joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a430
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x483230]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x62c], ecx
mov eax, dword [ebp - 0x62c]
cmp dword [eax + 0xb8], 0xffffffff
je 0x40a45e
xor al, al
jmp 0x40a5a9
mov cx, word [0x469d88]
mov word [ebp - 0x210], cx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
add esp, 8
mov ax, word [0x469d8c]
mov word [ebp - 0x418], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x210]
push ecx
push str._sDownLoad
push 0x104
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jbe 0x40a50d
mov ecx, dword [ebp - 0x420]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2]
cmp eax, 0x2f
je 0x40a50d
mov ecx, dword [ebp - 0x420]
sub ecx, 1
mov dword [ebp - 0x420], ecx
jmp 0x40a4e1
mov dx, word [0x469da8]
mov word [ebp - 0x628], dx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x626]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x418]
push ecx
push str._s_s.WHD
push 0x104
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x14
push 0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x1001
lea ecx, [ebp - 0x628]
push ecx
mov ecx, dword [ebp - 0x62c]
add ecx, 0xb4
mov edx, dword [ebp - 0x62c]
mov eax, dword [edx + 0xb4]
call dword [eax + 0x28]
test eax, eax
jne 0x40a5a7
xor al, al
jmp 0x40a5a9
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.00460cbd
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x43c150
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x5c], 0
je 0x43c1ab
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x70], 0
je 0x43c1ab
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x70]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43c1ab
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x64]
mov dword [ebp - 4], edx
lea eax, [ebp - 8]
push eax
push 0x43c110
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 8], 0
je 0x43c1ab
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x43c1c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x20], 0
je 0x43c1dc
push 0x64
mov ecx, dword [ebp - 0x10]
call fcn.0040c2c0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x5c], 0
je 0x43c2eb
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x70], 0
je 0x43c242
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x70]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43c242
push 0
push 0
push 0x64
push 2
mov ecx, dword [ebp - 0x10]
call fcn.0043c750
push 0x3e8
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x102
jne 0x43c240
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x43c26c
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x102
jne 0x43c26c
push 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x60], 0
je 0x43c29a
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x5c], 0
je 0x43c2b0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x70], 0
push 0x10
push 0
mov edx, dword [ebp - 0x10]
add edx, 0x5c
push edx
call sub.MSVCR71.dll_memset
add esp, 0xc
movzx eax, byte [ebp + 8]
cmp eax, 1
jne 0x43c2eb
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0xc]
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x440610
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x948
mov eax, dword [0x483230]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x944], ecx
mov ax, word [0x4734a4]
mov word [ebp - 0x418], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
add esp, 8
mov dx, word [0x4734a8]
mov word [ebp - 0x210], dx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x418]
push eax
push 0x4734ac
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
mov dx, word [0x4734e4]
mov word [ebp - 0x818], dx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
push 0x200
lea ecx, [ebp - 0x818]
push ecx
push 0x4734e8
push 0x4734ec
push str.Assistant
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx edx, word [ebp - 0x818]
test edx, edx
je 0x44084e
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x820], 0x2f
push 0xffff0002
push 0
push 0
push 0x10
push 0x10
push 0xb
push 0xb
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0x820]
push ecx
mov ecx, dword [ebp - 0x944]
call sub.MFC71U.DLL_CTabCtrl::InsertItem
mov edx, dword [ebp - 0x944]
mov dword [edx + 0x64], eax
mov ax, word [0x47351c]
mov word [ebp - 0x840], ax
xor ecx, ecx
mov dword [ebp - 0x83e], ecx
mov dword [ebp - 0x83a], ecx
mov dword [ebp - 0x836], ecx
mov dword [ebp - 0x832], ecx
mov dword [ebp - 0x82e], ecx
mov dword [ebp - 0x82a], ecx
mov dword [ebp - 0x826], ecx
mov word [ebp - 0x822], cx
mov edx, dword [ebp - 0x81c]
push edx
push 0x473520
push 0x10
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
mov cx, word [0x47353c]
mov word [ebp - 0x940], cx
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x93e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [ebp - 0x210]
push edx
push 0x80
lea eax, [ebp - 0x940]
push eax
push 0x473540
push str.AssistantName
lea ecx, [ebp - 0x840]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx edx, word [ebp - 0x940]
test edx, edx
jne 0x4407ec
jmp 0x440839
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x948], eax
mov ecx, dword [ebp - 0x944]
mov edx, dword [ecx + 0x64]
push edx
mov eax, dword [ebp - 0x948]
push eax
push 0xa
lea ecx, [ebp - 0x940]
push ecx
mov ecx, dword [ebp - 0x944]
call fcn.00442790
mov edx, dword [ebp - 0x81c]
add edx, 1
mov dword [ebp - 0x81c], edx
mov eax, 1
test eax, eax
jne 0x440738
mov ecx, dword [ebp - 0x944]
mov edx, dword [ecx + 0x64]
push edx
mov ecx, dword [ebp - 0x944]
call fcn.00441080
mov ecx, dword [ebp - 4]
call fcn.00460cbd
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x455910
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x483230]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x90], ecx
mov ax, word [0x475f18]
mov word [ebp - 0x88], ax
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x86]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x10
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0x475f1c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [ebp - 0x88]
test eax, eax
je 0x4559f0
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x8c], ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.00455860
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.00455860
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.00455860
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.00455860
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov al, 1
jmp 0x4559f2
xor al, al
mov ecx, dword [ebp - 4]
call fcn.00460cbd
pop edi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x455a10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x483230]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x90], ecx
mov ax, word [0x475f20]
mov word [ebp - 0x88], ax
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x86]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0x475f24
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [ebp - 0x88]
test eax, eax
je 0x455ac0
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x8c], ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.00455860
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.00455860
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov al, 1
jmp 0x455ac2
xor al, al
mov ecx, dword [ebp - 4]
call fcn.00460cbd
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x455ae0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x483230]
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x90], ecx
mov ax, word [0x475f28]
mov word [ebp - 0x88], ax
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x86]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0x475f2c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [ebp - 0x88]
test eax, eax
je 0x455bb0
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x8c], ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.00455860
movzx esi, al
lea eax, [ebp - 0x8c]
push eax
mov ecx, dword [ebp - 0x90]
call fcn.00455860
movzx ecx, al
shl ecx, 8
or esi, ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.00455860
movzx eax, al
shl eax, 0x10
or esi, eax
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov al, 1
jmp 0x455bb2
xor al, al
mov ecx, dword [ebp - 4]
call fcn.00460cbd
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x460a66
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x4770e8
call fcn.00460f54
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x460aa6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x460aa6
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x460abe
cmp eax, 0x20b
je 0x460aab
mov dword [ebp - 0x1c], edi
jmp 0x460ad2
cmp dword [ecx + 0x84], 0xe
jbe 0x460aa6
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x460acc
cmp dword [ecx + 0x74], 0xe
jbe 0x460aa6
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x48539c], 0xffffffff
or dword [0x4853a0], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x485324]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x485320]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x485398], eax
call fcn.00460fac
call fcn.0046104c
cmp dword [0x483258], edi
jne 0x460b32
push fcn.0046104c
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0046103a
push 0x483094
push 0x483090
call sub.MSVCR71.dll__initterm
push 0x460ff0
call fcn.00460d04
mov eax, dword [0x48531c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x485318]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x460b86
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x48308c
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x460bb0
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x460c6a
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x460c1f
cmp ax, di
je 0x460bc6
cmp dword [ebp - 0x20], edi
jne 0x460c1f
mov ax, word [esi]
cmp ax, di
je 0x460bdb
cmp ax, 0x20
ja 0x460bdb
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x460bc6
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x460bf7
movzx eax, word [ebp - 0x54]
jmp 0x460bfa
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.004612a2
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x460c17
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x460c64
cmp ax, 0x22
jne 0x460c30
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x460bb0
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00460f8f
ret
Function at 0x10001044
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x10014efc
sub byte [esi - 0x1a3], 0xd8
pop esi
jmp 0x1000107d
jmp 0x100010a4
xor eax, eax
jmp 0x10001414
call fcn.100010ab
test eax, eax
jne 0x10001422
ret
push ebp
push eax
mov eax, 0x10015143
add dword [eax - 0x3c], 0x25b5642c
xor byte [eax - 0x365], 0xf5
pop eax
push ebx
mov ebx, eax
jmp loc.10021000

Function at 0x1000121c
Capabilities:
Access peb ldr_data

Disassembly:
push esi
jmp 0x1000123c
xor eax, eax
mov eax, dword fs:[eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
pop esi
ret

Function at 0x1000125f
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push edx
push ecx
mov ecx, 0x10014e79
xor dword [ecx - 0x121], 0x1638db40
pop ecx
push esi
push edi
mov ebx, dword [ebp + 8]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
push dword [ebx + 0x7c]
push 0x9c830a79
pop dword [0x10014f30]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
add dword [esp], ebx
push edi
mov edi, 0x10015138
xor dword [edi - 0x326], 0x411f6b3b
mov byte [edi - 0x258], 0x58
pop edi
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
jmp 0x100012f4
jmp 0x1000132b
jmp 0x10001351
add edx, ecx
mov dword [ebp - 4], edx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x10001358
mov dword [0x10014d6c], edi
cmp eax, dword [ebp + 0xc]
je 0x10001380
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x100012b7
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
push edi
mov edi, 0x10014d8f
and byte [edi + 0xfc], 0xef
mov word [edi + 0x185], 0x3fc
pop edi
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
pop ecx
cmp eax, ebx
jbe 0x100013fb
cmp eax, ecx
jae 0x100013fb
push edi
mov edi, 0x10014e35
sbb word [edi + 0xbf], 0x63e8
and word [edi + 0x31f], 0x6a01
pop edi
push dword [ebp - 4]
push dword [ebp + 8]
sub esp, 4
mov dword [esp], 0xeb8ed3f6
add dword [esp], 0x343216f8
push dword [ebp + 8]
call fcn.1000125f
call eax
sub dword [0x10014ed7], edi
pop edi
pop esi
push ecx
mov ecx, 0x10015162
sub dword [ecx - 0x2bf], 0x15bc800
pop ecx
pop edx
pop ebx
leave
ret 8
Function at 0x10008ec6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1000c3fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000c40a
pop dword [ebp - 0x4c]
mov eax, 0x1c924a50
add eax, 0xf36e79ba
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x38214
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xef95484e
add ecx, 0x106b0279
mov esi, eax
mov edx, 0x10021400
add edx, dword [ebp - 0x4c]
mov edi, 0x6adbe435
add dword [ebp - 4], 0xa5ee387f
mov ebx, dword [edx]
add ebx, edi
sub dword [ebp - 8], 0x3bb7af7e
mov dword [esi], ebx
xor dword [ebp - 0x34], ecx
add esi, 0x9048aa6f
sub esi, 0x9048aa6b
add edx, 0xed0ab1a3
add edx, 0x12f54e61
loop 0x1000c458
add eax, 0x11def
mov ebx, eax
add eax, 0xc6dfe75a
sub eax, 0xc6dfe755
mov ecx, 0xfcb32b73
add ecx, 0x134cd48d
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1e7a3c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
faddp st(6)
inc ebp
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1e7a38f1
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a38a6
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22

Function at 0x1e7a3ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a38f1
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a38a6
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a38f1
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a38a6
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a38e1
scasb al, byte es:[edi]
jg 0x1e7a3d5e
jmp [esi - 0x77760381]
mov dword [eax - 0x8363], ecx
dec dword [eax - 0x8263]
inc esi

Function at 0x1e7a3db0
Capabilities:
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.1e7a38e1
xchg esp, eax
push eax
pop ss
lea eax, [ebp - 0x84]
push eax
Function at 0x1e7a3dd0
Capabilities:
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
call fcn.1e7a38f1
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a38a6
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x1e7a40da
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.1e7a3852
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x1e7a3e51
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.1e7a3852
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x1e7a3e1e
call fcn.1e7a38e1
xchg edx, eax
xor al, 0x4f
push cs
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x1e7a40d0
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x1e7a3e86
cmp dword [eax + 0xc], ebx
je 0x1e7a3f29
mov edi, dword [eax + 0xc]
add edi, esi
push edi
invalid
xchg ebp, eax
inc eax
invalid

Function at 0x1e7a3e40
Capabilities:
Inspect section memory permissions

Disassembly:
call fcn.1e7a38f1
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a38a6
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x1e7a40da
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.1e7a3852
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x1e7a3e51
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.1e7a3852
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x1e7a3e1e
call fcn.1e7a38e1
xchg edx, eax
xor al, 0x4f
push cs
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x1e7a40d0
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x1e7a3e86
cmp dword [eax + 0xc], ebx
je 0x1e7a3f29
mov edi, dword [eax + 0xc]
add edi, esi
push edi
invalid
xchg ebp, eax
inc eax
invalid

Function at 0x1e7a4150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ecx + 0x56fffffc], edi
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.1e7a38f1
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a38a6
add esp, 0xc
mov dword [ebp - 0x68c], eax
invalid
xchg ebp, eax
je 0x1e7a4198
invalid

Function at 0x1e7a41a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx - 0x6737b]
inc edi
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
add byte [eax], al