joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100211ad
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.1001f290
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10021248
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x100588ac]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x10021248
cmp eax, 1
je 0x10021269
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10021248
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x10021215
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x10021244
xor eax, eax
inc eax
jmp 0x10021288
cmp edi, eax
jae 0x1002124c
xor eax, eax
jmp 0x10021288
cmp eax, esi
jae 0x10021253
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100588ac]
jmp 0x1002126c
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10022f74
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x10058ae8], ebx
push esi
push edi
jne 0x10022ff4
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1002302f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x10058ae8], eax
je 0x1002302f
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x10058aec], eax
call esi
cmp dword [0x100588ac], 2
mov dword [0x10058af0], eax
jne 0x10022ff4
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x10058af8], eax
je 0x10022ff4
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x10058af4], eax
mov eax, dword [0x10058af4]
test eax, eax
je 0x10023039
call eax
test eax, eax
je 0x10023020
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x10058af8]
test eax, eax
je 0x10023020
test byte [ebp - 8], 1
jne 0x10023039
cmp dword [0x100588b8], 4
jb 0x10023033
or byte [ebp + 0x12], 0x20
jmp 0x10023058
xor eax, eax
jmp 0x10023068
or byte [ebp + 0x12], 4
jmp 0x10023058
mov eax, dword [0x10058aec]
test eax, eax
je 0x10023058
call eax
mov ebx, eax
test ebx, ebx
je 0x10023058
mov eax, dword [0x10058af0]
test eax, eax
je 0x10023058
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x10058ae8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100243f3
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1002b2b8
call fcn.1001aea0
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x10058bd8], edi
jne 0x10024437
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10024422
mov dword [0x10058bd8], ebx
jmp 0x10024437
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x10024437
mov dword [0x10058bd8], 2
mov eax, dword [0x10058bd8]
cmp eax, ebx
jne 0x10024457
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1002451a
cmp eax, 2
je 0x10024460
cmp eax, edi
jne 0x10024488
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x10024473
mov eax, dword [0x10058a8c]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x1002448f
xor eax, eax
jmp 0x1002451a
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.1001f290
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x100244c2
cmp esi, edi
jne 0x100244d8
push dword [ebp - 0x20]
call fcn.10019e85
pop ecx
mov esi, eax
cmp esi, edi
je 0x10024488
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1002450b
cmp dword [ebp + 0x14], edi
jne 0x100244f5
push edi
push edi
jmp 0x100244fb
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x10024517
push esi
call fcn.10017899
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.1001aedb
ret
Function at 0x10024523
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1002b2c8
call fcn.1001aea0
xor esi, esi
cmp dword [0x10058bdc], esi
jne 0x10024567
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10024552
mov dword [0x10058bdc], edi
jmp 0x10024567
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x10024567
mov dword [0x10058bdc], 2
mov eax, dword [0x10058bdc]
cmp eax, 2
je 0x10024648
cmp eax, esi
je 0x10024648
cmp eax, 1
jne 0x100245ac
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x10024595
mov eax, dword [0x10058a8c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x100245b3
xor eax, eax
jmp 0x1002465a
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.1001f290
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x100245e9
cmp edi, esi
jne 0x10024604
lea eax, [ebx + ebx]
push eax
call fcn.10019e85
pop ecx
mov edi, eax
cmp edi, esi
je 0x100245ac
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10024637
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x10024621
push esi
push esi
jmp 0x10024627
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x10024643
push edi
call fcn.10017899
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x1002465a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.1001aedb
ret

Function at 0x10025580
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100255f1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x100255f1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x100255da
jmp 0x100255f1
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x10025aa0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10058d2c], 0
je 0x10025ab9
mov eax, dword [0x10058d2c]
jmp 0x10025c56
mov dword [0x10058d2c], 0x10058d04
push 0x28
push 0
push 0x10058d04
call fcn.1001fb80
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10058d04], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10058d08], eax
cmp dword [0x10058d08], 0
jne 0x10025aff
xor eax, eax
jmp 0x10025c56
push str.ImagehlpApiVersionEx
mov eax, dword [0x10058d08]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10058d0c], eax
push str.SymInitialize
mov ecx, dword [0x10058d08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10058d10], eax
push str.SymSetOptions
mov edx, dword [0x10058d08]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10058d14], eax
push str.SymGetOptions
mov eax, dword [0x10058d08]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10058d18], eax
push str.SymLoadModule
mov ecx, dword [0x10058d08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10058d1c], eax
push str.SymGetModuleInfo
mov edx, dword [0x10058d08]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10058d20], eax
push str.SymGetSymFromName
mov eax, dword [0x10058d08]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10058d24], eax
push str.BindImage
mov ecx, dword [0x10058d08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10058d28], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.1001fb80
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x10058d0c], 0
je 0x10025bdd
lea eax, [ebp - 8]
push eax
call dword [0x10058d0c]
cmp dword [0x10058d0c], 0
je 0x10025bef
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x10025c0a
mov edx, dword [0x10058d08]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10058d08], 0
xor eax, eax
jmp 0x10025c56
cmp dword [0x10058d10], 0
je 0x10025c23
push 0
push 0
mov eax, dword [0x10058d04]
push eax
call dword [0x10058d10]
cmp dword [0x10058d18], 0
je 0x10025c51
cmp dword [0x10058d14], 0
je 0x10025c51
call dword [0x10058d18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x10058d14]
mov eax, dword [0x10058d2c]
mov esp, ebp
pop ebp
ret
Function at 0x10026ba4
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.1001f290
mov eax, dword [0x10030264]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.1001d58e
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x10026cd7
push 2
push esi
push dword [ebp + 8]
call fcn.1001d58e
add esp, 0xc
cmp eax, ebx
je 0x10026cd7
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x10026c77
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.1001fb80
push 0x8000
push dword [ebp + 8]
call fcn.10026ce5
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x10026c2d
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.1001cb8c
add esp, 0xc
cmp eax, 0xffffffff
je 0x10026c4d
sub edi, eax
test edi, edi
jg 0x10026c25
jmp 0x10026c65
call fcn.1001d512
cmp dword [eax], 5
jne 0x10026c62
call fcn.1001d509
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.10026ce5
pop ecx
pop ecx
jmp 0x10026cbf
jge 0x10026cbf
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001d58e
push dword [ebp + 8]
call fcn.10020a9c
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x10026cbf
call fcn.1001d509
mov dword [eax], 0xd
call fcn.1001d512
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.1001d58e
add esp, 0xc
mov eax, esi
pop edi
jmp 0x10026cd9
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.1001fb68
leave
ret
Function at 0x4fc690
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9f000]
mov dword [edi + 0xcf740], 0x2123e092
push edi
jmp 0x4fc6ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4fc6c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fc6b0
mov eax, 1
add ebx, ebx
jne 0x4fc6d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4fc6e4
jne 0x4fc703
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fc703
dec eax
add ebx, ebx
jne 0x4fc6f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4fc6c8
add ebx, ebx
jne 0x4fc6ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4fc755
xor ecx, ecx
sub eax, 3
jb 0x4fc71b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4fc78a
sar eax, 1
mov ebp, eax
jmp 0x4fc726
add ebx, ebx
jne 0x4fc726
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fc6f4
inc ecx
add ebx, ebx
jne 0x4fc734
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fc6f4
add ebx, ebx
jne 0x4fc741
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4fc736
jne 0x4fc752
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4fc736
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4fc774
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4fc766
jmp 0x4fc6b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4fc774
add edi, ecx
jmp 0x4fc6b6
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4fc792
cmp byte [edi], 0x11
jne 0x4fc792
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4fc797
lea edi, [esi + 0xf5000]
mov eax, dword [edi]
or eax, eax
je 0x4fc80f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x113c18]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x113d94]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4fc7c4
mov ecx, edi
jns 0x4fc7f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x113d98]
or eax, eax
je 0x4fc809
mov dword [ebx], eax
add ebx, 4
jmp 0x4fc7e1
call dword [esi + 0x113da8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4fc840
cmp al, 0xef
ja 0x4fc833
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4fc815
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4fc822
mov ebp, dword [esi + 0x113d9c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4fc874
sub esp, 0xffffff80
jmp 0x420577
Function at 0x1003a72
Capabilities:
Encode data using xor

Disassembly:
push 0x60
push 0x10012a8
call fcn.01003d34
mov edi, 0x94
mov eax, edi
call fcn.01004aa0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
jmp 0x1007355
jg 0x10073be
jmp fcn.01009a74
not ah
xor edx, 0x3b68e0cb
add edx, esi
jmp 0x1007371
not edx
mov ecx, 0x4ec8
sbb edx, edx
add eax, edx
cld
jmp 0x10073be
xchg edx, eax
or dl, dl
not dl
aas
and edx, 0
xchg edx, eax
xor eax, 0xffffffb0
cwde
test edx, 0x364a1c92
or ah, dl
inc eax
dec eax
xor ah, al
cmp al, bl
inc eax
xchg edx, edx
mov edx, 0xdaa3ea27
mov edx, edi
sub ecx, 2
jmp 0x100730c
sub word [ecx + 0x10099fe], 0xfa97
sub dl, bh
sub al, bl
not eax
mov dh, 0x74
dec eax
jmp 0x1007334
Function at 0x10005460
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov eax, dword [0x10020ae4]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push str.Version
push 0x2001f
push eax
mov dword [esp + 0x10], 0
call fcn.10004010
add esp, 0xc
test al, al
jne 0x100054a6
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10005b76
add esp, 8
ret
mov eax, esi
lea edx, [eax + 2]
jmp 0x100054b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100054b0
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push 0x10017614
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 8]
mov al, 1
pop esi
xor ecx, esp
call fcn.10005b76
add esp, 8
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40673a
pop dword [ebp - 0x2c]
mov eax, 0xcc4deb9
add eax, 0xf37b8881
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xfe63c77
add dword [ebp - 0x3c], 0x3e6c08d4
mov dword [ebp - 0x38], 0x3bdfccb7
sub dword [ebp - 0x38], 0x9ac8072
mov dword [ebp - 0x34], 0x88f72fd9
sub dword [ebp - 0x34], 0x3caaebab
mov dword [ebp - 0x30], 0x797efb39
sub dword [ebp - 0x30], 0x797efb39
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xc08c211
add dword [ebp - 0x3c], 0x6869a745
mov dword [ebp - 0x38], 0x82d13b8f
sub dword [ebp - 0x38], 0x4164da1a
mov dword [ebp - 0x34], 0xb5888bc5
add dword [ebp - 0x34], 0xade6e0a7
mov dword [ebp - 0x30], 0x3f2fad55
add dword [ebp - 0x30], 0xc0d052ab
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x8b7b5e3b
add eax, 0x74c522c5
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x36639
push 0
call eax
mov ecx, 0x4b5609f7
sub ecx, 0x4b55c679
xor esi, esi
add esi, eax
mov edi, 0x4c7d4ee0
add edi, 0xb3c99520
add edi, dword [ebp - 0x2c]
mov ebx, 0x3e9bc767
xor dword [ebp - 0x24], 0x264663ec
mov edx, dword [edi]
xor dword [ebp - 0x14], 0x4d8fb4a2
xor edx, ebx
add dword [ebp - 0x20], esi
mov dword [esi], edx
xor dword [ebp - 0x14], 0x1a6e56f8
add esi, 0x72c466d8
sub esi, 0x72c466d4
add edi, 4
loop 0x406853
add eax, 0x3d67a1af
sub eax, 0x3d66a0e4
mov ebx, eax
add eax, 5
mov ecx, 0xabd9d8c3
sub ecx, 0xab99d8c3
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1017a54
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
pushal
push ebp
mov ebp, esp
sub esp, 0x108
mov esi, 2
mov ebx, 0xb
mov dword [ebp - 8], 0xe
mov dword [ebp - 0x48], 0x3d8a
mov dword [ebp - 0x34], 0x10eb2029
mov dword [ebp - 0x14], 0x6abd
mov eax, 0x432
mul dword [ebp - 0x48]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x10], eax
add dword [ebp - 0x14], 0x39e2
dec dword [ebp - 0x34]
mov eax, ebx
add eax, dword [ebp - 8]
sub eax, 0x19
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 0x1631
add dword [ebp - 0x10], 0x15d8
add dword [ebp - 0x14], 0x2e561
mov eax, dword [ebp - 0x38]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
mov ecx, ebx
sub ecx, 7
xor edx, edx
div ecx
mov dword [ebp - 0x80], eax
mov edi, eax
mov dword [ebp - 0x4c], edi
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
sub edx, 0xd
sub eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov al, byte [edx + eax]
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x34]
and edx, 0xff
xor eax, edx
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 9]
mov byte [edx + eax], cl
dec dword [ebp - 0x18]
mov eax, 0x21
cdq
idiv ebx
mov edi, eax
add edi, dword [ebp - 0x38]
cmp dword [ebp - 0x18], edi
ja 0x1017ae7
mov dword [ebp - 0x50], 0x10246cc
mov dword [ebp - 0x40], 0x10af000
inc dword [ebp - 0x2c]
mov eax, esi
add eax, ebx
sub eax, 9
cmp dword [ebp - 0x2c], eax
jbe 0x1017ac2
mov dword [ebp - 0x54], 0x104bacc
mov eax, ebx
sub eax, 0xb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x50]
mov al, byte [edx + eax]
mov byte [ebp - 9], al
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
sub edx, 0xd
sub eax, edx
mov edx, dword [ebp - 0x40]
mov cl, byte [ebp - 9]
mov byte [edx + eax], cl
cmp dword [ebp - 0x1c], 0x272ec
jb 0x1017b59
mov dword [ebp - 0x58], 0x11c2000
mov eax, ebx
add eax, esi
sub eax, 0xd
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x54]
mov al, byte [edx + eax]
mov byte [ebp - 9], al
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, esi
dec edx
sub eax, edx
mov edx, dword [ebp - 0x58]
mov cl, byte [ebp - 9]
mov byte [edx + eax], cl
cmp dword [ebp - 0x20], 0xd4c4
jb 0x1017b96
mov dword [ebp - 0x5c], 0x10000000
mov dword [ebp - 0x60], 0x105c9c8
mov dword [ebp - 4], 0x10594cc
Function at 0x10006690
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x100303c4], 0
mov dword [0x100303c8], 0
mov dword [0x100303d0], 0
mov dword [0x100303bc], 0x1a14
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x100067b7
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, dword [0x100303c4]
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x100303c4], edx
mov dword [0x100303bc], 0xfbe
mov esi, dword [0x100303c8]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x100303c8], edx
mov ecx, dword [0x100303c4]
mov bl, byte [edi + ecx]
mov byte [0x100303cc], bl
mov bl, byte [edi + edx]
mov byte [edi + ecx], bl
mov dword [0x100303bc], 0x1d46
mov bl, byte [0x100303cc]
mov ecx, dword [0x100303c8]
mov byte [edi + ecx], bl
mov ecx, dword [0x100303c4]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x100303c8]
movzx edx, byte [edi + edx]
add edx, ecx
and edx, 0xff
mov dword [0x100303d0], edx
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x24]
mov bl, byte [ecx + esi]
xor bl, byte [edi + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], bl
mov ecx, dword [0x100303c0]
add ecx, 0x374
mov dword [0x100303c0], ecx
add esi, 1
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
mov dword [ebp - 0x20], esi
jne 0x100066e9
mov dword [0x100303c0], 0x20c0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100067d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100303c0]
add eax, 0xffffe02f
mov dword [ebp - 4], eax
lea eax, [fcn.100067d0]
mov ecx, dword [0x100303bc]
add ecx, 0xffffdbc5
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
jmp 0x1000682f
mov eax, dword [ebp - 0x14]
mov dword [0x100303c0], eax
mov eax, dword [ebp - 0x18]
add esp, 0x1c
pop ebp
ret
mov eax, dword [ebp - 0x18]
add eax, 0xfffff000
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
and eax, 0xfffff000
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
cmp word [eax], 0x5a4d
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jne 0x10006813
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x10006803
jmp 0x10006813