joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4059b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x41800c]
mov esi, edx
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x20019
push 0
push str.SOFTWAREPoliciesMozillaFirefox
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x405a61
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x18]
push 0
push 0
push 0
push 0
push eax
push 0
push 0
push ecx
push 0
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, 2
test eax, eax
jne 0x405a58
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 4
lea ecx, [ebp - 0x20]
push eax
push ecx
push 0
push 0x10
push esi
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, 2
test eax, eax
jne 0x405a58
xor ebx, ebx
cmp dword [ebp - 0x20], 0
sete bl
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405a66
mov ebx, 2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413150
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4069d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x41800c]
mov bl, 1
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x38], 0
je 0x406a51
cmp byte [ecx + 0x3d], 0
mov esi, ecx
je 0x406a51
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x406a4f
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x34]
lea edi, [ebp - 0x30]
lea edx, [esi + 0x40]
mov ebx, dword [ecx]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push edx
call dword [ebx + 0x20]
cmp eax, 3
je 0x406a65
cmp eax, 1
je 0x406a2b
test eax, eax
jne 0x406a4f
mov byte [esi + 0x3d], 0
mov ebx, dword [ebp - 0x34]
sub ebx, edi
je 0x406a46
push dword [esi + 0x4c]
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x406a4f
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x406a51
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413150
mov eax, ebx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x406a51
Function at 0x411e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x41800c]
mov esi, edx
mov edi, dword [ebp + 0xc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ecx]
mov edx, dword [ebx + 4]
cmp byte [edx + 0xd], 0
jne 0x411e9d
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov edi, edx
add edx, 0x10
mov ecx, ebx
call fcn.0040c490
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov edx, dword [edi + ecx*8]
cmp byte [edx + 0xd], 0
je 0x411e39
test al, al
mov dword [ebp - 0x14], edi
je 0x411edb
mov ecx, dword [ebp - 0x18]
mov ebx, edi
mov edi, dword [ebp + 0xc]
mov eax, dword [ecx]
cmp ebx, dword [eax]
je 0x411ea6
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x14]
call fcn.00411860
mov edi, dword [ebp - 0x14]
mov al, 1
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp + 8]
lea ecx, [edi + 0x10]
call fcn.0040c490
test al, al
je 0x411ecd
mov ecx, dword [ebp - 0x18]
movzx eax, byte [ebp - 0x1c]
mov edx, esi
push dword [ebp + 0xc]
push ebx
push eax
jmp 0x411eac
mov dword [ebp - 0x14], ebx
mov eax, ebx
cmp ebx, dword [eax]
jne 0x411e6b
mov edx, esi
push edi
push ebx
push 1
call fcn.00411c10
add esp, 0xc
mov al, 1
mov byte [esi + 4], al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413150
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0xc]
call fcn.00411ef0
xor eax, eax
mov dword [esi], edi
jmp 0x411eb6
mov dword [ebp - 0x1c], 0
mov ebx, edi
jmp 0x411e7e
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x18
push 0
push 0x40be70
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x40be74], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40be70], eax
mov eax, 0x40b088
mov dword [0x40be7c], eax
call fcn.00402223
call fcn.00407ba0
call fcn.00407330
call fcn.00406d58
call fcn.004068d1
call fcn.004066aa
call fcn.00406044
call fcn.00405e76
call fcn.00405bd0
call fcn.00403d0c
call fcn.004035b0
call fcn.00402e07
call fcn.004029e0
call fcn.004029cc
call fcn.00402908
call fcn.00402897
call fcn.004027be
call fcn.004022dc
mov edx, dword [0x40bf98]
push edx
push edx
mov edx, dword [0x40bf98]
push edx
push edx
call fcn.00406073
mov edx, dword [0x40b0a8]
add dword [esp], edx
call fcn.004067fb
add dword [0x40bf98], 2
push 0x40be80
call fcn.00407c20
call fcn.00401267
push 0
jmp 0x4010e8
call 0x401102
call fcn.00407bf0
push dword [0x40be70]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004022b9
call fcn.00402768
call fcn.00402896
call fcn.004029c0
call fcn.00402e06
call fcn.00405bf0
call fcn.00405f04
call fcn.0040669e
call fcn.0040687a
call fcn.004068b3
call fcn.004073f5
call fcn.00407320
ret
Function at 0x402549
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push 0x40a008
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x4025e1
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4025de
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x4025de
lea eax, [esi - 1]
push eax
push dword [0x40bfa0]
call fcn.0040748d
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x4025e0
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x4025d5
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x4026c8
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x4025bb
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x402687
push eax
call esi
test al, al
jns 0x402687
push 0x11
call esi
test al, al
js 0x402687
push 0x10
call esi
test al, al
js 0x402687
push 0x12
call esi
test al, al
js 0x402687
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x402687
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x40265b
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x402672
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x4026d2
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x4026d2
test ebp, ebp
je 0x4026ab
push 0x11
call esi
test al, al
js 0x4026a3
push 0x10
call esi
test al, al
js 0x4026a3
push 0x12
call esi
test al, al
jns 0x4026ab
push 1
push ebp
call fcn.004026de
test ebx, ebx
je 0x4026bf
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x4026d2
test edi, edi
je 0x4026d2
mov eax, dword [edi + 8]
jmp 0x4026d4
and dword [esp + 0x14], 0
jmp 0x4025e0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x403ca0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x403cd2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403ccd
cmp dword [esp + 0xc], esi
je 0x403ce9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x402c50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [0x4053e4]
push ebx
push ebp
push esi
push edi
push 0x2c
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x4053e4]
push 0x5a93
push 0x7478
push 0x4f0b
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x4053e8]
push 0
push 0x96
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov eax, dword [0x4053e8]
mov esi, dword [sym.imp.USER32.dll_SetScrollPos]
push 1
push 0x50
push 0x34
push eax
call esi
mov ecx, dword [0x4053f0]
mov ebp, dword [sym.imp.USER32.dll_GetClassWord]
push 0xc3
push ecx
call ebp
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov byte [ebx + edi], bl
mov edx, dword [0x4053f4]
push 0xa2
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc ebx
cmp ebx, 0x100
jl 0x402cc0
mov byte [edi + 0x100], 0
mov ecx, dword [section..data]
mov eax, 0x54f5c0dd
push 0x23
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [section..data], edx
mov byte [edi + 0x101], 0
mov ecx, dword [0x4053f4]
push ecx
call ebp
mov edx, dword [0x4053f4]
push 1
push 0x9a
push 0x2c
push edx
call esi
xor esi, esi
xor ebp, ebp
mov eax, esi
mov ecx, dword [esp + 0x18]
cdq
idiv dword [esp + 0x1c]
xor eax, eax
push 7
mov al, byte [edx + ecx]
xor edx, edx
mov dl, byte [esi + edi]
add edx, ebp
lea ebp, [edx + eax]
mov eax, dword [0x4053ec]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x405004]
mov eax, 0x99d722db
imul ecx
add edx, ecx
xor ebx, ebx
sar edx, 7
mov ecx, edx
push 0x55
shr ecx, 0x1f
add edx, ecx
and ebp, 0xff
mov dword [0x405004], edx
mov edx, dword [0x4053ec]
mov bl, byte [esi + edi]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, byte [edi + ebp]
push 0x9f
mov byte [esi + edi], al
mov ecx, dword [0x405404]
push ecx
call dword [sym.imp.USER32.dll_GetClassWord]
mov byte [edi + ebp], bl
mov eax, dword [0x405004]
cdq
mov ecx, 0x2bd0
push 1
idiv ecx
push 0x2d
push 0x12
mov dword [str.b], edx
mov edx, dword [0x405404]
push edx
call dword [sym.imp.USER32.dll_SetScrollPos]
inc esi
cmp esi, 0x100
jl 0x402d2a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x402de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x4053f8]
push ebx
push esi
push edi
push 0
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov eax, dword [0x40500c]
mov esi, dword [esp + 0x10]
xor ebx, ebx
xor edx, edx
mov dword [section..data], 0x77d0
mov bl, byte [esi + 0x100]
mov dl, byte [esi + 0x101]
lea ecx, [eax - 0x2031]
mov dword [section..data], ecx
mov ecx, dword [esp + 0x18]
xor edi, edi
mov dword [0x405018], 0x359777a0
test ecx, ecx
jle 0x402f12
push ebp
jmp 0x402e46
mov eax, dword [0x40500c]
mov edx, dword [esp + 0x14]
lea ecx, [eax + eax*2]
mov dword [0x405018], 0x7200
push 0xd7
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
lea ecx, [ecx + ecx*2]
lea ecx, [eax + ecx*2]
shl ecx, 4
add ecx, eax
inc ebx
and ebx, 0xff
xor eax, eax
mov dword [0x40501c], ecx
mov ecx, dword [0x405400]
mov al, byte [ebx + esi]
push ecx
add edx, eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_GetClassWord]
mov ecx, dword [0x405030]
mov eax, 0x726134bd
imul ecx
mov ebp, dword [esp + 0x14]
push 0xa
sar edx, 0xd
mov eax, edx
and ebp, 0xff
shr eax, 0x1f
add edx, eax
xor eax, eax
mov dword [section..data], edx
mov cl, byte [esi + ebp]
mov al, byte [ebx + esi]
mov byte [ebx + esi], cl
mov byte [esi + ebp], al
mov edx, dword [0x405028]
add edx, 0x6ad6
mov dword [esp + 0x18], ebp
mov dword [0x405028], edx
mov dl, byte [ebx + esi]
add edx, eax
mov eax, dword [esp + 0x1c]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [edi + eax]
xor dl, cl
mov byte [edi + eax], dl
mov edx, dword [0x405404]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x1c]
inc edi
cmp edi, eax
jl 0x402e3d
mov edx, ebp
pop ebp
mov byte [esi + 0x101], dl
mov eax, dword [0x4053f8]
push 0
push 0x21
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov byte [esi + 0x100], bl
mov ecx, dword [0x4053f0]
push 0x3d1a
push 0x265e
push 0x170e
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
ret
Function at 0x66204bc0
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6621b69b
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test ebx, ebx
je 0x66204bf4
mov byte [ebp + 0xb], 1
cmp esi, 0xffffffff
je 0x66204bf8
mov byte [ebp + 0xb], 0
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
call fcn.66207c70
mov dword [ebp - 4], 0
cmp byte [ebp + 0xb], 0
je 0x66204c4d
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x1a4]
push eax
push 0
mov eax, ebx
lea ecx, [ebp - 0x84]
cdq
push edx
push eax
call fcn.66208a50
mov edi, eax
test edi, edi
js 0x66204d61
lea ecx, [ebp - 0x1a4]
call fcn.66208c30
mov esi, dword [ebp - 0x154]
cmp byte [ebp + 0x20], 0
mov ecx, 4
push 0
push 0x8000000
mov eax, 0x40
mov dword [ebp - 0x24], esi
cmovne eax, ecx
mov dword [ebp - 0x20], 0
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0xf
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
js 0x66204d61
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 0
push 0x100000
push 2
push eax
push 0
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0
push eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov edi, eax
test edi, edi
js 0x66204cf4
cmp byte [ebp + 0xb], 0
je 0x66204cff
push dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1a4]
push ebx
push eax
call fcn.662086b0
mov edi, eax
add esp, 0x10
test edi, edi
jns 0x66204d26
push dword [ebp - 0x10]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x66204d61
test ebx, ebx
je 0x66204d26
mov eax, dword [ebp + 0xc]
push esi
test eax, eax
je 0x66204d1a
push dword [ebp - 0x10]
push eax
push ebx
call fcn.6620b480
add esp, 0x10
jmp 0x66204d26
push ebx
push dword [ebp - 0x10]
call fcn.6620d5b0
add esp, 0xc
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jne 0x66204d38
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x66204d3d
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x66204d51
push dword [ebp - 0x10]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x66204d56
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x66204d5f
mov dword [eax], esi
xor edi, edi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.66207e50
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x66205600
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6621b75b
push eax
mov dword fs:[0], esp
sub esp, 0xec
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0x178]
call fcn.66207580
cmp dword [edi + 0x160], 0
jne 0x66205743
cmp dword [edi + 4], 0
je 0x66205711
lea ecx, [ebp - 0xf8]
call fcn.66203190
mov dword [ebp - 4], 0
lea eax, [ebp - 0xf8]
push eax
push dword [edi]
call fcn.6620add0
add esp, 8
lea ecx, [ebp - 0xf8]
call fcn.66204330
mov dword [ebp - 0x20], eax
lea ebx, [edi + 0x170]
xor ecx, ecx
mov dword [ebp - 0x28], 0x18
cmp byte [edi + 0x18c], cl
mov eax, 0x20
mov dword [ebp - 0x24], 0
cmovne eax, ecx
mov dword [ebp - 0x1c], 0x40
or eax, 0x40
mov dword [ebp - 0x18], 0
push eax
push 1
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x28]
push eax
push dword [edi + 0x188]
push ebx
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov dword [ebp - 0x10], eax
test eax, eax
jns 0x662056ff
mov dword [ebx], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8]
call fcn.66203210
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8]
call fcn.66203210
push 5
push 0x18
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 0x170]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x662057ff
mov eax, dword [ebp - 0x40]
mov dword [edi + 0x168], eax
mov eax, dword [ebp - 0x3c]
mov dword [edi + 0x16c], eax
mov ecx, edi
call fcn.662059c0
mov ebx, eax
test ebx, ebx
jns 0x66205777
lea ecx, [edi + 0x178]
call fcn.66207580
mov ecx, edi
call fcn.66204b30
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [ebp + 8], 0
je 0x66205792
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [edi + 0x178]
mov ecx, esi
call fcn.66204970
test al, al
je 0x6620577d
cmp byte [ebp + 0xc], 0
je 0x6620577d
mov eax, dword [edi + 0x170]
mov dword [edi + 0x174], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x170], 0
test eax, eax
je 0x662057d2
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.662041d0
jmp 0x662057f2
mov ecx, esi
call fcn.66204950
mov ecx, edi
mov esi, eax
call fcn.66203eb0
push 0
push 0
push 0xffffffffffffffff
push esi
push 1
mov ecx, eax
call fcn.662033a0
push 0
push 0
push 1
mov ecx, edi
call fcn.66205600
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401422
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
mov esi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
or eax, eax
je 0x401448
cmp dword [ebp - 4], 0
jne 0x40144f
sub eax, eax
pop esi
leave
ret 0xc
mov eax, dword [ebp - 4]
add esi, eax
sub dword [ebp + 0x10], eax
jne 0x40142c
mov eax, 1
pop esi
leave
ret 0xc

Function at 0x4019aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
push dword [ebp + 8]
pop ebx
mov al, byte [ebx]
mov byte [ebp - 3], al
mov al, byte [ebx + 1]
mov byte [ebp - 4], al
mov edi, ebx
inc edi
inc edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0x10]
jecxz 0x401a15
inc byte [ebp - 3]
movzx eax, byte [ebp - 3]
movzx edx, byte [eax + edi]
mov byte [ebp - 1], dl
add byte [ebp - 4], dl
movzx eax, byte [ebp - 4]
mov dl, byte [eax + edi]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 3]
mov byte [eax + edi], dl
movzx eax, byte [ebp - 4]
mov dl, byte [ebp - 1]
mov byte [eax + edi], dl
mov dl, byte [ebp - 1]
add dl, byte [ebp - 2]
mov dl, byte [edx + edi]
mov eax, dword [ebp - 8]
xor byte [eax + esi], dl
inc dword [ebp - 8]
loop 0x4019d5
mov al, byte [ebp - 3]
mov byte [ebx], al
mov al, byte [ebp - 4]
mov byte [ebx + 1], al
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x401c8d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push edi
mov eax, dword [ebp + 0x14]
or eax, eax
je 0x401ca1
mov dword [eax], 0
sub edi, edi
cmp dword [ebp + 0x18], 1
jne 0x401cb0
mov edx, 0x200
jmp 0x401cbf
cmp dword [ebp + 0x18], 2
jne 0x401cbd
mov edx, 0x100
jmp 0x401cbf
sub edx, edx
or edx, 0x20019
lea eax, [ebp - 4]
push eax
push edx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x401d4a
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
jne 0x401d42
cmp dword [ebp - 8], 0
je 0x401d42
cmp dword [ebp - 0xc], 1
jne 0x401d08
cmp dword [ebp - 8], 1
je 0x401d42
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.004018cf
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
je 0x401d36
push edi
call fcn.004018b8
sub edi, edi
jmp 0x401d42
mov eax, dword [ebp + 0x14]
or eax, eax
je 0x401d42
push dword [ebp - 8]
pop dword [eax]
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, edi
or eax, eax
jne 0x401d6c
cmp dword [ebp + 0x18], 2
jae 0x401d6c
mov eax, dword [ebp + 0x18]
inc eax
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401c8d
pop edi
leave
ret 0x14
Function at 0x401dc6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, dword [ebp + 8]
not eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x401df1
mov edx, eax
shr edx, 8
xor al, byte [edi]
and eax, 0xff
mov eax, dword [eax*4 + 0x418940]
xor eax, edx
inc edi
loop 0x401dd9
not eax
pop edi
leave
ret 0xc

Function at 0x401f7e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
or eax, eax
je 0x401f8d
cmp byte [eax], 0
jne 0x401f96
mov eax, 0
leave
ret 4
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401fb0
test eax, 0x10
setne al
movzx eax, al
jmp 0x401fb5
mov eax, 0
leave
ret 4

Function at 0x401fb9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
or eax, eax
je 0x401ff9
push eax
push eax
call fcn.004018cf
mov dword [ebp - 4], eax
pop eax
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
or eax, eax
jne 0x401ff6
push dword [ebp - 4]
call fcn.004018b8
sub eax, eax
jmp 0x401ff9
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x401ffd
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push 0x10
push ebx
call fcn.004018e6
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebx], eax
inc eax
je 0x402084
push 0
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebx]
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x402077
mov dword [ebx + 4], eax
push 0
push 0
push 0
push 4
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [ebx + 8], eax
or eax, eax
jne 0x402084
push dword [ebx + 4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebx]
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebx], 0xffffffff
jmp 0x402084
push dword [ebx]
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebx], 0xffffffff
sub eax, eax
cmp dword [ebx + 8], eax
setne al
pop ebx
leave
ret 8