joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a700
Capabilities:
Copy file
Delete file
Move file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x524104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0x208
push 0
push eax
mov dword [ebp - 0x460], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [esi + 0x208], 0
je 0x41a804
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esi + 0x218]
push 4
push eax
push 4
push 0
push str.Overwrite
push edi
call ebx
push 4
lea eax, [esi + 0x214]
push eax
push 4
push 0
push str.LogEntryExit
push edi
call ebx
push 4
lea eax, [esi + 0x210]
push eax
push 4
push 0
push str.LogDebugView
push edi
call ebx
push 4
lea eax, [esi + 0x21c]
push eax
push 4
push 0
push str.DisableErrBufferEmpty
push edi
call ebx
push 4
lea eax, [esi + 0x220]
push eax
push 4
push 0
push str.OutputFormat
push edi
call ebx
push 4
lea eax, [esi + 0x42c]
push eax
push 4
push 0
push str.MessageSize
push edi
call ebx
cmp dword [esi + 0x1064], 0xffffffff
lea eax, [esi + 0x1064]
je 0x41a7e9
push 4
push eax
push 4
push 0
push str.StoreWithPrimaryAPI
push edi
call ebx
push 4
lea eax, [esi + 0x1068]
push eax
push 4
push 0
push str.Version
push edi
call ebx
mov ebx, dword [ebp - 0x460]
lea eax, [ebp - 0x20c]
push eax
lea edi, [esi + 0x63c]
push edi
call fcn.00417cb0
add esp, 8
test al, al
je 0x41a8b3
cmp dword [esi + 0x208], 0
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
jne 0x41a866
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x41a89e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x41a8b3
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x41a893
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x41a89e
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x41a8b3
push 0
push edi
lea eax, [esi + 0x844]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x41a8b3
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425b22
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425b22
mov esp, ebp
pop ebp
ret 8

Function at 0x41aa50
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x524104]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x254]
push edi
mov edi, dword [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x41aa94
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00425b22
mov esp, ebp
pop ebp
ret
Function at 0x41b820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428f28
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x524104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov esi, dword [ebp + 0xc]
lea eax, [edi + 4]
push eax
mov dword [edi], vtable.std::exception.0
movq qword [eax], xmm0
lea eax, [esi + 4]
push eax
call sub.VCRUNTIME140.dll___std_exception_copy
add esp, 8
mov dword [edi], vtable.boost::system::system_error.0
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.004016a0
mov dword [edi + 0x2c], vtable.boost::exception.0
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41ba70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428fd0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x524104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
lea eax, [esi + 4]
xorps xmm0, xmm0
mov dword [esi], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [ebx + 4]
push eax
call sub.VCRUNTIME140.dll___std_exception_copy
add esp, 8
mov dword [esi], vtable.boost::system::system_error.0
lea ecx, [esi + 0x14]
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
lea eax, [ebx + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.004016a0
mov dword [esi], vtable.boost::lock_error.0
lea edi, [esi + 0x2c]
mov dword [ebp - 4], 1
mov dword [edi], vtable.boost::exception.0
mov ecx, dword [ebx + 0x30]
mov dword [ebp + 8], edi
mov dword [edi + 4], ecx
test ecx, ecx
je 0x41bb08
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 0x34]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x38]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x3c]
mov dword [edi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41bb40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428fd0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x524104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
lea eax, [esi + 4]
xorps xmm0, xmm0
mov dword [esi], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [ebx + 4]
push eax
call sub.VCRUNTIME140.dll___std_exception_copy
add esp, 8
mov dword [esi], vtable.boost::system::system_error.0
lea ecx, [esi + 0x14]
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
lea eax, [ebx + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.004016a0
mov dword [esi], vtable.boost::thread_resource_error.0
lea edi, [esi + 0x2c]
mov dword [ebp - 4], 1
mov dword [edi], vtable.boost::exception.0
mov ecx, dword [ebx + 0x30]
mov dword [ebp + 8], edi
mov dword [edi + 4], ecx
test ecx, ecx
je 0x41bbd8
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 0x34]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x38]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x3c]
mov dword [edi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41f060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429226
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x524104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], 0x5254d4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x5254d8]
mov esi, eax
cmp ecx, esi
jne 0x41f0b2
mov eax, dword [0x5254d4]
inc eax
jmp 0x41f0c8
mov ecx, 0x5254dc
call fcn.0041fc40
mov eax, 0x5254d8
xchg dword [eax], esi
mov eax, 1
mov dword [0x5254d4], eax
mov byte [ebp - 0x128], 1
cmp dword [0x5254b0], 0
mov dword [ebp - 4], 2
je 0x41f0eb
mov bl, 1
jmp 0x41f275
push 0xf0
lea eax, [ebp - 0x100]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0xf
mov byte [ebp - 0x118], 0
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 3
push eax
push 2
call fcn.0041e0f0
add esp, 0x14
test eax, eax
jne 0x41f1fe
cmp dword [ebp - 0x104], 0x10
lea esi, [ebp - 0x118]
jb 0x41f16d
mov esi, dword [ebp - 0x118]
test esi, esi
je 0x41f19e
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41f172
sub ecx, edx
lea edi, [ecx + 1]
cmp edi, 0x3fffffff
jle 0x41f18a
xor eax, eax
jmp 0x41f19e
lea eax, [edi + edi]
call fcn.00425b70
mov eax, esp
push 3
push edi
push esi
push eax
call fcn.004019a0
lea ecx, [ebp - 0x11c]
push ecx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f1fe
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0xf0
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x124]
push eax
push 0
push 0x4a6004
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x11c]
test eax, eax
je 0x41f236
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov edx, dword [ebp - 0x104]
mov byte [ebp - 4], 2
cmp edx, 0x10
jb 0x41f255
mov ecx, dword [ebp - 0x118]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41f24b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41f24b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov eax, dword [ebp - 0x100]
mov dword [0x5254b0], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x41f200
push edx
push ecx
call fcn.00425b14
add esp, 8
mov eax, dword [0x5254d4]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0xf
mov byte [ebp - 0x118], 0
sub eax, 1
mov dword [ebp - 4], 4
mov dword [0x5254d4], eax
jne 0x41f2be
xor eax, eax
mov ecx, 0x5254d8
xchg dword [ecx], eax
mov eax, 0x80000000
mov ecx, 0x5254dc
lock xadd dword [ecx], eax
test eax, 0x40000000
jne 0x41f2be
cmp eax, 0x80000000
jle 0x41f2be
lock bts dword [ecx], 0x1e
jb 0x41f2be
call fcn.0041fbb0
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, bl
lea esp, [ebp - 0x13c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425b22
mov esp, ebp
pop ebp
ret
Function at 0x41f2f0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x524104]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41f359
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425b22
mov esp, ebp
pop ebp
ret

Function at 0x420710
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428f28
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x524104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov esi, dword [ebp + 0xc]
lea eax, [edi + 4]
push eax
mov dword [edi], vtable.std::exception.0
movq qword [eax], xmm0
lea eax, [esi + 4]
push eax
call sub.VCRUNTIME140.dll___std_exception_copy
add esp, 8
mov dword [edi], vtable.boost::system::system_error.0
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.004016a0
mov dword [edi + 0x2c], vtable.boost::exception.0
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x420d79
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x524104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420e3d
push edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x110], 1
push eax
lea eax, [ebp - 0x108]
mov edi, 0x104
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], edi
push eax
push ebx
push ebx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420e2c
cmp dword [ebp - 0x110], 2
lea eax, [ebp - 0x108]
mov byte [ebp - 5], bl
jne 0x420e1d
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb ebx, ebx
inc ebx
jmp 0x420e2c
push eax
push edi
push esi
call fcn.00420e51
xor ebx, ebx
test eax, eax
setns bl
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
jmp 0x420e3f
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00425b22
mov esp, ebp
pop ebp
ret 4
Function at 0x4245a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429a20
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x524104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x4245e1
mov eax, dword [edi]
jmp 0x4245e3
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x424602
push esi
push edi
push ebx
call fcn.00424400
add esp, 0xc
jmp 0x42474e
test eax, 0x400
je 0x42470d
cmp dword [edi + 0x14], 8
jb 0x424617
mov edx, dword [edi]
jmp 0x424619
mov edx, edi
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424632
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00422760
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp eax, 8
jb 0x424693
inc eax
push 2
push eax
push dword [ebp - 0x28]
call fcn.004213b0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 2
cmp esi, 0xffffffff
jne 0x4246c2
push dword [ebp - 0x34]
push edi
push ebx
call fcn.00424400
add esp, 0xc
jmp 0x42474e
push edi
call fcn.00424210
add esp, 4
test al, al
jne 0x4246f5
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.004242f0
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42474e
push esi
mov dword [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x42471f
mov dword [esi], 0
call fcn.00425750
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x424736
mov dword [ebp - 0x30], 2
call fcn.004242f0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425b22
mov esp, ebp
pop ebp
ret

Function at 0x425b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ret

Function at 0x425b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x599a84ee
pop ebp
dec eax
movsx ecx, al
imul ebx, ebp
add ebp, 0xd37
imul edx, edx
push ebp
imul ebx, eax
and eax, 0x56d3ee3f
pop esi
imul ebx, edi, 0x23254f2e
adc dh, ch
imul ecx, edx
Function at 0x10001ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
push 2
push 0
push 0x10001d60
mov ecx, dword [0x10049244]
call fcn.1001a6b0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001fcd
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x10048828]
call fcn.10001480
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x1004882c]
call fcn.10014090
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10003290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 5
mov dword [ebp - 8], 0
jmp 0x100032b2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x33
jge 0x100032f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x779227d4]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100032ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100032a9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x33], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10003310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 7
mov dword [ebp - 8], 0
jmp 0x10003332
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2b
jge 0x10003371
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6fff3f68]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000336c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10003329
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2b], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10003390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x16
mov dword [ebp - 8], 0
jmp 0x100033b2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2b
jge 0x100033f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x5d1e2afe]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100033ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100033a9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2b], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10003b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x2d0], 0
push 0x2c8
push 0
lea eax, [ebp - 0x2cc]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x2d0], 0x10010
lea ecx, [ebp - 0x2d0]
push ecx
push 0xfffffffffffffffe
mov edx, dword [0x10048824]
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x10003cfa
cmp dword [ebp - 0x2cc], 0
jne 0x10003c06
cmp dword [ebp - 0x2c8], 0
jne 0x10003c06
cmp dword [ebp - 0x2c4], 0
jne 0x10003c06
cmp dword [ebp - 0x2c0], 0
jne 0x10003c06
cmp dword [ebp - 0x2b8], 0
je 0x10003cfa
mov byte [ebp - 0x2f0], 0x48
mov byte [ebp - 0x2ef], 0x61
mov byte [ebp - 0x2ee], 0x72
mov byte [ebp - 0x2ed], 0x64
mov byte [ebp - 0x2ec], 0x77
mov byte [ebp - 0x2eb], 0x61
mov byte [ebp - 0x2ea], 0x72
mov byte [ebp - 0x2e9], 0x65
mov byte [ebp - 0x2e8], 0x20
mov byte [ebp - 0x2e7], 0x62
mov byte [ebp - 0x2e6], 0x72
mov byte [ebp - 0x2e5], 0x65
mov byte [ebp - 0x2e4], 0x61
mov byte [ebp - 0x2e3], 0x6b
mov byte [ebp - 0x2e2], 0x70
mov byte [ebp - 0x2e1], 0x6f
mov byte [ebp - 0x2e0], 0x69
mov byte [ebp - 0x2df], 0x6e
mov byte [ebp - 0x2de], 0x74
mov byte [ebp - 0x2dd], 0x20
mov byte [ebp - 0x2dc], 0x64
mov byte [ebp - 0x2db], 0x65
mov byte [ebp - 0x2da], 0x74
mov byte [ebp - 0x2d9], 0x65
mov byte [ebp - 0x2d8], 0x63
mov byte [ebp - 0x2d7], 0x74
mov byte [ebp - 0x2d6], 0x65
mov byte [ebp - 0x2d5], 0x64
mov byte [ebp - 0x2d4], 0
mov ecx, dword [0x10048828]
call fcn.10001480
push eax
push 0
lea ecx, [ebp - 0x2f0]
push ecx
push 1
lea edx, [ebp - 0x2f0]
push edx
mov ecx, dword [0x1004882c]
call fcn.10014090
mov esp, ebp
pop ebp
ret

Function at 0x10003d00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10048820]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x10003d21
xor eax, eax
jmp 0x10003d63
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
je 0x10003d3c
xor eax, eax
jmp 0x10003d63
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x28]
add ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, byte [edx]
xor ecx, ecx
cmp eax, 0xcc
sete cl
mov eax, ecx
mov esp, ebp
pop ebp
ret