joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a658
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f3c], 1
jne 0x42a718
or dword [0x4a3f3c], 1
push ebx
mov eax, 0x9fda
mov word [0x4a32e8], ax
dec eax
mov word [0x4a32ea], ax
push esi
mov esi, 0x9fd7
mov eax, esi
mov word [0x4a32ec], ax
add eax, 0xfffffff4
mov word [0x4a32ee], ax
lea edx, [esi - 0xa]
lea ecx, [esi - 6]
mov eax, edx
mov word [0x4a32f0], ax
mov eax, ecx
mov word [0x4a32f2], ax
add eax, 0xfffffff6
mov word [0x4a32f4], ax
lea eax, [esi - 0x17]
mov ebx, eax
add eax, 0x1c
mov esi, eax
lea eax, [edx + 7]
mov word [0x4a3308], ax
add eax, 7
mov word [0x4a330a], ax
lea eax, [edx + 8]
mov word [0x4a32fc], si
mov word [0x4a330c], ax
add eax, 0xffffffbd
pop esi
mov word [0x4a32f6], bx
mov dword [0x4a32f8], 0x9fd79fc0
mov dword [0x4a32fe], 0x9fcd9fc6
mov word [0x4a3302], cx
mov dword [0x4a3304], 0x9fdc9fdd
mov word [0x4a330e], ax
pop ebx
xor eax, eax
mov ecx, 0x9f92
xor cx, word [eax + 0x4a32e8]
add eax, 2
mov word [eax + 0x4a3ac6], cx
cmp eax, 0x28
jb 0x42a71a
mov eax, 0x4a3ac8
ret

Function at 0x42a73b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f38], 1
jne 0x42a7ea
or dword [0x4a3f38], 1
mov eax, 0x9fda
mov word [0x4a3310], ax
dec eax
mov word [0x4a3312], ax
mov edx, 0x9fd7
mov eax, edx
mov word [0x4a3314], ax
add eax, 0xfffffff4
mov word [0x4a3316], ax
lea ecx, [edx - 0xa]
mov eax, ecx
mov word [0x4a3318], ax
add eax, 4
mov word [0x4a331a], ax
lea eax, [edx + 7]
mov word [0x4a331c], ax
add eax, 0xfffffff5
mov word [0x4a331e], ax
lea eax, [edx - 0x16]
push edi
mov edi, eax
add eax, 0x1c
mov ecx, eax
mov word [0x4a332e], ax
lea eax, [edx - 0x11]
mov word [0x4a3330], ax
add eax, 0xffffffcc
mov word [0x4a3320], di
mov word [0x4a3322], di
mov dword [0x4a3324], 0x9fc19fd7
mov dword [0x4a3328], 0x9fc09fcd
mov word [0x4a332c], cx
mov word [0x4a3332], ax
pop edi
xor eax, eax
mov ecx, 0x9f92
xor cx, word [eax + 0x4a3310]
add eax, 2
mov word [eax + 0x4a3aee], cx
cmp eax, 0x24
jb 0x42a7ec
mov eax, 0x4a3af0
ret

Function at 0x42ac61
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f20], 1
jne 0x42acb6
or dword [0x4a3f20], 1
mov dword [0x4a33c0], 0xd1f5f7c0
mov dword [0x4a33c4], 0xe6f3f7e0
mov dword [0x4a33c8], 0xebf7d9f7
mov dword [0x4a33cc], 0xbbbaead7
mov dword [0x4a33d0], 0xfbf3f4b2
mov dword [0x4a33d4], 0xa8f6f7fe
mov word [0x4a33d8], 0x92b2
xor eax, eax
mov cl, byte [eax + 0x4a33c0]
xor cl, 0x92
mov byte [eax + 0x4a3b4c], cl
inc eax
cmp eax, 0x1a
jb 0x42acb8
mov eax, 0x4a3b4c
ret
Function at 0x42acd3
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x5c
mov eax, 0x470255
call fcn.00455d47
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov eax, dword [edi + 4]
mov esi, ecx
cmp eax, dword [edi + 8]
jb 0x42ad17
call fcn.0042ad86
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x5c]
call fcn.0044c67b
mov dword [ebp - 0x5c], vtable.std::runtime_error.0
push 0x4915dc
lea eax, [ebp - 0x5c]
push eax
call fcn.004554bb
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 0xc]
push ebx
push ebx
sar ecx, 1
push ebx
mov dword [ebp - 0x4c], ecx
push ebx
lea ecx, [eax + 1]
lea edx, [ebp - 0x4c]
push edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0xc]
push ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
je 0x42ad76
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042783a
pop ecx
push eax
mov dword [ebp - 4], ebx
call fcn.0042ae09
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040c222
add esp, 0xc
lea esi, [ebp - 0x68]
mov byte [ebp - 4], 1
call fcn.00404e30
push 0x4915dc
mov eax, esi
jmp 0x42ad11
push dword [edi + 0xc]
call fcn.00409092
mov eax, esi
call fcn.00455dca
ret

Function at 0x42ad86
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f1c], 1
jne 0x42adec
or dword [0x4a3f1c], 1
mov dword [0x4a33dc], 0xffe7fcd7
mov dword [0x4a33e0], 0xe6f3e0f7
mov dword [0x4a33e4], 0xb2fcfdfb
mov dword [0x4a33e8], 0xf7f6fcfb
mov dword [0x4a33ec], 0xe7fdb2ea
mov dword [0x4a33f0], 0xf4fdb2e6
mov dword [0x4a33f4], 0xfcf3e0b2
mov word [0x4a33f8], 0xf7f5
mov byte [0x4a33fa], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a33dc]
xor cl, 0x92
mov byte [eax + 0x4a3b68], cl
inc eax
cmp eax, 0x1f
jb 0x42adee
mov eax, 0x4a3b68
ret

Function at 0x42ae09
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f18], 1
jne 0x42ae55
or dword [0x4a3f18], 1
mov dword [0x4a33fc], 0xd7f5f7c0
mov dword [0x4a3400], 0xd9ffe7fc
mov dword [0x4a3404], 0xead7ebf7
mov dword [0x4a3408], 0xf4b2bbba
mov dword [0x4a340c], 0xf7fefbf3
mov dword [0x4a3410], 0x92b2a8f6
xor eax, eax
mov cl, byte [eax + 0x4a33fc]
xor cl, 0x92
mov byte [eax + 0x4a3b88], cl
inc eax
cmp eax, 0x18
jb 0x42ae57
mov eax, 0x4a3b88
ret

Function at 0x42afac
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f14], 1
jne 0x42afe1
or dword [0x4a3f14], 1
mov dword [0x4a3414], 0xfefee7dc
mov dword [0x4a3418], 0xfcfdf1b2
mov dword [0x4a341c], 0xe6eaf7e6
mov byte [0x4a3420], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3414]
xor cl, 0x92
mov byte [eax + 0x4a3ba0], cl
inc eax
cmp eax, 0xd
jb 0x42afe3
mov eax, 0x4a3ba0
ret

Function at 0x42affe
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f10], 1
jne 0x42b04a
or dword [0x4a3f10], 1
mov dword [0x4a3424], 0xddf5f7c0
mov dword [0x4a3428], 0xd9fcf7e2
mov dword [0x4a342c], 0xead7ebf7
mov dword [0x4a3430], 0xf4b2bbba
mov dword [0x4a3434], 0xf7fefbf3
mov dword [0x4a3438], 0x92b2a8f6
xor eax, eax
mov cl, byte [eax + 0x4a3424]
xor cl, 0x92
mov byte [eax + 0x4a3bb0], cl
inc eax
cmp eax, 0x18
jb 0x42b04c
mov eax, 0x4a3bb0
ret
Function at 0x42b067
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f0c], 1
jne 0x42b0c3
or dword [0x4a3f0c], 1
mov dword [0x4a343c], 0xc3f5f7c0
mov dword [0x4a3440], 0xebe0f7e7
mov dword [0x4a3444], 0xfdf4fcdb
mov dword [0x4a3448], 0xbaebf7d9
mov dword [0x4a344c], 0xf3f4b2bb
mov dword [0x4a3450], 0xf6f7fefb
mov word [0x4a3454], 0xb2a8
mov byte [0x4a3456], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a343c]
xor cl, 0x92
mov byte [eax + 0x4a3bc8], cl
inc eax
cmp eax, 0x1b
jb 0x42b0c5
mov eax, 0x4a3bc8
ret

Function at 0x42b0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x60
mov eax, 0x470220
call fcn.00455d47
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [edi + 4]
mov esi, ecx
cmp eax, dword [edi + 8]
jb 0x42b12a
call fcn.0042b1aa
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x60]
call fcn.0044c67b
mov dword [ebp - 0x60], vtable.std::runtime_error.0
push 0x4915dc
lea eax, [ebp - 0x60]
push eax
call fcn.004554bb
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 0xc]
push ebx
push ebx
sar ecx, 1
lea edx, [ebp - 0x50]
push edx
mov dword [ebp - 0x54], ecx
push ebx
lea ecx, [eax + 1]
lea edx, [ebp - 0x54]
push edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0xc]
push ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
je 0x42b18c
push eax
lea ecx, [ebp - 0x48]
call fcn.0042783a
pop ecx
push eax
mov dword [ebp - 4], ebx
call fcn.0042b22d
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c222
add esp, 0xc
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00404e30
push 0x4915dc
mov eax, esi
jmp 0x42b124
cmp esi, ebx
je 0x42b195
mov eax, dword [ebp - 0x50]
mov dword [esi], eax
push dword [edi + 0xc]
mov esi, dword [ebp - 0x4c]
call fcn.00409092
mov eax, esi
call fcn.00455dca
ret 4

Function at 0x42b1aa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f08], 1
jne 0x42b210
or dword [0x4a3f08], 1
mov dword [0x4a3458], 0xffe7fcd7
mov dword [0x4a345c], 0xe6f3e0f7
mov dword [0x4a3460], 0xb2fcfdfb
mov dword [0x4a3464], 0xf7f6fcfb
mov dword [0x4a3468], 0xe7fdb2ea
mov dword [0x4a346c], 0xf4fdb2e6
mov dword [0x4a3470], 0xfcf3e0b2
mov word [0x4a3474], 0xf7f5
mov byte [0x4a3476], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3458]
xor cl, 0x92
mov byte [eax + 0x4a3be4], cl
inc eax
cmp eax, 0x1f
jb 0x42b212
mov eax, 0x4a3be4
ret

Function at 0x42b22d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f04], 1
jne 0x42b289
or dword [0x4a3f04], 1
mov dword [0x4a3478], 0xc3f5f7c0
mov dword [0x4a347c], 0xebe0f7e7
mov dword [0x4a3480], 0xfdf4fcdb
mov dword [0x4a3484], 0xbaebf7d9
mov dword [0x4a3488], 0xf3f4b2bb
mov dword [0x4a348c], 0xf6f7fefb
mov word [0x4a3490], 0xb2a8
mov byte [0x4a3492], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3478]
xor cl, 0x92
mov byte [eax + 0x4a3c04], cl
inc eax
cmp eax, 0x1b
jb 0x42b28b
mov eax, 0x4a3c04
ret
Function at 0x42b3dd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f00], 1
jne 0x42b412
or dword [0x4a3f00], 1
mov dword [0x4a3494], 0xfefee7dc
mov dword [0x4a3498], 0xfcfdf1b2
mov dword [0x4a349c], 0xe6eaf7e6
mov byte [0x4a34a0], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3494]
xor cl, 0x92
mov byte [eax + 0x4a3c20], cl
inc eax
cmp eax, 0xd
jb 0x42b414
mov eax, 0x4a3c20
ret

Function at 0x42b42f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3efc], 1
jne 0x42b47b
or dword [0x4a3efc], 1
mov dword [0x4a34a4], 0xddf5f7c0
mov dword [0x4a34a8], 0xd9fcf7e2
mov dword [0x4a34ac], 0xead7ebf7
mov dword [0x4a34b0], 0xf4b2bbba
mov dword [0x4a34b4], 0xf7fefbf3
mov dword [0x4a34b8], 0x92b2a8f6
xor eax, eax
mov cl, byte [eax + 0x4a34a4]
xor cl, 0x92
mov byte [eax + 0x4a3c30], cl
inc eax
cmp eax, 0x18
jb 0x42b47d
mov eax, 0x4a3c30
ret

Function at 0x42b498
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ef8], 1
jne 0x42b4f4
or dword [0x4a3ef8], 1
mov dword [0x4a34bc], 0xc3f5f7c0
mov dword [0x4a34c0], 0xebe0f7e7
mov dword [0x4a34c4], 0xfdf4fcdb
mov dword [0x4a34c8], 0xbaebf7d9
mov dword [0x4a34cc], 0xf3f4b2bb
mov dword [0x4a34d0], 0xf6f7fefb
mov word [0x4a34d4], 0xb2a8
mov byte [0x4a34d6], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a34bc]
xor cl, 0x92
mov byte [eax + 0x4a3c48], cl
inc eax
cmp eax, 0x1b
jb 0x42b4f6
mov eax, 0x4a3c48
ret
Function at 0x42b7bd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ef4], 1
mov ecx, 0x9f92
jne 0x42b82b
or dword [0x4a3ef4], 1
lea eax, [ecx + 0x28]
mov word [0x4a34d8], ax
add eax, 0x1c
mov word [0x4a34da], ax
lea eax, [ecx + 0x65]
mov word [0x4a34dc], ax
add eax, 0xfffffffd
mov word [0x4a34de], ax
lea eax, [ecx + 0x61]
mov word [0x4a34e0], ax
add eax, 0xfffffff4
mov word [0x4a34e2], ax
lea eax, [ecx + 0x6c]
mov word [0x4a34e4], ax
add eax, 0xffffffe8
mov word [0x4a34e6], ax
lea eax, [ecx + 0x29]
mov word [0x4a34e8], ax
mov eax, ecx
mov word [0x4a34ea], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4a34d8]
add eax, 2
mov word [eax + 0x4a3c62], dx
cmp eax, 0x14
jb 0x42b82d
mov eax, 0x4a3c64
ret

Function at 0x42b84b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ef0], 1
mov ecx, 0x9f92
jne 0x42b8b9
or dword [0x4a3ef0], 1
lea eax, [ecx + 0x28]
mov word [0x4a34ec], ax
add eax, 0x3c
mov word [0x4a34ee], ax
lea eax, [ecx + 0x65]
mov word [0x4a34f0], ax
add eax, 0xfffffffd
mov word [0x4a34f2], ax
lea eax, [ecx + 0x61]
mov word [0x4a34f4], ax
add eax, 0xfffffff4
mov word [0x4a34f6], ax
lea eax, [ecx + 0x6c]
mov word [0x4a34f8], ax
add eax, 0xffffffe8
mov word [0x4a34fa], ax
lea eax, [ecx + 0x29]
mov word [0x4a34fc], ax
mov eax, ecx
mov word [0x4a34fe], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4a34ec]
add eax, 2
mov word [eax + 0x4a3c76], dx
cmp eax, 0x14
jb 0x42b8bb
mov eax, 0x4a3c78
ret

Function at 0x42b8d9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3eec], 1
jne 0x42b925
or dword [0x4a3eec], 1
mov dword [0x4a3500], 0xddf5f7c0
mov dword [0x4a3504], 0xd9fcf7e2
mov dword [0x4a3508], 0xead7ebf7
mov dword [0x4a350c], 0xf4b2bbba
mov dword [0x4a3510], 0xf7fefbf3
mov dword [0x4a3514], 0x92b2a8f6
xor eax, eax
mov cl, byte [eax + 0x4a3500]
xor cl, 0x92
mov byte [eax + 0x4a3c8c], cl
inc eax
cmp eax, 0x18
jb 0x42b927
mov eax, 0x4a3c8c
ret

Function at 0x42b942
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ee8], 1
jne 0x42b99e
or dword [0x4a3ee8], 1
mov dword [0x4a3518], 0xc3f5f7c0
mov dword [0x4a351c], 0xebe0f7e7
mov dword [0x4a3520], 0xe7fef3c4
mov dword [0x4a3524], 0xbaead7f7
mov dword [0x4a3528], 0xf3f4b2bb
mov dword [0x4a352c], 0xf6f7fefb
mov word [0x4a3530], 0xb2a8
mov byte [0x4a3532], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3518]
xor cl, 0x92
mov byte [eax + 0x4a3ca4], cl
inc eax
cmp eax, 0x1b
jb 0x42b9a0
mov eax, 0x4a3ca4
ret

Function at 0x42b9bb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ee4], 1
jne 0x42ba17
or dword [0x4a3ee4], 1
mov dword [0x4a3534], 0xc3f5f7c0
mov dword [0x4a3538], 0xebe0f7e7
mov dword [0x4a353c], 0xe7fef3c4
mov dword [0x4a3540], 0xbaead7f7
mov dword [0x4a3544], 0xf3f4b2bb
mov dword [0x4a3548], 0xf6f7fefb
mov word [0x4a354c], 0xb2a8
mov byte [0x4a354e], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3534]
xor cl, 0x92
mov byte [eax + 0x4a3cc0], cl
inc eax
cmp eax, 0x1b
jb 0x42ba19
mov eax, 0x4a3cc0
ret
Function at 0x42ba34
Capabilities:
Set registry value

Disassembly:
push 0x88
mov eax, 0x470e82
call fcn.00455d47
push 7
mov edi, ecx
pop eax
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], esi
mov word [ebp - 0x48], cx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0042a80d
push dword [ebp + 8]
call fcn.0042a324
mov ecx, dword [ebp - 0x48]
add esp, 0xc
cmp dword [ebp - 0x34], 8
jae 0x42ba93
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x84]
push edx
or eax, 0x20006
push eax
push esi
push ecx
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x42baef
push eax
lea ecx, [ebp - 0x64]
call fcn.0042783a
pop ecx
push eax
mov byte [ebp - 4], 2
call fcn.0042bb8c
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0040c222
add esp, 0xc
mov byte [ebp - 4], 3
lea esi, [ebp - 0x94]
call fcn.00404e30
push 0x4915dc
mov eax, esi
push eax
call fcn.004554bb
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x42bafa
mov edi, dword [edi]
cmp dword [ebp - 0x18], 8
mov ecx, dword [ebp - 0x2c]
jae 0x42bb06
lea ecx, [ebp - 0x2c]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push ecx
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42bb64
push esi
lea ecx, [ebp - 0x80]
call fcn.0042783a
pop ecx
push eax
mov byte [ebp - 4], 4
call fcn.0042bbf5
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0040c222
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 6
call fcn.00403b18
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x64]
jmp 0x42bad7
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00403c49
push 1
lea esi, [ebp - 0x48]
call fcn.00403c49
call fcn.00455dca
ret

Function at 0x42bb8c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ee0], 1
jne 0x42bbd8
or dword [0x4a3ee0], 1
mov dword [0x4a3550], 0xddf5f7c0
mov dword [0x4a3554], 0xd9fcf7e2
mov dword [0x4a3558], 0xead7ebf7
mov dword [0x4a355c], 0xf4b2bbba
mov dword [0x4a3560], 0xf7fefbf3
mov dword [0x4a3564], 0x92b2a8f6
xor eax, eax
mov cl, byte [eax + 0x4a3550]
xor cl, 0x92
mov byte [eax + 0x4a3cdc], cl
inc eax
cmp eax, 0x18
jb 0x42bbda
mov eax, 0x4a3cdc
ret

Function at 0x42bbf5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3edc], 1
jne 0x42bc5b
or dword [0x4a3edc], 1
mov dword [0x4a3568], 0xc1f5f7c0
mov dword [0x4a356c], 0xf3c4e6f7
mov dword [0x4a3570], 0xd7f7e7fe
mov dword [0x4a3574], 0xe6e1baea
mov dword [0x4a3578], 0xf5fcfbe0
mov dword [0x4a357c], 0xf3f4b2bb
mov dword [0x4a3580], 0xf6f7fefb
mov word [0x4a3584], 0xb2a8
mov byte [0x4a3586], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3568]
xor cl, 0x92
mov byte [eax + 0x4a3cf4], cl
inc eax
cmp eax, 0x1f
jb 0x42bc5d
mov eax, 0x4a3cf4
ret
Function at 0x42bc78
Capabilities:
Set registry value

Disassembly:
push 0x88
mov eax, 0x470e82
call fcn.00455d47
push 7
pop eax
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], esi
mov word [ebp - 0x48], cx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0042a80d
push dword [ebp + 0xc]
call fcn.0042a324
mov ecx, dword [ebp - 0x48]
add esp, 0xc
cmp dword [ebp - 0x34], 8
jae 0x42bcd5
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x84]
push edx
or eax, 0x20006
push eax
push esi
push ecx
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x42bd31
push eax
lea ecx, [ebp - 0x64]
call fcn.0042783a
pop ecx
push eax
mov byte [ebp - 4], 2
call fcn.0042bdc0
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0040c222
add esp, 0xc
mov byte [ebp - 4], 3
lea esi, [ebp - 0x94]
call fcn.00404e30
push 0x4915dc
mov eax, esi
push eax
call fcn.004554bb
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x42bd3d
lea eax, [ebp - 0x2c]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push esi
push eax
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42bd98
push esi
lea ecx, [ebp - 0x80]
call fcn.0042783a
pop ecx
push eax
mov byte [ebp - 4], 4
call fcn.0042be29
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0040c222
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 6
call fcn.00403b18
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x64]
jmp 0x42bd19
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00403c49
push 1
lea esi, [ebp - 0x48]
call fcn.00403c49
call fcn.00455dca
ret

Function at 0x42bdc0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ed8], 1
jne 0x42be0c
or dword [0x4a3ed8], 1
mov dword [0x4a3588], 0xddf5f7c0
mov dword [0x4a358c], 0xd9fcf7e2
mov dword [0x4a3590], 0xead7ebf7
mov dword [0x4a3594], 0xf4b2bbba
mov dword [0x4a3598], 0xf7fefbf3
mov dword [0x4a359c], 0x92b2a8f6
xor eax, eax
mov cl, byte [eax + 0x4a3588]
xor cl, 0x92
mov byte [eax + 0x4a3d14], cl
inc eax
cmp eax, 0x18
jb 0x42be0e
mov eax, 0x4a3d14
ret

Function at 0x42be29
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ed4], 1
jne 0x42be88
or dword [0x4a3ed4], 1
mov dword [0x4a35a0], 0xc1f5f7c0
mov dword [0x4a35a4], 0xf3c4e6f7
mov dword [0x4a35a8], 0xd7f7e7fe
mov dword [0x4a35ac], 0xe5f6baea
mov dword [0x4a35b0], 0xbbf6e0fd
mov dword [0x4a35b4], 0xfbf3f4b2
mov dword [0x4a35b8], 0xa8f6f7fe
mov word [0x4a35bc], 0x92b2
xor eax, eax
mov cl, byte [eax + 0x4a35a0]
xor cl, 0x92
mov byte [eax + 0x4a3d2c], cl
inc eax
cmp eax, 0x1e
jb 0x42be8a
mov eax, 0x4a3d2c
ret
Function at 0x42bea5
Capabilities:
Delete registry key

Disassembly:
push 0x88
mov eax, 0x470e2a
call fcn.00455d47
push 7
pop eax
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], esi
mov word [ebp - 0x48], cx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0042a80d
push dword [ebp + 8]
call fcn.0042a324
add esp, 0xc
cmp dword [ebp - 0x1c], esi
jne 0x42bf33
call fcn.0042bffa
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x90]
call fcn.0044c67b
mov dword [ebp - 0x90], vtable.std::runtime_error.0
push 0x4915dc
lea eax, [ebp - 0x90]
push eax
call fcn.004554bb
cmp dword [ebp - 0x34], 8
mov ecx, dword [ebp - 0x48]
jae 0x42bf3f
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x94]
push edx
or eax, 0x1000b
push eax
push esi
push ecx
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x42bf95
cmp eax, 2
je 0x42bf95
push eax
lea ecx, [ebp - 0x80]
call fcn.0042783a
pop ecx
push eax
mov byte [ebp - 4], 2
call fcn.0042c091
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0040c222
add esp, 0xc
mov byte [ebp - 4], 3
lea esi, [ebp - 0x90]
call fcn.00404e30
jmp 0x42bf22
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x42bfa1
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x94]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp eax, esi
je 0x42bfde
cmp eax, 2
je 0x42bfde
push eax
lea ecx, [ebp - 0x64]
call fcn.0042783a
pop ecx
push eax
mov byte [ebp - 4], 4
call fcn.0042c0fa
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0040c222
add esp, 0xc
mov byte [ebp - 4], 5
jmp 0x42bf88
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00403c49
push 1
lea esi, [ebp - 0x48]
call fcn.00403c49
call fcn.00455dca
ret

Function at 0x42bffa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ed0], 1
jne 0x42c074
or dword [0x4a3ed0], 1
mov dword [0x4a35c0], 0xe6e1e7df
mov dword [0x4a35c4], 0xf7e2e1b2
mov dword [0x4a35c8], 0xebf4fbf1
mov dword [0x4a35cc], 0xfcb2f3b2
mov dword [0x4a35d0], 0xf7bffcfd
mov dword [0x4a35d4], 0xebe6e2ff
mov dword [0x4a35d8], 0xf0e7e1b2
mov dword [0x4a35dc], 0xb2ebf7f9
mov dword [0x4a35e0], 0xfbe0e6e1
mov word [0x4a35e4], 0xf5fc
mov byte [0x4a35e6], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a35c0]
xor cl, 0x92
mov byte [eax + 0x4a3d4c], cl
inc eax
cmp eax, 0x27
jb 0x42c076
mov eax, 0x4a3d4c
ret

Function at 0x42c091
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ecc], 1
jne 0x42c0dd
or dword [0x4a3ecc], 1
mov dword [0x4a35e8], 0xddf5f7c0
mov dword [0x4a35ec], 0xd9fcf7e2
mov dword [0x4a35f0], 0xead7ebf7
mov dword [0x4a35f4], 0xf4b2bbba
mov dword [0x4a35f8], 0xf7fefbf3
mov dword [0x4a35fc], 0x92b2a8f6
xor eax, eax
mov cl, byte [eax + 0x4a35e8]
xor cl, 0x92
mov byte [eax + 0x4a3d74], cl
inc eax
cmp eax, 0x18
jb 0x42c0df
mov eax, 0x4a3d74
ret