joyce8/EMBER2024-capa huggingface dataset:
Function at 0x544d84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x67c33c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x544e48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x544dbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x544e5f
dec edx
je 0x544ea0
jmp 0x544efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x544efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x544f60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x544f7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x54508f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x544fb0
je 0x544ffc
sub ecx, 0x2b
je 0x544ff2
sub ecx, 4
je 0x544ff7
dec ecx
sub ecx, 0xa
jb 0x544fe1
jmp 0x544fff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x544fc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x544fd0
jmp 0x544fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x544fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x544fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x544fff
mov byte [eax], 0x3e
jmp 0x544fff
mov byte [eax], 0x3f
jmp 0x544fff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x544f8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x54504f
cmp byte [esp + 3], 0xff
jne 0x54504f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x545087
cmp dl, 0xff
je 0x545087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x544f88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x54511c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x68d7a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x545138
shr eax, 1
xor eax, 0xedb88320
jmp 0x54513a
shr eax, 1
dec edx
jne 0x54512b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x545124
pop ebx
ret
Function at 0x545150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x545159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0053ca38
xor eax, eax
push ebp
push 0x545239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0054511c
mov eax, dword [0x68ce0c]
mov byte [eax], 0
mov dword [ebx], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.0053ae7c
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.0053b218
call fcn.0053aba8
test eax, eax
jne 0x545216
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10145]
mov ecx, 0xfff1
lea eax, [ebp - 0x154]
call fcn.0053afcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x545210
lea eax, [ebp - 0x10145]
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x68d7a0]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x5451ec
cmp dword [ebp - 8], 0
jne 0x5451c3
lea eax, [ebp - 0x154]
call fcn.0053afec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x545240
lea eax, [ebp - 4]
call fcn.0053c588
ret

Function at 0x550718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x550738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x550726
pop edi
pop esi
pop ebx
ret
Function at 0x558fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x68dcb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + 0x682670]
mov eax, dword [esi*4 + 0x6826b0]
xor eax, dword [esp]
call fcn.00558f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.00558fac
mov dword [ebx], eax
mov edx, dword [esi*4 + 0x682680]
mov eax, dword [esi*4 + 0x6826c0]
xor eax, dword [esp]
call fcn.00558f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.00558fac
mov dword [ebx + 0x1000], eax
mov edx, dword [esi*4 + 0x682690]
mov eax, dword [esi*4 + 0x6826d0]
xor eax, dword [esp]
call fcn.00558f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.00558fac
mov dword [ebx + 0x2000], eax
mov edx, dword [esi*4 + 0x6826a0]
mov eax, dword [esi*4 + 0x6826e0]
xor eax, dword [esp]
call fcn.00558f70
mov edi, eax
mov eax, edi
call fcn.00558fac
mov dword [ebx + 0x3000], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x558fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x559138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x55916d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x559193
inc ebx
cmp ebx, 0xf
jne 0x55917d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x55914f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6b3967
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
mov dword [esp + 0xa4], edi
jmp 0x6b3983

Function at 0x6b397e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebp, 0x8601c5bb
jmp 0x6b3a7d
call fcn.006b3960
lea esp, [esp + 0xa4]
pushfd
cmc
jmp 0x6b39b6
add al, dh
lea edi, [ebx + esi]
mov cl, 0x3a
jmp 0x6b3a02
pop dword [esp]
call fcn.006b3967
jge 0x6b3992
add al, dh
lea edi, [ebx + esi]
jmp 0x6b3a1e
lea edi, [esp + 0x20]
inc cl
jg 0x6b3bf3
jle 0x6b3baf
cmp dword [eax], ebx
jnp 0x6b3a54
mov ebp, dword [esp + 0x28]
pushal
rdtsc
lea ecx, [ebx*4]
stc
jmp 0x6b3dda
mov cl, 0x3a
jmp 0x6b3a02
loopne 0x6b39ae
mov edx, ebp
add al, ch
jmp 0x6b3a57
aad 2
invalid
mov ebx, edx
neg ah
lea ebx, [esp + ebx]
jmp 0x6b36cd
lea eax, [esi - 0xc5]
pushal
lea esp, [esp + 2]
jmp 0x6b3a22
add ch, bl
retf
jl 0x6b3a2c
mov ebx, edx
neg ah
jmp 0x6b3a63
lea ebx, [esp + ebx]
jmp 0x6b36cd
jmp 0x6b3a4a
xchg ebx, ecx
mov ax, word [esp]
neg bx
je 0x6b3b0c
jne 0x6b3ad4
xor al, 0xb6
and al, 0x43
mov esi, 0x3bab260d
pop esi
lodsd eax, dword [esi]
sbb ecx, dword [esi - 0x27]
cmp byte [ebx], bl
jb 0x6b3a21
sub esp, 0xa0
mov esi, esp
mov edx, esi
sub esp, 6
jae 0x6b3a7b
in al, dx
mov al, byte [0x8b000000]
hlt
lea eax, [esi - 0xc5]
pushal
lea esp, [esp + 2]
jmp 0x6b3a22
pushal
jmp 0x6b3b0d
pushal
rdtsc
bswap eax
btr eax, esp
jmp 0x6b3bfa
rdtsc
bswap eax
btr eax, esp
jmp 0x6b3a9f
jno 0x6b39ec
jo 0x6b39ec

Function at 0x6c3d56
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6c3df7
lea esp, [esp + 4]
jmp 0x6a84e3

Function at 0xc48a5e
Capabilities:
Parse pe header

Disassembly:
call fcn.00c48045
call 0xc48a9f
pop word [esp + 5]
lea esp, [esp + 2]
mov dword [esp + 0x54], ebp
push esp
mov dword [esp], ecx
jmp 0xc48a89
lea esp, [esp + 1]
pushal
pop word [esp + 0x19]
lea esp, [esp + 1]
jmp 0xc48afb
mov dword [esp + 0x70], esi
call 0xc48ad0
mov eax, dword [eax]
jmp 0xc48b79
mov eax, dword [eax + 8]
push eax
jmp 0xc48040
Function at 0x403749
Capabilities:
Delete directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
xor esi, esi
cmp dword [0x8b7588], 0x594
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
jne 0x40378e
push 0x402b50
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
push 0x402b90
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov eax, dword [0x806d28]
mov ebx, dword [0x806d2c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.00403742
mov eax, dword [0x806d30]
mov edi, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x806d34]
add edi, 0x23f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl ecx, 4
cmp dword [0x8b7588], 0xc
mov dword [ebp - 4], ecx
jne 0x40382f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc44]
push eax
push esi
push 0x402c38
push 0x402c04
push 0x402cc0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push esi
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
add dword [ebp - 4], ecx
mov ecx, dword [0x8b7588]
cmp ecx, 0xfa9
jne 0x40384d
mov dword [0x8b6b24], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x40385b
mov dword [0x8b64d8], esi
lea ecx, [edi + eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
shr eax, cl
mov dword [0x8b6b20], 0xf4ea3dee
add eax, dword [ebp - 0x1c]
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x8b7588], 0x213
mov dword [ebp - 0x14], ecx
jne 0x403899
push esi
push 0x402c84
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0x8b7588], 0xc
jne 0x4038e2
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_BackupWrite]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push esi
lea eax, [ebp - 0xc44]
push eax
push 0x402d38
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [edi + eax]
shr eax, cl
add eax, ebx
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
add edi, 0x61c88647
dec dword [ebp - 0x18]
jne 0x4037c7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x40392d
Capabilities:
Create pipe
Get common file path
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8b7588]
mov ecx, dword [0x8b64dc]
sub esp, 0x834
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x403a25
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0x8b7588], 0x959
jne 0x403a13
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402dd4
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0x402e10
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402e58
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.00403749
add ebx, 8
dec dword [ebp - 4]
jne 0x403956
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4057fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x806494]
jne 0x405805
repz ret
jmp fcn.0040901c

Function at 0x40ae3b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406dc6
and dword [ebp - 4], 0
cmp dword [0x808108], 0
mov ebx, eax
jne 0x40aeec
push 0x4021bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40af9d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4021b0
push edi
call esi
test eax, eax
je 0x40af9d
push eax
call fcn.00406d54
mov dword [esp], 0x4021a0
push edi
mov dword [0x808108], eax
call esi
push eax
call fcn.00406d54
mov dword [esp], 0x40218c
push edi
mov dword [0x80810c], eax
call esi
push eax
call fcn.00406d54
mov dword [esp], 0x402170
push edi
mov dword [0x808110], eax
call esi
push eax
call fcn.00406d54
pop ecx
mov dword [0x808118], eax
test eax, eax
je 0x40aeec
push 0x402158
push edi
call esi
push eax
call fcn.00406d54
pop ecx
mov dword [0x808114], eax
mov eax, dword [0x808114]
cmp eax, ebx
je 0x40af44
cmp dword [0x808118], ebx
je 0x40af44
push eax
call fcn.00406dcf
push dword [0x808118]
mov esi, eax
call fcn.00406dcf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40af44
test edi, edi
je 0x40af44
call esi
test eax, eax
je 0x40af3b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40af3b
test byte [ebp - 0xc], 1
jne 0x40af44
or dword [ebp + 0x10], 0x200000
jmp 0x40af7d
mov eax, dword [0x80810c]
cmp eax, ebx
je 0x40af7d
push eax
call fcn.00406dcf
pop ecx
test eax, eax
je 0x40af7d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40af7d
mov eax, dword [0x808110]
cmp eax, ebx
je 0x40af7d
push eax
call fcn.00406dcf
pop ecx
test eax, eax
je 0x40af7d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x808108]
call fcn.00406dcf
pop ecx
test eax, eax
je 0x40af9d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40af9f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [esp + 8]
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSID73C037E7_E5D9_4954_876A_6DA81D6E5768InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401038
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 4
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x40105a
mov edx, dword [0x4d08ec]
push 0x4d05f0
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x104
push eax
push ecx
push 0
push 0
push str.ThreadingModel
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401089
mov esi, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x4205b2
Capabilities:
Encode data using xor

Disassembly:
sbb dword [eax + eax - 0x7d], 0xffffffc2
add cl, byte [esi - 0x7b]
idiv byte [edi]
add cl, cl
mov eax, ecx
pop esi
pop ebx
pushfd
add byte [ebx + 0x565351ec], cl
mov ebx, eax
add byte [eax], al
xor eax, eax
mov dword [ebx], eax
push ebx
mov esi, 0xfc458d00
push eax
push 0x38
inc dword [eax]
add bl, bh
push esi
add byte [eax + eax*8 + 0x38b005b], al
add eax, eax
call fcn.0042b3ae
mov esi, eax
push ebx
push esi
lea esp, [ebp + 0x386a5000]
call dword [0xfb4c]
mov eax, esi
pop esi
pop ebx
pop ecx
xor eax, dword [eax]
lea eax, [eax]
push ebp
mov ebp, esp
add dword [eax], 0
push ebx
push esi
mov esi, edx
mov ebp, dword [edi]
add al, al
mov dword [ebp - 0xc], eax
call dword [0x54]
cmp bx, ax
je 0x42055c
add byte [ebp - 4], al
call fcn.0042056e
add byte [eax], al
hlt

Function at 0x46a3a2
Capabilities:
Encode data using xor

Disassembly:
sbb dword [eax + eax - 0x7d], 0xffffffc2
add cl, byte [esi - 0x7b]
idiv byte [edi]
add cl, cl
mov eax, ecx
pop esi
pop ebx
pushfd
add byte [ebx + 0x565351ec], cl
mov ebx, eax
add byte [eax], al
xor eax, eax
mov dword [ebx], eax
push ebx
mov esi, 0xfc458d00
push eax
push 0x38
inc dword [eax]
add bl, bh
push esi
add byte [eax + eax*8 + 0x38b005b], al
add eax, eax
call fcn.0047519e
mov esi, eax
push ebx
push esi
lea esp, [ebp + 0x386a5000]
call dword [0xfb4c]
mov eax, esi
pop esi
pop ebx
pop ecx
xor eax, dword [eax]
lea eax, [eax]
push ebp
mov ebp, esp
add dword [eax], 0
push ebx
push esi
mov esi, edx
mov ebp, dword [edi]
add al, al
mov dword [ebp - 0xc], eax
call dword [0x54]
cmp bx, ax
je 0x46a34c
add byte [ebp - 4], al
call fcn.0046a35e
add byte [eax], al
hlt
Function at 0x482fa2
Capabilities:
Encode data using xor

Disassembly:
sbb dword [eax + eax - 0x7d], 0xffffffc2
add cl, byte [esi - 0x7b]
idiv byte [edi]
add cl, cl
mov eax, ecx
pop esi
pop ebx
pushfd
add byte [ebx + 0x565351ec], cl
mov ebx, eax
add byte [eax], al
xor eax, eax
mov dword [ebx], eax
push ebx
mov esi, 0xfc458d00
push eax
push 0x38
inc dword [eax]
add bl, bh
push esi
add byte [eax + eax*8 + 0x38b005b], al
add eax, eax
call fcn.0048dd9e
mov esi, eax
push ebx
push esi
lea esp, [ebp + 0x386a5000]
call dword [0xfb4c]
mov eax, esi
pop esi
pop ebx
pop ecx
xor eax, dword [eax]
lea eax, [eax]
push ebp
mov ebp, esp
add dword [eax], 0
push ebx
push esi
mov esi, edx
mov ebp, dword [edi]
add al, al
mov dword [ebp - 0xc], eax
call dword [0x54]
cmp bx, ax
je 0x482f4c
add byte [ebp - 4], al
call fcn.00482f5e
add byte [eax], al
hlt

Function at 0x48dd9e
Capabilities:
Encode data using xor

Disassembly:
xchg dword [ebx], esi
push 0xffffffffffffff8e
ret
pop ebp
sub dh, byte [ebx + 0x7f]
xchg dword [esi - 0x5711380e], esp
invalid
lds edi, [ecx]
mov al, 0xbb
jge 0x48ddf0
push edi
jb 0x48de0c
insb byte es:[edi], dx
pop ds
in al, dx
dec esi
nop
pop eax
jne 0x48dd94
pop ebp
neg dword [ecx + 0x4e9f0527]
xchg esp, eax
arpl si, dx
xchg esp, eax
push edi
push eax
xlatb
or al, 0x75
push dword [edx - 0x601018b4]
popal
push ebp
dec edi
sbb bl, byte [edx + 0x614f08c6]
je 0x48dd6b
and cl, byte [ebx - 0x5293d856]
stosb byte es:[edi], al
daa
insb byte es:[edi], dx
lodsd eax, dword [esi]
insb byte es:[edi], dx
xor al, 0xe6
fild dword [edi]
sub al, 0x5c
faddp st(7)
nop
arpl word [ebx + 0x29], bx
loop 0x48ddc9
and eax, 0xf4355eb1
jmp 0xe7f02bf
add dword [esi], edi
fld dword [edx]
xchg ecx, eax
fcom qword [eax]
jne 0x48dd86
mov dword [edi], esi
stosb byte es:[edi], al
sbb ch, al
ja 0x48de0d
push ebp
test al, 0x99
pop eax
in al, dx
mov esi, dword [ebx - 0x136116d5]
xlatb
mov dword [0x2307b843], eax
jnp 0x48de2d
inc ebx
mov eax, 0x1a7b2307
enter 0xffffffffffff9724, 0x63
mov cl, 0x4f
push 0x72
mov al, byte [0xbd04493e]
add byte [esp + ecx*2 + 0x5bf3d082], bl
lcall 0x6292, 0x3e1aa19e
lodsd eax, dword [esi]
ljmp 0x47dc
bound ebp, qword [ebp + 0x2c3facea]
scasd eax, dword es:[edi]
fadd qword [edi - 0x1a]
and al, ah
stc
out dx, eax
pop ds
rcl dword [eax]
cmp ch, byte [edi - 0x26]
das
xor esi, ecx
retf 0x168b

Function at 0x49bef2
Capabilities:
Encode data using xor

Disassembly:
sbb dword [eax + eax - 0x7d], 0xffffffc2
add cl, byte [esi - 0x7b]
idiv byte [edi]
add cl, cl
mov eax, ecx
pop esi
pop ebx
pushfd
add byte [ebx + 0x565351ec], cl
mov ebx, eax
add byte [eax], al
xor eax, eax
mov dword [ebx], eax
push ebx
mov esi, 0xfc458d00
push eax
push 0x38
inc dword [eax]
add bl, bh
push esi
add byte [eax + eax*8 + 0x38b005b], al
add eax, eax
call fcn.004a6cee
mov esi, eax
push ebx
push esi
lea esp, [ebp + 0x386a5000]
call dword [0xfb4c]
mov eax, esi
pop esi
pop ebx
pop ecx
xor eax, dword [eax]
lea eax, [eax]
push ebp
mov ebp, esp
add dword [eax], 0
push ebx
push esi
mov esi, edx
mov ebp, dword [edi]
add al, al
mov dword [ebp - 0xc], eax
call dword [0x54]
cmp bx, ax
je 0x49be9c
add byte [ebp - 4], al
call fcn.0049beae
add byte [eax], al
hlt