joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002bf0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
sub esp, 0x148
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov edx, 0x40
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x10]
mov ecx, dword [eax + 0x2c]
lea eax, [eax + 4]
xor ecx, dword [eax + 0x14]
xor ecx, dword [eax - 0xc]
xor ecx, dword [eax - 4]
mov dword [eax + 0x34], ecx
sub edx, 1
jne 0x10002c41
push ebx
push ebp
push esi
push edi
mov ebp, 0x4267e26c
mov dword [esp + 0x14], 0x35ac7b09
mov edi, 0x2d60319d
mov dword [esp + 0x10], edx
mov esi, 0xddbb4b82
mov ebx, 0x766db5df
lea esp, [esp]
mov ecx, edi
mov eax, esi
and eax, edi
not ecx
and ecx, ebx
mov edx, ebp
or ecx, eax
rol edx, 5
mov eax, dword [esp + 0x10]
add edx, ecx
mov ecx, ebx
mov ebx, esi
mov esi, edi
mov edi, ebp
ror esi, 2
add edx, dword [esp + eax*4 + 0x18]
mov eax, dword [esp + 0x14]
add eax, 0x5a827999
mov dword [esp + 0x14], ecx
add edx, eax
mov eax, dword [esp + 0x10]
inc eax
mov ebp, edx
mov dword [esp + 0x10], eax
cmp eax, 0x14
jl 0x10002c80
mov dword [esp + 0x10], 0x14
lea ecx, [ecx]
mov eax, ebx
rol edx, 5
xor eax, esi
add ecx, 0x6ed9eba1
xor eax, edi
add edx, eax
mov eax, dword [esp + 0x10]
add edx, dword [esp + eax*4 + 0x18]
inc eax
add edx, ecx
mov dword [esp + 0x10], eax
mov ecx, ebx
mov ebx, esi
mov esi, edi
mov edi, ebp
ror esi, 2
mov ebp, edx
cmp eax, 0x28
jl 0x10002cd0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0x28
mov edi, edi
mov ecx, esi
rol edx, 5
or ecx, edi
mov eax, esi
and eax, edi
and ecx, ebx
or ecx, eax
mov eax, dword [esp + 0x10]
add ecx, dword [esp + eax*4 + 0x18]
mov eax, dword [esp + 0x14]
add eax, 0x8f1bbcdc
mov dword [esp + 0x14], ebx
add edx, eax
mov ebx, esi
mov eax, dword [esp + 0x10]
mov esi, edi
inc eax
ror esi, 2
add edx, ecx
mov dword [esp + 0x10], eax
mov edi, ebp
mov ebp, edx
cmp eax, 0x3c
jl 0x10002d10
mov dword [esp + 0x10], 0x3c
lea esp, [esp]
mov ecx, dword [esp + 0x10]
mov eax, ebx
xor eax, esi
rol edx, 5
add edx, dword [esp + 0x14]
xor eax, edi
add eax, 0xca62c1d6
mov dword [esp + 0x14], ebx
add eax, dword [esp + ecx*4 + 0x18]
mov ebx, esi
add edx, eax
mov esi, edi
mov eax, ecx
ror esi, 2
inc eax
mov edi, ebp
mov dword [esp + 0x10], eax
mov ebp, edx
cmp eax, 0x50
jl 0x10002d60
mov ecx, dword [esp + 0x15c]
lea eax, [edx + 0x4267e26c]
mov dword [ecx], eax
lea eax, [edi + 0x2d60319d]
mov dword [ecx + 4], eax
lea eax, [esi - 0x2244b47e]
mov dword [ecx + 8], eax
lea eax, [ebx + 0x766db5df]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
add eax, 0x35ac7b09
pop ebp
mov dword [ecx + 0x10], eax
xor eax, eax
pop ebx
add esp, 0x148
ret
Function at 0x10004eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov di, word [esp + 0x14]
movzx eax, di
test edx, edx
je 0x10004f8d
or eax, 0x20
cmp byte [ecx + 0xd], 0
movzx eax, ax
je 0x10004eed
mov ebx, eax
add eax, 0xffffff9f
mov esi, ebx
cmp ax, 0x19
ja 0x10004eef
mov byte [esp + 0x14], 1
mov eax, ebx
mov bl, byte [esp + 0x14]
jmp 0x10004ef4
mov esi, eax
xor bl, bl
movzx eax, si
movzx ebp, ax
test edx, edx
jle 0x10004f8d
mov eax, dword [ecx]
lea esi, [eax + edx*2]
xor edx, edx
mov dword [esp + 0x14], edx
test bl, bl
je 0x10004f60
lea ecx, [ebp - 0x61]
mov dx, 0x19
cmp dx, cx
sbb ecx, ecx
and ecx, 0x20
add ecx, 0xffdf
xor ebp, ebp
movzx ebx, cx
mov edx, eax
cmp eax, esi
jae 0x10004f44
mov edi, edi
mov cx, word [edx]
lea eax, [edx + 2]
xor cx, di
test bx, cx
je 0x10004f51
mov edx, eax
cmp edx, esi
jb 0x10004f30
mov edx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
ret 0x10
mov ecx, 0x5f
inc ebp
mov word [edx], cx
mov dword [esp + 0x14], ebp
jmp 0x10004f28
mov ebx, 0x5f
mov ecx, eax
cmp eax, esi
jae 0x10004f48
jmp 0x10004f70
lea eax, [ecx + 2]
cmp word [ecx], di
je 0x10004f87
mov ecx, eax
cmp ecx, esi
jb 0x10004f70
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
ret 0x10
mov word [ecx], bx
inc edx
jmp 0x10004f65
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x10005b30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
xor ecx, ecx
push esi
push edi
mov esi, edx
xor edi, edi
test esi, esi
je 0x10005bec
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x208
push eax
lea eax, [esp + 0x1c]
mov edi, str.LanguagesIDM_.LNG
push eax
push ecx
push ecx
push str.ExePath
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005c00
lea eax, [esp + 0x18]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x10005bc1
xor ecx, ecx
lea edi, [esp + 0x18]
mov word [eax + 2], cx
mov eax, edi
push 0x104
push eax
call fcn.100014c8
mov ecx, 0x103
sub ecx, eax
mov eax, edi
push ecx
push str.LanguagesIDM_.LNG
push eax
call dword [sym.imp.msvcrt.dll_wcsncat]
add esp, 0x14
xor eax, eax
mov word [esp + 0x21e], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0x10053630
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005c00
movzx ecx, word [esp + 0x14]
push ecx
mov edx, edi
call fcn.10005a90
add esp, 4
pop edi
pop esi
add esp, 0x218
ret
pop edi
xor al, al
pop esi
add esp, 0x218
ret

Function at 0x10005e90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, edx
mov dword [esp + 0x14], esi
push edi
test ecx, ecx
je 0x10005edd
test esi, esi
je 0x10005edd
mov bl, byte [esi]
mov byte [esp + 0x13], bl
test bl, bl
je 0x10005edd
mov ebp, dword [esp + 0x20]
mov al, bl
mov dl, 0x19
or al, 0x20
sub al, 0x61
cmp dl, al
sbb dl, dl
and dl, 0x20
add dl, 0xdf
cmp ecx, ebp
jae 0x10005edd
lea esp, [esp]
mov al, byte [ecx]
xor al, bl
test dl, al
je 0x10005ee7
inc ecx
cmp ecx, ebp
jb 0x10005ed0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov edi, esi
mov esi, ecx
jmp 0x10005ef0
cmp esi, ebp
jae 0x10005f50
mov bh, byte [edi]
mov bl, byte [esi]
lea eax, [ebx + 0x20]
movzx eax, al
lea edx, [ebx - 0x41]
mov dword [esp + 0x14], eax
cmp dl, 0x19
mov edx, dword [esp + 0x14]
movzx eax, bl
mov bl, bh
cmova edx, eax
mov al, bh
add al, 0x20
mov dword [esp + 0x14], edx
sub bl, 0x41
movzx edx, al
cmp bl, 0x19
movzx eax, bh
cmova edx, eax
cmp byte [esp + 0x14], dl
jne 0x10005f50
inc edi
inc esi
cmp byte [edi], 0
jne 0x10005ef0
sub esi, ecx
test esi, esi
jg 0x10005f70
inc ecx
test esi, esi
je 0x10005edd
mov bl, byte [esp + 0x13]
mov esi, dword [esp + 0x18]
jmp 0x10005eb3
cmp byte [edi], 0
je 0x10005f38
cmp esi, ebp
jae 0x10005edd
cmp byte [esi], 0
je 0x10005edd
mov bl, byte [esp + 0x13]
inc ecx
mov esi, dword [esp + 0x18]
jmp 0x10005eb3
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x10006060
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x1005c2a8]
sub esp, 0x11c
test eax, eax
jne 0x100060e4
lea eax, [esp]
mov dword [esp], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1000608b
add esp, 0x11c
ret
mov edx, dword [esp + 4]
shl edx, 8
or edx, dword [esp + 8]
push esi
mov si, word [esp + 0x118]
shl edx, 8
movzx eax, si
or edx, eax
movzx eax, word [esp + 0x11a]
shl edx, 8
or edx, eax
cmp dword [esp + 8], 6
mov dword [0x1005c2a8], edx
mov eax, edx
jne 0x100060e3
cmp dword [esp + 0xc], 0
jne 0x100060e3
test si, si
jne 0x100060e3
cmp byte [esp + 0x11e], 1
je 0x100060e3
or eax, 0x100
mov dword [0x1005c2a8], eax
pop esi
add esp, 0x11c
ret
Function at 0x100065b0
Capabilities:
Encrypt data using rc4 prga
Get disk information

Disassembly:
sub esp, 0x624
push ebx
mov ebx, ecx
push ebp
push esi
push edi
cmp dword [ebx + 4], 4
jb 0x100065e2
push 4
push str.___
push dword [ebx]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x100065e2
push 4
push eax
mov ecx, ebx
call fcn.10004c30
cmp dword [ebx + 4], 2
jb 0x1000673c
mov ecx, dword [ebx]
movzx eax, word [ecx]
test eax, 0xff00
jne 0x10006610
movzx eax, al
test byte [eax*2 + 0x10050110], 6
je 0x10006610
cmp word [ecx + 2], 0x3a
je 0x1000677a
lea eax, [esp + 0x224]
push eax
push 0x207
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1000673c
mov eax, dword [0x100531b8]
lea edi, [esp + 0x224]
mov dword [esp + 0x10], eax
movzx eax, word [0x100531bc]
mov word [esp + 0x14], ax
mov ax, word [esp + 0x224]
test ax, ax
je 0x1000673c
movzx ecx, ax
jmp 0x10006660
push 0x103
lea eax, [esp + 0x20]
mov word [esp + 0x14], cx
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10006723
lea esi, [esp + 0x1c]
lea ecx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10006690
mov edx, dword [ebx + 4]
sub esi, ecx
sar esi, 1
cmp esi, edx
jae 0x10006723
mov ecx, dword [ebx]
cmp word [ecx + esi*2], 0x5c
jne 0x10006723
cmp word [esp + 0x220], 8
mov ebp, 0x103
jne 0x100066ce
mov ebp, 0x101
mov dword [esp + 0x18], 2
jmp 0x100066d6
mov dword [esp + 0x18], 0
cmp ebp, edx
ja 0x10006723
push ebp
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10006723
cmp dword [esp + 0x18], eax
je 0x10006749
cmp ebp, dword [ebx + 4]
je 0x10006749
mov eax, dword [ebx]
movzx ecx, word [esp + ebp*2 + 0x1c]
mov dx, word [eax + ebp*2]
mov ax, 0x19
xor dx, cx
or ecx, 0x20
sub ecx, 0x61
cmp ax, cx
sbb eax, eax
and eax, 0x20
add eax, 0xffdf
test ax, dx
je 0x10006749
movzx eax, word [edi]
add edi, 2
test ax, ax
jne 0x10006723
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x10006660
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x624
ret
mov eax, dword [ebx + 4]
test eax, eax
je 0x1000675d
mov ecx, dword [ebx]
mov ax, word [esp + 0x10]
mov word [ecx], ax
mov eax, dword [ebx + 4]
cmp eax, 1
jbe 0x1000676d
mov ecx, dword [ebx]
mov ax, word [esp + 0x12]
mov word [ecx + 2], ax
add esi, 0xfffffffe
mov ecx, ebx
push esi
push 2
call fcn.10004c30
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x624
ret
Function at 0x10006790
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1210
call fcn.10001480
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x1000
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x1000685c
mov esi, dword [esp + 0x10]
lea ebp, [esp + 0x220]
xor eax, eax
shr esi, 2
mov word [esp + 0x21c], ax
test esi, esi
je 0x1000685c
mov edi, edi
mov ebx, dword [ebp]
lea ebp, [ebp + 4]
dec esi
test ebx, ebx
je 0x10006858
push ebx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10006858
push 0x104
lea eax, [esp + 0x18]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], 0
je 0x10006858
lea eax, [esp + 0x14]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
lea ecx, [esp + 0x1c]
add esp, 8
cmp eax, ecx
jbe 0x10006841
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x14]
push str.ApplicationFrameHost
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x10006869
test esi, esi
jne 0x100067e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1210
ret
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x1210
ret
Function at 0x10006cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, edx
push esi
mov esi, dword [esp + 0x1c]
push edi
push ebx
mov dword [esp + 0x18], ebx
add esi, ebp
mov dword [esp + 0x14], ecx
call dword [sym.imp.msvcrt.dll_strlen]
mov edi, eax
mov edx, ebx
push esi
mov ecx, ebp
mov dword [esp + 0x24], edi
call fcn.10005d80
add esp, 8
test eax, eax
je 0x10006d84
mov bh, byte [esp + 0x24]
mov edx, eax
add eax, edi
cmp edx, ebp
jbe 0x10006d5f
mov bl, byte [edx - 1]
dec edx
movzx ecx, bl
mov cx, word [ecx*2 + 0x10050110]
shr cx, 9
test cl, 1
je 0x10006d1c
cmp byte [eax], bl
jne 0x10006ddf
inc eax
jmp 0x10006d5f
mov edi, edx
cmp ebp, edx
ja 0x10006ddb
movzx ecx, byte [ebp]
mov cl, byte [ecx*2 + 0x10050110]
and cl, 1
test cl, cl
je 0x10006d42
dec edx
cmp ebp, edx
jbe 0x10006d34
jmp 0x10006ddb
sub edi, edx
js 0x10006ddb
mov cl, byte [edx]
cmp cl, 0x7b
je 0x10006d5f
cmp cl, 0x5b
je 0x10006d5f
cmp cl, 0x2c
jne 0x10006ddb
mov edi, eax
cmp eax, esi
jae 0x10006d84
jmp 0x10006d70
mov dl, byte [eax]
movzx ecx, dl
test byte [ecx*2 + 0x10050110], 1
je 0x10006d9d
inc eax
cmp eax, esi
jb 0x10006d70
mov eax, dword [esp + 0x10]
mov dword [eax], 0
mov dword [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, eax
sub ecx, edi
js 0x10006d84
inc eax
cmp dl, 0x3a
jne 0x10006ddb
mov edi, eax
cmp eax, esi
jae 0x10006d84
nop
mov dl, byte [eax]
movzx ecx, dl
test byte [ecx*2 + 0x10050110], 1
je 0x10006dc6
inc eax
cmp eax, esi
jb 0x10006db0
jmp 0x10006d84
mov ecx, eax
sub ecx, edi
js 0x10006d84
mov cl, bh
xor cl, 1
shl cl, 5
add cl, 0x5b
cmp dl, cl
je 0x10006df8
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ecx, eax
push esi
call fcn.10005d80
add esp, 4
test eax, eax
jne 0x10006cf1
jmp 0x10006d84
inc eax
mov edi, 1
mov edx, eax
cmp edx, esi
jae 0x10006e65
mov bl, byte [edx]
movzx ecx, bl
movzx ecx, word [ecx*2 + 0x10050110]
test ecx, 0x200
je 0x10006e33
inc edx
cmp edx, esi
jae 0x10006e47
mov edi, edi
mov cl, byte [edx]
cmp cl, bl
je 0x10006e47
inc edx
cmp cl, 0x5c
jne 0x10006e2d
inc edx
cmp edx, esi
jb 0x10006e20
jmp 0x10006e47
test ecx, 0x400
je 0x10006e3e
inc edi
jmp 0x10006e47
test ecx, 0x800
je 0x10006e47
dec edi
inc edx
test di, di
jne 0x10006e00
mov ecx, dword [esp + 0x10]
sub edx, eax
dec edx
sub eax, ebp
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x10]
xor edx, edx
pop edi
sub eax, ebp
pop esi
pop ebp
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
pop ebx
add esp, 8
ret
Function at 0x10006e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov ebx, edx
mov ebp, ecx
push edi
mov edi, dword [esp + 0x18]
mov esi, ebx
add edi, ebx
mov dword [esp + 0x10], ebx
cmp ebx, edi
jae 0x10006eb4
lea esp, [esp]
mov cl, byte [esi]
movzx edx, cl
test byte [edx*2 + 0x10050110], 1
je 0x10006eca
inc esi
cmp esi, edi
jb 0x10006ea0
mov dword [ebp], 0
mov eax, ebp
mov dword [ebp + 4], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, esi
sub eax, ebx
js 0x10006eb4
mov ax, word [edx*2 + 0x10050110]
shr ax, 0xb
test al, 1
je 0x10006f0c
inc esi
mov edx, esi
cmp esi, edi
jae 0x10006eb4
jmp 0x10006ef0
mov cl, byte [esi]
movzx eax, cl
test byte [eax*2 + 0x10050110], 1
je 0x10006f06
inc esi
cmp esi, edi
jb 0x10006ef0
jmp 0x10006eb4
mov eax, esi
sub eax, edx
js 0x10006eb4
cmp byte [esp + 0x20], 0
je 0x10006f44
inc esi
cmp cl, 0x3a
jne 0x10006eb4
mov edx, esi
cmp esi, edi
jae 0x10006eb4
nop
mov cl, byte [esi]
movzx eax, cl
test byte [eax*2 + 0x10050110], 1
je 0x10006f39
inc esi
cmp esi, edi
jb 0x10006f20
jmp 0x10006eb4
mov eax, esi
sub eax, edx
jns 0x10006f83
jmp 0x10006eb4
cmp cl, 0x2c
jne 0x10006f83
inc esi
mov edx, esi
cmp esi, edi
jae 0x10006eb4
jmp 0x10006f60
mov cl, byte [esi]
movzx eax, cl
test byte [eax*2 + 0x10050110], 1
je 0x10006f79
inc esi
cmp esi, edi
jb 0x10006f60
jmp 0x10006eb4
mov eax, esi
sub eax, edx
js 0x10006eb4
mov al, byte [esp + 0x1c]
xor al, 1
shl al, 5
add al, 0x5b
cmp cl, al
jne 0x10006eb4
inc esi
mov ebx, 1
mov eax, esi
mov edi, edi
cmp eax, edi
jae 0x10007002
mov dl, byte [eax]
movzx ecx, dl
movzx ecx, word [ecx*2 + 0x10050110]
test ecx, 0x200
je 0x10006fd3
inc eax
cmp eax, edi
jae 0x10006fe7
mov edi, edi
mov cl, byte [eax]
cmp cl, dl
je 0x10006fe7
inc eax
cmp cl, 0x5c
jne 0x10006fcd
inc eax
cmp eax, edi
jb 0x10006fc0
jmp 0x10006fe7
test ecx, 0x400
je 0x10006fde
inc ebx
jmp 0x10006fe7
test ecx, 0x800
je 0x10006fe7
dec ebx
inc eax
test bx, bx
jne 0x10006fa0
sub eax, esi
dec eax
sub esi, dword [esp + 0x10]
mov dword [ebp + 4], eax
mov eax, ebp
mov dword [ebp], esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
sub esi, dword [esp + 0x10]
pop edi
mov dword [ebp], esi
mov dword [ebp + 4], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100081e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp byte [esp + 8], 0
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov ebx, ecx
mov esi, edx
mov eax, edi
cmovne esi, ebx
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
test edi, edi
je 0x10008225
sub ebx, edx
mov al, byte [edx]
lea edx, [edx + 1]
xor al, cl
lea esi, [esi + 1]
mov byte [ebx + edx - 1], al
movzx eax, byte [esi - 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub edi, 1
jne 0x10008206
pop edi
pop esi
pop ebx
ret
Function at 0x10009aa0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
xor eax, eax
push esi
push edi
mov esi, edx
mov dword [esp + 0x1c], eax
xor edx, edx
mov word [esp + 0x24], ax
mov dword [esp + 0x20], edx
mov edi, 0x10059da0
mov dword [esp + 0x18], edi
mov ebx, ecx
test ebp, ebp
je 0x10009c09
lea ecx, [ebp + 2]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea ecx, [edx*4 + 1]
push ecx
lea ecx, [esp + 0x1c]
call fcn.10003580
mov edi, dword [esp + 0x18]
test eax, eax
je 0x10009c01
mov eax, 0xaaaaaaab
mov ecx, edi
mul ebp
shr edx, 1
mov dword [esp + 0x14], edx
je 0x10009b76
mov ebp, edx
lea ecx, [ecx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_H6]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
add edx, edx
movzx eax, byte [eax + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_H6]
mov byte [ecx + 1], al
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
movzx eax, byte [eax + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_H6]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_H6]
mov byte [ecx + 3], al
add ecx, 4
sub ebp, 1
jne 0x10009b10
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
lea eax, [edx + edx*2]
sub ebp, eax
je 0x10009bcf
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_H6]
mov byte [ecx], al
movzx edx, byte [esi]
and edx, 3
shl edx, 4
cmp ebp, 1
jne 0x10009ba6
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_H6]
mov dl, 0x3d
mov byte [ecx + 1], al
jmp 0x10009bc5
movzx eax, byte [esi + 1]
shr eax, 4
mov al, byte [eax + edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_H6]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
and eax, 0xf
mov dl, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_H6]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
add ecx, 4
mov eax, dword [esp + 0x1c]
sub ecx, edi
mov edx, dword [esp + 0x20]
test eax, eax
je 0x10009be5
cmp ecx, eax
sbb esi, esi
neg esi
jmp 0x10009bf5
test edx, edx
je 0x10009bee
lea esi, [edx - 1]
jmp 0x10009bf0
xor esi, esi
cmp esi, ecx
sbb esi, esi
inc esi
test esi, esi
je 0x10009c09
mov eax, ecx
mov byte [ecx + edi], 0
jmp 0x10009c09
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], eax
mov al, byte [esp + 0x20]
pop esi
mov byte [ebx + 0xc], al
mov eax, ebx
pop ebp
mov byte [ebx + 0xd], 0
mov dword [ebx + 8], edx
pop ebx
add esp, 0x18
ret
Function at 0x1000a090
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov bl, al
lea edi, [ecx + eax]
xor bl, 0x15
mov esi, edx
cmp ecx, edi
jae 0x1000a0b7
sub esi, ecx
mov dl, byte [ecx]
mov al, dl
xor al, bl
mov bl, dl
mov byte [esi + ecx], al
inc ecx
cmp ecx, edi
jb 0x1000a0a7
pop edi
pop esi
pop ebx
ret
Function at 0x10012ca0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x838
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x12e4], 0
je 0x10012dfd
lea eax, [esp + 0x18]
push eax
push dword [esi + 0x12e0]
call dword [sym.imp.msvcrt.dll__wstat64]
add esp, 8
test eax, eax
js 0x10012dfd
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
cmp dword [esi + 0x12f0], ecx
jne 0x10012cf8
cmp dword [esi + 0x12f4], eax
jne 0x10012cf8
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x838
ret
mov dword [esi + 0x12f4], eax
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x12e0]
mov dword [esi + 0x12f0], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
mov dword [esp + 0xc], edi
test edi, edi
je 0x10012dfd
mov dword [esp + 0x58], 0x7e0
lea eax, [esp + 0x5c]
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], 0x100531f0
cmp edi, 0x7e0
jbe 0x10012d62
push edi
call dword [sym.imp.msvcrt.dll_malloc]
xor ecx, ecx
mov dword [esp + 0x58], eax
add esp, 4
test eax, eax
cmovne ecx, edi
mov dword [esp + 0x58], ecx
je 0x10012dca
mov edi, dword [esp + 0xc]
push eax
push edi
push dword [esp + 0x18]
push dword [esi + 0x12e0]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x10012dc6
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
push 0x10053cfc
push dword [esp + 0x60]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10012dc6
mov ecx, dword [esp + 0x14]
mov bl, 1
movzx edx, byte [ecx + 0xa]
movzx eax, byte [ecx + 8]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xc]
shl edx, 8
or edx, eax
mov eax, dword [esp + 0x54]
mov dword [esi + 0x1164], edx
jmp 0x10012dcc
mov eax, dword [esp + 0x54]
xor bl, bl
xor ecx, ecx
mov dword [esp + 0x50], 0x10053070
lea edx, [esp + 0x5c]
cmp eax, edx
cmove eax, ecx
mov dword [esp + 0x54], eax
test eax, eax
je 0x10012df1
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
add esp, 0x838
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x838
ret
Function at 0x10013690
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx + 0x1160]
push edi
lea edi, [ecx + 0x1160]
mov dword [esp + 0x10], 0
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.msvcrt.dll__time64]
add esp, 4
mov dword [edi], eax
cmp eax, esi
jne 0x100136c6
inc eax
mov dword [edi], eax
cmp byte [esp + 0x18], 0
jne 0x100136d1
mov bl, 1
jmp 0x1001372c
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.SoftwareDownloadManager
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001372a
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 2
push 0
push 0
push 0
push str.ConfigTime
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1001372a
push 4
push edi
push 4
push eax
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1001372a
mov bl, 1
jmp 0x1001372c
xor bl, bl
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1001373d
push eax
call esi
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10013748
push ecx
call esi
pop edi
pop esi
mov al, bl
pop ebx
add esp, 8
ret 4