joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ec5a
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x438
push ebx
push edi
xor ebx, ebx
push ebx
push 2
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x41ed20
push ebp
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41ed19
push esi
push dword [esp + 0x1c]
push ebx
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41ecee
push 0x104
lea eax, [esp + 0x244]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x41eceb
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x14], 8
jb 0x41ecd7
mov eax, dword [eax]
lea ecx, [esp + 0x240]
push ecx
push eax
call fcn.0045904d
pop ecx
pop ecx
test eax, eax
je 0x41ed00
push esi
call ebp
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41ec9c
jmp 0x41ed18
push 0xfffffffffffffff8
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call ebp
pop esi
xor ebx, ebx
push edi
inc ebx
call ebp
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 0x438
ret

Function at 0x41ed2b
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push esi
xor ebx, ebx
push ebx
push 2
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x41edd0
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x41edc6
push edi
push dword [esp + 0x18]
push ebx
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x41edb5
cmp dword [ebp + 0x14], 8
jb 0x41ed86
mov eax, dword [ebp]
jmp 0x41ed88
mov eax, ebp
lea ecx, [esp + 0x34]
push ecx
push eax
call fcn.0045904d
pop ecx
pop ecx
test eax, eax
jne 0x41edae
push 0xfffffffffffffff8
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41ed65
pop edi
xor ebx, ebx
push esi
inc ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x22c
ret
Function at 0x41f1d5
Capabilities:
Enumerate processes
Print debug messages
Terminate process

Disassembly:
sub esp, 0x434
push ebx
push ebp
push edi
xor ebx, ebx
push ebx
push 2
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x41f2ab
push esi
push 0x228
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.00466e30
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, eax
xor eax, eax
push 0x206
push eax
mov word [esp + 0x244], ax
lea eax, [esp + 0x246]
push eax
call fcn.00466e30
pop ecx
pop ecx
lea edx, [esp + 0x240]
mov ecx, ebp
call fcn.0041f17a
pop ecx
lea eax, [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test esi, esi
pop esi
je 0x41f2a4
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41f294
push dword [esp + 0x14]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x41f294
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41f261
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x434
ret

Function at 0x425ad0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47d0c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1007c
call fcn.00467a50
mov eax, dword [ebp + 8]
push ebx
cmp dword [eax + 0x14], 8
push esi
push edi
mov esi, ecx
jb 0x425b06
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi]
push eax
call fcn.004546f4
push dword [esp + 0xc]
mov edi, eax
xor ebx, ebx
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.0041d39e
lea edx, [esp + 0x10]
lea ecx, [esp + 0x28]
mov dword [esp + 0x10094], ebx
call fcn.0041d828
lea ecx, [esp + 0x10]
call fcn.0041d33b
lea ecx, [esp + 0x40]
call fcn.00426d46
mov byte [esp + 0x10094], 3
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
push eax
lea ecx, [esp + 0x44]
call fcn.00426e6e
push dword [esp + 0x58]
mov ecx, esi
call fcn.00425bc5
push edi
mov esi, eax
call fcn.00459479
pop ecx
lea ecx, [esp + 0x70]
mov byte [esp + 0x10094], 2
call fcn.00426d83
push ebx
push 1
lea ecx, [esp + 0x30]
call fcn.0041dab3
mov ecx, dword [esp + 0x1008c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x429cdb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x38]
mov ebx, ecx
push eax
mov dword [esp + 0x14], ebx
call fcn.00421d0e
mov ebp, dword [esp + 0x50]
mov edx, dword [ebx + 0x58]
mov ecx, dword [ebp]
sub ecx, dword [ebx + 0x80]
mov esi, dword [ebx + 0x4c]
mov edi, dword [esp + 0x38]
imul ecx, edx
add ecx, dword [ebx + 0x48]
lea eax, [esi + edi]
add ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 0x60]
mov ebx, dword [ebp + 0xc]
sub ebx, dword [ebp + 8]
mov ebp, dword [esp + 0x54]
sub eax, esi
add eax, edi
mov dword [esp + 0x30], eax
lea eax, [edx + ecx]
inc ebx
mov dword [esp + 0x34], eax
xor eax, eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x14], ebx
mov ecx, eax
test ebx, ebx
jle 0x429daa
push 9
pop edi
cmp word [ebp + ecx*2], di
je 0x429d58
inc ecx
cmp ecx, ebx
jl 0x429d4a
jmp 0x429daa
push 0x20
mov ecx, eax
pop esi
movzx edx, word [ebp + ecx*2]
cmp dx, di
jne 0x429d8c
mov word [eax*2 + 0x4e7c78], si
mov word [eax*2 + 0x4e7c7a], si
mov word [eax*2 + 0x4e7c7c], si
mov word [eax*2 + 0x4e7c7e], si
add eax, 4
jmp 0x429d95
mov word [eax*2 + 0x4e7c78], dx
inc eax
inc ecx
cmp ecx, ebx
jl 0x429d5d
cmp eax, 0xffffffff
je 0x429daa
mov ebx, eax
mov dword [esp + 0x14], ebx
mov ebp, 0x4e7c78
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x4c]
push dword [esi + 0x74]
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x824
lea eax, [esp + 0x2c]
push eax
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [esp + 0x50]
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.004297f2
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x1c]
push eax
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
test eax, eax
je 0x429e7f
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x20]
je 0x429e7f
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
lea eax, [esp + 0x18]
push eax
call esi
mov ebx, eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_GetClipRgn]
lea eax, [esp + 0x18]
push eax
call esi
mov esi, eax
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectClipRgn]
call edi
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
mov eax, dword [esp + 0x10]
push dword [eax + 0x70]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x54]
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [esp + 0x10]
push dword [eax + 0x78]
push dword [esp + 0x50]
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x824
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x5c]
call dword [sym.imp.USER32.dll_DrawTextW]
push ebx
push dword [esp + 0x50]
call edi
push ebx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x1c
Function at 0x42a271
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
xor eax, eax
push ebx
mov ebx, dword [esp + 0x100]
push ebp
push esi
push edi
mov edi, dword [esp + 0x108]
mov esi, ecx
cmp byte [edi], 1
sete al
mov dword [esi + 0x14], eax
test eax, eax
je 0x42a29c
inc edi
dec ebx
cmp dword [esi + 0xc], 0
je 0x42a2ab
push dword [esi + 0xc]
call fcn.00459479
pop ecx
push ecx
lea eax, [edi + ebx]
mov dword [esp + 0x100], edi
mov dword [esp + 0xf8], edi
push ecx
xor ebp, ebp
lea edi, [esi + 8]
lea ebx, [esi + 4]
push edi
mov edx, ebx
lea ecx, [esp + 0x58]
mov dword [esp + 0x68], ebp
mov dword [esp + 0x78], ebp
mov dword [esp + 0x104], eax
call fcn.0042d40e
add esp, 0xc
mov dword [esi + 0xc], eax
test eax, eax
je 0x42a432
push 0x2c
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.00466e30
mov edx, dword [edi]
mov ecx, dword [ebx]
add esp, 0xc
mov eax, edx
imul edx, ecx
neg eax
mov dword [esp + 0x28], eax
xor eax, eax
push 0x20
inc eax
mov word [esp + 0x30], ax
pop eax
push ebp
push ebp
mov word [esp + 0x36], ax
lea eax, [esp + 0x20]
push eax
push ebp
lea eax, [esp + 0x30]
push eax
shl edx, 2
push ebp
mov dword [esp + 0x38], 0x28
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], edx
mov dword [esp + 0x30], ebp
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [esi], eax
test eax, eax
je 0x42a432
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x42a432
mov ebx, dword [ebx]
imul ebx, dword [edi]
xor edi, edi
test ebx, ebx
jle 0x42a41a
mov dword [esp + 0x1c], 0xff
mov eax, dword [esi + 0xc]
mov cl, byte [eax + edi*4 + 1]
mov dl, byte [eax + edi*4]
mov byte [esp + 0x15], cl
mov cl, byte [eax + edi*4 + 2]
mov al, byte [eax + edi*4 + 3]
mov byte [esp + 0x14], cl
mov ecx, 0xff
mov byte [esp + 0x16], dl
mov byte [esp + 0x17], al
cmp al, cl
jae 0x42a3e7
movzx ecx, al
movzx eax, dl
imul eax, ecx
cdq
idiv dword [esp + 0x1c]
mov dword [esi + 0x10], 1
mov byte [esp + 0x16], al
movzx eax, byte [esp + 0x15]
imul eax, ecx
cdq
idiv dword [esp + 0x1c]
mov byte [esp + 0x15], al
movzx eax, byte [esp + 0x14]
imul eax, ecx
cdq
mov ecx, 0xff
idiv ecx
mov byte [esp + 0x14], al
mov al, byte [esp + 0x17]
movzx ecx, byte [esp + 0x16]
movzx edx, al
movzx eax, byte [esp + 0x14]
shl edx, 8
or edx, ecx
movzx ecx, byte [esp + 0x15]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
mov dword [ebp + edi*4], edx
inc edi
cmp edi, ebx
jge 0x42a41a
mov ebp, dword [esp + 0x18]
jmp 0x42a37a
cmp dword [esi + 0x14], 0
jne 0x42a42d
push dword [esi + 0xc]
call fcn.00459479
and dword [esi + 0xc], 0
pop ecx
xor eax, eax
inc eax
jmp 0x42a434
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret 8
Function at 0x42bddb
Capabilities:
Print debug messages

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0042b28f
test eax, eax
jne 0x42bdfc
push 0x408588
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x42be92
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x44]
xor ebx, ebx
cmp eax, dword [esi + 0x50]
mov eax, ecx
setg bl
and eax, 1
xor ebp, ebp
cmp eax, ebx
je 0x42be2c
test ebx, ebx
je 0x42be1e
or ecx, 1
jmp 0x42be21
and ecx, 0xfffffffe
mov dword [esi + 0x44], ecx
push ebp
mov ecx, esi
call fcn.00421bfe
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 0x48]
xor ecx, ecx
test ebx, ebx
cmove eax, ecx
sub edx, dword [esi + 0x50]
test eax, eax
lea edi, [esp + 0x1c]
lea ecx, [esp + 0x10]
cmovns ecx, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ebp
cmp edx, dword [ecx]
lea eax, [esp + 0x14]
cmovge eax, ecx
mov dword [esp + 0x14], edx
mov edi, dword [eax]
cmp edi, dword [esi + 0x4c]
je 0x42be92
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x4c], edi
call fcn.0042b28f
test eax, eax
je 0x42be8a
mov ecx, dword [esi + 0x14]
push edi
cmp dword [esi + 0x58], ebp
je 0x42be85
call fcn.0042c5c0
jmp 0x42be8a
call fcn.0042c553
push ebp
mov ecx, esi
call fcn.00421bfe
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4

Function at 0x43025c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
push esi
mov esi, dword [ebx + 8]
and esi, 7
je 0x43027c
cmp dword [ebx + 8], esi
jge 0x430274
call fcn.0042fc34
mov ecx, esi
shr dword [ebx + 0xc], cl
sub dword [ebx + 8], esi
mov edx, dword [ebx + 8]
xor ecx, ecx
test edx, edx
jle 0x4302a2
mov esi, dword [ebx + 0xc]
mov al, byte [ebx + 0xc]
mov byte [esp + ecx + 0xc], al
shr esi, 8
sub edx, 8
inc ecx
mov dword [ebx + 0xc], esi
test edx, edx
jg 0x430288
mov dword [ebx + 8], edx
jmp 0x4302b8
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jb 0x4302ad
xor edx, edx
jmp 0x4302b3
movzx edx, byte [eax]
inc eax
mov dword [ebx], eax
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 4
jl 0x4302a2
mov eax, dword [esp + 0xc]
movzx ecx, byte [esp + 0xf]
movzx ebp, ah
movzx eax, al
shl ebp, 8
add ebp, eax
movzx eax, byte [esp + 0xe]
shl ecx, 8
add ecx, eax
mov eax, ebp
xor eax, 0xffff
cmp ecx, eax
je 0x4302f4
mov dword [0x4e7c74], 0x408730
xor eax, eax
jmp 0x430340
mov eax, dword [ebx]
add eax, ebp
cmp eax, dword [ebx + 4]
jbe 0x430309
mov dword [0x4e7c74], 0x408740
jmp 0x4302f0
mov eax, dword [ebx + 0x10]
add eax, ebp
cmp eax, dword [ebx + 0x18]
jbe 0x430320
mov edx, ebp
mov ecx, ebx
call fcn.0042fc64
test eax, eax
je 0x4302f0
mov esi, dword [ebx]
push edi
mov edi, dword [ebx + 0x10]
push ebp
push esi
push edi
call fcn.0045ec30
lea eax, [esi + ebp]
mov dword [ebx], eax
lea eax, [edi + ebp]
add esp, 0xc
mov dword [ebx + 0x10], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x43623b
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push esi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, esi
cdq
mov esi, eax
mov ebx, edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
push dword [ebp - 0x14]
shld eax, ecx, 0xa
push dword [ebp - 0x18]
shl ecx, 0xa
push eax
push ecx
call fcn.0046bea0
cmp edx, ebx
jl 0x436260
jg 0x436294
cmp eax, esi
jb 0x436260
pop esi
pop ebx
leave
ret

Function at 0x436298
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp dword [esp + 0xc], 0
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebx, ecx
push 0xa
lea eax, [ebx + 0x64]
lea esi, [edi + 0x24]
pop ebp
je 0x43630c
mov dword [esp + 0x1c], esi
mov edx, ebp
mov dword [esp + 0x18], ebp
mov ecx, dword [ebx + 0x6c]
sub ecx, dword [eax]
mov eax, edx
imul eax, ecx
cdq
idiv ebp
add ecx, eax
mov dword [esi], eax
mov dword [edi + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 1
mov ecx, edi
mov esi, eax
call fcn.00421bfe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
mov ecx, ebp
sub ecx, eax
call fcn.0043623b
mov edx, dword [esp + 0x18]
dec edx
mov dword [esp + 0x18], edx
lea eax, [ebx + 0x64]
lea esi, [edi + 0x24]
test edx, edx
jg 0x4362bd
mov edi, dword [esp + 0x1c]
jmp 0x436366
xor edx, edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], esi
mov ecx, dword [eax]
mov eax, dword [ebx + 0x6c]
sub eax, ecx
imul eax, edx
cdq
idiv ebp
sub ecx, dword [ebx + 0x6c]
add ecx, eax
mov dword [esi], ecx
mov dword [edi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 1
mov ecx, edi
mov esi, eax
call fcn.00421bfe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
mov ecx, ebp
sub ecx, eax
call fcn.0043623b
mov edx, dword [esp + 0x1c]
inc edx
mov dword [esp + 0x1c], edx
lea eax, [ebx + 0x64]
lea esi, [edi + 0x24]
cmp edx, ebp
jl 0x436316
mov edi, dword [esp + 0x18]
lea esi, [ebx + 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
mov ecx, ebx
movsd dword es:[edi], dword [esi]
call fcn.00421bfe
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x43c75f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x409040
push 0x80000002
mov edi, ecx
mov dword [ebp - 8], 8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43c7b4
lea eax, [ebp - 8]
push eax
push edi
push esi
push esi
push 0x409024
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x4476a3
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, edx
push edi
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0xc]
xor ebx, ebx
shl eax, 2
push ebx
push eax
mov edi, ecx
call fcn.0044aa71
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x10]
shl eax, 2
push ebx
push eax
mov ecx, edi
call fcn.0044aa71
mov eax, dword [esi + 0x2c]
mov edx, dword [esi + 8]
shl eax, 3
push ebx
push eax
mov ecx, edi
call fcn.0044aa71
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x14]
shl eax, 2
push ebx
push eax
mov ecx, edi
call fcn.0044aa71
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x18]
imul eax, eax, 0xc
push ebx
push eax
mov ecx, edi
call fcn.0044aa71
mov eax, dword [esi + 0x28]
mov edx, dword [esi + 0x1c]
shl eax, 3
push ebx
push eax
mov ecx, edi
call fcn.0044aa71
push ebx
push 0x50
mov edx, esi
mov ecx, edi
call fcn.0044aa71
add esp, 0x38
pop edi
pop esi
pop ebx
ret
push esi
mov esi, edx
push edi
movzx eax, byte [esi + 4]
mov edi, ecx
cmp eax, 8
jg 0x447712
je 0x4476f7
sub eax, 4
je 0x4476e9
dec eax
je 0x4476e2
dec eax
je 0x4476ca
dec eax
jne 0x4476df
mov eax, dword [esi + 0x10]
add eax, 0x18
jmp 0x4476d5
movzx eax, byte [esi + 6]
lea eax, [eax*4 + 0x10]
push 0
push eax
call fcn.0044aa71
pop ecx
pop ecx
pop edi
pop esi
ret
pop edi
pop esi
jmp 0x450e05
mov eax, dword [edi + 0xc]
dec dword [eax + 0x1c]
mov eax, dword [esi + 0xc]
add eax, 0x11
jmp 0x4476d5
mov edx, dword [esi + 0x1c]
mov ecx, esi
call fcn.00446ada
mov ecx, esi
call fcn.0044e83a
push 0
push 0x70
mov edx, esi
mov ecx, edi
jmp 0x4476d8
sub eax, 9
je 0x447738
dec eax
je 0x447731
sub eax, 0xa
je 0x4476ef
sub eax, 0x12
jne 0x4476df
movzx eax, byte [esi + 6]
lea eax, [eax*8 + 0x10]
jmp 0x4476d5
pop edi
pop esi
jmp fcn.00446aae
pop edi
pop esi
jmp 0x446bfd
push esi
mov esi, edx
push edi
mov edx, dword [esi + 0x10]
mov edi, ecx
cmp edx, 0x406cf8
je 0x450e2d
mov cl, byte [esi + 7]
xor eax, eax
inc eax
shl eax, cl
push 0
mov ecx, edi
imul eax, eax, 0x18
push eax
call fcn.0044aa71
pop ecx
pop ecx
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0xc]
shl eax, 3
push 0
push eax
mov ecx, edi
call fcn.0044aa71
push 0
push 0x20
mov edx, esi
mov ecx, edi
call fcn.0044aa71
add esp, 0x10
pop edi
pop esi
ret

Function at 0x4486ae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 0x208], 0
push esi
mov esi, 0x200
lea eax, [ebp - 0x200]
push edi
mov edi, edx
mov dword [ebp - 0x204], ecx
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x20c], esi
jmp 0x4486eb
cmp esi, 0x3fffffff
ja 0x4486eb
add esi, esi
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.004416aa
push edi
push esi
push 1
push eax
call fcn.0045a094
add dword [ebp - 0x208], eax
add esp, 0x10
cmp eax, esi
jae 0x4486e1
lea ecx, [ebp - 0x210]
call fcn.00441747
pop edi
pop esi
leave
ret
Function at 0x44871e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
and dword [ebp - 0x20c], 0
push esi
mov esi, edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x208], ecx
lea eax, [ebp - 0x204]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], 0x200
call fcn.004416aa
push esi
push dword [ebp + 8]
push 1
push eax
call fcn.0045a094
mov esi, eax
add dword [ebp - 0x20c], esi
add esp, 0x10
lea ecx, [ebp - 0x214]
call fcn.00441747
xor eax, eax
cmp eax, esi
sbb eax, eax
neg eax
pop esi
leave
ret

Function at 0x448a2b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ecx + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ecx + 8]
sub esi, dword [eax]
push edi
sub esi, 8
sar esi, 3
push 1
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
pop edi
sub esi, ebx
jne 0x448a65
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov edx, ebx
dec esi
call fcn.0044002b
cmp eax, 3
jne 0x448ab8
test edi, edi
je 0x448a9e
mov ecx, dword [esp + 0xc]
push 0
mov edx, ebx
call fcn.004400dd
push ecx
movsd qword [esp], xmm0
push 0x40a2d8
push dword [esp + 0x1c]
call fcn.0045af8d
add esp, 0x10
test eax, eax
jg 0x448ae6
xor edi, edi
inc ebx
test esi, esi
jne 0x448a61
test edi, edi
jne 0x448a57
mov ecx, dword [esp + 0xc]
push edi
xor edx, edx
call fcn.00441337
pop ecx
jmp 0x448a5a
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
mov edx, ebx
call fcn.004415ad
pop ecx
test edi, edi
je 0x448a9e
push dword [esp + 0x10]
push dword [esp + 0x18]
push 1
push eax
call fcn.0045b3f8
add esp, 0x10
cmp eax, dword [esp + 0x14]
jne 0x448a9e
xor edi, edi
inc edi
jmp 0x448aa0
Function at 0x4545ac
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x47d64b
call fcn.00478a94
mov eax, dword [esp + 0x18]
sub esp, 0x844
push ebx
push ebp
mov ebp, dword [esp + 0x860]
push esi
push edi
mov edi, dword [eax + ebp - 4]
xor edi, 0x12040826
mov ebx, ecx
add edi, ebp
jmp 0x4546d1
add eax, 0xfffffff0
shr eax, 1
xor edx, edx
test eax, eax
jle 0x4545fc
lea esi, [edi + 0x10]
mov cx, word [esi]
mov word [esp + edx*2 + 0x4c], cx
inc edx
lea esi, [esi + 2]
cmp edx, eax
jl 0x4545ec
cdq
sub eax, edx
sar eax, 1
xor ecx, ecx
test eax, eax
jle 0x454614
xor dword [esp + ecx*4 + 0x4c], 0x12040826
inc ecx
cmp ecx, eax
jl 0x454607
and dword [esp + 0x28], 0
xor eax, eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 7
call fcn.0041e530
and dword [esp + 0x85c], 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.00426dd1
mov esi, dword [esp + 0x10]
cmp esi, dword [ebx]
je 0x454669
lea eax, [esi + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041eb92
test al, al
je 0x4546b7
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.0041d9f3
and dword [esp + 0x48], 0
lea eax, [esp + 0x30]
push eax
mov ecx, ebx
mov byte [esp + 0x860], 1
call fcn.0042711a
push eax
add eax, 0x10
push eax
push esi
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
call fcn.0042714b
mov esi, dword [esp + 0x14]
push 0
push 1
lea ecx, [esp + 0x38]
mov dword [esp + 0x18], esi
call fcn.0041dab3
or dword [esp + 0x85c], 0xffffffff
push 0
push 1
lea ecx, [esp + 0x20]
mov dword [esi + 0x28], edi
call fcn.0041dab3
add edi, dword [edi]
mov eax, dword [edi]
test eax, eax
jne 0x4545de
mov ecx, dword [esp + 0x854]
pop edi
mov dword [ebx + 8], ebp
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
leave
ret 8