joyce8/EMBER2024-capa huggingface dataset:
Function at 0x654670
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0
mov byte [ebp + 0xa], cl
lea ecx, [ebp + 8]
push 3
mov eax, dword [esi + 0xc]
push ecx
mov byte [ebp + 8], 0xff
mov byte [ebp + 9], bl
push dword [eax + 0x150]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x6546b8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0062bd80
add esp, 0xc
push dword [ebp + 0x10]
push ebx
push str.SENT
push esi
call fcn.00653f20
add esp, 0x10
pop esi
pop ebx
pop ebp
ret

Function at 0x6547f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0x1f
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x134]
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jne 0x65494d
push edi
lea ecx, [eax + 0x1cb4]
lea edi, [eax + 0x1eb4]
mov dword [edi], ecx
cmp ecx, edi
jae 0x654840
mov byte [ecx], 0xff
inc ecx
mov dword [edi], ecx
cmp ecx, edi
jae 0x654840
mov byte [ecx], 0xfa
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x654840
mov byte [ecx], 0x1f
inc dword [edi]
movzx eax, word [eax + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x1caa]
push eax
call esi
mov edx, dword [ebp + 8]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x6548ac
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x6548ac
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x6548ac
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x6548ac
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x6548ac
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x6548ac
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov esi, dword [ebp - 4]
mov dword [esi + 0x1eb8], eax
lea ecx, [esi + 0x1cb4]
sub eax, ecx
mov dword [edi], ecx
sub eax, 2
push eax
lea eax, [esi + 0x1cb6]
push eax
push 0x3e
push ebx
call fcn.00654020
add esp, 0x10
lea eax, [esi + 0x1cb4]
push 0
push 3
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x150]
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x65490a
call edi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0062bd80
add esp, 0xc
push 4
lea eax, [esi + 0x1cb7]
push eax
push ebx
call fcn.006546d0
add esp, 0xc
lea eax, [esi + 0x1cbb]
push 0
push 2
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x150]
call dword [sym.imp.WS2_32.dll_send]
pop esi
test eax, eax
jns 0x65494c
call edi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0062bd80
add esp, 0xc
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x655a80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x74e694]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x320]
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [edi + 0x13c]
lea esi, [edi + 0x148]
push 0
add eax, 4
push eax
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x130], 0
mov dword [edi + 0x134], eax
jne 0x655b0e
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.00666bd0
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [edi + 0x130], eax
mov edx, dword [edi + 0x134]
cmp edx, 4
jge 0x655b41
push str.Received_too_short_packet
push ebx
call fcn.0062bd80
add esp, 8
mov dword [edi + 0xc], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00663ada
mov esp, ebp
pop ebp
ret
push esi
call fcn.00655690
movzx eax, ax
add esp, 4
mov dword [edi + 0xc], eax
dec eax
cmp eax, 5
ja case.0x655b5a.1
jmp dword [eax*4 + 0x655c9c]
cmp edx, 4
jle case.0x655b5a.4
push esi
call fcn.00655670
movzx ecx, word [edi + 0x144]
add esp, 4
inc ecx
cmp cx, ax
jne case.0x655b5a.4
lea eax, [edx - 4]
push eax
mov eax, dword [esi]
add eax, 4
push eax
push 1
push ebx
call fcn.0062bcd0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x655bbd
push 5
push edi
call fcn.006564f0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00663ada
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x134]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.006391d0
jmp 0x655c65
mov eax, dword [esi]
lea esi, [edx - 4]
add eax, 4
mov dword [ebp - 0x8c], eax
lea eax, [edi + 0x148]
push eax
call fcn.00655670
push esi
push dword [ebp - 0x8c]
movzx eax, ax
mov dword [edi + 8], eax
call fcn.00656620
add esp, 0xc
cmp eax, esi
jae case.0x655b5a.4
push dword [ebp - 0x8c]
push str.TFTP_error:__s
push ebx
call fcn.0062be40
jmp 0x655c65
lea eax, [edx - 2]
push eax
mov eax, dword [esi]
add eax, 2
push eax
push edi
call fcn.00655850
add esp, 0xc
test eax, eax
je case.0x655b5a.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00663ada
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x73309c
push ebx
call fcn.0062bd80
add esp, 0xc
push ebx
call fcn.006394e0
add esp, 4
test eax, eax
je 0x655b2e
push 5
push edi
call fcn.006564f0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0x2a
pop edi
pop esi
pop ebx
call fcn.00663ada
mov esp, ebp
pop ebp
ret
Function at 0x6564f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x656500
jmp dword [edx*4 + 0x656554]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00655fa0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00655cc0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00656750
push str.TFTP_finished
push 0x73309c
push ecx
call fcn.0062be40
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x73309c
push ecx
call fcn.0062bd80
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x661270
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x6612a3
push 0x2e
push edi
call fcn.00667de0
add esp, 8
test eax, eax
je 0x6612a1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x662c70
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x74e64c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x662c9d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x662ce7
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x662ced
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x662d4b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x662d10
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x662d77
mov eax, dword [esi + 4]
push 1
push 0x6b4e0c
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x6b4e0d
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x662d50
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x68360e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00683484

Function at 0x686110
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00685c63
Function at 0x1000657e
Capabilities:
Get disk information

Disassembly:
mov eax, 0x100602fb
call fcn.1005fa24
sub esp, 0x2c
push ebx
push esi
mov dword [ebp - 0x14], 0x2e71
mov ebx, ecx
cmp dword [ebp - 0x14], 0x2f50
push edi
mov dword [ebp - 0x10], esp
jle 0x10006608
push 0
push 0x601
push 0
push 0x215d
push 0x1702
push 0
push 0x10ae
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [ebp - 0x38]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100065e3
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.1000330e
inc edi
cmp edi, 0x3220
jl 0x100065c7
inc esi
cmp esi, 0x1bce
jl 0x100065c5
cmp dword [ebp - 0x14], 0x2c05
jge 0x1000661c
push str.brufbx_pviudhf_tpfaqdm_uvkeaycqp_eqxjlbvrk_argkzs_phlrsbbu_ovu_fdezjg_azpo_mkrkhajcm_nhcmafem_inmt_ipqnvfvk
call fcn.10048e5f
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x10006709
mov dword [ebp - 0x20], 0x1513
cmp dword [ebp - 0x20], 0x18c6
jle 0x10006691
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], 0x941
mov ebx, edi
mov dword [ebp - 0x14], 0x6fa7
xor esi, esi
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x1007cff8
cdq
push edx
push eax
call fcn.10002e68
inc esi
cmp esi, 0x5524
jl 0x10006653
dec ebx
dec dword [ebp - 0x14]
jne 0x10006651
mov esi, dword [ebp - 0x1c]
add edi, esi
dec dword [ebp - 0x18]
jne 0x10006648
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x57d5
jl 0x1000663f
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x1b5c
push 0x1f17
push 0x1114
push 0x3af
push 0xfa
push 0x247e
push 0xba6
push 0x3f3
push 0x9e3
push 0x16c7
push 0x22cc
call dword [sym.imp.GDI32.dll_StretchBlt]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x132c
jge 0x100066ed
mov edx, str.omoo_gryjcacc_sodr_jybj
mov ecx, 0x1007cff8
call fcn.100050b8
jmp 0x10006717
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xfffffffb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000764f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x10], 0
mov byte [ebp - 4], dl
je 0x1000768a
cmp byte [ebp + 8], 0
je 0x1000767b
push 0
push 0x2113
push 0xfbf
push 0x1bcb
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
jmp 0x100076c2
push 0x17f8
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x100076c2
test dl, dl
je 0x1000769d
cmp byte [ecx], 0
je 0x100076c2
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x100076c2
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100076c2
push esi
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 2
jl 0x100076af
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10007731
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov dword [ebp - 8], 0x903
cmp dword [ebp - 8], 0xc2f
push esi
push edi
jle 0x100077ae
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
lea ecx, [ebp - 0x20]
cdq
idiv ebx
mov eax, esi
sub eax, edx
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10007780
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.1000330e
inc ebx
cmp ebx, 0x18e3
jl 0x10007762
inc edi
cmp edi, 0x1e26
jl 0x10007760
inc esi
cmp esi, 0x6102
jl 0x1000775e
mov edx, dword [ebp + 8]
push 0x6df5
push 0
push ecx
push ecx
call fcn.100077dd
add esp, 0x10
cmp dword [ebp - 8], 0x829
jge 0x100077d6
push str.tefj_lunwkix_rlh_wcwfuz_zhwhole_dxkycib_zjvz_ncam_auple_fxkfpj
call fcn.10048e5f
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008188
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x100081a7
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1000822b
mov dword [esp + 0x14], 0x612
cmp dword [esp + 0x14], 0x90a
jle 0x100081fc
xor esi, esi
xor edi, edi
mov ebx, 0x1de7
mov eax, edi
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100081da
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000330e
add edi, esi
dec ebx
jne 0x100081c2
inc esi
cmp esi, 0x60b1
jl 0x100081bb
mov byte [esp + 0x13], 0
cmp dword [esp + 0x14], 0x3e6
jge 0x10008216
push str.rsog_dhvg_agopcol_elzgy_dzbl_qjgfnfqym_byxwtln
call fcn.10048e5f
pop ecx
push ecx
push 0
push 0x3db3
push ecx
lea edx, [esp + 0x23]
call fcn.1000591c
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000825a
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov eax, 0x1006037f
call fcn.1005fa24
sub esp, 0x34
push ebx
push esi
xor ebx, ebx
mov esi, edx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], esi
cmp byte [ebp + 8], bl
je 0x1000832a
mov dword [ebp - 0x20], 0x233c
cmp dword [ebp - 0x20], 0x2469
jle 0x100082ec
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], 0x5f33
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100082b9
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.1000330e
dec esi
dec dword [ebp - 0x18]
jne 0x1000829e
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x36b1
jl 0x10008294
inc edi
cmp edi, 0x4870
jl 0x1000828f
mov esi, dword [ebp - 0x28]
cmp dword [ebp - 0x20], 0x2103
jge 0x10008300
push str.rvwyhww_dorf_ubavvxv_xib_fftrq_pncltsosq_ztiuvkx_yaaxwuz_hugmoae_cglzta_raq_xepnsnud_owpxmnrlm
call fcn.10048e5f
pop ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], ebx
jmp 0x10008314
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xe35a12a2
inc dword [edx]
cmp dword [edx], 4
jl 0x10008307
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0x4fc6
cmp dword [ebp - 0x24], 0x505b
jle 0x1000839c
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, esi
mov dword [ebp - 0x20], ebx
cdq
idiv edi
mov edi, edx
mov esi, ebx
mov ebx, dword [ebp - 0x20]
mov eax, edi
mov ecx, 0x1007cff8
xor eax, esi
xor eax, ebx
cdq
push edx
push eax
call fcn.10002e68
inc esi
cmp esi, 0xfc
jl 0x10008353
inc ebx
push 0
mov dword [ebp - 0x20], ebx
cmp ebx, 0x5822
pop ebx
jl 0x1000834e
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x22f0
jl 0x10008344
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x60cf
jl 0x1000833f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100083b1
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x4db7
jge 0x10008319
mov edx, str.earkec_ebpipw_darmcpsv_gazj_xvx_jtn_pyjxk_aoereyf_zwpdwacl_whw_bsdchzl_agja_amd
mov ecx, 0x1007cff8
call fcn.100050b8
jmp 0x10008319
Function at 0x1000861e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0xc], 0
push ebx
push esi
mov ebx, edx
push edi
mov dword [esp + 0x14], ebx
je 0x10008643
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x100086f3
mov dword [esp + 0x10], 0x49ac
cmp dword [esp + 0x10], 0x4c7f
jle 0x100086ab
xor esi, esi
xor edi, edi
xor ebx, ebx
lea ecx, [ebx + edi]
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10008678
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000330e
inc ebx
cmp ebx, 0x4aa6
jl 0x1000865b
inc edi
cmp edi, 0x69c4
jl 0x10008659
inc esi
cmp esi, 0x4781
jl 0x10008657
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x10], 0x48d9
jge 0x100086c0
push str.vuapd_ibnmpplb_goszetwte_xgtexrq_djtbd_hnxtdiv_rpogx_rdtc_ejasasv_eydenddk_lgmckj_kghxvrbo
call fcn.10048e5f
pop ecx
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [esi]
mov eax, dword [ebx]
cmp ecx, eax
mov ecx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x14]
setge dl
mov dword [ecx], edx
cmp dword [eax], 0xb0d58e7e
mov edx, dword [ecx]
sbb eax, eax
xor ecx, ecx
neg eax
imul edx, eax
mov eax, dword [esi]
cmp edx, eax
mov eax, dword [ebp + 0x18]
setne cl
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100089da
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100603a5
call fcn.1005fa24
sub esp, 0x24
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10008a19
mov dword [ecx], 0
jmp 0x10008a0f
mov dword [ebp - 0x20], 0xffffffff
cmp dword [ebp - 0x20], 0
jne 0x10008b12
dec dword [ecx]
cmp dword [ecx], 0xffffffec
je 0x100089fc
jmp 0x10008b12
mov dword [ebp - 0x20], 0x6054
cmp dword [ebp - 0x20], 0x62b7
jle 0x10008a70
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, ebx
mov ecx, 0x1007cff8
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10002e68
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x4c26
jl 0x10008a34
inc ebx
cmp ebx, 0x4346
jl 0x10008a2f
inc edi
cmp edi, 0x328b
jl 0x10008a2d
inc esi
cmp esi, 0x3b4d
jl 0x10008a2b
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5d6b
jge 0x10008a8c
mov edx, str.qoopo_ltxw_luexd
mov ecx, 0x1007cff8
call fcn.100050b8
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x24], 0x90a23371
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jne 0x10008af5
lea eax, [ebp - 0x18]
mov dword [ebp - 0x2c], 1
push eax
push 0x1aee
push 0x5379
push ecx
push 0
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0xa8628405
push eax
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x24]
call fcn.10005848
add esp, 0x20
jmp 0x10008b12
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0xc3b03c3f
push eax
lea eax, [ebp - 0x18]
push 0
push eax
lea ecx, [ebp - 0x24]
call fcn.100076e8
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a8e2
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
je 0x1000a9d9
cmp byte [ebp + 0x1c], 0
je 0x1000a9ba
mov dword [esp + 0x14], 0x5a25
cmp dword [esp + 0x14], 0x5ab6
push 0
pop ebx
jle 0x1000a976
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1b99
push 0x792
push 0x215a
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, ebx
mov edi, esi
mov ebx, 0x616f
mov eax, edi
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000a955
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000330e
dec edi
dec ebx
jne 0x1000a93d
inc esi
cmp esi, 0x1836
jl 0x1000a936
cmp dword [esp + 0x14], 0x57d3
jge 0x1000a98b
push str.dfnmizjs_jtntnrwf_rgvjycph_japunvj_iwai_klnuu
call fcn.10048e5f
pop ecx
mov esi, dword [ebp + 0x20]
mov dword [esi], ebx
jmp 0x1000a9b3
push 0x5e43
push ebx
push 0x1907
mov byte [esp + 0x1f], bl
lea ecx, [esp + 0x1f]
push 1
mov dl, 1
call fcn.1000764f
add esp, 0x10
dec dword [esi]
cmp dword [esi], 0xffffffe2
jl 0x1000a992
jmp 0x1000a9ed
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1000a9ed
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x1000a9c8
jmp 0x1000a9ed
cmp byte [ebp + 0xc], 0
je 0x1000a9e3
dec dword [ecx]
jmp 0x1000a9ed
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000aa05
Capabilities:
Query or enumerate registry value

Disassembly:
test cl, cl
je 0x1000aa2c
cmp byte [edx], 0
je 0x1000aa3a
push 0x307f
push 1
push 0x33b0
push 1
mov dl, 1
mov ecx, 0x5861
call fcn.1000764f
add esp, 0x10
ret
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
ret
Function at 0x1000beb7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060476
call fcn.1005fa24
sub esp, 0x10
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1000bf01
push 0x7b21
push 1
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
push 0x5dee
push eax
mov dl, 1
xor cl, cl
call fcn.10008c57
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x60b6
cmp dword [ebp - 0x1c], 0x60fe
jle 0x1000bf48
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x5b7
mov eax, ebx
mov ecx, 0x1007cff8
xor eax, esi
cdq
push edx
push eax
call fcn.10002e68
add ebx, edi
dec dword [ebp - 0x18]
jne 0x1000bf1e
inc edi
cmp edi, 0x4765
jl 0x1000bf15
inc esi
cmp esi, 0x2562
jl 0x1000bf13
push 0
push 0x12ef
push 0x501
push 0x1a5c
push 0x4e
call dword [sym.imp.USER32.dll_SetScrollRange]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5d0a
jge 0x1000bef0
mov edx, str.ieplvs_ejftskoe_lwsriswrl_mmnrkutwi_tum_kzfq_pdqclr
mov ecx, 0x1007cff8
call fcn.100050b8
jmp 0x1000bef0

Function at 0x1000c0a3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006048a
call fcn.1005fa24
sub esp, 0x1c
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov esi, ecx
je 0x1000c0f1
mov dword [esi], 0
cmp dword [esi], 1
jge 0x1000c0e0
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
and dword [eax + ecx*4], 0
inc dword [esi]
cmp dword [esi], 1
jl 0x1000c0d1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x6366
cmp dword [ebp - 0x1c], 0x66f2
jle 0x1000c161
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
and dword [ebp - 0x24], 0
mov ecx, ebx
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x20], esi
sar esi, cl
mov eax, esi
mov ecx, 0x1007cff8
xor eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.10002e68
inc ebx
cmp ebx, 0x7910
jl 0x1000c11b
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x1e0
jl 0x1000c10d
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x719a
jl 0x1000c108
inc edi
cmp edi, 0x46e5
jl 0x1000c103
mov edi, dword [ebp - 0x28]
mov dword [edi], 1
jmp 0x1000c174
push ecx
mov cl, 1
call fcn.100070ed
dec dword [edi]
pop ecx
cmp dword [edi], 0
jge 0x1000c169
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6175
jge 0x1000c0e0
mov edx, str.dcf_fpz_kavusnvi_rksblab_tzckos_gnndb_lcwc_cvzpo_sxqwrgled_wzpokpht_vaxcq
mov ecx, 0x1007cff8
call fcn.100050b8
jmp 0x1000c0e0