joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413033
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056f390
push 0x5a0a54
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.00408d5e
add esp, 0x18
call fcn.0042a8b9
test al, al
je 0x41308d
mov esi, 0x2648eef3
push edi
lea esi, [ebp - 0x2c79bd3d]
xchg edx, eax
xchg esi, eax
sub ebp, dword [edi]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.0056935c
mov esp, ebp
pop ebp
ret

Function at 0x4130e4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0056f390
add esp, 0xc
call fcn.0042ad4e
test al, al
je 0x413126
jle 0x413118
invalid
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x3ff
push 0x400
push eax
call fcn.00413572
cmp dword [0x627014], 8
lea ecx, [ebp - 0x804]
mov eax, section..data
cmovae eax, dword [section..data]
push ecx
push eax
call int.00413176
mov ecx, dword [ebp - 4]
add esp, 0x20
xor ecx, ebp
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x413176
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.00569440
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x200c], edi
mov dword [ebp - 0x2008], eax
call fcn.00413033
test eax, eax
je 0x413320
xor ebx, ebx
push ebx
call fcn.0057a2fd
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2018]
push eax
mov dword [ebp - 0x2014], edx
call fcn.0057d151
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp - 0x2008]
mov ecx, dword [esi + 0x10]
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00412cf6
add esp, 0x28
call fcn.0042ac7f
test al, al
je 0x41322e
test byte [edi], dl
cmp eax, 0x2c2f5342
jle 0x413267
xchg ebx, eax
mov esp, 0x7f39c2a2
imul esi, edx, 0xf4bd8b9d
invalid
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
inc esi
test eax, eax
cmovne ebx, esi
mov dword [ebp - 0x200c], ebx
call fcn.0042aeec
test al, al
je 0x41325f
cmp eax, 0x8d5051c6
mov byte [0x96680db9], al
iretd
push 0x5a36e8
push edi
call fcn.00578999
mov ebx, eax
mov dword [ebp - 0x2010], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x413320
push edi
push ss
add byte [ebx - 0xf627628], cl
invalid
cmp dword [ebp - 0x200c], 0
jne 0x4132a2
push ebx
push 2
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0xfeff
push esi
push eax
call fcn.00578e7b
add esp, 0x10
call fcn.0042ae1d
test al, al
je 0x4132c3
sti
inc ecx
mov ecx, 0x8a35929f
inc ecx
mov ecx, gs
push 0x58
dec edi
invalid
lea eax, [ebp - 0x2004]
push eax
call fcn.00578706
push ebx
add eax, eax
push eax
lea eax, [ebp - 0x2004]
push 1
push eax
call fcn.00578e7b
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xd
push 1
push eax
call fcn.00578e7b
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xa
push 1
push eax
call fcn.00578e7b
push ebx
call fcn.00578797
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x4139df
Capabilities:
Encode data using xor

Disassembly:
cmp dword [eax - 0x75], 0x76
salc
das
adc byte [edx + 0xbce81e3], 0xbe
jo 0x4139ac
inc ecx
jmp 0x9f913a85
and dh, cl
movsd dword es:[edi], dword [esi]
sub ch, al
push esp
jae 0x4139b5
add byte [eax + eax*8 - 0x60f5ed8c], al
xchg esp, eax
dec ebp
mov ebx, 0x436f98c7
test al, al
je 0x4139cb
or bl, byte [edi - 0x3844b26c]
cwde
outsd dx, dword [esi]
inc ebx
mov esp, 0xdae7946d
sub esi, dword [edx]
jecxz 0x413979
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
mov eax, ebx
call fcn.00569382
ret
push 0x3c
mov eax, 0x59c9a7
call fcn.005693c7
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
and dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
and dword [ebp - 0x44], 0
push eax
mov dword [ebp - 0x48], ebx
call fcn.00402ac4
xor esi, esi
mov ecx, ebx
inc esi
push 0x5a06d8
mov dword [ebp - 4], esi
call fcn.00402ac4
mov dword [ebp - 0x44], esi
call fcn.0042ad4e
test al, al
je 0x413a3e
int3
xor byte [eax + ecx*2 - 0x436bfaf5], bh
mov ch, 0x70
pop ebx
mov dword [0x86d6b6f3], eax
xor al, 0x5a
jg 0x4139c9
and eax, 0x6de87a01
add dword [edx - 0x18], edi
insd dword es:[edi], dx
call fcn.0042abb0
jno 0x413a43
add byte [eax + eax*8 + 0x55871574], al
xor esp, esi
jae 0x413ac7
test al, al
je 0x413a5c
xchg dword [ebp + 0x33], edx
out 0x73, al
jp 0x413a28
ficom dword [eax]
or eax, 0x1851762a
adc byte [0x1851762a], cl
xchg esi, eax
pop ss
je 0x413a3c
xchg esp, eax
in al, dx
cld
call fcn.0042ad09
test al, al
je 0x413a77
push esi
insd dword es:[edi], dx
push 0xffffffffffffff83
dec esi
adc eax, 0xdc716680
pop es
scasd eax, dword es:[edi]
push ebp
sub al, 0x84
jbe 0x413ae2
mov esi, 0x5a0a50
push esi
call fcn.00578706
pop ecx
push eax
or edi, 0xffffffff
lea ecx, [ebp - 0x28]
push edi
push esi
call fcn.00413504
cmp eax, edi
jg 0x413ab0
mov esi, 0x5a3654
push esi
call fcn.00578706
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x28]
call fcn.00413504
cmp eax, edi
jle 0x413ad6
inc eax
lea ecx, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.00403a48
push eax
mov ecx, ebx
call fcn.00402b42
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00403628
jmp 0x413ae8
jmp [edx]
lea eax, [ebp - 0x28]
cmp ebx, eax
je 0x413ae8
push edi
push 0
push eax
mov ecx, ebx
call fcn.004036b6
retf
call fcn.0042ac7f
test al, al
Function at 0x413d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00578706
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00569947
push dword [ebp + 8]
mov edi, eax
push edi
mov dword [ebp - 4], edi
call fcn.00578f87
add esp, 0x10
call fcn.0042aeec
test al, al
je 0x413db3
dec ecx
or dword gs:[edx - 0x57], esi
invalid
mov eax, dword [ebp - 8]
xor esi, esi
xor ebx, ebx
inc esi
mov dword [ebp - 0xc], ebx
test eax, eax
js 0x413e7d
cmp word [edi + ebx*2], 0x5c
jne 0x413e6e
call fcn.0042ac3a
test al, al
je 0x413dee
popfd
in al, dx
aas
popfd
invalid
call fcn.0042aa57
test al, al
je 0x413e18
and dword [0x471bcc6], 0xb7563a47
popal
push es
or al, 0x67
std
push edi
adc cl, byte [edx + 0x3a]
jl 0x413df5
sbb eax, 0x1221030
xor byte [eax], dl
and al, byte [ecx]
xor cl, bh
cmp eax, dword [ecx - 0x17038275]
or dword [ebp + 1], ebp
add byte [eax + eax*8 - 0x3e9edd8c], al
mov esi, 0x5c3f4bb5
lahf
call fcn.0042ab26
test al, al
je 0x413e43
popal
sar dword [esi + 0x5c3f4bb5], 0x9f
adc dword [ebx + 0x5369bf0d], esi
loopne 0x413e0d
lea ecx, [edx + 0x22e4f1e9]
iretd
mov ebx, dword [ebp - 0xc]
xor eax, eax
push edi
movzx esi, word [edi + ebx*2]
mov word [edi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413e67
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x413e8d
mov eax, dword [ebp - 8]
mov word [edi + ebx*2], si
inc ebx
mov dword [ebp - 0xc], ebx
cmp ebx, eax
jle 0x413dc6
xor esi, esi
inc esi
push edi
call fcn.0056947b
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x413e7d
Function at 0x414f03
Capabilities:
Get common file path

Disassembly:
je 0x414efe
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x414efe
mov al, 1
jmp 0x414f00
xor al, al
pop esi
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x62c3d8], 0
push ebx
push esi
push edi
je 0x414f8b
call fcn.0042aa9c
test al, al
je 0x414f3f
jl 0x414eec
pop edx
inc eax
and dword [eax - 0x21dd9bc6], ecx
imul byte [edi + 0x5c]
invalid
call fcn.0042ad4e
test al, al
je 0x414f64
invalid
call fcn.0042af76
test al, al
je 0x415082
and byte [eax + 0x1014fbe7], ch
invalid
call fcn.0042af76
test al, al
je 0x414faf
inc ecx
dec edx
push ecx
not esi
push eax
mov esp, 0xc15bc09a
pop edi
enter 0xffffffffffffb744, 0x1a
cmp eax, 0x96ef6822
wait
fldenv [esi + 0x6878f811]
or byte [edx], al
add byte [eax], al
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41501f
lea eax, [ebp - 0x20c]
push eax
call fcn.0057c0eb
lea eax, [ebp - 0x20c]
mov dword [esp], 0x5a34b4
push eax
call fcn.00572b2d
pop ecx
pop ecx
test eax, eax
jne 0x415018
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.00572b2d
pop ecx
pop ecx
test eax, eax
je 0x41501f
mov byte [0x62c3d8], 1
call fcn.0042add8
test al, al
je 0x41503a
jmp 0x415079
call fcn.0042aa9c
test al, al
je 0x41505e
pop ds
cmp ebx, dword [eax + ebp - 0x7d]
pop ecx
test al, 0x26
cli
dec edi
push 0x86a78f11
movsd dword es:[edi], dword [esi]
mov esp, dword [edi - 0x647e4f87]
int3
sbb dword [ebx + 0x49b64ecc], 0x15a39e8
add byte [eax + eax*8 + 0x22a91b74], al
xor bh, byte [esi + 0x6e]
call fcn.0042aa9c
test al, al
je 0x415082
test eax, 0x6e7e3222
stosb byte es:[edi], al
and bl, bh
lahf
fisub word [ebx]
out dx, al
push 0x69f7953b
scasd eax, dword es:[edi]
adc ebx, dword [eax + 0x56]
jp 0x415058
dec eax
push ecx
dec eax
mov ecx, dword [ebp - 4]
mov al, byte [0x62c3d8]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret

Function at 0x415098
Capabilities:
Get common file path

Disassembly:
push 0x138
mov eax, 0x59caea
call fcn.005693c7
mov al, byte [0x62c3d9]
test al, al
jne 0x415161
push 0x104
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x114]
xor edi, edi
inc edi
push edi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x41515c
push str.config_systemprofile
lea ecx, [ebp - 0x12c]
call fcn.00403edb
lea eax, [ebp - 0x114]
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x144]
call fcn.00403edb
push dword [ebp - 0x11c]
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
push esi
cmovae eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x144]
push eax
call fcn.004091f1
movzx ecx, byte [0x62c3d9]
cmp eax, 0xffffffff
push esi
cmovne ecx, edi
mov byte [0x62c3d9], cl
lea ecx, [ebp - 0x144]
push edi
call fcn.00404928
push esi
push edi
lea ecx, [ebp - 0x12c]
call fcn.00404928
mov al, byte [0x62c3d9]
call fcn.00569382
ret
Function at 0x4159ca
Capabilities:
Delete file
Enumerate processes

Disassembly:
push 0
mov eax, 0x59c8c5
call fcn.00569393
and dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x415ac9
call fcn.0042ae62
test al, al
je 0x415a0e
push esi
test dl, bh
stc
or eax, 0x5a394943
faddp st(7)
ret
call fcn.0042ab6b
test al, al
je 0x415a36
adc byte [esi + 0x15], ch
call 0xcfec879e
mov cl, 0x99
adc al, 0x75
nop
sub eax, dword [ecx + 0xd]
cmpsb byte [esi], byte es:[edi]
xor byte [ebp - 0x3a], 0xc4
not dword [edi]
dec edx
or eax, dword [eax - 0x22]
mov dword [0x4f4de8ab], eax
add dword [eax], eax
call fcn.0042a988
test al, al
je 0x415a55
lahf
cmc
xor ah, byte [eax - 0x622e0211]
cld
in eax, dx
xchg esp, eax
pop ss
add dword [ebp - 0xf25e0c4], ebp
jo 0x4159da
dec esp
push eax
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call int.00411c46
pop ecx
call fcn.0042af76
test al, al
je 0x415a83
int3
call fcn.0042aeec
test al, al
je 0x415aa7
mov esp, 0x45458be2
rcl dword [eax]
inc edx
cmp cl, byte [eax]
nop
adc ebx, dword [ebx - 0x72e8b363]
ja 0x415ad7
leave
mov dl, 0xa0
int1
and dl, cl
mov al, byte [0x53fbe86a]
add dword [eax], eax
call fcn.0042aea7
test al, al
je 0x415ac9
out 0xc9, al
xor bh, byte [esi]
mov eax, eax
aas
adc al, bh
xchg edi, eax
and esi, dword [esi - 0x436ba7ba]
je 0x415b1e
ret
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00403628
xor eax, eax
inc eax
call fcn.0056936d
ret
std
invalid
Function at 0x415ade
Capabilities:
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x59cce2
call fcn.005693c7
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x415ccb
push eax
lea ecx, [ebp - 0x40]
call fcn.00402ac4
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.0041937c
mov edi, 0x22c
lea eax, [ebp - 0x284]
push edi
push 0
push eax
call fcn.0056f390
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x28c], esi
cmp esi, 0xffffffff
je 0x415cbb
call fcn.0042ad4e
test al, al
je 0x415b60
jmp 0xe10b8c60
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x415c38
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x415b9f
lea eax, [ebp - 0x260]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403772
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0041937c
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040383c
test eax, eax
je 0x415bf3
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call int.00419a01
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.0040383c
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x415bfa
mov byte [ebp - 0x285], 1
test bl, 1
je 0x415c0e
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
jecxz 0x415c07
call fcn.00403628
cmp byte [ebp - 0x285], 0
jne 0x415cd1
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00403628
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x415b78
call fcn.0042ae62
test al, al
je 0x415c68
xor dl, byte [eax]
jne 0x415c6a
pop ss
ja 0x415c07
push ecx
cmp esi, ebp
dec eax
sub al, 0x18
aaa
pop eax
cld
pushal
out dx, eax
invalid
call fcn.0042a8fe
dec esp
add dword [eax], eax
test al, al
je 0x415c8a
arpl ax, ax
out dx, eax
sbb ebp, dword [ecx]
mov edx, 0x4fd0676a
mov byte [0x7602a32], al
salc
stosb byte es:[edi], al
sbb edx, dword [ebx - 0x77]
or dword [edi], eax
jne 0x415c95
mov eax, 0x14f21e8
add byte [eax + eax*8 + 0xa451c74], al
call fcn.0042abb0
test al, al
je 0x415caf
inc ebp
or dl, byte [0xd77d2ac6]
adc eax, 0xd77d2ac6
int3
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00403628
mov eax, esi
call fcn.00569382
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00403628
jmp 0x415cbd
Function at 0x417829
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
push eax
call fcn.0056f390
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4178ae
lea eax, [ebp - 0x218]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4178a7
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00402ac4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0056935c
mov esp, ebp
pop ebp
ret

Function at 0x417a85
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x59cd4d
call fcn.005693c7
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
and dword [ebp - 0x24c], 0
push 0x208
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056f390
add esp, 0xc
call fcn.0042ac7f
test al, al
je 0x417ad8
cmp dl, byte [esi]
iretd
push 0x104
lea eax, [ebp - 0x218]
xor esi, esi
push eax
push esi
jmp 0x417be0
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x417bd2
call fcn.0042ad4e
test al, al
je 0x417b22
ja 0x417b44
rcl dword [edx - 0x17c16f71], 0x26
cwde
jmp 0x417b68
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x417b52
or eax, 0xfde8858d
invalid
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403772
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
add byte [ebp - 0x22f7b], cl
call dword [eax - 0x73]
test dword [eax + 0x50fffffd], edi
call fcn.0041a8f3
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00403628
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
push dword [ebp - 0x250]
call fcn.004178ce
pop ecx
pop ecx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
push 0
push 1
call fcn.00404928
push 0x104
lea eax, [ebp - 0x218]
inc esi
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x417aec
call fcn.00569382
ret
Function at 0x418daa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.0042af76
test al, al
je 0x418de4
mov al, byte [0xebacdbca]
pop ecx
salc
add byte [esi], cl
cmp eax, 0xcf8d0cd7
and cl, cl
mov ss, word [eax]
imul edx, dword [esp + eax*8], 0xffffffc5
stosb byte es:[edi], al
scasd eax, dword es:[edi]
xor eax, 0xdb33039f
lea eax, [ebp - 0xc]
mov esi, 0xf013f
push eax
push esi
push ebx
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418f1a
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x418f11
call fcn.0042add8
test al, al
je 0x418e40
retf 0xe8b8
call fcn.0042aa9c
test al, al
je 0x418e64
inc edx
or dword [eax], edx
dec edi
cdq
clc
test byte [0xbd20efda], 0xa5
xor byte [ecx], 0x41
mov dh, ah
mov ah, 0x4f
xor al, 0xb7
mov byte [0xdb34f007], al
call fcn.0042aa9c
test al, al
je 0x418e88
or byte [edx], dh
arpl word [ecx + 0x41], dx
push 0xffffffffffffffcd
mov dword [edx], esp
inc ebp
sbb edx, ebx
leave
xor al, 0x57
sbb dh, byte [ecx]
mov bl, 0xb7
xchg esi, eax
pop dword [edi + 0x6e]
xchg edi, eax
push 0x458df633
cld
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf013f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x418eba
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
jmp 0x418f1a
push dword [ebp + 0x14]
call fcn.00578706
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042a9cd
test al, al
je 0x418f08
bound edx, qword [ebp - 0x75a650ea]
inc ecx
adc ebp, esp
lodsd eax, dword [esi]
cmp edx, esp
invalid
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418f21
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
call fcn.0042af76
test al, al
je 0x418f52
add al, 0x25
std
and bl, bh
ljmp 0x9046
call fcn.0042aeec
test al, al
je 0x418f76
std
sub ecx, dword [eax + 0x3a]
daa
rcl al, cl
or esi, dword [esi]
imul ebp, edx, 0xfe19b4b1
test dword [edx], ecx
leave
ret 0x1c32
call fcn.0042aea7
test al, al
je 0x418f98
stosb byte es:[edi], al
invalid
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push 0xf013f
push ebx
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4190ed
call fcn.0042aea7
test al, al
je 0x418fe3
and eax, 0x3f4f9a6e
ja 0x419033
sti
sti
mov cs, word [ecx]
inc eax
jle 0x419016
or dword [0xba1603a7], 0x67fd8894
push eax
invalid
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41900f
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4190ed
call fcn.0042af76
test al, al
je 0x419035
mov esi, ecx
retf 0x8f6c
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x419066
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x4190eb
call fcn.0042a9cd
test al, al
je 0x41908f
mov dh, 0x8b
ret 0xd3b1
call fcn.0042ae62
test al, al
je 0x4190b4
insb byte es:[edi], dx
invalid
push dword [ebp + 0x14]
call fcn.00578706
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a41a
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x59d05f
call fcn.005693c7
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x38], ebx
call fcn.0041a584
pop ecx
pop ecx
push ebx
push ebx
push ebx
xor ecx, ecx
lea eax, [ebp - 0x28]
inc ecx
cmp dword [ebp - 0x14], 8
push ebx
cmovae eax, dword [ebp - 0x28]
push 0xffffffffffffffff
push eax
push ebx
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
imul eax, eax, 3
push eax
mov dword [ebp - 0x34], eax
call fcn.00569947
mov edi, eax
pop ecx
mov dword [ebp - 0x30], edi
call fcn.0042a9cd
test al, al
je 0x41a4a1
pop edx
aas
sub al, 0xd7
mov bh, 0xdb
ficom word [edx - 0x15]
push es
push 0x37d134ca
popfd
push edi
or eax, dword [ebx + 0x5f]
mov ebp, 0xdb29a83
mov dl, 0xd
adc byte [ebp + 0xa771ace], ch
call fcn.0042ae62
test al, al
je 0x41a4c9
xchg ecx, eax
out dx, al
mov dl, ch
xor byte [edx], 0xbf
out dx, al
rcl edx, 0xc0
stosd dword es:[edi], eax
inc esp
pop ebx
out 0xc8, al
out 0x16, eax
cmp dword [ecx], 0x32091884
mov edx, 0x8bc50436
jge 0x41a499
mov esi, dword [ebp - 0x34]
xor ebx, ebx
push esi
push ebx
push edi
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x2c]
push edi
call fcn.00403edb
push edi
mov dword [ebp - 0x38], 1
call fcn.0056947b
pop ecx
call fcn.0042af76
test al, al
je 0x41a52b
ljmp 0x295d:0x68ebc4bf
call fcn.0042abf5
test al, al
je 0x41a54b
dec edx
push eax
fild dword [esi - 0x7c]
adc eax, 0x92ee9061
fstp xword [edi + 0x5d]
push cs
and dl, byte [ebx]
push ds
dec edi
stosb byte es:[edi], al
shl esp, 1
das
xchg ebp, eax
call fcn.0042aa9c
test al, al
je 0x41a56f
inc esi
invalid
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
mov eax, dword [ebp - 0x2c]
call fcn.00569382
ret