joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d580
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x45d5b4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.0045d490
test eax, eax
jne 0x45d5cd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.0045d500
cmp eax, 1
je 0x45d75a
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x45d606
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x45d682
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45d702
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.0045d3c0
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x45d719
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x45d622
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x45d6d0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.0045d070
test eax, eax
je 0x45d702
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x45d69e
cmp dword [esp + 0x18], 1
jb 0x45d702
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.0045cf50
cmp eax, 1
je 0x45d74b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x45d729
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x45d702
push ebp
mov ecx, ebx
call fcn.0045d770
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45d75a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x45d770
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x45d7a2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.0045d500
test eax, eax
jne 0x45d7bf
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x45d7e6
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x45d834
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.0045d210
test eax, eax
jne 0x45d81d
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x45d803
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
call fcn.0045cfe0
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x45d857
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x475d28
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x475d60
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00473db5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00473d8d
jmp 0x475d6c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47741d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47745f
call fcn.0047ced2
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47745f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x477456
xor eax, eax
jmp 0x477467
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047746d
pop edi
pop esi
pop ebx
ret 4
Function at 0x47d402
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47d430
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47d44e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047d368
jmp 0x47d44e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47d44e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047d368
test edi, edi
mov eax, edi
jne 0x47d438
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x3f336a6e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x3f336a7d
pop dword [ebp - 0x2c]
mov eax, 0x7c03749
add eax, 0x37733334
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3f6e8
push 0
mov eax, 0xb3762699
add eax, 0x8b99eac7
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x874397e2
sub ecx, 0x8743644a
xor ebx, ebx
add ebx, eax
mov edx, 0xbc3bc514
add edx, 0x83046aec
add edx, dword [ebp - 0x2c]
mov edi, 0x63ec055
add dword [ebp - 4], edi
mov esi, dword [edx]
xor dword [ebp - 4], 0x76e0d9ee
xor esi, edi
mov dword [ebx], esi
xor dword [ebp - 0x14], ecx
add ebx, 0x237c91b2
add ebx, 0xdc836e52
invalid
ret 0xa37d
invalid
Function at 0x3f3845bf
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x110
push esi
push edi
push dword [ebp + 0x7c]
xor esi, esi
push dword [ebp + 0x78]
mov dword [ebp + 0x64], ecx
mov dword [ebp + 0x68], esi
call fcn.3f336a6e
mov edi, eax
cmp edi, esi
je 0x3f384696
push 0x80
lea eax, [ebp - 0x20]
push eax
push 0xc
push dword [0x3f3a32c0]
call dword [sym.imp.user32.dll_LoadStringA]
test eax, eax
jle 0x3f38468f
mov ecx, dword [ebp + 0x64]
push ebx
push dword [ebp + 0x78]
call fcn.3f38958d
push esi
push esi
mov ebx, eax
push 0x81
lea eax, [ebp - 0xa4]
push eax
push ebx
call fcn.3f390cad
pop ecx
inc eax
push eax
push ebx
push esi
push esi
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xa4]
push eax
push 1
push esi
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop ebx
jne 0x3f38468f
push 0x80
lea eax, [ebp - 0x20]
push eax
push 0xd
push dword [0x3f3a32c0]
call dword [sym.imp.user32.dll_LoadStringA]
test eax, eax
jle 0x3f38468f
mov ecx, dword [ebp + 0x64]
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call fcn.3f336a6e
mov dword [ebp + 0x68], eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x68]
pop edi
pop esi
add ebp, 0x6c
leave
ret 0xc

Function at 0x3f38a12e
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
add edx, edx
add eax, edx
mov cx, word [eax]
inc eax
push ebx
mov ebx, dword [esp + 0x10]
inc eax
cmp cx, 0x3e
push esi
mov esi, dword [ebx]
je 0x3f38a153
cmp cx, 0x7d
jne 0x3f38a162
dec esi
jne 0x3f38a15d
xor eax, eax
jmp 0x3f38a1fd
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x3a
je 0x3f38a17a
cmp cx, 0x3b
je 0x3f38a17a
cmp cx, 0x38
je 0x3f38a17a
cmp cx, 0x25
jne 0x3f38a156
dec esi
je 0x3f38a156
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x2d
je 0x3f38a18e
cmp cx, 0x5e
jne 0x3f38a198
dec esi
test esi, esi
je 0x3f38a156
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x28
je 0x3f38a1f0
cmp cx, 0x3e
je 0x3f38a1f0
cmp cx, 0x44
je 0x3f38a1f0
cmp cx, 0x49
je 0x3f38a1f0
cmp cx, 0x4f
je 0x3f38a1f0
cmp cx, 0x6f
je 0x3f38a1f0
cmp cx, 0x5c
je 0x3f38a1f0
cmp cx, 0x2f
je 0x3f38a1f0
cmp cx, 0x7c
je 0x3f38a1f0
cmp cx, 0x30
jne 0x3f38a1db
cmp word [eax - 4], 0x38
jne 0x3f38a1f0
cmp cx, 0x29
jne 0x3f38a156
cmp word [eax - 4], 0x38
je 0x3f38a156
sub eax, edx
sub eax, dword [esp + 0xc]
sar eax, 1
mov dword [ebx], eax
xor eax, eax
inc eax
pop esi
pop ebx
ret 0xc
Function at 0x3f38cf7e
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0x200
push ebx
push esi
push edi
push 0x80
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 0x6c]
call dword [sym.imp.ole32.dll_StringFromGUID2]
xor ebx, ebx
push ebx
push ebx
push 0x40
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x9c]
push eax
push ebx
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov esi, 0x3f2ff05c
lea edi, [ebp + 0x24]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x1c]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x3f38cfcd
lea edi, [ebp + 0x24]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x3f38cfda
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x74]
cmp edi, ebx
mov esi, 0x3f2ff054
je 0x3f38d015
push dword [ebp + 0x70]
mov eax, edi
push ebx
call fcn.3f336a6e
lea eax, [ebp - 0x1c]
push eax
push esi
mov eax, edi
call fcn.3f336a6e
mov eax, dword [ebp + 0x78]
cmp eax, ebx
je 0x3f38d040
push dword [ebp + 0x70]
push ebx
call fcn.3f336a6e
mov eax, dword [ebp + 0x78]
push edi
push 0x3f2ff04c
call fcn.3f336a6e
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 0x78]
push esi
call fcn.3f336a6e
push dword [ebp + 0x70]
lea eax, [ebp + 0x24]
push ebx
call fcn.3f336a6e
cmp edi, ebx
je 0x3f38d05e
push edi
push 0x3f2ff044
lea eax, [ebp + 0x24]
call fcn.3f336a6e
cmp dword [ebp + 0x78], ebx
je 0x3f38d073
push dword [ebp + 0x78]
lea eax, [ebp + 0x24]
push 0x3f2ff028
call fcn.3f336a6e
push ebx
push 0x3f2ff018
lea eax, [ebp + 0x24]
call fcn.3f336a6e
push dword [ebp + 0x7c]
mov esi, 0x3f2ff008
push esi
lea eax, [ebp + 0x24]
call fcn.3f336a6e
push esi
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0x19c]
push 0x3f2ff000
push eax
call fcn.3f336a6e
add esp, 0x10
push ebx
lea eax, [ebp + 0x78]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x19c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x3f38d0ff
mov esi, 0x3f2feff4
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x3f38d0d9
sub eax, edx
inc eax
push eax
push esi
push 1
push ebx
push 0x3f2fefe4
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add ebp, 0x64
leave
ret 0x14

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x42105f
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x44e8a8
call fcn.00422e90
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x420f16
xor ebx, ebx
jmp 0x420f49
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x420f12
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x420f12
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x420f49
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004279ab
test eax, eax
jne 0x420f5d
push 0x1c
call main
pop ecx
call fcn.00427918
test eax, eax
jne 0x420f6e
push 0x10
call main
pop ecx
call fcn.00428296
and dword [ebp - 4], 0
call fcn.004279c0
test eax, eax
jns 0x420f88
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x457adc], eax
call main
mov dword [0x455a24], eax
call main
test eax, eax
jns 0x420fae
push 8
call main
pop ecx
call fcn.00427eb1
test eax, eax
jns 0x420fbf
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x420fd2
push eax
call main
pop ecx
call fcn.00428714
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x420ff4
push esi
call main
call fcn.00426cd7
jmp 0x421029
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00422ed5
ret
call main
jmp 0x420ee8

Function at 0x2fb3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02fb378f
jae 0x2fb370e
xor ecx, ecx
call fcn.02fb378f
jae 0x2fb373d
xor eax, eax
call fcn.02fb378f
jae 0x2fb374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02fb378f
adc al, al
jae 0x2fb372f
jne 0x2fb3779
stosb byte es:[edi], al
jmp 0x2fb3711
call fcn.02fb379b
sub ecx, ebx
jne 0x2fb3756
call fcn.02fb3799
jmp 0x2fb3775
lodsb al, byte [esi]
shr eax, 1
je 0x2fb3783
adc ecx, ecx
jmp 0x2fb3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02fb3799
cmp eax, 0x7d00
jae 0x2fb3772
cmp ah, 5
jae 0x2fb3773
cmp eax, 0x7f
ja 0x2fb3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2fb3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x4011b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x42cf40], ecx
inc eax
cmp eax, 0x100
jb 0x4011b2
cmp eax, 0x800
jae 0x401283
nop word [eax + eax]
mov edx, dword [eax*4 + 0x42cb40]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x42cf40]
mov dword [eax*4 + 0x42cf40], edx
inc eax
cmp eax, 0x800
jb 0x401260
mov dword [0x42c440], 0x4012d0
call fcn.00405510
mov ecx, dword [0x42c440]
test eax, eax
mov edx, 0x401370
cmove ecx, edx
mov dword [0x42c440], ecx
ret

Function at 0x402080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
je 0x4020d3
mov ebx, dword [ebp + 0xc]
mov dword [edi], 0
push 0
mov ecx, 0x400000
mov dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
cmp esi, ecx
push eax
mov eax, esi
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x4020da
test ecx, ecx
je 0x4020d3
test esi, esi
jne 0x402098
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x402180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
je 0x4021d3
mov ebx, dword [ebp + 0xc]
mov dword [edi], 0
push 0
mov ecx, 0x400000
mov dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
cmp esi, ecx
push eax
mov eax, esi
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x4021da
test ecx, ecx
je 0x4021d3
test esi, esi
jne 0x402198
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x405320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x405340
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
lea edx, [esi - 4]
add edx, ecx
mov dword [ebp + 0xc], edx
add esi, ebx
mov dword [ebp - 4], esi
cmp esi, edx
jae 0x405372
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x40536f
inc esi
cmp esi, edx
jb 0x405360
mov dword [ebp - 4], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x40549a
cmp ecx, 3
jbe 0x4053b2
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x4053f0
cmp cl, 0xff
je 0x4053f0
mov edx, dword [ebp + 0xc]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x405354
dec ecx
shl eax, cl
and eax, 7
je 0x40538a
cmp byte [eax + 0x41d470], 0
je 0x4053dd
movzx ecx, byte [eax + 0x41d478]
mov edx, esi
sub edx, ecx
mov cl, byte [edx + 4]
test cl, cl
je 0x4053da
cmp cl, 0xff
jne 0x40538a
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
and eax, 3
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x405354
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x40541e
lea edx, [edi + ebx]
add edx, esi
jmp 0x405424
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x405462
movzx edi, byte [eax + 0x41d478]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x40544e
cmp cl, 0xff
jne 0x405462
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x405411
mov esi, dword [ebp - 4]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
neg cl
mov byte [esi + 1], dl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp + 0xc]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x405354
pop edi
pop esi
cmp ecx, 3
jbe 0x4054af
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
call fcn.0040e2e0
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40b7d1
cmp eax, 0xea
jne 0x40b816
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 2
mul edx
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00418518
add esp, 4
mov edi, eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
push edi
push dword [ebp + 8]
call fcn.0040b820
mov ecx, dword [ebp + 0xc]
mov esi, eax
push edi
call fcn.0040dec0
push edi
call fcn.00418521
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40bb30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b758
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x42c0a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x420abc
xor edi, edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], 0x420abc
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
xor ebx, ebx
call fcn.0040e470
test eax, eax
jle 0x40bba3
lea ecx, [ebp + 8]
call fcn.0040e470
mov ebx, eax
lea ecx, [ebp + 8]
call fcn.0040e470
inc eax
lea ecx, [ebp - 0x18]
push eax
call fcn.0040c780
lea ecx, [ebp + 8]
call fcn.0040e470
lea ecx, [ebp + 8]
lea eax, [eax*2 + 2]
push eax
call fcn.0040df60
push eax
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.0040e470
mov esi, eax
lea ecx, [esi + 2]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040c780
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov word [eax + esi*2 + 2], cx
cmp ebx, 0x104
jge 0x40bccf
lea ecx, [ebp + 0x90]
xor ebx, ebx
call fcn.0040e470
test eax, eax
jle 0x40bc23
lea ecx, [ebp + 0x90]
call fcn.0040e470
mov ebx, eax
lea ecx, [ebp + 0x90]
call fcn.0040e470
inc eax
lea ecx, [ebp - 0x24]
push eax
call fcn.0040c780
lea ecx, [ebp + 0x90]
call fcn.0040e470
lea ecx, [ebp + 0x90]
lea eax, [eax*2 + 2]
push eax
call fcn.0040df60
push eax
push dword [ebp - 0x1c]
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea ecx, [ebp + 0x90]
call fcn.0040e470
mov esi, eax
lea ecx, [esi + 2]
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040c780
mov edi, dword [ebp - 0x1c]
xor eax, eax
mov word [edi + esi*2 + 2], ax
cmp ebx, 0x104
jge 0x40bccf
mov dword [ebp - 0x32], eax
mov eax, 0x414
mov word [ebp - 0x34], ax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x2e], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x2a], 0
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb esi, esi
inc esi
jmp 0x40bcd1
xor esi, esi
push edi
call fcn.00418521
push dword [ebp - 0x10]
call fcn.00418521
add esp, 8
lea ecx, [ebp + 8]
call fcn.0040de80
lea ecx, [ebp + 0x90]
call fcn.0040de80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret