joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011312
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebx + 4], eax
xor eax, eax
cmp byte [ebp + 0x24], al
mov dword [ebx + 0x10], ecx
mov ecx, dword [ebp + 0x10]
push edi
mov word [ebx + 0xc], ax
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], eax
jne 0x101135c
mov ecx, 0x2000
lea edi, [esi + 0x8000]
rep movsd dword es:[edi], dword [esi]
mov word [ebx + 0x2c], ax
mov dword [ebx + 0x30], eax
call fcn.01010d5f
mov eax, dword [ebx + 0x14]
and dword [ebx + 0x20], 0
mov ecx, 0x8000
push 2
mov word [ebx + 0x3c], cx
mov dword [ebx + 0x34], ecx
add eax, ecx
pop edx
movzx edi, byte [eax]
mov esi, dword [ebx + 0x20]
shl esi, 5
xor esi, edi
and esi, 0x7fff
inc eax
dec edx
mov dword [ebx + 0x20], esi
jne 0x1011380
cmp byte [ebp + 0x24], 0
je 0x10113a7
mov edi, ebx
call fcn.01010bb3
jmp 0x10113b6
xor eax, eax
mov edx, dword [ebx + 0x18]
and word [eax + edx], 0
inc eax
inc eax
dec ecx
jne 0x10113a9
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.0100ffc6
push 0x4b
pop edx
call fcn.0100ffc6
call fcn.01011091
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
je 0x10113f0
mov edi, dword [ebx + 0x14]
mov ecx, 0x2000
lea esi, [edi + 0x8000]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x28]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24
Function at 0x401318
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push edi
push ebx
sub esp, 0xc8
call sym.___main
mov dword [esp + 4], 0x403024
mov dword [esp], str.1.txt
call sym._fopen
mov dword [esp + 0xbc], eax
cmp dword [esp + 0xbc], 0
jne 0x401368
mov dword [esp], str.open_error
call sym._puts
mov dword [esp], 0
call sym._exit
lea ebx, [esp + 0x44]
mov al, 0
mov edx, 0x78
mov edi, ebx
mov ecx, edx
rep stosb byte es:[edi], al
mov dword [esp + 0x44], 0xa
mov dword [esp + 0x48], 0x616161
lea ebx, [esp + 0x4c]
mov al, 0
mov edx, 0x10
mov edi, ebx
mov ecx, edx
rep stosb byte es:[edi], al
mov dword [esp + 0x5c], 0xb
mov dword [esp + 0x60], 0x626262
lea ebx, [esp + 0x64]
mov al, 0
mov edx, 0x10
mov edi, ebx
mov ecx, edx
rep stosb byte es:[edi], al
mov dword [esp + 0x74], 0xc
mov dword [esp + 0x78], 0x636363
lea ebx, [esp + 0x7c]
mov al, 0
mov edx, 0x10
mov edi, ebx
mov ecx, edx
rep stosb byte es:[edi], al
mov dword [esp + 0x8c], 0xd
mov dword [esp + 0x90], 0x646464
lea ebx, [esp + 0x94]
mov al, 0
mov edx, 0x10
mov edi, ebx
mov ecx, edx
rep stosb byte es:[edi], al
mov dword [esp + 0xa4], 0xe
mov dword [esp + 0xa8], 0x656565
lea ebx, [esp + 0xac]
mov al, 0
mov edx, 0x10
mov edi, ebx
mov ecx, edx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0xbc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 5
mov dword [esp + 4], 0x18
lea eax, [esp + 0x44]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [esp + 0xbc]
mov dword [esp], eax
call sym._rewind
mov eax, dword [esp + 0xbc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x18
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sym._fread
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x2c]
add edx, 4
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str._d___s_n
call sym._printf
mov dword [esp + 8], 0
mov dword [esp + 4], 0x30
mov eax, dword [esp + 0xbc]
mov dword [esp], eax
call sym._fseek
test eax, eax
je 0x4014dd
mov dword [esp], str.error
call sym._printf
jmp 0x4014e9
mov dword [esp], str.yeah
call sym._puts
mov eax, dword [esp + 0xbc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x18
lea eax, [esp + 0x14]
mov dword [esp], eax
call sym._fread
mov dword [esp], 0x40304b
call sym._puts
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x14]
add edx, 4
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str._d___s_n
call sym._printf
mov eax, dword [esp + 0xbc]
mov dword [esp], eax
call sym._fclose
add esp, 0xc8
pop ebx
pop edi
leave
ret
Function at 0x52ebdd
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x52ebfb
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x52ebf0
pop esi
ret
Function at 0x5e2185
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x1c], esp
mov dword [esp + 0x18], ebp
call fcn.005e21a0
mov bh, 0x27
mov bh, 0xd2
and dword [ebx + reloc.MSVCRT.dll_strncpy], ebx
mov esi, 0x243c8989
mov dword [esp], edi
mov dword [esp], edi
jmp 0x5e216c

Function at 0x5e21a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
jmp 0x5e22b2
lea esp, [esp + 2]
push word [esp]
jge 0x5e218a
jl 0x5e21b4
push 3
xchg ebx, eax
test byte [0x89f146b4], 0x74
and al, 0x18
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
jmp 0x5e22b2
pushfd
call 0x5e2249
jbe 0x5e22ce
seto dh
mov dx, 0x12d1
jmp fcn.005e22d5
seto dh
mov dx, 0x12d1

Function at 0x5e42cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf05ce720
jmp 0x5e4361
jmp 0x5e42f2
mov dword [esp + 2], ecx
jmp 0x5e433c
mov dword [esp], edx
mov dword [esp], ecx
push dword [esp + 3]
je 0x5e42cd
mov dword [esp + 2], ecx
mov word [esp + 5], bp
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x5e4325
pushfd
jmp 0x5e3259
mov word [esp + 5], bp
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x5e4325
xchg al, bl
jmp 0x5e439f
dec ecx
jae 0x5e434b
xchg al, bl
mov ch, 0x16
stc
jmp 0x5e43a2
mov dl, 0x8c
stc
jne 0x5e43a8
mov cx, word [esp]
jmp 0x5e43ac
mov ch, 0x16
stc
mov esi, dword [esp + 0x2c]
jmp 0x5e4388
mov cx, word [esp]
jmp 0x5e4422
jmp 0x5e43f6
jmp 0x5e43e0
pop word [esp]
xchg byte [esp], dl
lea esp, [esp + 2]
lea edx, reloc.MSVCRT.dll_strncpy
rcl ch, cl
jmp 0x5e447f
add bh, byte [ebp - 0x6e99e074]
lea esp, [esp + 2]
mov dword [esp + 4], eax
pushfd
push bx
call fcn.005e437f
rdtsc
not cl
mov ebx, esi
pushfd
jmp 0x5e43b2
sub esp, 0xc0
mov ebp, esp
bsf ax, si
jb 0x5e43b0
rdtsc
not cl
jmp 0x5e43e4
bt edx, edi
mov edx, 0xb28029cb
xchg edx, eax
jmp 0x5e4438
retf
lea edi, [esp]
not bl
bswap eax
mov edx, 0x25411d8b
rcr eax, cl
jl 0x5e43ae
jge 0x5e43f6
neg esi
sbb ax, di
js 0x5e4468
jns 0x5e4468
repne insb byte es:[edi], dx
loop 0x5e43ca
je 0x5e440e
in al, 0x79
jmp 0xd92bbfd6
xchg edx, eax
jmp 0x5e4438
call fcn.005e4452
push esi
hlt
jnp 0x5e440a
bt edx, edi
mov edx, 0xb28029cb
jmp 0x5e444f

Function at 0x5e42e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.005e4273
lea esp, [esp + 2]
pushfd
push dword [esp + 2]
jle 0x5e42a3
jg 0x5e42a3

Function at 0x5e437f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], ecx
call fcn.005e42e5
pop dword [esp]
lea esp, [esp + 2]
jmp 0x5e431c
Function at 0x5e4452
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
rdtsc
jmp 0x5e44a1
mov eax, 0x9e6715b8
lea eax, [eax*4]
jmp 0x5e44ad
lea esp, [esp + 2]
not esi
neg al
jg 0x5e448b
jle 0x5e44ce
lea edx, reloc.MSVCRT.dll_strncpy
clc
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0x5e44ed
mov eax, 0x9e6715b8
lea eax, [eax*4]
lea edx, reloc.MSVCRT.dll_strncpy
clc
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0x5e44ed
not cx
jmp 0x5e4534
xor esi, 0x6bc0d7b9
call 0x5e451e
mov al, 0x9d
lea ecx, [edx*4]
bswap edx
mov edx, 0x38399519
neg cx
call fcn.005e45a6
cmp al, 0xf
ja 0x5e4587
jbe 0x5e4587
mov al, 0x9d
lea ecx, [edx*4]
bswap edx
jmp 0x5e456e
mov edx, 0x38399519
neg cx
jmp 0x5e45d4
neg esi
add dx, di
jae 0x5e453f
jb 0x5e455d
mov eax, 0x3c03f601
rdtsc
mov eax, 0x829bed8e
lea ebx, [ebx + 0x7d]
jmp 0x5e45b4
lea edx, [ecx*4]
bt ecx, ebp
xchg dword [esp], ebx
add dh, 0x9e
bts cx, di
push bp
jmp 0x5e4600
mov al, cl
mov edx, 0xde15bd32
dec esi
stc
jmp 0x5e4ae7
mov cx, word [esp]
inc eax
jmp 0x5e4aa8
lea esp, [esp + 2]
push dword [esp]
ret 4
js 0x5e45e3
mov cx, word [esp]
inc eax
jmp 0x5e45e8

Function at 0x5e45a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dl, ah
mov ecx, dword [esp]
rdtsc
xchg ah, dl
xchg dword [esp], ebx
jmp 0x5e4590

Function at 0x5ec9c6
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x5d1a53
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x5d1a6d
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x5d1a5c
pop esi
jmp 0x5d1a78
ret 4
jmp 0x5d1a46

Function at 0x6c5aae
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6c5adc
mov word [esp + 5], si
popal
mov di, word [esp + 2]
mov byte [esp], al
mov si, word [esp]
jmp 0x6c5b23
push 0
pushal
mov bx, word [esp]
pushal
xchg byte [esp + 0x1e], ah
jmp 0x6c5b4d
mov bx, sp
lea esp, [esp + 3]
popal
push ax
mov word [esp], sp
lea esp, [esp + 2]
jmp 0x6c5b0d
xchg word [esp + 3], si
xchg word [esp + 0x13], di
cpuid
lea esp, [esp + 2]
jmp 0x6c5ba0
mov dword [esp + 0x13], ebx
push dword [esp + 0x10]
push dword [esp + 1]
xchg word [esp + 2], si
jmp 0x6c5b37
cpuid
mov word [esp + 0xc], di
xchg bp, dx
mov esi, 0x7e85c636
not ebp
push word [esp + 0x1a]
jmp 0x6c5b76

Function at 0x6c7096
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp + 0xc], esi
call 0x6c707d

Function at 0x6c7132
Capabilities:
Access peb ldr_data

Disassembly:
mov byte [esp + 2], ah
mov dword [esp + 4], esp
call fcn.006c7044
push word [esp]
lea esp, [esp + 3]
mov dword [esp + 4], ebx
push ebp
jmp 0x6c705a

Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x41da50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x41da72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41da79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41da68
mov eax, 1
add ebx, ebx
jne 0x41da8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41da80
jne 0x41da9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41da80
xor ecx, ecx
sub eax, 3
jb 0x41dab0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41db22
mov ebp, eax
add ebx, ebx
jne 0x41dabb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41dac8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41daec
inc ecx
add ebx, ebx
jne 0x41dad8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41dacd
jne 0x41dae9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41dacd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41db0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41dafd
jmp 0x41da6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41db0c
add edi, ecx
jmp 0x41da6e
pop esi
mov edi, esi
mov ecx, 0x20f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41db2a
cmp byte [edi], 5
jne 0x41db2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41db2f
lea edi, [esi + 0x1b000]
mov eax, dword [edi]
or eax, eax
je 0x41dba7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e37c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e41c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41db5c
mov ecx, edi
jns 0x41db8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e420]
or eax, eax
je 0x41dba1
mov dword [ebx], eax
add ebx, 4
jmp 0x41db79
call dword [esi + 0x1e428]
mov ebp, dword [esi + 0x1e424]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41dbdb
sub esp, 0xffffff80
jmp 0x40cad0
Function at 0x1001953
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x100413c]
and dword [ebp - 0x24c], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xe
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
push 0x43
lea edi, [ebp - 0x248]
rep stosd dword es:[edi], eax
mov esi, 0x106
push esi
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [0x10010f4]
cmp eax, 0xffffffff
jne 0x10019b1
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.01001495
test eax, eax
jl 0x1001a57
lea eax, [ebp - 0x210]
push eax
call dword [0x1001104]
mov esi, eax
xor edi, edi
cmp word [esi], di
je 0x10019cb
mov word [esi - 2], di
lea eax, [ebp - 0x210]
push eax
call dword [0x1001108]
mov dword [ebp - 0x238], esi
xor esi, esi
inc esi
cmp dword [ebp + 0xc], edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x24c], 0x3c
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x248], 0x40
je 0x1001a16
mov dword [ebp - 0x248], 0x440
lea eax, [ebp - 0x24c]
push eax
call dword [0x10010f8]
test eax, eax
je 0x1001a57
cmp dword [ebp - 0x214], edi
je 0x1001a53
cmp dword [ebp + 0x10], edi
je 0x1001a47
push 0x4ff
push 0xffffffffffffffff
push dword [ebp - 0x214]
push edi
call fcn.01002bc4
push dword [ebp - 0x214]
call dword [0x10010dc]
mov eax, esi
jmp 0x1001a59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01002aac
leave
ret 0xc
Function at 0x1001df1
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ax, word [esi]
xor ebx, ebx
cmp ax, bx
push edi
mov dword [ebp - 4], ebx
je 0x1001f10
mov edi, dword [0x100106c]
cmp ax, 0x2d
je 0x1001e2a
cmp ax, 0x2f
je 0x1001e2a
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x1001e14
cmp word [esi], bx
je 0x1001f10
inc esi
push 0x10013c0
inc esi
push esi
call edi
test eax, eax
je 0x1001e8c
push 0x10013a4
push esi
call edi
test eax, eax
je 0x1001ea7
push 0x1001394
push esi
call edi
test eax, eax
je 0x1001eea
movzx eax, word [esi]
sub eax, 0x62
je 0x1001e79
sub eax, 0x10
je 0x1001e73
dec eax
jne 0x1001e7d
or dword [ebp - 4], 4
jmp 0x1001e7d
or dword [ebp - 4], 1
jmp 0x1001e7d
or dword [ebp - 4], 2
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x1001e14
jmp 0x1001f10
push 0x1e
call dword [0x1001110]
test eax, eax
je 0x1001f10
push ebx
push 0x1001d9d
push 3
push 0x10012a0
jmp 0x1001f03
push 0x1e
call dword [0x1001110]
test eax, eax
je 0x1001f10
push 0x1001378
call dword [0x10010e0]
mov esi, eax
cmp esi, ebx
je 0x1001f10
push 0x1001364
push esi
call dword [0x10010e8]
cmp eax, ebx
je 0x1001ee1
push ebx
push ebx
push ebx
push ebx
call eax
mov dword [ebp - 4], 1
push esi
call dword [0x1001070]
jmp 0x1001f10
push 0x1e
call dword [0x1001110]
test eax, eax
je 0x1001f10
push ebx
push 0x1001d9d
push 8
push 0x1001308
push 0x80000002
call fcn.01001ab8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100202d
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [entry0]
test eax, eax
jne 0x1002062
push 0x10013d8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x1002069
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x100413c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x634], eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
lea eax, [ebp - 0x61c]
push eax
call dword [0x1001084]
push 0x10013f8
lea eax, [ebp - 0x61c]
push eax
call dword [0x1001080]
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call dword [entry0]
test eax, eax
jne 0x10021e8
push edi
lea ecx, [ebp - 0x628]
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x630]
push ecx
push eax
lea ecx, [ebp - 0x62c]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push eax
push dword [ebp - 0x620]
mov edi, 0x104
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x62c], edi
mov dword [ebp - 0x628], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10021db
push ebx
push esi
mov esi, dword [0x10010ec]
cmp dword [ebp - 0x630], 1
jne 0x1002184
push 0x314
push 0x40
call dword [0x1001068]
mov ebx, eax
push 0x80
lea eax, [ebp - 0x20c]
push eax
push ebx
call esi
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebx + 0x108]
push eax
call esi
push ebx
push 0
push 0x180
push dword [ebp - 0x634]
call dword [0x1001170]
cmp eax, 0xffffffff
je 0x100217d
cmp eax, 0xfffffffe
jne 0x1002184
push ebx
call dword [0x1001064]
inc dword [ebp - 0x624]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x630]
push eax
push 0
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x624]
mov dword [ebp - 0x62c], edi
push dword [ebp - 0x620]
mov dword [ebp - 0x628], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1002127
pop esi
pop ebx
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.01002aac
leave
ret 4
Function at 0x54b178
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5b4a28]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push dword [eax]
call sub.WS2_32.dll_ntohl
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.WS2_32.dll_ntohl
mov dword [ebp - 0x24], eax
and dword [ebp - 8], 0
jmp 0x54b1b0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x54b1cd
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call sub.WS2_32.dll_ntohl
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1c], eax
jmp 0x54b1a9
mov dword [ebp - 0x20], 0xe3779b90
and dword [ebp - 8], 0
jmp 0x54b1e1
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x54b23c
mov eax, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
xor eax, ecx
mov ecx, dword [ebp - 4]
shr ecx, 5
add ecx, dword [ebp - 0x10]
xor eax, ecx
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
shl eax, 4
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x20]
xor eax, ecx
mov ecx, dword [ebp - 0x24]
shr ecx, 5
add ecx, dword [ebp - 0x18]
xor eax, ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x20]
add eax, 0x61c88647
mov dword [ebp - 0x20], eax
jmp 0x54b1da
push dword [ebp - 4]
call sub.WS2_32.dll_htonl
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x24]
call sub.WS2_32.dll_htonl
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004b2f5a
leave
ret
Function at 0x70ab50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp + 8], eax
mov eax, dword [0x70a0ac]
push esi
push edi
test eax, eax
jne 0x70abcd
mov esi, 0x70a284
mov edx, dword [esi]
lea eax, [ebp - 0x24]
mov cl, byte [edx]
test cl, cl
je 0x70ab8b
lea edi, [ebp - 0x24]
sub edx, edi
xor cl, 0x55
mov byte [eax], cl
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
jne 0x70ab7d
lea ecx, [ebp - 0x24]
mov byte [eax], 0
push ecx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov edx, dword [esi - 4]
add esi, 8
cmp esi, 0x70a29c
mov dword [edx], eax
jl 0x70ab6d
mov ecx, dword [0x70a0ac]
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleA]
push 0
push 0x70a2ac
push ecx
mov dword [0x70a0a4], eax
call fcn.0070ad80
add esp, 0xc
mov dword [0x70a0a8], eax
mov dword [ebp - 4], 0
mov esi, 0x70a284
mov edx, dword [esi]
mov cl, byte [edx]
test cl, cl
je 0x70ac16
mov eax, dword [ebp + 8]
mov al, byte [eax]
test al, al
je 0x70ac16
cmp al, 0x5a
jg 0x70ac02
cmp al, 0x41
jl 0x70ac02
movsx edi, al
add edi, 0x20
movsx ebx, cl
xor edi, 0x55
cmp ebx, edi
je 0x70ac08
xor al, 0x55
cmp cl, al
jne 0x70ac16
mov ecx, dword [ebp + 8]
inc edx
inc ecx
mov dword [ebp + 8], ecx
mov cl, byte [edx]
test cl, cl
jne 0x70abe1
cmp byte [edx], 0
je 0x70ac36
mov edx, dword [ebp - 4]
add esi, 8
inc edx
cmp esi, 0x70a29c
mov dword [ebp - 4], edx
jl 0x70abd9
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov edx, dword [ecx*8 + 0x70a280]
mov eax, dword [edx]
mov esp, ebp
pop ebp
ret