joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40df5c
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov edi, dword [esp + 0x40]
mov eax, dword [0x41cc58]
test eax, eax
je 0x40e08d
mov esi, dword [eax]
test esi, esi
js 0x40e074
mov eax, dword [0x41cc58]
test eax, eax
je 0x40e07e
mov ebx, dword [eax]
test ebx, ebx
je 0x40e020
mov eax, dword [0x41cc5c]
test eax, eax
je 0x40e058
mov esi, dword [eax]
call fcn.0040eca4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_TlsGetValue
push edx
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_SetLastError
push ecx
mov dword [esp + 0x2c], esi
test esi, esi
je 0x40e011
mov ecx, esi
lea ebx, [esp + 0x2c]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x40e003
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 1
mov dword [esp], 1
call eax
cmp eax, 6
je 0x40e030
cmp eax, 8
jne 0x40e068
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x40dfcc
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [0x41cc60]
test eax, eax
je 0x40e09c
mov esi, dword [eax]
jmp 0x40dfbe
mov dword [edi + 0xc], 0
mov eax, dword [esp + 0x2c]
mov dword [edi + 0x10], eax
mov dword [esp + 0x2c], esi
mov edx, ebx
mov eax, edi
call fcn.0040d920
cmp eax, 7
jne 0x40e016
mov eax, ebx
call fcn.0040dbc4
nop
call fcn.0040d9d8
mov dword [0x41cc5c], eax
jmp 0x40dfa1
mov eax, 3
add esp, 0x30
pop ebx
pop esi
pop edi
ret
call fcn.0040db08
jmp 0x40df7d
call fcn.0040da40
mov dword [0x41cc58], eax
jmp 0x40df8a
call fcn.0040da40
mov dword [0x41cc58], eax
jmp 0x40df73
call fcn.0040d9b4
mov dword [0x41cc60], eax
mov esi, dword [eax]
jmp 0x40dfbe

Function at 0x40e18c
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [0x41cc58]
test eax, eax
je 0x40e239
mov eax, dword [eax]
test eax, eax
js 0x40e22f
mov eax, dword [0x41cc58]
test eax, eax
je 0x40e248
mov eax, dword [eax]
test eax, eax
je 0x40e208
mov eax, dword [0x41cc5c]
test eax, eax
je 0x40e223
mov esi, dword [eax]
call fcn.0040eca4
mov edi, eax
mov dword [esp], esi
call sub.KERNEL32.dll_TlsGetValue
push esi
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_SetLastError
push edi
mov dword [esp + 0x1c], esi
lea esi, [esp + 0x1c]
mov edx, esi
mov eax, ebx
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x40e215
call fcn.0040d920
cmp eax, 7
je 0x40e21c
call sub.msvcrt.dll_abort
mov eax, dword [0x41cc60]
test eax, eax
je 0x40e257
mov esi, dword [eax]
jmp 0x40e1e6
call fcn.0040dddc
jmp 0x40e1fe
mov eax, esi
call fcn.0040dbc4
call fcn.0040d9d8
mov dword [0x41cc5c], eax
jmp 0x40e1c9
call fcn.0040db08
jmp 0x40e1ad
call fcn.0040da40
mov dword [0x41cc58], eax
jmp 0x40e1a3
call fcn.0040da40
mov dword [0x41cc58], eax
jmp 0x40e1ba
call fcn.0040d9b4
mov dword [0x41cc60], eax
mov esi, dword [eax]
jmp 0x40e1e6
Function at 0x40e268
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x40e288
mov dword [esp], ebx
call fcn.0040df5c
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov eax, dword [0x41cc58]
test eax, eax
je 0x40e318
mov edi, dword [eax]
test edi, edi
js 0x40e304
mov eax, dword [0x41cc58]
test eax, eax
je 0x40e328
mov esi, dword [eax]
test esi, esi
je 0x40e2f4
mov eax, dword [0x41cc5c]
test eax, eax
je 0x40e348
mov esi, dword [eax]
call fcn.0040eca4
mov edi, eax
mov dword [esp], esi
call sub.KERNEL32.dll_TlsGetValue
push edx
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_SetLastError
push ecx
mov dword [esp + 0x1c], esi
lea edx, [esp + 0x1c]
mov eax, ebx
call fcn.0040dddc
cmp eax, 7
je 0x40e30c
call sub.msvcrt.dll_abort
lea esi, [esi]
mov eax, dword [0x41cc60]
test eax, eax
je 0x40e338
mov esi, dword [eax]
jmp 0x40e2d8
call fcn.0040db08
jmp 0x40e29b
lea eax, [esp + 0x1c]
call fcn.0040dbc4
lea esi, [esi]
call fcn.0040da40
mov dword [0x41cc58], eax
jmp 0x40e295
call fcn.0040da40
mov dword [0x41cc58], eax
jmp 0x40e2a8
call fcn.0040d9b4
mov dword [0x41cc60], eax
mov esi, dword [eax]
jmp 0x40e2d8
call fcn.0040d9d8
mov dword [0x41cc5c], eax
jmp 0x40e2bb

Function at 0x40e4e8
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
push eax
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40e510
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
pop eax
pop ebx
pop esi
jmp fcn.0040ed60
pop eax
pop ebx
pop esi
jmp fcn.0040eca4

Function at 0x40e53c
Capabilities:
Get thread local storage value

Disassembly:
push esi
sub esp, 0x28
call fcn.0040eca4
mov esi, eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push ecx
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_SetLastError
push esi
mov eax, dword [esp + 0x1c]
add esp, 0x28
pop esi
ret

Function at 0x40e56c
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x40e590
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.0040eca4
Function at 0x40e86c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
xor eax, eax
mov ecx, 0xffffffff
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
lea eax, [edx - 1]
mov dword [ebp - 0x20], eax
lea eax, [edx + 0xe]
mov dword [ebp - 0x24], eax
lea eax, [edx + 0x3f]
and eax, 0xfffffff0
call fcn.0040e9e8
sub esp, eax
lea ebx, [esp + 0xc]
mov esi, str.gcc_shmem_tdm2
mov ecx, 0xe
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x1a], 0x2d
lea eax, [esp + 0x1b]
mov edi, eax
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + edx + 0xf]
mov cl, 0x20
mov al, 0x61
mov edi, esi
rep stosb byte es:[edi], al
lea edi, [edx + 0x2f]
mov byte [esp + edi + 0xc], 0
mov edx, dword [ebp - 0x24]
mov byte [esp + edx + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], 0x2d
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
test eax, eax
je 0x40e91c
int3
mov dword [esp], ebx
call sub.KERNEL32.dll_FindAtomA
push ecx
test ax, ax
jne 0x40e9b4
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov esi, eax
mov edx, dword [ebp - 0x20]
add edx, 0x10
mov dword [ebp - 0x20], edx
mov eax, edx
add eax, ebx
mov ecx, 0x20
lea esi, [esi]
mov edx, esi
shr edx, cl
and edx, 1
je 0x40e95c
mov byte [eax], 0x41
inc eax
dec ecx
jne 0x40e950
mov dword [esp], ebx
call sub.KERNEL32.dll_AddAtomA
push edx
test ax, ax
je 0x40e9b0
movzx eax, ax
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
mov ecx, edi
mov edx, ebx
call fcn.0040e7f8
mov ebx, eax
cmp eax, esi
je 0x40e9cd
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_ReleaseMutex
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push edx
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
int3
movzx eax, ax
mov edx, dword [ebp - 0x20]
add edx, 0x10
mov dword [esp], edx
mov ecx, edi
mov edx, ebx
call fcn.0040e7f8
mov ebx, eax
jmp 0x40e98e
xor eax, eax
mov edi, esi
mov ecx, dword [ebp + 0xc]
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40e98e
mov dword [esp], esi
mov eax, dword [ebp + 0x10]
call eax
jmp 0x40e98e
Function at 0x401000
Capabilities:
Check if file exists
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, 1
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
jle 0x401104
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4010fc
mov ecx, dword [edi + 4]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, 0xffffffff
je 0x4010fc
push ebx
push 0
push 0
push 0
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x4010ec
mov edx, dword [ebp + 8]
push edx
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x4010e2
mov edi, dword [esi + 0x3c]
mov eax, 0x5a4d
mov word [esi], ax
cmp dword [edi + esi], 0x4550
jne 0x4010d8
push str.CheckSumMappedFile
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4010d8
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push ecx
push esi
call eax
mov eax, dword [ebp + 8]
cmp dword [ebp - 8], eax
je 0x4010d8
mov dword [edi + esi + 0x58], eax
mov dword [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401682
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x4021a8
call fcn.00401994
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x403678
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x4014a1
cmp eax, esi
jne 0x401494
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4014a4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40147b
xor esi, esi
inc esi
mov eax, dword [0x403674]
cmp eax, esi
jne 0x4014b7
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4014f2
mov eax, dword [0x403674]
test eax, eax
jne 0x4014ec
mov dword [0x403674], esi
push 0x4020b0
push 0x4020a4
call fcn.00401402
pop ecx
pop ecx
test eax, eax
je 0x4014f2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4015bc
mov dword [0x40333c], esi
mov eax, dword [0x403674]
cmp eax, esi
jne 0x401516
push 0x4020a0
push 0x402098
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x403674], 2
cmp dword [ebp - 0x1c], ebx
jne 0x401523
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40367c], ebx
je 0x401544
push 0x40367c
call fcn.004018c4
pop ecx
test eax, eax
je 0x401544
push ebx
push 2
push ebx
call dword [0x40367c]
push dword [0x403324]
push dword [0x403328]
push dword [0x403320]
call fcn.00401000
add esp, 0xc
mov dword [0x403338], eax
cmp dword [0x40332c], ebx
jne 0x4015a2
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x40333c], ebx
jne 0x4015b0
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x403338]
call fcn.004019d9
ret
call fcn.00401ac3
jmp 0x401459
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x91be9c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x91bea6
pushal
call 0x91beac
pop ebp
sub ebp, 0x10
sub ebp, 0x51be9c
jmp 0x91bec2
mov eax, 0x51be9c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5fc
mov edx, 0x64c90823
xor byte [eax], dl
inc eax
dec ecx
jne 0x91bed9
jmp 0x91beec
test al, 0xee
test al, 0xaa
pop ds
and esp, dword [ebx]
and esp, dword [edx + 0x2323dbe2]
and esp, dword [eax]
out dx, al
wait
and eax, 0x99232323
or esp, dword [ebx]
and esp, dword [ebx]
aam 0xc1
and bl, ch
test al, 0xa2
das
and esp, dword [ebx]
and esp, dword [eax]
out 0xae, al
inc edi
pop es
fild qword [edx + 0x47ae0727]
pop es
fild qword [edx - 0x70b4f8d9]
mov gs, word [0x33cc4b23]
pushal
and esp, dword [edx]
sysret
Function at 0xc30eca0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, ecx
lea eax, [esi + 0x350]
push eax
xor edi, edi
push edi
push esi
push 0xc30bbb2
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2e8], eax
cmp eax, edi
je 0xc30ed74
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
push edi
push edi
call ebx
push 0xf
push dword [esi + 0x2e8]
mov dword [esi + 0x2e0], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [esi + 0x34c]
push eax
push edi
push esi
push 0xc30ec76
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2e4], eax
cmp eax, edi
je 0xc30ed59
push edi
push edi
push edi
push edi
call ebx
push 1
push dword [esi + 0x2e4]
mov dword [esi + 0x2dc], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0x18]
mov ecx, dword [eax]
lea edx, [esi + 0x20]
push edx
push edi
push eax
call dword [ecx + 0x1c]
mov ecx, esi
lea edi, [esi + 0x2f0]
call fcn.0c304296
mov dword [edi], eax
mov dword [esi + 0x310], eax
mov eax, edx
mov dword [esi + 0x314], eax
mov dword [edi + 4], edx
xor eax, eax
jmp 0xc30ed79
mov dword [esi + 0x35c], 1
mov esi, dword [esi + 0x2e0]
cmp esi, edi
je 0xc30ed74
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 0x8007000e
pop edi
pop esi
pop ebx
ret

Function at 0xc318737
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0xc32b180]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x108]
push edx
push 0xf003f
push 0
push ecx
push eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xc3187cf
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push edi
mov edi, 0x100
jmp 0xc318799
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x108]
call fcn.0c318737
push edi
lea eax, [ebp - 0x104]
push eax
push 0
push dword [ebp - 0x108]
call esi
test eax, eax
je 0xc318787
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0c328610
leave
ret 8
Function at 0xc3188ee
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0xc32b180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x410], ecx
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
push esi
mov dword [ebp - 0x40c], ecx
cmp edi, ebx
je 0xc318956
push eax
mov esi, 0x400
push esi
lea eax, [ebp - 0x404]
push eax
call fcn.0c3187e2
push 0xc30204c
push esi
lea eax, [ebp - 0x404]
push eax
call fcn.0c31881c
push edi
push esi
lea eax, [ebp - 0x404]
push eax
call fcn.0c31881c
lea eax, [ebp - 0x404]
push ebx
lea ecx, [ebp - 0x408]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0xc3189b0
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x40c]
push 1
push ebx
push dword [ebp - 0x410]
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x408]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0c328610
leave
ret 8
Function at 0xc331226
Capabilities:
Encode data using xor

Disassembly:
call 0xc33119f
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0xc3311cf
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0xc3311eb
xor edx, 0
jmp 0xc3311f6
xor edx, edx
jmp 0xc33120d
jmp 0xc331219
xor eax, eax
push 0x8427d7c0
call 0xc331226
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0xc331262
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0xc33123b
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0xc331279
add eax, 0
jno 0xc33127e
add esi, 0
ret 0x10

Function at 0xc331fe7
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0xc332009
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0xc3321ab
cmp edi, dword [ebp + 0x10]
jb 0xc3321ab
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.0c331ad3
inc edi
jmp 0xc332092
jmp 0xc33209f
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.0c331ad3
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.0c331ad3
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0xc3320f3
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0xc3320d7
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.0c332121
add dword [eax], 0x39
jle 0xc3320fd
sub al, 0xf5
mov ch, al
call fcn.0c332136
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10
Function at 0xc333e0e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0xc333e24
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0xc333e35
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.0c333e76
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx

Function at 0xc3361e2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0xc33612b
add ebx, 0
push ecx
call 0xc336140
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x71ed9260
sub ebx, dword [0x71ef8a9f]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x71ef8a8f
call fcn.0c331c0a
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.0c331118
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0xc33629e
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0xc33629e
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0xc336255
mov eax, 1
lock xchg dword [0x71ef8a9b], eax
push 0x3dd1fc71
call 0xc3361e2
push esi
add esp, 8
cmp eax, 0
jne 0xc3361cb
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0xc3361f1
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0xc336206
cmp ecx, edx
cmp eax, 0
je 0xc33622b
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0xc336215
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.0c336244
dec eax
loope 0xc336247
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x71ef8a9b], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0xc33627b
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0xc336290
jmp 0xc33629b
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0xc336189