joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40349a
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
add ecx, 8
push esi
push 8
mov eax, edx
pop esi
test al, 1
je 0x4034b2
shr eax, 1
xor eax, 0xedb88320
jmp 0x4034b4
shr eax, 1
dec esi
jne 0x4034a5
mov dword [ecx], eax
inc edx
add ecx, 4
cmp edx, 0xff
jle 0x4034a0
pop esi
ret

Function at 0x4072f5
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x46159c]
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea ecx, [ebp - 0x238]
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
call fcn.00407279
mov eax, dword [ebp - 0x220]
xor eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x21c]
xor ecx, dword [ebp + 0x18]
and eax, dword [ebp - 0x210]
and ecx, dword [ebp - 0x20c]
mov dword [ebp - 0x238], eax
mov esi, 0x100
push esi
lea eax, [ebp - 0x204]
mov dword [ebp - 0x234], ecx
xor ebx, ebx
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 0x230], bl
mov dword [ebp - 0x208], ebx
xor edi, edi
call fcn.004072bc
xor eax, eax
mov byte [ebp + eax - 0x104], al
inc eax
cmp eax, esi
jl 0x40736e
mov dword [ebp + 0x18], ebx
mov eax, dword [ebp + 0x18]
xor ecx, ecx
mov cl, byte [ebp + edi - 0x204]
lea eax, [ebp + eax - 0x104]
movsx edx, byte [eax]
add ecx, dword [ebp - 0x208]
add ecx, edx
and ecx, 0xff
mov dword [ebp - 0x208], ecx
lea ecx, [ebp + ecx - 0x104]
movsx ebx, byte [ecx]
inc edi
cmp edi, esi
mov byte [ecx], dl
mov byte [eax], bl
jl 0x4073bc
xor edi, edi
inc dword [ebp + 0x18]
cmp dword [ebp + 0x18], esi
jl 0x40737d
mov edi, dword [ebp + 0x10]
test edi, edi
jge 0x4073cd
neg edi
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x4073f5
mov ecx, dword [ebp + 8]
sub edi, ecx
mov dword [ebp + 0x10], eax
lea eax, [edi + ecx]
cdq
mov ebx, esi
idiv ebx
mov al, byte [ebp + edx - 0x104]
and al, 0x7f
xor byte [ecx], al
inc ecx
dec dword [ebp + 0x10]
jne 0x4073dc
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00439e9c
leave
ret

Function at 0x407b65
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x407bb5
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x44bb88
call fcn.0043a704
sub esp, 0x1c
mov eax, dword [0x46694c]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push 0x2001f
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407c8b
push 4
pop edi
push edi
mov dword [ebp - 0x20], edi
call fcn.0043adb2
pop ecx
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push ebx
mov esi, str.WarnOnZoneCrossing
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407c44
cmp dword [ebp - 0x24], edi
jne 0x407c60
push edi
push dword [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
call fcn.0043a730
mov eax, dword [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x18], eax
jmp 0x407c60
xor eax, eax
inc eax
push edi
mov dword [0x46694c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 8]
je 0x407c79
push edi
lea eax, [ebp + 8]
push eax
push edi
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x1c]
call fcn.0043adad
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x40849a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x20]
sub eax, edi
push eax
lea eax, [esi + edi]
push eax
call fcn.00408347
add esp, 0xc
cmp edi, dword [ebp + 0x10]
mov ecx, edi
jae 0x4084dd
xor edx, edx
mov eax, ecx
div dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov al, byte [edx + eax]
xor al, byte [ecx + esi]
xor al, byte [ebp + 0x1c]
mov byte [ecx + esi], al
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x4084c1
pop edi
pop esi
pop ebp
ret
Function at 0x414dbb
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x46159c]
push ebx
push esi
push 0x2001f
push dword [ebp + 0x9c]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp + 0x90], eax
mov dword [ebp - 0x74], esi
call fcn.00414cec
cmp eax, esi
jne 0x414e43
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x414e0c
lea eax, [ebp - 0x70]
push eax
call fcn.00414dbb
cmp eax, esi
jne 0x414e42
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x74]
je 0x414dff
call fcn.00414cd5
push dword [ebp + 0x9c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.00414cd5
mov ecx, dword [ebp + 0x90]
mov eax, esi
pop esi
pop ebx
call fcn.00439e9c
add ebp, 0x94
leave
ret 4
Function at 0x415253
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x41525e
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x41670d
Capabilities:
Set current directory
Terminate process

Disassembly:
mov eax, 0x44c19b
call fcn.0043a704
push ecx
mov eax, 0x1168
call fcn.0043b570
mov eax, dword [0x46159c]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
call fcn.004333ba
call fcn.004084e1
test al, al
jne 0x416759
push 0
push str.Fatal_Error
push str.Files_are_altered_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
jmp 0x417686
push 0x44e5c8
push 0x4663d8
call fcn.00439f50
pop ecx
pop ecx
push 0x104
mov edi, 0x4667d8
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push edi
call fcn.0043b820
cmp eax, esi
pop ecx
pop ecx
jne 0x41679c
push esi
push str.Fatal_Error
push str.Invalid_access_rights_
sbb al, byte [ebp]
jmp 0x416b14
push edi
mov byte [eax + 1], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x4167b2
sar byte [ebx - 0x53], 1
jns 0x416794
out dx, al
mov eax, dword [0x890e4c3]
loopne 0x4167b2
test eax, 0x53b96089
invalid
fisub word [ecx + 0x7f979c15]
pop esi
pushfd
xchg edi, eax
jg 0x416b76
and dword [ecx + ecx*8 - 2], eax
cmp al, 0x43
push ebp
or dword [edi - 0x7b], ecx
mov dl, 0x26
xchg ecx, eax
mov ebx, eax
movsd dword es:[edi], dword [esi]
pop edx
fldcw word [esi + 0x61]
mov ebx, 0x473847c5
leave
inc ebx
jo 0x426bafdc
xor al, 0x17
outsd dx, dword [esi]
js 0x416b6e
mov ebp, dword [edx + 0xd]
and byte [eax], cl
test al, 0xf3
mov ch, 0x76
xlatb
push edi
mov ch, 0x19
imul edi, dword [ecx + 0x75], 0x3b
pop esi
ljmp 0xf65e
outsd dx, dword [esi]
test byte [esi + 0x4b], dh
mov eax, 0x4240f7ca
inc edx
pop ds
add ecx, dword [ecx + 0x579af4a2]
les esi, [ecx - 0x618e9255]
sub byte [ecx + ecx*4], bl
ja 0x416b11
cmp esi, dword [edx]
out dx, eax
mov ebx, 0xc3bc7d0b
int3
call fcn.0043bb09
int3

Function at 0x41a5c7
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
call fcn.00439e9c
leave
ret
push esi
jmp 0x41a5d3
fstp xword [edi + 0x3f]
jno 0x41a626
sbb esi, dword [ecx + 0x75]
jno 0x41a5ba
push ecx
sbb dword [ebx], edx
sbb edx, dword [bx + 0x5f17]
push ebp
sbb al, 0x3d
adc eax, 0x7e4ec123
imul ebx, ebp, 0xffffff94
sub al, 0x16
retf
add byte [edx], al
add byte [edx], ch
Function at 0x41a712
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7b8]
sub esp, 0x838
mov eax, dword [0x46159c]
push esi
mov dword [ebp + 0x7b4], eax
lea eax, [ebp - 0x50]
push eax
push 0x20019
push 0
mov esi, ecx
push dword [esi + 0x104]
mov dword [ebp - 0x60], 0x800
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41a804
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x41a7fb
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
inc eax
push edi
push eax
call fcn.0043adb2
pop ecx
mov edi, eax
lea eax, [ebp - 0x5c]
push eax
push edi
lea eax, [ebp - 0x58]
push eax
push 0
push str.cdgfilename
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a7f3
cmp dword [ebp - 0x58], 1
jne 0x41a7f3
push dword [esi + 0x100]
call fcn.0043adad
and dword [esi + 0x100], 0
push edi
call fcn.00439eb0
inc eax
push eax
call fcn.0043adb2
push edi
push eax
mov dword [esi + 0x100], eax
call fcn.00439f50
add esp, 0x14
push edi
call fcn.0043adad
pop ecx
pop edi
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0x100]
mov ecx, dword [ebp + 0x7b4]
pop esi
call fcn.00439e9c
add ebp, 0x7b8
leave
ret

Function at 0x41a956
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x44c411
call fcn.0043a704
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 0xc
mov dword [esi], 0x452278
mov dword [esi + 0x94], ebx
mov dword [esi + 0x108], ebx
call fcn.00439f3b
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x41a988
call fcn.004200eb
jmp 0x41a98a
xor eax, eax
mov dword [esi + 0x24], eax
lea eax, [esi + 0x98]
push 0x44e5c8
push eax
mov dword [esi + 0x100], ebx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x28], bl
mov byte [esi + 0x29], bl
mov byte [esi + 0x38], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call fcn.00439f50
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41e351
Capabilities:
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
cmp byte [ebp + 8], 0
mov eax, dword [0x46159c]
mov dword [ebp - 4], eax
je 0x41e56d
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x41e56c
push dword [ebp + 0xc]
call fcn.00439eb0
cmp eax, edi
pop ecx
mov dword [ebp - 0x510], eax
jle 0x41e56c
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
mov byte [ebp - 0x108], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.0043b820
cmp eax, edi
pop ecx
pop ecx
je 0x41e3d4
mov byte [eax + 1], 0
lea eax, [ebp - 0x108]
push str.wrapperdl.tdat
push eax
call fcn.00439f60
pop ecx
pop ecx
push ebx
push esi
push edi
mov esi, 0x80
push esi
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov ebx, 0x40000000
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
jne 0x41e432
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 4
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
je 0x41e56a
push 0
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x41e46f
cmp eax, 0x19000
jbe 0x41e46f
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
push 5
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
mov edi, eax
jmp 0x41e475
mov edi, dword [ebp - 0x50c]
cmp edi, 0xffffffff
je 0x41e56a
push 2
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x10], ebx
mov esi, dword [ebp - 0x510]
je 0x41e4ae
push dword [ebp + 0x10]
call fcn.00439eb0
cmp eax, esi
pop ecx
jle 0x41e4ae
push dword [ebp + 0x10]
call fcn.00439eb0
pop ecx
mov esi, eax
add esi, 0x64
push esi
call fcn.0043adb2
mov ebx, 0x452210
mov esi, eax
push ebx
push esi
call fcn.00439f50
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x41e4d5
push edi
call fcn.00421c8c
pop ecx
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
call fcn.0043a138
lea eax, [ebp + 8]
push eax
call fcn.0043c5f3
push eax
push str._d__m__Y__H:_M:_S
lea eax, [ebp - 0x508]
push 0x400
push eax
call fcn.0043c5d8
lea eax, [ebp - 0x508]
push eax
push esi
call fcn.00439f50
push edi
call fcn.00421c8c
push dword [ebp + 0xc]
push esi
call fcn.00439f50
push edi
call fcn.00421c8c
add esp, 0x30
cmp dword [ebp + 0x10], 0
je 0x41e54c
push dword [ebp + 0x10]
call fcn.00439eb0
test eax, eax
pop ecx
jbe 0x41e54c
push dword [ebp + 0x10]
push esi
call fcn.00439f50
push edi
call fcn.00421c8c
add esp, 0xc
push ebx
push esi
call fcn.00439f50
push edi
call fcn.00421c8c
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00439e66
pop ecx
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
call fcn.00439e9c
leave
ret
Function at 0x4204da
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xc0]
sub esp, 0x140
mov eax, dword [0x46159c]
push edi
mov dword [ebp + 0xbc], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
xor edi, edi
push edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0xc8]
mov dword [ebp - 0x5c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x420631
mov eax, dword [ebp - 0x58]
push ebx
inc eax
push esi
push eax
mov dword [ebp - 0x4c], eax
call fcn.00439f3b
mov ebx, eax
mov eax, dword [ebp - 0x58]
inc eax
push eax
push edi
push ebx
mov dword [ebp - 0x4c], eax
call fcn.0043b5b0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push edi
push str.Publisher
push dword [ebp + 0xc8]
call esi
test eax, eax
jne 0x420628
cmp dword [ebp - 0x54], 1
jne 0x420628
push str.Zylom_Games
push ebx
call fcn.0043b919
test eax, eax
pop ecx
pop ecx
jne 0x420628
mov eax, dword [ebp - 0x58]
inc eax
push eax
push edi
push ebx
mov dword [ebp - 0x4c], eax
call fcn.0043b5b0
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push edi
push str.GameID
push dword [ebp + 0xc8]
call esi
test eax, eax
jne 0x420628
cmp dword [ebp - 0x54], 4
jne 0x420628
push 4
lea eax, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0x50], edi
call fcn.0043a730
add esp, 0xc
cmp dword [ebp - 0x50], edi
jbe 0x420628
mov esi, dword [ebp + 0xd0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
cmp eax, dword [ebp - 0x50]
jne 0x420628
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x40]
push 4
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
push 4
push edi
push str.BuildType
push dword [ebp + 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
call fcn.00439e66
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0xbc]
pop edi
call fcn.00439e9c
add ebp, 0xc0
leave
ret
Function at 0x420c4e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xcc]
sub esp, 0x14c
mov eax, dword [0x46159c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp + 0xc8], eax
lea eax, [ebp - 0x40]
push eax
xor esi, esi
mov ebx, 0x20019
push ebx
push esi
push dword [ebp + 0xd8]
mov dword [ebp - 0x5c], 0x104
push dword [ebp + 0xd4]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x48], esi
call edi
test eax, eax
jne 0x420dd1
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x420dc8
mov eax, dword [ebp - 0x44]
inc eax
push eax
mov dword [ebp - 0x50], eax
call fcn.00439f3b
push dword [ebp + 0xd8]
mov dword [ebp - 0x54], eax
call fcn.00439eb0
add eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x58]
lea eax, [eax + ecx + 0xa]
push eax
call fcn.00439f3b
add esp, 0xc
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x60], esi
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x60]
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
mov dword [ebp - 0x78], eax
jne 0x420da2
push dword [ebp - 0x54]
push dword [ebp + 0xd8]
push str._s_s
push dword [ebp - 0x4c]
call fcn.0043afac
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push ebx
push esi
push dword [ebp - 0x4c]
push dword [ebp + 0xd4]
call edi
test eax, eax
jne 0x420daa
push dword [ebp - 0x4c]
push dword [ebp + 0xe0]
push dword [ebp - 0x48]
call fcn.00420645
add esp, 0xc
cmp eax, esi
je 0x420d97
mov edx, dword [ebp + 0xdc]
mov ecx, dword [edx]
cmp ecx, esi
jne 0x420d8f
mov dword [edx], eax
jmp 0x420d97
mov ecx, dword [ecx + 0x34]
cmp dword [ecx + 0x34], esi
jne 0x420d8c
mov dword [ecx + 0x34], eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x420daa
cmp eax, 0x103
je 0x420daa
nop
inc dword [ebp - 0x60]
cmp dword [ebp - 0x78], esi
je 0x420d0e
push dword [ebp - 0x4c]
call fcn.00439e66
push dword [ebp - 0x54]
call fcn.00439e66
pop ecx
pop ecx
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0xc8]
pop edi
pop esi
pop ebx
call fcn.00439e9c
add ebp, 0xcc
leave
ret
Function at 0x421c8c
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
test esi, esi
je 0x421cbf
push esi
call fcn.00439eb0
pop ecx
xor ecx, ecx
test eax, eax
jbe 0x421cae
xor byte [ecx + esi], 0x2f
inc ecx
cmp ecx, eax
jb 0x421ca5
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x421cc4
Capabilities:
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
cmp byte [ebp + 8], 0
mov eax, dword [0x46159c]
mov dword [ebp - 4], eax
je 0x421ee0
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x421edf
push dword [ebp + 0xc]
call fcn.00439eb0
cmp eax, edi
pop ecx
mov dword [ebp - 0x510], eax
jle 0x421edf
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
mov byte [ebp - 0x108], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.0043b820
cmp eax, edi
pop ecx
pop ecx
je 0x421d47
mov byte [eax + 1], 0
lea eax, [ebp - 0x108]
push str.wrapperdl.tdat
push eax
call fcn.00439f60
pop ecx
pop ecx
push ebx
push esi
push edi
mov esi, 0x80
push esi
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov ebx, 0x40000000
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
jne 0x421da5
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 4
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
je 0x421edd
push 0
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x421de2
cmp eax, 0x19000
jbe 0x421de2
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
push 5
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
mov edi, eax
jmp 0x421de8
mov edi, dword [ebp - 0x50c]
cmp edi, 0xffffffff
je 0x421edd
push 2
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x10], ebx
mov esi, dword [ebp - 0x510]
je 0x421e21
push dword [ebp + 0x10]
call fcn.00439eb0
cmp eax, esi
pop ecx
jle 0x421e21
push dword [ebp + 0x10]
call fcn.00439eb0
pop ecx
mov esi, eax
add esi, 0x64
push esi
call fcn.0043adb2
mov ebx, 0x452210
mov esi, eax
push ebx
push esi
call fcn.00439f50
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x421e48
push edi
call fcn.00421c8c
pop ecx
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
call fcn.0043a138
lea eax, [ebp + 8]
push eax
call fcn.0043c5f3
push eax
push str._d__m__Y__H:_M:_S
lea eax, [ebp - 0x508]
push 0x400
push eax
call fcn.0043c5d8
lea eax, [ebp - 0x508]
push eax
push esi
call fcn.00439f50
push edi
call fcn.00421c8c
push dword [ebp + 0xc]
push esi
call fcn.00439f50
push edi
call fcn.00421c8c
add esp, 0x30
cmp dword [ebp + 0x10], 0
je 0x421ebf
push dword [ebp + 0x10]
call fcn.00439eb0
test eax, eax
pop ecx
jbe 0x421ebf
push dword [ebp + 0x10]
push esi
call fcn.00439f50
push edi
call fcn.00421c8c
add esp, 0xc
push ebx
push esi
call fcn.00439f50
push edi
call fcn.00421c8c
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00439e66
pop ecx
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
call fcn.00439e9c
leave
ret