joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e72a890
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1e7dca1b
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x1e7e4380]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0xb8], edi
call fcn.1e72a0d0
test al, al
je 0x1e72a9f4
xor eax, eax
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], eax
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], 0x80
mov byte [ebp - 4], 1
lea ecx, [ecx]
mov ebx, 8
cmp dword [ebp - 0x98], ebx
jae 0x1e72a96d
push ebx
call fcn.1e71aec0
mov esi, eax
add esp, 4
test esi, esi
jne 0x1e72a937
push 0x1e7dea9c
lea edx, [ebp - 0xb4]
push edx
mov dword [ebp - 0xb4], 0x8007000e
call sub.msvcrt.dll__CxxThrowException
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xa0]
push eax
push ecx
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x94]
add esp, 0xc
cmp eax, edx
je 0x1e72a967
push eax
call fcn.1e71aef0
add esp, 4
mov dword [ebp - 0xa0], esi
mov eax, dword [edi + 4]
lea ecx, [ebp - 0xbc]
push ecx
lea edx, [ebp - 0xc0]
push edx
mov edx, dword [ebp - 0xa0]
lea ecx, [ebp - 0xa4]
push ecx
push ebx
push edx
push eax
mov dword [ebp - 0x9c], ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x1e72a9c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1e72a9b2
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0xa8], eax
push 0x1e7dea9c
lea eax, [ebp - 0xa8]
push eax
call sub.msvcrt.dll__CxxThrowException
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa0]
cmp ecx, dword [ebp - 0x9c]
jae 0x1e72aa10
lea edx, [ebp - 0x94]
mov byte [ebp - 4], 0
cmp eax, edx
je 0x1e72a9f4
push eax
call fcn.1e71aef0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1e72b65d
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.1e7270b0
mov eax, dword [ebp - 0x9c]
cmp eax, ebx
jae 0x1e72aa44
push 0x1e7dea9c
lea edx, [ebp - 0xb0]
push edx
mov dword [ebp - 0xb0], 0x80004005
call sub.msvcrt.dll__CxxThrowException
xor esi, esi
mov ecx, dword [ebp - 0xa0]
cmp esi, eax
jae 0x1e72aaa6
mov edx, dword [edi + 4]
push 0
lea ebx, [ebp - 0xa4]
push ebx
sub eax, esi
push eax
add ecx, esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1e72aa98
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1e72aa81
and eax, 0xffff
or eax, 0x80070000
push 0x1e7dea9c
lea edx, [ebp - 0xac]
push edx
mov dword [ebp - 0xac], eax
call sub.msvcrt.dll__CxxThrowException
add esi, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x9c]
jmp 0x1e72aa46
mov eax, dword [edi]
mov edx, dword [eax]
push ecx
mov ecx, edi
call edx
jmp 0x1e72a900
Function at 0x1e72ac50
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x1e6f24d8
xor esi, esi
push 0x80000002
mov dword [0x1e7e6f3c], 7
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1e72ace4
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push esi
push 0x1e6f9c18
mov edi, 4
push ecx
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1e72acda
cmp dword [ebp - 0xc], edi
jne 0x1e72acda
mov eax, dword [ebp - 0x10]
cmp eax, esi
jbe 0x1e72acda
cmp eax, 7
mov dword [0x1e7e6f3c], eax
jle 0x1e72accb
mov dword [0x1e7e6f3c], 7
jmp 0x1e72acda
cmp eax, 6
jge 0x1e72acda
mov dword [0x1e7e6f3c], 6
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x1e72a4c0
mov dword [eax + 4], 0x1e72ab30
mov dword [eax + 8], esi
mov dword [eax + 0xc], 0x1e72abe0
mov dword [eax + 0x54], 0x1e729460
mov dword [eax + 0x5c], 0x1e727250
mov dword [eax + 0x58], 0x1e7271d0
mov dword [eax + 0x60], 0x1e727570
mov ecx, dword [0x1e7e6f3c]
dec ecx
cmp ecx, 6
ja case.default.0x1e72ad2a
jmp dword [ecx*4 + 0x1e72add4]
mov dword [eax + 0x4c], 0x1e723ec0
mov dword [eax + 0x50], 0x1e72a6a0
mov dword [eax + 0x44], 0x1e723e90
mov dword [eax + 0x48], 0x1e729900
mov dword [eax + 0x40], esi
mov dword [eax + 0x34], esi
mov dword [eax + 0x38], esi
mov dword [eax + 0x3c], esi
mov dword [eax + 0x30], esi
mov dword [eax + 0x2c], 0x1e729340
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], 0x1e7293a0
mov dword [eax + 0x1c], 0x1e72aba0
mov dword [eax + 0x20], esi
mov dword [eax + 0x24], 0x1e729410
mov eax, dword [0x1e7e6f3c]
push eax
push esi
call fcn.1e724130
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.1e727650
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [0x1e7e6f3c]
push eax
call fcn.1e723f10
add esp, 0x10
call fcn.1e7275c0
mov edi, dword [ebp + 8]
mov ecx, 0x35
mov esi, 0x1e7e6e68
rep movsd dword es:[edi], dword [esi]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1e72c930
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x1e6f24d8
push 0x80000002
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1e72c996
mov edx, dword [ebp + 0x10]
push esi
lea ecx, [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1e72c996
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1e72c996
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1e72eca0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1e7defd0
push 0x1e72b672
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x1e7e4380]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0x1c]
push eax
push 0x1e6f24d8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x1e72ed4f
mov esi, 4
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x24]
push eax
push edi
push 0x1e6fad2c
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1e72ed45
cmp dword [ebp - 0x24], esi
jne 0x1e72ed45
cmp dword [ebp - 0x28], edi
je 0x1e72ed45
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1e7e5930], edi
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1e7e5930], edi
jge 0x1e72edac
mov dword [0x1e7e5930], edi
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x4c], di
jne 0x1e72edac
cmp word [ebp - 0x2c], 5
jb 0x1e72edac
mov dword [ebp - 4], edi
call fcn.1e72ec70
test eax, eax
je 0x1e72eda5
emms
mov dword [0x1e7e5930], 1
jmp 0x1e72eda5
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1e7e5930]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1e72eff0
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1e7e4380]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x9c
xor esi, esi
lea eax, [ebp - 0xa0]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xa0]
push ecx
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1e72f08e
cmp dword [ebp - 0x90], 2
jne 0x1e72f077
cmp dword [ebp - 0x9c], 5
jne 0x1e72f094
cmp dword [ebp - 0x98], esi
jne 0x1e72f094
mov dword [0x1e7e5934], esi
cmp word [ebp - 0xc], si
je 0x1e72f094
mov dword [0x1e7e890c], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1e72b65d
mov esp, ebp
pop ebp
ret
push 0x162
push 0x1e6fad78
push 0x1e6fad48
call sym.d3d8.dll_DebugSetMute
add esp, 0xc
mov dword [0x1e7e5934], esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1e72b65d
mov esp, ebp
pop ebp
ret
Function at 0x1e72f0b0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1e7e4380]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x102
push eax
lea ecx, [ebp - 0x106]
push ecx
mov word [ebp - 0x108], ax
call sub.msvcrt.dll_memset
xor edx, edx
push 0x102
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call sub.msvcrt.dll_memset
add esp, 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1e72f122
sub eax, edx
add eax, 0xffffffff
js 0x1e72f140
mov cl, 0x5c
cmp byte [ebp + eax - 0x108], cl
je 0x1e72f140
sub eax, 1
jns 0x1e72f132
lea edx, [ebp + eax - 0x107]
lea eax, [ebp - 0x20c]
mov ecx, eax
push esi
mov esi, 0x104
sub edx, ecx
jmp 0x1e72f160
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x1e72f17b
mov cl, byte [edx + eax]
test cl, cl
je 0x1e72f17b
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x1e72f160
jmp 0x1e72f17f
test esi, esi
jne 0x1e72f180
dec eax
lea edx, [ebp - 0x210]
push edx
push 0x1e6fadc0
push 0x80000002
mov byte [eax], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
pop esi
test eax, eax
jne 0x1e72f1dd
lea eax, [ebp - 0x20c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1e72f1a8
mov ecx, dword [ebp - 0x210]
sub eax, edx
inc eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0x1e6fadb8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1e72b65d
mov esp, ebp
pop ebp
ret
Function at 0x1e760340
Capabilities:
Check for time delay via gettickcount
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x1e7e4380]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x1a4], 0xffffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x1e760370
call edi
mov dword [esi + 0x1a4], eax
inc dword [esi + 0x1a0]
cmp dword [esi + 0x1a0], 0x78
jb 0x1e7603f8
call edi
mov ecx, eax
sub ecx, dword [esi + 0x1a4]
cmp ecx, 0x7d0
jb 0x1e7603f8
mov eax, dword [esi + 0x1a0]
imul eax, eax, 0x2710
xor edx, edx
div ecx
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
push ecx
mov ecx, dword [esi + 0xc]
push edx
mov edx, dword [ecx + 0x1f0]
push edx
push 0x1e7026c4
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.1e71e880
add esp, 0x18
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call edi
mov dword [esi + 0x1a4], eax
mov dword [esi + 0x1a0], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1e72b65d
mov esp, ebp
pop ebp
ret
Function at 0x1e760670
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
mov ecx, esi
call fcn.1e75cbd0
xor edi, edi
push 0xd8
lea ebx, [esi + 0x8c]
push edi
push ebx
mov dword [esi], 0x1e702790
mov dword [esi + 0x1c], 0x1e70277c
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x198], edi
mov dword [esi + 0x1a0], edi
mov dword [esi + 0x1a4], 0xffffffff
call sub.msvcrt.dll_memset
mov edx, dword [esi + 0xc]
mov eax, dword [edx + 0x208]
add esp, 0xc
lea ecx, [ebp + 0xc]
push ecx
push 0x1e6f24d8
mov dword [ebx], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x80000002
mov dword [esi + 0xc8], 0xcc0020
mov dword [esi + 0x160], 0x80004005
call ebx
test eax, eax
jne 0x1e76079c
lea edx, [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push edi
push 0x1e70276c
push edx
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1e76075f
cmp dword [ebp - 4], edi
je 0x1e76075f
or dword [esi + 0x198], 1
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push edi
push 0x1e702760
push eax
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1e760792
cmp dword [ebp - 4], edi
je 0x1e760792
or dword [esi + 0x198], 2
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp + 0xc]
push edx
push 0x1e702740
push 0x80000002
mov dword [esi + 0x19c], edi
call ebx
test eax, eax
jne 0x1e7607f0
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push edi
push 0x1e70272c
push eax
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1e7607e6
mov ecx, dword [ebp - 8]
mov dword [esi + 0x19c], ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1e776410
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, 0x9e3779b9
xor esi, esi
push edi
mov dword [ebp - 4], eax
mov edi, ecx
cmp eax, 0xc
jb 0x1e7764bc
mov eax, 0xaaaaaaab
mul dword [ebp + 8]
shr edx, 3
mov edi, edi
add esi, dword [ebx + 8]
add ecx, dword [ebx + 4]
mov eax, dword [ebx]
sub eax, esi
sub eax, ecx
add eax, edi
sub ecx, esi
mov edi, esi
shr edi, 0xd
xor eax, edi
sub ecx, eax
mov edi, eax
shl edi, 8
xor ecx, edi
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 0xd
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 0xc
xor eax, edi
sub ecx, esi
sub ecx, eax
mov edi, eax
shl edi, 0x10
xor ecx, edi
sub dword [ebp - 4], 0xc
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 5
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 3
xor eax, edi
sub ecx, esi
mov edi, eax
shl eax, 0xa
sub ecx, edi
xor ecx, eax
sub esi, ecx
mov eax, ecx
sub esi, edi
shr eax, 0xf
xor esi, eax
add ebx, 0xc
sub edx, 1
jne 0x1e776440
mov eax, dword [ebp + 8]
add esi, eax
mov eax, dword [ebp - 4]
dec eax
cmp eax, 0xa
ja case.default.0x1e7764c7
jmp dword [eax*4 + 0x1e776594]
movzx edx, byte [ebx + 0xa]
shl edx, 0x18
add esi, edx
movzx eax, byte [ebx + 9]
shl eax, 0x10
add esi, eax
movzx edx, byte [ebx + 8]
shl edx, 8
add esi, edx
movzx eax, byte [ebx + 7]
shl eax, 0x18
add ecx, eax
movzx edx, byte [ebx + 6]
shl edx, 0x10
add ecx, edx
movzx eax, byte [ebx + 5]
shl eax, 8
add ecx, eax
movzx edx, byte [ebx + 4]
add ecx, edx
movzx eax, byte [ebx + 3]
shl eax, 0x18
add edi, eax
movzx edx, byte [ebx + 2]
shl edx, 0x10
add edi, edx
movzx eax, byte [ebx + 1]
shl eax, 8
add edi, eax
movzx edx, byte [ebx]
add edi, edx
sub edi, esi
sub edi, ecx
sub ecx, esi
mov eax, esi
shr eax, 0xd
xor edi, eax
sub ecx, edi
mov edx, edi
shl edx, 8
xor ecx, edx
sub esi, ecx
sub esi, edi
mov eax, ecx
shr eax, 0xd
xor esi, eax
sub edi, esi
sub edi, ecx
mov edx, esi
shr edx, 0xc
xor edi, edx
sub ecx, esi
sub ecx, edi
mov eax, edi
shl eax, 0x10
xor ecx, eax
sub esi, ecx
sub esi, edi
mov edx, ecx
shr edx, 5
xor esi, edx
mov eax, esi
sub edi, eax
sub edi, ecx
mov edx, eax
shr edx, 3
xor edi, edx
sub ecx, eax
sub ecx, edi
mov edx, edi
shl edx, 0xa
xor ecx, edx
sub eax, ecx
sub eax, edi
pop edi
shr ecx, 0xf
pop esi
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1e77f820
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
push 0x1e6f24d8
push 0x80000002
mov dword [ebp - 4], 4
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1e77f88b
push esi
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1e77f88b
cmp dword [ebp - 0xc], 4
jne 0x1e77f88b
cmp dword [ebp - 4], 4
mov eax, dword [ebp - 8]
je 0x1e77f88d
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1e7a3f90
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
push edi
cmp eax, dword [esi + 0x28]
jne 0x1e7a3fa8
inc dword [esi + 0x2c]
mov edi, dword [ebp + 8]
test dword [edi + 0x12fa8], 0x200000
je 0x1e7a3fcc
mov ebx, dword [edi + 0x13810]
cmp ebx, 0xffffffff
je 0x1e7a3fcc
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
jmp 0x1e7a3fe6
mov edx, dword [edi + 0x11c1c]
mov ecx, dword [edi + 0x11c18]
mov ebx, dword [edi + 0x12fa4]
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x18]
jl 0x1e7a4143
jg 0x1e7a4000
cmp ecx, dword [esi + 8]
jb 0x1e7a4143
cmp eax, dword [esi + 0x14]
jg 0x1e7a4143
jl 0x1e7a4014
cmp ecx, dword [esi + 0x10]
jae 0x1e7a4143
mov dword [ebp + 8], 0x12345605
cmp dword [esi + 0x20], edx
je 0x1e7a4027
mov dword [ebp + 8], 0x92345605
mov dword [esi + 0x350], edx
mov eax, dword [edi + 0x11b58]
cmp eax, edx
je 0x1e7a4072
jmp 0x1e7a4040
mov ecx, dword [esi + 0x350]
mov edx, dword [eax + 0xc]
mov dword [esi + ecx*8 + 0x30], edx
mov ecx, dword [esi + 0x350]
mov edx, dword [eax + 0x20]
mov dword [esi + ecx*8 + 0x34], edx
inc dword [esi + 0x350]
cmp dword [esi + 0x350], 0x64
jae 0x1e7a4070
mov eax, dword [eax + 0x58]
test eax, eax
jne 0x1e7a4040
xor edx, edx
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x12fa4]
mov dword [ebp - 0x38], eax
mov eax, dword [edi + 0x12fc0]
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 0x12fa8]
mov dword [ebp - 0x30], ecx
mov ecx, dword [edi + 0x12fc4]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x12fb8]
mov dword [ebp - 0x28], ecx
mov ecx, dword [edi + 0x12fbc]
mov dword [ebp - 0x10], edx
mov edx, dword [esi]
push edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 4]
push 0x30
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [esi + 0x350]
lea eax, [ebp - 0x38]
push 1
push eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xc], ecx
call sub.msvcrt.dll_fwrite
mov ecx, dword [esi]
mov edx, dword [esi + 0x350]
push ecx
push edx
lea eax, [esi + 0x30]
push 8
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x20
cmp dword [esi + 0x20], 0
jne 0x1e7a4136
test dword [edi + 0x12fbc], 0x80000
jne 0x1e7a4118
mov ecx, dword [esi]
mov edx, dword [edi + 0x12fcc]
push ecx
push ebx
push 2
push edx
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov ecx, dword [edi + 0x12fc0]
mov eax, dword [esi]
imul ecx, ebx
mov edx, dword [edi + 0x12fc8]
push eax
push ecx
push 1
push edx
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov eax, dword [esi]
push eax
call sub.msvcrt.dll_fflush
add esp, 4
xor edx, edx
add dword [esi + 0x18], ebx
pop edi
adc dword [esi + 0x1c], edx
inc dword [esi + 0x24]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1e7f5540
Capabilities:
Encode data using xor

Disassembly:
call 0x1e7f54b9
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1e7f54e9
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1e7f5505
xor edx, 0
jmp 0x1e7f5510
xor edx, edx
jmp 0x1e7f5527
jmp 0x1e7f5533
xor eax, eax
push 0x8427d7c0
call 0x1e7f5540
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1e7f557c
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1e7f5555
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1e7f5593
add eax, 0
jno 0x1e7f5598
add esi, 0
ret 0x10

Function at 0x1e7f6301
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x1e7f6323
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x1e7f64c5
cmp edi, dword [ebp + 0x10]
jb 0x1e7f64c5
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.1e7f5ded
inc edi
jmp 0x1e7f63ac
jmp 0x1e7f63b9
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1e7f5ded
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1e7f5ded
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x1e7f640d
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x1e7f63f1
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.1e7f643b
add dword [eax], 0x39
jle 0x1e7f6417
sub al, 0xf5
mov ch, al
call fcn.1e7f6450
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10