joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc609f3
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + eax - 0x1cb0202d]
mov word ss:[edx + eax*2 - 0x39604066], cx
cdq
btr edx, 0x3a
lea esi, [esi + eax - 0x1cb02037]
mov eax, dword [eax + esi - 0x1cb02033]
shl dl, 0x61
movzx ecx, dl
xor eax, ebx
and cx, dx
jns 0xb5108e
rol edx, 3
xor ebx, edx
add ebp, edx
mov dword [esp + ecx - 0x18d79231], ecx
jmp 0xb6ecb9
setge dl
bswap eax
sbb eax, 0xcb99f89b
btr dx, dx
bswap eax
add cx, dx
js 0xd45599
and dl, 7
lea eax, [edx + eax + 0x1986b581]
sal dl, cl
xor ebx, eax
shr cx, cl
add ebp, eax
fstp qword [edi + ecx - 0x18d79231]
mul dword [esp + ecx - 0x18d79231]
mov dword [esp + ecx - 0x18d79231], ebp
ret
mov dword [esp + ecx - 0x3192d718], eax
rol edx, 2
not edx
bswap ecx
sar byte [esp + ecx - 0x18d79230], 0xe7
adc word [esp + ecx - 0x18d79230], cx
lea edx, [edx + ecx - 0x7d0705ef]
jb 0xab31d3
adc dword [ecx + 0xf], 0xffffffc8
setae dl
xor eax, 0xf1b3cf10
and byte [esp + ecx*4 - 0x3b0bafc], cl
add dl, ch
lea eax, [eax + edx + 0x886b3e9]
neg eax
dec eax
or cx, 0xa527
rol eax, 1
and dl, 0xb7
js 0xa909e4
test byte [eax], dl
jmp 0xf7ce9075
rol byte [eax - 0x77f0481e], 0x10
add bl, ah
inc dword [eax + 0x66]
sub dword [esp + ecx*2 - 0x1d95f7c], ecx
inc eax
sub word [esp + ecx*2 - 0x1d95f7c], cx
xor ebx, eax
neg cx
add dword [esp + ecx*2 - 0x1d8a082], 0x1e80c58a
jg 0xd3a267
xor edx, ebx
btr ecx, 0x1b
jb 0xb98000
insb byte es:[edi], dx
pushal
jp 0xc609bb
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
movsb byte es:[edi], byte [esi]
xchg ebp, eax
inc di
jbe 0xc609a5
cmp dword [edx + 3], esi
jp 0xc609ca
cdq
aaa
je 0xc60a0f
out 0x93, al
insb byte es:[edi], dx
push esp
out 0x12, al
outsb dx, byte [esi]
add esi, edx
and ebx, dword [ecx]
out 0xe9, al
sbb esp, edi
pop esp
shl dh, 0x30
pop ebx
pop eax
dec eax
sbb di, si
xor byte [esi + 0x3b47671b], bh
pop ebx
cli
or al, 0x42
invalid

Function at 0xc75ee9
Capabilities:
Packed with generic packer

Disassembly:
shr eax, 0xa1
inc edx
rol edx, 1
dec edx
and ecx, 0x4c21982b
inc ecx
bswap edx
shr ecx, cl
or eax, 0x929e250f
sete al
inc edx
bswap eax
not edx
not ecx
ror edx, 1
lea eax, [ecx + eax*4 + 0x1987ff39]
call fcn.00cd1266
lea esi, [esi + ecx*2 - 0x4d43c92c]
mov dword [esp + ecx*2 - 0x4d43c930], ecx
or dword [esp + ecx*2 - 0x4d43c930], ecx
neg byte [esp + ecx*2 - 0x4d43c930]
xor edx, ebx
bswap ecx
lea eax, [ecx + ecx*8 - 0x4e6a63cd]
pop eax
xor edx, 0xa38ef9aa
bt cx, cx
jae 0xb2705f

Function at 0xcaeb51
Capabilities:
Encode data using xor

Disassembly:
sbb ebp, 8
mov dword [esp], 0x70a4049f
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ecx
not dword [esp]
push 0xd1aaa806
mov eax, dword [esp + 1]
mov dword [ebp + eax - 0x60d1aaa8], edx
shl al, 0x21
mov ebx, dword [esp + eax - 0x60d1aa48]
mov ecx, 0x4aa41c8a
pop ecx
pop edx
pop eax
jbe fcn.00bc3641
Function at 0xcbe160
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, eax
xor dx, cx
ja 0xc26527
or dl, 0xa4
mov dword [ecx + edx*2 - 0xf74c], eax
lea esi, [esi + edx*2 - 0xf750]
movzx eax, dx
mov ecx, eax
and cx, 0x5228
mov edx, dword [edx + esi - 0x7ba6]
sar ecx, 0xf4
xor edx, ebx
and eax, ecx
neg edx
bswap edx
add ecx, 0x2e35002e
xor edx, 0xb13281a3
lea ecx, [ecx*2 + 0x2390d68e]
push ecx
ror edx, 1
inc eax
and al, 0xf
xor ebx, edx
inc eax
rol ax, 5
rol word [esp + eax*2 - 0x7f], 0xa5
add ebp, edx
movzx edx, al
mov dword [esp + eax*2 - 0x80], ebp
ret
and dl, 0xbd
adc ebp, eax
rdtsc
add cl, cl
sbb edi, 8
btc ecx, ecx
jae 0xc1cba4
jmp 0xad7550
mov edx, eax
mul ax
rol ecx, 3
or eax, eax
mov dword [esp + eax - 0x6ab95401], edx
rol al, 0xe7
not ecx
xor ebx, ecx
mov dword [esp + eax - 0x6ab95478], edx
dec byte [esp + edx - 0x6ab970e3]
add esi, ecx
lea ebp, [ebp + edx - 0x6ab970e6]
neg dl
dec byte [esp + eax - 0x6ab9547d]
movzx edx, byte [ebp + eax - 0x6ab95480]
mov byte [esp + eax - 0x6ab9547f], ah
mov word [esp + eax - 0x6ab9547e], ax
dec word [esp + eax - 0x6ab95476]
xor dl, bl
lea ecx, [eax*4 + 0x591daa93]
xor dl, cl
add dl, 6
bts ecx, eax
setae cl
rol dl, 1
inc dl
sub ecx, 0xce96a68b
or ecx, dword [esp + eax - 0x6ab95478]
xor bl, dl
lea edi, [edi + eax - 0x6ab95484]
mov dword [edi + ecx - 0x7ffc75f5], edx
mov dword [esp + ecx - 0x7ffc75f1], eax
btc eax, ecx
imul ax, ax
pop eax
pop edx
pop ecx
jb fcn.00af3aac
mov eax, dword [esi]
dec ecx
add esi, 4
xor eax, ebx
xor eax, 0xd801fab5
inc ecx
movzx edx, cl
btc edx, ecx
bswap eax
rol eax, 1
inc edx
bts edx, ecx
add ecx, edx
bswap eax
jno 0xbc14bf

Function at 0xcc3466
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + ecx*4 - 0x6716ef96]
mov dword [esp + ecx - 0x19c5bbe7], ecx
mov byte es:[edx + ecx - 0x19c5bbe7], al
pop eax
sub ax, ax
movsx edx, cl
lea ebp, [ebp + ecx*4 - 0x6716efa0]
not eax
mov ecx, dword [ebp + ecx - 0x19c5bbe7]
xor ecx, ebx
call fcn.00d209b3

Function at 0xcd649b
Capabilities:
Packed with generic packer

Disassembly:
adc esi, 4
sar word [esp + 3], 0xac
jns 0xcbcddf
push 0xdc0b5491
div ecx
mov byte [esp + 2], 0x92
mov ecx, 0xdcba2c12
inc cx
mov dword [esi], edx
call fcn.00b2c799
mov edx, 0x64389316
mov ax, word [edx + edi - 0x64389316]
mov dx, word [edi + edx - 0x64389314]
mov cl, byte [edi + 4]
add edi, 4
call fcn.00a690a1
bswap eax
shr cx, 0xca
ror edx, 1
pop eax
movsx eax, cx
sub ax, cx
xor ebx, edx
shl eax, 0x81
adc ebp, edx
cbw
mov edx, dword [esi + eax*2]
lea ecx, [ecx + ecx*8 + 0x5f03bf2f]
add dword [esp + eax + 4], ecx
and ax, 0xaf84
adc eax, dword [esi + ecx - 0x7e67c0db]
sub cx, 0xbe11
mov ecx, dword [esi + ecx - 0x7e6702c6]
not word [esp]
jne 0xb376c3

Function at 0xcfb9a8
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x1c]
call fcn.00b743c3
Function at 0xd28715
Capabilities:
Packed with generic packer

Disassembly:
call fcn.00a5d296
xor ebx, ecx
cdq
add ebp, ecx
pop eax
pop edx
pop ecx
jmp fcn.00cbac6c
btr ax, 0x9b
not cl
inc cl
movsx edx, byte [esp + 4]
mov dword [esp + edx - 8], edx
push eax
xor bl, cl
lea edi, [edi + edx*2 - 0x12]
xor ax, ax
shl al, 0xc3
xadd word [esp + edx*2 - 0xe], ax
mov word [edx + edi - 8], cx
sbb word [esp + edx*8 - 0x36], 0x82b3
sbb ax, word [esp + edx*8 - 0x3a]
lea esi, [edx + esi - 0xc]
shl eax, 0x92
add word [esp + edx], ax
mov ecx, dword [edx + esi - 8]
xor ecx, ebx
dec ecx
not ecx
sub ax, 0x4a19
xor al, 0x86
rol ecx, 3
dec ecx
mul dword [esp + edx]
bswap edx
jo 0xbb8ab7
sub esi, 4
mov ecx, 0x1190a1ad
movsx edx, cl
mov edx, dword [esi + ecx*2 - 0x2321435a]
xor edx, ebx
jmp 0xa5189e

Function at 0xd2b5a2
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
ja 0xc143c9
mov edx, esp
mov ecx, 0x68
mov eax, 0x98b6ea2f
sal al, 0xe2
mov dword [esp], 0x3d28da29
cmp edi, edx
jmp 0xb15a3a

Function at 0xd2c4d2
Capabilities:
Encode data using xor

Disassembly:
bts cx, dx
xor ebx, eax
add ebp, eax
movsx eax, dl
jmp 0xa9769d
mov eax, dword [edi]
pop ecx
add edi, 4
mov edx, 0xc8b74608
movzx ecx, dl
xor eax, ebx
bswap eax
sub dl, dh
inc eax
neg eax
imul edx, ecx
bswap eax
btr edx, 0x95
jb 0xbee223
sbb eax, 0x4cb6ffec
mov dh, 0x4c
call 0xfdc68ca
or dword [edi], ecx
aas
add eax, 0x6c56665f
jnp 0xd2c501
and ebp, ecx
add al, byte [eax - 0x2621fb21]
int 2
sbb bh, 4
fcompp
mov esp, 0xde20e201
daa
mov ebp, 0x34d602b8
stc
call 0xa4bfc8a5
xor dword [bx + si + 0x4d], esi
inc eax
sbb eax, dword [edx + 0x3d]
sub dword [eax - 0xd7bdbc1], esi
sti
fdivr qword [ebx + 0x1b750062]
insb byte es:[edi], dx
lodsb al, byte [esi]
imul esi, dword [esi + eax*2 - 0x1d], 0xffffffef
in eax, 0xd4
jl 0xd2c50c
sbb eax, 0xedbfb789
in eax, dx
or al, 0x9a
or al, 0xb9
sbb ah, byte cs:[edx - 0x146f6c65]
jg 0xd2c4f9
cdq
sbb eax, 0x53d1abe5
jmp 0xd2c548
Function at 0xd454e7
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edx + edi - 0x1350]
sub edx, 0x340a090a
not cx
inc cl
xor eax, ebx
inc eax
dec edx
xor eax, 0x28373286
not eax
and word [esp + ecx - 0x6805ecab], cx
jge 0xbf946c
mov eax, 0x1aa37f0a
sub eax, eax
movsx ecx, ax
or eax, dword [eax + esi]
lea esi, [esi + ecx*8 + 4]
sar ecx, 0x4e
push ecx
xor eax, ebx
movsx edx, byte [esp + ecx*4]
xor eax, 0xef132223
not byte [esp + ecx*4 + 3]
or cl, dh
sbb cl, 0x13
ror eax, 1
xchg dword [esp + edx*2], ecx
sal cx, 0xae
xor eax, 0xc522d48f
pop edx
neg eax
dec dl
xadd dl, dh
xor eax, 0x388108a2
bts ecx, 0x1b
ror ecx, 0xc5
not ecx
lea eax, [eax + edx*2 + 0x1b0130c5]
xor ebx, eax
not cx
add cl, cl
call fcn.00d1ed59
div ecx
neg dword [esp + 0xe]
mov dword [esp + 4], 0x1a001f89
mov dword [edi], edx
mov dword [edi + 4], eax
pop ecx
pop ecx
pop eax
pop edx
pop ecx
jmp esi
xor ecx, 0x85bf03aa
bswap eax
bt edx, edx
ror ecx, 3
sub dx, dx
xor dl, dh
lea ecx, [ecx + edx*2 - 0x7b535505]
rol al, 0x24
mul dx
bts edx, 0x3d
bswap ecx
cmovb dx, ax
sar edx, 0xa2
xor ebx, ecx
add ebp, ecx
div eax
inc dl
not edx
mov edx, edi
lea ecx, [eax*4 + 0x629f071f]
bts ecx, ecx
inc eax
lea edi, [edi + eax*2 - 0x1bedb67e]
mov dword [eax + edi - 0xdf6db3d], edx
lea ecx, [eax*4 - 0x6d6a3c60]
jno 0xc6c929
adc al, 0xae
nop dword [edi]
invalid
pop ecx
bswap eax
xor edx, edx
btr ecx, ecx
xor ebx, eax
not cx
inc dl
add esi, eax
lea eax, [ecx + edx*4 + 0x3d16e681]
cdq
fcomp qword [ebp + ecx - 0x6804ffab]
xadd dl, cl
btr eax, 0x96
jmp esi
cmovp ecx, eax
jge fcn.00d411df
adc dx, cx
fild dword [edi + edx*2 - 0xf600]
lea ecx, [edx + edx*4 + 0x4fb4f039]
sbb edx, edx
lea eax, [ecx*4 - 0x22ccf9c8]
mov dword [esp + edx], ebp
ret
mov ecx, 0xbc326802
movsx edx, cl
lea ebp, [ebp + edx - 6]
movzx eax, dl
mov edx, dword [ebp + edx*4 - 8]
xor edx, ebx
inc ecx
dec eax
call fcn.00ba8929
mov ecx, dword [esi]
add esi, 4
mov edx, 0x32a3e29b
movsx eax, dx
dec edx
xor ecx, ebx
shl al, 0xc1
add eax, 0x3d1931b2
cwd
bswap ecx
dec ecx
bts ax, ax
bt ax, 0xba
jae 0xbf8306
mov ecx, 0x40289aa3
ror ecx, cl
mov eax, dword [edi + ecx - 0x68051354]
push ecx
movzx edx, cx
jae 0xa7411d
sub ebp, 4
mov ecx, 0x56074c9f
movzx eax, cx
mov eax, dword [ecx + ebp - 0x56074c9f]
movzx edx, cx
inc ecx
xor eax, ebx
neg eax
not edx
btr edx, edx
lea ecx, [ecx + 0x6f09e7a1]
sbb eax, 0xef1100bf
rol cl, cl
ror ecx, cl
bts ecx, edx
not eax
bswap eax
not dl
lea edx, [ecx + edx - 0x7ef7baf2]
lea ecx, [edx + edx*8 - 0x3a425600]
xor ebx, eax
xor cl, ch
and dx, dx
dec edx
adc esi, eax
lea ebp, [ebp + edx*2 - 0x64988b9b]
shl cl, 2
inc cx
dec cl
movzx edx, byte [ebp + edx*2 - 0x64988b9a]
movsx eax, cl
xor dl, bl
or cl, cl
rol eax, 0x25
rol dl, 1
bts ax, 0x89
sbb ecx, ecx
xor dl, 0xae
ror ax, 0x21
bswap ecx
not dl
not eax
btc ecx, 0x1e
ror dl, 1
or ecx, ecx
xor bl, dl
btc cx, ax
call fcn.00b3b4ca
mov ecx, 0xe60bdf84
call fcn.00d2c4d2
jmp 0xbc6f6b
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x6ace3720
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6b5f7d35
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x139e1be0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x13aa801c]
test eax, eax
jne 0x139e1c5b
mov dword [0x13aa801c], 1
call fcn.13a075c0
test eax, eax
je 0x139e1c4b
push 0
push 0x104
push 0x13aa8020
call fcn.13a0ab70
add esp, 0xc
test eax, eax
je 0x139e1c5b
push esi
push edi
mov edi, 0x13a9138c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x13aa8020
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 0x13aa8020
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x104
push 0x13aa8020
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, 0x13aa8020
ret

Function at 0x139e2f40
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
push 0x80000002
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x139e2f9e
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x139e2f7a
push esi
call fcn.13a178c3
add esp, 4
lea eax, [eax + eax + 2]
jmp 0x139e2f7c
xor eax, eax
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 8]
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret 0xc

Function at 0x139e2fb0
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
push 0x80000002
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x139e2ff7
mov ecx, dword [esp]
lea edx, [esp + 0x10]
push 4
push edx
push 4
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret 0xc

Function at 0x139e3000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push 0x80000002
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x139e309a
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x139e3084
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.13a17a56
mov esi, eax
add esp, 4
test esi, esi
je 0x139e3084
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8
Function at 0x139e30b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push 0x80000002
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x139e3147
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
test eax, eax
jne 0x139e3131
mov eax, dword [esp + 0x18]
cmp eax, 1
jb 0x139e3131
inc eax
push eax
mov dword [esp + 0x1c], eax
call fcn.13a17a56
mov esi, eax
add esp, 4
test esi, esi
je 0x139e3131
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push esi
push eax
push 0
push edi
push ecx
call ebx
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8

Function at 0x139e3150
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
lea eax, [esp]
push eax
push ecx
push 0x80000002
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x139e31b4
mov dword [esp + 8], eax
lea edx, [esp + 0x10]
lea eax, [esp + 4]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 0xc
ret 8
Function at 0x139e4580
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
jne 0x139e4597
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx]
xor edx, edx
mov edi, dword [eax + 8]
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx + edi + 0x78]
mov ecx, dword [eax + edi + 0x1c]
add eax, edi
add ecx, edi
mov dword [ebp - 0x14], ecx
mov ebx, dword [eax + 0x18]
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
add ecx, edi
add eax, edi
cmp ebx, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
jbe 0x139e4646
mov dword [ebp - 4], ecx
mov eax, dword [ecx]
mov esi, dword [ebp + 8]
add eax, edi
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x139e460f
test cl, cl
je 0x139e460b
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x139e460f
add eax, 2
add esi, 2
test cl, cl
jne 0x139e45eb
xor eax, eax
jmp 0x139e4614
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x139e4635
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
inc edx
add ecx, 4
cmp edx, eax
mov dword [ebp - 4], ecx
jb 0x139e45e4
mov esi, dword [ebp - 0xc]
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov ax, word [ecx + edx*2]
mov edx, dword [ebp - 0x14]
mov esi, dword [edx + eax*4]
add esi, edi
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x139ea750
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x13a7b5a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x139ea826
push str.msedgewebview2.exe
push eax
call fcn.13a17fe0
add esp, 8
test eax, eax
jne 0x139ea826
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x139ea826
push str.___webview_exe_namems_teams.exe
push eax
call fcn.139fb2a0
add esp, 8
test eax, eax
je 0x139ea826
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.13a3dd90
push eax
lea eax, [esp + 8]
push eax
call fcn.13a3def0
add esp, 0xc
mov eax, dword [eax]
lea ecx, [esp + 0x14]
push eax
mov dword [esp + 0x10], 0
call fcn.139f42a0
lea ecx, [esp]
mov byte [esp + 0xc], 2
call fcn.139ef820
mov ecx, dword [esp + 0x14]
push str.msedgewebview2.exe
push ecx
call fcn.13a17add
add esp, 8
mov dword [esp + 0xc], 0xffffffff
test eax, eax
lea ecx, [esp + 0x14]
je 0x139ea821
call fcn.139f4ba0
mov eax, 1
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
call fcn.139f4ba0
mov ecx, dword [esp + 4]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x139eb480
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x13a7b60b
push eax
mov eax, dword [0x13aab948]
mov dword fs:[0], esp
sub esp, 0x910
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
jne 0x139eb6c6
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x519]
mov byte [esp + 0x518], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.OAgent.ini
mov dword [0x13aab948], 1
mov dword [esp + 0xc], ebx
stosb byte es:[edi], al
call fcn.139e1cd0
push eax
lea eax, [esp + 0x1c]
push 0x13a91124
push eax
call fcn.13a177e2
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push ecx
push 0x400
push edx
push 0x13aab94c
push 0x13a7f9f8
push str.AgentConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, ebx
jbe 0x139eb576
cmp byte [esp + 0x517], bl
jne 0x139eb576
lea eax, [esp + 0x518]
push 0x400
lea ecx, [esp + 0x11c]
push eax
push ecx
call fcn.13a44a10
add esp, 0xc
mov dword [esp + 8], eax
jmp 0x139eb57a
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x139eb684
lea ecx, [esp + 0xc]
call fcn.13a02d00
push 0x20019
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
push 0x80000002
lea ecx, [esp + 0x18]
mov dword [esp + 0x92c], ebx
call fcn.13a02e70
test eax, eax
je 0x139eb5f9
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
push 0x13a7fa44
call fcn.13a03290
cmp eax, ebx
je 0x139eb5f9
mov ecx, dword [esp + 8]
cmp ecx, 0x400
jae 0x139eb5ec
mov edx, ecx
push esi
mov esi, eax
lea edi, [esp + 0x51c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x139eb5f0
mov dword [esp + 8], ebx
push eax
call fcn.13a17a4b
add esp, 4
lea ecx, [esp + 0xc]
call fcn.13a02ec0
lea ecx, [esp + 0xc]
mov dword [esp + 0x920], 0xffffffff
call fcn.13a02df0
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x139eb684
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x118]
push 0x400
rep stosd dword es:[edi], eax
lea eax, [esp + 0x11c]
push eax
push 0x13aab94c
push 0x13a7fa44
push str.ED30_8AC4_11D5_8930_A730
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
jbe 0x139eb67c
cmp byte [esp + 0x517], bl
jne 0x139eb67c
lea ecx, [esp + 0x518]
push 0x400
lea edx, [esp + 0x11c]
push ecx
push edx
call fcn.13a44a10
add esp, 0xc
jmp 0x139eb680
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x139eb6c6
cmp eax, 4
jbe 0x139eb6c6
lea ecx, [esp + 0x518]
test ecx, ecx
je 0x139eb6c6
cmp dword [esp + 0x518], 1
je 0x139eb6c6
mov edx, dword [esp + 0x534]
and edx, 0xffff
lea ecx, [edx + edx + 0x22]
cmp ecx, ebx
je 0x139eb6c6
add eax, 0xfffffffc
cmp ecx, eax
ja 0x139eb6c6
mov eax, dword [esp + 0x520]
mov dword [0x13aab944], eax
mov ecx, dword [esp + 0x918]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x91c
ret