joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001080
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
push esi
push edi
xor esi, esi
mov dword [ebp - 8], str.SoftwareClassesCLSID7347baa5_ddad_428a_bbed_3a95b53237f7
mov dword [ebp - 4], str.SoftwareClasses.pdfShellEx8895b1c6_b41f_4c1c_a562_0d564250836f
xor edi, edi
test esi, esi
js 0x1000110d
mov eax, dword [ebp + edi*4 - 8]
push eax
push 0x80000002
call ebx
test eax, eax
jle 0x100010bf
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x100010cb
xor esi, esi
inc edi
cmp edi, 2
jb 0x100010a1
test esi, esi
js 0x1000110d
lea ecx, [ebp - 4]
push ecx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPreviewHandlers
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000110d
mov edx, dword [ebp - 4]
push str.7347baa5_ddad_428a_bbed_3a95b53237f7
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001120
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jle 0x10001157
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x100011c4
mov edx, dword [esi + 0xc]
test edx, edx
je 0x10001190
mov eax, edx
push edi
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001166
mov ecx, dword [esi + 8]
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
mov edx, dword [ebp + 8]
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
jmp 0x100011a8
mov ecx, dword [esi + 8]
mov edx, dword [ebp + 8]
push 4
lea eax, [esi + 0x10]
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jle 0x100011b6
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
ret

Function at 0x100017a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
test eax, eax
jne 0x100017ae
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
pop ebp
ret 0xc

Function at 0x100017d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
test eax, eax
jne 0x100017de
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
pop ebp
ret 0xc
Function at 0x10001f40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10001fb2
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x10001f81
cmp eax, 2
jne 0x10001f9c
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x10001fac
test eax, eax
je 0x10001fa7
test al, 1
jne 0x10001f9c
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x10001fac
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10002410
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b4b38
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1011b92c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.100b3865
push eax
lea ecx, [ebp - 0x1c]
call fcn.100b3334
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x28]
xor edi, edi
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x1000246e
mov eax, dword [ecx]
mov edx, dword [eax + 0x68]
call edx
mov ecx, dword [esi + 0x28]
cmp ecx, edi
je 0x1000246b
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
mov dword [esi + 0x28], edi
mov eax, dword [esi + 0x2c]
cmp eax, edi
je 0x10002489
push eax
mov eax, dword [0x1011b990]
mov ecx, dword [eax + 0x11c]
call ecx
add esp, 4
mov dword [esi + 0x2c], edi
mov eax, dword [esi + 0x30]
cmp eax, edi
je 0x100024a2
mov edx, dword [0x1011b980]
push eax
mov eax, dword [edx + 0x74]
call eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [esi + 0x34]
cmp ecx, edi
je 0x100024c3
mov edx, dword [ecx]
mov eax, dword [edx + 0x68]
call eax
mov ecx, dword [esi + 0x34]
cmp ecx, edi
je 0x100024c0
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov dword [esi + 0x34], edi
add esi, 0x3c
mov eax, esi
lea edx, [eax + 2]
jmp 0x100024d0
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x100024d0
sub eax, edx
sar eax, 1
je 0x100024f7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
push edi
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call sub.mfc100u.dll_AFX_MAINTAIN_STATE2::AFX_MAINTAIN_STATE2
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10002f80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call fcn.100b3865
push eax
lea ecx, [ebp - 0x10]
call fcn.100b3334
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call esi
mov ecx, 0x8000
test cx, ax
je 0x10002fb1
mov edi, 1
push 0xa2
call esi
mov edx, 0x8000
test dx, ax
jne 0x10002fd3
push 0xa3
call esi
mov ecx, 0x8000
test cx, ax
je 0x10002fd6
or edi, 2
push 0x20
call esi
mov edx, 0x8000
test dx, ax
je 0x10002fe7
or edi, 0x40
lea ecx, [ebp - 0x10]
call sub.mfc100u.dll_AFX_MAINTAIN_STATE2::AFX_MAINTAIN_STATE2
mov ax, di
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c7e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x84], 2
jne 0x1000c7f6
xor al, al
pop esi
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
movzx ecx, word [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0x10]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1000c81f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x1000c828
pop edi
pop ebx
xor al, al
pop esi
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
mov ebx, eax
call dword [sym.imp.MSVCR100.dll_malloc]
mov ecx, dword [esi + 0x84]
mov dword [esi + ecx*4 + 0x74], eax
mov edx, dword [esi + 0x84]
mov eax, dword [esi + edx*4 + 0x74]
push edi
push ebx
push eax
call sub.MSVCR100.dll_memcpy
mov ecx, dword [esi + 0x84]
add esp, 0x10
push 1
mov dword [esi + ecx*4 + 0x7c], edi
mov edx, dword [esi + 0x20]
inc dword [esi + 0x84]
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop ebx
mov al, 1
pop esi
pop ebp
ret 0xc
Function at 0x1000c8d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b4fbb
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x1011b92c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
mov eax, dword [esi + 0x88]
cmp dword [esi + eax*4 + 0x74], 0
mov dword [ebp - 0x218], ebx
je 0x1000ca3e
lea ecx, [ebx + 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_CopyRect]
push 0xf0f0f0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [ebx + 0x18]
mov edi, eax
push edi
lea eax, [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, 0xffff8000
test dx, ax
setne al
cmp byte [esi + 0x8c], 0
je 0x1000c987
mov edx, dword [ebx + 0x18]
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x200
or eax, 0x10
push eax
push 4
lea ecx, [ebp - 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawFrameControl]
mov eax, dword [esi + 0x88]
mov ecx, dword [esi + eax*4 + 0x7c]
mov edx, dword [esi + eax*4 + 0x74]
push 4
push ecx
push edx
lea ecx, [ebp - 0x214]
call sym.NitroPDFPreviewHandler.dll_public:_void___thiscall_CxImage::constructor_unsigned_char___unsigned_long_int__unsigned_long_int_
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x214]
cdq
sub eax, edx
mov esi, eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0
cdq
sub eax, edx
mov edi, eax
sar esi, 1
sar edi, 1
call sym.NitroPDFPreviewHandler.dll_public:_unsigned_long_int___thiscall_CxImage::GetWidth_void_const
lea ecx, [ebp - 0x214]
mov ebx, eax
call sym.NitroPDFPreviewHandler.dll_public:_unsigned_long_int___thiscall_CxImage::GetHeight_void_const
mov ecx, eax
mov eax, ebx
cdq
sub eax, edx
mov edx, dword [ebp - 0x218]
sar eax, 1
sub esi, eax
push 0
sub edi, eax
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x1c], esi
add esi, ecx
push 0
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], edi
add edi, ebx
push eax
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], esi
call sym.NitroPDFPreviewHandler.dll_public:_long_int___thiscall_CxImage::Draw_struct_HDC_____struct_tagRECT_const___struct_tagRECT___bool_
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - method.CxImage.virtual_0], vtable.CxImage.0
call sym.NitroPDFPreviewHandler.dll_public:_bool___thiscall_CxImage::DestroyFrames_void_
lea ecx, [ebp - 0x214]
call sym.NitroPDFPreviewHandler.dll_public:_bool___thiscall_CxImage::Destroy_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b3ac1
mov esp, ebp
pop ebp
ret 4
Function at 0x1001ede0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b58fe
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1011b92c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x1011bbd0], 1
jne 0x1001ee34
or dword [0x1011bbd0], 1
xor ebx, ebx
mov ecx, 0x1011bbc0
mov dword [ebp - 4], ebx
call fcn.1001d880
push 0x100b6760
call fcn.100b3def
add esp, 4
jmp 0x1001ee36
xor ebx, ebx
push 2
lea eax, [ebp - 0x10]
push eax
push 0x20001004
push 0x400
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [ebp + 0xc], ebx
jne 0x1001ee57
mov dword [ebp + 0x10], ebx
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push ebx
push esi
push ecx
call dword [sym.imp.USER32.dll_CharNextExA]
mov edi, eax
cmp edi, esi
je 0x1001eed9
lea esp, [esp]
mov ecx, dword [ebp - 0x10]
push 1
lea edx, [ebp + 8]
push edx
mov eax, edi
sub eax, esi
push eax
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, 1
jne 0x1001eead
mov edx, dword [ebp + 8]
push edx
mov ecx, 0x1011bbc0
call fcn.1001c9e0
test eax, eax
js 0x1001eead
cmp ebx, dword [ebp + 0x10]
jge 0x1001eeaa
mov ecx, dword [ebp + 0xc]
mov byte [ebx + ecx], al
inc ebx
jmp 0x1001eec4
cmp esi, edi
je 0x1001eec4
cmp ebx, dword [ebp + 0x10]
jge 0x1001eebe
mov dl, byte [esi]
mov eax, dword [ebp + 0xc]
mov byte [ebx + eax], dl
inc esi
inc ebx
cmp esi, edi
jne 0x1001eeb1
mov ecx, dword [ebp - 0x10]
push 0
push edi
push ecx
mov esi, edi
call dword [sym.imp.USER32.dll_CharNextExA]
mov edi, eax
cmp edi, esi
jne 0x1001ee70
cmp dword [ebp + 0xc], 0
je 0x1001eee6
mov eax, dword [ebp + 0x10]
cmp ebx, eax
jg 0x1001eee8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001ef00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
push 0x400
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
push edi
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1001ef7f
push edi
push 0
push esi
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 4]
add esp, 0xc
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jg 0x1001ef89
push esi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push esi
call fcn.1001ede0
push esi
mov edi, eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100496ea
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x1004971c
push esi
call fcn.10049da2
cmp byte [esi + 0x40], 0
pop ecx
je 0x10049715
mov dword [esi + 0x14], 0xcf
mov al, 1
jmp 0x100497ac
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x10049789
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x1004977e
mov eax, dword [esi + 8]
test eax, eax
je 0x1004973d
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x190]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x1004977a
cmp eax, 2
je 0x1004977e
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10049732
cmp eax, 3
je 0x10049761
cmp eax, 1
jne 0x10049732
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x10049732
mov ecx, dword [esi + 0x11c]
add dword [eax + 8], ecx
jmp 0x10049732
xor al, al
jmp 0x100497ac
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x100497a7
cmp eax, 0xcc
je 0x100497a7
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.10049522
pop esi
pop ebp
ret
Function at 0x1005b870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1005b5f5
mov ah, 0x64
loope 0x1005b8d4
lea eax, [ebp - 0x58]
push eax
call fcn.1005b605
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1005b5ba
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1005b8e3
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1005b5f5
mov ch, 0x47
sub byte [esi - 0x73], 0x45
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x1005ba50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jecxz 0x1005babc
mov byte [ebp - 0x1c], 0x2b
call fcn.1005b605
push eax
push esi
push dword [ebp + 8]
call fcn.1005b5ba
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1005b5f5
sti
invalid
jmp esp
js 0x1005baa8
sub byte [eax - 0x8363], cl
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
invalid
jmp 0xf855816
invalid
invalid

Function at 0x1005ba90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.1005b5f5
mov byte [0x8da0a91d], al
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid
Function at 0x1005ccc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
cld
add eax, dword [ebp - 0x678]
push eax
lea eax, [ebp - 0x38c]
push eax
call fcn.1005b566
add esp, 0xc
mov eax, dword [ebp - 0x38c]
mov ecx, dword [ebp - 0x678]
lea eax, [ecx + eax + 4]
mov dword [ebp - 0x3ac], eax
push 4
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.1005b566
add esp, 0xc
mov eax, dword [ebp - 0x678]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax + 4]
mov dword [ebp - 0x748], eax
mov eax, dword [ebp - 0x3ac]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax + 4]
mov dword [ebp - 0x6f8], eax
and dword [ebp - 0x700], 0
jmp 0x1005cd45
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x38c]
jae 0x1005cd97
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
movsx ecx, byte [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 0x748]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
not eax
mov ecx, dword [ebp - 0x748]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
jmp 0x1005cd38
and dword [ebp - 0x700], 0
jmp 0x1005cdad
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x688]
jae 0x1005cdff
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
movsx ecx, byte [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
not eax
invalid
Function at 0x10084d30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1011b92c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
mov bl, byte [edx + 8]
push esi
mov dword [ebp - 0x18], eax
cmp bl, 3
je 0x10084efc
mov ecx, dword [edx]
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x1c], 0
test bl, 2
je 0x10084d95
movzx eax, byte [edx + 9]
movzx edi, byte [esi]
mov ebx, eax
sub ebx, edi
movzx edi, byte [esi + 1]
mov dword [ebp - 0x14], ebx
mov ebx, eax
sub ebx, edi
movzx edi, byte [esi + 2]
sub eax, edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
mov edi, 3
jmp 0x10084da7
movzx edi, byte [esi + 3]
movzx ebx, byte [edx + 9]
sub ebx, edi
mov dword [ebp - 0x14], ebx
mov edi, 1
test byte [edx + 8], 4
je 0x10084dbc
movzx esi, byte [esi + 4]
movzx ebx, byte [edx + 9]
sub ebx, esi
mov dword [ebp + edi*4 - 0x14], ebx
inc edi
xor esi, esi
test edi, edi
jle case.0x10084e05.3
cmp dword [ebp + esi*4 - 0x14], 0
jg 0x10084dd7
mov dword [ebp + esi*4 - 0x14], 0
jmp 0x10084dde
mov dword [ebp - 0x1c], 1
inc esi
cmp esi, edi
jl 0x10084dc6
cmp word [ebp - 0x1c], 0
je case.0x10084e05.3
movzx esi, byte [edx + 9]
add esi, 0xfffffffe
cmp esi, 0xe
ja case.0x10084e05.3
movzx esi, byte [esi + 0x10084f20]
jmp dword [esi*4 + 0x10084f0c]
mov edx, dword [edx + 4]
test edx, edx
je case.0x10084e05.3
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
dec edx
jne 0x10084e17
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b3ac1
mov esp, ebp
pop ebp
ret
mov edi, dword [edx + 4]
mov esi, eax
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov edx, 0xf0
sar edx, cl
mov ebx, 0xf
sar ebx, cl
and dl, 0xf0
or dl, bl
test edi, edi
je case.0x10084e05.3
lea ebx, [ebx]
mov bl, byte [esi]
mov cl, al
shr bl, cl
inc esi
and bl, dl
dec edi
mov byte [esi - 1], bl
jne 0x10084e60
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b3ac1
mov esp, ebp
pop ebp
ret
imul ecx, edi
xor ebx, ebx
mov esi, eax
mov dword [ebp - 0x18], ecx
test ecx, ecx
je case.0x10084e05.3
mov edi, edi
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi - 1], cl
cmp ebx, dword [ebp - 0x18]
jb 0x10084e90
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b3ac1
mov esp, ebp
pop ebp
ret
imul ecx, edi
xor ebx, ebx
mov esi, eax
mov dword [ebp - 0x18], ecx
test ecx, ecx
je case.0x10084e05.3
xor edx, edx
mov eax, ebx
div edi
movzx eax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc ebx
add esi, 2
movzx ecx, word [ebp + edx*4 - 0x14]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, dword [ebp - 0x18]
jb 0x10084ec3
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100b3ac1
mov esp, ebp
pop ebp
ret
Function at 0x1008d400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, edx
jb 0x1008d479
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call sub.MSVCR100.dll_memcpy
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x1008d450
sub eax, ebx
jmp 0x1008d452
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x1008d441
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x1008d46f
sub eax, ebx
jmp 0x1008d471
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x1008d460
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x1008d4d3
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, esi
add edx, dword [edi + 0x38]
mov esi, eax
push edx
call fcn.1008d100
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x1008d4bf
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx eax, byte [esi]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x1008d4d3
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x1008d405
pop esi
pop ebx
ret

Function at 0x100b3ac1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1011b92c]
jne 0x100b3acb
repz ret
jmp fcn.100b443b

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx