joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012e3e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp + 8]
push eax
call fcn.1001293a
add esp, 0xc
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10012e6e
xor eax, eax
jmp 0x10012fd3
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10012b26
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10012e96
xor eax, eax
jmp 0x10012fd3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x42f8
push 0x36b0
push 1
call fcn.10012b84
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x10012ebf
xor eax, eax
jmp 0x10012fd3
push 0x3ffa
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x4df6
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
call fcn.10012bf7
add esp, 0x20
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 4]
push eax
call fcn.10012cd2
add esp, 0x10
push 1
push 0x2e29
push 0x6f29
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10012d39
add esp, 0x18
cmp dword [ebp - 0x14], 0
je 0x10012f3a
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0x6dbc
call fcn.10012dcf
add esp, 0x10
push dword [ebp - 4]
call fcn.10012359
pop ecx
test eax, eax
jne 0x10012f4e
xor eax, eax
jmp 0x10012fd3
push 0x5d33
push 0x1dd0
push dword [ebp - 4]
push 1
push 0x7989
push 0x5802
push 0x2a63
push 0x741c
call fcn.1000c687
add esp, 0x20
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10012fbb
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10012f98
xor eax, eax
jmp 0x10012fd3
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10012fb1
xor eax, eax
jmp 0x10012fd3
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10012fcc
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10012fd0
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10076fa6
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007f330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100668b4
mov dword [ebp - 0x14], eax
cmp dword [0x1066c414], esi
jne 0x10077099
push 0x800
push esi
push 0x10007bac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10077026
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10077179
push esi
push esi
push 0x10007bac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10077179
push 0x10007bc4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10077179
push eax
call ebx
push 0x10007bd0
push edi
mov dword [0x1066c414], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007be0
push edi
mov dword [0x1066c418], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007bf4
push edi
mov dword [0x1066c41c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066c424], eax
test eax, eax
je 0x10077096
push 0x10007c10
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066c420], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100770be
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100770b1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100770d3
push 4
pop eax
jmp 0x1007717b
cmp dword [ebp - 0x14], esi
je 0x100770d3
push dword [0x1066c414]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100770b8
mov eax, dword [0x1066c420]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10077131
cmp dword [0x1066c424], edi
je 0x10077131
push eax
call ebx
push dword [0x1066c424]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10077131
test eax, eax
je 0x10077131
call ecx
test eax, eax
je 0x10077126
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10077126
test byte [ebp - 8], 1
jne 0x10077131
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10077161
mov eax, dword [0x1066c418]
cmp eax, edi
je 0x1007715e
push eax
call ebx
test eax, eax
je 0x1007715e
call eax
mov esi, eax
test esi, esi
je 0x1007715e
mov eax, dword [0x1066c41c]
cmp eax, edi
je 0x1007715e
push eax
call ebx
test eax, eax
je 0x1007715e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1066c414]
call ebx
test eax, eax
je 0x10077179
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007717b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x463b83
Capabilities:
Encode data using xor

Disassembly:
dec ebx
jmp 0x46ce9a
push 0xfc3e8fac
not dword [esp]
lea esp, [esp + 8]
jne 0x46135f

Function at 0x495d7d
Capabilities:
Encode data using xor

Disassembly:
call fcn.00460289
mov edi, dword [esp + edi*4 - 0xcff0ab4]
mov dword [esp + 0x14], 0x91ce45d
push dword [esp + 4]
popfd
lea esp, [esp + 0x14]
call fcn.0047287f
neg dl
jmp 0x498a60
push 0x53a5142c
shl dword [esp + 2], 0x4b
inc dl
xor dl, 0x81
xor bl, dl
sal word [esp + 3], 0x46
setb byte [esp + 7]
lea edx, [esp + edx + 8]
jns 0x4d08f2
mov byte [0x785a8a78], al
mov al, byte [0x4f9eff58]
mov byte [0x54ab707a], al
adc dh, 0x36
and eax, 0xe74eb0f8
lcall 0x3d3b, 0x8f26b1cb
inc esp
mov al, byte [0xbfdf9504]
cmp dword [ebx + 0x69c5fb5f], 0xffffffe8
stosd dword es:[edi], eax
inc esp
mov al, byte [0x59cb0044]
aaa
push esi
mov byte [ebp - 0x75], ah
dec edx
xor al, 0x41
push cs
invalid
jp 0x46c378
inc ecx
rol ah, 1
dec eax
mov dword [esp], 0x622f9534
call fcn.004d0fa1
Function at 0x10017700
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001772d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001772d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4043fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x406408
cmp edx, dword [eax]
je 0x40441f
add eax, 8
inc ecx
cmp eax, 0x406498
jl 0x404410
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x406408]
jne 0x40454d
mov eax, dword [0x4067e8]
cmp eax, 1
je 0x404527
test eax, eax
jne 0x404450
cmp dword [0x406354], 1
je 0x404527
cmp edx, 0xfc
je 0x40454d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404487
lea eax, [ebp - 0x1a4]
push 0x401414
push eax
call fcn.00404cb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004026e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4044ca
lea eax, [ebp - 0x1a4]
push eax
call fcn.004026e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x401410
push edi
call fcn.00404e30
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4013f4
push eax
call fcn.00404cb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404cc0
lea eax, [ebp - 0xa0]
push 0x4013f0
push eax
call fcn.00404cc0
push dword [esi + 0x40640c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404cc0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4013c8
push eax
call fcn.00404da0
add esp, 0x2c
pop edi
jmp 0x40454d
lea eax, [ebp + 8]
lea esi, [esi + 0x40640c]
push 0
push eax
push dword [esi]
call fcn.004026e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x100058be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100058cd
pop dword [ebp - 0x4c]
mov eax, 0x63b22ac1
sub eax, 0x53b1d1f4
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x92ae4f
add dword [ebp - 0x5c], 0x4dbf96fc
mov dword [ebp - 0x58], 0xf47ed2bb
sub dword [ebp - 0x58], 0xc24b8676
mov dword [ebp - 0x54], 0x29235d27
add dword [ebp - 0x54], 0x2328e707
mov dword [ebp - 0x50], 0x71269e1
add dword [ebp - 0x50], 0xf8ed961f
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x1f938a1a
sub eax, 0xf91ea12
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x517c3d39
add dword [ebp - 0x5c], 0x22f62c1d
mov dword [ebp - 0x58], 0x9c00c400
sub dword [ebp - 0x58], 0x5a94628b
mov dword [ebp - 0x54], 0xcfd6d659
sub dword [ebp - 0x54], 0x6c6769ed
mov dword [ebp - 0x50], 0xd074fb86
sub dword [ebp - 0x50], 0xd074fb86
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xa2d9ad0
add eax, 0x5d4053c
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c761
push 0
call eax
mov ecx, 0x9328ab1d
sub ecx, 0x93285a4d
xor edi, edi
add edi, eax
mov ebx, 0xf60e1798
add ebx, 0x19f43268
add ebx, dword [ebp - 0x4c]
mov edx, 0x3f51114c
mov dword [ebp - 0x20], 0x4b81f07d
mov esi, dword [ebx]
mov dword [ebp - 8], 0xeccbb7a0
xor esi, edx
mov dword [edi], esi
xor dword [ebp - 0x20], 0x16f69d42
add edi, 4
add ebx, 0x32ee9a1e
add ebx, 0xcd1165e6
loop 0x100059eb
add eax, 0x9c155f2b
sub eax, 0x9c142918
xor ebx, ebx
add ebx, eax
add eax, 0x8e24e707
add eax, 0x71db18fe
mov ecx, 0x89a9fd58
sub ecx, 0x79a9fd58
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x30014af0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x30020490]
jne 0x30016bf1
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x30021d98], eax
mov dword [0x30021d94], ecx
mov dword [0x30021d90], edx
mov dword [0x30021d8c], ebx
mov dword [0x30021d88], esi
mov dword [0x30021d84], edi
mov word [0x30021db0], ss
mov word [0x30021da4], cs
mov word [0x30021d80], ds
mov word [0x30021d7c], es
mov word [0x30021d78], fs
mov word [0x30021d74], gs
pushfd
pop dword [0x30021da8]
mov eax, dword [ebp]
mov dword [0x30021d9c], eax
mov eax, dword [ebp + 4]
mov dword [0x30021da0], eax
lea eax, [ebp + 8]
mov dword [0x30021dac], eax
mov eax, dword [ebp - 0x320]
mov dword [0x30021ce8], 0x10001
mov eax, dword [0x30021da0]
mov dword [0x30021c9c], eax
mov dword [0x30021c90], 0xc0000409
mov dword [0x30021c94], 1
mov eax, dword [0x30020490]
mov dword [ebp - 0x328], eax
mov eax, dword [0x30020494]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x30021ce0], eax
push 1
call fcn.3001ac97
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x30002c70
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x30021ce0], 0
jne 0x30016ce1
push 1
call fcn.3001ac97
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x3001b72d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x3001b73c
pop dword [ebp - 0x30]
mov eax, 0x3803682
add eax, 0x2c8180ba
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3ad0d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xc89e8f2b
add ecx, 0x3761be9e
xor edx, edx
add edx, eax
mov edi, 0x69b76b8d
add edi, 0xc64afc73
add edi, dword [ebp - 0x30]
mov esi, 0xd4b2d749
add esi, 0x20c7f23c
add dword [ebp - 0x14], 0xbb80976c
mov ebx, dword [edi]
xor dword [ebp - 0x20], 0x87394f6e
xor ebx, esi
sub dword [ebp - 8], 0x547fc6c9
mov dword [edx], ebx
sub dword [ebp - 0x2c], edx
add edx, 4
add edi, 4
loop 0x3001b798
add eax, 0x872b29f
add eax, 0xf78e7758
mov ebx, eax
add eax, 0x913d165d
add eax, 0x6ec2e9a8
mov ecx, 0x30000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x402dbe
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call fcn.00402d30
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.004d9f5c
call fcn.004bcaa5
call fcn.0043e97a
call fcn.004bf620
call fcn.0045e016
call fcn.004def36
call fcn.00440d22
mov esi, eax
cmp dword [esi + 0x14], edi
jne 0x402e49
mov ebx, dword [0x5b1374]
push edi
push edi
xor ebp, ebp
inc ebp
push ebp
push edi
call ebx
push edi
push edi
push ebp
push edi
mov dword [esi], eax
call ebx
mov dword [esi + 8], eax
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x440e67
push edi
push edi
call fcn.0057e701
add esp, 0x18
mov dword [esi + 0xc], eax
cmp eax, edi
je 0x402e46
push 0xffffffffffffffff
push eax
call dword [0x5b1164]
push dword [esi + 0xc]
call dword [0x5b1154]
mov dword [esi + 0x14], ebp
call fcn.00403ab6
push 0x6246b8
mov esi, eax
call fcn.0044167b
mov ecx, esi
mov esi, eax
call fcn.004416b7
call fcn.00403016
call fcn.00404d8c
call fcn.004a692b
mov ebx, eax
cmp ebx, edi
je 0x402e9d
push 1
call fcn.004a2b8b
mov esi, eax
call fcn.004a2bc7
call fcn.004b68b1
mov ecx, eax
call fcn.004b68ed
call fcn.00403199
push ebx
call fcn.004a7043
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.firstrun
push str.Softwarehao123JuziBrowser
push 0x80000001
mov dword [esp + 0x30], edi
call dword [0x5b14c0]
push dword [0x6b4e2c]
mov ebx, dword [0x5b1794]
call ebx
mov ebp, dword [0x5b1790]
test eax, eax
je 0x402f05
lea eax, [esp + 0x14]
push eax
push dword [0x6b4e28]
mov dword [esp + 0x1c], edi
call dword [0x5b1784]
push dword [esp + 0x14]
call dword [0x5b1780]
push edi
push edi
push 0x502
push dword [0x6b4e2c]
call ebp
call fcn.0044167b
mov esi, eax
push dword [esi + 4]
call ebx
mov ebx, dword [0x5b13a0]
test eax, eax
je 0x402f37
push edi
push edi
push 0x10
push dword [esi + 4]
call ebp
push 0x7d0
push dword [esi + 0x24]
call dword [0x5b1380]
push dword [esi + 0x24]
call ebx
push 1
call fcn.00442880
mov eax, dword [0x62445c]
pop ecx
cmp eax, edi
je 0x402f51
push eax
call ebx
mov dword [0x62445c], edi
mov eax, dword [0x624468]
cmp eax, edi
je 0x402f6f
push eax
call dword [0x5b13a8]
push dword [0x624468]
call ebx
mov dword [0x624468], edi
call dword [sym.imp.ole32.dll_OleUninitialize]
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
add esp, 0xc
ret

Function at 0x405acc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x405ada
push 0xd
pop eax
jmp 0x405b0d
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [0x5b13e8]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x405ae1
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x405f57
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x606c40]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
mov dword [ebp - 0x21c], eax
xor esi, esi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.00405f24
mov ebx, eax
cmp ebx, esi
je 0x405fbf
cmp dword [ebp - 0x214], esi
je 0x405fb8
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x40605a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x405fe7
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00405f57
mov dword [ebp - 0x220], eax
cmp eax, esi
jne 0x40606b
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x405fc7
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], esi
je 0x406032
push dword [ebp - 0x214]
call ebx
mov dword [ebp - 0x214], esi
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [ebp - 0x214], esi
je 0x406058
push dword [ebp - 0x214]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057d6ce
leave
ret 4
cmp dword [ebp - 0x214], esi
je 0x40607f
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x220]
jmp 0x40605a

Function at 0x408e1c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi]
push ebx
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20119
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x408e86
cmp dword [ebp - 4], edi
je 0x408e86
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x408e86
push dword [ebp - 8]
push edi
push dword [ebp + 0x18]
call fcn.005847c0
add esp, 0xc
mov dword [esi], edi
xor eax, eax
jmp 0x408e88
mov eax, ebx
pop edi
pop ebx
leave
ret
Function at 0x408e8c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
mov ebx, 0x20106
push ebx
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
cmp eax, 5
jne 0x408ee3
push dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.00408c1e
pop ecx
test eax, eax
jne 0x408f0e
push esi
lea eax, [ebp - 4]
push eax
push esi
push ebx
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jne 0x408f0e
cmp dword [ebp - 4], esi
je 0x408f0e
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a170
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ebx
cdq
push 3
pop ecx
idiv ecx
lea eax, [ebx + 2]
xor esi, esi
mov dword [ebp - 8], edx
cdq
idiv ecx
lea eax, [eax*4 + 1]
push eax
call fcn.0057c3f0
pop ecx
mov ecx, eax
test ecx, ecx
je 0x40a262
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
jle 0x40a21f
cdq
push 3
pop ebx
idiv ebx
mov eax, dword [ebp - 4]
test edx, edx
jne 0x40a1c4
movzx edx, byte [eax + edi]
shr edx, 2
jmp 0x40a20a
cmp edx, 1
jne 0x40a1e4
movzx edx, byte [eax + edi - 1]
movzx ebx, byte [eax + edi]
and edx, 3
shl edx, 4
shr ebx, 4
mov dl, byte [edx + ebx + 0x61c5e8]
jmp 0x40a210
cmp edx, 2
jne 0x40a214
movzx edx, byte [eax + edi - 1]
movzx ebx, byte [eax + edi]
and edx, 0xf
shr ebx, 6
mov dl, byte [ebx + edx*4 + 0x61c5e8]
mov byte [ecx + esi], dl
movzx edx, byte [eax + edi]
inc esi
and edx, 0x3f
mov dl, byte [edx + 0x61c5e8]
mov byte [ecx + esi], dl
inc esi
mov ebx, dword [ebp + 8]
inc eax
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x40a1ae
cmp dword [ebp - 8], 1
jne 0x40a240
movzx eax, byte [edi + ebx - 1]
and eax, 3
shl eax, 4
mov al, byte [eax + 0x61c5e8]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
jmp 0x40a258
cmp dword [ebp - 8], 2
jne 0x40a25e
movzx eax, byte [edi + ebx - 1]
and eax, 0xf
mov al, byte [eax*4 + 0x61c5e8]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
inc esi
mov byte [ecx + esi], 0
pop esi
mov eax, ecx
pop ebx
leave
ret
Function at 0x417033
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ecx
push esi
push edi
mov edi, 0xa000
push edi
mov dword [esp + 0xc], edi
call fcn.0057c3f0
mov esi, eax
pop ecx
test esi, esi
je 0x41710d
push ebp
push edi
push 0
push esi
call fcn.005847c0
mov eax, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], eax
lea eax, [esp + 0xc]
push eax
push esi
push str.cookie:
call dword [0x61e854]
mov ebp, eax
test ebp, ebp
je 0x417105
push ebx
mov ebx, dword [0x61e850]
mov eax, dword [esi + 4]
test eax, eax
je 0x4170d6
push 0x620678
push eax
call dword [0x5b1530]
test eax, eax
je 0x4170d6
push dword [0x620778]
push 0x6206f8
push eax
call dword [0x5b1498]
test eax, eax
je 0x4170d6
push dword [esi + 4]
call ebx
test eax, eax
jne 0x4170d6
call dword [0x5b13dc]
cmp eax, 5
jne 0x4170d6
push 0
push dword [esi + 4]
call dword [0x61e84c]
push dword [esi + 4]
call ebx
push edi
push 0
push esi
mov dword [esp + 0x1c], edi
call fcn.005847c0
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi], eax
lea eax, [esp + 0x10]
push eax
push esi
push ebp
call dword [0x61e848]
test eax, eax
jne 0x417085
push ebp
call dword [0x61e844]
pop ebx
push esi
call fcn.0057d6c3
pop ecx
pop ebp
pop edi
pop esi
pop ecx
ret

Function at 0x417f6a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
push esi
push edi
mov dword [ebp - 8], eax
cmp dword [ebp + 8], eax
je 0x418048
cmp dword [ebp + 0x14], eax
je 0x418048
lea edi, [ebx + 2]
push edi
call fcn.0057c3f0
mov esi, eax
pop ecx
test esi, esi
je 0x418043
push edi
push 0
push esi
call fcn.005847c0
push ebx
push dword [ebp + 8]
push esi
call fcn.00584840
push ebx
call fcn.0041825a
push dword [ebp + 0x10]
mov ecx, esi
push ebx
mov dword [ebp + 8], eax
call fcn.0041823f
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push 0x10
pop edi
push 5
push dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push 0
push 0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
call dword [0x5b1428]
and dword [ebp - 4], 0
push 0x5cba40
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
call fcn.0058138c
add esp, 0xc
test eax, eax
jne 0x418035
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push 1
push edi
push eax
call fcn.00581b18
push dword [ebp - 4]
push ebx
push 1
push esi
call fcn.00581b18
push dword [ebp - 4]
call fcn.00581c11
add esp, 0x24
push esi
call fcn.0057db06
pop ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
jmp 0x41804a
xor eax, eax
pop edi
pop esi
leave
ret