joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41082f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
je 0x410850
push 0x40
push dword [ebp + 0xc]
mov ebx, 0x41f970
add byte [ebx - 0x18], dl
loope 0x410818
invalid
invalid
jmp 0x410853
mov ebx, dword [ebp + 0xc]
cmp byte [0x41f968], 0
jne 0x4108a8
xor ecx, ecx
mov esi, 0x41f32c
lea eax, [ecx + 1]
cdq
push 5
pop edi
idiv edi
lea eax, [ecx + 2]
mov dword [esi - 4], ecx
mov dword [esi], edx
cdq
idiv edi
lea eax, [ecx + 3]
add esi, 0x14
mov dword [esi - 0x10], edx
cdq
idiv edi
lea eax, [ecx + 4]
mov dword [esi - 0xc], edx
cdq
idiv edi
mov dword [esi - 8], edx
test ecx, ecx
je 0x410896
dec ecx
jmp 0x410899
push 4
pop ecx
cmp esi, 0x41f96c
jl 0x410863
mov byte [0x41f968], 1
mov esi, dword [ebp + 8]
push 5
pop ecx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x41f334
mov dword [ebp + 0x10], ebx
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [esi], ecx
mov esi, dword [eax - 8]
mov edx, dword [eax]
mov edx, dword [ebp + edx*4 - 0x24]
mov edi, dword [eax - 4]
mov edi, dword [ebp + edi*4 - 0x24]
add dword [ebp + 0x10], 4
lea esi, [ebp + esi*4 - 0x24]
mov dword [ebp + 0xc], esi
mov esi, dword [eax + 4]
lea esi, [ebp + esi*4 - 0x24]
xor edi, edx
mov dword [ebp - 8], esi
mov esi, dword [eax - 0xc]
mov esi, dword [ebp + esi*4 - 0x24]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 0xc]
and edi, dword [edx]
rol esi, 5
xor edi, dword [ebp - 4]
add esi, ecx
mov ecx, dword [ebp - 8]
lea edx, [edi + esi + 0x5a827999]
add dword [ecx], edx
mov ecx, dword [ebp + 0xc]
ror dword [ecx], 2
add eax, 0x14
mov edx, 0x41f474
cmp eax, edx
jl 0x4108bb
mov dword [ebp + 0x10], 0x10

Function at 0x410974
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 3]
and eax, 0xf
lea esi, [ebx + eax*4]
lea eax, [ecx - 5]
and eax, 0xf
mov eax, dword [ebx + eax*4]
lea edi, [ecx + 5]
and edi, 0xf
out 0xf, eax
out 0xf, eax
xor eax, dword [ebx + edi*4]
and ecx, 0xf
xor eax, dword [ebx + ecx*4]
xor eax, dword [esi]
rol eax, 1
mov dword [esi], eax
mov esi, dword [edx - 8]
mov ecx, dword [edx]
mov ecx, dword [ebp + ecx*4 - 0x24]
mov edi, dword [edx - 4]
mov edi, dword [ebp + edi*4 - 0x24]
fmul qword [ebp - 0x76234a8c]
jne 0x410988
mov esi, dword [edx + 4]
lea esi, [ebp + esi*4 - 0x24]
xor edi, ecx
mov dword [ebp - 4], esi
mov esi, dword [edx - 0xc]
mov esi, dword [ebp + esi*4 - 0x24]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0xc]
and edi, dword [ecx]
rol esi, 5
xor edi, dword [ebp - 8]
add esi, eax
mov eax, dword [ebp - 4]
lea ecx, [edi + esi + 0x5a827999]
add dword [eax], ecx
mov eax, dword [ebp + 0xc]
ror dword [eax], 2
inc dword [ebp + 0x10]
add edx, 0x14
mov eax, 0x41f4c4
cmp edx, eax
jl 0x41093b
mov dword [ebp + 0x10], 0x14
mov edx, eax
Function at 0x410a03
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 3]
and eax, 0xf
lea esi, [ebx + eax*4]
lea eax, [ecx - 5]
lea edi, [ecx + 5]
and eax, 0xf
mov eax, dword [ebx + eax*4]
and ecx, 0xf
and edi, 0xf
xor eax, dword [ebx + edi*4]
xor eax, dword [ebx + ecx*4]
xor eax, dword [esi]
rol eax, 1
mov dword [esi], eax
mov ecx, dword [edx - 8]
mov edi, dword [edx]
lea ecx, [ebp + ecx*4 - 0x24]
mov dword [ebp + 0xc], ecx
mov ecx, dword [edx + 4]
lea ecx, [ebp + ecx*4 - 0x24]
mov dword [ebp - 4], ecx
mov ecx, dword [edx - 0xc]
mov esi, dword [ebp + ecx*4 - 0x24]
mov ecx, dword [edx - 4]
mov ecx, dword [ebp + ecx*4 - 0x24]
xor ecx, dword [ebp + edi*4 - 0x24]
rol esi, 5
mov edi, ecx
mov ecx, dword [ebp + 0xc]
xor edi, dword [ecx]
add esi, eax
mov eax, dword [ebp - 4]
lea esi, [edi + esi + 0x6ed9eba1]
add dword [eax], esi
ror dword [ecx], 2
inc dword [ebp + 0x10]
add edx, 0x14
cmp edx, 0x41f654
jl 0x4109cd
mov ecx, 0x41f650
mov dword [ebp + 0x10], 0x28
mov dword [ebp + 0xc], ecx
mov eax, dword [ebp + 0x10]
lea edx, [eax - 3]
and eax, 0xf
lea esi, [ebx + eax*4]
lea eax, [edx - 5]
and eax, 0xf
mov eax, dword [ebx + eax*4]
lea edi, [edx + 5]
and edi, 0xf
xor eax, dword [ebx + edi*4]
and edx, 0xf
xor eax, dword [ebx + edx*4]
xor eax, dword [esi]
rol eax, 1
mov dword [esi], eax
mov edx, dword [ecx - 4]
mov edi, dword [ecx + 8]
mov esi, dword [ecx]
mov esi, dword [ebp + esi*4 - 0x24]
lea edx, [ebp + edx*4 - 0x24]
lea edi, [ebp + edi*4 - 0x24]
mov dword [ebp - 0x10], edx
mov edx, dword [edx]
mov dword [ebp - 0xc], edi
mov edi, dword [ecx - 8]
mov ecx, dword [ecx + 4]
mov ecx, dword [ebp + ecx*4 - 0x24]
mov edi, dword [ebp + edi*4 - 0x24]
mov dword [ebp - 8], edx
or edx, esi
and ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 8]
and ecx, esi
or edx, ecx
rol edi, 5
add edi, eax
mov eax, dword [ebp - 0xc]
lea ecx, [edx + edi - 0x70e44324]
add dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
ror dword [eax], 2
inc dword [ebp + 0x10]
add ecx, 0x14
cmp ecx, 0x41f7e0
mov dword [ebp + 0xc], ecx
jl 0x410a57
mov dword [ebp + 0x10], 0x3c
mov edx, 0x41f7e4
Function at 0x10018b1
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x10050ac]
push esi
mov dword [ebp + 0x190], eax
lea eax, [ebp - 0x80]
push eax
xor esi, esi
lea eax, [ebp - 0x7c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x1001260
push 0x80000000
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001a0b
cmp dword [ebp - 0x80], 1
jne 0x1001a0b
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, 0x1001268
push ebx
call edi
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push esi
push esi
push dword [ebp - 0x7c]
call ebx
test eax, eax
jne 0x1001a09
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x1001278
push 0x80000000
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001a09
push 0x1001288
call edi
push eax
push 0x1001288
push 1
push esi
push esi
push dword [ebp - 0x7c]
call ebx
test eax, eax
jne 0x1001a09
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x1001294
push 0x80000000
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001a09
push 0x104
lea eax, [ebp - 0x78]
push eax
call fcn.0100186d
lea eax, [ebp - 0x78]
push eax
push 0x10012b8
lea eax, [ebp + 0x8c]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
lea eax, [ebp + 0x8c]
push eax
call edi
push eax
lea eax, [ebp + 0x8c]
push eax
push 1
push esi
push esi
push dword [ebp - 0x7c]
call ebx
test eax, eax
jne 0x1001a09
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x7c], esi
pop edi
pop ebx
cmp dword [ebp - 0x7c], esi
pop esi
je 0x1001a1a
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x190]
call fcn.0100448b
add ebp, 0x194
leave
ret
Function at 0x10024fb
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x10050ac]
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0x98]
cmp esi, ebx
mov dword [ebp + 0x8c], eax
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
je 0x10025c2
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push ebx
push 0x1001418
push 0x80000002
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10025b4
lea eax, [ebp + 0x98]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x1001417
push dword [ebp - 0x7c]
mov dword [ebp + 0x98], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10025b4
cmp dword [ebp - 0x80], 2
lea eax, [ebp - 0x78]
jne 0x1002597
push dword [ebp + 0x9c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp + 0x98], eax
jmp 0x10025b4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10025b4
push dword [ebp + 0x9c]
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp - 0x7c], ebx
je 0x10025c2
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x8c]
pop esi
pop ebx
call fcn.0100448b
add ebp, 0x90
leave
ret 8
Function at 0x1002f7e
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 1
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov al, byte [esi]
cmp al, 0x22
jne 0x1002fad
inc esi
mov al, byte [esi]
test al, al
je 0x1002fa6
cmp al, 0x22
jne 0x1002f9b
cmp byte [esi], 0x22
jne 0x1002fbe
jmp 0x1002fbd
cmp al, 0x20
jle 0x1002fbe
inc esi
cmp byte [esi], 0x20
jg 0x1002fb1
jmp 0x1002fbe
cmp al, 0x20
jg 0x1002fc4
inc esi
mov al, byte [esi]
test al, al
jne 0x1002fb9
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x1002fde
movzx eax, word [ebp - 0x14]
jmp 0x1002fe1
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1003eb8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x1003f77
cmp dword [ebp + 0x10], ebx
je 0x1003f77
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x1003efb
mov dword [ebp - 4], 0x80040116
jmp 0x1003f6b
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1003f14
mov dword [ebp - 4], 0x80040116
jmp 0x1003f63
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
jne 0x1003f2d
mov dword [ebp - 4], 0x8007000e
jmp 0x1003f62
push ebx
lea eax, [ebp - 8]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1003f4a
mov dword [ebp - 4], 0x80040116
jmp 0x1003f62
cmp esi, dword [ebp - 8]
je 0x1003f58
mov dword [ebp - 4], 0x80004005
jmp 0x1003f62
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
pop edi
mov eax, dword [ebp + 8]
cmp eax, ebx
pop esi
je 0x1003f72
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x1003f7c
mov eax, 0x80070057
pop ebx
leave
ret 0xc
Function at 0x100448b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10050ac]
jne 0x1004494
ret
jmp 0x1004499
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x10050ac]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x10050d0]
test eax, eax
je 0x10044bd
call eax
cmp dword [0x10050d4], 0
je 0x1004504
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x10050d4]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.0100448b
add ebp, 0x2a8
leave
ret
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..pdata
mov ebx, 0x408f6c
nop
mov ecx, 0x7d633627
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
mov ecx, 0x12a06074
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x411b50
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
cmp word [ecx], 3
mov edi, edx
mov esi, ecx
jne 0x411b70
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x14]
push eax
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, edi
jmp 0x411b7e
mov eax, dword [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.00411930
test eax, eax
jne 0x411b85
lea eax, [esi + 0x1c]
pop edi
pop esi
ret 8
Function at 0x412260
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x35c
push ebx
push esi
push edi
mov ebx, ecx
push ebp
mov ebp, edx
call fcn.004121e0
test eax, eax
je 0x412284
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x35c
ret
lea eax, [esp + 0x20]
mov edi, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x268]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [0x4190c0]
mov edi, ebx
mov word [esp + 0x64], ax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x64]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4190c0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x64]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebp, ebp
je 0x4123c6
cmp byte [ebp], 0
je 0x4123c6
mov edi, 0x4190bc
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x64]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x64]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4190c0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x64]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
lea edx, [esp + 0x6c]
push 0
lea eax, [esp + 0x274]
push 0
push 0
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x35c
ret
Function at 0x413d10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x413d6b
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
mov edx, dword [esp + 4]
push eax
mov dword [esp + 0xc], 0x104
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea ecx, [esp + 0xc]
mov edx, dword [esp + 0x114]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 4

Function at 0x413d80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
mov ebx, edx
push ebp
mov edi, ecx
xor esi, esi
push ebx
mov eax, dword [esp + 0x220]
push esi
push eax
mov ebp, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push edi
push 0x419154
push esi
call ebp
cmp eax, 0x20
jg 0x413e73
mov ecx, edi
call fcn.004121e0
test eax, eax
jne 0x413dc4
xor eax, eax
jmp 0x413e7a
lea eax, [esp + 0x10]
mov edx, 0x41914c
push eax
mov ecx, 0x80000000
call fcn.00413d10
test eax, eax
jne 0x413e78
lea eax, [esp + 0x10]
push 0x419138
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
lea edx, [esp + 0x10]
push eax
mov ecx, 0x80000000
call fcn.00413d10
test eax, eax
jne 0x413e78
lea eax, [esp + 0x10]
push 0x419130
push eax
call fcn.00418e20
add esp, 8
mov ebp, eax
test ebp, ebp
jne 0x413e4a
lea eax, [esp + 0x10]
push 0x41912c
push eax
call fcn.00418e20
add esp, 8
mov ebp, eax
test ebp, ebp
jne 0x413e4a
lea eax, [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
call ebp
lea ebp, [esp + eax + 0xf]
jmp 0x413e4e
mov byte [ebp], 0
push 0x419044
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x413e78
mov esi, 1
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4
Function at 0x414350
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, edx
mov edi, dword [esp + 0xc]
mov edx, dword [ecx + 2]
xor edx, dword [ecx + 6]
xor edx, dword [ecx + 0xa]
add edi, edx
xor edx, edx
mov eax, dword [ecx + 6]
inc edx
xor dword [edi + edx*4 - 4], eax
inc edx
mov eax, dword [ecx + 0xa]
xor dword [edi + edx*4 - 4], eax
cmp edx, 0x14
jl 0x414365
mov ecx, dword [esi]
call fcn.004175e0
mov dword [esi], 0
cmp word [0x4191b8], 0
je 0x41439d
cmp word [0x4191c0], 0
je 0x41439d
call edi
push 0
push 0x419238
push 0x419228
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret 4

Function at 0x414420
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x318
lea eax, [esp + 0x110]
push ebx
push esi
xor ebx, ebx
push edi
mov byte [0x41c948], bl
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x414457
mov byte [esp + 0x11c], 0x63
mov byte [esp + 0x11d], bl
xor edx, edx
lea edi, [esp + 0x11c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4144a0
mov ebx, 0x5c
cmp byte [esp + edx + 0x11c], bl
je 0x414498
inc edx
lea edi, [esp + 0x11c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jg 0x414475
jmp 0x4144a0
mov byte [esp + edx + 0x11d], 0
lea eax, [esp + 0x18]
push 0x104
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x230]
push eax
lea edx, [esp + 0x130]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4144ee
lea eax, [esp + 0x18]
push 0xa
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.00418c50
add esp, 0xc
jmp 0x4144fd
mov edx, 0x419284
mov ecx, 0x41926c
call fcn.004175f0
xor eax, eax
mov edx, 0x38
mov cl, byte [esp + eax + 0x18]
cmp cl, 0x30
jl 0x41451a
cmp cl, 0x39
jg 0x41451a
mov byte [eax + 0x41c940], cl
jmp 0x414520
mov byte [eax + 0x41c940], dl
inc eax
cmp eax, 8
jl 0x414504
mov edi, 0x41c940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [esp + 0x1a]
mov al, byte [esp + 0x1f]
mov dl, byte [esp + 0x18]
mov byte [0x41c940], cl
mov cl, byte [esp + 0x1b]
mov byte [0x41c943], al
mov al, byte [esp + 0x1d]
mov byte [0x41c942], dl
mov byte [0x41c944], cl
mov byte [0x41c941], al
mov byte [0x41c945], 0
cmp byte [esp + 0x1a], 0x30
jne 0x414595
mov al, byte [esp + 0x1a]
inc al
mov byte [0x41c940], al
mov edx, 0x419264
mov ecx, 0x41c940
call fcn.00417a60
pop edi
mov dword [0x41c9d4], eax
pop esi
pop ebx
add esp, 0x318
ret
Function at 0x416240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
push ebx
push esi
push edi
push ebp
push eax
push 0x419198
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x41626c
mov ax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
push 0xbb80
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
jne 0x416292
mov ax, 3
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov dword [esp + 0x10], 0xbb80
lea eax, [esp + 0x10]
push eax
push ebp
push 0x419198
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x4162e7
push ebp
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call esi
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFree]
call ebp
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, 3
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
dec dword [esp + 0x10]
push eax
mov edx, dword [esp + 0x14]
push ecx
mov ecx, ebp
xor ebx, ebx
call fcn.00417770
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
lea eax, [ecx + 8]
mov dword [esp + 0x10], edx
cmp edx, ebx
jle 0x41632e
mov ecx, 0xc
mov esi, eax
mov edi, dword [0x41cb78]
repe cmpsb byte [esi], byte es:[edi]
je 0x41632e
add eax, 0xc
inc ebx
cmp ebx, dword [esp + 0x10]
jl 0x416313
push ebp
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call edi
push ebp
call esi
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFree]
call ebp
mov eax, dword [esp + 0x14]
push eax
call esi
push eax
call edi
mov eax, dword [esp + 0x14]
push eax
call esi
push eax
call ebp
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, dword [esp + 0x10]
je 0x416384
or byte [0x41c94a], 0x20
mov ax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret