joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d322
Capabilities:
Encode data using xor

Disassembly:
push 0x1c
mov eax, 0x42f5dc
call fcn.0041a8d7
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0040d142
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.004042fc
mov byte [ebp - 4], 1
lea edi, [ebp - 0x28]
cmp byte [0x439ecd], 0
mov esi, str._QWTKN
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
je 0x40d37e
xor ecx, ecx
xor edx, edx
mov eax, ecx
push 0x37
pop esi
div esi
add dl, 0x37
xor byte [ebp + ecx - 0x28], dl
inc ecx
cmp ecx, 0x12
jl 0x40d368
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.004042c3
mov byte [ebp - 4], 0
call fcn.0040d031
add esp, 0x30
lea ecx, [ebp + 8]
call fcn.00402616
xor al, al
call fcn.0041a8a5
ret

Function at 0x40d3a8
Capabilities:
Copy file
Encode data using xor

Disassembly:
push 0x24c
mov eax, 0x42f614
call fcn.0041a90a
push 0x104
lea eax, [ebp - 0x224]
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 5
pop edx
lea ecx, [ebp - 0x240]
call fcn.00405dad
lea eax, [ebp - 0x224]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x258]
call fcn.004042c3
push ebx
lea ecx, [ebp - 0x240]
push ecx
mov ecx, eax
call fcn.00404221
lea ecx, [ebp - 0x258]
mov esi, eax
call fcn.00402616
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00402616
cmp esi, 0xffffffff
jne 0x40d50d
push 5
pop edx
lea ecx, [ebp - 0x258]
call fcn.00405dad
xor eax, eax
lea ecx, [ebp - 0x258]
inc eax
push eax
push 0x438f4c
mov dword [ebp - 4], eax
call fcn.004044c7
push eax
lea ecx, [ebp - 0x240]
call fcn.0040428a
cmp dword [ebp - 0x22c], 0xf
lea ecx, [ebp - 0x240]
lea edx, [ebp - 0x11c]
cmova ecx, dword [ebp - 0x240]
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40d470
lea ecx, [ebp - 0x240]
call fcn.00402616
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00402616
cmp byte [0x439bc3], 0
lea edi, [ebp - 0x234]
mov esi, str.YWM_K_Y
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x40d4c6
mov ecx, ebx
xor edx, edx
mov eax, ecx
push 0x37
pop esi
div esi
add dl, 0x37
xor byte [ebp + ecx - 0x234], dl
inc ecx
cmp ecx, 0xc
jl 0x40d4ad
lea edx, [ebp - 0x234]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x40d4ce
lea edi, [ebp - 0x11c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40d4de
mov ecx, edx
lea eax, [ebp - 0x11c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push ebx
mov ecx, edx
push eax
and ecx, 3
lea eax, [ebp - 0x224]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40d513
call fcn.0041a8b9
ret
sub esp, 0x18
lea eax, [ebp - 0x11c]
mov ecx, esp
push eax
call fcn.004042c3
call fcn.0040d322
add esp, 0x18
push ebx
call fcn.0041dcef
int3
Function at 0x40d5ee
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x42f687
call fcn.0041a90a
mov esi, ecx
push 4
xor ebx, ebx
call fcn.00419f96
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
push edi
push ebx
push ecx
push 0x40d7eb
push ebx
push ebx
call fcn.0041de61
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x40d637
mov eax, esi
call fcn.0041a8b9
ret 4
push 6
mov dword [edi], ebx
call fcn.00419be6
int3

Function at 0x40e19c
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, 0x419
cmp ax, cx
je 0x40e1f1
add ecx, 0x12
cmp ax, cx
je 0x40e1f1
mov ecx, 0x423
cmp ax, cx
je 0x40e1f1
add ecx, 0x14
cmp ax, cx
je 0x40e1f1
mov ecx, 0x43f
cmp ax, cx
je 0x40e1f1
add ecx, 0xffffffe9
cmp ax, cx
je 0x40e1f1
mov ecx, 0x843
cmp ax, cx
je 0x40e1f1
mov ecx, 0x422
cmp ax, cx
setne al
ret
xor al, al
ret

Function at 0x40e1f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1dc
mov eax, dword [0x440040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x43a00c
lea edi, [ebp - 0x1c0]
mov ebx, ecx
xor ecx, ecx
push 0x36
mov dword [ebp - 0x1b4], ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1b4], ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0x1c0], dl
inc ecx
cmp ecx, 0xb
jl 0x40e22d
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1b4], eax
test eax, eax
je 0x40e2b4
cmp byte [0x43a00b], 0
lea edi, [ebp - 0x1d8]
push 5
pop ecx
mov esi, str.TNQyWL0_:
rep movsd dword es:[edi], dword [esi]
je 0x40e294
push 0x36
xor ecx, ecx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0x1d8], dl
inc ecx
cmp ecx, 0x14
jl 0x40e278
mov eax, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x1d8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x40e2d1
push dword [ebp - 0x1b4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x438f3b
mov ecx, ebx
call fcn.004042c3
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419f88
leave
ret
push 0x1a3
lea eax, [ebp - 0x1ab]
mov dword [ebp - 0x1b0], 0x1a8
push 0
push eax
mov byte [ebp - 0x1ac], 0
call fcn.0041bd20
add esp, 0xc
lea eax, [ebp - 0x1b0]
push 1
push eax
push 1
push 0
call esi
push dword [ebp - 0x1b4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x40e2b4
lea eax, [ebp - 0x18c]
push eax
jmp 0x40e2b9
Function at 0x40e3da
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, 0x439fec
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
mov ecx, edi
xor edx, edx
mov eax, ecx
push 0x36
pop esi
div esi
add dl, 0x39
xor byte [ebp + ecx - 0xc], dl
inc ecx
cmp ecx, 9
jl 0x40e3f1
lea eax, [ebp - 0xc]
push eax
push 1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
test esi, esi
je 0x40e428
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40e42c
pop edi
pop esi
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.0041dcef
int3

Function at 0x40e43a
Capabilities:
Encode data using xor
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea ecx, [ebp - 0x20]
push ebx
push esi
push edi
call fcn.0040e1f4
mov ebx, 0x441ec8
push eax
mov ecx, ebx
call fcn.00404255
lea ecx, [ebp - 0x20]
call fcn.00402616
cmp dword [0x441ed8], 1
jb 0x40e570
mov esi, str.kkxy
lea edi, [ebp - 0x1c]
push 0x36
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
pop edi
xor edx, edx
mov eax, esi
div edi
add dl, 0x39
xor byte [ebp + esi - 0x1c], dl
inc esi
cmp esi, 0x11
jl 0x40e47f
lea edx, [ebp - 0x1c]
mov ecx, ebx
call fcn.00408dd9
test al, al
jne 0x40e570
call fcn.0040e3da
mov ax, word [0x439508]
mov word [ebp - 4], ax
test ah, ah
je 0x40e4cc
xor ecx, ecx
xor edx, edx
mov eax, ecx
div edi
add dl, 0x39
xor byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 2
jl 0x40e4b9
sub esp, 0x18
lea esi, [ebp - 4]
mov ecx, esp
push 0x441dc0
call fcn.004042fc
push 0x7d
pop edx
lea ecx, [ebp - 0x20]
call fcn.00407ad7
add esp, 0x18
mov edx, esi
mov ecx, eax
call fcn.00408dd9
lea ecx, [ebp - 0x20]
mov bl, al
call fcn.00402616
test bl, bl
je 0x40e508
call fcn.0040e34d
mov ax, word [0x439508]
mov word [ebp - 4], ax
test ah, ah
je 0x40e52b
xor ecx, ecx
xor edx, edx
mov eax, ecx
div edi
add dl, 0x39
xor byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 2
jl 0x40e518
sub esp, 0x18
lea esi, [ebp - 4]
mov ecx, esp
push 0x441e68
call fcn.004042fc
push 0x7d
pop edx
lea ecx, [ebp - 0x20]
call fcn.00407ad7
add esp, 0x18
mov edx, esi
mov ecx, eax
call fcn.00408dd9
lea ecx, [ebp - 0x20]
mov bl, al
call fcn.00402616
test bl, bl
je 0x40e56b
call fcn.0040e19c
test al, al
je 0x40e570
pop edi
pop esi
pop ebx
leave
ret
push 0
call fcn.0041dcef
int3
Function at 0x410a1c
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x14
mov eax, 0x42fcfd
call fcn.0041a90a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
xor ebx, ebx
lea eax, [ebp + 0xc]
push ebx
push 0x80
push 3
push ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x20], 0xf
push 7
cmova eax, dword [ebp + 0xc]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x410adb
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x1c], eax
call fcn.0041df49
mov edi, eax
pop ecx
test edi, edi
je 0x410a8f
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x410a98
push edi
call fcn.0041df2e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x410adb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x410ad2
mov eax, dword [ebp - 0x20]
mov dl, byte [ebx + edi]
mov ecx, dword [eax + 4]
mov byte [ebp - 0x15], dl
cmp ecx, dword [eax + 8]
je 0x410abe
mov byte [ecx], dl
inc dword [eax + 4]
jmp 0x410acd
lea edx, [ebp - 0x15]
push edx
push ecx
mov ecx, eax
call fcn.004093f6
mov eax, dword [ebp - 0x20]
inc ebx
cmp ebx, esi
jb 0x410aa9
push edi
call fcn.0041df2e
pop ecx
mov bl, 1
lea ecx, [ebp + 0xc]
call fcn.00402616
mov al, bl
call fcn.0041a8b9
ret 0x1c
Function at 0x412387
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push 0x164
mov eax, 0x42ff48
call fcn.0041a90a
mov ebx, ecx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x118], ebx
lea edi, [ebp - 0x13c]
cmp byte [0x43a17d], 0
mov esi, 0x43a174
push 0x38
mov dword [ebp - 0x118], 0x100
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
je 0x4123e1
xor ecx, ecx
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0x13c], dl
inc ecx
cmp ecx, 0xa
jl 0x4123cb
push 5
pop ecx
lea edi, [ebp - 0x154]
mov esi, 0x43a1d0
rep movsd dword es:[edi], dword [esi]
push 0x38
xor ecx, ecx
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0x154], dl
inc ecx
cmp ecx, 0x15
jl 0x4123f7
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0xffff
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x154]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x4124cb
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x130]
call fcn.004042c3
and dword [ebp - 4], 0
lea ecx, [ebp - 0x170]
push 0x438f4c
call fcn.004042c3
push 0x439484
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 1
call fcn.004042c3
lea eax, [ebp - 0x170]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x154]
lea ecx, [ebp - 0x130]
call fcn.0040709b
pop ecx
lea ecx, [ebp - 0x154]
call fcn.00402616
lea ecx, [ebp - 0x170]
call fcn.00402616
lea eax, [ebp - 0x130]
mov ecx, ebx
push eax
call fcn.0040428a
lea ecx, [ebp - 0x130]
call fcn.00402616
jmp 0x4124d7
push str.null
mov ecx, ebx
call fcn.004042c3
mov eax, ebx
call fcn.0041a8b9
ret
Function at 0x412788
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x440040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, ecx
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov esi, str.R_IRXR_fro__E
mov dword [ebp - 0x18], eax
xor ebx, ebx
push 0x39
mov ecx, ebx
mov dword [ebp - 0x24], eax
movsd dword es:[edi], dword [esi]
pop ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor edx, edx
mov eax, ecx
div ebx
add dl, bl
xor byte [ebp + ecx - 0x14], dl
inc ecx
cmp ecx, 0xd
jl 0x4127b9
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
push 0
pop ebx
push 0x39
test eax, eax
je 0x412883
mov esi, 0x43a250
lea edi, [ebp - 0x3c]
mov ecx, ebx
pop ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor edx, edx
mov eax, ecx
div ebx
add dl, bl
xor byte [ebp + ecx - 0x3c], dl
inc ecx
cmp ecx, 0x11
jl 0x4127f5
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
pop ebx
test eax, eax
je 0x41285c
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push ecx
lea ecx, [ebp - 0x14]
push ecx
call eax
test eax, eax
je 0x412835
lea eax, [ebp - 0x14]
jmp 0x4128a9
mov eax, dword [str.WOWP]
mov dword [ebp - 0x20], eax
mov al, byte [0x43a168]
push 0x39
mov byte [ebp - 0x1c], al
pop ecx
xor edx, edx
mov eax, ebx
div ecx
add dl, cl
xor byte [ebp + ebx - 0x20], dl
inc ebx
cmp ebx, 5
jl 0x412848
jmp 0x4128a6
mov eax, dword [str.WOWP]
mov dword [ebp - 0x20], eax
mov al, byte [0x43a168]
push 0x39
mov byte [ebp - 0x1c], al
pop ecx
xor edx, edx
mov eax, ebx
div ecx
add dl, cl
xor byte [ebp + ebx - 0x20], dl
inc ebx
cmp ebx, 5
jl 0x41286f
jmp 0x4128a6
mov eax, dword [str.WOWP]
mov dword [ebp - 0x20], eax
mov al, byte [0x43a168]
mov byte [ebp - 0x1c], al
pop ecx
xor edx, edx
mov eax, ebx
div ecx
add dl, cl
xor byte [ebp + ebx - 0x20], dl
inc ebx
cmp ebx, 5
jl 0x412894
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
push eax
call fcn.004042c3
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00419f88
leave
ret
Function at 0x4128ea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
push edi
mov edi, ecx
xor esi, esi
push 6
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x41298b
movaps xmm0, xmmword [0x43ac80]
lea ecx, [ebp - 0x20]
push ebx
mov ebx, 0x80000000
mov edx, ebx
movups xmmword [ebp - 0x20], xmm0
call fcn.004128c4
mov eax, dword [ebp - 0x20]
push 0x40
mov dword [ebp - 8], eax
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.0041bd20
add esp, 0xc
cmp dword [ebp - 8], ebx
jb 0x41297f
mov edx, ebx
lea ecx, [ebp - 0x20]
call fcn.004128c4
cmp ebx, 0x80000002
jne 0x412955
lea edi, [ebp - 0x60]
jmp 0x41296d
cmp ebx, 0x80000003
jne 0x412962
lea edi, [ebp - 0x50]
jmp 0x41296d
cmp ebx, 0x80000004
jne 0x412974
lea edi, [ebp - 0x40]
lea esi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
inc ebx
cmp ebx, dword [ebp - 8]
jbe 0x41293e
mov edi, dword [ebp - 0xc]
xor esi, esi
cmp byte [ebp - 0x60], 0
pop ebx
je 0x41298b
lea eax, [ebp - 0x60]
jmp 0x4129b3
mov eax, dword [str.WUUY]
mov dword [ebp - 8], eax
mov al, byte [0x43a140]
mov byte [ebp - 4], al
xor edx, edx
mov eax, esi
push 0x39
pop ecx
div ecx
add dl, cl
xor byte [ebp + esi - 8], dl
inc esi
cmp esi, 5
jl 0x41299b
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.004042c3
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x4129c1
Capabilities:
Encode data using xor

Disassembly:
push 0x2c
mov eax, 0x42fffa
call fcn.0041a940
mov dword [ebp - 0x18], ecx
mov esi, 0x43a318
lea edi, [ebp - 0x24]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
push 0x39
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0x24], dl
inc ecx
cmp ecx, 0xb
jl 0x4129e7
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x412a62
mov esi, str._OoDMK__
lea edi, [ebp - 0x38]
push 0x39
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ebx
div esi
add dl, 0x39
xor byte [ebp + ebx - 0x38], dl
inc ebx
cmp ebx, 0x11
jl 0x412a1d
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x412a59
push dword [ebp - 0x18]
call eax
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x412a65
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or eax, 0xffffffff
call fcn.0041a8a5
ret
Function at 0x412a70
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x440040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov esi, 0x100
push edi
mov dword [ebp - 0x208], eax
xor ebx, ebx
push esi
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.0041bd20
push esi
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.0041bd20
add esp, 0x18
mov dword [ebp - 0x208], esi
mov esi, 0x43a2b8
lea edi, [ebp - 0x260]
push 0xb
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x39
mov ecx, ebx
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0x260], dl
inc ecx
cmp ecx, 0x2d
jl 0x412adc
lea eax, [ebp - 0x20c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x260]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412bca
lea edi, [ebp - 0x21c]
mov esi, str.iHTXH_K
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [0x43a2f3], bl
je 0x412b4a
push 0x39
mov ecx, ebx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0x21c], dl
inc ecx
cmp ecx, 0xc
jl 0x412b34
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push 1
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov esi, str.zOINXPK
lea edi, [ebp - 0x21c]
push 0x39
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0x21c], dl
inc ecx
cmp ecx, 0xd
jl 0x412b83
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 1
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x204]
push eax
call fcn.0041fd6d
pop ecx
cmp eax, 0x4e20
jl 0x412c32
mov esi, str.nSUXRIL_prC
lea edi, [ebp - 0x22c]
push 0x39
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ebx
div esi
add dl, 0x39
xor byte [ebp + ebx - 0x22c], dl
inc ebx
cmp ebx, 0xb
jl 0x412bf1
lea ecx, [ebp - 0x104]
mov eax, dword [ecx]
lea edx, [ebp - 0x22c]
cmp eax, dword [edx]
jne 0x412c32
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jne 0x412c32
movzx eax, word [ecx + 8]
cmp ax, word [edx + 8]
jne 0x412c32
mov byte [ebp - 0xfb], 0x31
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x104]
push eax
call fcn.004042c3
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x220]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00419f88
leave
ret
Function at 0x412c59
Capabilities:
Encode data using xor
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc60
mov eax, dword [0x440040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xd
pop ecx
xor ebx, ebx
lea edi, [ebp - 0xc60]
mov esi, 0x43a274
mov dword [ebp - 0xc14], ebx
rep movsd dword es:[edi], dword [esi]
push 0x39
mov dword [ebp - 0xc10], ebx
mov ecx, ebx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0xc60], dl
inc ecx
cmp ecx, 0x34
jl 0x412c92
cmp dword [0x441f54], 0xf
mov eax, 0x441f40
mov dword [ebp - 0xc0c], 0xf003f
cmova eax, dword [0x441f40]
mov dword [0x441f50], ebx
mov byte [eax], bl
lea eax, [ebp - 0xc14]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0xc60]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x412cf7
xor al, al
jmp 0x412e74
mov eax, ebx
mov dword [ebp - 0xc20], ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0xc08]
mov dword [ebp - 0xc08], 0x400
push ecx
lea ecx, [ebp - 0x404]
push ecx
push eax
push dword [ebp - 0xc14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x412e64
mov eax, dword [0x43a21c]
mov dword [ebp - 0xc1c], eax
mov ax, word [0x43a220]
mov word [ebp - 0xc18], ax
test ah, ah
je 0x412d64
mov ecx, ebx
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0xc1c], dl
inc ecx
cmp ecx, 6
jl 0x412d4e
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc60]
push eax
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00412755
add esp, 0x10
lea eax, [ebp - 0xc10]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x804]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412e56
lea edi, [ebp - 0xc2c]
mov esi, str.SHLQ_F
push 0x39
mov dword [ebp - 0xc08], 0x400
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp byte [0x43a317], bl
je 0x412dea
mov ecx, ebx
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0xc2c], dl
inc ecx
cmp ecx, 0xc
jl 0x412dd4
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0xc0c]
push eax
push ebx
lea eax, [ebp - 0xc2c]
push eax
push dword [ebp - 0xc10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412e38
lea eax, [ebp - 0xc04]
mov edi, 0x441f40
push eax
mov ecx, edi
call fcn.00404870
push 1
push 0x438f48
mov ecx, edi
call fcn.004044c7
push dword [ebp - 0xc10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc20]
inc eax
mov dword [ebp - 0xc20], eax
jmp 0x412cff
push dword [ebp - 0xc10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412e66
mov bl, 1
push dword [ebp - 0xc14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419f88
leave
ret
Function at 0x413ebd
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push 0x164
mov eax, 0x43035e
call fcn.0041a90a
mov ebx, ecx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x118], ebx
lea edi, [ebp - 0x13c]
cmp byte [0x43a807], 0
mov esi, str.N_WPXJ_0_6De
push 0x31
mov dword [ebp - 0x118], 0x100
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
je 0x413f16
xor ecx, ecx
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0x13c], dl
inc ecx
cmp ecx, 0xc
jl 0x413f00
push 9
pop ecx
lea edi, [ebp - 0x170]
mov esi, str.juhj
rep movsd dword es:[edi], dword [esi]
push 0x31
xor ecx, ecx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x39
xor byte [ebp + ecx - 0x170], dl
inc ecx
cmp ecx, 0x24
jl 0x413f2b
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0xffff
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x170]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x413fff
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x130]
call fcn.004042c3
and dword [ebp - 4], 0
lea ecx, [ebp - 0x164]
push 0x438f4c
call fcn.004042c3
push 0x439484
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 1
call fcn.004042c3
lea eax, [ebp - 0x164]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x148]
lea ecx, [ebp - 0x130]
call fcn.0040709b
pop ecx
lea ecx, [ebp - 0x148]
call fcn.00402616
lea ecx, [ebp - 0x164]
call fcn.00402616
lea eax, [ebp - 0x130]
mov ecx, ebx
push eax
call fcn.0040428a
lea ecx, [ebp - 0x130]
call fcn.00402616
jmp 0x41400b
push str.null
mov ecx, ebx
call fcn.004042c3
mov eax, ebx
call fcn.0041a8b9
ret