joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4411e8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [0x461198]
cmp byte [eax + 0xc], 0
je 0x44135a
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x441353
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x462b64], 0
jne 0x441241
push 0x441360
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [ebp - 4], eax
push 0x441368
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462b64], eax
cmp dword [0x460b04], 0
jne 0x44133c
push 0x441378
call sub.kernel32.dll_LoadLibraryA
mov dword [0x460b04], eax
cmp dword [0x460b04], 0
je 0x44133c
push 0x441384
mov eax, dword [0x460b04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462b68], eax
push 0x441394
mov eax, dword [0x460b04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462b6c], eax
push 0x4413a8
mov eax, dword [0x460b04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462b70], eax
push 0x4413c0
mov eax, dword [0x460b04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462b74], eax
push 0x4413d8
mov eax, dword [0x460b04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462b78], eax
push 0x4413ec
mov eax, dword [0x460b04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462b7c], eax
push 0x441404
mov eax, dword [0x460b04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462b80], eax
push 0x44141c
mov eax, dword [0x460b04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462b84], eax
push 0x441438
mov eax, dword [0x460b04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462b88], eax
push 0x441444
mov eax, dword [0x460b04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462b8c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44135a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ecx
pop ecx
pop ebp
ret

Function at 0x445cf8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
mov eax, dword [ebp - 8]
call fcn.00403e84
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x445d51
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.004040f4
mov esp, ebp
pop ebp
ret
Function at 0x44e8e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov word [ebp - 2], ax
mov al, byte [0x44e940]
mov byte [ebp - 3], al
test byte [ebp - 2], 4
je 0x44e902
or byte [ebp - 3], 1
test byte [ebp - 2], 8
je 0x44e90c
or byte [ebp - 3], 4
test byte [ebp - 2], 1
je 0x44e916
or byte [ebp - 3], 8
test byte [ebp - 2], 2
je 0x44e920
or byte [ebp - 3], 0x10
test byte [ebp - 2], 0x10
je 0x44e92a
or byte [ebp - 3], 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44e93a
or byte [ebp - 3], 2
mov al, byte [ebp - 3]
pop ecx
pop ebp
ret

Function at 0x44e944
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov al, byte [0x44e988]
mov byte [ebp - 5], al
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44e965
or byte [ebp - 5], 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44e975
or byte [ebp - 5], 4
test byte [ebp - 1], 0x20
je 0x44e97f
or byte [ebp - 5], 2
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x4568e8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
test dl, dl
je 0x4568fa
add esp, 0xfffffff0
call fcn.00403458
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0041b99c
mov eax, dword [0x460e60]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x456e58
mov eax, dword [0x460e6c]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x456e78
mov eax, dword [ebp - 4]
call fcn.00456e98
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41275c]
call fcn.0040311c
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41275c]
call fcn.0040311c
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], eax
mov dl, 1
mov eax, dword [0x41275c]
call fcn.0040311c
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov dl, 1
mov eax, dword [0x41275c]
call fcn.0040311c
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], eax
mov dl, 1
mov eax, dword [0x41275c]
call fcn.0040311c
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x10], eax
push 0x5a
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_GetDeviceCaps
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, 0x4522a8
push eax
push 0
push 0
mov eax, dword [0x460fb8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41db74]
call fcn.0041f16c
mov edx, dword [ebp - 4]
mov dword [edx + 0x84], eax
mov dl, 1
mov eax, dword [0x41db74]
call fcn.0041f16c
mov edx, dword [ebp - 4]
mov dword [edx + 0x88], eax
mov dl, 1
mov eax, dword [0x41db74]
call fcn.0041f16c
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov eax, dword [ebp - 4]
call fcn.004573e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x457230
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x457230
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x457230
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x456a82
call fcn.004034b0
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x456fe8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor edx, edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4571b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x457191
mov dl, 1
mov eax, dword [0x412b78]
call fcn.0040311c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403e84
lea eax, [ebp - 0x11c]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x45717a
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
call fcn.00441588
test al, al
je 0x45716e
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
lea ecx, [ebp - 0x264]
mov edx, 0x4571c4
lea eax, [ebp - 0x25c]
call fcn.00409094
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45716e
xor eax, eax
push ebp
push 0x457167
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], pe_nt_image_headers32
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x4571fc
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x457150
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x21c]
mov ecx, pe_nt_image_headers32
call fcn.004040f4
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x457150
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x21c]
mov ecx, pe_nt_image_headers32
call fcn.004040f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45716e
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x45705d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dl, 1
call fcn.00417294
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4571ba
lea eax, [ebp - 0x268]
call fcn.00403e84
ret
Function at 0x457cec
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x462bb0]
cmp byte [eax + 0xa5], 0
jne 0x457d63
cmp dword [0x462bc8], 0
jne 0x457d21
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x457ca8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x462bc8], eax
cmp dword [0x462bc4], 0
jne 0x457d3c
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x462bc4], eax
cmp dword [0x462bcc], 0
jne 0x457d63
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x457c48
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x462bcc], eax
pop ecx
pop ebp
ret

Function at 0x457e2c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.00457dc4
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x457e4d
xor eax, eax
call fcn.00457dfc
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x457e67
mov al, 1
call fcn.00457dfc
mov esp, ebp
pop ebp
ret

Function at 0x45852c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x462bb0]
cmp dword [eax + 0x30], 0
je 0x4585f6
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x4585ed
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x4584ac
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
cmp dword [eax + 8], 0
je 0x4585ed
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
push 0xffffffffffffffec
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4585a7
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4585ed
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
call fcn.00414f64
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4585bc
mov eax, dword [ebp - 4]
inc dword [eax + 0x94]
mov esp, ebp
pop ebp
ret

Function at 0x459310
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa4], 0
je 0x459355
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.00403f74
jmp 0x459366
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x8c]
call fcn.00403ed8
mov esp, ebp
pop ebp
ret
Function at 0x45a70c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x45a75f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0043ba3c
test al, al
je 0x45a75f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0043b678
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45a75f
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0043b678
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret

Function at 0x45cae4
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, eax
lea eax, [esp + 8]
push eax
mov eax, edi
call fcn.00404344
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x45cb15
mov dword [esp], 0
mov dword [esp + 4], 0
jmp 0x45cb80
mov eax, ebx
call fcn.004026dc
mov esi, eax
push esi
push ebx
push 0
mov eax, edi
call fcn.00404344
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x45cb6a
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push 0x45cb90
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45cb6a
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0xc]
mov cl, 8
call fcn.0045ba14
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x45cb79
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, esi
call fcn.004026fc
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x95f287
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
xor dword [edx], eax
add edx, 4
dec ecx
jne 0x95f29f
pop ebp
ret 0xc

Function at 0x95f34e
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebp
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x95f37f
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95f35d
add dl, dl
jne 0x95f392
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95f402
xor eax, eax
add dl, dl
jne 0x95f3a7
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95f4d7
add dl, dl
jne 0x95f3ba
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95f3c9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95f3d8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95f3e7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x95f3f5
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x95f372
mov eax, 1
add dl, dl
jne 0x95f414
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95f423
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x95f407
sub eax, ebx
mov ebx, 1
jne 0x95f46a
mov ecx, 1
add dl, dl
jne 0x95f448
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x95f457
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x95f43b
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x95f372
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x95f485
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x95f494
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x95f478
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x95f372
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x95f4ff
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x95f372
pop ebp
sub edi, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x80a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0080a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x80a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x80a06a
add dl, dl
jne 0x80a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x80a0dc
xor eax, eax
add dl, dl
jne 0x80a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x80a17d
add dl, dl
jne 0x80a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x80a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x80a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x80a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x80a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x80a075
mov eax, 1
add dl, dl
jne 0x80a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x80a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x80a0e1
sub eax, ebx
mov ebx, 1
jne 0x80a128
mov ecx, 1
add dl, dl
jne 0x80a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x80a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x80a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x80a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x80a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x80a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x80a136
cmp eax, 0x7d00
jae 0x80a16d
cmp eax, 0x500
jb 0x80a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x80a075
cmp eax, 0x7f
ja 0x80a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x80a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x80a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x80a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100033a6
Capabilities:
Encode data using base64

Disassembly:
push 0x10
mov eax, 0x100eeedb
call fcn.100dea80
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp + 8]
call fcn.10002d18
xor esi, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], 1
cmp dword [ebp + 0x10], edi
je 0x100034fa
mov eax, dword [ebp + 0xc]
dec dword [ebp + 0x10]
mov al, byte [eax]
mov byte [ebp + esi - 0x10], al
mov bl, byte [ebp - 0xf]
inc esi
inc dword [ebp + 0xc]
cmp esi, 3
jne 0x10003451
mov al, byte [ebp - 0x10]
shr al, 2
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0x10]
and al, 3
shl al, 4
mov cl, bl
shr cl, 4
add al, cl
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0x13], al
mov al, bl
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0x12], al
mov al, byte [ebp - 0xe]
and al, 0x3f
mov byte [ebp - 0x11], al
xor esi, esi
movzx edi, byte [ebp + esi - 0x14]
mov eax, 0x101466e4
call fcn.10003692
mov al, byte [eax]
mov ecx, dword [ebp + 8]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
push 1
call fcn.1000352f
inc esi
cmp esi, 4
jl 0x10003426
xor esi, esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jne 0x100033d7
cmp esi, edi
je 0x100034fa
cmp esi, 3
jge 0x1000347a
push 3
pop ecx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x10]
push edi
push eax
call fcn.100ab9a0
mov bl, byte [ebp - 0xf]
add esp, 0xc
mov al, byte [ebp - 0x10]
mov cl, al
shr cl, 2
mov byte [ebp - 0x14], cl
and al, 3
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xe]
and bl, 0xf
mov cl, al
shl bl, 2
shr cl, 6
add bl, cl
mov byte [ebp - 0x12], bl
and al, 0x3f
lea ebx, [esi + 1]
mov byte [ebp - 0x11], al
mov dword [ebp + 0x10], edi
cmp ebx, edi
jle 0x100034e2
mov eax, dword [ebp + 0x10]
movzx edi, byte [ebp + eax - 0x14]
mov eax, 0x101466e4
call fcn.10003692
mov al, byte [eax]
mov ecx, dword [ebp + 8]
mov byte [ebp + 0xc], al
push dword [ebp + 0xc]
push 1
call fcn.1000352f
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], ebx
jl 0x100034b6
push 3
pop edi
cmp esi, edi
jge 0x100034fa
sub edi, esi
mov ecx, dword [ebp + 8]
push 0x3d
push 1
call fcn.1000352f
dec edi
jne 0x100034eb
mov eax, dword [ebp + 8]
call fcn.100deb40
ret 0xc
Function at 0x100041cd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x274
mov eax, 0x100eed6d
call fcn.100deb00
mov eax, dword [ebp + 8]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
mov ebx, edx
xor esi, esi
inc edi
push esi
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x260], 0xff
mov dword [ebp - 0x270], 7
mov dword [ebp - 0x268], edi
call fcn.100015a1
push esi
mov ecx, ebx
call fcn.100015a1
call fcn.1001505f
lea ebx, [eax + 1]
mov dword [ebp - 0x25c], esi
cmp ebx, esi
jle 0x100043fd
cmp dword [ebp - 0x25c], esi
jle 0x10004251
or dword [ebp - 0x268], 0x100
push dword [ebp - 0x274]
lea eax, [ebp - 0x238]
push eax
call fcn.10014650
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x10004270
mov eax, dword [eax + 4]
jmp 0x10004273
add eax, 4
lea ecx, [ebp - 0x264]
push ecx
push dword [ebp - 0x268]
push esi
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x278], eax
call fcn.100031be
lea ecx, [ebp - 0x238]
call fcn.10002740
cmp dword [ebp - 0x278], esi
jne 0x100043eb
mov eax, dword [ebp - 0x26c]
cmp dword [eax + 0x14], esi
jne 0x10004353
mov eax, 0x208
push eax
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100ab9a0
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x270]
push eax
push esi
push str.InstallTime
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [ebp - 0x218], si
je 0x10004353
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.10014fe8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x26c]
push eax
mov dword [ebp - 4], esi
call fcn.10002c71
or dword [ebp - 4], 0xffffffff
push esi
push edi
lea ecx, [ebp - 0x238]
call fcn.100015c0
lea ecx, [ebp - 0x238]
call fcn.10002740
mov eax, 0x208
push eax
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100ab9a0
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x270]
push eax
push esi
push str.Channel
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [ebp - 0x218], si
je 0x100043df
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.10014fe8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x280]
push eax
mov dword [ebp - 4], edi
call fcn.10002c71
or dword [ebp - 4], 0xffffffff
push esi
push edi
lea ecx, [ebp - 0x258]
call fcn.100015c0
lea ecx, [ebp - 0x258]
call fcn.10002740
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x25c]
cmp dword [ebp - 0x25c], ebx
jl 0x1000423f
mov eax, edi
call fcn.100deb60
ret