joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cf68
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45cfa0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45cf81
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45cf90
or bl, 4
test esi, 0x20000000
je 0x45cf9b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x463648
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x46365a
add esp, 0xfffffff0
call fcn.0040362c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a6ec
mov eax, dword [0x47a218]
mov dword [eax + 4], ebx
mov dword [eax], 0x4639ec
mov eax, dword [0x47a228]
mov dword [eax + 4], ebx
mov dword [eax], 0x4639f8
mov eax, ebx
call fcn.00463a04
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411ff0]
call fcn.004032d8
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411ff0]
call fcn.004032d8
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411ff0]
call fcn.004032d8
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411ff0]
call fcn.004032d8
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411ff0]
call fcn.004032d8
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45fe20
push eax
push 0
push 0
mov eax, dword [0x47a388]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41c190]
call fcn.0041d904
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41c190]
call fcn.0041d904
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41c190]
call fcn.0041d904
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00463e24
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x463d00
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x463d00
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x463d00
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x463797
call fcn.00403684
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x463ae4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x463c8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x463c70
mov dl, 1
mov eax, dword [0x41240c]
call fcn.004032d8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004040dc
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x463c5f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004515f8
test al, al
je 0x463c52
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x463ca0
lea eax, [ebp - 0x254]
call fcn.004091b8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x463c52
xor eax, eax
push ebp
push 0x463c4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x463cd8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x463c34
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040434c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x463c34
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040434c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463c52
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x463b55
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416314
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463c96
lea eax, [ebp - 0x260]
call fcn.004040dc
ret

Function at 0x4645c4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x47bbec]
cmp byte [eax + 0xa5], 0
jne 0x464635
cmp dword [0x47bc04], 0
jne 0x4645f6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x464580
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x47bc04], eax
cmp dword [0x47bc00], 0
jne 0x464611
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x47bc00], eax
cmp dword [0x47bc08], 0
jne 0x464635
push esp
push 0
push 0
push 0x464524
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x47bc08], eax
pop edx
ret
Function at 0x46472c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x464743
add esp, 0xfffffff0
call fcn.0040362c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a6ec
mov eax, dword [0x47a374]
cmp word [eax + 2], 0
jne 0x46476b
mov eax, dword [0x47a374]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00465eac
mov eax, dword [0x47a424]
cmp word [eax + 2], 0
jne 0x464785
mov eax, dword [0x47a424]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004660a4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411ff0]
call fcn.004032d8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411ff0]
call fcn.004032d8
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41cc70]
call fcn.004242ac
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x46490c
mov eax, dword [0x47a288]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042467c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x466654
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x47a288]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ca08
test eax, eax
je 0x46487a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408bac
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ca30
test eax, eax
je 0x46488e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040434c
mov eax, dword [0x47a15c]
cmp byte [eax], 0
jne 0x4648c2
mov eax, ebx
call fcn.00464a34
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00466830
mov eax, ebx
call fcn.004671f4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x464902
call fcn.00403684
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464cb4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47bbec]
cmp dword [eax + 0x30], 0
je 0x464d5e
cmp dword [ebx + 0x94], 0
jne 0x464d58
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x464c44
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x464d58
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x464d1e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x464d58
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004143b4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x464d2d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4658c0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4658f5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004041cc
jmp 0x465902
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404130
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x466a0c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x466a4d
mov eax, esi
call fcn.0044cb9c
test al, al
je 0x466a4d
mov eax, dword [ebx + 0x84]
call fcn.0044c898
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x466a4d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044c898
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x471074
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x47109b
push 0
push 0
mov dx, 4
mov eax, ebx
call fcn.004706dc
cmp dword [ebx + 0x38], 0xffffffff
jne 0x4710b0
push 0xffffffffffffffff
push 0xffffffffffffffe8
mov dx, 0x18
mov eax, ebx
call fcn.004706dc
mov eax, dword [esi]
push eax
mov edx, edi
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.00471030
mov eax, dword [esi]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x4710e8
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x4710e8
xor eax, eax
jmp 0x4710ea
mov al, 1
test al, al
jne 0x471102
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov dx, 2
mov eax, ebx
call fcn.004706dc
mov cl, 1
mov dl, 6
mov eax, ebx
call fcn.00474084
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x471230
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x471257
push 0
push 0
mov dx, 4
mov eax, ebx
call fcn.004706dc
mov eax, dword [esi]
mov byte [eax + 0x14], 1
cmp dword [ebx + 0x38], 0xffffffff
jne 0x471272
push 0xffffffffffffffff
push 0xffffffffffffffe8
mov dx, 0x18
mov eax, ebx
call fcn.004706dc
mov eax, dword [esi]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x47129b
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x47129b
xor eax, eax
jmp 0x47129d
mov al, 1
test al, al
jne 0x4712b5
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov dx, 3
mov eax, ebx
call fcn.004706dc
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x474d74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov edi, eax
xor eax, eax
push ebp
push 0x474ea8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x474eb8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0x474e8d
mov dl, 1
mov eax, dword [0x41240c]
call fcn.004032d8
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x474e86
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0x14], pe_nt_image_headers32
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00404728
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.00404728
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040459c
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040459c
push eax
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
test ebx, ebx
jne 0x474e46
mov edx, dword [ebp - 0x14]
dec edx
lea eax, [ebp - 0xc]
call fcn.00404728
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
jmp 0x474e4e
cmp ebx, 0x103
jne 0x474e52
test ebx, ebx
je 0x474dd8
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x90]
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474e8d
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x1c]
call fcn.00403308
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474eaf
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404100
ret
Function at 0x4050e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
test eax, eax
jne 0x4050fa
push edi
call fcn.00404d50
mov eax, dword [edi + 4]
add esp, 4
cmp eax, 1
jne 0x405114
push dword [ebp + 0x10]
lea eax, [edi + 8]
push dword [ebp + 0xc]
push eax
call fcn.00405560
add esp, 0xc
pop edi
pop ebp
ret
cmp eax, 2
jne 0x40514d
push dword [edi]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004684c4
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jae 0x40514d
push edi
call fcn.00404d00
push str.Disabled_writing_session_log_due_to_error_while_writing
push dword [edi + 0x18]
mov dword [edi + 4], 3
call fcn.0043dc60
add esp, 0xc
pop edi
pop ebp
ret

Function at 0x4053c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4b97e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
mov edi, dword [ebp + 0xc]
nop dword [eax + eax]
mov cl, byte [edx + esi]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x4053f2
movsx eax, cl
sub eax, 0x41
jmp 0x405434
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x405401
movsx eax, cl
sub eax, 0x47
jmp 0x405434
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x405410
movsx eax, cl
add eax, 4
jmp 0x405434
cmp cl, 0x2b
jne 0x40541c
mov eax, 0x3e
jmp 0x405434
cmp cl, 0x2f
jne 0x405428
mov eax, 0x3f
jmp 0x405434
cmp cl, 0x3d
jne 0x4054b1
or eax, 0xffffffff
mov dword [ebp + edx*4 - 0x14], eax
inc edx
cmp edx, 4
jl 0x4053e0
mov edx, dword [ebp - 0x14]
cmp edx, 0xffffffff
je 0x4054b1
mov esi, dword [ebp - 0x10]
cmp esi, 0xffffffff
je 0x4054b1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp ecx, 0xffffffff
jne 0x405462
cmp eax, ecx
jne 0x4054b1
lea ebx, [ecx + 2]
jmp 0x40546d
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
add ebx, 2
shl edx, 6
and ecx, 0x3f
or edx, esi
and eax, 0x3f
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
mov eax, edx
shr eax, 0x10
mov byte [edi], al
cmp ebx, 1
jbe 0x405496
mov ecx, edx
shr ecx, 8
mov byte [edi + 1], cl
cmp ebx, 2
jbe 0x40549e
mov byte [edi + 2], dl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449391
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449391
mov esp, ebp
pop ebp
ret

Function at 0x406200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
je 0x406235
push ebx
mov ebx, dword [ebp + 0xc]
sub ebx, eax
nop word [eax + eax]
movzx edx, byte [ebx + eax]
lea eax, [eax + 1]
movzx ecx, byte [eax - 1]
xor edx, ecx
or edi, edx
sub esi, 1
jne 0x406220
pop ebx
mov eax, pe_nt_image_headers32
sub eax, edi
pop edi
shr eax, 8
pop esi
pop ebp
ret
Function at 0x40a510
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0x34
push dword [ebp + 8]
call fcn.00403120
add esp, 8
cmp byte [eax], 0
je 0x40a52e
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00405a10
push 0x35
push dword [ebp + 8]
call fcn.004030c0
add esp, 8
test eax, eax
je 0x40a545
pop ebp
jmp fcn.0043f990
xor eax, eax
pop ebp
ret

Function at 0x40a810
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0043df30
add esp, 8
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.00446300
Function at 0x41e5b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4b97e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x40], edi
movups xmm0, xmmword [edi + 0x3c8]
movups xmmword [ebp - 0x34], xmm0
test ebx, ebx
jle 0x41e715
dec ebx
add edx, 3
shr ebx, 4
inc ebx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ebx
push esi
movzx ecx, byte [edx - 3]
lea esi, [edx - 1]
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], ecx
movzx ecx, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 6]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ecx
movzx ecx, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xa]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
movzx ecx, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
call fcn.0041e590
add esp, 8
xor edi, edi
mov edx, dword [ebp + edi - 0x34]
lea esi, [esi + 4]
mov ebx, dword [ebp + edi - 0x14]
mov ecx, edx
shr ecx, 0x18
mov eax, ebx
shr eax, 0x18
xor cl, al
mov eax, ebx
mov byte [esi - 6], cl
mov ecx, edx
shr ecx, 0x10
shr eax, 0x10
xor cl, al
mov eax, ebx
mov byte [esi - 5], cl
mov ecx, edx
shr eax, 8
xor dl, bl
shr ecx, 8
xor cl, al
mov byte [esi - 3], dl
mov eax, dword [ebp + edi - 0x24]
mov dword [ebp + edi - 0x34], eax
add edi, 4
mov byte [esi - 4], cl
cmp edi, 0x10
jl 0x41e694
mov edx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x40]
add edx, 0x10
sub dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], edx
jne 0x41e5f0
movups xmm0, xmmword [ebp - 0x34]
mov eax, edi
pop esi
pop edi
pop ebx
movups xmmword [eax + 0x3c8], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449391
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
movups xmmword [edi + 0x3c8], xmm0
pop edi
xor ecx, ebp
pop ebx
call fcn.00449391
mov esp, ebp
pop ebp
ret
Function at 0x41f3c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4b97e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
movups xmm0, xmmword [ebx + 0x3c8]
mov edi, dword [ebp + 0xc]
movups xmmword [ebp - 0x14], xmm0
test edi, edi
jle 0x41f51d
mov edx, dword [ebp - 8]
dec edi
shr edi, 4
add esi, 2
inc edi
nop word [eax + eax]
movzx ecx, byte [esi - 2]
movzx eax, byte [esi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 3]
xor dword [ebp - 0x14], ecx
movzx ecx, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 7]
xor dword [ebp - 0x10], ecx
movzx ecx, byte [esi + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xb]
xor dword [ebp - 0xc], ecx
movzx ecx, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xd]
shl ecx, 8
or ecx, eax
lea eax, [ebp - 0x14]
push eax
xor edx, ecx
push ebx
mov dword [ebp - 8], edx
call fcn.0041f3a0
mov ecx, dword [ebp - 0x14]
add esp, 8
mov eax, ecx
mov byte [esi + 1], cl
shr eax, 0x18
mov byte [esi - 2], al
mov eax, ecx
shr eax, 0x10
mov byte [esi - 1], al
mov eax, ecx
mov ecx, dword [ebp - 0x10]
shr eax, 8
mov byte [esi], al
mov eax, ecx
shr eax, 0x18
mov byte [esi + 2], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 3], al
mov eax, ecx
shr eax, 8
mov byte [esi + 4], al
mov byte [esi + 5], cl
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shr eax, 0x18
mov byte [esi + 6], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 7], al
mov eax, ecx
shr eax, 8
mov edx, dword [ebp - 8]
lea esi, [esi + 0x10]
mov byte [esi - 8], al
mov eax, edx
shr eax, 0x18
mov byte [esi - 6], al
mov eax, edx
shr eax, 0x10
mov byte [esi - 5], al
mov eax, edx
shr eax, 8
mov byte [esi - 7], cl
mov byte [esi - 4], al
mov byte [esi - 3], dl
sub edi, 1
jne 0x41f400
movups xmm0, xmmword [ebp - 0x14]
mov ecx, dword [ebp - 4]
pop edi
pop esi
movups xmmword [ebx + 0x3c8], xmm0
xor ecx, ebp
pop ebx
call fcn.00449391
mov esp, ebp
pop ebp
ret
Function at 0x420610
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
lea edx, [eax + 2]
mov cl, byte [eax + 1]
mov bh, byte [eax]
mov dword [ebp - 8], edx
mov byte [ebp - 1], cl
cmp dword [ebp + 0x10], edi
jle 0x420672
mov al, cl
push esi
inc bh
movzx esi, bh
add esi, edx
mov bl, byte [esi]
add al, bl
movzx ecx, al
add edx, ecx
movzx ecx, byte [edx]
mov byte [esi], cl
mov byte [edx], bl
movzx edx, byte [esi]
mov esi, dword [ebp + 0xc]
movzx ecx, bl
add edx, ecx
movzx ecx, dl
mov edx, dword [ebp - 8]
movzx ecx, byte [ecx + edx]
xor byte [edi + esi], cl
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x420633
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 1]
pop esi
pop edi
mov byte [eax], bh
mov byte [eax + 1], cl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4206f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4b97e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
push edi
lea ebx, [eax + 2]
mov word [eax], 0
mov edi, ebx
mov dword [ebp - 0x108], ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x104]
sub edi, eax
mov eax, ecx
lea esi, [ebp - 0x104]
xor edx, edx
add esi, ecx
div dword [ebp + 0x10]
mov byte [edi + esi], cl
inc ecx
mov al, byte [edx + ebx]
mov byte [esi], al
cmp ecx, 0x100
jb 0x420726
mov esi, dword [ebp - 0x108]
lea ebx, [ebp - 0x104]
xor edi, edi
mov dword [ebp - 0x10c], pe_nt_image_headers32
sub ebx, esi
mov dl, byte [esi]
lea esi, [esi + 1]
movzx eax, byte [ebx + esi - 1]
add eax, edi
movzx ecx, dl
add ecx, eax
sub dword [ebp - 0x10c], 1
movzx edi, cl
mov ecx, dword [ebp - 0x108]
mov al, byte [edi + ecx]
mov byte [esi - 1], al
mov byte [edi + ecx], dl
jne 0x420760
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449391
mov esp, ebp
pop ebp
ret