joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ecc1
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4cf6f8]
je 0x47ecdc
inc edi
cmp edi, 0x17
jb 0x47eccd
cmp edi, 0x17
jae 0x47ee5c
push ebp
push 3
call fcn.0048a497
cmp eax, 1
pop ecx
je 0x47ee28
push 3
call fcn.0048a497
test eax, eax
pop ecx
jne 0x47ed10
cmp dword [0x4cf6c0], 1
je 0x47ee28
cmp ebx, 0xfc
je 0x47ee5b
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4d21e0
push ebp
call fcn.0047f02a
add esp, 0xc
test eax, eax
je 0x47ed46
push esi
push esi
push esi
push esi
push esi
call fcn.00479057
add esp, 0x14
push 0x104
mov esi, 0x4d21f9
push esi
push 0
mov byte [0x4d22fd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x47ed8a
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0047f02a
add esp, 0xc
test eax, eax
je 0x47ed8a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00479057
add esp, 0x14
push esi
call fcn.0047f090
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x47edcf
push esi
call fcn.0047f090
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4d24f4
push 0x4b95bc
sub ecx, eax
push ecx
push eax
call fcn.0047a7d4
add esp, 0x14
test eax, eax
je 0x47edcf
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00479057
add esp, 0x14
jmp 0x47edd1
xor esi, esi
push 0x4b95b8
push ebx
push ebp
call fcn.0048a426
add esp, 0xc
test eax, eax
je 0x47edf1
push esi
push esi
push esi
push esi
push esi
call fcn.00479057
add esp, 0x14
push dword [edi*8 + 0x4cf6fc]
push ebx
push ebp
call fcn.0048a426
add esp, 0xc
test eax, eax
je 0x47ee13
push esi
push esi
push esi
push esi
push esi
call fcn.00479057
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0048a269
add esp, 0xc
jmp 0x47ee5b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x47ee5b
cmp ebp, 0xffffffff
je 0x47ee5b
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4cf6fc]
push dword [esi]
call fcn.0047f090
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x48a269
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0047e44c
xor ebx, ebx
cmp dword [0x4d2930], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x48a33f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x48a41f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x48a41f
push eax
call fcn.0047e3de
mov dword [esp], 0x4b98e0
push edi
mov dword [0x4d2930], eax
call esi
push eax
call fcn.0047e3de
mov dword [esp], 0x4b98cc
push edi
mov dword [0x4d2934], eax
call esi
push eax
call fcn.0047e3de
mov dword [0x4d2938], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004831e9
test eax, eax
pop ecx
pop ecx
je 0x48a30d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00479057
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x48a33f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0047e3de
cmp eax, ebx
pop ecx
mov dword [0x4d2940], eax
je 0x48a33f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047e3de
pop ecx
mov dword [0x4d293c], eax
mov eax, dword [0x4d293c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x48a3c4
cmp dword [0x4d2940], ecx
je 0x48a3c4
push eax
call fcn.0047e455
push dword [0x4d2940]
mov esi, eax
call fcn.0047e455
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x48a3c4
cmp edi, ebx
je 0x48a3c4
call esi
cmp eax, ebx
je 0x48a391
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x48a391
test byte [ebp - 0x18], 1
jne 0x48a3c4
lea eax, [ebp - 0x10]
push eax
call fcn.00483220
test eax, eax
pop ecx
je 0x48a3ac
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00479057
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x48a3bb
or dword [ebp + 0x10], 0x200000
jmp 0x48a3ff
or dword [ebp + 0x10], 0x40000
jmp 0x48a3ff
mov eax, dword [0x4d2934]
cmp eax, dword [ebp - 8]
je 0x48a3ff
push eax
call fcn.0047e455
cmp eax, ebx
pop ecx
je 0x48a3ff
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x48a3ff
mov eax, dword [0x4d2938]
cmp eax, dword [ebp - 8]
je 0x48a3ff
push eax
call fcn.0047e455
cmp eax, ebx
pop ecx
je 0x48a3ff
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d2930]
call fcn.0047e455
cmp eax, ebx
pop ecx
je 0x48a41f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x48a421
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49574a
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp + 8], eax
jne 0x495763
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 8], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x1c
pop esi
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00479220
add esp, 0xc
push 0
push 4
mov dword [ebp - 0x20], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
test ebx, ebx
je 0x4957ea
push edi
lea eax, [ebp - 0x20]
push eax
push ebx
call sub.KERNEL32.dll_Thread32First
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4957e2
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jne 0x4957d8
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 4], eax
je 0x4957d8
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x4957d2
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call edi
jmp 0x4957d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x20]
push eax
push ebx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x4957a5
push ebx
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a5361
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4d2fe4], 0
push esi
jne 0x4a52d4
call fcn.004a51ff
test eax, eax
je 0x4a5317
mov eax, dword [0x4d2fe4]
cmp eax, 1
jne 0x4a52f5
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4a5317
pop esi
ret
push eax
call dword [0x4d2fec]
test eax, eax
jne 0x4a535f
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4a531b
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4d2fe4]
call dword [0x4d2fec]
mov edi, eax
test edi, edi
je 0x4a5342
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4a535e
lea edi, [esi + 0xff0]
push esi
push dword [0x4d2fe4]
call dword [0x4d2fe8]
add esi, 0x10
cmp esi, edi
jb 0x4a5348
mov eax, esi
pop edi
pop esi
ret
jmp 0x4a52c1

Function at 0x4a54b2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4cf640]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004a5447
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00479220
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4a5501
cmp dword [ebp - 0x1c], 5
jb 0x4a5519
jmp 0x4a5515
cmp dword [ebp - 0x10], 1
jne 0x4a5519
cmp dword [ebp - 0x1c], 4
ja 0x4a5515
jne 0x4a5519
cmp dword [ebp - 0x18], 0
jbe 0x4a5519
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4bbc98
call fcn.0040f310
test eax, eax
jge 0x4a553a
mov byte [0x4d1ae0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00478cd0
add ebp, 0x78
leave
ret
Function at 0x4a5be0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4b2378
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cf640]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x4d3088]
test eax, eax
jne 0x4a5c12
xor esi, esi
jmp 0x4a5c1b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
je 0x4a5c5d
cmp dword [esi + 0x14], 0
jne 0x4a5c9f
cmp dword [esi + 0x10], 0
jne 0x4a5ca5
push 0x4a5700
push 0x4d3080
call fcn.004a5900
mov eax, dword [0x4d3088]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
mov dword [esp + 0x20], 0xffffffff
je 0x4a5c8b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4a5c8b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x4a5ce5
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x4a5cd3
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x4a5ca5
cmp dword [esi + 0x14], 0
je 0x4a5c37
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4a5d0a
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x4a5d3b
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4a5d3b
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4a5d3b
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x4a5cef
jmp 0x4a5c31
Function at 0x4a5eb0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4b23f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4cf640]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x4a5d60
push 0
push 0
call fcn.0047ad44
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4a5f1b
lea ecx, [esp + 0x10]
call fcn.00478d78
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.00415700
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x4a5f41
cmp eax, 0xffffffff
je 0x4a5f41
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4a74d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x4a74df
mov eax, dword [eax + 4]
jmp 0x4a74e2
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a757a
push esi
call fcn.004a6950
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x4a755f
cmp eax, 3
je 0x4a755f
cmp eax, 0x7b
je 0x4a755f
cmp eax, 0xf
je 0x4a755f
cmp eax, 0x15
je 0x4a755f
cmp eax, 0x57
je 0x4a755f
cmp eax, 0xa1
je 0x4a755f
cmp eax, 0x35
je 0x4a755f
cmp eax, 0x20
jne 0x4a7554
mov eax, dword [0x4d30e4]
mov dword [ecx], eax
mov edx, dword [0x4d30e8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x4d30e4]
mov dword [ecx], eax
mov edx, dword [0x4d30e8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x4d30e4]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x4d30e8]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x4a75a7
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret
Function at 0x4a75d0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4b25ab
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x4cf640]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cf640]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x2ac]
mov eax, dword [esp + 0x2a8]
mov edx, dword [esp + 0x2b0]
mov ebp, dword [esp + 0x2a0]
mov ebx, dword [esp + 0x2a4]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x2b4]
xor esi, esi
push 0xffffffffffffffff
push esi
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], esi
mov word [esp + 0x30], si
call fcn.0040216a
mov eax, dword [esp + 0x34]
cmp eax, esi
mov dword [esp + 0x298], esi
je 0x4a7697
lea edi, [eax - 1]
cmp edi, eax
jbe 0x4a767c
call fcn.00479177
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x4a768b
lea eax, [esp + 0x24]
cmp word [eax + edi*2], 0x5c
mov edx, 0x4bbf9c
je 0x4a769c
mov edx, 0x4bbf94
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4a76a1
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.0040c600
mov eax, dword [esp + 0x24]
mov edi, 8
cmp dword [esp + 0x38], edi
jae 0x4a76ce
lea eax, [esp + 0x24]
lea edx, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebx], eax
jne 0x4a7711
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], esi
call edi
cmp eax, 2
je 0x4a76f4
call edi
mov esi, eax
call fcn.004a6950
cmp dword [esp + 0x38], 8
mov dword [ebp], esi
mov dword [ebp + 4], eax
jb 0x4a7793
mov eax, dword [esp + 0x24]
push eax
jmp 0x4a778b
lea eax, [esp + 0x68]
lea edx, [eax + 2]
jmp 0x4a7720
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4a7720
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x6c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.0040244b
test byte [esp + 0x3c], 0x10
je 0x4a775b
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [edx], 3
mov dword [eax], 3
jmp 0x4a776f
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ecx], 2
mov dword [edx], 2
cmp dword [esp + 0x38], edi
mov eax, dword [0x4d30e4]
mov dword [ebp], eax
mov ecx, dword [0x4d30e8]
mov dword [ebp + 4], ecx
jb 0x4a7793
mov edx, dword [esp + 0x24]
push edx
call fcn.00478d09
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.00478cd0
add esp, 0x288
ret
Function at 0x1ab6c0d
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
test dh, 0x23
cmp eax, dword [ebp - 0x10]
pushal
jmp 0x1e52bb2
pushal
mov byte [esp + 4], cl
lea esp, [esp + 0x44]
jae 0x1ab28e1
and ch, bh
invalid
movsx bx, cl
call fcn.01e588e7
xchg ecx, eax
sub dl, bl
wait
mov edi, 0x2b67d045
add byte [eax], ch
xor esi, eax
popal
cmpsd dword [esi], dword es:[edi]
mov ecx, 0x282ea149
test al, 0x66
rol dword [esi], 1
cmpsb byte [esi], byte es:[edi]
imul eax, dword [eax - 0x11e4d794], 0xffffffde
pop ebx
je 0x1e52bbd
retf 0x2b22

Function at 0x1dc1dbf
Capabilities:
Encode data using xor

Disassembly:
call 0x1ab2c54
jl 0x1dc1e21
pop ebx
xor ah, byte [ecx + 0x26]
movsb byte es:[edi], byte [esi]
mov eax, dword gs:[0x45e0d63d]
pop eax
cld
cld
in eax, dx
in al, 0x3d
loopne 0x1dc1dc5
or dword [ebp - 0x42], esi
call 0xaa6c205a
mov ebx, 0xefc30e42
popfd
pop es
ljmp 0xac8f
ret

Function at 0x1e5229c
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
ror al, 7
pushfd
mov byte [esp], 0xe0
cmp al, byte [edi]
jmp 0x1dc5cbf
setno al
jmp 0x220b76e
push dword [esp]
neg al
push 0x88dcce9e
push 0xb57b9d8
stc
not al
jmp 0x1aba599
inc esi
leave
popal
ret 0xd838
and al, 8
lea esp, [esp + 0x30]
jmp 0x220ff81
jno 0x220b6cc
jmp dword [ecx]
lea edi, [edi + 1]
lea esp, [esp + 0x44]
jnp 0x220c50e
bswap eax
pop eax
pushfd
call fcn.01e592fb
and eax, 0x31a4d376
push ds
jecxz 0x220b7fa
dec edi
les edi, [ebx - 0x52]
xchg esi, eax
jnp 0x220b72d
lcall 0x93fe, 0x8b2743ce
aam 0x4b
cmp byte [ecx], ch
lcall 0x5e59, 0xe3923e1
pop esi
les esp, [ebp + 0x30]
push es
dec eax
loopne 0x220b740
jecxz 0x220b810
fsubr qword [edi + 0x23]
cmp dword [eax], edx
cmc
fild qword [eax + 9]
dec esp
mov dword [0xee7b6280], eax
bound edi, qword [ebx - 0x12]
xor ah, bh
jnp 0x220b7bb
imul edi, dword [eax + 0x19b76079], 5
sub dword [esi - 0x41], esp
mov edx, 0x3845a721
mov edi, 0x193a1911
cli
out 0x62, al
insb byte es:[edi], dx
lcall 0x5160, 0xe3bf1126
cdq
xchg edx, eax
cld
add dh, ah
and cl, byte [ebx]
dec ebp
mov ecx, 0x104bfc3c
xchg edi, eax
popal
stosd dword es:[edi], eax
and byte [ecx], dl
lodsd eax, dword [esi]
fadd dword [ebx]
mov edi, 0xf197004
fsubr dword [esi + 0x59]
psubusb mm5, qword [esi + 0x59]
sub al, 0xf3
mov ebp, 0xbb126a4
mov esp, 0x74a73cf3
aas
test al, 0x27
push ebp
das
mov al, byte [0x6857086]
xchg byte [eax - 0x7b], dh
push es
stc
push ebp
pop ds
salc
adc dword [edx], edx
in eax, 0x78
invalid
call fcn.01b43ffa
pushfd
pushal
mov dword [esp + 0x28], ebp
mov word [esp], cx
push eax
pushfd
mov dword [esp + 0x2c], esi
push dword [esp]
mov dword [esp + 0x2c], esi
call fcn.02210848
mov dword [esp + 0x3c], ecx
call fcn.0220f249
jmp 0x220fb24
push 0x5da907fa
mov word [esp], si
pushfd
pushfd
mov dword [esp + 8], edi
jmp 0x220fcf4
Function at 0x220bd83
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x43d2b406]
mov dl, byte [esi]
cmp ah, ch
insb byte es:[edi], dx
mul byte [ebp - 0x7f]
push 0x8ea28978
stosb byte es:[edi], al
push ebx
ret 0xadf
ficomp word [ebp - 0x570de5d5]
xlatb
test dword [esi + 0x6220af18], edi
sbb edi, eax
mov ch, 0x10
insd dword es:[edi], dx
in eax, 0x35
xchg byte [edx + 0x63bf02e2], bl
test dword [esi - 0x35e369e6], edi
mov ss, word [eax + 0x1f]
outsb dx, byte [esi]
cwde
fmul qword [ecx - 0x31]
dec esi
dec ebp
dec esi
mov ch, byte ds:[eax + 0x70c92b84]
xchg dword [ecx], ebp
jnp 0x1dc364d
sub dword [ebx + 0x62], edi
sar dword [ebx - 0x5a], 0x3d
xor dword [ebx], 0xffffffac
fisubr dword [esi + 0x6d]
ja 0x1dc3597
rol dword [ebp - 0x27c788f0], 0xf2
jge 0x1dc35b3
and dword [edx - 0x4cc533d7], ebx
add dword [eax + 0x6650a31a], esi
lodsb al, byte [esi]
mov ebx, dword [ecx + 0x780b30f7]
cmpsd dword [esi], dword es:[edi]
xor al, 0x7b
pop eax
cmp eax, 0xc7d3b406
push cs
xchg al, ch
adc eax, 0xdf004481
mov al, byte [0x5be78209]
call 0x220b738
fbld tbyte [eax + 0x5be78209]
js 0x1dc35e8
jns 0x1dc35df
ljmp 0xb1a:0x8f232333
test eax, 0xce5faf10
pop edi
outsd dx, dword gs:[esi]
mov eax, dword [0x5657929e]
xchg edx, eax
push edi
push esi
mov ah, 0x31
lcall 0x6abf, 0xa30c99c9
sbb al, 0x89
test byte [eax - 0x1a994d93], bl
movsb byte es:[edi], byte [esi]
les esp, [ecx + ecx*4]
pop es
in eax, 0x1a
push esi
push 0xffffffffffffffd6
add byte [esi + 0x6f1d96], dl
les ecx, [edi + 0x7e]
cmpsb byte [esi], byte es:[edi]
rol dword [ebx], 9
popfd
nop
and edi, dword [eax - 0x14416ed6]
or dword [esi + 0x67], esi
adc ecx, ecx
xchg edi, eax
pushal
arpl sp, ax
sub esi, dword [eax - 0x6b0db65]
daa
pushal
xor dl, ah
scasd eax, dword es:[edi]
push es
mov ah, 0xd3
mov byte [edi - 0x44], ch
sbb eax, 0x4de96336
outsb dx, byte [esi]
xor byte [ebx], ch
inc ebp
pop esi
xlatb
xchg esi, eax
neg dword [edi + 0x5693faf3]
jg 0x1dc3657
xor ebp, dword [edx - 7]
wait
sbb eax, ebx
adc dh, byte [eax + eax*4]
in eax, 0x53
movsb byte es:[edi], byte [esi]
mov dl, byte [eax - 0x228889ee]
pop esi
ljmp 0x8a67
daa
add ah, 0x6a
shld ax, bp, 1
shr eax, cl
push ebp
cwde
sal bp, cl
ror eax, 5
btc ax, dx
mov ebp, esp
and eax, 0x44a1e0e0
sub esp, 0x10
movzx ax, al
cmc
aad 0x28
movzx ax, al
push esi
btc ax, 9
shld eax, ecx, 0xf
push edi
shl al, 7
pushfd
rol ax, cl
sar eax, cl
mov dword [esp], ebx
aam 0xf4
cmc
bswap ax
push edx
stc
shld ax, si, 7
mov eax, dword [ebp + 8]
clc
test esp, edx
test bp, bx
test eax, eax
pushfd
jmp 0x1dc361e
Function at 0xcc0370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xcc038e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xce9074
push ecx
mov edi, eax
call fcn.00cd4198
mov esi, eax
add esp, 8
test esi, esi
jne 0xcc03cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00cd402e
push esi
call fcn.00cd3fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xcc3850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xcc38ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xcee720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xcc38ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00cd41e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xcc38ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xcee720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xcc392a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00cd5082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xcc3957
mov word [eax], si
add eax, 2
push eax
call fcn.00cd5030
add esp, 4
jmp 0xcc3959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xcc38ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xcc38b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xcc3ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret