mov edx, dword [0x2072f8f4]
mov eax, dword [0x2072f8e8]
mov ecx, dword [0x2072f8f0]
push ebp
push ebx
push edx
mov edx, dword [0x2072f8ec]
push eax
push ecx
push edx
push edi
push esi
push 3
call fcn.2078d820
add esp, 0x24
mov eax, dword [0x2072f8f4]
mov ecx, dword [0x2072f8e8]
mov edx, dword [0x2072f8f0]
push esi
push 0x20718250
push 0x20718240
push 4
push 0x139
push eax
mov eax, dword [0x2072f8ec]
push ecx
push edx
push eax
push 1
call fcn.207921f0
add esp, 0x28
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x207d9ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x1164
call fcn.208486f0
mov eax, dword [0x2072f9a8]
mov ecx, dword [0x2072f988]
push ebx
mov edx, dword [0x2072f990]
push ebp
push esi
push edi
push 0x20718260
push 0x20716418
and byte [edx + 4], ch
Function at 0x207ea390
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x40
mov eax, dword [esp + 0x4c]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax]
xor ebx, ebx
xor ebp, ebp
mov cl, byte [edi + 4]
mov byte [esp + 0x47], cl
mov ecx, dword [esp + 0x58]
mov edx, dword [edi]
mov word [esp + 0x44], bx
mov al, byte [ecx]
mov dword [esp + 0x38], edx
cmp al, 0x80
mov dword [esp + 0x4c], ebx
jae 0x207ea3d1
and eax, 0xff
mov esi, 1
mov dword [esp + 0x1c], eax
jmp 0x207ea3e5
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.207e29e0
mov esi, eax
mov eax, dword [esp + 0x24]
add esp, 8
mov ecx, dword [edi + 8]
cmp esi, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], ecx
jae 0x207ea4e5
lea edx, [edi + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x5c]
xor eax, eax
mov ax, word [ecx + 4]
cmp ebx, eax
jge 0x207ea4e5
mov edx, dword [esp + 0x58]
mov al, byte [esi + edx]
lea ecx, [esi + edx]
cmp al, 0x80
jae 0x207ea439
and eax, 0xff
mov ecx, eax
mov eax, 1
mov dword [esp + 0x20], ecx
jmp 0x207ea44b
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.207e29e0
mov ecx, dword [esp + 0x28]
add esp, 8
mov edx, dword [esp + 0x10]
add esi, eax
cmp edx, dword [esp + 0x54]
jb 0x207ea46f
cmp ecx, 0xc
jb 0x207ea463
lea eax, [ecx - 0xc]
shr eax, 1
jmp 0x207ea46b
xor eax, eax
mov al, byte [ecx + 0x2072fc34]
test eax, eax
jg 0x207ea4e5
lea eax, [esp + 0x28]
push eax
push ecx
mov ecx, dword [esp + 0x60]
add edx, ecx
push edx
call fcn.207e9f90
mov ecx, dword [esp + 0x1c]
add esp, 0xc
add ecx, eax
mov eax, dword [esp + 0x24]
cmp ebx, eax
mov dword [esp + 0x10], ecx
jge 0x207ea49e
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
jmp 0x207ea4a0
xor eax, eax
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x60]
mov ecx, dword [eax + 8]
add ecx, edx
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.207edfd0
mov ebp, eax
add esp, 0xc
test ebp, ebp
jne 0x207ea4e5
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
inc ebx
add edx, 4
add ecx, 0x28
cmp esi, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
jb 0x207ea407
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x207ea4fa
lea eax, [esp + 0x28]
push eax
call fcn.207ed290
add esp, 4
test ebp, ebp
jne 0x207ea530
mov al, byte [edi + 5]
test al, al
je 0x207ea510
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x40
ret
mov al, byte [edi + 6]
test al, al
jne 0x207ea544
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jae 0x207ea544
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40
ret
mov eax, dword [edi + 0xc]
test eax, eax
je 0x207ea544
cmp ebx, dword [edi + 8]
jge 0x207ea544
cmp byte [eax + ebx], 0
je 0x207ea544
neg ebp
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x207f7c30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x28]
test esi, esi
mov dword [esp + 4], 0x14
jne 0x207f7c4e
mov eax, 0x80000065
pop esi
add esp, 0x20
ret
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x207f7c60
mov eax, 0x80000067
pop esi
add esp, 0x20
ret
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x207f7c72
mov eax, 0x80000068
pop esi
add esp, 0x20
ret
push ebx
push ebp
push edi
mov al, 0xeb
xor edi, edi
mov ecx, 0x20722a38
mov dl, byte [ecx]
xor al, 0x43
add al, 0x4d
add ecx, 2
xor dl, al
mov byte [esp + edi + 0x1c], dl
inc edi
cmp ecx, 0x20722a60
jl 0x207f7c7e
lea eax, [esp + 0x14]
push 1
push eax
call fcn.207981e0
lea ecx, [esp + 0x24]
push 0x14
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.207982b0
mov ebp, dword [esp + 0x4c]
xor eax, eax
mov dword [esp + 0x30], eax
add esp, 0x14
mov dword [esp + 0x20], eax
xor ebx, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
test ebp, ebp
mov dword [esp + 0x2c], eax
jbe 0x207f7d04
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
sub edi, esi
mov eax, dword [esi]
test eax, eax
je 0x207f7d00
mov ecx, dword [edi + esi]
lea edx, [esp + 0x14]
push ecx
push eax
push edx
call fcn.207982b0
add esp, 0xc
inc ebx
add esi, 4
cmp ebx, ebp
jb 0x207f7ce0
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push esi
push ecx
call fcn.20798340
add esp, 0xc
cmp ebx, ebp
pop edi
pop ebp
pop ebx
je 0x207f7d3e
mov eax, 0x80000067
pop esi
add esp, 0x20
ret
xor eax, eax
pop esi
add esp, 0x20
ret
Function at 0x20813410
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x40
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x2081491d
mov ebx, dword [eax + 0x1c]
test ebx, ebx
je 0x2081491d
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x2081491d
cmp dword [eax], 0
jne 0x20813449
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x2081491d
cmp dword [ebx], 0xb
jne 0x20813454
mov dword [ebx], 0xc
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov eax, dword [ebx + 0x38]
mov ebp, dword [ebx + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebx]
cmp ecx, 0x1c
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], 0
ja 0x2081491d
jmp 0x2081349a
jmp dword [ecx*4 + 0x20814a90]
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret

Function at 0x20815350
Capabilities:
Reference sql statements
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2a8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2b8]
push edi
xor ecx, ecx
mov eax, dword [esi]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x9c], ecx
mov eax, dword [eax + 8]
mov dword [esp + 0x7c], ecx
mov edx, dword [eax + 0x14]
mov al, byte [edx + 0x59]
mov byte [esp + 0x4c], al
lea eax, [esi + 0xb4]
push eax
mov dword [esp + 0x134], eax
call fcn.207e8060
mov eax, dword [esi + 0x78]
add esp, 4
cmp eax, 7
je 0x208190cd
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [esi + 0x78], ecx
mov dword [esi + 0x94], ecx
mov edx, dword [eax + 0xd8]
mov dword [eax + 0x148], ecx
cmp edx, ecx
jne 0x2081909c
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x1c], ecx
Function at 0x2081f3b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
jne 0x2081f3c5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ebp, dword [esp + 0x14]
push 0x48
push ebp
call fcn.207e1330
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x2081f3e1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov al, byte [edi + 5]
mov byte [esi + 5], al
mov ecx, dword [edi]
push ecx
push ebp
call fcn.2081f080
mov dword [esi], eax
mov edx, dword [edi + 0xc]
push edx
push ebp
call fcn.2081f1e0
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
push eax
push ebp
call fcn.2081ef60
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
push ecx
push ebp
call fcn.2081f080
mov dword [esi + 0x14], eax
mov edx, dword [edi + 0x18]
push edx
push ebp
call fcn.2081ef60
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
push eax
push ebp
call fcn.2081f080
mov dword [esi + 0x1c], eax
mov cl, byte [edi + 4]
mov byte [esi + 4], cl
mov edx, dword [edi + 0x20]
push edx
push ebp
call fcn.2081f3b0
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x2c]
push eax
push ebp
call fcn.2081ef60
add esp, 0x40
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0x30]
push ecx
push ebp
call fcn.2081ef60
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dl, byte [edi + 6]
mov byte [esi + 6], dl
mov al, byte [edi + 7]
mov byte [esi + 7], al
add esp, 8
or eax, 0xffffffff
mov byte [esi + 8], bl
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov byte [esi + 9], bl
mov dword [esi + 0x28], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x20828af0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
test esi, esi
push edi
jne 0x20828b06
pop edi
pop esi
pop ebp
mov eax, 0x80000065
pop ebx
ret
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x20828b18
pop edi
pop esi
pop ebp
mov eax, 0x80000066
pop ebx
ret
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x20828b2a
pop edi
pop esi
pop ebp
mov eax, 0x80000068
pop ebx
ret
mov eax, 0xaaaaaaab
mov ebx, 3
mul edi
mov ebp, edx
mov eax, edi
xor edx, edx
div ebx
shr ebp, 1
lea ecx, [ebp*4]
test edx, edx
je 0x20828b4e
add ecx, 4
mov eax, dword [esp + 0x1c]
inc ecx
test eax, eax
je 0x20828c4f
mov edx, dword [esp + 0x20]
cmp dword [edx], ecx
jb 0x20828c4f
cmp edi, 3
jb 0x20828bd0
xor edx, edx
xor ebx, ebx
mov dl, byte [esi]
add esi, 3
shr edx, 2
inc eax
sub edi, 3
mov dl, byte [edx + 0x207315f8]
mov byte [eax - 1], dl
mov dl, byte [esi - 3]
mov bl, byte [esi - 2]
and edx, 3
shl edx, 4
shr ebx, 4
or edx, ebx
xor ebx, ebx
inc eax
mov dl, byte [edx + 0x207315f8]
mov byte [eax - 1], dl
mov dl, byte [esi - 2]
mov bl, byte [esi - 1]
and edx, 0xf
shl edx, 2
shr ebx, 6
or edx, ebx
inc eax
mov dl, byte [edx + 0x207315f8]
mov byte [eax - 1], dl
mov dl, byte [esi - 1]
and edx, 0x3f
inc eax
dec ebp
mov dl, byte [edx + 0x207315f8]
mov byte [eax - 1], dl
jne 0x20828b6c
dec edi
je 0x20828c13
dec edi
jne 0x20828c3e
xor edx, edx
xor ebx, ebx
mov dl, byte [esi]
shr edx, 2
inc eax
mov dl, byte [edx + 0x207315f8]
mov byte [eax - 1], dl
mov dl, byte [esi]
mov bl, byte [esi + 1]
and edx, 3
shl edx, 4
shr ebx, 4
or edx, ebx
inc eax
mov dl, byte [edx + 0x207315f8]
mov byte [eax - 1], dl
mov dl, byte [esi + 1]
and edx, 0xf
mov dl, byte [edx + 0x207315f8]
mov byte [eax], dl
jmp 0x20828c39
xor edx, edx
mov dl, byte [esi]
shr edx, 2
inc eax
mov dl, byte [edx + 0x207315f8]
mov byte [eax - 1], dl
mov dl, byte [esi]
and edx, 3
shl edx, 4
inc eax
mov dl, byte [edx + 0x207315f8]
mov byte [eax - 1], dl
mov byte [eax], 0x3d
inc eax
mov byte [eax], 0x3d
inc eax
mov byte [eax], 0
mov eax, dword [esp + 0x20]
dec ecx
pop edi
pop esi
mov dword [eax], ecx
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [esp + 0x20]
pop edi
neg eax
sbb eax, eax
pop esi
pop ebp
mov dword [edx], ecx
and eax, 0x80000079
pop ebx
ret
Function at 0x20828c70
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
xor edi, edi
test ecx, ecx
jne 0x20828c88
pop edi
pop esi
pop ebp
mov eax, 0x80000065
pop ebx
ret
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x20828e2b
test bl, 3
jne 0x20828e2b
mov edx, dword [esp + 0x20]
test edx, edx
jne 0x20828caf
pop edi
pop esi
pop ebp
mov eax, 0x80000068
pop ebx
ret
mov esi, dword [esp + 0x1c]
lea eax, [ebx + ebx*2]
shr eax, 2
test esi, esi
je 0x20828e19
cmp dword [edx], eax
jb 0x20828e19
mov al, byte [ecx + ebx - 1]
lea ebp, [ebx - 4]
cmp al, 0x3d
je 0x20828cd6
mov ebp, ebx
xor edx, edx
test ebp, ebp
jbe 0x20828cf8
mov al, byte [edx + ecx]
cmp al, 0x7f
jg 0x20828d46
cmp al, 0x3d
je 0x20828cf3
movsx eax, al
cmp byte [eax + 0x20731638], 0xff
je 0x20828d46
inc edx
cmp edx, ebp
jb 0x20828cdc
cmp ebp, ebx
je 0x20828d50
mov eax, ebp
jae 0x20828d0b
cmp byte [eax + ecx], 0x7f
jg 0x20828d46
inc eax
cmp eax, ebx
jb 0x20828d00
mov al, byte [ecx + ebp]
movsx edx, al
cmp byte [edx + 0x20731638], 0xff
je 0x20828d46
cmp al, 0x3d
je 0x20828d46
mov al, byte [ecx + ebp + 1]
movsx edx, al
cmp byte [edx + 0x20731638], 0xff
je 0x20828d46
cmp al, 0x3d
je 0x20828d46
mov al, byte [ecx + ebp + 2]
cmp al, 0x3d
je 0x20828d50
movsx eax, al
cmp byte [eax + 0x20731638], 0xff
jne 0x20828d50
pop edi
pop esi
pop ebp
mov eax, 0x800000d6
pop ebx
ret
test ebp, ebp
jbe 0x20828dc4
lea edi, [ebp + 3]
shr edi, 2
lea edx, [edi + edi*2]
mov dword [esp + 0x14], edx
movsx eax, byte [ecx + 1]
add ecx, 4
mov dl, byte [eax + 0x20731638]
movsx eax, byte [ecx - 4]
shr dl, 4
mov al, byte [eax + 0x20731638]
shl al, 2
or dl, al
mov byte [esi], dl
inc esi
movsx edx, byte [ecx - 3]
mov al, byte [edx + 0x20731638]
movsx edx, byte [ecx - 2]
shl al, 4
mov dl, byte [edx + 0x20731638]
shr dl, 2
or al, dl
mov byte [esi], al
inc esi
movsx eax, byte [ecx - 2]
mov dl, byte [eax + 0x20731638]
movsx eax, byte [ecx - 1]
shl dl, 6
or dl, byte [eax + 0x20731638]
inc esi
dec edi
mov byte [esi - 1], dl
jne 0x20828d61
mov edi, dword [esp + 0x14]
cmp ebp, ebx
je 0x20828e0c
movsx edx, byte [ecx + 1]
mov al, byte [edx + 0x20731638]
movsx edx, byte [ecx]
shr al, 4
mov dl, byte [edx + 0x20731638]
shl dl, 2
or al, dl
inc edi
mov byte [esi], al
mov al, byte [ecx + 2]
cmp al, 0x3d
je 0x20828e0c
movsx ecx, byte [ecx + 1]
movsx eax, al
mov dl, byte [ecx + 0x20731638]
mov cl, byte [eax + 0x20731638]
shl dl, 4
and cl, 0xf
or dl, cl
inc edi
mov byte [esi + 1], dl
mov edx, dword [esp + 0x20]
xor eax, eax
mov dword [edx], edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [edx], eax
mov eax, esi
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
and eax, 0x80000079
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0x80000066
pop ebx
ret
Function at 0x4077e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4077f3
pop dword [ebp - 0x20]
mov eax, 0x9b3f2f9b
add eax, 0x65014858
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x5243e
push 0
mov eax, 0x1a93c80a
sub eax, 0x1a4d6032
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x67de901d
add ecx, 0x9821c924
mov esi, eax
mov edi, 0xf827841d
sub edi, 0xf7dea41d
add edi, dword [ebp - 0x20]
mov ebx, 0x8c9ab2a2
sub ebx, 0xbf9f1c0e
add dword [ebp - 0x10], 0xbbd812a8
mov edx, dword [edi]
xor edx, ebx
sub dword [ebp - 0x14], edx
mov dword [esi], edx
sub dword [ebp - 0x18], 0x77bd4fd8
add esi, 0x9d2032b2
add esi, 0x62dfcd52
add edi, 0x74a59357
sub edi, 0x74a59353
loop 0x407852
add eax, 0x9d5cc9e0
sub eax, 0x9d5b7209
xor ebx, ebx
add ebx, eax
add eax, 0xa217451d
add eax, 0x5de8bae8
mov ecx, 0xe522cb55
add ecx, 0x1b1d34ab
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10005dd0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
push edi
push eax
mov esi, ecx
mov ecx, dword [ebp + 8]
push ebx
push ecx
mov ecx, esi
call fcn.1001b860
test eax, eax
je 0x10005fb8
cmp ebx, 0x203
ja 0x10005ec8
je 0x10005e93
mov eax, ebx
sub eax, 2
je 0x10005e7c
sub eax, 0xe
je 0x10005e35
sub eax, 0x3a
jne 0x10005eda
push edi
mov ecx, esi
call fcn.100074f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [esi]
mov eax, dword [edx + 0x8c]
push 0x104
push 0x100356e8
push 0x100356f0
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x10005fb8
call fcn.10007480
mov edx, dword [esi]
mov eax, dword [edx + 0x80]
mov ecx, esi
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.10007480
mov eax, esi
call fcn.10006fd0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
xor eax, eax
movzx ecx, di
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x10]
push eax
push ecx
shr edi, 0x10
mov ecx, esi
mov dword [esp + 0x1c], edi
call edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, ebx
sub eax, 0x4cc
je 0x10005faf
sub eax, 6
je 0x10005ef3
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push edi
push eax
push ebx
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [esi + 0x2730]
push 0x1388
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10005f4a
mov eax, dword [esi + 0x2730]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi]
mov eax, dword [edx + 0x8c]
push 0
push 0x100356e8
push 0x10035710
mov ecx, esi
mov dword [esi + 0x2730], 0
call eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [esi + 0x2730]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x2730]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x2730]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 0
push 0x100356e8
push 0x10035710
mov ecx, esi
mov dword [esi + 0x2730], 0
call edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, edi
mov ecx, esi
call fcn.10007000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10006d70
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.10007bc0
mov edx, dword [esp]
lea ecx, [esp + 4]
push ecx
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x10006dc9
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10006dc3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
add esp, 8
ret
mov ecx, dword [esp + 4]
push 0x100356e0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
mov eax, dword [esp]
je 0x10006df2
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x10006db7
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10006e0e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
add esp, 8
ret

Function at 0x10006ea0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [0x10044c58]
push 0x8a
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
mov ebx, eax
test ebx, ebx
je 0x10006fc6
push 0
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0x400
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_RemoveMenu]
mov ebp, dword [sym.imp.USER32.dll_DestroyMenu]
push ebx
call ebp
test edi, edi
je 0x10006fc6
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x8c]
push 0
mov ecx, esi
call eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
push 0x102
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push edi
mov ebx, eax
call ebp
mov eax, ebx
sub eax, 0x9c4a
je 0x10006f85
sub eax, 1
jne 0x10006fc6
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 0x104
push 0x100356e8
push 0x100356f0
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x10006fc6
mov eax, esi
call fcn.10006fd0
mov eax, dword [esi]
mov edx, dword [eax + 0x80]
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 1
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esi + 0x2724], 0
je 0x10006fbc
mov dword [esi + 0x2374], 0
add esi, 0x2368
push esi
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret