joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469e90
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48abc8]
cmp dword [eax + 0x30], 0
je 0x469f3a
cmp dword [ebx + 0x94], 0
jne 0x469f34
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x469e20
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x469f34
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x469efa
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x469f34
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418fc0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x469f09
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46aa9c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46aad1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004041cc
jmp 0x46aade
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404130
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46bbd8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46bc19
mov eax, esi
call fcn.00451d10
test al, al
je 0x46bc19
mov eax, dword [ebx + 0x84]
call fcn.00451a0c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46bc19
push 0
mov eax, dword [ebx + 0x84]
call fcn.00451a0c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x47a248
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x47a250
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x47a442
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x47a458
mov eax, esi
call fcn.004780d4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404130
lea ecx, [ebp - 0x10]
mov edx, 0x47a46c
mov eax, esi
call fcn.004780d4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404130
lea ecx, [ebp - 0x14]
mov edx, 0x47a484
mov eax, esi
call fcn.004780d4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404130
lea ecx, [ebp - 0x18]
mov edx, 0x47a4a0
mov eax, esi
call fcn.004780d4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404130
lea ecx, [ebp - 0x1c]
mov edx, 0x47a4bc
mov eax, esi
call fcn.004780d4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404130
lea ecx, [ebp - 0x24]
mov edx, 0x47a4d4
mov eax, esi
call fcn.004780d4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004083b8
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408798
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x47a4ec
mov eax, esi
call fcn.004780d4
mov eax, dword [ebp - 0x28]
call fcn.00471a94
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x47a4fc
mov eax, esi
call fcn.004780d4
mov eax, dword [ebp - 0x2c]
call fcn.00471a94
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x47a514
mov eax, esi
call fcn.004780d4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408798
inc eax
je 0x47a3e5
lea ecx, [ebp - 0x34]
mov edx, 0x47a514
mov eax, esi
call fcn.004780d4
mov eax, dword [ebp - 0x34]
call fcn.0040875c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.00409dd4
fstp qword [ebp - 0x3c]
wait
call fcn.0040a138
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x47a400
lea ecx, [ebp - 0x40]
mov edx, 0x47a514
mov eax, esi
call fcn.004780d4
mov eax, dword [ebp - 0x40]
call fcn.00471a94
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x47a524
mov eax, esi
call fcn.004780d4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a449
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404100
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404100
ret
Function at 0x481164
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4811be
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00481154
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00470700
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00470300
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4811c5
lea eax, [ebp - 4]
call fcn.004040dc
ret
Function at 0x486ee8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040458c
mov eax, dword [ebp - 0xc]
call fcn.0040458c
xor eax, eax
push ebp
push 0x487104
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.00402a24
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00408c88
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
call fcn.004043e8
mov eax, dword [ebp - 0x14]
call fcn.00408b28
test al, al
je 0x486f74
push 1
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x416ef0]
call fcn.0041bccc
mov dword [ebp - 0x10], eax
jmp 0x486f8b
push 0xffff
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x416ef0]
call fcn.0041bccc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4870c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
call fcn.00483674
xor edx, edx
mov dword [eax + 0x20], edx
xor eax, eax
push ebp
push 0x4870ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, 0x48711c
call fcn.004046e0
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.0040463c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00481e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4870b6
mov eax, dword [ebp - 0x10]
call fcn.004032c8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x328], 0
je 0x4870ab
mov eax, dword [ebp - 0x14]
call fcn.00408b28
test al, al
je 0x4870ab
xor eax, eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], 3
lea eax, [ebp - 0x44]
mov ecx, 0x487128
mov edx, dword [ebp - 0x14]
call fcn.004043e8
mov eax, dword [ebp - 0x44]
call fcn.0040459c
mov dword [ebp - 0x2e], eax
mov eax, 0x48712c
mov dword [ebp - 0x2a], eax
mov word [ebp - 0x26], 0x410
lea eax, [ebp - 0x36]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x4870ab
lea ecx, [ebp - 0x18]
mov edx, 0x487138
mov eax, dword [ebp - 0xc]
call fcn.00408bf4
lea edx, [ebp - 0x4c]
xor eax, eax
call fcn.00402a24
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00408c88
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
call fcn.004043e8
mov eax, dword [ebp - 0x18]
call fcn.00408b28
test al, al
je 0x4870ab
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00408b50
ret
Function at 0x44feb2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
test byte [esi + 0x24], 1
je 0x450278
cmp byte [ebp + 0x10], 1
push edi
jne 0x44fef1
mov eax, dword [esi + 0x14]
add eax, 0xfffffffe
cmp eax, 5
ja 0x450277
jmp dword [eax*4 + 0x407a9c]
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x450277
cmp edi, 0xd
jge 0x450277
mov eax, dword [edi*4 + 0x768270]
dec edi
push ebx
push 0x1b7
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0
call int.0050de96
mov bl, byte [ebp + 0x14]
cmp eax, 1
je 0x44ff3d
cmp bl, 1
jne 0x4501f3
mov eax, dword [edi*4 + 0x7682a4]
cmp eax, 8
jg 0x44ff4e
cmp dword [esi + 0x14], eax
jg 0x44ff57
cmp bl, 1
jne 0x4501f3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x7682f0]
mov dword [0x779070], 0
mov dword [0x779074], 0xffffff
mov ecx, 0xff
mov edi, 0x779078
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push esi
push 0x6c1be0
push 0x316
push 0x6c1b38
mov ecx, 0x77c500
mov dword [ebp - 0x20], 0x779070
call fcn.0044d7e2
cmp bl, 1
jne 0x45003c
cmp dword [ebp - 4], 0x7d0
jbe 0x44ffea
push 0
push 0
push 0
push 0
push 0
push 0x10006
push 8
push 0xa4
push esi
push esi
push 0x6c1be0
push 0x323
push 0x6c1b38
mov ecx, 0x77c340
call fcn.0044d112
cmp dword [esi + 0x14], 0x18
je 0x45001e
xor dword [esi + 0x21], edx
pop eax
push ebx
jb 0x44fff7
or dl, byte [esi]
popal
adc al, 0x70
pop esp
int 0xd
inc edi
mov edx, 0x91c1a1c0
hlt
ret 0xd5ce
push ebx
and byte [ecx], ah
lds ecx, [0x10c8415e]
in al, dx
fxch st(4)
mov al, 0x93
and al, bh
xchg ebp, eax
out dx, al
rol dword [0xe920539a], 0xd1
push edx
or esi, dword [edx - 0xb]
xchg ecx, eax
popal
inc ebx
or al, 0x60
insb byte es:[edi], dx
jo 0x45003c
mov dh, 0xb0
ror dword [ecx], cl
adc dl, byte [ebp - 0x6c21a55]
mov ah, 0xf1
int1
xor eax, esp
push edx
mov dl, 0x69
push ebx
add eax, 0x65ca1066
push eax
inc esp
iretd
pop ebp
loope 0x4501e4
xor eax, 0x4759c5e1
pop ecx
inc edi
push ebp
mov edi, 0xffa86be9
loop 0x450229
push es
pushal
aad 0x5a
sub al, 0x41
inc ecx
xor byte [esi], 0x46
insb byte es:[edi], dx
xchg dword [edi + 0x65], eax
or dl, ah
test dword [esi - 0x59], eax
je 0x45022c
inc ebp
mov byte [0x6683871a], al
inc ebx
into
jo 0x4501de
push 0x725c8ac0
pop edi
int1
pop esp
xor eax, 0x55d6484
xor eax, 0x175a649a
and esp, dword [ecx - 0x53]
mov cl, 0xb
mov ch, 0xf8
mov byte [0xe5162853], al
or esp, ebx
sbb ecx, 0x4a
xor dword [edx - 0x5d], edx
mov dl, ch
shl dword ss:[ecx + 0x4f], cl
push ss
in eax, 9
fadd qword [ebx + 0x52314ad9]
mov dword [0xd336d58a], eax
popal
dec edi
adc esi, ebp
pop ebp
pop ecx
invalid
inc edx
jbe 0x4502a6
push ebx
push 0x50
arpl word [eax - 0x7d6b7688], sp
xor dl, 0xf0
mov byte [ebx + 0x5acaa17a], bl
in eax, dx
imul esp, dword [ebp + 0x26], 0x779761d7
sbb byte [ebx - 0x24], dh
or al, 7
mov dword [edx], esp
invalid
nop
loop 0x45029a
test dword [esi], edi
dec ecx
xchg esi, esp
mov dl, 0x8f
aad 0x11
inc esp
mov esi, 0xc7130d21
pushfd
xor dl, dh
sub cl, 0x26
mov cl, 0x1d
fld qword [esi]
int3
Function at 0x4cae9d
Capabilities:
Encode data using xor

Disassembly:
add esp, dword [ebp - 0x612e7767]
and al, 2
rcr byte cs:[ebx], 8
xor eax, 0xe29aba6d
idiv byte [eax + 0x386983aa]
call 0x1c536997
or byte [esi + 0x15], bl
js 0x4caea5
add byte [edx - 0x66c1adc4], 0x68
push 0x5a8a4fe8
mov byte [esp + ebx*8], ch
inc esp
xchg edi, eax
sti
dec edi
enter 0x4076, 0xffffffffffffff98
fistp qword [ebx]
bound edx, qword [ecx - 0x53]
aad 0xca
sub al, 0x92
fnstcw word [ecx + 0x695a5fad]
cmp dword [eax + 0x2a], esi
mov bh, 0x17
sbb dl, byte [ebp + 0x14bfd05]
sbb bl, al
arpl word [esi - 0x71], dx
sbb edx, esp
inc ecx
salc
mov al, 0x78
dec ecx
scasd eax, dword es:[edi]
fdivr dword [ebx]
dec eax
stc
call 0x19be40ba
dec eax
lodsb al, byte [esi]
or bl, bh
invalid

Function at 0x4cb789
Capabilities:
Encode data using xor

Disassembly:
cli
push edi
cmc
mov bl, 0x2f
or al, 0x3e
sub edi, dword [ebx]
mov ebx, 0x9748e002
mov dword [ebx], eax
dec edi
imul ebx, dword [edx + edi + 0x7d], 0x3391e193
xchg esp, eax
insd dword es:[edi], dx
fst dword [edx + 0x3e861e24]
mov ebx, 0x2ea8d844
cmc
or dword [edi - 0x6f], ebx
adc byte [ecx*8 + 0x4e58ba39], 2
sub dword [esi + 0x14], esi
sbb dword [ecx + 0x7807bdb9], edx
out 0x17, eax
mov dl, byte [edi - 0x40]
jae 0x4cb7ce
or byte [eax + 0x7f296b58], ah
mov eax, 0xb8a88834
sub eax, ecx
push esp
invalid
out 0x8e, al
mov dl, 0x68
and al, 0x1b
scasb al, byte es:[edi]
mov eax, 0x1018fb0c
cmp byte [eax + 0x44], dh
cmp eax, 0x420ba4ab
push es
pop esp
popal
js 0x4cb723
aaa
lodsb al, byte [esi]
cmp eax, ebp
insd dword es:[edi], dx
fldcw word [edi]
or byte [ecx + 0x1578e058], cl
adc bh, bh
sbb dword [edx + 0x6a], ebx
enter 0xffffffffffffd1da, 0x51
fcmovbe st(0), st(1)
push ecx
movsb byte es:[edi], byte [esi]
mov ebp, ds
push ebx
mov ebx, 0x99094859
dec eax
mov dword [esp + edx*2 + 0x68], eax
dec eax
sal byte [eax], 1
cmp ah, byte [ebx]
clc
cmp ch, al
xor al, 0x17
call edi
call 0xd84bcf07
push esp
and ebp, dword [edx + 0x19]
jnp 0x4cb7b6
jle 0x4cb7fc
dec ebx
stc
sub byte [ebx + 0x57], bh
mov gs, word [eax + 0xa]
push 0x69
bound ecx, qword [ecx - 0x27]
and dh, byte [edx + 0x7a]
dec ebx
push ds
cli
test eax, 0xd9787338
pop edi
xchg ecx, eax
sub dword [ebp - 3], 0xfffffff4
mov bh, 0xbc
lahf
mov dword [0x22ae4784], eax
sub al, byte [edx + 0x614b776a]
lahf
fdivr dword [ebx + 0x48]
pop ebp
xchg ebp, eax
mov ecx, 0xf3371598
int1
inc edi
cmp edi, edx
sub dword [ecx], esp
dec ecx
mov eax, 0xc4493854
mov ebx, dword [ecx]
sbb byte [ecx], 0x99
xor al, 0xf7
loopne 0x4cb82d
invalid
mov al, byte [0x7c4812e5]
cmp dword [ebp - 0x27d701c8], esp
or cl, byte ds:[edx - 0x46]
imul dword [eax - 0x12510177]
dec esi
dec ebx
push esp
cld
mov byte [esp + ecx + 0x685b07d9], bh
out 0x18, al
and byte [edx], dl
cld
and esi, dword [eax]
cwde
rcl bl, 0x76
ret
Function at 0x55b197
Capabilities:
Encode data using xor

Disassembly:
lahf
insb byte es:[edi], dx
push ecx
aas
or eax, dword [esi*4 + 0x505810f8]
das
aad 0xc
imul byte [eax]
cmp byte [eax + 0x462ca8f7], 0x3a
xchg esi, eax
imul dword [eax - 0x69c5b9d4]
salc
mov ah, 0x55
call 0x3ecd7dab
test byte [edi + ecx*4], bh
xor ah, byte [eax + 0x18]
mov cl, 0x60
pushal
xchg ecx, eax
jnp 0x55b162
or al, 0xe5
sbb al, 0xc9
mov dword [0x8081a292], eax
xor byte [eax - 0x76261aff], cl
pop es
invalid
lahf
cmc
das
aam 0x1c
movsb byte es:[edi], byte [esi]
and al, 0x9d
dec eax
jne 0x55b176
ror byte [ebp - 0x770f67cb], 1
push ebp
xor eax, 0x5588f098
inc esp
sub byte [ebp + 0x75], bh
lodsd eax, dword [esi]
jns 0x55b1a4
inc esp
sub byte [0x55382204], dh
cdq
add al, 0x22
cmp byte [ebp - 0x67], dl
add bh, dh
je 0x55b1f8
cmp al, 0xa1
inc esi
mov cl, 0xae
mov ebp, dword [edi - 0x676f92db]
jno 0x55b150
mov eax, dword [0x8baeb146]
scasd eax, dword es:[edi]
and eax, 0x7198906d
mov byte [ecx], al
sub al, 0xb
add dword [ebx + ecx], ebp
pop ebp
jne 0x55b1bb
js 0x55b1bc
add ch, byte [edx + edx*4 - 0x4f1f3484]
jbe 0x55b219
js 0x55b1b3
jp 0x55b198
invalid
inc edx
sti
in eax, 0x3c
jmp 0x15f32b27
adc eax, 0x7c59cd38
adc byte [ecx], 0xc6
dec eax
jmp 0x55b250
js 0x55b200
mov edi, 0x5cb1d896
or eax, 0x746a5051
cmp byte [eax], al
mov bl, ch
ljmp 0x9c73
jo 0x55b28e
xor byte [0x5c855dae], bh
loopne 0x55b286
rcr dword [eax - 0x50], cl
pop eax
mov cl, 0x56
inc ecx
pushfd
add eax, 0x1b4f35fd
fdiv st(1), st(0)
cdq
adc cl, al
or eax, 0x95ddcd8d
insb byte es:[edi], dx
test esp, ebx
mov ch, 0x44
pushal
push es
retf
loopne 0x55b274
inc ebp
stosd dword es:[edi], eax
jb 0x55b278
nop
xor ebp, dword [ebx + ebx*2 - 0x32]
insb byte es:[edi], dx
pop ebx
into
dec edx
test ah, bl
cld
cmp al, 0x44
sbb al, 0xae
mov ecx, 0xcd1c234f
ret 0x11f3

Function at 0xab6270
Capabilities:
Encode data using xor

Disassembly:
jmp 0xab627a
pushal
call 0xab6280
pop ebp
sub ebp, 0x10
sub ebp, 0x6b6270
jmp 0xab6296
mov eax, 0x6b6270
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f3
mov edx, 0x5cfcff42
xor byte [eax], dl
inc eax
dec ecx
jne 0xab62ad
jmp 0xab62c0
leave
invalid
Function at 0x10006690
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x811c9dc5
jmp 0x100066a9
movzx edx, word [ecx]
imul eax, eax, 0x1000193
xor eax, edx
add ecx, 2
cmp ecx, dword [esp + 8]
jne 0x1000669b
ret

Function at 0x10008ef7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10008f06
pop dword [ebp - 0x4c]
mov eax, 0x10008f06
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3fadf
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x911053be
add ecx, 0x6ef00eb5
xor edx, edx
add edx, eax
mov ebx, 0x10036a00
add ebx, dword [ebp - 0x4c]
mov edi, 0x3acff0c7
add edi, 0xcfa58103
sub dword [ebp - 0xc], 0x7fb7ab2f
mov esi, dword [ebx]
sub dword [ebp - 0x34], 0x847384f7
xor esi, edi
sub dword [ebp - 0x40], edi
mov dword [edx], esi
sub dword [ebp - 0xc], esi
add edx, 0xd59d788e
add edx, 0x2a628776
add ebx, 0xfeef767a
sub ebx, 0xfeef7676
loop 0x10008f57
add eax, 0x17c9f
xor ebx, ebx
add ebx, eax
add eax, 0x938f312e
add eax, 0x6c70ced7
mov ecx, 0x450082e8
add ecx, 0xcaff7d18
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x1000b06c
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x1000b0ba
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x1000b0cb
push 0xd
pop eax
jmp 0x1000b0f5
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x1000b0ce
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x1000b5af
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10008ef7
mov ebx, eax
cmp ebx, esi
je 0x1000b622
lea ecx, [ebp - 0x74]
call fcn.10009ecc
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ba56
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000b63a
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.1000b5af
cmp eax, esi
jne 0x1000b66c
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000b62a
lea ecx, [ebp - 0x74]
call fcn.10009ecc
push dword [ebp - 0x78]
mov ecx, edi
call fcn.1000af95
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10009ecc
mov eax, esi
jmp 0x1000b608
Function at 0x4081b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.Console
push SysReAllocStringLen
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4080b7
mov eax, dword [esp + 0x10]
lea ecx, [esp + 8]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x5b4aa8
push eax
call edi
cmp dword [esp + 8], 0xa
jbe 0x4081a1
push 0x7d0
push 0
push str.0:db0:lk0:hs1:ld0:ll0:hb0:pj51.4_.4202:zb0.1:bb
call fcn.0054fb10
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push str.0:db0:lk0:hs1:ld0:ll0:hb0:pj51.4_.4202:zb0.1:bb
lea edx, [esp + 0x14]
push edx
push 0
push str.IpDate
push eax
call edi
push 0
lea ecx, [esi + 0x1e]
push ecx
push 0x5b4ac8
call fcn.00407f30
push 0
lea edx, [esi + 0x21c]
push edx
push 0x5b4ad0
call fcn.00407f30
lea eax, [esi + 0x258]
push eax
push 0
push 0x5b4ad8
call fcn.00407f30
push 0
lea ecx, [esi + 0x25c]
push ecx
push 0x5b4ae0
call fcn.00407f30
push 0
lea edx, [esi + 0x45a]
push edx
push 0x5b4ae8
call fcn.00407f30
lea eax, [esi + 0x498]
push eax
push 0
push 0x5b4af0
call fcn.00407f30
add esp, 0x48
push 0
lea ecx, [esi + 0x49c]
push ecx
push 0x5b4af8
call fcn.00407f30
push 0
lea edx, [esi + 0x69a]
push edx
push 0x5b4b00
call fcn.00407f30
add esi, 0x6d8
push esi
push 0
push 0x5b4b08
call fcn.00407f30
add esp, 0x24
pop edi
pop esi
add esp, 0xc
ret
cmp byte [0x5ec5b4], 0
jne 0x408288
push str.0:db0:lk0:hs1:ld0:ll0:hb0:pj51.4_.4202:zb0.1:bb
mov byte [0x5ec5b4], 1
call fcn.0054eef4
push 0x12a0
push 0
push 0x5ea788
call fcn.0054fb10
push 0
push 0x5ea7a6
push 0x5b4b10
call fcn.00407f30
push 0
push 0x5ea9a4
push 0x5b4b18
call fcn.00407f30
push 0x5ea9e0
push 0
push 0x5b4b20
call fcn.00407f30
push 0
push 0x5ea9e4
push 0x5b4b28
call fcn.00407f30
add esp, 0x40
push 0
push 0x5eabe2
push 0x5b4b30
call fcn.00407f30
push 0x5eac20
push 0
push 0x5b4b38
call fcn.00407f30
push 0
push 0x5eac24
push 0x5b4b40
call fcn.00407f30
push 0
push 0x5eae22
push 0x5b4b48
call fcn.00407f30
push 0x5eae60
push 0
push 0x5b4b50
call fcn.00407f30
add esp, 0x3c
mov eax, 0x5ea788
jmp 0x408060
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x403e59
pop dword [ebp - 0x20]
mov eax, 0x4a5b96e6
sub eax, 0x4a1b588d
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xc5df9bd7
sub dword [ebp - 0x30], 0x778d568c
mov dword [ebp - 0x2c], 0xa5fb12da
add dword [ebp - 0x2c], 0x8c38396b
mov dword [ebp - 0x28], 0xd330b200
sub dword [ebp - 0x28], 0x86e46dd2
mov dword [ebp - 0x24], 0x9337524b
sub dword [ebp - 0x24], 0x9337524b
lea eax, [ebp - 0x30]
push eax
mov eax, 0x3c6f9d5
add eax, 0xfc79768f
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x23e96a2
sub dword [ebp - 0x30], 0x8dcc2d4c
mov dword [ebp - 0x2c], 0xc762822b
add dword [ebp - 0x2c], 0x7a09df4a
mov dword [ebp - 0x28], 0xa4a8f66c
add dword [ebp - 0x28], 0xbec67600
mov dword [ebp - 0x24], 0x4711e2b
sub dword [ebp - 0x24], 0x4711e2b
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x8c823698
add eax, 0x73be3a10
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3bf21
push 0
call eax
mov ecx, 0x5ccb
mov ebx, eax
mov esi, 0xcde37239
add esi, 0x325d8dc7
add esi, dword [ebp - 0x20]
mov edx, 0xa71e198d
sub edx, 0x3749f0ae
mov edi, dword [esi]
xor dword [ebp - 0x1c], ecx
add edi, edx
add dword [ebp - 0x14], 0x40f00a8f
mov dword [ebx], edi
sub dword [ebp - 0x10], 0xf4bd365b
add ebx, 0xbdbb0a2f
sub ebx, 0xbdbb0a2b
add esi, 0x9aca652f
add esi, 0x65359ad5
loop 0x403f75
add eax, 0x165ff
mov ebx, eax
add eax, 0x2eaedadd
sub eax, 0x2eaedad8
mov ecx, 0x434eef09
sub ecx, 0x430eef09
add ecx, dword [ebp - 0x20]
call ebx
leave
ret