joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ffc7b
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005ffbf7
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x5ffdf3
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x5ffdf3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x5ffda2
jg 0x5ffcd4
test eax, eax
je 0x5ffd98
push 1
push 0x1000
call fcn.005f152f
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x5ffcfa
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x5ffd8f
push 0x8000
push ebx
call fcn.005eac37
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x5ffd26
jg 0x5ffd21
cmp ecx, 0x1000
jb 0x5ffd26
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.005ee903
add esp, 0x10
cmp eax, 0xffffffff
je 0x5ffd6b
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x5ffd21
jl 0x5ffd52
test ecx, ecx
jne 0x5ffd13
push dword [ebp - 0xc]
push ebx
call fcn.005eac37
push esi
call fcn.005ef059
add esp, 0xc
xor edi, edi
jmp 0x5ffe04
cmp byte [edi + 0x24], 0
je 0x5ffd82
cmp dword [edi + 0x20], 5
jne 0x5ffd82
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x5ffd8d
mov edi, dword [edi + 0x18]
jmp 0x5ffd8f
xor edi, edi
push esi
call fcn.005ef059
pop ecx
jmp 0x5ffe04
test ecx, ecx
jg 0x5ffd64
jl 0x5ffda2
test eax, eax
jae 0x5ffd64
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005ef4de
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x5ffdc5
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x5ffd64
jmp 0x5ffdfc
push ebx
call fcn.005f70a4
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x5ffd64
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x5ffe04
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x5ffe01
mov edi, dword [edi + 0x18]
jmp 0x5ffe04
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.005ef4de
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x607a90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6268f2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6a5418]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004f9250
mov dword [edi], vtable.CSkyObject.0
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea esi, [edi + 0x134]
mov byte [ebp - 4], 1
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0059852b
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1bc], 0
mov dword [edi + 0x1c0], 0
mov dword [edi + 0x1c4], 0
mov dword [edi + 0x1c8], 0x3f800000
mov dword [edi + 0x1cc], 0x3f800000
mov dword [edi + 0x1d0], 0x3f800000
mov dword [edi + 0x1d8], 0
mov dword [edi + 0x1e8], 0
mov dword [edi + 0x1ec], 0xf
mov byte [edi + 0x1d8], 0
lea ecx, [edi + 0x1f4]
mov byte [ebp - 4], 3
call fcn.00507260
mov dword [edi + 0x174], 0
mov dword [edi + 0x170], 0
mov dword [edi + 0x16c], 0
mov dword [edi + 0x168], 0
mov dword [edi + 0x160], 0
mov dword [edi + 0x15c], 0
mov dword [edi + 0x158], 0
mov dword [edi + 0x154], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x148], 0
mov dword [edi + 0x144], 0
mov dword [edi + 0x140], 0
mov dword [edi + 0x178], 0x3f800000
mov dword [edi + 0x164], 0x3f800000
mov dword [edi + 0x150], 0x3f800000
mov dword [edi + 0x13c], 0x3f800000
mov dword [edi + 0x1b4], 0
mov dword [edi + 0x1b0], 0
mov dword [edi + 0x1ac], 0
mov dword [edi + 0x1a8], 0
mov dword [edi + 0x1a0], 0
mov dword [edi + 0x19c], 0
mov dword [edi + 0x198], 0
mov dword [edi + 0x194], 0
mov dword [edi + 0x18c], 0
mov dword [edi + 0x188], 0
mov dword [edi + 0x184], 0
mov dword [edi + 0x180], 0
mov dword [edi + 0x1b8], 0x3f800000
mov dword [edi + 0x1a4], 0x3f800000
mov dword [edi + 0x190], 0x3f800000
mov dword [edi + 0x17c], 0x3f800000
mov byte [ebp - 4], 4
mov dword [edi + 0xf8], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf0], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe0], 0
mov dword [edi + 0xdc], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xd0], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xfc], 0x3f800000
mov dword [edi + 0xe8], 0x3f800000
mov dword [edi + 0xd4], 0x3f800000
mov dword [edi + 0xc0], 0x3f800000
mov ecx, dword [0x6fb5a0]
call fcn.004e3a40
mov dword [edi + 0x130], eax
mov eax, edi
mov dword [edi + 0x128], 0
mov dword [edi + 0x12c], 0
mov word [edi + 0x1f0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x60e4e0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
lea edi, [edx + eax]
mov dword [ebp - 8], edi
cmp eax, 0x10
jb 0x60e586
mov esi, dword [ebp + 0x10]
lea eax, [edi - 0x10]
push ebx
mov dword [ebp - 4], eax
lea ebx, [esi + 0x24234428]
lea edi, [esi - 0x7a143589]
lea eax, [esi + 0x61c8864f]
nop dword [eax]
imul ecx, dword [edx], 0x7a143589
sub ebx, ecx
imul ecx, dword [edx + 4], 0x7a143589
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
sub edi, ecx
imul ecx, dword [edx + 8], 0x7a143589
rol edi, 0xd
imul edi, edi, 0x9e3779b1
sub esi, ecx
imul ecx, dword [edx + 0xc], 0x7a143589
rol esi, 0xd
add edx, 0x10
imul esi, esi, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp edx, dword [ebp - 4]
jbe 0x60e520
rol eax, 0x12
rol esi, 0xc
rol edi, 7
add eax, esi
add eax, edi
rol ebx, 1
mov edi, dword [ebp - 8]
add eax, ebx
pop ebx
jmp 0x60e58e
mov eax, dword [ebp + 0x10]
add eax, 0x165667b1
add eax, dword [ebp + 0xc]
lea esi, [edx + 4]
cmp esi, edi
ja 0x60e5ba
nop dword [eax + eax]
imul ecx, dword [edx], 0x3d4d51c3
mov edx, esi
lea esi, [edx + 4]
sub eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp esi, edi
jbe 0x60e5a0
cmp edx, edi
jae 0x60e5d9
nop
movzx ecx, byte [edx]
inc edx
imul ecx, ecx, 0x165667b1
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp edx, edi
jb 0x60e5c0
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop edi
pop esi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x404b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x404b33
pop dword [ebp - 0x2c]
mov eax, 0x2510d251
sub eax, 0x24d0871e
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x647c01b6
add dword [ebp - 0x3c], 0xe9d64395
mov dword [ebp - 0x38], 0x16382180
sub dword [ebp - 0x38], 0xe404d53b
mov dword [ebp - 0x34], 0x6bd6656d
sub dword [ebp - 0x34], 0x1f8a213f
mov dword [ebp - 0x30], 0x35da1c31
add dword [ebp - 0x30], 0xca25e3cf
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x29d3d320
sub dword [ebp - 0x3c], 0xb56169ca
mov dword [ebp - 0x38], 0xe8c8be69
sub dword [ebp - 0x38], 0xa75c5cf4
mov dword [ebp - 0x34], 0xa75643fd
add dword [ebp - 0x34], 0xbc19286f
mov dword [ebp - 0x30], 0xb359fef6
sub dword [ebp - 0x30], 0xb359fef6
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x29273aab
sub eax, 0x28e50987
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x439c4
push 0
call eax
mov ecx, 0x5f8d
xor edx, edx
add edx, eax
mov edi, 0x383ae9f6
add edi, 0xc8085a0a
add edi, dword [ebp - 0x2c]
mov esi, 0xee969db5
add esi, 0x9869e5c4
sub dword [ebp - 0x20], edi
mov ebx, dword [edi]
xor dword [ebp - 0x18], 0x929add32
sub ebx, esi
add dword [ebp - 8], edi
mov dword [edx], ebx
mov dword [ebp - 0x1c], 0xfdfcc16
add edx, 0x4bf2a2f8
add edx, 0xb40d5d0c
add edi, 4
loop 0x404c4c
add eax, 0x17107
mov ebx, eax
add eax, 0x40ce15c7
add eax, 0xbf31ea3e
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45b030]
jne 0x401116
repz ret
jmp fcn.00401ea1

Function at 0x4086ae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406a72
and dword [ebp - 4], 0
cmp dword [0x45d814], 0
mov ebx, eax
jne 0x40875f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408810
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408810
push eax
call fcn.00406a00
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45d814], eax
call esi
push eax
call fcn.00406a00
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45d818], eax
call esi
push eax
call fcn.00406a00
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45d81c], eax
call esi
push eax
call fcn.00406a00
pop ecx
mov dword [0x45d824], eax
test eax, eax
je 0x40875f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406a00
pop ecx
mov dword [0x45d820], eax
mov eax, dword [0x45d820]
cmp eax, ebx
je 0x4087b7
cmp dword [0x45d824], ebx
je 0x4087b7
push eax
call fcn.00406a7b
push dword [0x45d824]
mov esi, eax
call fcn.00406a7b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4087b7
test edi, edi
je 0x4087b7
call esi
test eax, eax
je 0x4087ae
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4087ae
test byte [ebp - 0xc], 1
jne 0x4087b7
or dword [ebp + 0x10], 0x200000
jmp 0x4087f0
mov eax, dword [0x45d818]
cmp eax, ebx
je 0x4087f0
push eax
call fcn.00406a7b
pop ecx
test eax, eax
je 0x4087f0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4087f0
mov eax, dword [0x45d81c]
cmp eax, ebx
je 0x4087f0
push eax
call fcn.00406a7b
pop ecx
test eax, eax
je 0x4087f0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45d814]
call fcn.00406a7b
pop ecx
test eax, eax
je 0x408810
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408812
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cc40
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x45b030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2c3b114]
push ebx
mov ebx, dword [0x2c3af60]
push esi
mov esi, dword [0x45c050]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40cc81
push str.lefovuweceh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2c3b114]
mov dword [0x45d9ec], esi
cmp eax, 0x114e
jne 0x40ccab
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.nanucucolumisocifozoguvex
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
mov eax, dword [0x2c3b114]
cmp eax, 0x2f
jne 0x40cccd
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
call fcn.0040cbb0
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e02aad4
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e02aad4
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret

Function at 0x2e0149fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030292
call fcn.2e02e16c
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014b02
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e0148ed
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010b76
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014ac0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014ab7
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e02aad4
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014aa9
push esi
mov ecx, edi
call fcn.2e010c49
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e02aad4
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014b02
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014af9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e02aad4
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e02aad4
pop ecx
pop ecx
mov al, bl
call fcn.2e02e14a
ret 8
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e02aad4
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e02aad4
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8
Function at 0x2e01e341
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030586
call fcn.2e02e16c
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e45f
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e456
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e02aad4
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e449
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010c49
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e02aad4
test al, al
jne 0x2e01e3fc
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e02aad4
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e3ff
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e439
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e430
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e02aad4
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e02aad4
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e02aad4
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e14a
ret
Function at 0x2e02aad4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2e02aae3
pop dword [ebp - 0x2c]
mov eax, 0x2e02aae3
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x77484b77
add dword [ebp - 0x3c], 0xd709f9d4
mov dword [ebp - 0x38], 0xce2f2d4f
sub dword [ebp - 0x38], 0x9bfbe10a
mov dword [ebp - 0x34], 0xe26712c
sub dword [ebp - 0x34], 0xc1da2cfe
mov dword [ebp - 0x30], 0x9f2e0b8a
sub dword [ebp - 0x30], 0x9f2e0b8a
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xabdba1cf
add eax, 0x82277ef9
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x9dc16587
sub dword [ebp - 0x3c], 0x294efc31
mov dword [ebp - 0x38], 0x69ca6a1
add dword [ebp - 0x38], 0x3acfbad4
mov dword [ebp - 0x34], 0xed412cff
add dword [ebp - 0x34], 0x762e3f6d
mov dword [ebp - 0x30], 0xfe0a1306
add dword [ebp - 0x30], 0x1f5ecfa
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xb2a15962
sub eax, 0x849e38a6
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x431ec
push 0
call eax
mov ecx, 0x5a138687
sub ecx, 0x5a1335f0
mov ebx, eax
mov edx, 0x2e056e00
add edx, dword [ebp - 0x2c]
mov edi, 0xbe5cc7ed
add edi, 0xd3b785bf
mov esi, dword [edx]
xor dword [ebp - 0x10], 0x3ae2ecff
sub esi, edi
mov dword [ebx], esi
add ebx, 4
add edx, 0x170ff8f2
sub edx, 0x170ff8ee
loop 0x2e02abfa
add eax, 0xace0e57c
sub eax, 0xacdfb04d
mov ebx, eax
add eax, 5
mov ecx, 0xb4c24718
sub ecx, 0x86c24718
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x57f770
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x122000]
push edi
jmp 0x57f78a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x57f791
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f780
mov eax, 1
add ebx, ebx
jne 0x57f7a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x57f7b4
jne 0x57f7d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7d3
dec eax
add ebx, ebx
jne 0x57f7c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x57f798
add ebx, ebx
jne 0x57f7cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x57f825
xor ecx, ecx
sub eax, 3
jb 0x57f7eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x57f85a
sar eax, 1
mov ebp, eax
jmp 0x57f7f6
add ebx, ebx
jne 0x57f7f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7c4
inc ecx
add ebx, ebx
jne 0x57f804
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7c4
add ebx, ebx
jne 0x57f811
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x57f806
jne 0x57f822
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x57f806
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x57f844
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x57f836
jmp 0x57f786
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x57f844
add edi, ecx
jmp 0x57f786
pop esi
mov edi, esi
mov ecx, 0x40d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x57f862
cmp byte [edi], 0x11
jne 0x57f862
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x57f867
lea edi, [esi + 0x178000]
mov eax, dword [edi]
or eax, eax
je 0x57f8df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x219b38]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x219cb4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x57f894
mov ecx, edi
jns 0x57f8c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x219cb8]
or eax, eax
je 0x57f8d9
mov dword [ebx], eax
add ebx, 4
jmp 0x57f8b1
call dword [esi + 0x219cc8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x57f910
cmp al, 0xef
ja 0x57f903
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x57f8e5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x57f8f2
mov ebp, dword [esi + 0x219cbc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x57f944
sub esp, 0xffffff80
jmp 0x4204f7
Function at 0x2580fc62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x2580fc71
pop dword [ebp - 0x50]
mov eax, 0xf2a8b129
sub eax, 0xcd27b4b8
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x65a04af9
add dword [ebp - 0x60], 0xe8b1fa52
mov dword [ebp - 0x5c], 0xf172a834
add dword [ebp - 0x5c], 0x40c0a411
mov dword [ebp - 0x58], 0xa2f318cd
add dword [ebp - 0x58], 0xa9592b61
mov dword [ebp - 0x54], 0x685e57ad
sub dword [ebp - 0x54], 0x685e57ad
lea eax, [ebp - 0x60]
push eax
mov eax, 0xb309b53b
sub eax, 0x8d87e4f7
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xa2abafdc
add dword [ebp - 0x60], 0xd1c6b97a
mov dword [ebp - 0x5c], 0x24dc7fc4
add dword [ebp - 0x5c], 0x1c8fe1b1
mov dword [ebp - 0x58], 0x5d277f6d
sub dword [ebp - 0x58], 0xf9b81301
mov dword [ebp - 0x54], 0xf1ee73b0
add dword [ebp - 0x54], 0xe118c50
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3ba46
push 0
call eax
mov ecx, 0x8a4ff06d
sub ecx, 0x8a4fac35
mov edx, eax
mov esi, 0x637d300f
add esi, 0xc20565f1
add esi, dword [ebp - 0x50]
mov ebx, 0x350719ba
add ebx, 0xd87cf58
xor dword [ebp - 0x30], esi
mov edi, dword [esi]
xor dword [ebp - 0x28], 0xcd5bcbfc
xor edi, ebx
mov dword [ebp - 0x14], 0x29eaa9df
mov dword [edx], edi
add dword [ebp - 8], ecx
add edx, 4
add esi, 0xb6eab969
add esi, 0x4915469b
loop 0x2580fd8e
add eax, 0x6b8ff9a
add eax, 0xf9480419
mov ebx, eax
add eax, 5
mov ecx, 0x958cf346
add ecx, 0x8ff30cba
add ecx, dword [ebp - 0x50]
call ebx
leave
ret