joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10070f7c
Capabilities:
Get thread local storage value

Disassembly:
push 4
mov eax, 0x100da5f0
call fcn.100157c2
mov ebx, ecx
mov eax, dword [ebx + 0xc]
push dword [eax + 0x70]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1007103b
push 0
pop edi
and eax, 3
je 0x10070fc4
cmp eax, 1
jne 0x10070fcd
and esi, 0xfffffffe
mov esi, dword [esi + 0x10]
add esi, 8
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10070fc4
mov al, byte [eax + 0x44]
test al, al
jne 0x1007103b
mov ecx, esi
call fcn.10068350
jmp 0x10071002
and esi, 0xfffffffd
lea ecx, [esi + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x10], ecx
call dword [eax + 0x10]
mov esi, dword [esi + 0x20]
mov eax, dword [esi + 0x2c]
add esi, 0x10
test eax, eax
je 0x10070ff3
mov al, byte [eax + 0x44]
test al, al
je 0x10070ff3
mov esi, edi
jmp 0x10070ffa
mov ecx, esi
call fcn.10068350
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x14]
test esi, esi
je 0x1007103b
cmp dword [esi + 0x14], ebx
je 0x10071035
push 0x3c
call sym.MSVCR120.dll__j1
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x10071028
push esi
push ebx
mov ecx, eax
call sym.MSVCR120.dll__j1
mov edi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.10068350
jmp 0x10071037
mov edi, esi
mov eax, edi
jmp 0x1007103d
xor eax, eax
call fcn.100157f5
ret

Function at 0x10073f6d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x100db7e8
call fcn.100157c2
mov edi, ecx
mov dword [ebp - 0x10], edi
or dword [edi + 4], 0xfffffff
lea ecx, [edi + 0x3c]
xor esi, esi
mov dword [edi + 8], esi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], 0x80000000
mov dword [edi + 0x18], esi
mov dword [edi + 0x38], esi
call sym.MSVCR120.dll_public:_void___thiscall_Concurrency::event::constructor_void_
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
call sym.MSVCR120.dll__j1
mov dword [edi + 0xc], eax
mov eax, dword [eax + 0x34]
mov dword [edi], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
test eax, eax
je 0x10073fe8
cmp eax, 2
je 0x10073fe8
xor edx, edx
add eax, 4
inc edx
lock xadd dword [eax], edx
mov ecx, edi
call fcn.10074d68
lea ecx, [edi + 0x3c]
call sym.MSVCR120.dll_public:_void___thiscall_Concurrency::event::set_void_
cmp byte [ebp + 0xc], 0
je 0x10074029
mov edx, dword [edi + 0x64]
mov ecx, edi
add edx, 0x68
mov esi, dword [edx]
mov eax, esi
mov dword [edi + 0x68], esi
lock cmpxchg dword [edx], ecx
jmp 0x10074023
mov dword [edi + 0x68], eax
mov esi, eax
mov ecx, dword [edi + 0x64]
mov edx, edi
add ecx, 0x68
lock cmpxchg dword [ecx], edx
cmp eax, esi
je 0x10074031
jmp 0x10074012
or dword [edi + 0x78], 1
and dword [edi + 0x68], 0
call fcn.1001ffa7
mov esi, eax
cmp dword [esi + 0x20], 0
jne 0x10074045
mov ecx, esi
call fcn.10065b8a
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x40]
and dword [edi + 4], 0xfffffff
mov dword [edi + 0x80], eax
mov eax, edi
call fcn.100157f5
ret 8
Function at 0x10075d62
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100de7b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100e3510]
test dword [ebp + 8], eax
je 0x10075dfc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x808]
call sym.MSVCR120.dll__j1
xor eax, eax
mov word [ebp - 8], ax
mov eax, dword [0x100dfd60]
pop ecx
test eax, eax
je 0x10075def
push esi
push edi
lea ecx, [ebp - 0x808]
push ecx
push eax
call sym.MSVCR120.dll_fwprintf
mov edi, dword [0x100e3524]
mov esi, dword [0x100e3520]
pop ecx
pop ecx
push 0
push 0x32
push edi
push esi
call fcn.10032225
add esi, 1
mov dword [0x100e3520], esi
adc edi, 0
or eax, edx
mov dword [0x100e3524], edi
pop edi
pop esi
jne 0x10075dfc
push dword [0x100dfd60]
call sym.MSVCR120.dll_fflush
pop ecx
jmp 0x10075dfc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010cbc
mov esp, ebp
pop ebp
ret

Function at 0x100c0f1e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100c0f2d
pop dword [ebp - 0x1c]
mov eax, 0x100c0f2d
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x5e8a9
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x8a0ad086
add ecx, 0x75f57c41
xor esi, esi
add esi, eax
mov edi, 0x258b0453
add edi, 0xea83c9ad
add edi, dword [ebp - 0x1c]
mov ebx, 0xde54e11e
add ebx, 0x52b75181
add dword [ebp - 0xc], ebx
mov edx, dword [edi]
xor dword [ebp - 0x10], esi
xor edx, ebx
mov dword [esi], edx
sub dword [ebp - 0x10], edi
add esi, 0xbed8ac4a
add esi, 0x412753ba
add edi, 0x12a4a8e3
sub edi, 0x12a4a8df
loop 0x100c0f84
add eax, 0xf4d9227e
add eax, 0xb280371
mov ebx, eax
add eax, 5
mov ecx, 0xa5565a50
sub ecx, 0x95565a50
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401360
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485546
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x4911b8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov dword [ebp - 0xb8], 0
jmp 0x4013bd
push dword [0x491b44]
call fcn.0046a0d0
push eax
push dword [ebp - 0xb8]
call fcn.0046a6d0
jmp 0x4013db
push 0x40
push 0x3000
push dword [0x491b44]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push eax
pop dword [ebp - 0xb8]
jmp 0x4013a4
mov ecx, 2
cmp dword [0x491b44], ecx
jbe 0x401405
nop dword [eax + eax]
mov eax, dword [ebp - 0xb8]
xor byte [ecx + eax], 0x15
add ecx, 3
cmp ecx, dword [0x491b44]
jb 0x4013f0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [0x491b40]
call fcn.004070c0
push eax
call dword [ebp - 0xb8]
xor ecx, ecx
mov eax, 0x401350
test eax, eax
mov dword [ebp - 0x90], ecx
setne al
test al, al
je 0x401455
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xb4], vtable.std::_Func_impl_void____cdecl___int___class_std::allocator_int___void__int_.0

Function at 0x47cf55
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047cdd4
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10003ece
pop dword [ebp - 0xc]
mov eax, 0xf6504446
sub eax, 0xe6500578
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x18c9732a
sub dword [ebp - 0x1c], 0xca772ddf
mov dword [ebp - 0x18], 0x417f46be
sub dword [ebp - 0x18], 0xf4bfa79
mov dword [ebp - 0x14], 0x57762774
sub dword [ebp - 0x14], 0xb29e346
mov dword [ebp - 0x10], 0x88c06506
add dword [ebp - 0x10], 0x773f9afa
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xcd6bed85
sub eax, 0xbd6b9d41
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x9923edc2
sub dword [ebp - 0x1c], 0x24b1846c
mov dword [ebp - 0x18], 0x4d264901
sub dword [ebp - 0x18], 0xbb9e78c
mov dword [ebp - 0x14], 0x5e10d46f
sub dword [ebp - 0x14], 0xfaa16803
mov dword [ebp - 0x10], 0xbcf64998
add dword [ebp - 0x10], 0x4309b668
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x39d12
push 0
call eax
mov ecx, 0xa3aae535
sub ecx, 0xa3aa9079
xor ebx, ebx
add ebx, eax
mov edi, 0x1000b600
add edi, dword [ebp - 0xc]
mov edx, 0xb49b22cf
xor dword [ebp - 4], 0x4731ceba
mov esi, dword [edi]
mov dword [ebp - 8], 0x2191bd71
sub esi, edx
xor dword [ebp - 8], edx
mov dword [ebx], esi
xor dword [ebp - 8], esi
add ebx, 4
add edi, 0x9aa5791d
add edi, 0x655a86e7
loop 0x10003fe1
add eax, 0xd742bfff
sub eax, 0xd7417a3c
mov ebx, eax
add eax, 0xea52fbe
sub eax, 0xea52fb9
mov ecx, 0x652ab9e1
sub ecx, 0x552ab9e1
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4022c6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push 0x80000301
push 0
push 3
push 0x80000004
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40231a
mov eax, 0x413329
push eax
push 2
mov ebx, 0x134
call fcn.004089c0
add esp, 0x1c
mov dword [ebp - 0x1c], eax
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402343
mov eax, 0x413329
push eax
push 1
mov ebx, 0x130
call fcn.00408a10
add esp, 0x10
mov dword [ebp - 0x20], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x40236c
mov eax, 0x413329
push eax
push 1
mov ebx, 0x130
call fcn.00408a10
add esp, 0x10
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x20]
push dword [ebp - 8]
push dword [ebp - 0x1c]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
nop
nop
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4023b5
push ebx
call fcn.00406be6
add esp, 4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4023cf
mov eax, 0
jmp 0x40241d
push 0x80000301
push 0
push 0x40
push 0x80000301
push 0
push dword [ebp - 0x14]
push 2
mov ebx, 0xc4
call fcn.00408a20
add esp, 0x1c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x40
jne 0x402413
mov eax, 1
jmp 0x40241d
mov eax, 0
jmp 0x40241d
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40242e
push ebx
call fcn.00406be6
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40243e
push ebx
call fcn.00406be6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x405389
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x4053d0
cmp ebx, 0x20
je 0x4053d0
cmp ebx, 0xffffffe0
je 0x4053d0
jne 0x4053d9
add eax, 1
cmp esi, eax
je 0x4053e6
jne 0x4053b5
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x4053ea
jne 0x4053b1
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x4053fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x4054bf
test ecx, ecx
je 0x4054bf
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x4054bf
test ebx, ebx
je 0x4054bf
mov ebx, eax
add ebx, edx
je 0x4054bf
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x4054bf
cmp dword [edx + eax + 0x14], 0
je 0x4054bf
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x4054bf
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4054af
test dl, dl
je 0x4054ab
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4054af
add edi, 2
add esi, 2
test dl, dl
jne 0x40548f
xor eax, eax
jmp 0x4054b4
sbb eax, eax
or eax, 1
test eax, eax
je 0x4054cb
inc ebp
cmp ebp, dword [esp + 4]
jb 0x40547c
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x40642c
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40645a
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x406451
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x406449
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x40647b
mov esp, ebp
pop ebp
ret

Function at 0x40647f
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x4064eb
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x406518
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x406507
xor ecx, eax
xor edx, ebx
dec edi
jne 0x4064f8
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x40653e
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x4064df
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x40656a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407360
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.00409cb0
mov edi, dword [esp + 0x28]
mov ebp, eax
push edi
xor esi, esi
call dword [0x433f40]
add esp, 8
test ebp, ebp
je 0x40742a
test eax, eax
je 0x40742a
inc eax
push ebx
push eax
call fcn.0040a287
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a260
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4073cc
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407406
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x407419
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call fcn.0040a251
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x408d10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [esp + 0x11c]
push ebp
push esi
push edi
push eax
call fcn.00409cb0
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov ebp, eax
mov dword [esp + 0x18], esi
call dword [0x433f40]
add esp, 8
test ebp, ebp
je 0x408df7
test eax, eax
je 0x408df7
inc eax
push ebx
push eax
call fcn.0040a287
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a260
mov esi, eax
add esp, 0xc
test esi, esi
je 0x408d8b
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x408ddf
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push esi
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x408dcc
cmp eax, 0xea
jne 0x408dd4
mov dword [esp + 0x14], 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0040a251
mov eax, dword [esp + 0x18]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x114
ret
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x114
ret
Function at 0x408e10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00409cb0
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call dword [0x433f40]
add esp, 8
test ebx, ebx
je 0x408f54
test eax, eax
je 0x408f54
inc eax
push eax
call fcn.0040a287
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a260
mov edi, eax
add esp, 0xc
test edi, edi
je 0x408e82
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x408f41
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.0040a287
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x408f0a
cmp eax, 0xea
jne 0x408f2d
push esi
call fcn.0040a251
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0040a287
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x408ed5
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x408f18
cmp eax, 2
jne 0x408f2d
push esi
call dword [0x433f40]
push eax
push esi
call fcn.00409d00
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call fcn.0040a251
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0040a251
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x408f7d
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x408f89
mov esi, dword [esp + 0x40]
test esi, esi
je 0x408f89
push esi
call dword [0x433f40]
push eax
push esi
call fcn.00409d00
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x409170
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x40918e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x409183
pop esi
ret
Function at 0x4097f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x409822
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], 0x100
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x409882
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x409859
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x409930
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x4099cc
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x40995b
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret