joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15216c0
Capabilities:
Create http request

Disassembly:
push ecx
cmp dword [0x15d7350], 0
jne 0x1521769
push 0
push 0
push 0
push 1
push str.Portal_CGI_Agent
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [0x15d7350], eax
jne 0x1521707
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetOpen_:_LastErr__d_
push 0x2000001
call fcn.01509090
add esp, 0xc
xor eax, eax
pop ecx
ret
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea ecx, [esp + 8]
push ecx
push 2
push eax
mov dword [esp + 0x14], 0xea60
call esi
mov eax, dword [0x15d7350]
push 4
lea edx, [esp + 8]
push edx
push 6
push eax
call esi
mov edx, dword [0x15d7350]
push 4
lea ecx, [esp + 8]
push ecx
push 5
push edx
call esi
mov ecx, dword [0x15d7350]
push 4
lea eax, [esp + 8]
push eax
push 7
push ecx
call esi
mov eax, dword [0x15d7350]
push 4
lea edx, [esp + 8]
push edx
push 8
push eax
call esi
pop esi
mov eax, 1
pop ecx
ret

Function at 0x152a034
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x15b0648]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x152a05a
mov eax, 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0153eb33
add esp, 0x194
ret 8
xor ecx, ecx
mov ch, byte [esp + 0x1a0]
push ebx
mov bl, byte [esp + 0x1a0]
lea eax, [esp + 8]
push eax
mov cl, bl
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x152a09f
mov ax, word [esp + 8]
cmp al, bl
jne 0x152a099
cmp ah, byte [esp + 0x1a4]
jne 0x152a099
mov eax, 1
mov dword [esi + 4], eax
jmp 0x152a0a1
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov ecx, dword [esp + 0x198]
pop ebx
pop esi
xor ecx, esp
call fcn.0153eb33
add esp, 0x194
ret 8

Function at 0x152a3c0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1617390], 1
push esi
mov esi, ecx
je 0x152a3d1
call fcn.014fbaa0
cmp dword [esi], 0
jne 0x152a3db
call fcn.014fbaa0
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x152a3e9
xor al, al
pop esi
ret 8
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esi + 4], 0xffffffff
jbe 0x152a426
push edi
mov edi, dword [esi]
shl edi, 8
nop
movzx edx, byte [ecx]
mov eax, dword [esi + 4]
xor edx, eax
and edx, 0xff
add edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x15d7390]
add ecx, 1
sub ebp, 1
mov dword [esi + 4], eax
jne 0x152a400
pop edi
pop ebp
mov al, 1
pop esi
ret 8
Function at 0x152a792
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
call edx
cmp eax, 1
je 0x152a7a6
call fcn.014fbaa0
mov ebx, dword [esp + 0x18]
test ebx, ebx
jne 0x152a7b6
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x152a7c4
call fcn.014fbaa0
mov eax, dword [esp + 0x14]
push eax
mov ecx, esi
call fcn.0152a740
test eax, eax
jne 0x152a7db
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
mov edx, dword [esi + 0x98]
push 0
lea ecx, [esp + 0x10]
push ecx
push ebx
push edi
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, esi
call fcn.0152a770
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret 0xc

Function at 0x152cd40
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov ebp, 0x811c9dc5
cmp esi, 0xfffffffe
je 0x152cd65
test esi, esi
je 0x152cd60
cmp esi, dword [esp + 0x1c]
je 0x152cd65
call fcn.0153d98c
cmp edi, dword [esp + 0x20]
je 0x152cdd1
cmp esi, 0xfffffffe
mov ebx, edi
je 0x152cd97
test esi, esi
jne 0x152cd7b
call fcn.0153d98c
cmp dword [esi + 0x18], 0x10
jb 0x152cd86
mov eax, dword [esi + 4]
jmp 0x152cd89
lea eax, [esi + 4]
mov ecx, dword [esi + 0x14]
add ecx, eax
cmp edi, ecx
jb 0x152cd97
call fcn.0153d94d
add edi, 1
cmp esi, 0xfffffffe
je 0x152cdc4
test esi, esi
jne 0x152cda8
call fcn.0153d98c
cmp dword [esi + 0x18], 0x10
jb 0x152cdb3
mov eax, dword [esi + 4]
jmp 0x152cdb6
lea eax, [esi + 4]
mov edx, dword [esi + 0x14]
add edx, eax
cmp ebx, edx
jb 0x152cdc4
call fcn.0153d94d
movsx eax, byte [ebx]
imul ebp, ebp, 0x1000193
xor ebp, eax
jmp 0x152cd51
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x1533a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x157b239
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x15b0648]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.IFile.0
mov dword [esp + 0x1c], 2
call fcn.01532470
mov byte [esp + 0x1c], 1
lea ecx, [esi + 0x58]
call fcn.014765f0
xor ebx, ebx
mov byte [esp + 0x1c], bl
lea ecx, [esi + 0x30]
mov dword [esp + 0x10], ecx
mov byte [esp + 0x1c], bl
call fcn.0152d430
mov dword [esp + 0x1c], 0xffffffff
cmp dword [esi + 0x2c], 0x10
jb 0x1533a7b
mov eax, dword [esi + 0x18]
push eax
call fcn.0153e380
add esp, 4
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], ebx
mov byte [esi + 0x18], bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x1535f40
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x1535f4c
xor al, al
ret 8
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
add eax, 1
ret 8
Function at 0x1535fe0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 8
test eax, eax
jne 0x1535ff2
xor al, al
add esp, 8
ret 8
mov edx, dword [esp + 0x10]
mov ecx, 4
mov dword [esp], ecx
mov dword [esp + 4], ecx
lea ecx, [esp]
push ecx
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
add eax, 1
add esp, 8
ret 8

Function at 0x1539d50
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x153d2f0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x153d334
cmp dword [esi + 0x18], 1
jne 0x153d334
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x153d314
pop esi
xor eax, eax
pop ebx
ret
cmp eax, 1
jbe 0x153d32d
push edi
lea edi, [eax - 1]
test edi, edi
jbe 0x153d32c
mov eax, dword [esi + 0x14]
push eax
call ebx
sub edi, 1
jne 0x153d321
pop edi
mov dword [esi + 0x18], 0
pop esi
mov eax, 1
pop ebx
ret

Function at 0x153d340
Capabilities:
Resume thread
Suspend thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x153d389
cmp dword [esi + 0x18], 0
jne 0x153d389
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x153d367
mov dword [esi + 0x18], 0
xor eax, eax
pop esi
ret
test eax, eax
jbe 0x153d382
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
mov edi, eax
mov eax, dword [esi + 0x14]
push eax
call ebx
sub edi, 1
jne 0x153d375
pop edi
pop ebx
mov dword [esi + 0x18], 1
mov eax, 1
pop esi
ret

Function at 0x153d3b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x153d3f7
cmp byte [esi + 4], 0xb8
push edi
lea edi, [esi + 4]
je 0x153d3c8
call fcn.014fbaa0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea eax, [esi + 0x1c]
push eax
push 4
push ecx
push edi
push edx
push 0
call fcn.0154471e
add esp, 0x18
test eax, eax
mov dword [esi + 0x14], eax
pop edi
je 0x153d400
mov ecx, dword [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
pop esi
ret 0xc
xor eax, eax
pop esi
ret 0xc

Function at 0x153d690
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x157c463
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x15b0648]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0153d640
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esi], vtable.CThreadControl.0
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
push 0xfa0
mov dword [esi + 0x30], eax
push edi
lea ecx, [esi + 0x44]
mov dword [esi + 0x2c], 0xffffffff
call fcn.01521c30
mov eax, 1
mov byte [esp + 0x18], al
mov dword [esi + 0x40], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x153eb33
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x15b0648]
jne 0x153eb3d
repz ret
jmp fcn.0154922c
Function at 0x1547338
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x15b0810]
je 0x1547353
inc edi
cmp edi, 0x17
jb 0x1547344
cmp edi, 0x17
jae 0x15474d3
push ebp
push 3
call fcn.0155e4b7
cmp eax, 1
pop ecx
je 0x154749f
push 3
call fcn.0155e4b7
test eax, eax
pop ecx
jne 0x1547387
cmp dword [0x15b072c], 1
je 0x154749f
cmp ebx, 0xfc
je 0x15474d2
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x16176c0
push ebp
call fcn.01542010
add esp, 0xc
test eax, eax
je 0x15473bd
push esi
push esi
push esi
push esi
push esi
call fcn.015435e5
add esp, 0x14
push 0x104
mov esi, 0x16176d9
push esi
push 0
mov byte [0x16177dd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1547401
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.01542010
add esp, 0xc
test eax, eax
je 0x1547401
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.015435e5
add esp, 0x14
push esi
call fcn.015447d0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1547446
push esi
call fcn.015447d0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x16179d4
push 0x158c228
sub ecx, eax
push ecx
push eax
call fcn.01551792
add esp, 0x14
test eax, eax
je 0x1547446
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.015435e5
add esp, 0x14
jmp 0x1547448
xor esi, esi
push 0x1588370
push ebx
push ebp
call fcn.01555502
add esp, 0xc
test eax, eax
je 0x1547468
push esi
push esi
push esi
push esi
push esi
call fcn.015435e5
add esp, 0x14
push dword [edi*8 + 0x15b0814]
push ebx
push ebp
call fcn.01555502
add esp, 0xc
test eax, eax
je 0x154748a
push esi
push esi
push esi
push esi
push esi
call fcn.015435e5
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0155e2fa
add esp, 0xc
jmp 0x15474d2
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x15474d2
cmp ebp, 0xffffffff
je 0x15474d2
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x15b0814]
push dword [esi]
call fcn.015447d0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x155e2fa
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0154760b
xor ebx, ebx
cmp dword [0x161806c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x155e3d0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x155e4b0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x158da54
push edi
call esi
cmp eax, ebx
je 0x155e4b0
push eax
call fcn.0154759d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x161806c], eax
call esi
push eax
call fcn.0154759d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1618070], eax
call esi
push eax
call fcn.0154759d
mov dword [0x1618074], eax
lea eax, [ebp - 0xc]
push eax
call fcn.015495e3
test eax, eax
pop ecx
pop ecx
je 0x155e39e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.015435e5
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x155e3d0
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0154759d
cmp eax, ebx
pop ecx
mov dword [0x161807c], eax
je 0x155e3d0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0154759d
pop ecx
mov dword [0x1618078], eax
mov eax, dword [0x1618078]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x155e455
cmp dword [0x161807c], ecx
je 0x155e455
push eax
call fcn.01547614
push dword [0x161807c]
mov esi, eax
call fcn.01547614
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x155e455
cmp edi, ebx
je 0x155e455
call esi
cmp eax, ebx
je 0x155e422
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x155e422
test byte [ebp - 0x18], 1
jne 0x155e455
lea eax, [ebp - 0x10]
push eax
call fcn.01549692
test eax, eax
pop ecx
je 0x155e43d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.015435e5
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x155e44c
or dword [ebp + 0x10], 0x200000
jmp 0x155e490
or dword [ebp + 0x10], 0x40000
jmp 0x155e490
mov eax, dword [0x1618070]
cmp eax, dword [ebp - 8]
je 0x155e490
push eax
call fcn.01547614
cmp eax, ebx
pop ecx
je 0x155e490
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x155e490
mov eax, dword [0x1618074]
cmp eax, dword [ebp - 8]
je 0x155e490
push eax
call fcn.01547614
cmp eax, ebx
pop ecx
je 0x155e490
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x161806c]
call fcn.01547614
cmp eax, ebx
pop ecx
je 0x155e4b0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x155e4b2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x402ee4
pop dword [ebp - 0x10]
mov eax, 0x402ee4
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xf5b644a6
add dword [ebp - 0x20], 0x589c00a5
mov dword [ebp - 0x1c], 0x9a714962
add dword [ebp - 0x1c], 0x97c202e3
mov dword [ebp - 0x18], 0x3864ad61
sub dword [ebp - 0x18], 0xec186933
mov dword [ebp - 0x14], 0x1b1f2ed7
sub dword [ebp - 0x14], 0x1b1f2ed7
lea eax, [ebp - 0x20]
push eax
mov eax, 0xa38f0fd0
add eax, 0x5cb17134
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xeb7bd19d
add dword [ebp - 0x20], 0x88f697b9
mov dword [ebp - 0x1c], 0x909a8c51
sub dword [ebp - 0x1c], 0x4f2e2adc
mov dword [ebp - 0x18], 0x5626cbb3
add dword [ebp - 0x18], 0xd48a0b9
mov dword [ebp - 0x14], 0x938a5596
sub dword [ebp - 0x14], 0x938a5596
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x32b53
push 0
call eax
mov ecx, 0x72b0bd62
sub ecx, 0x72b086b2
xor edi, edi
add edi, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0x10]
mov esi, 0xe7808f14
mov edx, dword [ebx]
sub dword [ebp - 4], 0xf93f9d58
add edx, esi
xor dword [ebp - 4], 0xf6cc2f6b
mov dword [edi], edx
add dword [ebp - 4], eax
add edi, 0x9a305543
sub edi, 0x9a30553f
add ebx, 4
loop 0x402ff2
add eax, 0xf74ac264
add eax, 0x8b60b2f
mov ebx, eax
add eax, 0xc73c78aa
add eax, 0x38c3875b
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x417c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x4c6b3c]
imul ecx, dword [eax + eax + 0x53], 0x50
call dword [sym.imp.USER32.dll_HideCaret]
mov ecx, dword [0x4c6b3c]
add byte [ecx - 0x18], dl
mov word [edx], ds
or al, byte [eax]

Function at 0x417c25
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x4c6b3c]
imul ecx, dword [eax + eax + 0x53], 0x50
call dword [sym.imp.USER32.dll_HideCaret]
mov ecx, dword [0x4c6b3c]
add byte [ecx - 0x18], dl
mov word [edx], ds
or al, byte [eax]

Function at 0x417c6d
Capabilities:
Query or enumerate registry value

Disassembly:
jne 0x417cdc
push 0x4c6c4c
mov dword [esp + 8], 0
inc esp
and al, 8
add byte [eax], al
add byte [eax], al

Function at 0x437a05
Capabilities:
Encode data using xor

Disassembly:
sbb dh, byte [ebx]
sbb dword [edi - 0x18c2cb1a], 0xffffff87
xchg esi, eax
mov edi, dword [edx + edi*4]
inc edi
push 0xb1d651f
shr byte [edi], cl
enter 0xffffffffffffac3a, 0xffffffffffffff8a
inc eax
stosd dword es:[edi], eax
pop ecx
les edx, ds:[edi]
sar edi, 1
xchg ebx, eax
test byte [eax - 0x55], dh
dec esp
idiv byte [ebx + edx]
das
sub al, 0xa7
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
daa
mov edi, 0x1756a416
mov bh, 4
sub edx, dword [edx]
aas
mov esi, 0x8fae0c9b
sahf
and al, 0xba
and al, 0x86
adc al, 0xba
add al, 0xa6
cmp esi, edi
test byte [esp + edx*8 + 0x82e947a], bh
dec edi
inc esp
or bl, byte [eax + 0x74d4283a]
cmpsd dword [esi], dword es:[edi]
je 0x4379d9
xor byte [esi], cl
popal
mov al, byte [0xa8428544]
sbb eax, 0xfbe176b
mov eax, 0x9b86abed
aad 0xa
jecxz 0x437ab2
les ebx, [edx + esi*4]
pop ebp
and eax, 0x35650419
cdq
add edx, ecx
xor dword [edx], ebp
pop ss
mov dword [0xfe51aa30], eax
jge 0x437a30
xor edi, esp
ret 0x8dac
leave
xor ebp, dword [esp + eax*2 + 0x5ddf3b9c]
sbb eax, 0xecd3813e
sub al, 0x8c
add esp, 0xd24ac135
inc esi
or byte [eax + 0x1eb00ed5], 0x70
fdiv dword [eax + 0x442c72ca]
Function at 0x44e749
Capabilities:
Encode data using xor

Disassembly:
arpl word [esi - 0x49], cx
mov edx, 0x9e7b4dae
ret
out dx, al
push cs
outsd dx, dword [esi]
out dx, al
fisttp dword [ebx]
fimul dword [ebx + esi*2]
nop
sti
jmp 0x44e760
dec esp
mov dword [edi + 0x5b12add1], esp
xlatb
lodsd eax, dword [esi]
adc bl, byte [ebx - 0x29]
or dword [ebx], esi
xchg edi, eax
lds esp, [edi + 0x24]
stosd dword es:[edi], eax
pushal
and edi, edx
add edi, dword [edx - 0x2e]
loope 0x44e784
jnp 0x44e75c
adc dword [esi + 0x7261bb3e], edx
ja 0x44e719
pop edi
lcall 0xc4ab, 0x9005ab18
sbb byte [ebx - 0x3b546ffb], ch
stosd dword es:[edi], eax
les edi, [esp + esi + 0x1b0babf6]
test al, 0xec
imul esp, dword [eax], 0x3b61af3d
sbb al, bh
pop ss
rcl dword [edx - 0x3a], cl
inc eax
mov ebx, 0x93f1737c
xor byte [edi - 0x7dd78e8a], cl
push esi
add byte [ebx - 0x5f070405], dl
aaa
and eax, 0x7b2a6237
mov al, 0xbd
cmp al, 0x49
and al, 0xd8
test al, 0xdb
dec ebx
mov dl, 0x6c
dec eax
and al, bl
ror dword [edi], cl
sub ebp, dword [eax + 0x73]
xor dword [edx + 0x7ca308ca], ebx
mov ebx, ecx
and esi, ebp
sbb eax, esp
stc
jo 0x44e780
mov esp, 0xbabf634
sbb ebp, dword [eax + 0x3d2069ec]
scasd eax, dword es:[edi]
popal
cmp ebx, dword [edx]
invalid
dec esp
int 0xfa
cdq
cmp edx, dword [edx + 0xb]
cmp ah, byte [ebp + esi*4 - 0x2b]
dec edx
add edi, dword [ebx - 0x48]
inc edx
mov ebp, eax
cli
out dx, al
arpl word [esi], di
and al, byte [esi + 0x2ca86d6f]
sti
out dx, al
push eax
sti
invalid

Function at 0x4baab1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33f8
cmp edx, dword [eax]
je 0x4baad3
add eax, 8
inc ecx
cmp eax, 0x4c3488
jl 0x4baac4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33f8]
jne 0x4bac01
mov eax, dword [0x4c7f80]
cmp eax, 1
je 0x4babdb
test eax, eax
jne 0x4bab04
cmp dword [0x4c3324], 1
je 0x4babdb
cmp edx, 0xfc
je 0x4bac01
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bab3b
lea eax, [ebp - 0x1a4]
push 0x4bfba0
push eax
call fcn.004bb490
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb920
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bab7e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb920
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb9c
push edi
call fcn.004bd7f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfb80
push eax
call fcn.004bb490
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb4a0
lea eax, [ebp - 0xa0]
push 0x4bfb7c
push eax
call fcn.004bb4a0
push dword [esi + 0x4c33fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb4a0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfb54
push eax
call fcn.004bd764
add esp, 0x2c
pop edi
jmp 0x4bac01
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33fc]
push 0
push eax
push dword [esi]
call fcn.004bb920
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret