joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x43b647
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
add esi, 0x24a07939
mov esi, 0x90a34263
call fcn.0043b69e
and esi, ebx
add ebx, esi
add ebx, 0x4436d78a
xor dword [edi], eax
mov esi, ebx
add edi, 1
sub esi, 0x88428157
sub esi, 0xf052364c
mov ebx, 0x131cb96
cmp edi, ecx
jne fcn.0043b647
and ebx, ebx
mov esi, esi
sub esi, esi
ret
Function at 0x4010b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4010ff
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x804]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x404]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40170c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40171b
pop dword [ebp - 0x24]
mov eax, 0x40171b
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x6f5f869d
sub dword [ebp - 0x34], 0x210d4152
mov dword [ebp - 0x30], 0x793201fd
sub dword [ebp - 0x30], 0x46feb5b8
mov dword [ebp - 0x2c], 0xbac92b57
sub dword [ebp - 0x2c], 0x6e7ce729
mov dword [ebp - 0x28], 0x5b0c52ea
sub dword [ebp - 0x28], 0x5b0c52ea
lea eax, [ebp - 0x34]
push eax
mov eax, 0xc4103ccc
add eax, 0x3c309388
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x8d9387b7
sub dword [ebp - 0x34], 0x19211e61
mov dword [ebp - 0x30], 0x9b736357
add dword [ebp - 0x30], 0xa5f8fe1e
mov dword [ebp - 0x2c], 0x4eb129d6
sub dword [ebp - 0x2c], 0xeb41bd6a
mov dword [ebp - 0x28], 0xd4fc18ce
sub dword [ebp - 0x28], 0xd4fc18ce
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3610e
push 0
call eax
mov ecx, 0x683add98
sub ecx, 0x683aa442
mov edx, eax
mov ebx, 0xfc7f34c
add ebx, 0xf079bcb4
add ebx, dword [ebp - 0x24]
mov edi, 0xb8f0dcd3
add dword [ebp - 0xc], 0xb9290edb
mov esi, dword [ebx]
mov dword [ebp - 0x20], 0x12f48272
sub esi, edi
xor dword [ebp - 0x20], 0x93b45046
mov dword [edx], esi
xor dword [ebp - 4], 0xca330ddb
add edx, 0x344eb7be
sub edx, 0x344eb7ba
add ebx, 0xb51521d0
add ebx, 0x4aeade34
loop 0x40182d
add eax, 0x67946c6c
sub eax, 0x67939441
xor ebx, ebx
add ebx, eax
add eax, 0x57358c95
sub eax, 0x57358c90
mov ecx, 0x1b888e70
add ecx, 0xe4b77190
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x48e434
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a7df0]
jne 0x48e43e
repz ret
jmp fcn.00492ac7

Function at 0x490b14
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a7df0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048b192
and dword [ebp - 0x14], 0
cmp dword [0x4aab14], 0
mov dword [ebp - 0x18], eax
jne 0x490bc7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x490c6f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x490c6f
mov esi, dword [fcn.00486d00]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4aab14], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4aab18], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4aab1c], eax
call edi
push eax
call esi
mov dword [0x4aab24], eax
test eax, eax
je 0x490bc7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4aab20], eax
mov eax, dword [0x4aab20]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00486d04]
cmp eax, ecx
je 0x490c20
cmp dword [0x4aab24], ecx
je 0x490c20
push eax
call esi
push dword [0x4aab24]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x490c20
test ebx, ebx
je 0x490c20
call edi
test eax, eax
je 0x490c17
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x490c17
test byte [ebp - 8], 1
jne 0x490c20
or dword [ebp + 0x10], 0x200000
jmp 0x490c53
mov eax, dword [0x4aab18]
cmp eax, dword [ebp - 0x18]
je 0x490c53
push eax
call esi
test eax, eax
je 0x490c53
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x490c53
mov eax, dword [0x4aab1c]
cmp eax, dword [ebp - 0x18]
je 0x490c53
push eax
call esi
test eax, eax
je 0x490c53
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4aab14]
call esi
test eax, eax
je 0x490c6f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x490c71
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048e434
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040cffb
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040cffb
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040cffb
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040cffb
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040cffb
mov dword [0x41203c], eax
call fcn.0040cffb
test eax, eax
jge 0x402550
push 8
call fcn.0040cffb
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040cffb
pop ecx
push 1
call fcn.0040cffb
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040cffb
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040cffb
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040cffb
jmp 0x402495

Function at 0x40cffb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40d00a
pop dword [ebp - 0x44]
mov eax, 0xb1530c01
add eax, 0x4eedc409
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3ae3e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x9c0f87a3
add ecx, 0x63f0c700
mov ebx, eax
mov edx, 0xdac5ed48
sub edx, 0xda84b184
add edx, dword [ebp - 0x44]
mov edi, 0x582f7c3c
sub edi, 0x35c0d20a
xor dword [ebp - 0x2c], edx
mov esi, dword [edx]
sub esi, edi
add dword [ebp - 0x40], eax
mov dword [ebx], esi
mov dword [ebp - 0x24], 0x6017d304
add ebx, 0x90c80a72
add ebx, 0x6f37f592
add edx, 0xc7dfb1
add edx, 0xff382053
loop 0x40d064
add eax, 0x749a05b5
add eax, 0x8b6727aa
mov ebx, eax
add eax, 0xc5b64df9
add eax, 0x3a49b20c
mov ecx, 0xd2acdfd0
sub ecx, 0xd26cdfd0
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x4174f6
Capabilities:
Encode data using xor

Disassembly:
inc ebx
mov bh, 0x9d
frstor dword [esi + 0x26]
mov byte [edi + 0x1c], dl
xor byte [edi + 0x69], ah
test dword [ecx - 0x4586ac06], eax
popfd
xor eax, 0x6b32462d
mov bl, 5
and dh, byte [ecx - 0x794aad07]
mov edx, 0x462d359d
xor ch, byte [ebx - 0x4d]
add eax, 0x52f9b122
mov ch, 0x86
xor dl, byte [ebx]
xlatb
fst dword [esi]
and al, 0x70
fild dword [edi]
xchg ecx, eax
xchg ebp, eax
jnp 0x4174a9
out dx, eax
xor esp, dword [eax]
int3
mov bh, 0xf6
mov word [eax], cs
stosb byte es:[edi], al
sar dword ss:[eax + 0x7fcddc9], 1
mov eax, 0x7fcddc9
dec ebp
push edx
pop ecx
pop ds
and eax, 0x5228a8aa
inc esp
jge 0x417496
xor bl, byte [ecx + 0x69f5897c]
adc dword [edx + 0x29853f6b], ebx
loopne 0x4174e5
lcall 0xe1e0, 0x29853f6b
xchg ebx, eax
loope 0x4174db
sahf
adc dh, ch
cmp al, 0x94
cmp al, 0x4a
and al, 0x1b
push 0xc5843615
inc esi
dec esp
fild qword [eax + 0x40]
jbe 0x4174fd
invalid

Function at 0x4370d2
Capabilities:
Encode data using xor

Disassembly:
adc bh, 0x71
daa
call 0x9c8ab22c
mov di, 0xc0b1
out 0x5c, al
or ebx, eax
cmpsd dword [esi], dword es:[edi]
xor dword [edi], 0x70
mov dh, 0xd1
dec ecx
jne 0x4370d6
pop edi
pop es
int3

Function at 0x43817a
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0xc3
add eax, 0x41937743
xor dword [eax + 0x54b42aa2], edx
cmpsd dword [esi], dword es:[edi]
and ecx, 0x59
ja 0x438120
ret
clc
dec ecx
mov bl, 0xaf
shl dword [eax - 0x4f0e8c9d], cl
mov dl, 0xe2
jmp dword [eax - 0x3c89f98f]
call 0x18c20d85
jo 0x43811f
pop esi
wait
xchg ebp, eax
idiv dword [eax - 0x6448647a]
inc ebx
push 0x675b3836
in al, 0x59
rcl byte [edx], cl
ljmp 0xec2

Function at 0x45be26
Capabilities:
Encode data using xor

Disassembly:
test byte [edi + 0xa547108], bh
fidivr dword [ebp - 0x54d8dd29]
jno 0x45be7f
or bl, dl
mov ebp, 0xab2722d7
stc
adc dl, byte [edx - 5]
push 0x29
fnstsw word [ecx - 0x6defc3a3]
mov edx, 0xfd533a7e
sar dword [edi + 0x32], 1
sub edx, dword [esi]
mov dl, 0x99
cdq
add dh, byte [ebp - 0xd]
xor dword [edi - 0x50], edi
aas
not ecx
jns 0x45be29
xchg edi, eax
jb 0x45be7d
ljmp 0x60ea:0x1d027e97
loope 0x45be49
xchg ebp, eax
fmul dword [edi - 0x5aee63f2]
invalid
in eax, 0xa4
sbb eax, dword [edx + 0x4a388cf0]
dec edx
jb 0x45be70
in al, 0x4e
outsb dx, byte [esi]
dec ebp
and al, 3
std
lodsb al, byte [esi]
mov dl, 0xc7
xchg byte [esi + 0x1c], al
enter 0xffffffffffffb882, 0xffffffffffffff94
fidiv dword [eax]
mov dword [esi + 0x55b58c16], eax
mov dh, byte [edx - 0x42138d73]
inc ebx
out dx, eax
shl byte [ebx], 0x1b
bound ecx, qword [esi + 0x6a086fc]
pushal
in al, 0x57
push ss
pop es
cmpsd dword [esi], dword es:[edi]
dec eax
das
fstp xword [eax - 0x5981c7c8]
mov ebp, 0x9056753e
int3
Function at 0x4bad51
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c53a0
cmp edx, dword [eax]
je 0x4bad73
add eax, 8
inc ecx
cmp eax, 0x4c5430
jl 0x4bad64
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c53a0]
jne 0x4baea1
mov eax, dword [0x4c9d34]
cmp eax, 1
je 0x4bae7b
test eax, eax
jne 0x4bada4
cmp dword [0x4c52cc], 1
je 0x4bae7b
cmp edx, 0xfc
je 0x4baea1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4baddb
lea eax, [ebp - 0x1a4]
push 0x4c0d58
push eax
call fcn.004bb730
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbbc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bae1e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbbc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0d54
push edi
call fcn.004bda90
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0d38
push eax
call fcn.004bb730
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb740
lea eax, [ebp - 0xa0]
push 0x4c0d34
push eax
call fcn.004bb740
push dword [esi + 0x4c53a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb740
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0d0c
push eax
call fcn.004bda04
add esp, 0x2c
pop edi
jmp 0x4baea1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c53a4]
push 0
push eax
push dword [esi]
call fcn.004bbbc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x6d01378d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x6d030030]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x6d013830
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.6d014932
pop ecx
pop ecx
test eax, eax
je 0x6d013819
test ebx, ebx
je 0x6d01380d
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.6d014932
pop ecx
pop ecx
test eax, eax
jle 0x6d013819
push ebx
call fcn.6d015895
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.6d015874
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x6d0137da
xor edi, edi
cmp ebx, edi
jne 0x6d013834
xor eax, eax
jmp 0x6d0138a0
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x6d013863
call fcn.6d015895
pop ecx
cmp dword [ebp - 0x70], edi
je 0x6d013830
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x6d013830
call fcn.6d015895
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d013853
cmp dword [ebp - 0x70], edi
je 0x6d013896
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.6d015874
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d018259
add ebp, 0x9c
leave
ret
Function at 0x6d014932
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x6d014941
pop dword [ebp - 0x34]
mov eax, 0x295da0b9
sub eax, 0xbc5c5778
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xa00e3505
add dword [ebp - 0x44], 0xae441046
mov dword [ebp - 0x40], 0x9f42f54a
sub dword [ebp - 0x40], 0x6d0fa905
mov dword [ebp - 0x3c], 0xc97170bb
add dword [ebp - 0x3c], 0x82dad373
mov dword [ebp - 0x38], 0xe91789a
sub dword [ebp - 0x38], 0xe91789a
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x946040ea
sub dword [ebp - 0x44], 0x1fedd794
mov dword [ebp - 0x40], 0xac44cfd1
add dword [ebp - 0x40], 0x952791a4
mov dword [ebp - 0x3c], 0x55e61e40
sub dword [ebp - 0x3c], 0xf276b1d4
mov dword [ebp - 0x38], 0x48f5f1f6
add dword [ebp - 0x38], 0xb70a0e0a
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xd2d9a4cf
add eax, 0x9a28db7d
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x34862
push 0
call eax
mov ecx, 0x2d1a
mov esi, eax
mov edx, 0xd82d1a43
sub edx, 0x6b29b243
add edx, dword [ebp - 0x34]
mov edi, 0x41b32d6c
sub edi, 0xd4c7e2f8
xor dword [ebp - 0x1c], 0x679452e4
mov ebx, dword [edx]
sub dword [ebp - 8], 0x8803a5cf
sub ebx, edi
mov dword [esi], ebx
sub dword [ebp - 0x18], edx
add esi, 0x4e595d39
add esi, 0xb1a6a2cb
add edx, 4
loop 0x6d014a58
add eax, 0xa73b
xor ebx, ebx
add ebx, eax
add eax, 0x35dd1a9a
add eax, 0xca22e56b
mov ecx, 0x6d010000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x6d01555d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x6d030030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.6d0153ca
push 8
mov esi, eax
call fcn.6d01582d
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x6d0155c8
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x6d0155cf
and dword [ebx + 4], 0
jmp 0x6d0155e4
xor eax, eax
jmp 0x6d0156af
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x6d015695
push edi
call fcn.6d017a10
pop ecx
cmp eax, 4
jl 0x6d0155bb
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x6d0155bb
add eax, 0xfffffffd
push 0x6d02982c
push eax
mov dword [ebp - 0x74], eax
call fcn.6d018270
pop ecx
pop ecx
test eax, eax
je 0x6d01562a
push 0x6d029828
push dword [ebp - 0x74]
call fcn.6d018270
pop ecx
pop ecx
test eax, eax
jne 0x6d0155bb
push 0x3b
push edi
call fcn.6d0193f0
pop ecx
pop ecx
test eax, eax
jne 0x6d0155bb
push dword [ebp - 0x78]
call fcn.6d017a10
push edi
mov ebx, eax
call fcn.6d017a10
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.6d01582d
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.6d014932
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.6d014932
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.6d015420
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x6d0155bb
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindClose]
push dword [ebx + 4]
call fcn.6d015895
push ebx
call fcn.6d015895
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d018259
add ebp, 0x214
leave
ret

Function at 0x6d018259
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d030030]
jne 0x6d018263
repz ret
jmp fcn.6d01e721
Function at 0x46495a
Capabilities:
Encode data using xor

Disassembly:
inc esi
inc esp
bound esi, qword [ebx + edx*2]
leave
lahf
dec edi
jbe 0x4649d6
mov esi, 0xa51ea3b4
sub al, 0x19
and eax, 0x4d12f303
sbb dword [eax - 0x7f], eax
sub al, 0x8c
sbb ch, 0xc9
in al, dx
sbb al, 0xbc
and edi, eax
xor byte [ebp + 0x381263c2], al
and al, 0xab
and dword [ebx + 0x6a], 0x3ba28bcd
cmp al, 0xe8
or dword [esi + 0x5c], ecx
jl 0x464976
insd dword es:[edi], dx
pop eax
jae 0x4649fb
adc ch, byte [esi - 0x6a]
int3
arpl word [0x44da0dca], dx
adc al, byte [esi]
pushal
cmp dword [ebx], 0xfffffff3
retf 0x44e6
or al, 0xdb
out 0xb3, eax
or al, 0x3c
mov al, byte [0x55ebd865]
sub edi, dword [esi - 0x779d9c6e]
fld qword [0xecc08db7]
pop ebp
cmp eax, 0xd47edf8a
mov cl, 0xc5
fstp qword [ecx - 0x43]
sti
cmpsd dword [esi], dword es:[edi]
mov ds, word [ebx - 0x58]
dec edx
cmc
cmp al, 0xf7
retf