joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401443
pop dword [ebp - 0x30]
mov eax, 0xecc15e29
sub eax, 0xec8149e6
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x643c3fc1
sub dword [ebp - 0x40], 0x15e9fa76
mov dword [ebp - 0x3c], 0x8a9c0675
add dword [ebp - 0x3c], 0xa79745d0
mov dword [ebp - 0x38], 0xfaac6283
add dword [ebp - 0x38], 0x519fe1ab
mov dword [ebp - 0x34], 0x915af750
sub dword [ebp - 0x34], 0x915af750
lea eax, [ebp - 0x40]
push eax
mov eax, 0x6969a6ae
sub eax, 0x6929356a
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xa3b76a14
sub dword [ebp - 0x40], 0x2f4500be
mov dword [ebp - 0x3c], 0xde770d38
sub dword [ebp - 0x3c], 0x9d0aabc3
mov dword [ebp - 0x38], 0xda7e4eee
sub dword [ebp - 0x38], 0x770ee282
mov dword [ebp - 0x34], 0x49e6ccb4
add dword [ebp - 0x34], 0xb619334c
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3c30d
push 0
call eax
mov ecx, 0x346eaa1e
sub ecx, 0x346e51bc
xor esi, esi
add esi, eax
mov edi, 0xcfdd284c
add edi, 0x306637b4
add edi, dword [ebp - 0x30]
mov ebx, 0x2ae85191
sub ebx, 0x2ef80bce
xor dword [ebp - 0x14], eax
mov edx, dword [edi]
sub edx, ebx
add dword [ebp - 4], ecx
mov dword [esi], edx
add esi, 0xb25226fa
sub esi, 0xb25226f6
add edi, 0xb88624d2
sub edi, 0xb88624ce
loop 0x401562
add eax, 0x1545b
xor ebx, ebx
add ebx, eax
add eax, 0xd4a9b178
add eax, 0x2b564e8d
mov ecx, 0x37a1fef
add ecx, 0xfcc5e011
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x402a69
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x424010]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402afd
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402aba
cmp dword [ebp + 0x10], ebx
jne 0x402af1
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402acc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402aa1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.004060b1
cmp eax, ebx
je 0x402b04
push ebx
push dword [0x424010]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x424010], ebx
jne 0x402afa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402afa
jmp 0x402afd
Function at 0x406120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422af4], 0
push esi
jne 0x406157
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406131
mov dword [ecx*4 + 0x422af0], eax
inc ecx
cmp ecx, 0x100
jl 0x40612c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406188
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422af0]
xor eax, esi
inc ecx
dec edx
jne 0x40616a
pop edi
not eax
pop esi
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x56406ed6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x69f85aff
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40233f
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4051f8
call fcn.00402861
push 1
call fcn.004023c2
pop ecx
test al, al
jne 0x4021e8
push 7
call fcn.00402a74
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040238d
mov byte [ebp - 0x24], al
mov eax, dword [0x40633c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4021e1
test eax, eax
jne 0x402252
mov dword [0x40633c], ecx
push 0x40429c
push 0x404284
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x402235
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402339
push 0x404280
push 0x40426c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x40633c], 2
jmp 0x402257
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040251f
pop ecx
call fcn.00402a68
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x402287
push esi
call fcn.00402492
pop ecx
test al, al
je 0x402287
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00402ca3
call esi
call fcn.00402a6e
mov esi, eax
cmp dword [esi], edi
je 0x4022a5
push esi
call fcn.00402492
pop ecx
test al, al
je 0x4022a5
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00402b89
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00402bbc
test al, al
jne 0x4022de
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4022e7
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040253c
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x402339
call fcn.004028a7
ret
call fcn.00402059
jmp 0x4021c9

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x233e21c2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..rsrc
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x22f506b7
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001c10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10001c2b
push 0
push 0
push 0x10001be0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
mov eax, 1
pop ebp
ret 0xc
Function at 0x12186058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x121861a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1218607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1218606a
add dl, dl
jne 0x12186089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x121860dc
xor eax, eax
add dl, dl
jne 0x12186096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1218617d
add dl, dl
jne 0x121860a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x121860b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x121860bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x121860c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x121860d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x12186075
mov eax, 1
add dl, dl
jne 0x121860ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x121860f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x121860e1
sub eax, ebx
mov ebx, 1
jne 0x12186128
mov ecx, 1
add dl, dl
jne 0x1218610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x12186119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x12186105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12186075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1218613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1218614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x12186136
cmp eax, 0x7d00
jae 0x1218616d
cmp eax, 0x500
jb 0x12186168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12186075
cmp eax, 0x7f
ja 0x12186170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x12186075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1218619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x12186075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xe3f628
Capabilities:
Encode data using xor

Disassembly:
cdq
popal
sbb dword [esp + ecx*8], 0x14
and byte [ebx + 0x8eb7437], 0
jmp 0xe3f632
add byte [esi + 4], bh
jmp 0xe3f632
add byte [eax], al
add byte [eax], al
add byte [eax - 0x18], ah
add byte [eax], al
add byte [eax], al
pushal
call 0xe3f638
pop ebp
sub ebp, 0x10
sub ebp, 0xa3f628
jmp 0xe3f64e
mov eax, 0xa3f628
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a1
mov edx, 0xa6f3eb69
mov eax, dword [0xba000005]
imul ebp, ebx, 0x1030a6f3
xor byte [eax], dl
inc eax
dec ecx
jne 0xe3f665
jmp 0xe3f678
loop 0xe3f61e
loop 0xe3f65c
push ebp
imul ebp, dword [ecx + 0x69], 0x6991a8e8
imul ebp, dword [ecx + 0x6a], 0x696dd1a4
imul ebp, dword [ecx - 0x2d], 0x69696941
call 0x6a4d882d
imul ebp, dword [edx - 0x5c], 0x69696dd1
imul edx, ebx, 0x69696941
sahf
mov ebp, dword [edx - 0x5f]
loop 0xe3f680
imul ebp, dword gs:[ecx + 0x69], 0x3939ac6a
add dword [0x169488d], ebx
fnstsw word [eax - 0x15]
imul ebp, dword [eax + 0x45], 0xcaeb014d
pop esi
sbb eax, 0x69696c81
imul eax, dword [eax + 0x6969695f], 0x954d0de4
loopne 0xe3f707
dec ebp
in al, 5
dec ebp
imul esp, edx, 0x696961ec
imul esp, edx, 0x696965fc
imul esp, edx, 0x696979e4
imul ebp, dword [eax + 0x6b586b80], 0x206dabea
in al, dx
popfd
xchg esi, eax
xchg esi, eax
xchg esi, eax
loop 0xe3f72f
dec ebp
in al, 0xd
dec ebp
insd dword es:[edi], dx
stosd dword es:[edi], eax
imul esp, edx, 0x696d4de5
imul ebp, dword [ecx + 1], 0x69488d1d
add ebp, ebx
js 0xe3f6ed
insd dword es:[edi], dx
imul ebp, dword [ecx + 0x69], 0x488d1d01
imul eax, dword [ecx], 0x69eb78dd
push 0x81384d45
insb byte es:[edi], dx
imul ebp, dword [eax + 0x45], 0x6c81384d
sub dword [ecx + ebp*2 + 0x69], 0x6b5a8069
imul ebp, dword [ecx + 0x3c], 0x1c96343d
xchg esi, eax
sbb al, 0x61
or dword [edi], 0xe2696969
aam 0x61
imul ebp, dword [ecx + 0x69], 0x696b5a80
imul edi, dword [edi + 0x651c9634], 0x81611c96
punpckhwd mm5, qword [ecx + 0x69]
loop 0xe3f6f5
popal
imul ebp, dword [ecx + 0x69], 0xbb5aa05a
ljmp 0x27ed
daa
imul ebp, dword [ecx + 0x69], 0x6921e166
imul ebp, dword [ecx + 0xf], 0xe95075e2
xchg edx, eax
and dword [esi - 0x13], 0x69696973
jmp 0xee4a77dd

Function at 0x402a81
Capabilities:
Parse pe header

Disassembly:
test ecx, ecx
jne 0x402a88
xor al, al
ret
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x402a85
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x402a85
mov eax, dword [eax + 0x98]
test eax, eax
je 0x402aae
lea edx, [eax + ecx]
jmp 0x402ab0
xor edx, edx
test edx, edx
je 0x402a85
lea eax, [edx + 8]
test eax, eax
je 0x402a85
cmp byte [eax], 0x30
lea ecx, [eax + 1]
jne 0x402adf
mov al, byte [ecx]
inc ecx
cmp al, 0x82
jne 0x402adf
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 1]
shl eax, 8
lea eax, [eax + ecx + 0x13]
and eax, 0xffffff8
jmp 0x402ae1
xor eax, eax
test eax, eax
je 0x402a85
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], edx
mov al, 1
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x44b651
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x44b66e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x44b65f
add dl, dl
jne 0x44b679
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x44b6c5
xor eax, eax
add dl, dl
jne 0x44b686
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x44b762
add dl, dl
jne 0x44b695
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x44b6a0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x44b6ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x44b6b6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x44b6c0
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x44b665
mov eax, 1
add dl, dl
jne 0x44b6d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x44b6de
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x44b6ca
sub eax, 2
jne 0x44b70d
mov ecx, 1
add dl, dl
jne 0x44b6f3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x44b6fe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x44b6ea
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x44b665
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x44b724
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x44b72f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x44b71b
cmp eax, 0x7d00
jae 0x44b752
cmp eax, 0x500
jb 0x44b74d
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x44b665
cmp eax, 0x7f
ja 0x44b755
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x44b665
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x44b77e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x44b665
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x405b32
pop dword [ebp - 0x38]
mov eax, 0x174dc7a2
sub eax, 0x170d6c70
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x8696f7f3
sub dword [ebp - 0x48], 0x3844b2a8
mov dword [ebp - 0x44], 0x99701a
add dword [ebp - 0x44], 0x3199dc2b
mov dword [ebp - 0x40], 0x60c6c0ec
sub dword [ebp - 0x40], 0x147a7cbe
mov dword [ebp - 0x3c], 0xad7531d3
sub dword [ebp - 0x3c], 0xad7531d3
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xf14a8369
sub dword [ebp - 0x48], 0x7cd81a13
mov dword [ebp - 0x44], 0x9927b1a8
add dword [ebp - 0x44], 0xa844afcd
mov dword [ebp - 0x40], 0x7cdcbd0c
sub dword [ebp - 0x40], 0x196d50a0
mov dword [ebp - 0x3c], 0xbd0b1713
add dword [ebp - 0x3c], 0x42f4e8ed
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x986a9d2d
sub eax, 0x982a1cb1
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3c998
push 0
call eax
mov ecx, 0x15931156
add ecx, 0xea6d4d06
mov edx, eax
mov esi, 0x550bd267
sub esi, 0x54c64067
add esi, dword [ebp - 0x38]
mov ebx, 0xcfd0c2cb
add ebx, 0xee2ddd85
sub dword [ebp - 0xc], 0xfb1ebbdb
mov edi, dword [esi]
add dword [ebp - 0x2c], 0x9db69e91
xor edi, ebx
sub dword [ebp - 0x14], 0x31617e6f
mov dword [edx], edi
add dword [ebp - 0x1c], ebx
add edx, 4
add esi, 0x296d49eb
add esi, 0xd692b619
loop 0x405c4f
add eax, 0x604568f4
sub eax, 0x6043fcb1
mov ebx, eax
add eax, 0xfa831445
sub eax, 0xfa831440
mov ecx, 0xbab58809
add ecx, 0x458a77f7
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc

Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call 0x40c300
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.513hojhv]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.513hojhv]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.513hojhv]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.513hojhv]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.513hojhv]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.513hojhv]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402b70
Capabilities:
Set registry value

Disassembly:
cmp dword [edi], 0
jne 0x402b96
push str.m_hKey___0
push 0
push 0x1621
push 0x42a9e8
push 2
call fcn.004075b0
add esp, 0x14
cmp eax, 1
jne 0x402b96
int3
xor eax, eax
test esi, esi
setne al
test eax, eax
jne 0x402bc9
push str.__atl_condVal
push eax
push 0x1622
push 0x42a9e8
push 2
call fcn.004075b0
add esp, 0x14
cmp eax, 1
jne 0x402bc1
int3
mov eax, 0xd
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 4]
mov edx, dword [edi]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 4

Function at 0x402c60
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax], 0
push ebp
mov ebp, dword [esp + 0x10]
jne 0x402c8f
push str.m_hKey___0
push 0
push 0x162e
push 0x42a9e8
push 2
call fcn.004075b0
add esp, 0x14
cmp eax, 1
jne 0x402c8f
int3
xor eax, eax
test ebp, ebp
setne al
test eax, eax
jne 0x402cc3
push str.__atl_condVal
push eax
push 0x162f
push 0x42a9e8
push 2
call fcn.004075b0
add esp, 0x14
cmp eax, 1
jne 0x402cba
int3
mov eax, 0xd
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x402cd0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push edi
push ebp
push 7
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x402d30
Capabilities:
Set registry value

Disassembly:
cmp dword [esi], 0
jne 0x402d56
push str.m_hKey___0
push 0
push 0x1615
push 0x42a9e8
push 2
call fcn.004075b0
add esp, 0x14
cmp eax, 1
jne 0x402d56
int3
mov ecx, dword [esp + 4]
mov edx, dword [esi]
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8