joyce8/EMBER2024-capa huggingface dataset:
Function at 0x616d84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0xc6d33c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x616e48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x616dbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x616e5f
dec edx
je 0x616ea0
jmp 0x616efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x616efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x616f60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x616f7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x61708f

Function at 0x61711c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0xc7e7a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x617138
shr eax, 1
xor eax, 0xedb88320
jmp 0x61713a
shr eax, 1
dec edx
jne 0x61712b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x617124
pop ebx
ret
Function at 0x617150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x617159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0060ea38
xor eax, eax
push ebp
push 0x617239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0061711c
mov eax, dword [0xc7de0c]
mov byte [eax], 0
mov dword [ebx], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.0060ce7c
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.0060d218
call fcn.0060cba8
test eax, eax
jne 0x617216
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10145]
mov ecx, 0xfff1
lea eax, [ebp - 0x154]
call fcn.0060cfcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x617210
lea eax, [ebp - 0x10145]
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0xc7e7a0]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x6171ec
cmp dword [ebp - 8], 0
jne 0x6171c3
lea eax, [ebp - 0x154]
call fcn.0060cfec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x617240
lea eax, [ebp - 4]
call fcn.0060e588
ret

Function at 0x622718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x622738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x622726
pop edi
pop esi
pop ebx
ret
Function at 0x62afd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0xc7ecb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + 0xc73670]
mov eax, dword [esi*4 + 0xc736b0]
xor eax, dword [esp]
call fcn.0062af70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.0062afac
mov dword [ebx], eax
mov edx, dword [esi*4 + 0xc73680]
mov eax, dword [esi*4 + 0xc736c0]
xor eax, dword [esp]
call fcn.0062af70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.0062afac
mov dword [ebx + 0x1000], eax
mov edx, dword [esi*4 + 0xc73690]
mov eax, dword [esi*4 + 0xc736d0]
xor eax, dword [esp]
call fcn.0062af70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.0062afac
mov dword [ebx + 0x2000], eax
mov edx, dword [esi*4 + 0xc736a0]
mov eax, dword [esi*4 + 0xc736e0]
xor eax, dword [esp]
call fcn.0062af70
mov edi, eax
mov eax, edi
call fcn.0062afac
mov dword [ebx + 0x3000], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x62afe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x62b138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x62b16d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x62b193
inc ebx
cmp ebx, 0xf
jne 0x62b17d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x62b14f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x634ee0
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 0x18], 0x100
mov esi, 0xc780f4
mov ebx, 0xc82ce4
movzx edi, byte [esi]
mov dword [esp], edi
mov eax, edi
call fcn.00633e30
mov dword [esp + 8], eax
mov eax, edi
call fcn.00633e40
mov dword [esp + 0x10], eax
movzx edi, byte [esi + 0x100]
mov dword [esp + 4], edi
mov eax, edi
call fcn.00633e30
mov dword [esp + 0xc], eax
mov eax, edi
call fcn.00633e40
mov ebp, eax
mov dword [esp + 0x14], ebp
mov eax, edi
mov edx, dword [esp + 0xc]
shl edx, 8
or eax, edx
mov edx, ebp
shl edx, 0x10
or eax, edx
mov edx, ebp
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [esp + 0xc]
shl ebp, 8
or edx, ebp
shl edi, 0x10
or edx, edi
mov ecx, dword [esp + 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [esp + 8]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [esp + 0x18]
jne 0x634ef9
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10001a37
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10001a46
pop dword [ebp - 0x50]
mov eax, 0x31566968
sub eax, 0x21564f22
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xa9a09410
sub dword [ebp - 0x60], 0x5b4e4ec5
mov dword [ebp - 0x5c], 0xf42e2720
add dword [ebp - 0x5c], 0x3e052525
mov dword [ebp - 0x58], 0x12ad0d38
sub dword [ebp - 0x58], 0xc660c90a
mov dword [ebp - 0x54], 0xec619f72
sub dword [ebp - 0x54], 0xec619f72
lea eax, [ebp - 0x60]
push eax
mov eax, 0x5289e6b7
sub eax, 0x4287f613
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xf52af349
add dword [ebp - 0x60], 0x7f47760d
mov dword [ebp - 0x5c], 0xe4d5b670
add dword [ebp - 0x5c], 0x5c96ab05
mov dword [ebp - 0x58], 0xe9299acd
add dword [ebp - 0x58], 0x7a45d19f
mov dword [ebp - 0x54], 0xa34bdd47
add dword [ebp - 0x54], 0x5cb422b9
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xa1d4fbab
sub eax, 0x91d30b0f
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3d36a
push 0
call eax
mov ecx, 0xb371deb1
add ecx, 0x4c8e717f
mov edi, eax
mov esi, 0x10029a00
add esi, dword [ebp - 0x50]
mov ebx, 0xe13261a8
add ebx, 0xca8586ca
xor dword [ebp - 0x10], 0x42e92764
mov edx, dword [esi]
mov dword [ebp - 8], 0x9eb2810
add edx, ebx
xor dword [ebp - 0x4c], edi
mov dword [edi], edx
add dword [ebp - 0x20], edx
add edi, 0x7f2439c9
add edi, 0x80dbc63b
add esi, 0xfd95591
sub esi, 0xfd9558d
loop 0x10001b62
add eax, 0x75dec19e
add eax, 0x8a2271f5
xor ebx, ebx
add ebx, eax
add eax, 0x8ab1caff
add eax, 0x754e3506
mov ecx, 0x333148a2
sub ecx, 0x233148a2
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10001a37
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10001a37
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.10001a37
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10001a37
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10001a37
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c
Function at 0x6d7b364a
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d4c]
test eax, eax
je 0x6d7b36b9
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d4c]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.6d7bb07b
pop ecx
pop edi
pop esi
ret

Function at 0x6d7b3d88
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x6d7b3dbd
push edi
mov edi, 0x120
cmp dword [esp + 0x10], edi
jae 0x6d7b3db0
push eax
call fcn.6d7b4838
push 2
call fcn.6d7b4827
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
pop edi
pop esi
ret

Function at 0x6d7bb07b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x6d7bb08a
pop dword [ebp - 0x30]
mov eax, 0xe3a87a06
add eax, 0x89d33684
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x3b89f258
add dword [ebp - 0x40], 0x12c852f3
mov dword [ebp - 0x3c], 0x4e8272a8
add dword [ebp - 0x3c], 0xe3b0d99d
mov dword [ebp - 0x38], 0x9cac09bd
sub dword [ebp - 0x38], 0x505fc58f
mov dword [ebp - 0x34], 0xcd8ba12e
add dword [ebp - 0x34], 0x32745ed2
lea eax, [ebp - 0x40]
push eax
mov eax, 0xd2a90c94
add eax, 0x9ad3d3a8
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xea009731
add dword [ebp - 0x40], 0x8a71d225
mov dword [ebp - 0x3c], 0xa77bccb5
add dword [ebp - 0x3c], 0x99f094c0
mov dword [ebp - 0x38], 0x3b1635e1
add dword [ebp - 0x38], 0x2859368b
mov dword [ebp - 0x34], 0x983e4cd
sub dword [ebp - 0x34], 0x983e4cd
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x75638021
sub eax, 0x7e69f81
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38fdf
push 0
call eax
mov ecx, 0x1c24168c
add ecx, 0xe3dc328e
xor esi, esi
add esi, eax
mov edx, 0xe5140250
sub edx, 0x77963050
add edx, dword [ebp - 0x30]
mov edi, 0xdf26b7b7
sub edi, 0x7d1ec7a1
xor dword [ebp - 0x18], 0x73dcdb05
mov ebx, dword [edx]
add dword [ebp - 0x2c], 0x7d7326b3
add ebx, edi
add dword [ebp - 0x24], edx
mov dword [esi], ebx
add dword [ebp - 0x24], 0x48c9e164
add esi, 0x432c368b
add esi, 0xbcd3c979
add edx, 4
loop 0x6d7bb1ae
add eax, 0x43442569
add eax, 0xbcbcf1d2
mov ebx, eax
add eax, 5
mov ecx, 0x166a2921
sub ecx, 0xa8ef2921
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x6d4ab202
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d4b3fd0]
jne 0x6d4ab20c
repz ret
jmp fcn.6d4ab8f0

Function at 0x6d4abf21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x6d4abf30
pop dword [ebp - 0x44]
mov eax, 0x6f66d3b2
sub eax, 0x21c1482
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xa0faf118
sub dword [ebp - 0x54], 0x52a8abcd
mov dword [ebp - 0x50], 0x8bb57f2f
sub dword [ebp - 0x50], 0x598232ea
mov dword [ebp - 0x4c], 0xf6df550e
add dword [ebp - 0x4c], 0x556cef20
mov dword [ebp - 0x48], 0x3585553d
add dword [ebp - 0x48], 0xca7aaac3
lea eax, [ebp - 0x54]
push eax
mov eax, 0x8be2e85e
add eax, 0xe167e7da
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x75f92c8c
add dword [ebp - 0x54], 0xfe793cca
mov dword [ebp - 0x50], 0x514e4fd8
sub dword [ebp - 0x50], 0xfe1ee63
mov dword [ebp - 0x4c], 0xcdb7eb1d
add dword [ebp - 0x4c], 0x95b7814f
mov dword [ebp - 0x48], 0xb7df76d5
add dword [ebp - 0x48], 0x4820892b
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x82e4c62f
sub eax, 0x1599f5fb
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36124
push 0
call eax
mov ecx, 0xa825da30
add ecx, 0x57da6807
xor ebx, ebx
add ebx, eax
mov edx, 0xed93d20b
add edx, 0x7fb7abf5
add edx, dword [ebp - 0x44]
mov edi, 0xdc2bdebd
xor dword [ebp - 0x34], ecx
mov esi, dword [edx]
add dword [ebp - 0x2c], 0x4b99880a
sub esi, edi
mov dword [ebp - 0x24], 0xcc8e64de
mov dword [ebx], esi
add dword [ebp - 0x38], ebx
add ebx, 0xf03022fd
sub ebx, 0xf03022f9
add edx, 0x335c2edc
add edx, 0xcca3d128
loop 0x6d4ac04e
add eax, 0x3248cc8d
sub eax, 0x3247d0de
mov ebx, eax
add eax, 0x862ca78e
add eax, 0x79d35877
mov ecx, 0x6d4a0000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1000ec90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000ec9f
pop dword [ebp - 0xc]
mov eax, 0x1000ec9f
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x64870
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x5210
xor esi, esi
add esi, eax
mov edx, 0xa0ad2364
add edx, 0x6f65889c
add edx, dword [ebp - 0xc]
mov ebx, 0x7548ed47
add ebx, 0xb5c7d90c
mov dword [ebp - 8], 0xb8928ca1
mov edi, dword [edx]
xor dword [ebp - 8], ecx
add edi, ebx
sub dword [ebp - 4], 0x719969be
mov dword [esi], edi
add esi, 0x8a725169
add esi, 0x758dae9b
add edx, 4
loop 0x1000ecf0
add eax, 0x4d5e6b2a
sub eax, 0x4d5d3017
mov ebx, eax
add eax, 0xae1f7600
sub eax, 0xae1f75fb
mov ecx, 0x3bda0260
add ecx, 0xd425fda0
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10047e50
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a56a9
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x1010df64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov eax, dword [0x1010df30]
mov ecx, 0x1010df30
mov byte [ebp - 4], 1
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x128], esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
mov dword [ebp - 0x124], 0
call fcn.10013bd0
mov ecx, eax
call fcn.10013cd0
mov eax, dword [ebp + 8]
mov edi, dword [eax - 0xc]
test edi, edi
jns 0x10047efa
push 0x80070057
call fcn.1000ec90
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, edi
or ecx, edx
jge 0x10047f17
push edi
lea ecx, [ebp + 8]
call fcn.1000ec90
mov eax, dword [ebp + 8]
lea ecx, [edi + 1]
push ecx
push eax
call fcn.1000ec90
mov eax, dword [ebp + 8]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x10047ef0
mov dword [eax - 0xc], edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax + edi*2], cx
push dword [ebp + 8]
lea eax, [ebp - 0x120]
push str.wstrUserName_s
push str.IDCRL::DeleteUserAllExtendedProperties
push eax
push str.d:_bt20572clientwlidsspwlidsvccorecredentialbag.cpp_40
lea eax, [ebp - 0x11c]
push 2
push eax
call fcn.1000ec90
add esp, 0x1c
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 3
cmp dword [eax - 0xc], 0
je 0x10048004
lea eax, [ebp - 0x124]
push eax
push 0x20006
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov edi, eax
test edi, edi
je 0x10047fa6
jg 0x10047f95
mov dword [ebp - 0x120], edi
jmp 0x1004800a
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x120], edi
jmp 0x1004800a
push 0x39
push str.SoftwareMicrosoftMSOIdentityCRLUserExtendedProperties_
lea ecx, [ebp - 0x128]
call fcn.1000ec90
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x128]
push dword [eax - 0xc]
push eax
call fcn.1000ec90
mov esi, dword [ebp - 0x128]
push esi
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x10047ff8
cmp eax, 2
je 0x10047ff8
test eax, eax
jle 0x10047ff2
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x120], eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 2
call fcn.1000ec90
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 1
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10048039
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x1004805a
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001e17
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bac0
Capabilities:
Write file on windows

Disassembly:
call fcn.1000ec90
call fcn.1000ddf0
mov ecx, eax
call fcn.1000d310
mov ecx, dword [0x1011169c]
test ecx, ecx
je 0x1004bb06
push esi
call fcn.1000ec90
mov esi, dword [0x1011169c]
test esi, esi
je 0x1004bafb
mov ecx, esi
call fcn.1000ec90
push esi
call fcn.1000863f
add esp, 4
mov dword [0x1011169c], 0
pop esi
jmp fcn.1004de70