joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459450
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f19b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x533014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
call fcn.00458580
mov ecx, 0x600
cmp ax, cx
jb 0x45960e
call fcn.0041b6a0
mov edx, dword [eax]
cmp edx, vtable.ATL::CAtlStringMgr.0
jne 0x4594a7
lock inc dword [eax + 0x14]
add eax, 8
jmp 0x4594ac
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push dword [esi]
push str.__s___d
push eax
call fcn.004167e0
add esp, 0x10
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x2001f
push str.SOFTWARERegisteredApplications
push 0x80000002
call fcn.0041b7b0
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x4595b6
mov edi, dword [ebp + 8]
mov edx, dword [edi]
test edx, edx
je 0x45953e
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459516
sub ecx, dword [ebp - 0x14]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebx]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub esp, 0x14
lea ecx, [ebp - 0x20]
push dword [edi]
push 0x80000002
call fcn.0045b320
test eax, eax
je 0x45957e
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x459562
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
call fcn.00414500
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push 2
push dword [eax]
push str.ApplicationDescription
call fcn.0045b3a0
push 2
push esi
push str.ApplicationIcon
lea ecx, [ebp - 0x20]
call fcn.0045b3a0
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
push 2
push dword [eax]
push str.ApplicationName
call fcn.0045b3a0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4595c4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45960e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x45960c
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a640
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x533014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [ebp - 0x14]
call fcn.004145e0
mov ebx, dword [ebp + 0xc]
mov edx, esi
push ecx
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00459ca0
add esp, 8
test eax, eax
je 0x45a6c2
push 0
push ebx
mov edx, edi
lea ecx, [ebp - 0x14]
call fcn.004596a0
add esp, 8
push dword [edi]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x80000000
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.0045b0a0
mov eax, dword [ebp - 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x45a6f8
push eax
call edi
mov dword [ebp - 0x24], 0
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push str.FileAssociations
mov dword [ebp - 0x20], 0
call fcn.0045aad0
add esp, 4
lea ecx, [ebp - 0x24]
push 0x2001f
push dword [eax]
push 0x80000002
call fcn.0041b7b0
mov edx, dword [ebp - 0x18]
test eax, eax
sete byte [ebp - 0xd]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45a762
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x45a760
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x45a762
call esi
cmp byte [ebp - 0xd], 0
mov esi, dword [ebp - 0x24]
je 0x45a775
push dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x45a7ac
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x45a7a8
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x45a7ac
mov ecx, edx
call ebx
test esi, esi
je 0x45a7b3
push esi
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45b281
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x45b24f
cmp eax, 2
jne 0x45b26b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x45b27b
test ecx, ecx
je 0x45b276
test cl, 1
jne 0x45b26b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x45b27b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x45b3a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x45b3b5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45b3c0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x45bb50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x13c], eax
call fcn.0045b6e0
push 0xffffffffffffffff
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 0
push eax
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x144], 0xf
mov dword [ebp - 0x148], 0
mov byte [ebp - 0x158], 0
call fcn.00409d10
mov eax, dword [ebp - 0x148]
lea ecx, [ebp - 0x130]
cmp dword [ebp - 0x144], 0x10
mov edx, 0x100
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x158]
cmovae eax, dword [ebp - 0x158]
mov dword [ebp - 0x134], eax
xor eax, eax
nop word [eax + eax]
mov byte [ecx], al
lea ecx, [ecx + 1]
inc eax
cmp ax, dx
jl 0x45bc00
xor dl, dl
mov word [ebp - 0x30], 0
xor ebx, ebx
lea esi, [ebp - 0x130]
mov edi, 0x100
mov eax, dword [ebp - 0x134]
lea esi, [esi + 1]
mov cl, byte [esi - 1]
movzx edx, dl
mov al, byte [edx + eax]
add al, bl
add al, cl
movzx ebx, al
movzx eax, byte [ebp + ebx - 0x130]
mov byte [esi - 1], al
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x138]
mov byte [ebp + ebx - 0x130], cl
sub edi, 1
jne 0x45bc20
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
jle 0x45bcba
movzx edx, byte [ebp - 0x30]
movzx ebx, byte [ebp - 0x2f]
nop dword [eax + eax]
inc dl
movzx edx, dl
mov cl, byte [ebp + edx - 0x130]
add bl, cl
movzx ebx, bl
movzx eax, byte [ebp + ebx - 0x130]
mov byte [ebp + edx - 0x130], al
mov byte [ebp + ebx - 0x130], cl
movzx eax, byte [ebp + edx - 0x130]
add al, cl
mov ecx, dword [ebp - 0x13c]
movzx eax, al
movzx eax, byte [ebp + eax - 0x130]
xor byte [esi + ecx], al
inc esi
cmp esi, edi
jl 0x45bc70
mov eax, dword [ebp - 0x144]
cmp eax, 0x10
jb 0x45bcd8
inc eax
lea ecx, [ebp - 0x158]
push eax
push dword [ebp - 0x158]
call fcn.00407610
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x45bced
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407610
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046370d
mov esp, ebp
pop ebp
ret 8
Function at 0x45bdd0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1d27
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x533014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x513e90
mov dword [edi + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
sub esp, 8
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov dword [ebp - 0x10], 1
push esi
call fcn.0045d7a0
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.0044efb0
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x48], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x3d], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x5397b4]
mov dword [esi + 0x40], eax
mov eax, dword [0x5397b8]
mov dword [esi + 0x44], eax
mov eax, edi
mov dword [esi + 0x4c], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45bff0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1d77
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x533014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x513e80
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
sub esp, 8
mov dword [ebp - 4], 0
lea esi, [edi + 0x10]
mov dword [ebp - 0x10], 1
push esi
call fcn.0044ef00
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.0044efb0
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x48], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x3d], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x5397b4]
mov dword [esi + 0x40], eax
mov eax, dword [0x5397b8]
mov dword [esi + 0x44], eax
mov eax, edi
mov dword [esi + 0x4c], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45d390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x45d4e0
cmp byte [edi + 0x3d], 0
je 0x45d4e0
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x45d3e9
xor al, al
jmp 0x45d4e2
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
nop
mov eax, dword [edi + 0x38]
lea ebx, [ebp - 0x28]
cmp ecx, 0x10
lea esi, [ebp - 0x28]
cmovae ebx, edx
cmovae esi, edx
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
cmp eax, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x45d445
mov dword [ebp - 0x2c], esi
xor eax, eax
jmp 0x45d466
mov ecx, dword [edi + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
push eax
push esi
lea eax, [edi + 0x40]
push eax
mov eax, dword [ebp - 0x30]
call dword [eax + 0x20]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub eax, 0
je 0x45d479
sub eax, 1
je 0x45d47d
sub eax, 2
je 0x45d4ca
xor bl, bl
jmp 0x45d4cc
mov byte [edi + 0x3d], 0
cmp ecx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edx
sub esi, eax
je 0x45d4ac
push dword [edi + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004acae4
mov ecx, dword [ebp - 0x14]
add esp, 0x10
mov edx, dword [ebp - 0x28]
cmp esi, eax
jne 0x45d475
cmp byte [edi + 0x3d], 0
je 0x45d4ca
test esi, esi
jne 0x45d420
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00424930
jmp 0x45d419
mov bl, 1
cmp ecx, 0x10
jb 0x45d4dc
inc ecx
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00407610
mov al, bl
jmp 0x45d4e2
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046370d
mov esp, ebp
pop ebp
ret
Function at 0x45ed00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f225b
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x138], eax
call fcn.0045e940
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x134]
mov dword [ebp - 0x12c], 0
push eax
push 0
push 0
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x134], 0
push eax
push 0
push 0
push 0
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x45ee7f
xor esi, esi
mov dword [ebp - 0x130], 0x100
cmp dword [ebp - 0x12c], esi
jbe 0x45ee7f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [edi + 0x1c]
call ebx
test eax, eax
jne 0x45ee68
mov dword [ebp - 0x114], 0xf
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x128], al
cmp byte [ebp - 0x110], al
je 0x45edf9
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45edf0
sub eax, edx
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x128]
call fcn.00409e40
mov ecx, dword [ebp - 0x138]
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 4], 0
call fcn.0045f1a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x114]
cmp eax, 0x10
jb 0x45ee68
mov ecx, dword [ebp - 0x128]
inc eax
cmp eax, 0x1000
jb 0x45ee5f
test cl, 0x1f
jne 0x45ee9d
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x45ee9d
sub ecx, eax
cmp ecx, 4
jb 0x45ee9d
cmp ecx, 0x23
ja 0x45ee9d
mov ecx, eax
push ecx
call fcn.00463708
add esp, 4
inc esi
mov dword [ebp - 0x130], 0x100
cmp esi, dword [ebp - 0x12c]
jb 0x45eda1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046370d
mov esp, ebp
pop ebp
ret 4
call fcn.004a8769
int3

Function at 0x46724b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4b7ebc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b7ac1

Function at 0x4bbad4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bb2ae

Function at 0x4bbadf
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bb4e9

Function at 0x4bc032
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bbdb9
Function at 0x7ff6cc
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
jmp 0x7ff704
jmp 0x7ff6e8
lea esp, [esp + 4]
jmp 0x7ff6af
jmp 0x7ff720
jmp 0x7ff73c
push ebx
jmp 0x7ff758
jmp 0x7ff774
push ebp
jmp 0x7ff790
jmp 0x7ff7ac
push esi
jmp 0x7ff7c8
jmp 0x834b76
push edi
movzx edx, byte [eax]
shl edx, 8
movzx esi, byte [eax + 1]
xor edx, esi
jmp 0x834baa
movzx esi, byte [eax + 2]
shl edx, 8
jmp 0x834c83
xor edx, esi
movzx esi, byte [eax + 0xb]
jmp 0x834cf6
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
jmp 0x834bdf
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
jmp 0x834c00
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
jmp 0x834c2a
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
jmp 0x834c4d
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x80904c]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x80904c]
and edi, 0xff0000
jmp 0x834e82
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x80904c]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x80904c]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.00821298
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x80904c]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x80904c]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x80904c]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x80904c]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x80a874
jne 0x834ecf
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x8007f1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0x80080d
lea esp, [esp + 4]
jmp 0x8009b1
jmp 0x800845
jmp 0x800861
push ebp
jmp 0x80087d
jmp 0x800899
mov ebp, esp
jmp 0x8008b5
jmp 0x8008d1
push ecx
jmp 0x8008ed
jmp 0x800909
push ecx
jmp 0x800925
jmp 0x800941
push ebx
jmp 0x80095d
jmp 0x800979
push edi
jmp 0x800995
jmp 0x835e88
jmp 0x800829
cmp al, 0x30
jb 0x8351a3
cmp al, 0x61
jb 0x835346
cmp al, 0x7a
jbe 0x835479
jmp 0x835346
mov edi, eax
mov al, byte [ecx]
cmp al, 0x41
jb 0x83593d
cmp al, 0x5a
jbe 0x835479
jmp 0x83593d
Function at 0x801810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x83711f
lea esp, [esp + 4]
jmp fcn.00837158

Function at 0x802b93
Capabilities:
Get storage device properties

Disassembly:
jmp 0x802baf
lea esp, [esp + 4]
jmp 0x838f60
jmp 0x802be7
jmp 0x802c03
push ebp
jmp 0x802c1f
jmp 0x802c3b
mov ebp, esp
jmp 0x802c57
jmp 0x802c73
sub esp, 0x224
jmp 0x802c8f
jmp 0x802cb8
push ebx
jmp 0x839b03
jmp 0x802bcb
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov ebx, 0x428
cmp dword [ebp - 4], 4
jae 0x839bf0
push dword [ebp - 4]
lea eax, [ebp - 0x224]
push 0x80a874
push eax
call fcn.008141c6
add byte [ebx - 0x7f2af7fb], cl
add byte [ebx - 0x3b7cfbc0], cl
or al, 0x56
push esi
push 3
push esi
push 7
push esi
lea ecx, [ebp - 0x224]
push ecx
call eax
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x839bd3
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push 8
push dword [0x80d4cc]
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
call dword [fcn.0080d4f0]
push esi
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 0x2d1400
push dword [ebp - 0xc]
call fcn.00814197
add byte [ebp - 0x74e18b40], al
inc edi
sbb cl, ch
movsd dword es:[edi], dword [esi]
add byte [eax], al
add byte [eax], cl
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
sub eax, 0xa0c151f0
push ebx
salc
cmp edi, dword [edi + 0x13b94a2f]
cli
leave
sub eax, 0xd508058b
add byte [eax], 0xe9
cmpsb byte [esi], byte es:[edi]
add al, byte [eax]
add cl, bl
pop edx
enter 0x5aaf, 0xffffffffffffffbc
mov dword [ebp - 0x2b], 0xe1ac4fbc
iretd
inc dword [ebp - 4]
jmp 0x839e39
mov eax, dword [ebp - 8]
jmp 0x839e1b
pop edi
pop esi
pop ebx
jmp 0x839e49
cmp dword [ebp - 8], esi
je 0x839b13
jmp 0x839bf0
leave
ret