joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458a6c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x458a83
add esp, 0xfffffff0
call fcn.004035c0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419730
mov eax, dword [0x4649c0]
cmp word [eax + 2], 0
jne 0x458aab
mov eax, dword [0x4649c0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045a144
mov eax, dword [0x464a70]
cmp word [eax + 2], 0
jne 0x458ac5
mov eax, dword [0x464a70]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045a33c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4117c4]
call fcn.0040326c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4117c4]
call fcn.0040326c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41bc6c]
call fcn.004231a8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x458c4c
mov eax, dword [0x4648dc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00423578
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45a8ec
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4648dc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c348
test eax, eax
je 0x458bba
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408538
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c370
test eax, eax
je 0x458bce
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040425c
mov eax, dword [0x4647c0]
cmp byte [eax], 0
jne 0x458c02
mov eax, ebx
call fcn.00458d74
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045aac8
mov eax, ebx
call fcn.0045b48c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x458c42
call fcn.00403618
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458ff4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x465bb0]
cmp dword [eax + 0x30], 0
je 0x45909e
cmp dword [ebx + 0x94], 0
jne 0x459098
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458f84
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x459098
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45905e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x459098
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413bb4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45906d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x459c00
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x459c35
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004040dc
jmp 0x459c42
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404040
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45aca4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45ace5
mov eax, esi
call fcn.00440f3c
test al, al
je 0x45ace5
mov eax, dword [ebx + 0x84]
call fcn.00440c38
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45ace5
push 0
mov eax, dword [ebx + 0x84]
call fcn.00440c38
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45be1c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00406910
ret
Function at 0x45c0b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x46439c]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x46439c]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x46439c]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x46439c]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x463f20]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x45c0df
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x45c1ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x46439c]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x46439c]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x46439c]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x46439c]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x463f20]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x45c1e7
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x45c2c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x46439c]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x46439c]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x46439c]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x46439c]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x463f20]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x46439c]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x46439c]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x46439c]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x46439c]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x45c313
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x461654
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, edx
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040425c
mov eax, dword [ebx]
call fcn.004042ac
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x461696
mov eax, ebx
mov edx, 0x4616a8
call fcn.004042b4
add esp, 0x108
pop ebx
ret
Function at 0x1000dc86
Capabilities:
Send data
Send data on socket

Disassembly:
push 4
mov eax, 0x10012213
call fcn.10010b55
push 0x10
call fcn.1000fa81
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1000bea9
mov esi, eax
push 0xa8
mov ecx, esi
call fcn.1000bed1
push 1
call fcn.1000bed1
call fcn.1000bef5
mov ecx, esi
call fcn.1000f82d
mov ecx, dword [esi + 0xc]
push 0
movzx eax, word [ecx]
add eax, 2
push eax
push ecx
push dword [0x1001973c]
call dword [sym.imp.WS2_32.dll_send]
push dword [esi + 0xc]
call fcn.1000fcc7
push 0x10
push esi
call fcn.1000fab1
add esp, 0xc
call fcn.10010b32
ret 8

Function at 0x1000dcfc
Capabilities:
Send data
Send data on socket

Disassembly:
push 4
mov eax, 0x10012213
call fcn.10010b55
push 0x10
call fcn.1000fa81
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1000bea9
mov esi, eax
push 0x32
mov ecx, esi
call fcn.1000bed1
push 0xc9
call fcn.1000bed1
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
mov edx, dword [esi + 4]
mov edi, eax
pop ecx
mov ebx, 0x3bea
lea ecx, [edi + 2]
add ecx, edx
cmp ecx, ebx
jae 0x1000dd85
cmp edi, 0x2000
ja 0x1000dd85
lea eax, [edx + 2]
cmp eax, ebx
jae 0x1000dd6f
mov eax, dword [esi + 0xc]
mov word [edx + eax], di
add dword [esi + 4], 2
mov edx, dword [esi + 4]
add dword [esi], 2
mov eax, dword [esi + 0xc]
push dword [ebp + 0xc]
add eax, edx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy]
add dword [esi + 4], edi
add dword [esi], edi
pop ecx
pop ecx
mov ecx, esi
call fcn.1000bef5
mov ecx, esi
call fcn.1000f82d
mov ecx, dword [esi + 0xc]
push 0
movzx eax, word [ecx]
add eax, 2
push eax
push ecx
push dword [0x1001973c]
call dword [sym.imp.WS2_32.dll_send]
push dword [esi + 0xc]
call fcn.1000fcc7
push 0x10
push esi
call fcn.1000fab1
add esp, 0xc
call fcn.10010b32
ret 8
Function at 0x1000e0da
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create directory
Create raw socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
mov eax, dword [0x10019008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
push 0
push 0x2710
push edx
push eax
call fcn.10010c00
mov edi, edx
mov ebx, eax
push 0
mov dword [ebp - 0x1ec], edi
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
pop ecx
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
pop ecx
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
push 0
movzx esi, ax
push str.movies
mov dword [ebp - 0x1f0], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movzx eax, si
push eax
push edi
push ebx
lea eax, [ebp - 0x48]
push str.movies__lld__d.byn
push eax
call fcn.1000104a
add esp, 0x14
lea eax, [ebp - 0x48]
push 0x1001479c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push 3
push 0x20
push 0x64
push str._c_c_c
push eax
mov dword [0x10019754], eax
call fcn.10001026
add esp, 0x1c
push dword [0x10019754]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
lea eax, [ebp - 0x1e8]
mov dword [0x10019758], ebx
push eax
push 0x202
mov dword [0x1001975c], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x10
lea eax, [ebp - 0x58]
push 0
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
push 6
push 1
push 2
pop esi
push esi
call dword [sym.imp.WS2_32.dll_socket]
push str.145.239.93.29
mov dword [0x10019740], eax
mov word [ebp - 0x58], si
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x1d74
mov dword [ebp - 0x54], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x56], ax
lea eax, [ebp - 0x58]
push 0x10
push eax
push dword [0x10019740]
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x14], 0x2001000d
mov byte [ebp - 0x10], 3
mov edx, edi
mov byte [ebp - 0xf], bl
mov eax, edx
mov byte [ebp - 0xb], dl
mov ecx, ebx
shrd ecx, eax, 8
mov eax, edx
mov byte [ebp - 0xe], cl
mov ecx, ebx
shrd ecx, eax, 0x10
mov eax, edx
shrd ebx, eax, 0x18
mov eax, edx
mov byte [ebp - 0xd], cl
sar eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
sar eax, 0x10
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x1f0]
mov byte [ebp - 7], al
shr eax, 8
push 0
mov byte [ebp - 6], al
lea eax, [ebp - 0x14]
push 0xf
push eax
push dword [0x10019740]
sar edx, 0x18
mov byte [ebp - 0xc], bl
mov byte [ebp - 8], dl
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000fa73
leave
ret
Function at 0x1000e276
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x144
mov eax, 0x1001227d
call fcn.10010b88
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x144]
push str.SOFTWARETibiazQt_DLL_Gorgo
call fcn.100028eb
xor ebx, ebx
lea ecx, [ebp - 0x12c]
push str.remember
mov dword [ebp - 4], ebx
call fcn.100028eb
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov dword [ebp - 0x150], 0xff
mov dword [ebp - 0x14c], ebx
test eax, eax
jne 0x1000e371
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
jb 0x1000e2e1
mov eax, dword [ebp - 0x144]
lea ecx, [ebp - 0x148]
push ecx
push 0x20019
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000e46b
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
jb 0x1000e317
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x150]
push ecx
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x14c]
push ecx
push ebx
push eax
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000e45f
cmp dword [ebp - 0x14c], 1
jne 0x1000e45f
lea eax, [ebp - 0x114]
mov byte [0x100196fc], 1
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
jmp 0x1000e455
cmp eax, 1
jne 0x1000e3ec
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
jb 0x1000e38b
mov eax, dword [ebp - 0x144]
push ebx
lea ecx, [ebp - 0x148]
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1000e46b
cmp dword [ebp - 0x118], 0x10
lea edi, [ebp - 0x12c]
jb 0x1000e3c5
mov edi, dword [ebp - 0x12c]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
push esi
call ebx
pop ecx
inc eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1000e45f
push esi
call ebx
jmp 0x1000e452
cmp eax, 2
jne 0x1000e46b
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
jb 0x1000e406
mov eax, dword [ebp - 0x144]
lea ecx, [ebp - 0x148]
push ecx
push 2
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000e46b
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
jb 0x1000e435
mov eax, dword [ebp - 0x12c]
push eax
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x1000e45f
mov esi, 0x1001335f
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
push eax
push esi
mov ecx, 0x10019700
call fcn.10002af1
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x12c]
call fcn.10002891
lea ecx, [ebp - 0x144]
call fcn.10002891
call fcn.10010b46
ret 8
Function at 0x1000eecd
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0x40
push dword [ebp + 8]
mov ebx, edx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 8], 2
jne 0x1000eef3
mov word [esi], bx
jmp 0x1000eefb
cmp dword [ebp + 8], 1
jne 0x1000eefb
mov byte [esi], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
leave
ret

Function at 0x1000f801
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, 0x1000c9ee
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov byte [esi + 8], cl
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
setne al
mov byte [esi + 8], al
mov eax, esi
pop esi
ret 0xc

Function at 0x1000f82d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10019008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x768c7c]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [0x768c80]
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [0x768c84]
cmp dword [edi + 8], 2
mov esi, dword [edi]
sete bl
mov dword [ebp - 0xc], eax
mov eax, dword [0x768c88]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 8], eax
lea ebx, [ebx*4 + 2]
add esi, ebx
mov dword [ebp - 0x28], ebx
mov ecx, esi
mov dword [ebp - 0x1c], esi
and ecx, 0x80000007
jns 0x1000f890
dec ecx
or ecx, 0xfffffff8
add ecx, 1
je 0x1000f89c
push 8
pop eax
sub eax, ecx
add esi, eax
mov dword [ebp - 0x1c], esi
mov ecx, dword [edi + 0xc]
mov eax, esi
cdq
add ecx, ebx
and edx, 3
mov dword [ebp - 0x20], ecx
add eax, edx
xor edx, edx
sar eax, 2
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], edx
test eax, eax
jle 0x1000f930
mov edi, dword [ecx + edx*4]
xor esi, esi
mov ebx, dword [ecx + edx*4 + 4]
push 0x20
pop edx
mov ecx, ebx
mov eax, ebx
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
and eax, 3
add ecx, ebx
mov eax, dword [ebp + eax*4 - 0x14]
add eax, esi
sub esi, 0x61c88647
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
shr eax, 0xd
add ecx, edi
and eax, 3
mov eax, dword [ebp + eax*4 - 0x14]
add eax, esi
xor ecx, eax
add ebx, ecx
sub edx, 1
jne 0x1000f8c7
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + edx*4], edi
mov dword [ecx + edx*4 + 4], ebx
add edx, 2
mov dword [ebp - 0x18], edx
cmp edx, dword [ebp - 0x24]
jl 0x1000f8bb
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x2c]
mov eax, dword [edi + 0xc]
lea ecx, [ebx - 2]
add ecx, esi
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov dword [edi], esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1000fa73
leave
ret
Function at 0x1000f94c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10019008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x768c7c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x768c80]
mov dword [ebp - 0x10], eax
mov eax, dword [0x768c84]
mov dword [ebp - 0xc], eax
mov eax, dword [0x768c88]
mov dword [ebp - 8], eax
mov eax, edx
cdq
and edx, 3
add eax, edx
xor edx, edx
sar eax, 2
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
test eax, eax
jle 0x1000fa0e
push ebx
push edi
mov edi, dword [esi + edx*4 + 2]
mov ebx, dword [esi + edx*4 + 6]
mov esi, 0xc6ef3720
push 0x20
pop edx
mov ecx, edi
mov eax, edi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
shr eax, 0xd
add ecx, edi
and eax, 3
mov eax, dword [ebp + eax*4 - 0x14]
add eax, esi
add esi, 0x61c88647
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
and eax, 3
add ecx, ebx
mov eax, dword [ebp + eax*4 - 0x14]
add eax, esi
xor ecx, eax
sub edi, ecx
sub edx, 1
jne 0x1000f9ab
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov dword [esi + edx*4 + 2], edi
mov dword [esi + edx*4 + 6], ebx
add edx, 2
mov dword [ebp - 0x18], edx
cmp edx, dword [ebp - 0x20]
jl 0x1000f99b
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000fa73
leave
ret