joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100012c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov esi, esp
mov eax, 4
call fcn.101be810
mov eax, esp
mov ecx, 8
mov dword [esi + 0x5c], eax
mov eax, ecx
call fcn.101be810
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x58e1db
mov ecx, dword [sym.imp.USER32.dll_DestroyMenu]
mov dword [esi + 0x58], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x34d36b
mov ecx, dword [sym.imp.USER32.dll_SwitchDesktop]
mov dword [esi + 0x54], eax
call ecx
xor ecx, ecx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ecx
jmp 0x10001371
mov eax, dword [esi + 0x48]
add eax, 1
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x44]
cmp eax, 0xe5
mov dword [esi + 0x4c], eax
je 0x100013ed
jmp 0x10001371
mov eax, dword [esi + 0x40]
add eax, 1
cmp eax, 0x237
sete cl
mov dword [esi + 0x3c], eax
mov byte [esi + 0x3b], cl
mov al, byte [esi + 0x3b]
test al, 1
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x34], ecx
jne 0x10001437
jmp 0x100013f3
mov eax, dword [esi + 0x4c]
mov dword [esi + 0x80], 0x8a2
sub esp, 8
mov ecx, esp
lea edx, [esi + 0x80]
mov dword [ecx + 4], edx
mov dword [ecx], 0x884d5a
mov ecx, dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov dword [esi + 0x48], eax
call ecx
xor ecx, ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
jmp 0x100013f3
lea eax, [esi + 0x60]
mov dword [esi + 0x7c], 0xbd0
mov dword [esi + 0x78], 0xe99c26
mov ecx, dword [esi + 0x5c]
mov dword [ecx], eax
sub esp, 0x14
mov eax, esp
mov dword [eax + 0xc], ecx
lea edx, [esi + 0x78]
mov dword [eax + 8], edx
lea edx, [esi + 0x7c]
mov dword [eax + 4], edx
mov dword [eax + 0x10], 0xbd0
mov dword [eax], 0xb8ca0f
mov eax, dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
call eax
mov dword [esi + 0x2c], eax
jmp 0x10001345
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esi + 0x34]
mov ecx, 0xaf286bcb
mov dword [esi + 0x40], eax
mul ecx
mov eax, dword [esi + 0x40]
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x13
mov ecx, dword [esi + 0x40]
sub ecx, eax
mov eax, ecx
sub eax, 2
mov dword [esi + 0x28], ecx
mov dword [esi + 0x24], eax
je 0x100013a7
jmp 0x10001423
mov eax, dword [esi + 0x28]
sub eax, 9
mov dword [esi + 0x20], eax
je 0x100013a7
jmp 0x10001345
xor eax, eax
xor ecx, ecx
mov edx, dword [esi + 0x48]
sub edx, 1
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], edx
je 0x10001327
jmp 0x10001452
mov eax, dword [esi + 0x48]
sub eax, 0x4b
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], ecx
je 0x10001327
jmp 0x10001469
mov eax, dword [esi + 0xc]
sub esp, 0x10
mov ecx, esp
mov edx, dword [esi + 0x58]
mov dword [ecx + 0xc], edx
mov dword [ecx + 8], 0x612
mov dword [ecx + 4], 0x612
mov dword [ecx], 0xe5da61
mov ecx, dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov dword [esi + 8], eax
call ecx
mov ecx, dword [esi + 8]
add ecx, 1
cmp ecx, 0xa
mov dword [esi + 4], eax
mov dword [esi + 0xc], ecx
je 0x10001327
jmp 0x10001469
Function at 0x101c322e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102d7198]
jne 0x101c3238
repz ret
jmp fcn.101cc548

Function at 0x101ce02f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.101c1496
and dword [ebp - 4], 0
cmp dword [0x102d80f4], 0
mov ebx, eax
jne 0x101ce0e0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x101ce191
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x101ce191
push eax
call fcn.101c1424
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x102d80f4], eax
call esi
push eax
call fcn.101c1424
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x102d80f8], eax
call esi
push eax
call fcn.101c1424
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x102d80fc], eax
call esi
push eax
call fcn.101c1424
pop ecx
mov dword [0x102d8104], eax
test eax, eax
je 0x101ce0e0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.101c1424
pop ecx
mov dword [0x102d8100], eax
mov eax, dword [0x102d8100]
cmp eax, ebx
je 0x101ce138
cmp dword [0x102d8104], ebx
je 0x101ce138
push eax
call fcn.101c149f
push dword [0x102d8104]
mov esi, eax
call fcn.101c149f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x101ce138
test edi, edi
je 0x101ce138
call esi
test eax, eax
je 0x101ce12f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x101ce12f
test byte [ebp - 0xc], 1
jne 0x101ce138
or dword [ebp + 0x10], 0x200000
jmp 0x101ce171
mov eax, dword [0x102d80f8]
cmp eax, ebx
je 0x101ce171
push eax
call fcn.101c149f
pop ecx
test eax, eax
je 0x101ce171
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x101ce171
mov eax, dword [0x102d80fc]
cmp eax, ebx
je 0x101ce171
push eax
call fcn.101c149f
pop ecx
test eax, eax
je 0x101ce171
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102d80f4]
call fcn.101c149f
pop ecx
test eax, eax
je 0x101ce191
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x101ce193
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101d17d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x102d65fc], 0
mov byte [0x102d6600], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x102d65f0], 0xde7
mov dword [0x102d65f4], 0x22fd
mov dword [0x102d65f8], 0
mov dword [ebp - 0x1c], eax
jmp 0x101d190a
mov dword [0x102d65f0], 0xa6
mov dword [0x102d65f4], 0x1ca3
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [0x102d6604], 0
mov dword [0x102d65f4], 0x1bb5
mov eax, dword [0x102d65fc]
mov ecx, dword [0x102d65f8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, 0x100
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
movzx esi, byte [ecx + edx]
mov edi, dword [ebp - 0x20]
add esi, edi
mov dword [ebp - 0x28], eax
mov eax, edx
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + edx]
add esi, edx
mov dword [0x102d6604], esi
mov dword [0x102d65f4], 0x938
mov eax, esi
cdq
mov esi, dword [ebp - 0x28]
idiv esi
mov dword [0x102d65fc], edx
mov ecx, dword [0x102d65f8]
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x102d6600], bl
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x102d6600]
mov ecx, dword [0x102d65fc]
mov byte [esi + ecx], bl
mov dword [0x102d65f4], 0x42e
mov dword [0x102d65f0], 0x178b
mov ecx, dword [0x102d65f8]
add ecx, 1
mov dword [0x102d65f8], ecx
cmp ecx, 0x100
jl 0x101d1840
jmp 0x101d1824
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x102d65f8]
add eax, 1
mov dword [0x102d65f8], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101d190a
mov dword [0x102d65f0], 0xbd0
mov dword [0x102d65f8], 0
jmp 0x101d1840
Function at 0x101d1960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [0x102d65f4], 0x8f6
mov dword [0x102d65f0], 0xfffff6fa
mov ecx, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0x6c
mov edi, edx
add edi, esi
add edi, 0x68
mov esi, dword [edi]
imul edi, eax, 0x6c
add edx, edi
add edx, 0x50
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x1d5
mov ecx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jne 0x101d198d
lea eax, [0x102c6484]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x102d65f4], 0xb99
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
call fcn.101d1d70
mov eax, dword [0x102d65f4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add eax, 0xfffff64c
mov dword [0x102d65f0], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.101d1510
mov ecx, eax
mov dword [0x102d6610], eax
mov eax, esp
mov edx, dword [ebp - 0x3c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, dword [0x102d65f4]
add edx, 0xffffef93
mov dword [0x102d65f0], edx
mov edx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
imul esi, eax, 0x6c
mov edi, edx
add edi, esi
add edi, 0x68
mov esi, dword [edi]
imul edi, eax, 0x6c
mov ebx, edx
add ebx, edi
add ebx, 0x4c
mov edi, dword [ebx]
imul ebx, eax, 0x6c
add edx, ebx
add edx, 0x50
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x4c]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
call fcn.101d1b60
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x58]
add edx, 1
cmp edx, 0x1d5
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
jne 0x101d1a70
mov dword [0x102d65f0], 0x23de
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 8], ecx
call fcn.101d20d0
xor eax, eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0x169ef7
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [0x102d65f0], 0x26a1
mov dword [edx + 4], 0x12be00
mov ecx, dword [ebp - 0x4c]
add ecx, 0x15fc09
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x1f30
mov dword [0x102d65f4], 0x1a84
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101d1bf0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x102d65f4], 0x12cc
mov dword [0x102d65f8], 0
mov dword [0x102d65fc], 0
mov dword [0x102d6608], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x101d1d68
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x102d65f4], 0x79c
mov edx, dword [0x102d65f8]
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x102d65f8], edx
mov dword [0x102d65f0], 0x11e9
mov esi, dword [0x102d65fc]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x102d65fc], edx
mov dword [0x102d65f0], 0x18c
mov ecx, dword [0x102d65f8]
mov bl, byte [edi + ecx]
mov byte [0x102d6600], bl
mov dword [0x102d65f0], 0x82
mov ecx, dword [0x102d65fc]
mov bl, byte [edi + ecx]
mov ecx, dword [0x102d65f8]
mov byte [edi + ecx], bl
mov bl, byte [0x102d6600]
mov ecx, dword [0x102d65fc]
mov byte [edi + ecx], bl
mov ecx, dword [0x102d65f4]
add ecx, 0xffffede2
mov dword [0x102d65f0], ecx
mov ecx, dword [0x102d65f8]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x102d65fc]
movzx edx, byte [edi + edx]
add edx, ecx
and edx, 0xff
mov dword [0x102d6608], edx
mov dword [0x102d65f4], 0x9b0
mov dword [0x102d65f0], 0xeba
mov bl, byte [edi + edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
movzx esi, byte [ecx + edx]
mov dword [esp], esi
movzx esi, bl
mov dword [esp + 4], esi
call fcn.10001000
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov byte [ecx + edx], al
mov dword [0x102d65f0], 0x15cf
add edx, 1
mov esi, dword [ebp - 0x10]
cmp edx, esi
mov dword [ebp - 0x20], edx
jne 0x101d1c49
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x101d1f10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x102d65f0], 0x2505
lea eax, [fcn.101d1f10]
mov dword [ebp - 4], eax
jmp 0x101d1f41
mov eax, dword [ebp - 8]
add eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
je 0x101d1f50
jmp 0x101d1f58
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
je 0x101d1f2b
jmp 0x101d1f58
mov eax, dword [ebp - 8]
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x102d65f4], 0x1296
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x101d1f41
Function at 0x101d24b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [0x102d65f0], 0x2ca5
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x102d65f0], 0x261f
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x101d2533
mov dword [0x102d65f0], 0x17cf
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x101d25c3
jmp 0x101d2606
mov dword [0x102d65f0], 0x6eb
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
jge 0x101d2549
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
jne 0x101d2512
mov eax, dword [ebp - 0x1c]
mov dword [0x102d65f4], 0x6af
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x101d2606
mov dword [0x102d65f0], 0x1f57
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x101d2606
mov eax, dword [0x102d65f4]
add eax, 0xffffec0d
mov dword [0x102d65f0], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x101d2606
mov dword [0x102d65f4], 0x681
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x101d24f0
jmp 0x101d2606
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x101d2606
mov dword [0x102d65f0], 0x23a3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x1e], dx
mov eax, 0x5b7
mov ecx, 1
mov dx, word [ebp - 0x1e]
cmp dx, 0x6c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
je 0x101d2615
mov eax, 0x1567
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x101d2615
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [0x102d65f0], ecx
add esp, 0x28
pop ebp
ret
Function at 0x1272db44
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push 0x3c
push 0x12770bb8
call fcn.1273b4d0
lea eax, [ebp - 0x1c]
push eax
push 0x12721580
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x1272dbb5
push 4
pop esi
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
push 0x12721f44
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1272dbac
cmp dword [ebp - 0x24], esi
jne 0x1272dbac
cmp dword [ebp - 0x28], edi
je 0x1272dbac
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x12773388], edi
xor eax, eax
jmp 0x1272dc17
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x12773388], edi
jge 0x1272dc12
mov dword [0x12773388], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x4c], di
jne 0x1272dc12
cmp word [ebp - 0x2c], 5
jb 0x1272dc12
mov dword [ebp - 4], edi
call fcn.1272db17
test eax, eax
je 0x1272dc0b
emms
mov dword [0x12773388], 1
jmp 0x1272dc0b
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x12773388]
call fcn.1273b515
ret

Function at 0x1272dd5b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
sub eax, 0
mov dword [ebp - 4], 4
je 0x1272de4b
dec eax
jne 0x1272de50
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.1273ba25
mov dword [0x1277baa4], 0x50
call fcn.1272db44
mov ecx, dword [0x1277baa4]
test eax, eax
je 0x1272ddaa
add ecx, ecx
mov dword [0x1277baa4], ecx
push edi
push 3
pop edi
mov eax, ecx
shl eax, 2
xor edx, edx
div edi
mov dword [0x1277ba94], ecx
mov dword [0x1277baa0], eax
lea eax, [ecx + ecx]
mov dword [0x1277ba9c], eax
mov eax, ecx
imul eax, eax, 0x28
mov dword [0x1277ba98], eax
lea eax, [ebp + 0xc]
push eax
push 0x12721580
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
pop edi
test eax, eax
jne 0x1272de3a
lea eax, [ebp - 4]
push eax
push 0x1277ba90
lea eax, [ebp + 8]
push eax
push 0
push 0x12721f8c
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1272de25
cmp dword [ebp + 8], 4
jne 0x1272de25
mov eax, dword [0x1277ba90]
cmp eax, 4
jb 0x1272de25
cmp eax, 0x80
jbe 0x1272de2f
mov dword [0x1277ba90], 0x18
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1272de44
mov dword [0x1277ba90], 0x18
call fcn.12789f4c
jmp 0x1272de50
call fcn.1275d290
xor eax, eax
inc eax
leave
ret 0xc

Function at 0x1272deb2
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x1277bbac]
test eax, eax
je 0x1272dee6
push esi
mov esi, dword [sym.imp.msvcrt.dll_fwrite]
push eax
push 1
lea eax, [ebp + 8]
push 4
push eax
call esi
push dword [0x1277bbac]
lea eax, [ebp + 0xc]
push 1
push 4
push eax
call esi
add esp, 0x20
pop esi
pop ebp
ret
Function at 0x12784486
Capabilities:
Encode data using xor

Disassembly:
call 0x127843ff
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1278442f
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1278444b
xor edx, 0
jmp 0x12784456
xor edx, edx
jmp 0x1278446d
jmp 0x12784479
xor eax, eax
push 0x8427d7c0
call 0x12784486
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x127844c2
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1278449b
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x127844d9
add eax, 0
jno 0x127844de
add esi, 0
ret 0x10

Function at 0x12785247
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x12785269
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x1278540b
cmp edi, dword [ebp + 0x10]
jb 0x1278540b
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.12784d33
inc edi
jmp 0x127852f2
jmp 0x127852ff
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.12784d33
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.12784d33
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x12785353
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x12785337
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.12785381
add dword [eax], 0x39
jle 0x1278535d
sub al, 0xf5
mov ch, al
call fcn.12785396
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10
Function at 0x1278706e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x12787084
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x12787095
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.127870d6
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx

Function at 0x12789442
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x1278938b
add ebx, 0
push ecx
call 0x127893a0
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x71dfa230
sub ebx, dword [0x71e19a6f]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x71e19a5f
call fcn.12784e6a
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.12784378
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x127894fe
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x127894fe
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x127894b5
mov eax, 1
lock xchg dword [0x71e19a6b], eax
push 0x3dd1fc71
call 0x12789442
push esi
add esp, 8
cmp eax, 0
jne 0x1278942b
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x12789451
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x12789466
cmp ecx, edx
cmp eax, 0
je 0x1278948b
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x12789475
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.127894a4
dec eax
loope 0x127894a7
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x71e19a6b], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x127894db
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x127894f0
jmp 0x127894fb
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x127893e9