joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433ce3
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
call fcn.00433c3b
test eax, eax
je 0x433d24
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
push 0
push 0x41d570
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 8

Function at 0x4356aa
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push ebp
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebp, dword [ebp + 0xc]
movzx ebx, byte [esi + 0x100]
test ebp, ebp
movzx edx, byte [esi + 0x101]
je 0x4357bf
test edi, 3
je 0x435703
add bl, 1
movzx ecx, byte [esi + ebx]
add dl, cl
movzx eax, byte [esi + edx]
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
movzx eax, byte [esi + ecx]
xor byte [edi], al
add edi, 1
sub ebp, 1
je 0x4357b3
jmp 0x4356d2
sub ebp, 4
jl 0x435782
sub edi, 4
add bl, 1
movzx ecx, byte [esi + ebx]
add dl, cl
movzx eax, byte [esi + edx]
add edi, 4
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
movzx eax, byte [esi + ecx]
add bl, 1
movzx ecx, byte [esi + ebx]
ror eax, 8
add dl, cl
mov al, byte [esi + edx]
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
mov al, byte [esi + ecx]
add bl, 1
movzx ecx, byte [esi + ebx]
ror eax, 8
add dl, cl
mov al, byte [esi + edx]
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
mov al, byte [esi + ecx]
add bl, 1
movzx ecx, byte [esi + ebx]
ror eax, 8
add dl, cl
mov al, byte [esi + edx]
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
mov al, byte [esi + ecx]
ror eax, 8
xor dword [edi], eax
sub ebp, 4
jge 0x43570b
add edi, 4
test ebp, 3
je 0x4357b3
sub edi, 1
add ebp, 4
add bl, 1
movzx ecx, byte [esi + ebx]
add dl, cl
movzx eax, byte [esi + edx]
add edi, 1
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
movzx eax, byte [esi + ecx]
xor byte [edi], al
sub ebp, 1
jne 0x435790
mov byte [esi + 0x100], bl
mov byte [esi + 0x101], dl
pop ebp
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6e8e2e9f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..pdata_1
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x44704fc9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x404480
Capabilities:
Terminate process

Disassembly:
push dword [0x43bef0]
push 0x10000
push 0x43bef8
call fcn.0040e437
add esp, 0xc
test eax, eax
je 0x40449d
ret
push str.Error:__fgets_returns_NULL_n
call fcn.0040e55c
add esp, 4
push 0
call fcn.004145b4
int3

Function at 0x4044c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42aec7
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x43b074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x43bef0]
push 0x10000
push 0x43bef8
call fcn.0040e437
add esp, 0xc
test eax, eax
je 0x40461c
push dword [0x43bef0]
push 0x10000
push 0x43bef8
call fcn.0040e437
add esp, 0xc
test eax, eax
je 0x40461c
push 0x43bef4
push str._d__s
push 0x43bef8
call fcn.00406f50
push str._stddev
push 0x43bef8
call fcn.0040a270
mov ecx, dword [0x45befc]
test eax, eax
mov eax, dword [0x43bef4]
mov edx, 1
cmovne ecx, edx
mov edx, 4
mov dword [0x45befc], ecx
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004092ae
xor esi, esi
mov dword [0x45bf1c], eax
add esp, 0x18
cmp dword [0x43bef4], esi
jle 0x4045d0
nop word [eax + eax]
push 0x80
call fcn.00409270
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4045b6
mov ecx, eax
call fcn.00406f80
mov ecx, eax
jmp 0x4045b8
xor ecx, ecx
mov eax, dword [0x45bf1c]
mov dword [ebp - 4], 0xffffffff
mov dword [eax + esi*4], ecx
inc esi
cmp esi, dword [0x43bef4]
jl 0x404590
push dword [0x43bef0]
push 0x10000
push 0x43bef8
call fcn.0040e437
add esp, 0xc
test eax, eax
je 0x40461c
push str.counts
push 0x43bef8
call fcn.0040a270
add esp, 8
test eax, eax
je 0x40460c
mov dword [0x45bef8], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push str.Error:__fgets_returns_NULL_n
call fcn.0040e55c
add esp, 4
push 0
call fcn.004145b4
int3

Function at 0x406530
Capabilities:
Terminate process

Disassembly:
cmp dword [esp + 0x18], 0x10
lea eax, [esp + 4]
cmovae eax, dword [esp + 4]
push eax
push 0x42c34c
push dword [0x43bef0]
call fcn.00406ab0
add esp, 0xc
test eax, eax
js 0x40658d
mov ecx, dword [esp + 0x18]
cmp ecx, 0x10
jb 0x40658c
mov edx, dword [esp + 4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406582
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja fcn.0040e00f
push ecx
push edx
call fcn.004092a0
add esp, 8
ret
push str.Error:__fprintf_reports_an_error_n
call fcn.0040e55c
add esp, 4
push 0
call fcn.004145b4
int3
Function at 0x408ab0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x408ad1
jl 0x408ac8
test edi, edi
jne 0x408ad1
xor eax, eax
xor edx, edx
jmp 0x408b92
cmp dword [ebx + 0x38], 0
je 0x408ae6
push eax
push edi
push dword [ebp + 8]
call fcn.00408b98
jmp 0x408b92
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x408b2d
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x408b2d
cmp eax, edi
jb 0x408b07
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0040aa30
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x408b33
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x408b87
mov ecx, ebx
call fcn.004082fd
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x408b72
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00415933
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x408b87
jmp 0x408b45
test edx, edx
je 0x408b87
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00415933
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x408c87
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x408ca9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408d6c
jmp 0x408d67
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x408ccf
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x408cd4
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x408d34
jg 0x408ce9
test esi, esi
je 0x408d34
test ecx, ecx
jl 0x408d2f
jg 0x408cf3
test eax, eax
je 0x408d2f
cmp edi, ecx
jg 0x408d05
jl 0x408cfd
cmp esi, eax
jae 0x408d05
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.0040aa30
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 8]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x408d37
mov ecx, dword [ebp + 8]
jmp 0x408d41
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x408d5b
jg 0x408d41
test esi, esi
je 0x408d5b
cmp dword [ebx + 0x4c], 0
je 0x408d5b
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00415f1e
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x409e3f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409e7e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409e7e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409e7e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409e7e
cmp dword [ecx + 0x74], 0xe
jbe 0x409e7e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41e451
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041e2c7

Function at 0x42a4f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42a51d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42a51d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x176e6dc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x176e6f5
mov esi, edi
mov edi, eax
jmp 0x176e6f7
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x176e707
mov eax, ebx
jmp 0x176e711
push eax
push ebx
call fcn.017554ac
add esp, 8
test eax, eax
jne 0x176e719
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x176e737
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x176e720
cmp eax, dword [esi + 4]
jge 0x176e74e
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x176e73c
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x176e771
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x176e76e
sub eax, 1
test eax, eax
jg 0x176e75e
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x17d242c
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], edx
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
mov edi, 0xc6ef3720
mov dword [ebp + 0xc], edx
mov dword [ebp - 0xc], ecx
mov edx, esi
dec ebx
shr edx, 5
add edx, ecx
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp + 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [ebp - 4]
shl ecx, 4
add ecx, dword [ebp - 8]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
lea edi, [edi + 0x61c88647]
mov ecx, dword [ebp - 0xc]
sub esi, edx
test ebx, ebx
jg 0x17d2461
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x17d289c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 4]
mov dword [ebp + 0xc], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov edx, eax
lea edi, [edi - 0x61c88647]
shr edx, 5
mov ecx, eax
add edx, dword [ebp + 0xc]
dec ebx
shl ecx, 4
add ecx, dword [ebp - 4]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shr edx, 5
add edx, dword [ebp - 8]
shl ecx, 4
add ecx, dword [ebp - 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
add eax, edx
test ebx, ebx
jg 0x17d28ce
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x17dc07c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10122324]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], esi
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0x40
jle 0x17dc0b6
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
call fcn.017dbcbc
add esp, 0xc
lea edi, [ebp - 0x24]
mov ebx, 0x20
push 0x40
lea eax, [esi + 0x68]
push 0x36
push eax
call fcn.017e896c
push 0x40
add esi, 0xa8
push 0x5c
push esi
call fcn.017e896c
add esp, 0x18
test ebx, ebx
jle 0x17dc0f4
nop
movzx eax, byte [edi]
lea edi, [edi + 1]
xor byte [esi - 0x40], al
lea esi, [esi + 1]
movzx eax, byte [edi - 1]
xor byte [esi - 1], al
sub ebx, 1
jne 0x17dc0dc
mov esi, dword [ebp - 0x28]
push 0
push esi
call fcn.017dc13c
push 0x40
lea eax, [esi + 0x68]
push eax
push esi
call fcn.017dc17c
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.017e569d
mov esp, ebp
pop ebp
ret

Function at 0x17e498c
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], edx
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
mov edi, 0xc6ef3720
mov dword [ebp + 0xc], edx
mov dword [ebp - 0xc], ecx
mov edx, esi
dec ebx
shr edx, 5
add edx, ecx
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp + 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [ebp - 4]
shl ecx, 4
add ecx, dword [ebp - 8]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
lea edi, [edi + 0x61c88647]
mov ecx, dword [ebp - 0xc]
sub esi, edx
test ebx, ebx
jg 0x17e49c1
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x17e4b5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 4]
mov dword [ebp + 0xc], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov edx, eax
lea edi, [edi - 0x61c88647]
shr edx, 5
mov ecx, eax
add edx, dword [ebp + 0xc]
dec ebx
shl ecx, 4
add ecx, dword [ebp - 4]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shr edx, 5
add edx, dword [ebp - 8]
shl ecx, 4
add ecx, dword [ebp - 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
add eax, edx
test ebx, ebx
jg 0x17e4b8e
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x182d53c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0182d123
Function at 0x182d547
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0182d2b2

Function at 0x18450bc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x18450e9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x18450e9
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404960
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448c00
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x462014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x4630bc
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00417f20
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x462a8c
push eax
call fcn.00417f20
mov esi, dword [0x4630cc]
xor ebx, ebx
mov edi, dword [0x4630d0]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x466360], bl
mov eax, ebx
mov ecx, 0x4630bc
cmovae ecx, dword [0x4630bc]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x466470], al
inc ebx
cmp ebx, 0x100
jl 0x4049e0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x466360]
movzx eax, byte [esi + 0x466470]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x404a34
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x466360]
mov byte [esi + 0x466360], al
inc esi
mov byte [edi + 0x466360], dl
cmp esi, 0x100
jl 0x404a10
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00404650
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x404a89
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404a7f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404adf
push edx
push ecx
call fcn.0041d4c4
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x404acb
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404ac1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404adf
push edx
push ecx
call fcn.0041d4c4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00436aca
int3
Function at 0x405c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448d10
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x462014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x414], edi
push 0x400
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.00433f50
add esp, 0xc
mov dword [ebp - 0x414], 0x400
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x418]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405d10
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push 0
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x410]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [edi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405d36
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
mov ecx, edi
call fcn.00417f20
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x405d7e
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405d74
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405ddd
push edx
push ecx
call fcn.0041d4c4
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x405dc0
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405db6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405ddd
push edx
push ecx
call fcn.0041d4c4
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041ce51
mov esp, ebp
pop ebp
ret
call fcn.00436aca
int3
Function at 0x405df0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x462014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 8]
push ecx
push 0xf003f
lea eax, [ebp + 8]
mov dword [ebp - 8], connect
cmovae eax, dword [ebp + 8]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405e57
cmp dword [ebp + 0x4c], 0x10
lea edx, [ebp + 0x38]
mov eax, dword [ebp + 0x48]
lea ecx, [ebp + 0x20]
cmovae edx, dword [ebp + 0x38]
cmp dword [ebp + 0x34], 0x10
cmovae ecx, dword [ebp + 0x20]
inc eax
push eax
push edx
push 2
push 0
push ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x405e94
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405e8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405f26
push edx
push ecx
call fcn.0041d4c4
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x405ed6
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405ecc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405f26
push edx
push ecx
call fcn.0041d4c4
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x405f18
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405f0e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405f26
push edx
push ecx
call fcn.0041d4c4
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ce51
mov esp, ebp
pop ebp
ret
call fcn.00436aca
int3