joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b0af
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000b14c
push ebx
push esi
call fcn.1000b078
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000b00c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000b0f9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b14b
push edi
push eax
call fcn.1000c06a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000b119
call fcn.10009b54
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b14a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000b00c
add esp, 0x20
test eax, eax
jne 0x1000b138
push edi
call fcn.10009b54
jmp 0x1000b140
push ebx
call fcn.10009b54
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000b3b9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012668
push 0x10012660
push str.FlsAlloc
push 0x1f
call fcn.1000b2d5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b3ed
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011140]
call esi
jmp 0x1000b3f3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000b437
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012678
push 0x10012670
push str.FlsGetValue
push 0x21
call fcn.1000b2d5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b46e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000b476
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012680
push 0x10012678
push str.FlsSetValue
push 0x22
call fcn.1000b2d5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b4b0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10011140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10010b30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010b5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010b5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4013dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
cmp dword [0x4406958], 0x594
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x2c], esi
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], ebx
jne 0x401412
push 0
lea eax, [ebp - 0x44c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x4192f8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
mov eax, dword [0x4192fc]
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x28], eax
call fcn.004013d2
mov ecx, dword [0x419300]
mov eax, dword [0x419304]
add dword [ebp - 4], 0x23f
push 0x20
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
pop esi
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, ebx
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x4406958], 0xfa9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4406954]
cmove eax, edx
xor edx, edx
cmp dword [0x4406958], 0x3eb
mov dword [0x4406954], eax
mov eax, dword [0x4402d5c]
cmove eax, edx
add ecx, ebx
mov dword [0x4402d5c], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov eax, dword [ebp - 8]
xor edx, ecx
add eax, dword [ebp - 0x1c]
mov ecx, dword [0x4406958]
xor eax, edx
mov dword [0x4406950], 0xf4ea3dee
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
cmp ecx, 0x213
jne 0x401546
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea eax, [ebp - 0xc4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x44c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov eax, dword [ebp - 8]
mov ecx, dword [0x4406958]
sub edi, eax
cmp ecx, 0xc
jne 0x401554
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, edi
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov eax, edi
mov edx, dword [ebp - 4]
shr eax, cl
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0xc]
xor edx, eax
mov dword [ebp - 0xc], edx
call fcn.004013d9
mov eax, dword [ebp - 0x18]
sub dword [ebp - 4], eax
dec esi
je 0x4015a0
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
jmp 0x401450
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d75d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4187a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408e07
mov dword [ebp - 0x14], eax
cmp dword [0x817778], esi
jne 0x40d850
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d7dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d930
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d930
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d930
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x817778], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x81777c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x817780], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x817788], eax
test eax, eax
je 0x40d84d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x817784], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d875
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d868
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d88a
push 4
pop eax
jmp 0x40d932
cmp dword [ebp - 0x14], esi
je 0x40d88a
push dword [0x817778]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d86f
mov eax, dword [0x817784]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d8e8
cmp dword [0x817788], edi
je 0x40d8e8
push eax
call ebx
push dword [0x817788]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d8e8
test eax, eax
je 0x40d8e8
call ecx
test eax, eax
je 0x40d8dd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d8dd
test byte [ebp - 8], 1
jne 0x40d8e8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d918
mov eax, dword [0x81777c]
cmp eax, edi
je 0x40d915
push eax
call ebx
test eax, eax
je 0x40d915
call eax
mov esi, eax
test esi, esi
je 0x40d915
mov eax, dword [0x817780]
cmp eax, edi
je 0x40d915
push eax
call ebx
test eax, eax
je 0x40d915
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x817778]
call ebx
test eax, eax
je 0x40d930
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d932
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004041de
mov esp, ebp
pop ebp
ret
Function at 0x40d04b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40d05a
pop dword [ebp - 0x48]
mov eax, 0x9a25d57
add eax, 0xf69e7303
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x25d786a6
sub dword [ebp - 0x58], 0xd785415b
mov dword [ebp - 0x54], 0x344ee3b5
sub dword [ebp - 0x54], 0x21b9770
mov dword [ebp - 0x50], 0x87c2f8a9
add dword [ebp - 0x50], 0xc4894b85
mov dword [ebp - 0x4c], 0x3b93d16c
sub dword [ebp - 0x4c], 0x3b93d16c
lea eax, [ebp - 0x58]
push eax
mov eax, 0x833dc4aa
add eax, 0x7d031c52
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xa9ec824a
sub dword [ebp - 0x58], 0x357a18f4
mov dword [ebp - 0x54], 0xec1901b0
sub dword [ebp - 0x54], 0xaaaca03b
mov dword [ebp - 0x50], 0x25d0773f
sub dword [ebp - 0x50], 0xc2610ad3
mov dword [ebp - 0x4c], 0xac20a811
sub dword [ebp - 0x4c], 0xac20a811
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x5a511723
sub eax, 0x5a10369b
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x38854
push 0
call eax
mov ecx, 0xd6c582a8
add ecx, 0x293ac89c
xor esi, esi
add esi, eax
mov edi, 0x41f000
add edi, dword [ebp - 0x48]
mov ebx, 0x18e6bfc2
sub ebx, 0xbf6ba5b5
add dword [ebp - 0x20], 0x916295c5
mov edx, dword [edi]
xor dword [ebp - 0x14], 0x8830bbd3
xor edx, ebx
xor dword [ebp - 0x28], ebx
mov dword [esi], edx
sub dword [ebp - 0x30], 0xb2b255ff
add esi, 0x86c5bf1d
add esi, 0x793a40e7
add edi, 0x58b9af5c
add edi, 0xa74650a8
loop 0x40d178
add eax, 0x11fe3
xor ebx, ebx
add ebx, eax
add eax, 0xde0bc842
sub eax, 0xde0bc83d
mov ecx, 0x33b3aba2
add ecx, 0xcc8c545e
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4099a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x4099c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4099c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4099b8
mov eax, 1
add ebx, ebx
jne 0x4099db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4099d0
jne 0x4099ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4099d0
xor ecx, ecx
sub eax, 3
jb 0x409a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x409a72
mov ebp, eax
add ebx, ebx
jne 0x409a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x409a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x409a3c
inc ecx
add ebx, ebx
jne 0x409a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x409a1d
jne 0x409a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x409a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x409a4d
jmp 0x4099be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x409a5c
add edi, ecx
jmp 0x4099be
pop esi
mov edi, esi
mov ecx, 0xa8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x409a7a
cmp byte [edi], 1
jne 0x409a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x409a7f
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x409aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x91e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9304]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x409aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x930c]
or eax, eax
je 0x409ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x409ac9
call dword [esi + 0x9308]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x409b1f
cmp al, 0xef
ja 0x409b12
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x409af4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x409b01
mov ebp, dword [esi + 0x9310]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x9b7a]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x409b6b
sub esp, 0xffffff80
jmp 0x401d81
Function at 0x343f19f8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x343f6b04]
jne 0x34415a46
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x34419cd8], eax
mov dword [0x34419cd4], ecx
mov dword [0x34419cd0], edx
mov dword [0x34419ccc], ebx
mov dword [0x34419cc8], esi
mov dword [0x34419cc4], edi
mov word [0x34419cf0], ss
mov word [0x34419ce4], cs
mov word [0x34419cc0], ds
mov word [0x34419cbc], es
mov word [0x34419cb8], fs
mov word [0x34419cb4], gs
pushfd
pop dword [0x34419ce8]
mov eax, dword [ebp]
mov dword [0x34419cdc], eax
mov eax, dword [ebp + 4]
mov dword [0x34419ce0], eax
lea eax, [ebp + 8]
mov dword [0x34419cec], eax
mov eax, dword [ebp - 0x320]
mov dword [0x34419c28], 0x10001
mov eax, dword [0x34419ce0]
mov dword [0x34419bdc], eax
mov dword [0x34419bd0], 0xc0000409
mov dword [0x34419bd4], 1
mov eax, dword [0x343f6b04]
mov dword [ebp - 0x328], eax
mov eax, dword [0x34417ca0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x34419c20], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x34415b4c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x34419c20], 0
jne 0x34415b36
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x3440bf59
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x3440bf68
pop dword [ebp - 0x14]
mov eax, 0xdc44e32d
sub eax, 0xa80423c5
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x4175dabe
add dword [ebp - 0x24], 0xcdc6a8d
mov dword [ebp - 0x20], 0x9731f22d
sub dword [ebp - 0x20], 0x64fea5e8
mov dword [ebp - 0x1c], 0x12dbcc8d
add dword [ebp - 0x1c], 0x397077a1
mov dword [ebp - 0x18], 0x1211fd0
add dword [ebp - 0x18], 0xfedee030
lea eax, [ebp - 0x24]
push eax
mov eax, 0xc8481274
sub eax, 0x94090148
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x1bfe8f13
add dword [ebp - 0x24], 0x5873da43
mov dword [ebp - 0x20], 0xd8081706
sub dword [ebp - 0x20], 0x969bb591
mov dword [ebp - 0x1c], 0xcb5b6f21
sub dword [ebp - 0x1c], 0x67ec02b5
mov dword [ebp - 0x18], 0x6573539f
sub dword [ebp - 0x18], 0x6573539f
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xf196e002
add eax, 0x42a83126
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x41942
push 0
call eax
mov ecx, 0x522f
xor esi, esi
add esi, eax
mov edx, 0x3f3342b6
sub edx, 0xaf172b6
add edx, dword [ebp - 0x14]
mov ebx, 0xcd99e233
add dword [ebp - 0x10], 0x6d1cfec8
mov edi, dword [edx]
add dword [ebp - 8], 0x24977a6d
xor edi, ebx
mov dword [ebp - 4], 0x9957c6ef
mov dword [esi], edi
sub dword [ebp - 0xc], esi
add esi, 0xb38c23
add esi, 0xff4c73e1
add edx, 0xf3c8aa56
add edx, 0xc3755ae
loop 0x3440c080
add eax, 0x6cf5fff1
add eax, 0x930b3b9e
mov ebx, eax
add eax, 5
mov ecx, 0x343f0000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x3a115def
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x3a115dfe
pop dword [ebp - 0x4c]
mov eax, 0x6e6465fd
add eax, 0xcbacf801
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x384a0844
add dword [ebp - 0x5c], 0x16083d07
mov dword [ebp - 0x58], 0x778abad2
sub dword [ebp - 0x58], 0x45576e8d
mov dword [ebp - 0x54], 0x247995d
sub dword [ebp - 0x54], 0xb5fb552f
mov dword [ebp - 0x50], 0x83f9b7be
sub dword [ebp - 0x50], 0x83f9b7be
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xa473684b
add dword [ebp - 0x5c], 0xcfff010b
mov dword [ebp - 0x58], 0xb9473f6e
sub dword [ebp - 0x58], 0x77daddf9
mov dword [ebp - 0x54], 0x419c6761
sub dword [ebp - 0x54], 0xde2cfaf5
mov dword [ebp - 0x50], 0xc207c73c
add dword [ebp - 0x50], 0x3df838c4
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xb3f03e98
add eax, 0x8620d208
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3bcad
push 0
call eax
mov ecx, 0x9f67e179
add ecx, 0x609871ef
mov ebx, eax
mov esi, 0x3a11b600
add esi, dword [ebp - 0x4c]
mov edi, 0x38881158
sub dword [ebp - 0x20], ebx
mov edx, dword [esi]
mov dword [ebp - 0x24], 0x6106ee11
xor edx, edi
xor dword [ebp - 0x10], 0x4520ba96
mov dword [ebx], edx
add dword [ebp - 0x10], 0x69e28c6a
add ebx, 4
add esi, 0x8f2774b2
sub esi, 0x8f2774ae
loop 0x3a115f0f
add eax, 0x14073
mov ebx, eax
add eax, 0x9315afd7
add eax, 0x6cea502e
mov ecx, sym.MSOXEV.DLL_Ordinal_10
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x3a117ee9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3a1114b4]
jne 0x3a117f85
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x3a119350], eax
mov dword [0x3a11934c], ecx
mov dword [0x3a119348], edx
mov dword [0x3a119344], ebx
mov dword [0x3a119340], esi
mov dword [0x3a11933c], edi
mov word [0x3a119368], ss
mov word [0x3a11935c], cs
mov word [0x3a119338], ds
mov word [0x3a119334], es
mov word [0x3a119330], fs
mov word [0x3a11932c], gs
pushfd
pop dword [0x3a119360]
mov eax, dword [ebp]
mov dword [0x3a119354], eax
mov eax, dword [ebp + 4]
mov dword [0x3a119358], eax
lea eax, [ebp + 8]
mov dword [0x3a119364], eax
mov eax, dword [ebp - 0x320]
mov dword [0x3a1192a0], 0x10001
mov eax, dword [0x3a119358]
mov dword [0x3a119254], eax
mov dword [0x3a119248], 0xc0000409
mov dword [0x3a11924c], 1
mov eax, dword [0x3a1114b4]
mov dword [ebp - 0x328], eax
mov eax, dword [0x3a119098]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x3a119298], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x3a11808c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x3a119298], 0
jne 0x3a118075
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x460c2f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x460c3d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x4c64db
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c60c2

Function at 0x4c64e6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c624c

Function at 0x4cbbba
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cb572

Function at 0x4cbf54
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cbe28

Function at 0x401ae8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebx, section..text
push 0x67
push dword [0x4028f4]
call dword [sym.imp.USER32.dll_LoadBitmapA]
sub ebx, 0x1000
mov dword [0x4028f4], ebx
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401b11
push esp
mov eax, str.contents
mov dword [ebp - 4], eax
lea eax, [0x401187]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x4028f4]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x4028f4]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x4028f4]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x402904], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x402904]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401bc9
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401bb0
pop ebp
ret 0x10
Function at 0x6d6253aa
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6d6253f8
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d625409
push 0xd
pop eax
jmp 0x6d625433
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d62540c
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x6d6258d1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d62e944]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d628cc6
mov ebx, eax
cmp ebx, esi
je 0x6d625944
lea ecx, [ebp - 0x74]
call fcn.6d624b0c
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d6289ea
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d62595c
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d6258d1
cmp eax, esi
jne 0x6d62598e
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x6d62594c
lea ecx, [ebp - 0x74]
call fcn.6d624b0c
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d624a9d
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d624b0c
mov eax, esi
jmp 0x6d62592a