joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbd1290
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x694000]
push edi
or ebp, 0xffffffff
jmp 0xbd12b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xbd12b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbd12a8
mov eax, 1
add ebx, ebx
jne 0xbd12cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xbd12dc
jne 0xbd12fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbd12fb
dec eax
add ebx, ebx
jne 0xbd12e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xbd12c0
add ebx, ebx
jne 0xbd12f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xbd134d
xor ecx, ecx
sub eax, 3
jb 0xbd1313
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xbd1382
sar eax, 1
mov ebp, eax
jmp 0xbd131e
add ebx, ebx
jne 0xbd131e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbd12ec
inc ecx
add ebx, ebx
jne 0xbd132c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbd12ec
add ebx, ebx
jne 0xbd1339
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xbd132e
jne 0xbd134a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xbd132e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xbd136c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xbd135e
jmp 0xbd12ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xbd136c
add edi, ecx
jmp 0xbd12ae
pop esi
mov edi, esi
mov ecx, 0x5f96
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xbd138a
cmp byte [edi], 0x17
jne 0xbd138a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xbd138f
lea edi, [esi + 0x7c7000]
mov eax, dword [edi]
or eax, eax
je 0xbd1407
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7d53ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7d54b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xbd13bc
mov ecx, edi
jns 0xbd13eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7d54c0]
or eax, eax
je 0xbd1401
mov dword [ebx], eax
add ebx, 4
jmp 0xbd13d9
call dword [esi + 0x7d54bc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xbd1438
cmp al, 0xef
ja 0xbd142b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xbd140d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xbd141a
mov ebp, dword [esi + 0x7d54c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xbd146c
sub esp, 0xffffff80
jmp 0x4f9670
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x406243
pop dword [ebp - 0x24]
mov eax, 0x8e72faf3
sub eax, 0x8e3298b0
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xfc095769
sub dword [ebp - 0x34], 0xadb7121e
mov dword [ebp - 0x30], 0x3b7c880
sub dword [ebp - 0x30], 0xd1847c3b
mov dword [ebp - 0x2c], 0xcd58768a
sub dword [ebp - 0x2c], 0x810c325c
mov dword [ebp - 0x28], 0xcba4f191
sub dword [ebp - 0x28], 0xcba4f191
lea eax, [ebp - 0x34]
push eax
mov eax, 0xea5a4363
add eax, 0x15e63da1
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x88ca22d
add dword [ebp - 0x34], 0x6be5c729
mov dword [ebp - 0x30], 0xd41be7be
add dword [ebp - 0x30], 0x6d5079b7
mov dword [ebp - 0x2c], 0x32d5e
sub dword [ebp - 0x2c], 0x9c93c0f2
mov dword [ebp - 0x28], 0x962e9aab
sub dword [ebp - 0x28], 0x962e9aab
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xd5065457
add eax, 0x2b3a2ca9
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3381b
push 0
call eax
mov ecx, 0x5ce36076
sub ecx, 0x5ce32687
mov edx, eax
mov ebx, 0xf2f81ecb
add ebx, 0xd4ec535
add ebx, dword [ebp - 0x24]
mov esi, 0x63e83c55
add esi, 0xdc0be1b3
xor dword [ebp - 0x10], edi
mov edi, dword [ebx]
add dword [ebp - 0xc], 0xe44653bd
xor edi, esi
xor dword [ebp - 0xc], ebx
mov dword [edx], edi
xor dword [ebp - 0x1c], eax
add edx, 4
add ebx, 4
loop 0x406365
add eax, 0x60bb2e3b
sub eax, 0x60ba53ac
xor ebx, ebx
add ebx, eax
add eax, 0x68bcb1ae
sub eax, 0x68bcb1a9
mov ecx, 0x5ecf3caf
add ecx, 0xa170c351
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x6d1c8ef8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x6d1c8f07
pop dword [ebp - 0x1c]
mov eax, 0x85af869e
add eax, 0xe76d0869
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x4b43d8cc
sub dword [ebp - 0x2c], 0xfcf19381
mov dword [ebp - 0x28], 0x7673b6a0
add dword [ebp - 0x28], 0xbbbf95a5
mov dword [ebp - 0x24], 0x8f64a14d
sub dword [ebp - 0x24], 0x43185d1f
mov dword [ebp - 0x20], 0xe09a7508
sub dword [ebp - 0x20], 0xe09a7508
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x1f209ada
add dword [ebp - 0x2c], 0x5551ce7c
mov dword [ebp - 0x28], 0x63020d20
sub dword [ebp - 0x28], 0x2195abab
mov dword [ebp - 0x24], 0x4e271f78
add dword [ebp - 0x24], 0x15484cf4
mov dword [ebp - 0x20], 0x1a4d7dfb
sub dword [ebp - 0x20], 0x1a4d7dfb
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xec6ea1d
add eax, 0x5e55c5fb
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ab14
push 0
call eax
mov ecx, 0xd8717d16
add ecx, 0x278edab3
mov edi, eax
mov esi, 0x6d1e2800
add esi, dword [ebp - 0x1c]
mov ebx, 0x6bea6456
sub ebx, 0x86e03a08
add dword [ebp - 4], 0x4f066323
mov edx, dword [esi]
add dword [ebp - 4], 0xdf214488
sub edx, ebx
sub dword [ebp - 4], 0xc5dd61cd
mov dword [edi], edx
xor dword [ebp - 4], 0x16147de8
add edi, 0x34cdb8c7
sub edi, 0x34cdb8c3
add esi, 0x9b81665b
add esi, 0x647e99a9
loop 0x6d1c901e
add eax, 0xdc5c9752
sub eax, 0xdc5b455b
mov ebx, eax
add eax, 0xee05ed2f
add eax, 0x11fa12d6
mov ecx, 0xf494cf3d
sub ecx, 0x8779cf3d
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x6d1c932c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d1d54cc]
jne 0x6d1c9336
repz ret
jmp fcn.6d1c99bc
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000f197
pop dword [ebp - 0x20]
mov eax, 0x1000f197
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x339b9
push 0
mov eax, 0x4a08d708
sub eax, 0x3a0796a4
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xc945387b
sub ecx, 0xc945065f
mov edi, eax
mov esi, 0xc9848b1c
add esi, 0x467cfae4
add esi, dword [ebp - 0x20]
mov ebx, 0x98607cfd
add dword [ebp - 8], esi
mov edx, dword [esi]
mov dword [ebp - 0x18], 0x78ab0b4c
add edx, ebx
mov dword [ebp - 0x18], 0x6baae461
mov dword [edi], edx
xor dword [ebp - 0x10], 0xaf1e76c2
add edi, 4
add esi, 4
loop 0x1000f1eb
add eax, 0xf9da2da9
add eax, 0x6268d9a
mov ebx, eax
add eax, 5
mov ecx, 0x61ee85c
sub ecx, 0xf61ee85c
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x2580f0bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2580f0cc
pop dword [ebp - 0x2c]
mov eax, 0x2580f0cc
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x4c5e9bac
add dword [ebp - 0x3c], 0x1f3a99f
mov dword [ebp - 0x38], 0x2abbd3ad
sub dword [ebp - 0x38], 0xf8888768
mov dword [ebp - 0x34], 0x3919c98e
sub dword [ebp - 0x34], 0xeccd8560
mov dword [ebp - 0x30], 0x6b49a9f5
sub dword [ebp - 0x30], 0x6b49a9f5
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x9700da8e
sub eax, 0x717f0a4a
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xdf65cff
add dword [ebp - 0x3c], 0x667c0c57
mov dword [ebp - 0x38], 0x43d7b4f5
add dword [ebp - 0x38], 0xfd94ac80
mov dword [ebp - 0x34], 0x19de88ee
sub dword [ebp - 0x34], 0xb66f1c82
mov dword [ebp - 0x30], 0x634bdce5
sub dword [ebp - 0x30], 0x634bdce5
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x59ca8f41
sub eax, 0x3448bec1
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x41af1
push 0
call eax
mov ecx, 0x5c53
xor edx, edx
add edx, eax
mov edi, 0x25829600
add edi, dword [ebp - 0x2c]
mov esi, 0xda54f505
xor dword [ebp - 8], 0x3eccb1f1
mov ebx, dword [edi]
add dword [ebp - 0x10], ecx
add ebx, esi
mov dword [ebp - 0xc], 0xd016b96f
mov dword [edx], ebx
add edx, 0xe6111c66
sub edx, 0xe6111c62
add edi, 0x536c0b88
add edi, 0xac93f47c
loop 0x2580f1d9
add eax, 0xd3c6aa2
add eax, 0xf2c4f97d
mov ebx, eax
add eax, 5
mov ecx, 0xc886592a
add ecx, 0x5cf9a6d6
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0xe0e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00e0e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xe0e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe0e06a
add dl, dl
jne 0xe0e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe0e0dc
xor eax, eax
add dl, dl
jne 0xe0e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe0e17d
add dl, dl
jne 0xe0e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xe0e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xe0e075
mov eax, 1
add dl, dl
jne 0xe0e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe0e0e1
sub eax, ebx
mov ebx, 1
jne 0xe0e128
mov ecx, 1
add dl, dl
jne 0xe0e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe0e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe0e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe0e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe0e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe0e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe0e136
cmp eax, 0x7d00
jae 0xe0e16d
cmp eax, 0x500
jb 0xe0e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe0e075
cmp eax, 0x7f
ja 0xe0e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe0e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xe0e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xe0e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x100259e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x100259f0
pop dword [ebp - 0x24]
mov eax, 0x100259f0
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x2499e0de
add dword [ebp - 0x34], 0x29b8646d
mov dword [ebp - 0x30], 0x9cc9ef14
sub dword [ebp - 0x30], 0x6a96a2cf
mov dword [ebp - 0x2c], 0x6abedb4b
sub dword [ebp - 0x2c], 0x1e72971d
mov dword [ebp - 0x28], 0xe3389db8
sub dword [ebp - 0x28], 0xe3389db8
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x983de447
add dword [ebp - 0x34], 0xdc34850f
mov dword [ebp - 0x30], 0xdbb329c4
sub dword [ebp - 0x30], 0x9a46c84f
mov dword [ebp - 0x2c], 0x2cb12cb8
sub dword [ebp - 0x2c], 0xc941c04c
mov dword [ebp - 0x28], 0xc108db6
add dword [ebp - 0x28], 0xf3ef724a
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x27634b19
sub eax, 0x175ff9b5
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3e699
push 0
call eax
mov ecx, 0x552b
xor esi, esi
add esi, eax
mov edx, 0x10088400
add edx, dword [ebp - 0x24]
mov edi, 0xe12606de
add edi, 0xafdd42af
xor dword [ebp - 0x1c], 0xdd4fe777
mov ebx, dword [edx]
mov dword [ebp - 0x14], 0x33eb6772
sub ebx, edi
xor dword [ebp - 0x10], 0x935cd2f6
mov dword [esi], ebx
xor dword [ebp - 0x1c], ebx
add esi, 4
add edx, 0x8aae8a93
add edx, 0x75517571
loop 0x10025afe
add eax, 0xee042f0c
sub eax, 0xee02e78d
xor ebx, ebx
add ebx, eax
add eax, 0x6ea6665
sub eax, 0x6ea6660
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10001cac
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x854
mov eax, dword [0x10017114]
xor eax, esp
mov dword [esp + 0x850], eax
mov eax, dword [esp + 0x85c]
push esi
push edi
mov edi, dword [esp + 0x860]
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.gdi32.dll_SaveDC]
push 2
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.gdi32.dll_SetGraphicsMode]
push 1
xor esi, esi
push esi
push edi
call dword [sym.imp.gdi32.dll_ModifyWorldTransform]
push esi
push esi
push esi
push edi
call dword [sym.imp.gdi32.dll_SetViewportOrgEx]
push esi
push esi
push esi
push edi
call dword [sym.imp.gdi32.dll_SetWindowOrgEx]
mov esi, dword [sym.imp.gdi32.dll_GetDeviceCaps]
push 0x58
push edi
call esi
push 0x5a
push edi
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x20], xmm0
call esi
movss xmm0, dword [esp + 0x18]
mulss xmm0, dword [0x100104e0]
push 1
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm0, dword [0x100104f8]
cvttss2si eax, xmm0
mov dword [esp + 0xc], eax
imul eax, dword [esp + 0x86c], 0xa
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x100104f8]
cvttss2si eax, xmm0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.gdi32.dll_DPtoLP]
movd xmm0, dword [esp + 0xc]
xor ecx, ecx
cvtdq2pd xmm0, xmm0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov byte [esp + 0x30], cl
mov dword [esp + 0x32], ecx
mov word [esp + 0x36], cx
andps xmm0, xmmword [0x10010500]
divsd xmm0, qword [0x100104f0]
addsd xmm0, qword [0x100104e8]
cvttsd2si eax, xmm0
neg eax
cmp dword [esp + 0x870], ecx
mov dword [esp + 0x1c], eax
mov ecx, 0x800
mov eax, dword [esp + 0x86c]
setne byte [esp + 0x31]
push ecx
mov dword [esp + 0x30], eax
lea eax, [esp + 0x5c]
push eax
push 0x1002
push ecx
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [esp + 0x5c]
push str.Japan
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
lea eax, [esp + 0x38]
je 0x10001e12
push dword [esp + 0x14]
jmp 0x10001e17
push str.MS_UI_Gothic
push 0x20
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.gdi32.dll_CreateFontIndirectA]
push dword [esp + 0x10]
mov esi, eax
push edi
call dword [sym.imp.gdi32.dll_RestoreDC]
mov ecx, dword [esp + 0x858]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1000bdde
add esp, 0x854
ret 0x14
Function at 0x10007fd8
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x120
mov eax, dword [0x10017114]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x128]
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x1c], ecx
mov eax, dword [ebx + 4]
or eax, 0x2001f
mov dword [esp + 0xc], ebp
push eax
push ecx
push dword [ebx]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.1000c365
mov esi, eax
test esi, esi
jne 0x100080b7
lea eax, [esp + 0x20]
mov dword [esp + 0x18], pe_nt_image_headers32
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
push dword [esp + 0x28]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call ebp
test eax, eax
jne 0x1000808f
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.10007fd8
mov esi, eax
test esi, esi
jne 0x100080b7
lea eax, [esp + 0x20]
mov dword [esp + 0x18], pe_nt_image_headers32
push eax
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call ebp
test eax, eax
je 0x10008054
jmp 0x10008091
xor esi, esi
cmp dword [esp + 0xc], 0
je 0x100080a6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
push dword [esp + 0x1c]
mov ecx, ebx
mov dword [esp + 0x14], esi
call fcn.100055e8
mov esi, eax
cmp dword [esp + 0xc], 0
je 0x100080c8
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x128]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000bdde
add esp, 0x120
ret 4
Function at 0x10009543
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x100095a5
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x100095b5
push 0xd
pop eax
jmp 0x100095eb
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100095c1
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x100095bc
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x34896bdb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x34896bea
pop dword [ebp - 0x38]
mov eax, 0x34896bea
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x714c95a6
sub dword [ebp - 0x48], 0x22fa505b
mov dword [ebp - 0x44], 0xbc4b3e58
sub dword [ebp - 0x44], 0x8a17f213
mov dword [ebp - 0x40], 0x4dd2a9b1
sub dword [ebp - 0x40], 0x1866583
mov dword [ebp - 0x3c], 0x816c15b
add dword [ebp - 0x3c], 0xf7e93ea5
lea eax, [ebp - 0x48]
push eax
mov eax, 0x52e1c8a9
sub eax, 0x1e58b751
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xf2816d0d
sub dword [ebp - 0x48], 0x7e0f03b7
mov dword [ebp - 0x44], 0xad0ea1d0
sub dword [ebp - 0x44], 0x6ba2405b
mov dword [ebp - 0x40], 0xfb1f223d
add dword [ebp - 0x40], 0x68504a2f
mov dword [ebp - 0x3c], 0x96ea1ce5
add dword [ebp - 0x3c], 0x6915e31b
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x325f9dde
add eax, 0x22973e2
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3ed5e
push 0
call eax
mov ecx, 0x5d12e4e2
add ecx, 0xa2ed5fe0
mov edx, eax
mov ebx, 0x348cb000
add ebx, dword [ebp - 0x38]
mov esi, 0x8afa85e
mov dword [ebp - 8], 0xa8e26b12
mov edi, dword [ebx]
xor dword [ebp - 0x24], 0x8102aa79
sub edi, esi
sub dword [ebp - 0x10], 0x27e2211d
mov dword [edx], edi
mov dword [ebp - 0x34], 0xdcb08918
add edx, 0x473d3c1
add edx, 0xfb8c2c43
add ebx, 0x53b81a3a
add ebx, 0xac47e5ca
loop 0x34896cfb
add eax, 0x69cea4d5
add eax, 0x96326106
mov ebx, eax
add eax, 0x9b540d2c
sub eax, 0x9b540d27
mov ecx, 0x666306af
sub ecx, 0x31da06af
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x100130fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10013109
pop dword [ebp - 0x14]
mov eax, 0x10013109
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x73c5adc3
add dword [ebp - 0x24], 0xda8c9788
mov dword [ebp - 0x20], 0x874869a3
add dword [ebp - 0x20], 0xaaeae2a2
mov dword [ebp - 0x1c], 0x3e347cef
sub dword [ebp - 0x1c], 0xf1e838c1
mov dword [ebp - 0x18], 0xaa424dee
sub dword [ebp - 0x18], 0xaa424dee
lea eax, [ebp - 0x24]
push eax
mov eax, 0xa92c8f92
sub eax, 0x99299e06
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x7242458e
add dword [ebp - 0x24], 0x23023c8
mov dword [ebp - 0x20], 0x6a739fc5
add dword [ebp - 0x20], 0xd6f8c1b0
mov dword [ebp - 0x1c], 0x4dc6a413
sub dword [ebp - 0x1c], 0xea5737a7
mov dword [ebp - 0x18], 0xd5b44a9d
sub dword [ebp - 0x18], 0xd5b44a9d
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x445e0788
add eax, 0xcba4e964
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x473e3
push 0
call eax
mov ecx, 0x9cdba857
add ecx, 0x6324aa3e
mov ebx, eax
mov edi, 0x10046400
add edi, dword [ebp - 0x14]
mov edx, 0x4981705c
sub edx, 0xd2a0496d
sub dword [ebp - 0xc], 0x30e7f151
mov esi, dword [edi]
sub esi, edx
add dword [ebp - 8], 0x7b5a624e
mov dword [ebx], esi
xor dword [ebp - 4], esi
add ebx, 4
add edi, 0x3fbae09f
add edi, 0xc0451f65
loop 0x10013220
add eax, 0x13d27
xor ebx, ebx
add ebx, eax
add eax, 0xff103a2a
add eax, 0xefc5db
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40288e
pop dword [ebp - 4]
mov eax, 0x6156e8ca
add eax, 0x9ee93fc4
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x98069257
sub dword [ebp - 0x14], 0x49b44d0c
mov dword [ebp - 0x10], 0xfa4f46fa
sub dword [ebp - 0x10], 0xc81bfab5
mov dword [ebp - 0xc], 0x393f2526
add dword [ebp - 0xc], 0x130d1f08
mov dword [ebp - 8], 0x7cd00f63
sub dword [ebp - 8], 0x7cd00f63
lea eax, [ebp - 0x14]
push eax
mov eax, 0xb9c1c327
add eax, 0x467ebd65
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x5b1e184b
add dword [ebp - 0x14], 0x1954510b
mov dword [ebp - 0x10], 0xfce0793f
sub dword [ebp - 0x10], 0xbb7417ca
mov dword [ebp - 0xc], 0xbb37eb18
add dword [ebp - 0xc], 0xa8378154
mov dword [ebp - 8], 0xd89528b2
add dword [ebp - 8], 0x276ad74e
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x8ea86e95
add eax, 0x7198123f
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x37036
push 0
call eax
mov ecx, 0x25993281
add ecx, 0xda67172a
mov edx, eax
mov edi, 0xe56b098e
add edi, 0x1ad60672
add edi, dword [ebp - 4]
mov esi, 0x749f6682
sub esi, 0x851690a8
mov ebx, dword [edi]
xor ebx, esi
mov dword [edx], ebx
add edx, 0x15b4d6f9
add edx, 0xea4b290b
add edi, 4
loop 0x4029b0
add eax, 0x81387fbf
sub eax, 0x81376640
mov ebx, eax
add eax, 0x420d9f41
sub eax, 0x420d9f3c
mov ecx, 0xaa1221b7
add ecx, 0x562dde49
add ecx, dword [ebp - 4]
call ebx
leave
ret