joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ea22
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1009eb07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x100ae5ec
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.0048b65c
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.0048b65c
mov edi, dword [0x100a14d8]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0x100ae5d8
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [0x100a15d8]
lea ecx, [esp + 0xb0]
push ecx
call dword [0x100a111c]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.0046f542
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x471272
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009eea0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00470e22
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00470ea2
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00470ea2
lea ecx, [esi + 0xc]
call fcn.0048d5b2
lea ecx, [esi + 0x10]
call fcn.0048d5b2
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00472432
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00472432
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00472432
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0048d627
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0048d627
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x509afb
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x509b24
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 8], eax
jae 0x509b5c
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ecx + 0xc]
jb 0x509b51
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 0x10], ecx
jae 0x509b51
mov eax, dword [ebp - 4]
jmp 0x509b5e
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0x509b1b
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x509bab
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x18], 0
je 0x509be0
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [ebp + 0x18], 0
jne 0x509bf7
mov dword [ebp - 0x14], 0xc000000d
jmp 0x509d44
mov ecx, dword [ebp + 8]
and ecx, 0xfffffffe
je 0x509c10
mov dword [ebp - 0x14], 0xc000000d
jmp 0x509d44
cmp dword [ebp + 0xc], 0
je 0x509c1c
cmp dword [ebp + 0xc], 0xffffffff
jne 0x509c2d
mov dword [ebp - 0x14], 0xc000000d
jmp 0x509d44
mov edx, dword [ebp + 8]
and edx, 1
sete al
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x509c60
cmp dword [ebp + 0x14], 0
ja 0x509c60
jb 0x509c4f
cmp dword [ebp + 0x10], 0x40
jae 0x509c60
mov dword [ebp - 0x14], 0xc000007b
jmp 0x509d44
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x509c7e
mov dword [ebp - 0x14], 0xc000007b
jmp 0x509d44
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
movzx eax, byte [ebp - 1]
test eax, eax
je 0x509cdd
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x14]
ja 0x509cd2
jb 0x509cac
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0x10]
jae 0x509cd2
cmp dword [ebp - 0x10], 0xffffffe7
jae 0x509cd2
mov edx, dword [ebp - 0x10]
add edx, 0x18
xor eax, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp + 0x14]
jb 0x509cdd
ja 0x509cd2
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp + 0x10]
jb 0x509cdd
mov dword [ebp - 0x14], 0xc000007b
jmp 0x509d44
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [0x13050]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx]
jae 0x509d27
mov eax, dword [0x13050]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
jb 0x509d0a
mov dword [ebp - 0x14], 0xc000007b
jmp 0x509d44
mov edx, dword [ebp - 8]
add edx, 0xf8
mov eax, dword [0x13050]
cmp edx, dword [eax]
jb 0x509d27
mov dword [ebp - 0x14], 0xc000007b
jmp 0x509d44
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x509d3d
mov dword [ebp - 0x14], 0xc000007b
jmp 0x509d44
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jl 0x509d52
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4013d1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1c4]
sub esp, 0x244
mov eax, dword [0x45e56c]
push esi
push edi
mov edi, ecx
mov dword [ebp + 0x1c0], eax
mov eax, dword [edi + 4]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x54], edi
je 0x4015a0
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push esi
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
mov dword [ebp - 0x58], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4015a0
push ebx
mov dword [ebp - 0x50], esi
push 0x104
lea eax, [ebp + 0xbc]
push eax
push dword [ebp - 0x50]
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, esi
mov dword [ebp - 0x5c], eax
jne 0x401591
lea eax, [ebp + 0xbc]
push eax
call fcn.00438674
mov ebx, eax
cmp ebx, esi
pop ecx
jle 0x401591
push 0x1c
call fcn.004384ab
cmp eax, esi
pop ecx
je 0x401490
mov ecx, eax
call fcn.00401000
mov esi, eax
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x10]
push dword [edi + 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
test al, al
je 0x401583
mov eax, dword [esi + 0x18]
test eax, eax
je 0x40155d
push eax
call fcn.00438420
test eax, eax
pop ecx
jbe 0x40155d
mov ebx, dword [esi + 0x18]
and dword [ebp - 0x4c], 0
lea eax, [ebp - 0x4c]
push eax
push 0x44c484
push ebx
call fcn.004385b8
add esp, 0xc
cmp dword [ebp - 0x4c], 0
jle 0x40155d
jmp 0x4014e8
mov edi, dword [ebp - 0x54]
mov edi, dword [edi + 0x10]
jmp 0x4014fc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
cmp eax, dword [ebp - 0x4c]
je 0x401502
mov edi, dword [edi + 0x34]
test edi, edi
jne 0x4014ed
jmp 0x401514
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x48]
and dword [ebp - 0x4c], 0
mov byte [esi + 0x14], al
mov byte [esi + 0x15], 1
mov al, byte [ebx]
test al, al
je 0x401534
cmp al, 0x20
je 0x401529
cmp al, 9
je 0x401529
inc ebx
mov al, byte [ebx]
test al, al
jne 0x40151a
cmp byte [ebx], 0
je 0x401534
inc ebx
cmp byte [ebx], 0
jne 0x401538
and dword [ebp - 0x4c], 0
cmp dword [ebp - 0x4c], 0
jle 0x40155a
and dword [ebp - 0x4c], 0
lea eax, [ebp - 0x4c]
push eax
push 0x44c484
push ebx
call fcn.004385b8
add esp, 0xc
cmp dword [ebp - 0x4c], 0
jg 0x4014e5
mov edi, dword [ebp - 0x54]
mov ebx, dword [edi + 0xc]
test ebx, ebx
jne 0x40156e
mov dword [edi + 0xc], esi
jmp 0x401591
call dword [eax + 4]
mov ebx, eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
test eax, eax
mov eax, dword [ebx]
mov ecx, ebx
jne 0x401569
push esi
call dword [eax + 8]
jmp 0x401591
mov ecx, esi
call fcn.00401029
push esi
call fcn.004383d6
pop ecx
inc dword [ebp - 0x50]
xor esi, esi
cmp dword [ebp - 0x5c], esi
je 0x401441
pop ebx
mov ecx, dword [ebp + 0x1c0]
pop edi
pop esi
call fcn.0043840c
add ebp, 0x1c4
leave
ret
Function at 0x403508
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
add ecx, 8
push esi
push 8
mov eax, edx
pop esi
test al, 1
je 0x403520
shr eax, 1
xor eax, 0xedb88320
jmp 0x403522
shr eax, 1
dec esi
jne 0x403513
mov dword [ecx], eax
inc edx
add ecx, 4
cmp edx, 0xff
jle 0x40350e
pop esi
ret

Function at 0x4070f1
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x45e56c]
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea ecx, [ebp - 0x238]
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
call fcn.00407075
mov eax, dword [ebp - 0x220]
xor eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x21c]
xor ecx, dword [ebp + 0x18]
and eax, dword [ebp - 0x210]
and ecx, dword [ebp - 0x20c]
mov dword [ebp - 0x238], eax
mov esi, 0x100
push esi
lea eax, [ebp - 0x204]
mov dword [ebp - 0x234], ecx
xor ebx, ebx
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 0x230], bl
mov dword [ebp - 0x208], ebx
xor edi, edi
call fcn.004070b8
xor eax, eax
mov byte [ebp + eax - 0x104], al
inc eax
cmp eax, esi
jl 0x40716a
mov dword [ebp + 0x18], ebx
mov eax, dword [ebp + 0x18]
xor ecx, ecx
mov cl, byte [ebp + edi - 0x204]
lea eax, [ebp + eax - 0x104]
movsx edx, byte [eax]
add ecx, dword [ebp - 0x208]
add ecx, edx
and ecx, 0xff
mov dword [ebp - 0x208], ecx
lea ecx, [ebp + ecx - 0x104]
movsx ebx, byte [ecx]
inc edi
cmp edi, esi
mov byte [ecx], dl
mov byte [eax], bl
jl 0x4071b8
xor edi, edi
inc dword [ebp + 0x18]
cmp dword [ebp + 0x18], esi
jl 0x407179
mov edi, dword [ebp + 0x10]
test edi, edi
jge 0x4071c9
neg edi
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x4071f1
mov ecx, dword [ebp + 8]
sub edi, ecx
mov dword [ebp + 0x10], eax
lea eax, [edi + ecx]
cdq
mov ebx, esi
idiv ebx
mov al, byte [ebp + edx - 0x104]
and al, 0x7f
xor byte [ecx], al
inc ecx
dec dword [ebp + 0x10]
jne 0x4071d8
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0043840c
leave
ret

Function at 0x407961
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x4079b1
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x44a0eb
call fcn.00438c74
sub esp, 0x1c
mov eax, dword [0x463928]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push 0x2001f
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407a87
push 4
pop edi
push edi
mov dword [ebp - 0x20], edi
call fcn.00439322
pop ecx
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push ebx
mov esi, str.WarnOnZoneCrossing
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407a40
cmp dword [ebp - 0x24], edi
jne 0x407a5c
push edi
push dword [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
call fcn.00438ca0
mov eax, dword [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x18], eax
jmp 0x407a5c
xor eax, eax
inc eax
push edi
mov dword [0x463928], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 8]
je 0x407a75
push edi
lea eax, [ebp + 8]
push eax
push edi
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x1c]
call fcn.0043931d
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x408212
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x20]
sub eax, edi
push eax
lea eax, [esi + edi]
push eax
call fcn.004080bf
add esp, 0xc
cmp edi, dword [ebp + 0x10]
mov ecx, edi
jae 0x408255
xor edx, edx
mov eax, ecx
div dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov al, byte [edx + eax]
xor al, byte [ecx + esi]
xor al, byte [ebp + 0x1c]
mov byte [ecx + esi], al
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x408239
pop edi
pop esi
pop ebp
ret
Function at 0x4140d1
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x45e56c]
push ebx
push esi
push 0x2001f
push dword [ebp + 0x9c]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp + 0x90], eax
mov dword [ebp - 0x74], esi
call fcn.00414002
cmp eax, esi
jne 0x414159
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x414122
lea eax, [ebp - 0x70]
push eax
call fcn.004140d1
cmp eax, esi
jne 0x414158
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x74]
je 0x414115
call fcn.00413feb
push dword [ebp + 0x9c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.00413feb
mov ecx, dword [ebp + 0x90]
mov eax, esi
pop esi
pop ebx
call fcn.0043840c
add ebp, 0x94
leave
ret 4
Function at 0x414569
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x414574
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x415a2d
Capabilities:
Set current directory
Terminate process

Disassembly:
mov eax, 0x44a685
call fcn.00438c74
push ecx
mov eax, 0x1168
call fcn.00439ae0
mov eax, dword [0x45e56c]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
call fcn.00431927
call fcn.00408259
test al, al
jne 0x415a79
push 0
push str.Fatal_Error
push str.Files_are_altered_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
jmp 0x41695b
push 0x44c5be
push 0x4633b8
call fcn.004384c0
pop ecx
pop ecx
push 0x104
mov edi, 0x4637b8
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push edi
call fcn.00439d90
cmp eax, esi
pop ecx
pop ecx
jne 0x415abc
push esi
push str.Fatal_Error
push str.Invalid_access_rights_
jmp 0x415e33
push edi
mov byte [eax + 1], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x415ad2
cmp dword [ebx + 0x3cbb06db], 0x61
in eax, 8
sbb eax, 0xcc301286
iretd
inc edx
adc ax, word [ebx]
shr dword [ebx - 0x4d], cl
pop es
xor dword [ecx], ebp
mov bl, bl
mov edi, 0xb81cda4e
inc ebp
stosd dword es:[edi], eax
dec bh
jb 0x415e5c
jp 0x415e45
invalid
dec edx
in al, 0x47
movsd dword es:[edi], dword [esi]
add dword [eax - 0x109c1420], esi
dec edx
sub byte [edx - 0x12], al
test byte [edi - 0x21fd315], al
sub al, 0xe0
std
wrmsr
test eax, 0xe5c51698
push es
movsb byte es:[edi], byte [esi]
add esi, edi
adc al, 0x6e
in al, dx
or edx, ecx
sar ebx, 1
pop es
mov al, byte [0xe35a3f8a]
daa
mov bh, byte [edi]
pop edx
jecxz 0x415e88
jl 0x415e13
iretd
adc al, 0x16
test al, 0xfe
pop edi
ljmp 0x1dd0
call fcn.0043a079
int3

Function at 0x4197a2
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push esi
jmp 0x4197ae
push es
popal
mov dh, 0xd2
rcl ch, 0xcd
cmc
add eax, 0x2dd16072
inc eax
xor al, 0x59
invalid
Function at 0x4198ed
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7b8]
sub esp, 0x838
mov eax, dword [0x45e56c]
push esi
mov dword [ebp + 0x7b4], eax
lea eax, [ebp - 0x50]
push eax
push 0x20019
push 0
mov esi, ecx
push dword [esi + 0x100]
mov dword [ebp - 0x60], 0x800
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4199df
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4199d6
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
inc eax
push edi
push eax
call fcn.00439322
pop ecx
mov edi, eax
lea eax, [ebp - 0x5c]
push eax
push edi
lea eax, [ebp - 0x58]
push eax
push 0
push str.cdgfilename
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4199ce
cmp dword [ebp - 0x58], 1
jne 0x4199ce
push dword [esi + 0xfc]
call fcn.0043931d
and dword [esi + 0xfc], 0
push edi
call fcn.00438420
inc eax
push eax
call fcn.00439322
push edi
push eax
mov dword [esi + 0xfc], eax
call fcn.004384c0
add esp, 0x14
push edi
call fcn.0043931d
pop ecx
pop edi
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0xfc]
mov ecx, dword [ebp + 0x7b4]
pop esi
call fcn.0043840c
add ebp, 0x7b8
leave
ret

Function at 0x41cd71
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
test esi, esi
je 0x41cda4
push esi
call fcn.00438420
pop ecx
xor ecx, ecx
test eax, eax
jbe 0x41cd93
xor byte [ecx + esi], 0x2f
inc ecx
cmp ecx, eax
jb 0x41cd8a
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x41cda9
Capabilities:
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
cmp byte [ebp + 8], 0
mov eax, dword [0x45e56c]
mov dword [ebp - 4], eax
je 0x41cfc5
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x41cfc4
push dword [ebp + 0xc]
call fcn.00438420
cmp eax, edi
pop ecx
mov dword [ebp - 0x510], eax
jle 0x41cfc4
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
mov byte [ebp - 0x108], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.00439d90
cmp eax, edi
pop ecx
pop ecx
je 0x41ce2c
mov byte [eax + 1], 0
lea eax, [ebp - 0x108]
push str.wrapperdl.tdat
push eax
call fcn.004384d0
pop ecx
pop ecx
push ebx
push esi
push edi
mov esi, 0x80
push esi
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov ebx, 0x40000000
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
jne 0x41ce8a
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 4
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
je 0x41cfc2
push 0
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x41cec7
cmp eax, 0x19000
jbe 0x41cec7
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
push 5
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
mov edi, eax
jmp 0x41cecd
mov edi, dword [ebp - 0x50c]
cmp edi, 0xffffffff
je 0x41cfc2
push 2
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x10], ebx
mov esi, dword [ebp - 0x510]
je 0x41cf06
push dword [ebp + 0x10]
call fcn.00438420
cmp eax, esi
pop ecx
jle 0x41cf06
push dword [ebp + 0x10]
call fcn.00438420
pop ecx
mov esi, eax
add esi, 0x64
push esi
call fcn.00439322
mov ebx, 0x44f408
mov esi, eax
push ebx
push esi
call fcn.004384c0
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x41cf2d
push edi
call fcn.0041cd71
pop ecx
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
call fcn.004386a8
lea eax, [ebp + 8]
push eax
call fcn.0043ab63
push eax
push str._d__m__Y__H:_M:_S
lea eax, [ebp - 0x508]
push 0x400
push eax
call fcn.0043ab48
lea eax, [ebp - 0x508]
push eax
push esi
call fcn.004384c0
push edi
call fcn.0041cd71
push dword [ebp + 0xc]
push esi
call fcn.004384c0
push edi
call fcn.0041cd71
add esp, 0x30
cmp dword [ebp + 0x10], 0
je 0x41cfa4
push dword [ebp + 0x10]
call fcn.00438420
test eax, eax
pop ecx
jbe 0x41cfa4
push dword [ebp + 0x10]
push esi
call fcn.004384c0
push edi
call fcn.0041cd71
add esp, 0xc
push ebx
push esi
call fcn.004384c0
push edi
call fcn.0041cd71
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004383d6
pop ecx
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
call fcn.0043840c
leave
ret