joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4098bc
Capabilities:
Check if file exists

Disassembly:
push 0x23c
mov eax, 0x44c9b6
call fcn.00411f45
mov edi, ecx
lea eax, [ebp - 0x230]
push eax
call fcn.0040961d
and dword [ebp - 4], 0
lea esi, [edi + 4]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4098ee
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x44f8d8
call fcn.00401f72
push 0x44f8dc
mov ecx, esi
call fcn.00401f72
push 0x45f85c
mov ecx, esi
call fcn.00401f72
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.00401f14
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x409943
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4099db
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00428d50
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004094f1
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x40999a
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00401f72
push 0x45f85c
mov ecx, esi
call fcn.00401f72
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.00401f14
cmp dword [esi + 0x14], 8
jb 0x4099e3
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea esi, [edi + 0x1c]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4099fb
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x44f8d8
call fcn.00401f72
push 0x44f8dc
mov ecx, esi
call fcn.00401f72
push 0x45f85c
mov ecx, esi
call fcn.00401f72
lea eax, [ebp - 0x248]
mov ecx, edi
push eax
call fcn.0040967c
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00404486
lea ecx, [ebp - 0x248]
call fcn.00401fc4
lea ecx, [ebp - 0x230]
call fcn.00401fc4
call fcn.00411eef
ret
Function at 0x40c6d7
Capabilities:
Move file

Disassembly:
push 0x4c
mov eax, 0x44cd64
call fcn.00411f45
mov esi, ecx
cmp dword [esi + 0x1c], 0xffffffff
je 0x40c6f8
push dword [esi + 0x1c]
call fcn.00437ce2
or dword [esi + 0x1c], 0xffffffff
pop ecx
mov eax, dword [esi + 0x28]
mov ecx, esi
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0040af8e
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.004340de
mov edi, dword [esi + 0x28]
sub edi, 2
pop ecx
js 0x40c77c
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0040af8e
lea eax, [edi + 1]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0040af8e
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x28]
call fcn.00401fc4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.00401fc4
sub edi, 1
jns 0x40c726
mov ecx, esi
call fcn.0040c38b
lea ecx, [ebp - 0x58]
mov byte [esi + 0x5c], 0
call fcn.00401fc4
call fcn.00411eef
ret

Function at 0x40c795
Capabilities:
Move file

Disassembly:
push 0x4c
mov eax, 0x44cd64
call fcn.00411f45
mov esi, ecx
cmp dword [esi + 0x1c], 0xffffffff
je 0x40c7b6
push dword [esi + 0x1c]
call fcn.00437ce2
or dword [esi + 0x1c], 0xffffffff
pop ecx
mov eax, dword [esi + 0x28]
mov ecx, esi
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0040af8e
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.004340de
mov edi, dword [esi + 0x28]
sub edi, 2
pop ecx
js 0x40c83a
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0040af8e
lea eax, [edi + 1]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0040af8e
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x28]
call fcn.00401fc4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.00401fc4
sub edi, 1
jns 0x40c7e4
mov ecx, esi
call fcn.0040c422
lea ecx, [ebp - 0x58]
mov byte [esi + 0x5c], 0
call fcn.00401fc4
call fcn.00411eef
ret
Function at 0x40d292
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x3c
mov eax, 0x44ce0c
call fcn.00411f45
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x40d2b5
xor al, al
jmp 0x40d375
lea edi, [ecx + 4]
cmp dword [edi + 0x10], 0
ja 0x40d2d8
lea eax, [ebp - 0x40]
push eax
call fcn.0040d93f
pop ecx
push eax
mov ecx, edi
call fcn.00403f04
lea ecx, [ebp - 0x40]
call fcn.00401fc4
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
and dword [ebp - 0x14], 0
push edi
call fcn.00401d8c
xor edi, edi
lea ecx, [ebp - 0x28]
push str.Software_
mov dword [ebp - 4], edi
call fcn.00401f72
push dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
call fcn.00401f72
test ebx, ebx
je 0x40d320
push 0x45f85c
lea ecx, [ebp - 0x28]
call fcn.00401f72
push ebx
lea ecx, [ebp - 0x28]
call fcn.00401f72
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x44]
push ecx
push 0xf003f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x44], edi
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d36b
test esi, esi
je 0x40d358
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x40d362
push edi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.00401fc4
mov al, 1
call fcn.00411eef
ret 0xc
Function at 0x40d651
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x468030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
cmp dword [esi + 0x14], ebx
ja 0x40d6a9
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d93f
pop ecx
lea ecx, [esi + 4]
push eax
call fcn.00403f04
lea ecx, [ebp - 0x1c]
call fcn.00401fc4
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x40d6b4
mov eax, dword [eax]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x20]
push ecx
push 0xf013f
push ebx
push eax
push 0x80000003
call esi
test eax, eax
je 0x40d6d7
xor al, al
jmp 0x40d790
lea eax, [ebp - 0x24]
push eax
push 0xf013f
push ebx
push 0x44fc18
push dword [ebp - 0x20]
call esi
test eax, eax
je 0x40d6fa
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d6d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x40d72c
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x20]
call esi
jmp 0x40d6d0
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40d77f
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40d751
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call esi
mov bl, 1
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411745
leave
ret 0x10
Function at 0x40d7f1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x44ce7f
call fcn.00411f11
and dword [ebp - 0x20], 0
xor eax, eax
mov ebx, dword [ebp + 8]
and dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
and dword [ebp - 4], eax
push 0x208
mov dword [ebp - 0x20], 1
call fcn.00412085
mov edx, eax
xor eax, eax
pop ecx
mov ecx, 0x82
mov dword [ebp - 0x14], edx
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, 0x20019
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x18]
push eax
push edi
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x40d8f7
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x40d8ee
cmp dword [ebp - 0x10], 0x104
jbe 0x40d8bf
push dword [ebp - 0x14]
call fcn.0041208e
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412085
mov edi, eax
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x14], edi
push eax
push esi
push edi
call fcn.00403ae8
add esp, 0x14
jmp 0x40d8c2
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov ecx, ebx
mov esi, eax
push edi
call fcn.00402171
push edi
call fcn.0041208e
mov edi, dword [ebp - 0x1c]
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
pop eax
cmp esi, eax
jne 0x40d919
cmp dword [ebp + 0xc], 0x80000002
jne 0x40d919
cmp edi, 0x20019
jne 0x40d919
mov edi, 0x20119
jmp 0x40d83e
mov eax, ebx
call fcn.00411eda
ret

Function at 0x40db08
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x468030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40db8e
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.00428d50
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40db8e
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40db83
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0043883d
pop ecx
pop ecx
test eax, eax
je 0x40db9e
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40db63
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00411745
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x228]
jmp 0x40db90
Function at 0x40f051
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 4], 0
je 0x40f081
push esi
xor esi, esi
cmp dword [edx + 0x3cc], esi
jle 0x40f080
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, ecx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
inc esi
cmp esi, dword [edx + 0x3cc]
jl 0x40f070
pop edi
pop esi
pop ebp
ret 8

Function at 0x40f2a2
Capabilities:
Encode data using base64

Disassembly:
push 0x10
mov eax, 0x44cf7b
call fcn.00411f11
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], 0xf
mov byte [eax], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 1
cmp dword [ebp + 0x10], ebx
je 0x40f42d
mov eax, dword [ebp + 0x10]
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + edi - 0x14], al
inc edi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x40f373
mov esi, dword [ebp + 8]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
cmp dword [0x468020], 0x10
mov ecx, 0x46800c
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x46800c]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.00406116
inc edi
cmp edi, 4
jl 0x40f33b
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x40f2dd
mov dword [ebp + 0x10], edi
test edi, edi
je 0x40f42a
mov eax, edi
cmp edi, esi
jge 0x40f3a9
cmp eax, esi
jae 0x40f433
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x40f391
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x40f415
mov esi, dword [ebp + 8]
mov edi, eax
cmp dword [0x468020], 0x10
mov ecx, 0x46800c
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x46800c]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.00406116
inc ebx
cmp ebx, edi
jl 0x40f3e6
mov edi, dword [ebp + 0x10]
push 3
pop esi
cmp edi, esi
jge 0x40f42a
sub esi, edi
mov ecx, dword [ebp + 8]
push 0x3d
call fcn.00406116
sub esi, 1
jne 0x40f41b
mov eax, dword [ebp + 8]
call fcn.00411eda
ret
call fcn.004121f7
int3

Function at 0x4132a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x43f26a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043ef2d

Function at 0x43f275
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043f0ae

Function at 0x441f13
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00441bd3

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x68d614be
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7c9b6859
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x404b00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448bf0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x462014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x4630d0
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00418580
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x462a88
push eax
call fcn.00418580
mov esi, dword [0x4630e0]
xor ebx, ebx
mov edi, dword [0x4630e4]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x4663d0], bl
mov eax, ebx
mov ecx, 0x4630d0
cmovae ecx, dword [0x4630d0]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x4664e0], al
inc ebx
cmp ebx, 0x100
jl 0x404b80
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x4663d0]
movzx eax, byte [esi + 0x4664e0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x404bd4
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x4663d0]
mov byte [esi + 0x4663d0], al
inc esi
mov byte [edi + 0x4663d0], dl
cmp esi, 0x100
jl 0x404bb0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00404750
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x404c29
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404c1f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404c7f
push edx
push ecx
call fcn.0041d758
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x404c6b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404c61
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404c7f
push edx
push ecx
call fcn.0041d758
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00436d27
int3
Function at 0x404c90
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x462014]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x10], esi
mov eax, dword [eax]
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], esi
push edi
test eax, eax
jne 0x404ceb
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
push 0x45815b
mov byte [esi], al
call fcn.00418580
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.0041d0e1
mov esp, ebp
pop ebp
ret
mov ecx, eax
xor edi, edi
and ecx, 3
jne 0x404d05
cmp byte [eax + edx - 1], 0x3d
je 0x404d05
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], edi
jmp 0x404d27
mov dword [esp + 0x18], 1
cmp ecx, 2
ja 0x404d1f
cmp byte [eax + edx - 2], 0x3d
jne 0x404d1f
mov dword [esp + 0x20], edi
jmp 0x404d27
mov dword [esp + 0x20], 1
sub eax, dword [esp + 0x18]
and eax, 0xfffffffc
mov dword [esp + 0x40], edi
mov ecx, eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
shr ecx, 2
push 0
mov dword [esp + 0x48], 0xf
mov byte [esp + 0x34], 0
lea eax, [eax + ecx*2]
add eax, ecx
lea ecx, [esp + 0x34]
add eax, dword [esp + 0x1c]
push eax
call fcn.00418440
cmp dword [esp + 0x44], 0x10
lea eax, [esp + 0x30]
mov edx, dword [esp + 0x14]
cmovae eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
test edx, edx
je 0x404df5
mov esi, dword [esp + 0x2c]
lea eax, [edx - 1]
shr eax, 2
add esi, 2
inc eax
mov dword [esp + 0x28], eax
nop dword [eax]
movzx eax, byte [esi - 2]
lea esi, [esi + 4]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax*4 + 0x458f48]
movzx eax, byte [esi - 5]
shl ecx, 6
or ecx, dword [eax*4 + 0x458f48]
movzx eax, byte [esi - 4]
shl ecx, 6
or ecx, dword [eax*4 + 0x458f48]
movzx eax, byte [esi - 3]
shl ecx, 6
or ecx, dword [eax*4 + 0x458f48]
mov eax, ecx
sar eax, 0x10
mov byte [edx + edi], al
mov eax, ecx
sar eax, 8
mov byte [edx + edi + 1], al
mov eax, edx
mov byte [eax + edi + 2], cl
add edi, 3
sub dword [esp + 0x28], 1
jne 0x404d90
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
cmp dword [esp + 0x18], 0
je 0x404e52
mov eax, dword [esp + 0x2c]
add eax, edx
mov dword [esp + 0x24], eax
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
mov edx, dword [eax*4 + 0x458f48]
shl edx, 6
or edx, dword [ecx*4 + 0x458f48]
mov ecx, dword [esp + 0x1c]
shl edx, 0xc
mov eax, edx
sar eax, 0x10
cmp dword [esp + 0x20], 0
mov byte [ecx + edi], al
je 0x404e52
mov eax, dword [esp + 0x24]
sar edx, 8
movzx eax, byte [eax + 2]
mov eax, dword [eax*4 + 0x458f48]
shl eax, 6
sar eax, 8
or al, dl
mov byte [ecx + edi + 1], al
movups xmm0, xmmword [esp + 0x30]
mov ecx, dword [esp + 0x5c]
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
pop edi
movq xmm0, qword [esp + 0x3c]
movq qword [esi + 0x10], xmm0
pop esi
xor ecx, esp
call fcn.0041d0e1
mov esp, ebp
pop ebp
ret
Function at 0x4054c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448d00
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x462014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x414], edi
push 0x400
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.004341e0
add esp, 0xc
mov dword [ebp - 0x414], 0x400
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x418]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405570
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push 0
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x410]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [edi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405596
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
mov ecx, edi
call fcn.00418580
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x4055de
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4055d4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40563d
push edx
push ecx
call fcn.0041d758
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x405620
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405616
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40563d
push edx
push ecx
call fcn.0041d758
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d0e1
mov esp, ebp
pop ebp
ret
call fcn.00436d27
int3