joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.5li8laii]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.5li8laii]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.5li8laii]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.5li8laii]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.5li8laii]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.5li8laii]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401b7e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, 0
mov dword [esp], 0
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp + 4], 0x40e000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x401c23
jmp 0x401bc1
mov eax, 0
jmp 0x401c23
test byte [edi + 0xc], 0x10
jne 0x401c00
inc ebx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_realloc
mov esi, eax
test eax, eax
je 0x401bba
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [eax + ebx - 1]
mov dword [esp], eax
call sub.msvcrt.dll_fread
test byte [edi + 0xc], 0x10
je 0x401bc7
lea eax, [ebx - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401b44
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x475de9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x475e17
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x475e35
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00475d53
jmp 0x475e35
mov eax, dword [esi + 0x14]
test eax, eax
je 0x475e35
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00475d53
test edi, edi
mov eax, edi
jne 0x475e1f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4c1a7c]
test ecx, ecx
je 0x475ee8
jmp 0x475de8
ret 8

Function at 0x48d9f0
Capabilities:
Encode data using xor

Disassembly:
inc ebx
sub bp, di
scasb al, byte es:[edi]
push ebp
mov byte [eax + 0x4d94a6f1], dh
dec ebp
cmpsb byte [esi], byte es:[edi]
sbb dword [eax + ecx*2], eax
push esp
mov esp, 0x9252dcae
or eax, dword [ecx + ecx*2 - 0x75]
dec ecx
adc eax, 0xd37ff265
insb byte es:[edi], dx
mov esp, 0x8a4ae09f
xor byte [eax], bl
invalid
jg 0x48d9cf
cmp edx, dword [ebx]
ficomp word [ecx + 0x2041fcb4]
aaa
in al, dx
cld
outsb dx, byte [esi]
jns 0x48d9c4
lodsb al, byte [esi]
xlatb
mov word [esi - 0x21], cs
pop ss
das
dec esi
stosb byte es:[edi], al
invalid
Function at 0x1000ad80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012cd8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10023330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0
call dword [sym.imp.mfc140.dll_Ordinal_316]
push 0x163
mov ecx, esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], 0x163
call dword [sym.imp.mfc140.dll_Ordinal_5095]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x10018edc
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000ae22
lea eax, [ebp - 0x18]
push eax
push edi
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
mov ecx, esi
call dword [sym.imp.mfc140.dll_Ordinal_12503]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c260
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push 0x10018e28
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c2a0
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov esp, ebp
pop ebp
ret

Function at 0x1000c2c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push 0x10018e88
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c300
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov esp, ebp
pop ebp
ret

Function at 0x1000c320
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push 0x10018f10
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c360
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov esp, ebp
pop ebp
ret

Function at 0x1000c440
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10023330]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0x18
lea eax, [ebp - 0x10c]
push eax
push 0xf003f
push 0
push str.AppEventsSchemesAppsExplorerNavigating.Current
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c4d7
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000c4b3
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f27b
mov esp, ebp
pop ebp
ret
Function at 0x6478897a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x647889fa
cmp dword [esi + 0x18], 0
je 0x64788a17
lea ecx, [ecx]
mov ecx, dword [esi + 0x30]
xor eax, eax
cmp word [ecx], ax
je 0x647889d2
lea ebx, [ebx]
inc eax
cmp word [ecx + eax*2], 0
jne 0x647889ca
lea edx, [eax + eax + 2]
push edx
push edi
push ecx
call fcn.647888da
add esp, 0xc
test eax, eax
jne 0x647889f2
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x647889ba
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x64788a17
mov eax, dword [esi + 0x18]
test eax, eax
je 0x64788a17
mov edi, edi
cmp eax, ecx
je 0x647889f2
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x64788a0a
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x64788a4a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x64788a64
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x64788a6b
cmp dword [ebp + 0x18], edx
jne 0x64788a6b
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x3c]
mov ecx, 0x5a4d
cmp word [edi], cx
jne 0x64788a64
cmp dword [eax + edi], 0x4550
jne 0x64788a64
mov ecx, dword [eax + edi + 0x7c]
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x64788a64
push ebx
push esi
mov esi, dword [eax + edi + 0x78]
mov ecx, dword [esi + edi + 0x24]
mov eax, dword [esi + edi + 0x20]
add esi, edi
add ecx, edi
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x1c]
add ecx, edi
mov dword [ebp - 8], ecx
mov ecx, edx
add eax, edi
shr ecx, 0x10
mov dword [ebp + 0xc], eax
test ecx, ecx
je 0x64788b00
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jbe 0x64788b00
jmp 0x64788ac6
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + ebx*4]
add eax, edi
push eax
push edx
call fcn.6478894a
add esp, 8
test eax, eax
jne 0x64788ae6
inc ebx
cmp ebx, dword [esi + 0x18]
jb 0x64788ac0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + ebx*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + edx*4]
add eax, edi
cmp eax, esi
jbe 0x64788b02
add esi, dword [ebp - 0xc]
cmp eax, esi
jae 0x64788b02
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x64788b0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
xor eax, eax
mov ebx, 0x74
mov ecx, ebx
mov word [ebp - 0x2a], cx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x2c]
push esi
mov eax, 0x6e
push ecx
mov dword [ebp - 0x18], 0
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x28], 0x6c0064
Function at 0x64788b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x24], 0x2e006c
mov dword [ebp - 0x20], 0x6c0064
mov dword [ebp - 0x1c], 0x6c
call fcn.64788a2a
push 0
push 0
lea edx, [ebp - 0x44]
push edx
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x44], 0x7250746e
mov dword [ebp - 0x40], 0x6365746f
shr byte [edi + 0x74], 0x65
arpl di, ax
inc ebp
les esi, [esi + edx*2 + 0x69]
jb 0x64788b44
inc ebp
enter 0x7574, 0x61
jne 0x64788be3
insb byte es:[edi], dx
mov dword [ebp - 0x34], 0x6f6d654d
mov word [ebp - 0x30], 0x7972
mov byte [ebp - 0x2e], 0
call fcn.64788a4a
add esp, 0x18
mov esi, eax
call fcn.64788bca
lea ecx, [ebp - 0xc]
push ecx
push 0x40
lea edx, [ebp - 4]
mov dword [ebp - 8], eax
push edx
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
mov dword [ebp - 4], 0x2bf20
call esi
pop esi

Function at 0x64788c50
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
sub esp, 0xffffffc8
call 0x64788be5
mov edi, dword [esp]
add edi, 0x14
mov ecx, 0x29e00
mov al, 0xf4
add al, 0xe0
xor byte [edi], al
inc edi
loopne 0x64788bf2
cdq
out dx, al
shl dword [esi], 1
mov esp, 0xd4f41434
in al, dx
pop ss
pushfd
pop ebp
mov edi, 0x881477dc
pop ds
je 0x64788c65
cmc
xchg edi, eax
xor al, 0xfc
mov bh, 0x9c
mov esi, dword [ebp - 0x2b0beb5c]
mov ah, 0x94
je 0x64788c72
xor al, 0x14
hlt
push esp
sbb byte [0x950cf539], 0x38
cdq
adc eax, 0xc7bd9c40
mov ah, 4
pop ebx
jae 0x64788bd7
invalid
xchg byte [ebp + 0x3517b4d9], dh
pop edx
jp 0x64788bf4
mov ch, 0xd9
mov ah, 0x17
xor eax, 0xa09b7a5a
xchg esp, eax
not byte [ecx]
je 0x64788ca5
mov al, byte [0x7411f694]
inc esi
popal
lcall 0x7b10, 0x54faddf4
inc edi
adc byte [ebx + 0x47], bh
aam 0xb9
fcomi st(0)
adc dword [edx + 0x39], edi
sbb esi, edi
invalid
mov ah, 0x94
je 0x64788cca
xor al, 0x14
hlt
jg 0x64788c3d
in eax, 0xcf
invalid
iretd
mov ah, 0x94
je 0x64788c82
xor al, 0x16
cmc
fbstp tbyte [ebp - 0x47ab8b62]
push ss
hlt
Function at 0x64790680
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x8cd93f20
fcompi st(5)
jecxz 0x647906a5
invalid
and al, 0xf7
jb 0x647906a1
div dword [edx + 0x1d]
sub dword [eax + 0x17ffcd17], ebp
aas
leave
mov ch, bl
popal
in al, dx
xor eax, 0xa497b116
push edi
mov al, byte [0x4b2a48a9]
imul edi, edi, 0x11
rcr byte [ecx - 0x12d22990], 0xf6
jo 0x64790678
salc
sub eax, 0xbf0ef6ed
in eax, dx
test byte [esi], 0xbf
push cs
mov edi, 0xc15d0c41
pushal
mov ch, 0x9d
inc ecx
or al, 0x5d
shl dword [eax - 0x4b], 0x9d
lahf
push es
and esp, dword [edx - 0x49]
xchg ebp, ebx
jns 0x647906a0
xlatb
push ds
mov edi, 0xc019ff65
popfd
mov cl, 0x2c
jne 0x64790718
jno 0x6479071d
pop ss
jo 0x64790733
je 0x64790736
mov ebp, dword [ebx + 0x590049bd]
add byte [ebp + ebp*8 + 0x7f4eb62d], bl
cdq
dec esp
pop ds
xor dword [eax + 0x5ff6def5], ebp
insd dword es:[edi], dx
sbb eax, 0x61bda821
or al, 0x23
mov bh, 0xa5
ja 0x647906db
aad 0x32
sar dword [edi - 0x3ffe00b2], 1
pop ss
pop es
xlatb
add byte [ecx], ch
mov al, 0xaa
stosb byte es:[edi], al
retf
xchg ecx, eax
inc eax
pop ds
xor dword [ecx + edi*4 - 0x32b21d60], ebp
push ss
fbld tbyte cs:[ecx - 0x18]
xor eax, 0xb317b61d
push ecx
mov edi, 0x4c897dca
jge 0x647906a3
dec esp
sbb eax, 0xebb7a809
loopne 0x647906fd
test al, 0xb7
jmp 0x64790701
cmp byte [esi - 0x76], ah
stosd dword es:[edi], eax
retf
cmpsd dword [esi], dword es:[edi]
lodsb al, byte [esi]
push edi
invalid

Function at 0x647951f0
Capabilities:
Encode data using xor

Disassembly:
xor al, 0xa0
movsb byte es:[edi], byte [esi]
sbb ecx, esi
lodsb al, byte [esi]
leave
jmp 0x64795204
sub bl, bh
ror dword [ecx + 0x37], 1
cmp dword [edi], 0x49df2378
sbb al, 0x7f
push ebx
insb byte es:[edi], dx
xchg ebx, eax
je 0x6479526a
mov bh, 0xac
int3
aas
js 0x6479528f
fild word [ecx + 0x1c]
mov byte [0x74dfa73c], al
push esp
invalid
adc al, 0xa2
cmp al, 0xa7
mov ah, 0x74
push esp
invalid

Function at 0x64796af0
Capabilities:
Encode data using xor

Disassembly:
in al, 0x93
adc al, 0xf4
pop ecx
stc
add al, 0x25
fucompi st(4)
cld
add dword [edx - 0x4c], esi
xchg esp, eax
stc
add eax, eax
cdq
mov al, 0xd7
mov bh, 0xc6
and al, 0xdd
jno 0x64796ad4
sbb al, 0x40
adc edx, dword [esp + esi*2 - 0x4e601321]
enter 0x52e4, 0x37
je 0x64796ab5
in al, dx
lahf
mov cl, 0xc8
in al, 0x52
aaa
test eax, 0x7221fc34
mov ah, 0x94
call [ecx]
sub byte [esp - 0x7b], dl
loop 0x64796b68
invalid
jg 0x64796ab5
aas
sar dword [esi + eax + 0x5e], 1
adc al, 0x9e
aam 0xe2
les ebx, [esp + ecx + 0x5ff4143f]
stc
test bh, bh
add dword [eax], edi
lahf
mov cl, 0xdc
in eax, 0xc3
add al, 0xdc
jb 0x64796b1f
sub ecx, dword [ebx + 0x17]
mov al, 0x1c
mov ecx, 0x37852059
push edi
mov al, byte [edi]
fcom qword [edx + 0x53]
push edx
push ebx
aam 0xb4
pop ds
lodsb al, byte [esi]
xlatb
invalid
invalid
Function at 0x647d45c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
push esi
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
je 0x647d462e
test edx, edx
je 0x647d462e
push 0
lea eax, [ebp - 8]
push eax
push 0
push 2
push 0
push 0
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x647d4617
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x647d4633
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
jmp 0x647d4633
mov esi, 0x57
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.648031e0
mov esp, ebp
pop ebp
ret

Function at 0x647d4650
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
push esi
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
je 0x647d46be
test edx, edx
je 0x647d46be
push 0
lea eax, [ebp - 8]
push eax
push 0
push 2
push 0
push 0
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x647d46a7
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x647d46c3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
jmp 0x647d46c3
mov esi, 0x57
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.648031e0
mov esp, ebp
pop ebp
ret
Function at 0x647e1dc0
Capabilities:
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44
lea eax, [ebp - 0x50]
mov edi, edx
push 0
push eax
mov esi, ecx
call fcn.6480764e
add esp, 0xc
mov dword [ebp - 0x50], 0x44
lea eax, [ebp - 0x60]
xorps xmm0, xmm0
movups xmmword [ebp - 0x60], xmm0
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x24
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
test bl, bl
je 0x647e1e6b
push dword [ebp - 0x58]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test edi, edi
je 0x647e1e46
push 0xffffffffffffffff
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.648031e0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.648031e0
mov esp, ebp
pop ebp
ret
Function at 0x647f5740
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64817a28
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
xorps xmm0, xmm0
xor esi, esi
push edi
movq qword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x647f5799
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x647f5846
cmp dword [ebp - 0x28], esi
je 0x647f57a8
mov esi, 0xdf
jmp 0x647f5846
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push dword [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x24], xmm0
call fcn.647f5ac0
push 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x647f5806
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x24]
mov esi, eax
test ecx, ecx
je 0x647f5846
mov eax, dword [ebp - 0x1c]
push 1
sub eax, ecx
push eax
push ecx
call int.64788c50
add esp, 0xc
jmp 0x647f5846
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
call fcn.647e7e80
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.647f5870
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x647f5846
mov eax, dword [ebp - 0x1c]
push 1
sub eax, ecx
push eax
push ecx
call int.64788c50
add esp, 0xc
jmp 0x647f5846
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.648031e0
mov esp, ebp
pop ebp
ret 4
Function at 0x647f8850
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push ebx
movzx eax, byte [edx]
xor eax, 0x811c9dc5
mov dword [ebp - 8], edx
push esi
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
mov esi, dword [edi + 0xc]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx + ecx]
mov ecx, dword [edi + 4]
lea edi, [esi + edx*4]
mov ebx, dword [esi + edx*4]
mov esi, dword [ebp - 8]
nop dword [eax]
cmp ebx, ecx
jne 0x647f88c8
mov edx, ecx
jmp 0x647f88cd
mov edx, dword [edi + 4]
mov edx, dword [edx]
cmp eax, edx
je 0x647f8921
mov edx, dword [eax + 8]
cmp edx, dword [esi]
je 0x647f88dc
mov eax, dword [eax]
jmp 0x647f88c0
mov esi, dword [esi]
mov edx, eax
mov dword [ebp - 8], esi
cmp ebx, ecx
jne 0x647f88eb
mov esi, ecx
jmp 0x647f88f0
mov esi, dword [edi + 4]
mov esi, dword [esi]
cmp eax, esi
je 0x647f8900
mov esi, dword [ebp - 8]
cmp esi, dword [eax + 8]
jne 0x647f8900
mov eax, dword [eax]
jmp 0x647f88e3
cmp edx, eax
je 0x647f8921
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.648031e0
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.648031e0
mov esp, ebp
pop ebp
ret 8

Function at 0x647f8940
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov edx, dword [esi + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 8]
nop dword [eax]
cmp dword [ebp - 0xc], esi
jne 0x647f89b9
mov ecx, esi
jmp 0x647f89be
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x647f89d9
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x647f89cd
mov eax, dword [eax]
jmp 0x647f89b0
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
cmovne eax, esi
mov dword [ebx], eax
jmp 0x647f89db
mov dword [ebx], esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.648031e0
mov esp, ebp
pop ebp
ret 8