joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410bf9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov edi, ecx
push eax
push 0
push 2
and dword [edi], 0
mov esi, 0x80004005
push 0x404e0c
push 0x404e24
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x410c70
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [edi], esi
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
add esi, 0x8007000e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00423440
mov esp, ebp
pop ebp
ret

Function at 0x410fbc
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
cmp byte [0x424844], 0
jne 0x411104
push esi
mov esi, 0x424894
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x424844], 0
jne 0x4110fc
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x2c], 5
jne 0x411016
push 2
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
and dword [0x4241cc], 0
jmp 0x4110f4
mov ecx, 0x4241e8
call fcn.004172eb
test eax, eax
je 0x411057
mov ecx, 0x4241f0
call fcn.004172eb
test eax, eax
jne 0x41104e
push 0x10
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
mov dword [0x4241cc], 3
jmp 0x4110f4
call fcn.00410f5f
test al, al
je 0x411073
push 0x20
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
mov dword [0x4241cc], 2
jmp 0x4110f4
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx ecx, ax
mov eax, ecx
push 4
and eax, 0x3ff
pop edx
cmp ax, dx
jne 0x4110dd
and ecx, 0xfc00
mov eax, 0x800
cmp cx, ax
jne 0x4110dd
call fcn.00417326
test al, al
je 0x4110dd
lea eax, [ebp - 4]
xor ebx, ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
push ebx
call dword [sym.imp.NETAPI32.dll_NetGetJoinInformation]
test eax, eax
jne 0x411032
cmp dword [ebp - 4], 3
jne 0x4110c8
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
test bl, bl
je 0x411032
push 4
jmp 0x4110df
push 8
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
mov dword [0x4241cc], 1
mov byte [0x424844], 1
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, dword [0x4241cc]
mov esp, ebp
pop ebp
ret
Function at 0x41486d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
push esi
xor esi, esi
mov dword [ebp - 0x218], eax
push edi
mov dword [ebx], esi
lea ecx, [ebp - 0x220]
mov dword [eax], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x214], esi
call fcn.0040d97f
mov edi, eax
test edi, edi
jle 0x4148bd
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x414a51
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
mov eax, dword [ebp - 0x214]
je 0x414a33
test eax, eax
je 0x414a33
cmp word [eax], si
je 0x414a33
push eax
lea ecx, [ebp - 0x210]
call fcn.00410eaf
mov esi, dword [ebp - 0x210]
test esi, esi
je 0x414a1d
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
push 0x20119
push 0
push 0x405210
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4149a0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0x405250
push 0
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov dword [ebp - 0x228], eax
test eax, eax
jne 0x41498b
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00415391
mov esi, dword [ebp - 0x210]
mov edi, eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x228], 0
je 0x4149c5
push 0x405268
lea ecx, [ebp - 0x210]
call fcn.00415391
push 1
push 0x212
mov edi, eax
call dword [sym.imp.urlmon.dll_Ordinal_414]
mov esi, dword [ebp - 0x210]
test edi, edi
js 0x414a22
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, dword [ebp - 0x218]
add eax, eax
push eax
mov dword [ecx], eax
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov dword [ebx], eax
pop ecx
test eax, eax
je 0x414a1d
mov ecx, dword [ebp - 0x218]
push dword [ecx]
push esi
push dword [ecx]
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
je 0x414a22
push dword [ebx]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
and dword [ebx], 0
mov edi, 0x80004005
pop ecx
mov ecx, dword [ebp - 0x218]
and dword [ecx], 0
jmp 0x414a22
mov edi, 0x8007000e
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x214]
xor esi, esi
jmp 0x414a38
mov edi, 0x80004005
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x220]
mov dword [ebp - 0x214], esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423440
mov esp, ebp
pop ebp
ret
Function at 0x4156e6
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ecx], 0
push esi
mov esi, 0x80004005
je 0x415793
cmp dword [ebp + 8], 0
je 0x415793
cmp dword [ebp + 0x10], 0
je 0x415793
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push esi
push 0x800c
push dword [ecx]
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41577e
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41575e
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x20
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x415773
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x415773
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x415793
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x415793
movzx esi, si
or esi, 0x80070000
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4157a1
Capabilities:
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, 0x80004005
mov dword [ebp - 0xc], ebx
cmp dword [edi], ebx
je 0x4158b2
cmp dword [ebp + 8], ebx
je 0x4158b2
cmp dword [ebp + 0x10], ebx
je 0x4158b2
cmp dword [ebp + 0x18], ebx
je 0x4158b2
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x800c
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x415899
push ebx
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x415879
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00415c6c
test eax, eax
js 0x415865
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
test eax, eax
je 0x415845
mov esi, dword [ebp - 0xc]
jmp 0x41585a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41585a
movzx esi, si
or esi, 0x80070000
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x41588e
push 1
push 0x1e1
mov esi, 0x80092004
call dword [sym.imp.urlmon.dll_Ordinal_414]
jmp 0x41588e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41588e
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x4158ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4158b0
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x4158bf
push 1
push 0x20e
call dword [sym.imp.urlmon.dll_Ordinal_414]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4163cb
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x38], eax
push ebx
push esi
push edi
mov edi, 0x80070057
test eax, eax
je 0x416503
xor ebx, ebx
mov edi, 0x80004005
mov byte [eax], bl
mov eax, dword [ecx]
push 0x20
pop esi
cmp dword [eax], ebx
je 0x416435
lea ecx, [ebp - 0x24]
push ecx
push esi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x41641d
mov edi, ebx
jmp 0x416432
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x416432
movzx edi, di
or edi, 0x80070000
mov ecx, dword [ebp - 0x2c]
test edi, edi
js 0x416503
lea eax, [ebp - 0x24]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x44], ebx
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x40], ebx
push eax
push ecx
push 0x4063a8
push 1
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x3c], ebx
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], ebx
call fcn.00417017
mov esi, dword [ebp - 0x34]
mov edi, eax
test edi, edi
js 0x4164fc
mov ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
test esi, esi
je 0x4164ce
mov ecx, dword [ebp - 0x2c]
push esi
mov ecx, dword [ecx]
call fcn.00415b45
mov edi, eax
mov eax, dword [ebp - 0x28]
test edi, edi
js 0x4164d3
cmp eax, 1
jne 0x4164ce
test ebx, ebx
je 0x4164ce
push dword [ebx]
lea eax, [ebp - 0x24]
push dword [ebx + 4]
push dword [ebx + 8]
push dword [ebx + 0xc]
push ecx
push eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call fcn.004157a1
mov ecx, dword [ebp - 0x38]
test eax, eax
setns al
mov byte [ecx], al
mov eax, dword [ebp - 0x28]
jmp 0x4164d3
mov edi, 0x80004005
test ebx, ebx
je 0x4164fc
test eax, eax
je 0x4164f4
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x30]
mov ecx, ebx
call fcn.00412a37
add ebx, 0x10
dec esi
jne 0x4164e1
mov esi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x30]
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423440
mov esp, ebp
pop ebp
ret 8
Function at 0x416ba2
Capabilities:
Connect to http server
Create http request
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x22dc
call fcn.00423cf0
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov dword [ebp - 0x22a0], ecx
lea ecx, [ebp - 0x2298]
push ebx
push ecx
lea ecx, [ebp - 0x124c]
mov dword [ebp - 0x2298], 0x824
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
je 0x416d42
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x22dc]
push ebx
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x204]
mov dword [ebp - 0x22dc], edi
mov dword [ebp - 0x22cc], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x22c8], 0x100
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x2294]
mov dword [ebp - 0x22b0], eax
xor eax, eax
mov word [ebp - 0x2294], ax
lea eax, [ebp - 0x22dc]
push eax
push ebx
push dword [ebp - 0x2298]
lea eax, [ebp - 0x124c]
mov dword [ebp - 0x22ac], 0x824
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x416d42
push ebx
push ebx
push ebx
push ebx
push 0x40624c
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
je 0x416d42
push ebx
push 0x200
push 3
push ebx
push ebx
push dword [ebp - 0x22c4]
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, eax
test ebx, ebx
je 0x416d24
cmp dword [ebp - 0x22d0], 4
mov eax, 0x680100
jne 0x416cc2
mov eax, 0xe80100
xor ecx, ecx
push ecx
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x2294]
push eax
push 0x40625c
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [ebp - 0x229c], eax
test eax, eax
je 0x416d06
push dword [ebp - 0x22a0]
push dword [ebp + 0x10]
push esi
push eax
call fcn.00416d71
push dword [ebp - 0x229c]
mov esi, eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x416d1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x416d1b
movzx esi, si
or esi, 0x80070000
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x416d39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x416d39
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x416d57
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x416d57
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423440
mov esp, ebp
pop ebp
ret 0x10
Function at 0x419947
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
test edi, edi
je 0x419a72
test edx, edx
je 0x419a72
mov eax, dword [ebp + 8]
test eax, eax
je 0x419a72
push ebx
push esi
xor esi, esi
push 0x2000
mov dword [edx], esi
push edi
mov dword [eax], esi
call dword [sym.imp.msvcrt.dll_strnlen]
mov ebx, eax
pop ecx
pop ecx
mov dword [ebp - 0xc], ebx
lea eax, [ebx - 1]
cmp eax, 0x1ffe
ja 0x419a67
mov eax, esi
mov dword [ebp - 8], eax
test ebx, ebx
je 0x4199d1
mov al, byte [eax + edi]
mov byte [ebp - 1], al
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll_isalnum]
pop ecx
test eax, eax
jne 0x4199c6
mov al, byte [ebp - 1]
cmp al, 0x2b
je 0x4199c6
cmp al, 0x2f
je 0x4199c6
cmp al, 0x3d
jne 0x419a33
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, ebx
jb 0x4199a2
push esi
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push esi
push 1
push ebx
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x419a50
mov eax, dword [ebp - 8]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x419a49
push esi
push esi
lea eax, [ebp - 8]
push eax
push ebx
push 1
push dword [ebp - 0xc]
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x419a3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x419a29
movzx esi, si
or esi, 0x80070000
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
jmp 0x419a6c
mov esi, 0x8007000d
jmp 0x419a6c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ebx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x419a6c
mov esi, 0x8007000e
jmp 0x419a6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x419a6c
movzx esi, si
or esi, 0x80070000
jmp 0x419a6c
mov esi, 0x80070057
mov eax, esi
pop esi
pop ebx
jmp 0x419a77
mov eax, 0x80070057
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x419b2e
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 8], eax
mov ebx, edx
test edi, edi
je 0x419bdd
test ebx, ebx
je 0x419bdd
push esi
xor edx, edx
lea ecx, [ebp - 4]
push ecx
push edx
push 0x40000001
push ebx
push eax
mov esi, edx
mov dword [edi], edx
mov dword [ebp - 4], edx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x419bc3
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov dword [edi], eax
pop ecx
test eax, eax
je 0x419bbc
lea ecx, [ebp - 4]
push ecx
push eax
push 0x40000001
push ebx
push dword [ebp - 8]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x419bd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x419bae
movzx esi, si
or esi, 0x80070000
push dword [edi]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
and dword [edi], 0
pop ecx
jmp 0x419bd8
mov esi, 0x8007000e
jmp 0x419bd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x419bd8
movzx esi, si
or esi, 0x80070000
mov eax, esi
pop esi
jmp 0x419be2
mov eax, 0x80070057
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x419c61
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, edx
push ebx
push esi
mov dword [ebp - 8], eax
xor ebx, ebx
lea esi, [eax + 4]
mov eax, dword [ebp + 0xc]
push edi
push esi
mov edi, ecx
mov dword [eax], esi
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov esi, eax
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], esi
test esi, esi
je 0x419d0b
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.msvcrt.dll_rand_s]
pop ecx
test eax, eax
jne 0x419d04
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi], ecx
add esi, 4
shr edx, 2
test edx, edx
je 0x419cd9
imul ecx, ecx, 0x343fd
mov dword [ebp - 0xc], ebx
add ecx, 0x269ec3
mov dword [ebp - 4], ecx
mov al, byte [ebp + ebx - 4]
xor al, byte [edi]
inc ebx
inc edi
mov byte [esi], al
inc esi
cmp ebx, 4
jb 0x419cc3
push 0
pop ebx
dec edx
jne 0x419cb1
mov edx, dword [ebp - 8]
imul eax, ecx, 0x343fd
mov ecx, ebx
add eax, 0x269ec3
mov dword [ebp - 4], eax
and edx, 3
jbe 0x419d10
sub esi, edi
mov al, byte [ebp + ecx - 4]
xor al, byte [edi]
inc ecx
mov byte [esi + edi], al
inc edi
cmp ecx, edx
jb 0x419cf3
jmp 0x419d10
mov ebx, 0x80004005
jmp 0x419d10
mov ebx, 0x8007000e
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x419d20
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, edx
mov dword [ebp - 8], ecx
push dword [ebx]
xor edi, edi
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov dword [esi], eax
pop ecx
test eax, eax
je 0x419dbb
push dword [ebx]
push edi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 8]
add esp, 0xc
mov esi, dword [esi]
mov ebx, dword [eax]
lea ecx, [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
shr eax, 2
mov dword [ebp - 8], eax
test eax, eax
je 0x419d8e
imul ebx, ebx, 0x343fd
mov edx, edi
add ebx, 0x269ec3
mov dword [ebp - 4], ebx
mov al, byte [ebp + edx - 4]
xor al, byte [ecx]
inc ecx
mov byte [esi], al
inc esi
inc edx
cmp edx, 4
jb 0x419d79
dec dword [ebp - 8]
jne 0x419d68
imul eax, ebx, 0x343fd
mov edx, edi
add eax, 0x269ec3
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
and ebx, 3
jbe 0x419dc0
sub esi, ecx
mov al, byte [ebp + edx - 4]
xor al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
inc edx
cmp edx, ebx
jb 0x419daa
jmp 0x419dc0
mov edi, 0x8007000e
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41c9bb
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xac], eax
mov dword [eax], ebx
lea eax, [ebp - 0xa0]
push ecx
push eax
mov dword [ebp - 0xa4], edx
lea edx, [ebp - 0x88]
push 0x81
mov byte [ebp - 0x88], bl
mov dword [ebp - 0xa0], ebx
call fcn.0041ef9c
mov esi, eax
test esi, esi
js 0x41cbe1
push edi
push 0x448
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x41ca33
push ecx
mov ecx, eax
call fcn.0041c7d6
mov edi, eax
jmp 0x41ca35
mov edi, ebx
test edi, edi
jne 0x41ca4d
mov esi, 0x8007000e
mov dword [0x42484c], 0x1a8
jmp 0x41cbe0
lea ebx, [edi + 0x410]
mov edx, ebx
call fcn.0041ced2
mov esi, eax
test esi, esi
js 0x41cbe0
push 0x3e8
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41ca80
mov ecx, eax
call fcn.0041d008
mov esi, eax
jmp 0x41ca82
xor esi, esi
test esi, esi
js 0x41cbd1
lea eax, [ebp - 0x99]
mov byte [ebp - 0x99], 1
push eax
push 0
push dword [ebp - 0xa4]
mov ecx, edi
call fcn.0041cd9e
mov esi, eax
mov dword [ebp - 0xa0], esi
test esi, esi
js 0x41cb90
cmp byte [ebp - 0x99], 0
jne 0x41cb07
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x41caec
call fcn.0041e973
jmp 0x41caee
xor eax, eax
test eax, eax
js 0x41cb07
lea eax, [ebp - 0xa8]
push eax
push eax
push eax
push dword [edi + 0x418]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0x3e8
push dword [edi + 0x414]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41cb27
mov ecx, eax
call fcn.0041d008
mov esi, eax
jmp 0x41cb29
xor esi, esi
mov dword [ebp - 0xa0], esi
test esi, esi
js 0x41cb90
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x41cb43
xor esi, esi
jmp 0x41cb4a
call fcn.0041d06a
mov esi, eax
mov dword [ebp - 0xa0], esi
test esi, esi
js 0x41cb6c
push ecx
push ecx
lea eax, [ebp - 0x88]
mov ecx, edi
push eax
call fcn.0041d617
mov esi, eax
mov dword [ebp - 0xa0], esi
push dword [edi + 0x414]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x41cbc1
call fcn.0041d06a
test eax, eax
jns 0x41cbc1
test esi, esi
js 0x41cbd1
push 0x1d7
jmp 0x41cbae
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x41cbc1
call fcn.0041d06a
test eax, eax
jns 0x41cbc1
test esi, esi
js 0x41cbd1
push 0x1dd
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.0041c7a5
mov esi, dword [ebp - 0xa0]
test esi, esi
js 0x41cbd1
mov eax, dword [ebp - 0xac]
xor esi, esi
mov dword [eax], edi
jmp 0x41cbe0
mov ecx, edi
call fcn.0041c830
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423440
mov esp, ebp
pop ebp
ret 0x14