joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469a30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x559c03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.005472b3
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0xcd71e8
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0xcd7130
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x56211c]
push eax
mov ecx, edi
call fcn.0054ce11
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0054edd8
test eax, eax
je 0x469b4c
mov ecx, dword [esp + 0x3c]
call fcn.0054ce3e
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x56281c]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x469b10
push edi
mov ecx, esi
call fcn.0054a309
mov ecx, esi
call fcn.00469cf0
cmp dword [esp + 0x38], 1
jne 0x469b45
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0054a48e
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x46bd00
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x46bd33
push esi
call fcn.00479f80
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x46bd2c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x46bdb9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x46bda2
mov eax, dword [esi + 8]
test eax, eax
je 0x46bd57
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x46bd9e
cmp eax, 2
je 0x46bda2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46bd4a
cmp eax, 3
je 0x46bd7d
cmp eax, 1
jne 0x46bd4a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x46bd4a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x46bd4a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0046bde0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x46bdc8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0046bde0
add esp, 4
pop esi
ret
Function at 0x495d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55aa50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00495920
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004959a0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004959a0
lea ecx, [esi + 0xc]
call fcn.00545afb
lea ecx, [esi + 0x10]
call fcn.00545afb
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00496da0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00496da0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00496da0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00545b70
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00545b70
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4c1d80
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x55be80
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4c1f27
mov ecx, dword [0xd6d6d8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x4c1e7c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.004c0aa0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.00545ca9
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.00545b70
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xd5e48c
call fcn.00545bde
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.004c0e60
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.00545ca9
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.00545b70
lea ecx, [esp + 0xc]
call fcn.005460ab
mov ecx, dword [esp + 0xc]
push 0xd5eecc
push ecx
call fcn.00531934
add esp, 8
test eax, eax
je 0x4c1ea4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x4c1ddd
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.00545b70
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00545b70
jmp 0x4c1f2b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.004c1b20
test eax, eax
push 0
je 0x4c1f0f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.004c01c0
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x4c1ef5
cmp eax, 0x64
jg 0x4c1ee3
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [0x5624dc]
mov esi, eax
jmp 0x4c1e80
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [0x5624dc]
mov esi, eax
jmp 0x4c1e80
cmp eax, 0x64
jge 0x4c1e7c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [0x5624dc]
mov esi, eax
jmp 0x4c1e80
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.004c01c0
mov esi, eax
jmp 0x4c1e80
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x4c1f35
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x4ce4a7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55c356
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x14]
call fcn.00544611
mov eax, dword [0xd6d6d8]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x48], eax
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp ebx, edi
mov byte [esp + 0x18], 1
mov dword [esi], 0xd2d984
mov dword [esi + 4], edi
mov dword [esi + 8], ecx
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
je 0x4ce504
push ebx
call dword [0x56244c]
inc eax
push eax
call fcn.005458b1
add esp, 4
mov dword [esi + 4], eax
push ebx
push eax
call dword [0x562454]
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x4c], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4d96f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x4d98ad
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x4d9826
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x4d9826
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x4d980d
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x4d980d
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.004da960
mov ebp, eax
test ebp, ebp
je 0x4d9805
push ebp
mov ecx, esi
call fcn.004dbe10
test eax, eax
je 0x4d9805
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x4d9805
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x4d97c6
xor eax, eax
jmp 0x4d97ce
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.004dc7d0
inc ebx
xor ebp, ebp
jmp 0x4d9757
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x4d9730
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.004dac70
test eax, eax
pop ebx
je 0x4d98ad
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.004da960
mov edi, eax
cmp edi, ebp
je 0x4d98ad
push edi
mov ecx, esi
call fcn.004dbe10
test eax, eax
je 0x4d98ad
mov eax, 1
lea edx, [esi + 0x1f8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.004daeb0
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.004daf20
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.004dc7d0
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x4e3a30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x55d657
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0xd2e9a4
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.005439fd
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.005439fd
mov edi, dword [0x56278c]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0xd2e990
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [0x5626dc]
lea ecx, [esp + 0xb0]
push ecx
call dword [0x562128]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.004e4550
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x505470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55eca8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0xd6d6d8]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0xc]
push eax
push 0xd67a40
push ecx
mov byte [esp + 0x2c], 1
call fcn.00542a29
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push 0xd67a3c
push eax
call fcn.00545e79
push 0xd67a38
lea ecx, [esp + 0x30]
mov bl, 2
push eax
push ecx
mov byte [esp + 0x2c], bl
call fcn.00545e05
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call fcn.00545ca9
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], bl
call fcn.00545b70
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 1
call fcn.00545b70
mov edi, dword [esi + 0x118]
mov eax, dword [esi + 0x114]
cmp edi, eax
jge 0x5055c8
push ebp
mov ebp, dword [esp + 0x2c]
mov al, byte [esp + 0x34]
test al, al
je 0x50553c
push 1
push 0xdd2edc
jmp 0x5055af
push ebp
lea edx, [esp + 0x34]
push edi
push edx
mov ecx, esi
call fcn.005014f0
mov eax, dword [eax]
mov ebx, dword [esp + 0x10]
push eax
mov byte [esp + 0x28], 4
call fcn.00531576
push ecx
lea eax, [esp + 0x1c]
fstp qword [esp]
push ebx
push eax
call fcn.00542a29
add esp, 0x10
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 1
call fcn.00545b70
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00531576
fcomp qword [0xd30608]
add esp, 4
fnstsw ax
test ah, 0x40
je 0x5055a8
mov eax, dword [esi + 0x348]
test eax, eax
jne 0x5055b8
push 1
push 0xdd2edc
jmp 0x5055af
mov edx, dword [esp + 0x14]
push 1
push edx
push ebp
push edi
mov ecx, esi
call fcn.004fc0d0
mov eax, dword [esi + 0x114]
inc edi
cmp edi, eax
jl 0x50552b
pop ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.00545b70
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00545b70
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x50abb0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x55f308
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0054cb69
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov ecx, esi
mov dword [esp + 0x44], 0
call fcn.0050aaf0
mov ecx, dword [esi + 0x174]
mov eax, dword [esi + 0x178]
add ecx, 0x64
add eax, 0x64
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0054ca97
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x5627fc]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x50ac77
cmp dword [esp + 0x40], 1
jne 0x50ac75
cmp ecx, eax
jge 0x50ac77
mov eax, ecx
cmp eax, 0x12c
jge 0x50ac83
mov eax, 0x12c
mov ecx, esi
mov dword [esi + 0x194], eax
mov dword [esi + 0x1dc], 1
call fcn.0050acd0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x5627f8]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0054cbdb
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x514df0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xdd3064]
xor edx, edx
cmp eax, edx
jne 0x514e16
xor eax, eax
mov byte [eax + 0xdd2f64], al
inc eax
cmp eax, 0x100
jl 0x514dfe
mov dword [0xdd3064], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xdd2f64
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x514ea7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x514e7a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x514e48
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x514eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x514f03
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x514eea
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51b890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55fc4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0051c1b0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xd31eac
call fcn.005458b1
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x51b923
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005458b1
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x51b91c
push 0
mov ecx, eax
call fcn.00512a70
mov dword [esi + 0xc], eax
jmp 0x51b925
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x51b925
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x403b2f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
call fcn.00403d35
push 0x5b
push eax
mov dword [ebp - 8], eax
call fcn.00407830
mov edi, eax
xor ebx, ebx
add esp, 0xc
cmp edi, ebx
je 0x403bf0
push esi
inc edi
push 0x5d
push edi
call fcn.00407830
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x403bef
mov byte [esi], bl
inc esi
push 0x3d
push esi
call fcn.00407830
pop ecx
pop ecx
cmp eax, ebx
je 0x403bef
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push edi
push dword [section..data]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403bb4
push ebx
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403be6
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x403bdd
cmp eax, 2
je 0x403bdd
push ebx
push str.Could_not_delete_value
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.00403d35
pop ecx
pop esi
pop edi
pop ebx
leave
ret

Function at 0x403d35
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403d44
pop dword [ebp - 0x18]
mov eax, 0xaac941e6
sub eax, 0xaa8904a2
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x90b8a573
add dword [ebp - 0x28], 0xbd999fd8
mov dword [ebp - 0x24], 0xc621f4d6
add dword [ebp - 0x24], 0x6c11576f
mov dword [ebp - 0x20], 0x8929ad28
sub dword [ebp - 0x20], 0x3cdd68fa
mov dword [ebp - 0x1c], 0xaab4ec4e
add dword [ebp - 0x1c], 0x554b13b2
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xe1371a1d
add dword [ebp - 0x28], 0x933b4f39
mov dword [ebp - 0x24], 0xc1612608
sub dword [ebp - 0x24], 0x7ff4c493
mov dword [ebp - 0x20], 0x1b0f0b8d
sub dword [ebp - 0x20], 0xb79f9f21
mov dword [ebp - 0x1c], 0xcb8c630
add dword [ebp - 0x1c], 0xf34739d0
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x1d41d3d8
sub eax, 0x1cffa2b4
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3e61b
push 0
call eax
mov ecx, 0x4a05
xor ebx, ebx
add ebx, eax
mov edi, 0x58e98851
sub edi, 0x58a64451
add edi, dword [ebp - 0x18]
mov edx, 0xee338924
add edx, 0x8af86fe4
add dword [ebp - 0x14], 0x470e66ff
mov esi, dword [edi]
xor esi, edx
sub dword [ebp - 0xc], edi
mov dword [ebx], esi
add dword [ebp - 4], ecx
add ebx, 0xe23e9ac1
sub ebx, 0xe23e9abd
add edi, 4
loop 0x403e5d
add eax, 0x5f03c080
add eax, 0xa0fd5a67
xor ebx, ebx
add ebx, eax
add eax, 0x3e402dd7
sub eax, 0x3e402dd2
mov ecx, 0x371a4892
add ecx, 0xc925b76e
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x417c10
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc0
lea eax, [esp]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x1c]
mov edi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x12]
mov esi, dword [esp + 0xcc]
mov ecx, dword [esp + 0x14]
and edx, 0xffff
and eax, 0xffff
mov dword [esi], edx
mov edx, dword [esp + 0xe]
mov dword [esi + 4], eax
lea eax, [esp + 0x18]
and ecx, 0xffff
and edx, 0xffff
push eax
push edi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [esp + 0xa]
mov ecx, eax
mov eax, dword [esp + 8]
and edx, 0xffff
and eax, 0xffff
mov edi, dword [esi + 0x20]
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0xc4]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x1c]
add eax, edx
xor edx, edx
test eax, eax
setl dl
shl edx, 1
and edi, 0xfffffffd
or edx, edi
mov dword [esi + 0x20], edx
cdq
mov edi, eax
mov eax, 0x88888889
xor edi, edx
sub edi, edx
imul edi
add edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
test ecx, ecx
mov dword [esi + 0x18], edx
je 0x417cea
mov ecx, dword [0x4c6a7c]
push 0x4c676c
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [esi + 0x18]
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
mov eax, dword [esi + 0x20]
shl edx, 2
sub edi, edx
or al, 1
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov eax, esi
pop edi
pop esi
add esp, 0xc0
ret