joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006538
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100014dd
and dword [ebp - 4], 0
cmp dword [0x1000b5e8], 0
mov ebx, eax
jne 0x100065e9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000669a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000669a
push eax
call fcn.1000146b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1000b5e8], eax
call esi
push eax
call fcn.1000146b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1000b5ec], eax
call esi
push eax
call fcn.1000146b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1000b5f0], eax
call esi
push eax
call fcn.1000146b
pop ecx
mov dword [0x1000b5f8], eax
test eax, eax
je 0x100065e9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000146b
pop ecx
mov dword [0x1000b5f4], eax
mov eax, dword [0x1000b5f4]
cmp eax, ebx
je 0x10006641
cmp dword [0x1000b5f8], ebx
je 0x10006641
push eax
call fcn.100014e6
push dword [0x1000b5f8]
mov esi, eax
call fcn.100014e6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10006641
test edi, edi
je 0x10006641
call esi
test eax, eax
je 0x10006638
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10006638
test byte [ebp - 0xc], 1
jne 0x10006641
or dword [ebp + 0x10], 0x200000
jmp 0x1000667a
mov eax, dword [0x1000b5ec]
cmp eax, ebx
je 0x1000667a
push eax
call fcn.100014e6
pop ecx
test eax, eax
je 0x1000667a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000667a
mov eax, dword [0x1000b5f0]
cmp eax, ebx
je 0x1000667a
push eax
call fcn.100014e6
pop ecx
test eax, eax
je 0x1000667a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1000b5e8]
call fcn.100014e6
pop ecx
test eax, eax
je 0x1000669a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000669c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100147e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x10014805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x10014878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x1001483a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x1001486d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x1001486b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x10014831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x100147fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401933
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x42683f
call fcn.004256c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.004032ae
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.0040198c
lea ecx, [esi + 0x30]
call fcn.004032ae
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405386
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x405512
Capabilities:
Create directory

Disassembly:
mov eax, 0x426bd0
call fcn.004256c0
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x405535
mov al, 1
jmp 0x40557b
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x405546
xor al, al
jmp 0x40557b
lea ecx, [ebp - 0x44]
call fcn.0040573f
lea ecx, [ebp - 0x1c]
call fcn.004032ae
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0040598d
test al, al
je 0x405570
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.00403a73
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40597e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40598c
or eax, eax
ret

Function at 0x406d48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x406d57
pop dword [ebp - 0x2c]
mov eax, 0x406d57
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3b4a6
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x94ffed15
sub ecx, 0x94ff9bfe
mov edx, eax
mov edi, 0x436e00
add edi, dword [ebp - 0x2c]
mov esi, 0xdf9c0ada
add esi, 0x489c87bd
mov dword [ebp - 4], 0x9faecdde
mov ebx, dword [edi]
sub dword [ebp - 0x20], eax
xor ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0x14], eax
add edx, 0x61b9088c
sub edx, 0x61b90888
add edi, 0xa2cce21c
add edi, 0x5d331de8
loop 0x406da6
add eax, 0x1372f
mov ebx, eax
add eax, 0x4516fc72
add eax, 0xbae90393
mov ecx, 0x5188ba21
sub ecx, 0x5148ba21
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4a46e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4a46f0
pop dword [ebp - 0x24]
mov eax, 0x36c39aae
sub eax, 0x367953be
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x55ac6
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x1c7df686
sub ecx, 0x1c7db6b4
mov esi, eax
mov edi, 0xb148a9e6
sub edi, 0xb0f593e6
add edi, dword [ebp - 0x24]
mov edx, 0x775f55da
sub edx, 0x5511039
xor dword [ebp - 4], 0x109e8e8d
mov ebx, dword [edi]
xor dword [ebp - 0x20], 0x96b2b718
add ebx, edx
xor dword [ebp - 4], 0xb061cd82
mov dword [esi], ebx
add dword [ebp - 8], eax
add esi, 0x8e8cb321
add esi, 0x71734ce3
add edi, 0x84c10ab8
add edi, 0x7b3ef54c
loop 0x4a474a
add eax, 0xf21b
xor ebx, ebx
add ebx, eax
add eax, 0x497cfc19
add eax, 0xb68303ec
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x434600
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x33000]
push edi
jmp 0x43461a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x434621
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x434610
mov eax, 1
add ebx, ebx
jne 0x434633
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x434628
jne 0x434644
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x434628
xor ecx, ecx
sub eax, 3
jb 0x434658
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4346ca
mov ebp, eax
add ebx, ebx
jne 0x434663
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x434670
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x434694
inc ecx
add ebx, ebx
jne 0x434680
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x434675
jne 0x434691
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x434675
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4346b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4346a5
jmp 0x434616
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4346b4
add edi, ecx
jmp 0x434616
pop esi
mov edi, esi
mov ecx, 3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4346d2
cmp byte [edi], 0
jne 0x4346d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4346d7
lea edi, [esi + 0x32000]
mov eax, dword [edi]
or eax, eax
je 0x43474f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x633ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x63428]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x434704
mov ecx, edi
jns 0x434733
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x63430]
or eax, eax
je 0x434749
mov dword [ebx], eax
add ebx, 4
jmp 0x434721
call dword [esi + 0x6342c]
mov ebp, dword [esi + 0x63434]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x434783
sub esp, 0xffffff80
jmp 0x4011b0
Function at 0x10002c10
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
sub esp, 0x148
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov edx, 0x40
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x10]
mov ecx, dword [eax + 0x2c]
lea eax, [eax + 4]
xor ecx, dword [eax + 0x14]
xor ecx, dword [eax - 0xc]
xor ecx, dword [eax - 4]
mov dword [eax + 0x34], ecx
sub edx, 1
jne 0x10002c61
push ebx
push ebp
push esi
push edi
mov ebp, 0x4267e26c
mov dword [esp + 0x14], 0x35ac7b09
mov edi, 0x2d60319d
mov dword [esp + 0x10], edx
mov esi, 0xddbb4b82
mov ebx, 0x766db5df
lea esp, [esp]
mov ecx, edi
mov eax, esi
and eax, edi
not ecx
and ecx, ebx
mov edx, ebp
or ecx, eax
rol edx, 5
mov eax, dword [esp + 0x10]
add edx, ecx
mov ecx, ebx
mov ebx, esi
mov esi, edi
mov edi, ebp
ror esi, 2
add edx, dword [esp + eax*4 + 0x18]
mov eax, dword [esp + 0x14]
add eax, 0x5a827999
mov dword [esp + 0x14], ecx
add edx, eax
mov eax, dword [esp + 0x10]
inc eax
mov ebp, edx
mov dword [esp + 0x10], eax
cmp eax, 0x14
jl 0x10002ca0
mov dword [esp + 0x10], 0x14
lea ecx, [ecx]
mov eax, ebx
rol edx, 5
xor eax, esi
add ecx, 0x6ed9eba1
xor eax, edi
add edx, eax
mov eax, dword [esp + 0x10]
add edx, dword [esp + eax*4 + 0x18]
inc eax
add edx, ecx
mov dword [esp + 0x10], eax
mov ecx, ebx
mov ebx, esi
mov esi, edi
mov edi, ebp
ror esi, 2
mov ebp, edx
cmp eax, 0x28
jl 0x10002cf0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0x28
mov edi, edi
mov ecx, esi
rol edx, 5
or ecx, edi
mov eax, esi
and eax, edi
and ecx, ebx
or ecx, eax
mov eax, dword [esp + 0x10]
add ecx, dword [esp + eax*4 + 0x18]
mov eax, dword [esp + 0x14]
add eax, 0x8f1bbcdc
mov dword [esp + 0x14], ebx
add edx, eax
mov ebx, esi
mov eax, dword [esp + 0x10]
mov esi, edi
inc eax
ror esi, 2
add edx, ecx
mov dword [esp + 0x10], eax
mov edi, ebp
mov ebp, edx
cmp eax, 0x3c
jl 0x10002d30
mov dword [esp + 0x10], 0x3c
lea esp, [esp]
mov ecx, dword [esp + 0x10]
mov eax, ebx
xor eax, esi
rol edx, 5
add edx, dword [esp + 0x14]
xor eax, edi
add eax, 0xca62c1d6
mov dword [esp + 0x14], ebx
add eax, dword [esp + ecx*4 + 0x18]
mov ebx, esi
add edx, eax
mov esi, edi
mov eax, ecx
ror esi, 2
inc eax
mov edi, ebp
mov dword [esp + 0x10], eax
mov ebp, edx
cmp eax, 0x50
jl 0x10002d80
mov ecx, dword [esp + 0x15c]
lea eax, [edx + 0x4267e26c]
mov dword [ecx], eax
lea eax, [edi + 0x2d60319d]
mov dword [ecx + 4], eax
lea eax, [esi - 0x2244b47e]
mov dword [ecx + 8], eax
lea eax, [ebx + 0x766db5df]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
add eax, 0x35ac7b09
pop ebp
mov dword [ecx + 0x10], eax
xor eax, eax
pop ebx
add esp, 0x148
ret
Function at 0x10004f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov di, word [esp + 0x14]
movzx eax, di
test edx, edx
je 0x10004fdd
or eax, 0x20
cmp byte [ecx + 0xd], 0
movzx eax, ax
je 0x10004f3d
mov ebx, eax
add eax, 0xffffff9f
mov esi, ebx
cmp ax, 0x19
ja 0x10004f3f
mov byte [esp + 0x14], 1
mov eax, ebx
mov bl, byte [esp + 0x14]
jmp 0x10004f44
mov esi, eax
xor bl, bl
movzx eax, si
movzx ebp, ax
test edx, edx
jle 0x10004fdd
mov eax, dword [ecx]
lea esi, [eax + edx*2]
xor edx, edx
mov dword [esp + 0x14], edx
test bl, bl
je 0x10004fb0
lea ecx, [ebp - 0x61]
mov dx, 0x19
cmp dx, cx
sbb ecx, ecx
and ecx, 0x20
add ecx, 0xffdf
xor ebp, ebp
movzx ebx, cx
mov edx, eax
cmp eax, esi
jae 0x10004f94
mov edi, edi
mov cx, word [edx]
lea eax, [edx + 2]
xor cx, di
test bx, cx
je 0x10004fa1
mov edx, eax
cmp edx, esi
jb 0x10004f80
mov edx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
ret 0x10
mov ecx, 0x5f
inc ebp
mov word [edx], cx
mov dword [esp + 0x14], ebp
jmp 0x10004f78
mov ebx, 0x5f
mov ecx, eax
cmp eax, esi
jae 0x10004f98
jmp 0x10004fc0
lea eax, [ecx + 2]
cmp word [ecx], di
je 0x10004fd7
mov ecx, eax
cmp ecx, esi
jb 0x10004fc0
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
ret 0x10
mov word [ecx], bx
inc edx
jmp 0x10004fb5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x10005b80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
xor ecx, ecx
push esi
push edi
mov esi, edx
xor edi, edi
test esi, esi
je 0x10005c3c
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x208
push eax
lea eax, [esp + 0x1c]
mov edi, str.LanguagesIDM_.LNG
push eax
push ecx
push ecx
push str.ExePath
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005c50
lea eax, [esp + 0x18]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x10005c11
xor ecx, ecx
lea edi, [esp + 0x18]
mov word [eax + 2], cx
mov eax, edi
push 0x104
push eax
call fcn.100014c8
mov ecx, 0x103
sub ecx, eax
mov eax, edi
push ecx
push str.LanguagesIDM_.LNG
push eax
call dword [sym.imp.msvcrt.dll_wcsncat]
add esp, 0x14
xor eax, eax
mov word [esp + 0x21e], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0x1005569c
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005c50
movzx ecx, word [esp + 0x14]
push ecx
mov edx, edi
call fcn.10005ae0
add esp, 4
pop edi
pop esi
add esp, 0x218
ret
pop edi
xor al, al
pop esi
add esp, 0x218
ret

Function at 0x10005f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, edx
mov dword [esp + 0x14], esi
push edi
test ecx, ecx
je 0x10005f5d
test esi, esi
je 0x10005f5d
mov bl, byte [esi]
mov byte [esp + 0x13], bl
test bl, bl
je 0x10005f5d
mov ebp, dword [esp + 0x20]
mov al, bl
mov dl, 0x19
or al, 0x20
sub al, 0x61
cmp dl, al
sbb dl, dl
and dl, 0x20
add dl, 0xdf
cmp ecx, ebp
jae 0x10005f5d
lea esp, [esp]
mov al, byte [ecx]
xor al, bl
test dl, al
je 0x10005f67
inc ecx
cmp ecx, ebp
jb 0x10005f50
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov edi, esi
mov esi, ecx
jmp 0x10005f70
cmp esi, ebp
jae 0x10005fd0
mov bh, byte [edi]
mov bl, byte [esi]
lea eax, [ebx + 0x20]
movzx eax, al
lea edx, [ebx - 0x41]
mov dword [esp + 0x14], eax
cmp dl, 0x19
mov edx, dword [esp + 0x14]
movzx eax, bl
mov bl, bh
cmova edx, eax
mov al, bh
add al, 0x20
mov dword [esp + 0x14], edx
sub bl, 0x41
movzx edx, al
cmp bl, 0x19
movzx eax, bh
cmova edx, eax
cmp byte [esp + 0x14], dl
jne 0x10005fd0
inc edi
inc esi
cmp byte [edi], 0
jne 0x10005f70
sub esi, ecx
test esi, esi
jg 0x10005ff0
inc ecx
test esi, esi
je 0x10005f5d
mov bl, byte [esp + 0x13]
mov esi, dword [esp + 0x18]
jmp 0x10005f33
cmp byte [edi], 0
je 0x10005fb8
cmp esi, ebp
jae 0x10005f5d
cmp byte [esi], 0
je 0x10005f5d
mov bl, byte [esp + 0x13]
inc ecx
mov esi, dword [esp + 0x18]
jmp 0x10005f33
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x100060e0
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x1005e324]
sub esp, 0x11c
test eax, eax
jne 0x10006164
lea eax, [esp]
mov dword [esp], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1000610b
add esp, 0x11c
ret
mov edx, dword [esp + 4]
shl edx, 8
or edx, dword [esp + 8]
push esi
mov si, word [esp + 0x118]
shl edx, 8
movzx eax, si
or edx, eax
movzx eax, word [esp + 0x11a]
shl edx, 8
or edx, eax
cmp dword [esp + 8], 6
mov dword [0x1005e324], edx
mov eax, edx
jne 0x10006163
cmp dword [esp + 0xc], 0
jne 0x10006163
test si, si
jne 0x10006163
cmp byte [esp + 0x11e], 1
je 0x10006163
or eax, 0x100
mov dword [0x1005e324], eax
pop esi
add esp, 0x11c
ret
Function at 0x100066f0
Capabilities:
Encrypt data using rc4 prga
Get disk information

Disassembly:
sub esp, 0x624
push ebx
mov ebx, ecx
push ebp
push esi
push edi
cmp dword [ebx + 4], 4
jb 0x10006722
push 4
push str.___
push dword [ebx]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10006722
push 4
push eax
mov ecx, ebx
call fcn.10004c80
cmp dword [ebx + 4], 2
jb 0x1000687c
mov ecx, dword [ebx]
movzx eax, word [ecx]
test eax, 0xff00
jne 0x10006750
movzx eax, al
test byte [eax*2 + 0x10052120], 6
je 0x10006750
cmp word [ecx + 2], 0x3a
je 0x100068ba
lea eax, [esp + 0x224]
push eax
push 0x207
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1000687c
mov eax, dword [0x10055218]
lea edi, [esp + 0x224]
mov dword [esp + 0x10], eax
movzx eax, word [0x1005521c]
mov word [esp + 0x14], ax
mov ax, word [esp + 0x224]
test ax, ax
je 0x1000687c
movzx ecx, ax
jmp 0x100067a0
push 0x103
lea eax, [esp + 0x20]
mov word [esp + 0x14], cx
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10006863
lea esi, [esp + 0x1c]
lea ecx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100067d0
mov edx, dword [ebx + 4]
sub esi, ecx
sar esi, 1
cmp esi, edx
jae 0x10006863
mov ecx, dword [ebx]
cmp word [ecx + esi*2], 0x5c
jne 0x10006863
cmp word [esp + 0x220], 8
mov ebp, 0x103
jne 0x1000680e
mov ebp, 0x101
mov dword [esp + 0x18], 2
jmp 0x10006816
mov dword [esp + 0x18], 0
cmp ebp, edx
ja 0x10006863
push ebp
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10006863
cmp dword [esp + 0x18], eax
je 0x10006889
cmp ebp, dword [ebx + 4]
je 0x10006889
mov eax, dword [ebx]
movzx ecx, word [esp + ebp*2 + 0x1c]
mov dx, word [eax + ebp*2]
mov ax, 0x19
xor dx, cx
or ecx, 0x20
sub ecx, 0x61
cmp ax, cx
sbb eax, eax
and eax, 0x20
add eax, 0xffdf
test ax, dx
je 0x10006889
movzx eax, word [edi]
add edi, 2
test ax, ax
jne 0x10006863
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x100067a0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x624
ret
mov eax, dword [ebx + 4]
test eax, eax
je 0x1000689d
mov ecx, dword [ebx]
mov ax, word [esp + 0x10]
mov word [ecx], ax
mov eax, dword [ebx + 4]
cmp eax, 1
jbe 0x100068ad
mov ecx, dword [ebx]
mov ax, word [esp + 0x12]
mov word [ecx + 2], ax
add esi, 0xfffffffe
mov ecx, ebx
push esi
push 2
call fcn.10004c80
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x624
ret
Function at 0x100068d0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1210
call fcn.10001480
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x1000
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x1000699c
mov esi, dword [esp + 0x10]
lea ebp, [esp + 0x220]
xor eax, eax
shr esi, 2
mov word [esp + 0x21c], ax
test esi, esi
je 0x1000699c
mov edi, edi
mov ebx, dword [ebp]
lea ebp, [ebp + 4]
dec esi
test ebx, ebx
je 0x10006998
push ebx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10006998
push 0x104
lea eax, [esp + 0x18]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], 0
je 0x10006998
lea eax, [esp + 0x14]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
lea ecx, [esp + 0x1c]
add esp, 8
cmp eax, ecx
jbe 0x10006981
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x14]
push str.ApplicationFrameHost
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x100069a9
test esi, esi
jne 0x10006920
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1210
ret
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x1210
ret

Function at 0x100069c0
Capabilities:
Get common file path

Disassembly:
mov edx, dword [0x1005b958]
test edx, edx
jns 0x10006a06
push 0x104
push 0x1005e338
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [0x1005b958], edx
cmp edx, 0x104
jbe 0x100069ee
xor edx, edx
jmp 0x10006a00
test edx, edx
je 0x10006a06
mov eax, 0x5c
mov word [edx*2 + 0x1005e338], ax
inc edx
mov dword [0x1005b958], edx
xor eax, eax
lea ecx, [edx*2 + 0x1005e338]
mov word [ecx], ax
mov eax, 0x167
sub eax, edx
push eax
push str.SHCORE.DLL
push ecx
call dword [sym.imp.msvcrt.dll_wcsncat]
add esp, 0xc
push 0x1005e338
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
ret
Function at 0x10007220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, edx
push esi
mov esi, dword [esp + 0x1c]
push edi
push ebx
mov dword [esp + 0x18], ebx
add esi, ebp
mov dword [esp + 0x14], ecx
call dword [sym.imp.msvcrt.dll_strlen]
mov edi, eax
mov edx, ebx
push esi
mov ecx, ebp
mov dword [esp + 0x24], edi
call fcn.10005e00
add esp, 8
test eax, eax
je 0x100072f4
mov bh, byte [esp + 0x24]
mov edx, eax
add eax, edi
cmp edx, ebp
jbe 0x100072cf
mov bl, byte [edx - 1]
dec edx
movzx ecx, bl
mov cx, word [ecx*2 + 0x10052120]
shr cx, 9
test cl, 1
je 0x1000728c
cmp byte [eax], bl
jne 0x1000734f
inc eax
jmp 0x100072cf
mov edi, edx
cmp ebp, edx
ja 0x1000734b
movzx ecx, byte [ebp]
mov cl, byte [ecx*2 + 0x10052120]
and cl, 1
test cl, cl
je 0x100072b2
dec edx
cmp ebp, edx
jbe 0x100072a4
jmp 0x1000734b
sub edi, edx
js 0x1000734b
mov cl, byte [edx]
cmp cl, 0x7b
je 0x100072cf
cmp cl, 0x5b
je 0x100072cf
cmp cl, 0x2c
jne 0x1000734b
mov edi, eax
cmp eax, esi
jae 0x100072f4
jmp 0x100072e0
mov dl, byte [eax]
movzx ecx, dl
test byte [ecx*2 + 0x10052120], 1
je 0x1000730d
inc eax
cmp eax, esi
jb 0x100072e0
mov eax, dword [esp + 0x10]
mov dword [eax], 0
mov dword [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, eax
sub ecx, edi
js 0x100072f4
inc eax
cmp dl, 0x3a
jne 0x1000734b
mov edi, eax
cmp eax, esi
jae 0x100072f4
nop
mov dl, byte [eax]
movzx ecx, dl
test byte [ecx*2 + 0x10052120], 1
je 0x10007336
inc eax
cmp eax, esi
jb 0x10007320
jmp 0x100072f4
mov ecx, eax
sub ecx, edi
js 0x100072f4
mov cl, bh
xor cl, 1
shl cl, 5
add cl, 0x5b
cmp dl, cl
je 0x10007368
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ecx, eax
push esi
call fcn.10005e00
add esp, 4
test eax, eax
jne 0x10007261
jmp 0x100072f4
inc eax
mov edi, 1
mov edx, eax
cmp edx, esi
jae 0x100073d5
mov bl, byte [edx]
movzx ecx, bl
movzx ecx, word [ecx*2 + 0x10052120]
test ecx, 0x200
je 0x100073a3
inc edx
cmp edx, esi
jae 0x100073b7
mov edi, edi
mov cl, byte [edx]
cmp cl, bl
je 0x100073b7
inc edx
cmp cl, 0x5c
jne 0x1000739d
inc edx
cmp edx, esi
jb 0x10007390
jmp 0x100073b7
test ecx, 0x400
je 0x100073ae
inc edi
jmp 0x100073b7
test ecx, 0x800
je 0x100073b7
dec edi
inc edx
test di, di
jne 0x10007370
mov ecx, dword [esp + 0x10]
sub edx, eax
dec edx
sub eax, ebp
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x10]
xor edx, edx
pop edi
sub eax, ebp
pop esi
pop ebp
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
pop ebx
add esp, 8
ret