joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10357ba
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x103588e
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x103587d
push edi
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01028a67
push 0x100740c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x414]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
je 0x103587d
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x103587d
xor esi, esi
inc esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.010348fd
test eax, eax
jne 0x103587d
push eax
push eax
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.01035399
push edi
push 0x10073e8
push 4
call fcn.01036b8b
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01031a01
leave
ret 4
Function at 0x103871f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
push eax
push 1
xor esi, esi
push esi
push 0x1002c08
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1038798
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x1002bec
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], 3
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103878f
cmp dword [ebp - 4], 4
je 0x1038784
cmp dword [ebp - 4], 3
jne 0x103878f
xor eax, eax
cmp dword [ebp - 0xc], 1
setne al
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x1038a4d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp eax, esi
je 0x1038acb
cmp ecx, esi
je 0x1038acb
lea edx, [ebp - 0x210]
push edx
push 1
push esi
push ecx
push eax
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1038acb
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x1007890
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1038abf
inc esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret 8
Function at 0x1042e4f
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x198], esi
mov dword [ebp - 0x1a0], esi
je 0x1043005
push eax
push 0x100a564
lea eax, [ebp - 0x194]
push 0xc7
push eax
call fcn.01028b64
add esp, 0x10
test eax, eax
jl 0x1043005
lea eax, [ebp - 0x198]
push eax
push 3
push esi
lea eax, [ebp - 0x194]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1043005
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x19c]
push eax
push esi
mov esi, 0x10021cc
push esi
push dword [ebp - 0x198]
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x1a0], 0x190
call edi
test eax, eax
jne 0x1042ff8
cmp dword [ebp - 0x19c], 1
jne 0x1042ff8
lea eax, [ebp - 0x194]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1042f21
sub eax, edx
sar eax, 1
je 0x1042ff8
push 0
lea eax, [ebp - 0x194]
push eax
call fcn.01042674
test eax, eax
je 0x1042ff8
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x19c]
push eax
push 0
push 0x100d0e8
push dword [ebp - 0x198]
mov dword [ebp - 0x1a0], 0x190
call edi
test eax, eax
jne 0x1042feb
cmp dword [ebp - 0x19c], 1
jne 0x1042feb
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.01042674
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
je 0x1042fa8
push esi
push dword [ebp - 0x198]
call edi
jmp 0x1042fdc
lea eax, [ebp - 0x194]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1042fb1
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push 1
push 0
push esi
push dword [ebp - 0x198]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x100d0e8
push dword [ebp - 0x198]
call edi
jmp 0x1042ff8
push esi
push dword [ebp - 0x198]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x198]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret 4
Function at 0x1043454
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x101
xor edi, edi
push edi
push 0x10024d8
push 0x80000002
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10434be
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x100d170
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10434b1
cmp dword [ebp - 0xc], esi
je 0x10434b4
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, dword [ebp - 8]
pop edi
leave
ret
Function at 0x10437ec
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x210], 0
test eax, eax
push esi
mov dword [ebp - 0x21c], eax
mov esi, 0x80004005
jne 0x1043823
lea eax, [esi - 2]
jmp 0x1043936
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0x10067e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1043934
push ebx
mov ebx, dword [ebp + 0xc]
mov esi, 0x208
cmp ebx, esi
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], 1
jbe 0x1043869
mov dword [ebp - 0x218], esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x100d1d8
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10438d1
cmp dword [ebp - 0x214], 1
jne 0x10438d1
lea eax, [ebp - 0x20c]
push eax
call fcn.01033ed9
test eax, eax
je 0x10438b2
xor esi, esi
jmp 0x10438e4
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x20c]
push eax
call fcn.01033ed9
test eax, eax
jne 0x10438ae
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01043562
mov esi, eax
test esi, esi
jne 0x1043927
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10438ed
sub eax, edx
sar eax, 1
mov ecx, ebx
shr ecx, 1
inc eax
cmp ecx, eax
jbe 0x1043919
lea eax, [ebp - 0x20c]
push eax
push ecx
push dword [ebp - 0x21c]
call fcn.01028a67
jmp 0x1043927
mov eax, 0x8007007a
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret 8
Function at 0x104394a
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x214], 0
push ebx
push esi
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x214]
push eax
push 0x23
xor esi, esi
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ebx, eax
test ebx, ebx
jl 0x10439de
and dword [ebp - 0x210], esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10439a7
inc esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x10439da
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x10439da
push dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jne 0x1043a10
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1043a0b
push 0x100d1f8
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
test eax, eax
jge 0x1043a10
mov ebx, 0x80070057
test ebx, ebx
jl 0x1043a88
lea eax, [ebp - 0x20c]
push eax
call fcn.01033ed9
test eax, eax
je 0x1043a28
xor ebx, ebx
jmp 0x1043a4d
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x20c]
push eax
call fcn.01033ed9
test eax, eax
je 0x1043a49
xor ebx, ebx
test ebx, ebx
jne 0x1043a88
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1043a56
mov ecx, dword [ebp + 0xc]
sub eax, edx
sar eax, 1
shr ecx, 1
inc eax
cmp ecx, eax
jbe 0x1043a83
lea eax, [ebp - 0x20c]
push eax
push ecx
push dword [ebp - 0x218]
call fcn.01028a67
jmp 0x1043a88
mov ebx, 0x8007007a
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret 8
Function at 0x1043fc6
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
push 0x100d400
push 4
mov dword [ebp - 4], 1
call fcn.01036b8b
mov eax, dword [ebp + 8]
xor esi, esi
add esp, 0xc
cmp eax, esi
je 0x1043ffb
cmp word [eax], si
jne 0x1043ffb
xor eax, eax
push 0xf003f
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0xc], ebx
jne 0x1044036
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x104401e
push 0x57
pop eax
push eax
push edi
push 0x100d3cc
push 2
call fcn.01036b8b
add esp, 0x10
xor eax, eax
jmp 0x104419f
push 0xf01ff
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x1044071
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x1044057
push 0x57
pop eax
push eax
push edi
push 0x100d394
push 2
call fcn.01036b8b
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x104402f
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10440bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, esi
jne 0x104408d
push 0x57
pop edi
push dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0xc]
call esi
cmp edi, 0x420
jne 0x10440ad
xor eax, eax
inc eax
jmp 0x104419f
push edi
push dword [ebp + 0xc]
push 0x100d35c
jmp 0x1044025
cmp dword [ebp + 0x10], esi
je 0x1044169
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp + 0x10], 0x927c0
call ebx
test eax, eax
jne 0x10440f6
push edi
push 0x100d338
push 2
call fcn.01036b8b
add esp, 0xc
mov dword [ebp - 4], esi
jmp 0x1044169
cmp dword [ebp - 0x28], 4
je 0x1044169
mov edi, 0x1f4
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
add esi, 0x7530
cmp esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jle 0x1044139
mov dword [ebp + 0x10], esi
jmp 0x1044139
cmp dword [ebp - 0x28], 4
je 0x104413d
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
je 0x10441a6
sub esi, edi
add dword [ebp - 8], edi
test esi, esi
jg 0x104411a
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 8], eax
jg 0x1044153
cmp dword [ebp - 0x28], 4
je 0x1044169
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x10], eax
jne 0x1044101
push dword [ebp + 0xc]
push 0x100d320
push 2
call fcn.01036b8b
add esp, 0xc
and dword [ebp - 4], 0
push dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 4], 0
mov eax, 0x100d2cc
jne 0x1044189
mov eax, 0x100d2bc
push eax
push dword [ebp + 0xc]
push 0x100d304
push 4
call fcn.01036b8b
mov eax, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp + 0xc]
push 0x100d2e0
jmp 0x104415b
Function at 0x404b30
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x42dfa0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x404b70
cmp byte [ebx], 0xa
jne 0x404b70
or byte [edi + eax + 0x28], 4
jmp 0x404b75
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x404c74
mov dl, byte [eax]
cmp dl, 0x1a
je 0x404c57
inc eax
cmp dl, 0xd
je 0x404ba1
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x404bc7
cmp eax, ecx
jae 0x404bd5
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x404b89
jmp 0x404c74
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404c52
cmp dword [ebp - 0x10], 0
je 0x404c52
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x42dfa0]
test byte [eax + edi + 0x28], 0x48
je 0x404c2c
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x404c17
mov byte [esi], dl
jmp 0x404c28
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x42dfa0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x404c74
cmp byte [ebp - 1], 0xa
jne 0x404c3b
cmp esi, ebx
jne 0x404c3b
mov byte [esi], 0xa
jmp 0x404c73
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040492b
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x404c74
mov byte [esi], 0xd
jmp 0x404c73
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x42dfa0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x404c71
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x404c74
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x404c7d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x42dfa0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x404cc3
cmp word [ebx], dx
jne 0x404cc3
or byte [eax + edi + 0x28], 4
jmp 0x404cc8
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x404e2b
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x404e0b
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x404d09
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x404d3f
cmp eax, edx
jae 0x404d4d
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x404ce4
jmp 0x404e2b
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404e06
cmp dword [ebp - 0x18], 0
je 0x404e06
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x42dfa0]
test byte [eax + edi + 0x28], 0x48
je 0x404ddc
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x404da0
mov word [esi], cx
jmp 0x404dd7
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x42dfa0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x42dfa0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x42dfa0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x404e2b
pop eax
cmp word [ebp - 4], ax
jne 0x404dec
cmp esi, ebx
jne 0x404dec
mov word [esi], ax
jmp 0x404e28
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040492b
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x404e2b
push 0xd
pop eax
jmp 0x404de7
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x42dfa0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x404e25
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x404e2b
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x419c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov esi, 0x10
mov eax, ecx
mov ebx, dword [ebp + 0x14]
cdq
idiv esi
mov esi, eax
shl esi, 4
test edx, edx
je 0x419c7d
lea ecx, [esi + 0x10]
mov eax, dword [ebp + 0x10]
mov edx, edi
sub dword [ebp + 8], esi
push ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x220]
call fcn.0041cc10
add esp, 4
xor edi, edi
test esi, esi
jle 0x419d15
mov eax, dword [ebp + 0xc]
dec esi
mov edi, dword [ebp - 4]
sub eax, edi
shr esi, 4
inc esi
mov dword [ebp - 8], eax
mov eax, esi
mov dword [ebp + 0x10], esi
shl eax, 4
mov dword [ebp - 0xc], eax
lea ecx, [edi + 0xf]
xor eax, eax
mov edx, ebx
cmp ebx, ecx
ja 0x419ce1
lea ecx, [ebx + 0xf]
cmp ecx, edi
jb 0x419ce1
nop dword [eax]
mov cl, byte [edi + eax]
lea edx, [edx + 1]
xor byte [edx - 1], cl
inc eax
cmp eax, 0x10
jl 0x419cd0
jmp 0x419ced
movups xmm1, xmmword [edi]
movups xmm0, xmmword [ebx]
xorps xmm1, xmm0
movups xmmword [ebx], xmm1
mov esi, dword [ebp - 8]
lea ecx, [ebp - 0x220]
add esi, edi
mov edx, ebx
push esi
call fcn.0041d440
movups xmm0, xmmword [esi]
add esp, 4
add edi, 0x10
sub dword [ebp + 0x10], 1
movups xmmword [ebx], xmm0
jne 0x419cb7
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
lea esi, [ebx + 0xf]
test eax, eax
jle 0x419d8b
movaps xmm0, xmmword [0x4294d0]
push eax
mov eax, dword [ebp - 4]
add eax, edi
push eax
lea eax, [ebp - 0x1c]
push eax
movups xmmword [ebp - 0x1c], xmm0
call fcn.00402f60
lea eax, [ebp - 0xd]
add esp, 0xc
xor edx, edx
mov ecx, ebx
cmp ebx, eax
ja 0x419d62
lea eax, [ebp - 0x1c]
cmp esi, eax
jb 0x419d62
nop
mov al, byte [ebp + edx - 0x1c]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
inc edx
cmp edx, 0x10
jl 0x419d50
jmp 0x419d6f
movups xmm1, xmmword [ebx]
movups xmm0, xmmword [ebp - 0x1c]
xorps xmm1, xmm0
movups xmmword [ebx], xmm1
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x220]
add esi, edi
mov edx, ebx
push esi
call fcn.0041d440
movups xmm0, xmmword [esi]
add esp, 4
movups xmmword [ebx], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ba40
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov dl, 1
push ebx
push esi
push edi
xor ebx, ebx
movzx eax, dl
mov cl, dl
sar cl, 7
and cl, 0x1b
mov byte [ebp + ebx - 0x208], dl
mov byte [ebp + eax - 0x108], bl
mov al, dl
add al, al
inc ebx
xor cl, al
xor dl, cl
cmp ebx, 0x100
jl 0x41ba50
mov cl, 1
mov edx, 0x430850
movzx eax, cl
shl eax, 0x18
mov dword [edx], eax
mov al, cl
sar al, 7
add cl, cl
and al, 0x1b
add edx, 4
xor cl, al
cmp edx, 0x430878
jl 0x41ba81
mov dword [0x431480], 0x63
mov esi, 1
mov dword [0x430e0c], 0
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x108]
lea ecx, [ebp - 0x109]
sub ecx, eax
mov dl, byte [ecx]
mov cl, dl
mov al, dl
add al, al
shr cl, 7
or cl, al
xor dl, cl
mov al, cl
shr al, 7
add cl, cl
or al, cl
mov bl, al
xor bl, dl
mov dl, al
add al, al
shr dl, 7
or dl, al
mov al, dl
ror al, 7
movzx ecx, al
movzx eax, dl
xor ecx, eax
movzx eax, bl
xor ecx, eax
xor ecx, 0x63
mov dword [esi*4 + 0x431480], ecx
mov dword [ecx*4 + 0x430c80], esi
inc esi
cmp esi, 0x100
jl 0x41bac0
xor ebx, ebx
mov dword [ebp - 4], 0xff
nop word [eax + eax]
mov dl, byte [ebx + 0x431480]
mov cl, dl
movzx edi, dl
sar cl, 7
mov al, dl
and cl, 0x1b
add al, al
xor cl, al
movzx eax, dl
movzx esi, cl
shl esi, 8
xor esi, edi
movzx ecx, cl
xor ecx, eax
shl esi, 8
xor esi, edi
mov eax, esi
shl eax, 8
xor eax, ecx
bswap ecx
or ecx, esi
mov dword [ebx + 0x42ec50], eax
mov al, byte [ebx + 0x430c80]
mov dword [ebx + 0x42f450], ecx
shr ecx, 8
bswap edi
or ecx, edi
mov dword [ebx + 0x430050], ecx
shr ecx, 8
or ecx, edi
mov dword [ebx + 0x430450], ecx
test al, al
je 0x41bc20
movzx esi, al
xor edx, edx
mov eax, dword [ebp - 0xfb]
mov edi, 0xff
movzx eax, al
movzx ecx, byte [ebp + esi - 0x108]
add eax, ecx
div edi
mov eax, dword [ebp - 0xff]
movzx eax, al
add eax, ecx
movzx edi, byte [ebp + edx - 0x208]
xor edx, edx
div dword [ebp - 4]
movzx eax, byte [ebp + edx - 0x208]
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xfa]
movzx eax, al
add eax, ecx
mov ecx, 0xff
div ecx
movzx eax, byte [ebp + esi - 0x108]
mov esi, 0xff
movzx ecx, byte [ebp + edx - 0x208]
mov edx, dword [ebp - 0xfd]
movzx edx, dl
add eax, edx
xor edx, edx
div esi
mov eax, dword [ebp - 8]
movzx edx, byte [ebp + edx - 0x208]
jmp 0x41bc28
xor edi, edi
xor eax, eax
xor ecx, ecx
xor edx, edx
shl ecx, 8
xor ecx, eax
shl ecx, 8
xor ecx, edi
shl ecx, 8
xor ecx, edx
mov edx, ecx
mov dword [ebx + 0x42f850], ecx
shl edx, 0x18
shr ecx, 8
or edx, ecx
mov eax, edx
mov dword [ebx + 0x42fc50], edx
shl eax, 0x18
shr edx, 8
or eax, edx
mov dword [ebx + 0x42e450], eax
ror eax, 8
mov dword [ebx + 0x431080], eax
add ebx, 4
cmp ebx, 0x400
jl 0x41bb30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret