joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x20c
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call esi
test eax, eax
je 0x406e71
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push edx
mov dword [ebp - 8], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov eax, dword [ebp - 4]
push eax
call ebx
test edi, edi
jne 0x406ed7
push str.ScriptEngine
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 4]
push edx
push 0x20019
push edi
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call esi
test eax, eax
je 0x406ee0
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push eax
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call ebx
pop edi
xor eax, eax
test esi, esi
pop ebx
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407120
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
xor esi, esi
cmp dword [ecx + 8], esi
jle 0x407173
lea esp, [esp]
push esi
call fcn.00403560
push eax
push ebx
lea eax, [ebp - 0x208]
push 0x40c328
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [edi + 0xc]
inc esi
cmp esi, dword [ecx + 8]
jl 0x407140
mov edx, dword [edi + 0x10]
mov esi, dword [edx + 8]
dec esi
js 0x4071b0
lea esp, [esp]
mov ecx, dword [edi + 0x10]
push esi
call fcn.00403560
push eax
push ebx
lea eax, [ebp - 0x208]
push 0x40c328
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
dec esi
jns 0x407180
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xee9998
Capabilities:
Encode data using xor

Disassembly:
dec eax
and dl, byte [ebp - 0x51a08b88]
out dx, eax
outsd dx, dword [esi]
inc esi
in al, dx
jecxz 0xee99a8
pop ecx
or al, 0x17
push cs
scasb al, byte es:[edi]
add ecx, dword [ebx]
arpl word [ebx + 0x51e933], ax
adc ebx, esp
invalid
jmp 0xee99a2
pushal
call 0xee99a8
pop ebp
sub ebp, 0x10
sub ebp, 0xae9998
jmp 0xee99be
mov eax, 0xae9998
add eax, ebp
add eax, 0x4c
mov ecx, 0x5af
mov edx, 0xf19c4a82
xor byte [eax], dl
inc eax
dec ecx
jne 0xee99d5
jmp 0xee99e8
or dword [edi + 9], ecx
or edi, dword [esi + 0x3828282]
inc ebx
jp 0xee9976
add byte [edx - 0x7bc5b07f], 0x82
add byte [edx - 0x7d7d55c8], 0x82
jne 0xee9a64
or dword [edx + 9], 0x82828e03
add byte [ecx - 0x5919f0b9], 0x7e
or eax, dword [esi - 0x75152d5a]
mov byte [0xea82], al
or eax, 0x83820f36
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
ljmp 0x876a
xchg byte [eax - 0x72], al
or byte [ecx], 0xe
cmpsb byte [esi], byte es:[edi]
xchg byte [edx - 0x75157d7e], al
mov byte [0xea82], al
or eax, 0x83820f36
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
shr dword [edx - 0x79], cl
add byte [edx - 0x7f4e947e], 0x82
adc bh, 0xd6
fistp qword [ebp - 9]
invalid
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40b252
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40b261
pop dword [ebp - 0x34]
mov eax, 0x40b261
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x399cf
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x492a
mov edi, eax
mov ebx, 0xf6e2f3ab
sub ebx, 0xf6a1b7e7
add ebx, dword [ebp - 0x34]
mov esi, 0xf8ea451d
add dword [ebp - 0x20], eax
mov edx, dword [ebx]
sub dword [ebp - 0x2c], ecx
add edx, esi
sub dword [ebp - 0x2c], 0x6d33c505
mov dword [edi], edx
xor dword [ebp - 0xc], 0x2c225fae
add edi, 4
add ebx, 0x2979be8b
sub ebx, 0x2979be87
loop 0x40b2aa
add eax, 0x1177b
xor ebx, ebx
add ebx, eax
add eax, 0x1db9061f
sub eax, 0x1db9061a
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x40a771
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x4dd9dc
call fcn.004dc99a
mov esi, ecx
lea edi, [esi + 0xc]
push edi
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.004ce673
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
je 0x40a7df
cmp dword [ebp + 0x10], 0
je 0x40a7ae
push dword [ebp + 0x10]
push eax
call dword [0x4ee3a8]
push dword [ebp + 0x14]
lea ecx, [ebp + 0x10]
call fcn.004095ca
and dword [ebp - 4], 0
push eax
push edi
call fcn.0040a81a
mov ecx, eax
call fcn.0040585f
lea ecx, [ebp + 0x10]
call fcn.004090e7
push dword [esi + 4]
call dword [0x4ee3a4]
xor eax, eax
inc eax
call fcn.004dc963
ret 0x10
Function at 0x418437
Capabilities:
Inspect section memory permissions

Disassembly:
push 4
mov eax, 0x4df4af
call fcn.004dc99a
mov dword [ebp - 0x10], ecx
xor edi, edi
lea ecx, [ebp - 0x10]
push edx
mov dword [ebp - 4], edi
call fcn.00418e46
test eax, eax
je 0x418584
mov ebx, dword [ebp + 8]
mov ecx, 0xa4
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
cdq
idiv ecx
lea ecx, [ebp - 0x10]
push eax
call fcn.00418e46
mov esi, dword [ebx]
jmp 0x418578
push dword [esi + 4]
lea ecx, [ebp - 0x10]
call fcn.00418e46
cmp dword [esi + 4], 0x1b
je 0x4184a2
cmp dword [esi + 4], 0x1c
je 0x4184a2
mov ecx, esi
call fcn.00414400
neg eax
sbb eax, eax
neg eax
jmp 0x4184ac
mov ecx, esi
call fcn.004ae496
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.00418e46
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0xa0]
or edx, 0x1000000
cmp dword [esi], edi
cmove edx, dword [esi + 0x28]
mov ecx, edx
or ecx, 0x2000000
cmp eax, 1
cmovne ecx, edx
mov edx, ecx
or edx, 0x4000000
cmp eax, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 0x8000000
cmp dword [esi + 8], edi
cmove ecx, edx
cmp dword [esi + 0x2c], 0x80000001
jne 0x418505
or ecx, 0x10000000
jmp 0x418514
cmp dword [esi + 0x2c], 0x80000002
jne 0x418514
or ecx, 0x20000000
mov eax, ecx
or eax, 0xc0000000
cmp dword [esi + 0x58], 2
cmovne eax, ecx
cmp dword [esi + 0x58], 3
jne 0x41852f
or eax, 0x40000000
jmp 0x41853a
cmp dword [esi + 0x58], 4
jne 0x41853a
or eax, 0x80000000
push eax
lea ecx, [ebp - 0x10]
call fcn.00418e46
push dword [esi + 0x64]
lea ecx, [ebp - 0x10]
call fcn.00418e46
cmp dword [esi + 4], 0x10
push 0x4c
pop eax
push 0x20
pop ecx
cmovne eax, ecx
lea ecx, [ebp - 0x10]
add eax, esi
push eax
call fcn.00418fc8
lea eax, [esi + 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.00418fc8
add esi, 0xa4
cmp esi, dword [ebx + 4]
jne 0x41847c
xor edi, edi
inc edi
mov eax, edi
call fcn.004dc963
ret
Function at 0x41a647
Capabilities:
Enumerate pe sections

Disassembly:
push 0x30
push 0xaf30d0
call fcn.004c80e0
mov eax, edx
mov dword [ebp - 0x1c], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
je 0x41a72a
test eax, eax
je 0x41a72a
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41a72a
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x41a72a
mov byte [eax], bl
mov dword [ecx], ebx
mov dword [edx], ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x40]
push eax
push esi
call dword [0x4ee344]
test eax, eax
je 0x41a72a
cmp dword [ebp - 0x3c], ebx
je 0x41a72a
push 0x104
push dword [ebp - 0x1c]
push dword [ebp - 0x3c]
call dword [0x4ee3f4]
test eax, eax
je 0x41a72a
mov edi, dword [ebp - 0x3c]
mov edx, dword [edi + 0x3c]
add edx, edi
je 0x41a72a
movzx eax, word [edx + 0x14]
lea ecx, [edx + 0x18]
add ecx, eax
sub esi, edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ecx
movzx eax, word [edx + 6]
cmp ebx, eax
jae 0x41a72a
test ecx, ecx
je 0x41a72a
mov edi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 8]
cmovbe eax, dword [ecx + 8]
add eax, edi
cmp esi, edi
jb 0x41a71d
cmp esi, eax
ja 0x41a71d
lea eax, [ebx + 1]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
sub esi, edi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x41a733
inc ebx
add ecx, 0x28
jmp 0x41a6d9
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41d7bf
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x4dfc25
call fcn.004dc99a
mov esi, ecx
lea edi, [esi + 0xc]
push edi
push 4
push dword [ebp + 0xc]
push 0x41d5ef
push 0
push 0
call fcn.004ce673
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
je 0x41d82a
push 0xfffffffffffffffe
push eax
call dword [0x4ee3a8]
push 0x52b7b4
lea ecx, [ebp + 0xc]
call fcn.004095ca
and dword [ebp - 4], 0
push eax
push edi
call fcn.0040a81a
mov ecx, eax
call fcn.0040585f
lea ecx, [ebp + 0xc]
call fcn.004090e7
push dword [esi + 4]
call dword [0x4ee3a4]
xor eax, eax
inc eax
call fcn.004dc963
ret 0x10
Function at 0x425d58
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
mov eax, dword [0xb07014]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x425d8d
push edi
call dword [0x4ee690]
test eax, eax
je 0x425f3e
cmp dword [esi + 0x44], 0
je 0x425da2
test byte [esi + 0x58], 2
jne 0x425da2
push dword [esi + 0x44]
call dword [0x4ee704]
test byte [esi + 0x84], 2
mov dword [esi + 0x44], edi
jne 0x425f3b
mov edi, dword [0x4ee7bc]
xor ebx, ebx
push ebx
push ebx
push 0xb
push dword [esi + 4]
call edi
push ebx
push ebx
push 0x418
push dword [esi + 4]
call edi
mov ebx, eax
test ebx, ebx
jle 0x425de8
push 0
push 0
push 0x416
push dword [esi + 4]
call edi
sub ebx, 1
jne 0x425dd5
cmp dword [esi + 0x44], 0
je 0x425f1a
push dword [esi + 0x44]
call dword [0x4ee6e0]
push 0x64
mov dword [esp + 0x14], eax
lea eax, [esp + 0x7c]
push 0
push eax
call fcn.004c8e60
xor ebx, ebx
add esp, 0xc
cmp dword [esp + 0x10], ebx
jle 0x425f1a
push 0x30
lea eax, [esp + 0x38]
push 0
push eax
call fcn.004c8e60
and dword [esp + 0x48], 0
lea eax, [esp + 0x84]
add esp, 0xc
mov dword [esp + 0x58], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x30
mov dword [esp + 0x38], 0x15
mov dword [esp + 0x5c], 0x64
push eax
push 1
push ebx
push dword [esi + 0x44]
call dword [0x4ee68c]
lea eax, [esp + 0x78]
push eax
call dword [0x4ee398]
cmp eax, 0x63
jle 0x425e94
lea eax, [esp + 0x34]
mov dword [esp + 0x3c], 4
push eax
push 1
push ebx
push dword [esi + 0x44]
call dword [0x4ee688]
mov byte [esp + 0x78], 0
xor eax, eax
mov dword [esp + 0x68], ebx
and dword [esp + 0x64], eax
test byte [esp + 0x40], 3
mov word [esp + 0x6e], ax
setne al
mov byte [esp + 0x6d], 0x18
and dword [esp + 0x70], 0
dec al
and dword [esp + 0x74], 0
and al, 4
mov byte [esp + 0x6c], al
lea eax, [esp + 0x64]
push eax
push 0xffffffffffffffff
push 0x415
push dword [esi + 4]
call edi
and dword [esp + 0x30], 0
lea eax, [esp + 0x78]
mov dword [esp + 0x2c], eax
xorps xmm0, xmm0
lea eax, [esp + 0x14]
movlpd qword [esp + 0x1c], xmm0
push eax
push ebx
push 0x442
push dword [esi + 4]
movlpd qword [esp + 0x34], xmm0
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 2
call edi
inc ebx
cmp ebx, dword [esp + 0x10]
jl 0x425e1c
push 0
push 1
push 0xb
push dword [esi + 4]
call edi
push 1
push 0
push dword [esi + 4]
call dword [0x4ee694]
push dword [esi + 4]
call dword [0x4ee684]
xor eax, eax
inc eax
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c71aa
mov esp, ebp
pop ebp
ret 4
Function at 0x473dc7
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0xb07014]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0xdc729c], 0
push esi
mov esi, ecx
mov dword [esp + 4], 0x5308b0
mov dword [esp + 8], 0x5308c4
mov dword [esp + 0xc], 0x5308d8
mov dword [esp + 0x10], 0x5308f0
jne 0x473e1d
push 4
pop edx
lea ecx, [esp + 4]
mov dword [0xdc729c], 1
call fcn.00420adc
mov ecx, esi
call fcn.00473a4a
mov ecx, esi
call fcn.0046e997
mov ecx, esi
call fcn.00473bf7
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
xor ecx, esp
call fcn.004c71aa
mov esp, ebp
pop ebp
ret
Function at 0x48f928
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x44
mov eax, 0x4e6df6
call fcn.004dca05
mov esi, ecx
mov dword [ebp - 0x14], esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x24]
push dword [esi + 0x3c]
call dword [0x4ee668]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x48fa90
xor edi, edi
push 0xc
mov dword [ebp - 4], edi
call fcn.004c7923
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
mov dword [ebp + 8], ebx
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
jmp 0x48f98b
push edi
push edi
push 0x1200
push dword [esi + 0x4c]
call dword [0x4ee7bc]
mov ecx, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ecx
mov eax, edi
cmp eax, ecx
jge 0x48fa07
push 0x2c
mov dword [ebp - 4], 2
call fcn.004c7923
or dword [ebp - 4], 0xffffffff
pop ecx
mov dword [ebp - 0x1c], eax
jmp 0x48f9d6
push 0x2c
push edi
push eax
mov dword [ebp - 0x18], eax
call fcn.004c8e60
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov ecx, ebx
or dword [eax + 0x20], 0xffffffff
or dword [eax + 0x24], 0xffffffff
lea eax, [ebp - 0x1c]
push eax
call fcn.00430a1e
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x20], eax
jmp 0x48f9a5
mov eax, dword [esi + 0x7c]
push 4
inc eax
push eax
push dword [esi + 0x74]
call fcn.004cc845
add esp, 0xc
test eax, eax
je 0x48fa57
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x7c]
push 4
inc eax
push eax
push dword [esi + 0x78]
call fcn.004cc845
add esp, 0xc
test eax, eax
je 0x48fa57
mov edx, dword [esi + 0x7c]
mov ecx, dword [esi + 0x74]
shl edx, 2
mov dword [esi + 0x78], eax
add ecx, edx
je 0x48fa4e
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [esi + 0x78]
add eax, edx
je 0x48fa54
mov dword [eax], ebx
inc dword [esi + 0x7c]
cmp dword [ebp - 0x24], 0
jle 0x48fa8d
push 0x2c
lea eax, [ebp - 0x50]
push edi
push eax
call fcn.004c8e60
mov eax, dword [ebp + 0x10]
add esp, 0xc
test byte [eax + 8], 1
je 0x48fa7f
mov eax, dword [eax + 0x18]
or dword [ebp - 0x50], 1
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
mov ecx, esi
push eax
push dword [ebp + 0xc]
call fcn.0048af18
mov eax, dword [ebp + 0xc]
call fcn.004dc963
ret 0x10

Function at 0x49ee16
Capabilities:
Persist via run registry key

Disassembly:
push 8
mov eax, 0x4e8739
call fcn.004dc99a
mov esi, ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
xor edi, edi
push esi
inc edi
call fcn.004095ca
and dword [ebp - 4], 0
mov ebx, 0x4f57f0
push ecx
mov ecx, esp
push ebx
call fcn.004095ca
or dword [ebp - 4], 0xffffffff
mov edx, edi
mov ecx, 0x80000001
call fcn.00412c72
pop ecx
pop ecx
call fcn.00420866
test eax, eax
jne 0x49eeb6
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.004095ca
push ecx
mov ecx, esp
mov dword [ebp - 4], edi
push ebx
call fcn.004095ca
or dword [ebp - 4], 0xffffffff
mov edi, 0x80000002
xor edx, edx
mov ecx, edi
call fcn.00412c72
pop ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.004095ca
push ecx
mov ecx, esp
mov dword [ebp - 4], 2
push ebx
call fcn.004095ca
or dword [ebp - 4], 0xffffffff
xor edx, edx
inc edx
mov ecx, edi
call fcn.00412c72
pop ecx
pop ecx
call fcn.004dc963
ret
Function at 0x49ef46
Capabilities:
Persist via run registry key

Disassembly:
mov ecx, 0x4f49a0
call fcn.0049ee16
mov ecx, 0x5355e4
call fcn.0049ee16
mov ecx, 0x5355fc
call fcn.0049ee16
mov ecx, 0x535614
call fcn.0049ee16
mov ecx, 0x53562c
jmp fcn.0049ee16

Function at 0x49f06d
Capabilities:
Persist via run registry key

Disassembly:
push 0x18
mov eax, 0x4e880c
call fcn.004dc99a
xor ebx, ebx
xor esi, esi
inc ebx
mov dword [ebp - 0x10], esi
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
mov edi, 0x4f49a0
push edi
call fcn.004095ca
push ecx
mov ecx, esp
mov dword [ebp - 4], esi
push 0x4f57f0
call fcn.004095ca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
mov edx, 0x80000001
call fcn.004125b9
add esp, 0xc
mov dword [ebp - 4], ebx
mov eax, dword [eax]
mov dword [ebp - 0x10], ebx
cmp dword [eax - 0xc], esi
jne 0x49f14b
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.004095ca
push ecx
mov ecx, esp
mov dword [ebp - 4], 2
push 0x4f57f0
call fcn.004095ca
mov edx, 0x80000002
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.004125b9
add esp, 0xc
push 3
pop ebx
mov dword [ebp - 4], ebx
mov eax, dword [eax]
mov dword [ebp - 0x10], ebx
cmp dword [eax - 0xc], esi
jne 0x49f14b
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push edi
call fcn.004095ca
push ecx
mov ecx, esp
mov dword [ebp - 4], 4
push 0x4f57f0
call fcn.004095ca
mov edx, 0x80000002
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.004125b9
add esp, 0xc
mov eax, dword [eax]
push 7
pop ebx
cmp dword [eax - 0xc], esi
je 0x49f14e
xor esi, esi
inc esi
test bl, 4
je 0x49f15e
lea ecx, [ebp - 0x14]
and ebx, 0xfffffffb
call fcn.004090e7
test bl, 2
je 0x49f16b
lea ecx, [ebp - 0x18]
call fcn.004090e7
lea ecx, [ebp - 0x1c]
call fcn.004090e7
mov eax, esi
call fcn.004dc963
ret
Function at 0x4a6398
Capabilities:
Persist via run registry key

Disassembly:
push 0xc
mov eax, 0x4e94da
call fcn.004dc99a
mov edi, ecx
mov bx, word [ebp + 0xc]
xor esi, esi
inc esi
cmp bx, si
jne 0x4a64c6
push ecx
push esi
call fcn.004a5a23
push 0
push 0
push 0x147
push dword [edi + 0x2444]
call dword [0x4ee7bc]
xor ecx, ecx
cmp dword [edi + 0x2440], ecx
sete cl
add eax, ecx
mov ecx, dword [edi + 0x2648]
mov dword [edi + 0x243c], eax
cmp ecx, esi
jne 0x4a63f4
cmp eax, 2
jne 0x4a641e
cmp ecx, 2
jne 0x4a64c6
cmp dword [edi + 0x2a4c], eax
jne 0x4a641e
lea eax, [edi + 0x30]
push eax
lea eax, [edi + 0x264c]
push eax
call dword [0x4ee410]
test eax, eax
je 0x4a64c6
push esi
push ecx
lea esi, [edi + 0x30]
mov dword [ebp - 0x14], esp
mov ecx, esp
push esi
call fcn.004095ca
and dword [ebp - 4], 0
push ecx
mov ecx, esp
push 0x4f5820
call fcn.004095ca
mov edx, dword [edi + 0x243c]
lea ecx, [ebp + 0xc]
neg edx
sbb edx, edx
or dword [ebp - 4], 0xffffffff
add edx, 0x80000002
call fcn.004125b9
add esp, 0xc
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
je 0x4a64be
lea eax, [edi + 0x430]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040c8af
test eax, eax
je 0x4a64be
push esi
lea eax, [ebp - 0x10]
push 0x536c54
push eax
call fcn.0041e0d9
add esp, 0xc
push 0x31
push 0x52f364
push dword [eax]
push dword [edi + 4]
call dword [0x4ee798]
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.004090e7
cmp esi, 1
je 0x4a64be
lea ecx, [ebp + 0xc]
call fcn.004090e7
jmp 0x4a64da
lea ecx, [ebp + 0xc]
call fcn.004090e7
and dword [edi + 0x2444], 0
movzx eax, bx
push eax
push dword [edi + 4]
call dword [0x4ee73c]
xor eax, eax
call fcn.004dc963
ret 0x10
Function at 0x4d9951
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d97d0
Function at 0x437670
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x437684
mov dword [esp + 0x18], 0x462af0
jmp fcn.004635b0
mov dword [esp + 0x18], 0x463070
jmp fcn.00463750

Function at 0x43ec40
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x43ec89
mov al, byte [edx]
test al, al
je 0x43ec89
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
add edx, 1
xor esi, ecx
test al, al
jne 0x43ec57
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x44c210
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.004fc970
mov eax, dword [0x588eb0]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
push edi
mov edi, dword [esp + 0x9c]
je 0x44c285
cmp ebx, dword [esi]
je 0x44c27c
test edi, edi
je 0x44c262
cmp dword [esp + 0xa0], eax
jge 0x44c27c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004fbc95
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x44c28b
mov ebx, dword [esi]
test ebx, ebx
je 0x44c262
test edi, edi
push ebp
je 0x44c35d
push ebx
call fcn.00444ff0
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x44c2bb
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.0042bff0
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x44c315
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.00441fb0
add esp, 0xc
test eax, eax
je 0x44c418
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.00442160
add esp, 0xc
test eax, eax
je 0x44c418
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.00442170
add esp, 0xc
test eax, eax
je 0x44c418
jmp 0x44c33a
cmp eax, 0x80
ja 0x44c418
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.004fe150
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x44c365
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.004ffc00
add esp, 0xc
jmp 0x44c365
test eax, eax
je 0x44c404
xor eax, eax
jmp 0x44c370
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x44c370
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.00441fb0
add esp, 0xc
test eax, eax
je 0x44c418
push ebx
call fcn.00444ff0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.00442160
add esp, 0x10
test eax, eax
je 0x44c418
xor eax, eax
jmp 0x44c3c0
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x44c3c0
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.00441fb0
add esp, 0xc
test eax, eax
je 0x44c418
push ebx
call fcn.00444ff0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.00442160
add esp, 0x10
test eax, eax
je 0x44c418
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.00442300
add esp, 8
test eax, eax
jne 0x44c41c
xor eax, eax
jmp 0x44c421
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004fbc95
add esp, 0x88
ret