joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ebb0
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx - 0x46852941], edi
xlatb
imul ecx, dword [esi + 0x23], 0x48
adc ah, bl
popfd
daa
shr esi, 1
push edi
push ss
mov bl, 0xc1
lcall 0x713e, 0x8f3ba97b
inc ebp
cmp dh, byte [ebx + 0x1cdc2be5]
popal
inc ecx
imul edx
adc dword [0xaa4dc87f], edi
mov bh, 0x5b
sbb cl, byte [edx + 0x7e]
adc eax, 0xeb7d6db9
ror edx, cl
inc ebx
and byte [ebp - 0x57], 0x25
dec ebp
xchg edx, eax
push esi
xchg ecx, eax
xor ah, byte [esi - 0x23fc2a6a]
inc ebx
jnp 0x42ebcd
xchg ecx, eax
xor ecx, dword [eax]
dec ebx
xor al, 0xdf
invalid

Function at 0x4314e0
Capabilities:
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x456936
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], 0x458c20
mov eax, dword [esi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
push eax
mov dword [esp + 0x2c], 1
call ebx
lea edi, [esi + 8]
push str.liveupdatelogP2SP_360installer.log
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.0040d610
mov edx, dword [eax]
push 4
push 0
push edx
call ebx
mov eax, dword [esp + 0x10]
mov edx, dword [0x46005c]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x43156d
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x43156d
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00439890
add esp, 4
push str.liveupdatelog
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0040d610
mov ecx, dword [eax]
push 4
push 0
push ecx
call ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [0x46005c]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4315b1
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4315b1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.00439890
add esp, 4
mov ecx, dword [edi]
push 4
push 0
push ecx
call ebx
mov eax, dword [esi + 0xc]
mov ecx, dword [0x46005c]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4315e3
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4315e3
mov eax, dword [esi + 0xc]
sub eax, 0xc
push eax
call fcn.00439890
add esp, 4
mov eax, dword [edi]
mov edx, dword [0x46005c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x43160a
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x43160a
mov edx, dword [edi]
sub edx, 0xc
push edx
call fcn.00439890
add esp, 4
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x431a40
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1814
call fcn.00441bd0
mov ecx, dword [esp + 0x1820]
mov edx, dword [esp + 0x181c]
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x1820]
push eax
push ecx
xor ebx, ebx
push edx
push esi
mov dword [esp + 0x18], ebx
call fcn.004111c0
test eax, eax
je 0x431a88
pop esi
mov eax, 1
pop ebx
add esp, 0x1814
ret 0xc
cmp dword [esp + 8], ebx
jne 0x431c87
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x820]
rep stosd dword es:[edi], eax
push 0x800
lea eax, [esp + 0x824]
push 0x4612e4
push eax
call fcn.00441b85
push 0x800
lea ecx, [esp + 0x830]
push 0x462140
push ecx
call fcn.00442185
push 0x800
lea edx, [esp + 0x83c]
push 0x4612b8
push edx
call fcn.00442185
push 0x800
lea eax, [esp + 0x848]
push 0x462140
push eax
call fcn.00442185
push 0x800
lea ecx, [esp + 0x854]
push str.vL
push ecx
call fcn.00442185
push 0x800
lea edx, [esp + 0x860]
push esi
push edx
call fcn.00442185
add esp, 0x48
lea eax, [esp + 0x820]
push 0x800
push 0x461278
push eax
call fcn.00442185
add esp, 0xc
lea ecx, [esp + 0x820]
push 0x14
push 0x462140
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431c80
push 0xc8
push 0x461234
push 0x4622d8
call fcn.004536d2
add esp, 0xc
test eax, eax
jne 0x431c6b
mov ecx, 0x1ff
lea edi, [esp + 0x22]
mov word [esp + 0x20], bx
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x431c60
lea edx, [esp + 0x20]
push str.360ver.dll
lea eax, [esp + 0x24]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x431c60
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
call fcn.004110a0
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
je 0x431c60
push ebx
lea edx, [esp + 0x24]
push 1
push edx
call fcn.00431a40
test eax, eax
je 0x431c60
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x431c60
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, ebx
je 0x431c6b
push 5
push ebx
push ebx
push 0x462470
jmp 0x431c74
push 5
push ebx
push ebx
push 0x4622d8
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call fcn.00442074
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1814
ret 0xc
Function at 0x4325d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x84]
mov esi, dword [ebp + 0x8c]
mov dword [esp + 0x14], eax
mov eax, dword [ebx]
mov ecx, dword [eax - 0xc]
lea edi, [eax - 0xc]
cmp ecx, 1
mov dword [esp + 0x10], edi
jg 0x432607
cmp esi, dword [eax - 4]
jle 0x432698
mov eax, dword [eax - 8]
cmp esi, eax
mov dword [esp + 0x24], eax
jge 0x432614
mov esi, eax
test esi, esi
jne 0x432622
mov ecx, dword [str.lF_F]
mov dword [ebx], ecx
jmp 0x43264f
lea edx, [esi + esi + 0xe]
push edx
call fcn.00440c16
xor ecx, ecx
add esp, 4
cmp eax, ecx
je 0x43269a
mov dword [eax], 1
mov word [eax + esi*2 + 0xc], cx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
add eax, 0xc
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
lea ecx, [eax + eax + 2]
lea edx, [esi + esi + 2]
cmp edx, ecx
jb 0x432676
mov eax, ecx
lea esi, [edi + 0xc]
mov edi, dword [ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x24]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
mov ecx, dword [ebx]
mov dword [ecx - 8], eax
mov eax, dword [0x46005c]
cmp edi, eax
je 0x432698
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x432698
push edi
call fcn.00439890
add esp, 4
mov ecx, dword [ebx]
mov edx, dword [esp + 0x14]
mov eax, dword [ebp + 0x88]
push edx
mov edx, dword [ebp + 0x8c]
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebp, eax
mov eax, dword [ebx]
mov ecx, dword [eax - 0xc]
lea esi, [eax - 0xc]
cmp ecx, 1
jle 0x43272e
mov ecx, dword [0x46005c]
add eax, 0xfffffff4
cmp eax, ecx
je 0x4326fa
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4326f3
mov edx, dword [ebx]
sub edx, 0xc
push edx
call fcn.00439890
add esp, 4
mov eax, dword [str.lF_F]
mov dword [ebx], eax
mov ecx, dword [esi + 4]
push ecx
mov ecx, ebx
call fcn.00404130
test eax, eax
je 0x43272e
mov edi, dword [ebx]
mov edx, dword [esi + 4]
mov eax, dword [edi - 4]
lea ecx, [edx + edx + 2]
lea edx, [eax + eax + 2]
cmp edx, ecx
jb 0x43272e
mov eax, ecx
add esi, 0xc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebx]
pop edi
pop esi
mov dword [edx - 8], eax
mov ecx, dword [ebx]
mov word [ecx + eax*2], 0
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x4330d0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
test esi, esi
push edi
je 0x4331c2
mov ebx, dword [esp + 0x124]
test ebx, ebx
je 0x4331c2
mov ebp, dword [esp + 0x128]
cmp ebp, 0x80
jl 0x4331c2
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4331c2
cmp eax, 0xff
ja 0x4331c2
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4331c2
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
push 0x4605e4
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4331c2
mov ecx, ebp
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
shr edx, 0x10
push ecx
push edx
push str._d._d._d._d
push ebp
push ebx
call fcn.0042c5a0
add esp, 0x1c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc
Function at 0x433920
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x608
push ebx
push ebp
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x218]
push eax
push ecx
mov ecx, dword [edx + 0x4c]
lea eax, [esp + 0x18]
push eax
mov eax, dword [edx + 0x48]
push ecx
mov ecx, dword [edx + 0x54]
mov edi, 0x200
push eax
mov dword [esp + 0x24], esi
push ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ebx, dword [esp + 0x61c]
mov edx, dword [str.lF_F]
lea eax, [esp + 0x218]
test eax, eax
mov dword [ebx], edx
je 0x433adb
lea ecx, [esp + 0x218]
shr ecx, 0x10
jne 0x433a7c
mov eax, dword [0x468408]
xor ebp, ebp
lea edx, [esp + 0x218]
lea ecx, [esp + 0x18]
mov eax, dword [eax + 8]
mov bp, dx
push 0x100
push ecx
push ebp
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, esi
jne 0x4339de
mov word [esp + 0x18], si
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x433a19
lea eax, [esp + 0x18]
test eax, eax
je 0x4339fd
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esp + 0x18]
mov ecx, ebx
push edx
push eax
call fcn.00404190
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x608
ret 4
push 0x1ff
mov ecx, ebx
call fcn.00403f70
mov esi, eax
test esi, esi
je 0x433a64
mov eax, dword [0x468408]
push edi
push esi
push ebp
mov eax, dword [eax + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x433a44
mov word [esi], ax
mov ecx, edi
sub ecx, eax
cmp ecx, 1
jg 0x433a64
add edi, 0x100
mov ecx, ebx
lea edx, [edi - 1]
push edx
call fcn.00403f70
mov esi, eax
test esi, esi
jne 0x433a2b
push 0xffffffffffffffff
mov ecx, ebx
call fcn.00404030
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x608
ret 4
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x433adb
lea ecx, [esi + esi + 0xe]
push ecx
call fcn.00440c16
add esp, 4
test eax, eax
je 0x433adb
mov dword [eax], 1
mov word [eax + esi*2 + 0xc], 0
mov dword [eax + 4], esi
mov dword [eax + 8], esi
lea ecx, [esi + esi]
lea edx, [esi + esi + 2]
add eax, 0xc
cmp edx, ecx
mov dword [ebx], eax
jb 0x433adb
mov edi, eax
mov eax, ecx
lea esi, [esp + 0x218]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x608
ret 4

Function at 0x434750
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x434786
pop edi
xor eax, eax
pop esi
ret 4
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push ecx
push edx
push esi
call fcn.004347c0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret 4
Function at 0x4347c0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.00441bd0
mov eax, dword [esp + 0x1010]
push ebx
push ebp
push esi
cmp eax, 0xffffffff
push edi
je 0x4348ec
mov ebp, dword [esp + 0x1024]
xor esi, esi
cmp ebp, esi
je 0x4348ec
mov ecx, dword [esp + 0x1028]
cmp ecx, esi
jle 0x4348ec
mov eax, ecx
cdq
and edx, 0xfff
add eax, edx
mov ebx, eax
mov eax, ecx
sar ebx, 0xc
and eax, 0x80000fff
jns 0x43481e
dec eax
or eax, 0xfffff000
inc eax
cmp ebx, esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
jle 0x43488e
mov edx, dword [esp + 0x1020]
mov ecx, 0x400
mov esi, ebp
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 0x1000
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4348ec
mov eax, dword [esp + 0x102c]
test eax, eax
je 0x434877
mov ecx, dword [esp + 0x10]
mov edx, dword [eax]
add edx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x14]
add ebp, 0x1000
inc eax
cmp eax, ebx
mov dword [esp + 0x14], eax
jl 0x43482e
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x4348dc
mov ecx, eax
mov esi, ebp
mov edx, ecx
lea edi, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
lea edx, [esp + 0x20]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x102c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4348ec
mov eax, dword [esp + 0x102c]
test eax, eax
je 0x4348dc
mov ecx, dword [esp + 0x10]
mov edx, dword [eax]
add edx, ecx
mov dword [eax], edx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x100c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100c
ret
Function at 0x4372d0
Capabilities:
Encode data using xor

Disassembly:
dec edi
pop edi
inc esp
push ebx
jecxz 0x437281
inc eax
mov ah, 0x37
sti
and ebx, dword [ebp - 0x74]
fucompi st(3)
xor esp, dword [ebx]
test eax, 0x1f64c4c5
imul ebp, ebp, 0x13a179d8
mov ch, 0xdb
push 0xfffffffffffffff1
int1
mov eax, dword [0xf1c71dee]
mov ebp, 0xd5978f12
sbb dword [ebx - 0x278a8395], edx
mov dl, 0xab
lodsd eax, dword [esi]
push eax
jle 0x437304
stc
insb byte es:[edi], dx
cmp byte [eax], ch
inc eax
xor eax, 0xb58c9165
das
cmc
cli
fisub word [edx + 0x259492cd]
mov dh, 0xf8
xchg ebx, eax
cli
fst qword [esi - 0x59]
std
cmpsb byte [esi], byte es:[edi]
cmp byte [ecx], ah
wait
xor bl, byte [ebx + 0x3d3106fe]
iretd
mov ch, 0x7c
fcomp dword [edi - 0x19]
jge 0x437262
cdq
out dx, eax
retf
jne 0x437373
adc byte [esi - 0x69e81435], ch
or byte [edx + ebx*8 - 0x3c], cl
out 0xf3, eax
push ecx
popfd
push edi
aam 0xe1
jmp 0x1bf19c72
mov esp, 0x470d32cf
salc
mov eax, dword [0xd3d4aa2c]
lodsb al, byte [esi]
push esp
or dword [ebp - 0x5d], edx
test eax, 0x79e5c1f0
inc ecx
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
sahf
scasd eax, dword es:[edi]
in al, dx
push ebp
or dword [ebx - 0xdcd3156], esp
mov dword [0xf232ceaa], eax
mov ebp, 0x5e10f40f
mov byte [0xd7121f2e], al
push cs
jne 0x437391
mov ch, 0xd2
xchg edi, eax
mov esp, 0x33fc931c
jl 0x4373db
fistp qword [ebp + 0x4d]
sub al, 2
lodsb al, byte [esi]
and dh, ah
out dx, eax
cwde
sub byte [ebp - 0x3761ae90], ch
cwde
sub ah, byte [edi]
cld
int 0xb4
ror dword [ebx], 1
imul eax, esi, 0xa58d8c91
aam 0x3d
cmp byte [edi + 0x27de9c56], ch
push ds
inc edx
fld qword [edi]
mov cs, ebx
ffreep st(7)
dec edi
inc esi
push ecx
pop edx
invalid
invalid

Function at 0x43b0f0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x43c300
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x43c32f
push 0x4644bc
push eax
push 0x112
push 0x464404
call fcn.0043dd50
add esp, 0x10
xor eax, eax
ret
mov eax, 1
ret

Function at 0x43c580
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
push 0
push 0
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x43c5bc
push 0x464518
push eax
push 0xed
push 0x464404
call fcn.0043dd50
add esp, 0x10
xor eax, eax
pop edi
pop esi
ret
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xc]
push 0
push edx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43c5f5
push 0x4644fc
push eax
push 0xf0
push 0x464404
call fcn.0043dd50
add esp, 0x10
xor eax, eax
pop edi
pop esi
ret
cmp edi, dword [esp + 0xc]
je 0x43c619
push 0x4644ec
push 1
push 0xf2
push 0x464404
call fcn.0043dfd0
add esp, 0x10
xor eax, eax
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x43edf0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x43ee20
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x43ee50
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
ret
Function at 0x1000475b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x108
call fcn.100092c0
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x87029d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push 0x108
call fcn.100092c0
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x87029d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp - 4]
call fcn.100010b3
mov eax, 0
cmp eax, ecx
jl 0x100047db
push 0
push 0x4011022
push 1
call fcn.100092c6
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
call fcn.100010b3
mov eax, 0
cmp eax, ecx
jl 0x1000480e
push 0x29
push 0x4011022
push 1
call fcn.100092c6
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x10004824
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x1000484c
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x10004846
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x10004865
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push 0x80000301
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x1bc
call fcn.10009f20
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x100048c1
push ebx
call fcn.100092ba
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x100048d6
mov ebx, dword [ebp - 4]
push ebx
call fcn.100092ba
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.100092ba
add esp, 4
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000aa90
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000aaae
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1000aaa3
pop esi
ret
Function at 0x7712b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x7750a0
push edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
dec dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.007711ad
test eax, eax
jne 0x771323
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x771340
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x771323
cmp dword [ebp - 0x10], 4
jne 0x771323
cmp dword [ebp - 8], 1
jne 0x771323
cmp dword [esi + 0xc], ebx
je 0x77136e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x77133b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
leave
ret 4
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 4]
mov dword [ebp + 8], ebx
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
je 0x771323
mov eax, dword [esi + 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 4]
mov dword [eax + 8], ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
jmp 0x771323
Function at 0x7725d1
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp eax, edi
jne 0x772d32
mov eax, dword [esi + 0x30]
cmp eax, edi
jne 0x77303e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
je 0x772616
push dword [eax + 0x64]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
cmp dword [esi + 0x34], edi
jne 0x7732d7
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
test byte [esi + 0x38], bl
jne 0x7732c4
push ebx
lea ecx, [esi + 0x20]
push ecx
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi + 0x14]
push eax
call fcn.00772d61
test eax, eax
jne 0x7725ec
jmp 0x7732bd
shl eax, 0xa
push eax
jmp 0x772610
xor eax, eax
jmp 0x77262b
push 4
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x7725ec
jmp 0x7732bd
push ebx
push edi
push ebx
call dword [sym.imp.ntdll.dll_RtlSetProcessIsCritical]
add esp, 0xc
jmp 0x77261f

Function at 0x403161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x403161
lcall 0x5de5, 0x8b10c483
jmp loc.00791034