joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e6dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e6ef5
sub esp, 0x1c
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4e6eec
xor ecx, ecx
jmp 0x4e6df1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jge 0x4e6ee3
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + ecx]
cmp ebx, 0x80
jge 0x4e6ec6
inc ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
lea eax, [0x6a9609]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
mov dword [esp + 8], ebx
call fcn.004d4f30
mov eax, dword [esp + 0xc]
test eax, eax
jge 0x4e6de9
mov eax, dword [esp + 0x14]
cmp eax, 0xff
ja 0x4e6ea3
movzx ecx, al
lea edx, [0x879b40]
movzx ecx, byte [edx + ecx]
test cl, 0x60
setne cl
test cl, cl
je 0x4e6e69
xor eax, eax
test al, al
je 0x4e6de9
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
cmp eax, 0xff
jg 0x4e6e84
cmp eax, 0x30
jl 0x4e6e80
cmp eax, 0x39
setle al
xor eax, 1
jmp 0x4e6e5c
xor eax, eax
jmp 0x4e6e7b
mov ecx, dword [0x8a7d18]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045f490
movzx eax, byte [esp + 8]
lea edx, [0x879b40]
jmp 0x4e6e7b
mov ecx, dword [0x8a7dcc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045f490
movzx ecx, byte [esp + 8]
mov eax, dword [esp + 0x14]
lea edx, [0x879b40]
jmp 0x4e6e56
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0044b1c0
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
jmp 0x4e6e0e
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
call fcn.0044f4e0
jmp fcn.004e6dc0
Function at 0x5175b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5177ba
sub esp, 0x74
lea edi, [esp + 0x84]
xor eax, eax
call fcn.00450fcb
mov dword [esp], 0
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0xc], ecx
call fcn.0043f830
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x34], edx
lea edi, [esp + 0x60]
xor eax, eax
call fcn.00450fcb
lea ecx, [0x6a5d11]
mov dword [esp], ecx
mov dword [esp + 4], 0x13
mov ebx, dword [esp + 0x40]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov ebp, dword [0x8a7c74]
mov dword [esp + 0x10], ebp
mov ebp, dword [0x8a7c70]
mov dword [esp + 0x14], ebp
call fcn.004a1690
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x48], ecx
mov edx, dword [esp + 0x2c]
lea esi, [esp + 0x18]
lea edi, [esp + 0x60]
call fcn.004514ae
lea edi, [esp + 0x84]
lea esi, [esp + 0x60]
call fcn.004514ae
test edx, edx
jne 0x5177a4
mov dword [esp + 0x3c], edx
mov edi, esp
lea esi, [esp + 0x60]
call fcn.004514ae
lea eax, [0x6a5d11]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x13
call fcn.0049f910
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x34]
cmp ecx, edx
je 0x517774
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00407e70
mov eax, dword [esp + 8]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], ecx
call fcn.00407e70
mov eax, dword [esp + 8]
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
lea ecx, [0x659b80]
mov dword [esp + 0x50], ecx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
lea eax, [0x6b4df0]
mov dword [esp], eax
mov dword [esp + 4], 0x6a
lea eax, [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004b6a70
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
add esp, 0x74
ret
mov dword [esp], eax
mov edx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00402300
movzx eax, byte [esp + 0xc]
test al, al
je 0x51779b
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x3c]
jmp 0x517762
mov edx, dword [esp + 0x34]
jmp 0x5176c2
mov dword [esp + 0x98], edx
mov eax, dword [esp + 0x48]
mov dword [esp + 0x9c], eax
add esp, 0x74
ret
call fcn.0044f4e0
jmp fcn.005175b0
Function at 0x51b2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51b49d
sub esp, 0x6c
mov ecx, dword [esp + 0x7c]
test ecx, ecx
je 0x51b48a
nop
movzx edx, byte [0x8adfa8]
test dl, dl
je 0x51b47e
mov dword [0x8adfac], ecx
mov edx, dword [0x8c1190]
test edx, edx
jne 0x51b467
mov eax, dword [esp + 0x80]
mov dword [0x8adfb0], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x51b45c
nop
movzx edx, byte [ecx + 0xf]
mov ebx, edx
and edx, 0x1f
test bl, 0x20
jne 0x51b32f
or edx, 0x80
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0047fbe0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x44], edx
mov ebx, dword [esp + 0x84]
mov dword [esp], ebx
mov ebx, dword [esp + 0x88]
mov dword [esp + 4], ebx
call fcn.0051b4b0
lea esi, [esp + 8]
lea edi, [esp + 0x54]
call fcn.004514a4
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
lea edi, [esp + 0x1c]
lea esi, [esp + 0x54]
call fcn.004514a4
call fcn.005183f0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
test ecx, ecx
jne 0x51b429
mov ecx, dword [esp + 0x74]
cmp edx, ecx
ja 0x51b495
mov eax, dword [esp + 0x78]
sub eax, edx
mov ebx, eax
neg eax
sar eax, 0x1f
and eax, edx
mov ebp, dword [esp + 0x70]
add eax, ebp
mov dword [esp + 0x8c], eax
sub ecx, edx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
add esp, 0x6c
ret
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], eax
add esp, 0x6c
ret
xor edx, edx
xor eax, eax
xor ecx, ecx
jmp 0x51b32f
lea edi, [0x8adfb0]
mov eax, dword [esp + 0x80]
call fcn.00450d20
jmp 0x51b306
mov eax, dword [esp + 0x80]
jmp 0x51b306
xor ecx, ecx
xor edx, edx
xor eax, eax
jmp 0x51b32f
mov eax, edx
call fcn.00450e00
nop
call fcn.0044f4e0
jmp fcn.0051b2b0
Function at 0x53a280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53a446
sub esp, 0x34
lea eax, [0x6533e0]
mov dword [esp], eax
call fcn.0040a500
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x53a321
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edi, dword [esp + 0x2c]
mov ebx, edi
cmp esi, edx
jge 0x53a2fc
cmp ebp, eax
jge 0x53a2fc
jae 0x53a43c
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x53a2b7
jmp 0x53a433
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
je 0x53a3f4
mov eax, edx
mov ecx, ebp
mov edx, ebx
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ecx, ebp
jge 0x53a42f
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x53a2e0
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x53a317
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x53a317
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x53a317
add esp, 0x34
ret
mov eax, esi
mov ecx, edx
call fcn.00450da0
mov ecx, eax
mov eax, ebp
call fcn.00450da0
nop
call fcn.0044f4e0
jmp fcn.0053a280
Function at 0x5411f0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x541298
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x54125f
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x541249
call fcn.0044f4e0
jmp fcn.005411f0
Function at 0x563cc0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x563e9e
movzx eax, byte [esp + 4]
cmp al, 0x61
jb 0x563ceb
cmp al, 0x7a
ja 0x563ceb
mov byte [esp + 0xc], 0
ret
cmp al, 0x41
jb 0x563e97
cmp al, 0x5a
setbe cl
test cl, cl
jne 0x563ce5
cmp al, 0x30
jb 0x563e90
cmp al, 0x39
setbe cl
test cl, cl
jne 0x563ce5
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x563e82
cmp al, 0x2c
ja 0x563e5f
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x563d35
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x563d2f
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x563d2f
cmp al, 0x2f
ja 0x563e25
cmp al, 0x26
ja 0x563dfd
cmp al, 0x24
jne 0x563df2
cmp ecx, 2
jg 0x563db6
cmp ecx, 1
je 0x563dab
cmp ecx, 2
jne 0x563d8d
cmp al, 0x2f
jne 0x563d7b
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
je 0x563d71
cmp al, 0x2c
je 0x563d71
cmp al, 0x3f
sete al
jmp 0x563d76
cmp ecx, 7
jne 0x563da5
cmp al, 0x21
jne 0x563d9d
mov byte [esp + 0xc], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x563d97
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x563ddc
cmp al, 0x40
jne 0x563dca
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
je 0x563dc0
cmp al, 0x3f
je 0x563dc0
cmp al, 0x3a
sete al
jmp 0x563dc5
cmp ecx, 6
je 0x563dec
cmp ecx, 7
jne 0x563d8d
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x563d5d
jmp 0x563d8d
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x563d5d
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x563e17
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x563d5d
jmp 0x563d8d
cmp al, 0x3d
ja 0x563e44
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x563d5d
cmp al, 0x3d
je 0x563d5d
jmp 0x563d8d
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x563d5d
cmp al, 0x5f
je 0x563e11
cmp al, 0x7e
je 0x563e11
jmp 0x563d8d
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x563d2f
cmp al, 0x5b
je 0x563d2f
cmp al, 0x5d
je 0x563d2f
jmp 0x563d42
cmp ecx, 4
je 0x563d1e
jmp 0x563d42
xor ecx, ecx
jmp 0x563d0d
xor ecx, ecx
jmp 0x563cfa
call fcn.0044f4e0
jmp fcn.00563cc0
Function at 0x618ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x618e07
sub esp, 0x34
lea eax, [0x6523e0]
mov dword [esp], eax
call fcn.0040a500
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x64]
mov edx, dword [esp + 4]
mov dword [esp + 0x24], edx
mov ebx, dword [eax + 0x68]
mov ecx, dword [ecx + 0x10]
mov ebp, dword [eax + 0x74]
mov eax, dword [eax + 0x78]
mov dword [esp], ebx
mov dword [esp + 8], 0x1e
mov dword [esp + 0xc], 0x1e
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
call ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x618deb
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0x1e
mov dword [esp + 0x30], 0x1e
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
cmp ecx, 0x4034b50
mov dword [esp + 0x2c], 0x1a
mov dword [esp + 0x30], 0x1a
lea edx, [eax + 4]
mov dword [esp + 0x28], edx
cmp ecx, 0x4034b50
je 0x618d7a
mov eax, dword [0x8ad7b8]
mov ecx, dword [0x8ad7bc]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x34
ret
lea ecx, [eax + 0x1a]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], 4
nop
nop
movzx ecx, word [eax + 0x1a]
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], 2
lea edx, [eax + 0x1c]
mov dword [esp + 0x28], edx
nop
nop
movzx eax, word [eax + 0x1c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x28], edx
lea eax, [ecx + eax + 0x1e]
mov dword [esp + 0x3c], eax
sar eax, 0x1f
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
add esp, 0x34
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
add esp, 0x34
ret
call fcn.0044f4e0
jmp fcn.00618ca0
Function at 0x401000
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x40102b
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x40102e
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x401016
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x5bea58], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x40100b
mov esp, ebp
pop ebp
ret
Function at 0x44ba10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [0x66103c]
push ebx
push esi
mov esi, ecx
lea ecx, [eax*4]
mov eax, dword [0x661038]
or ecx, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ecx
push 0x664c2c
fild qword [esp + 0x14]
fstp qword [0x661058]
call fcn.006583a8
add esp, 4
test eax, eax
je 0x44ba59
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
lea edx, [esp + 8]
mov ebx, 1
push edx
push ebx
push 0
push 0x661064
push 0x80000000
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0xa5bf4c], eax
jne 0x44bad5
mov edx, dword [esp + 8]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push 0x664c2c
push ecx
push 0
push 0
push edx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0xa5bf4c], eax
jne 0x44babc
cmp dword [esp + 0xc], ebx
je 0x44babe
xor bl, bl
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x44bad5
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xa5bf4c]
test ecx, ecx
jne 0x44baf8
test eax, eax
jle 0x44baf3
and eax, 0xffff
or eax, 0x80070000
mov dword [0xa5bf4c], eax
pop esi
mov eax, 0x80004006
pop ebx
add esp, 0x10
ret

Function at 0x4e1420
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x4e144b
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x4e144e
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x4e1436
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x5bea58], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x4e142b
mov esp, ebp
pop ebp
ret

Function at 0x51eff0
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xff
xchg edx, eax
test eax, 0xb3429e5a
xor al, 0x83
fisub word [ecx + 0x5c78e21e]
mov eax, dword [0x5c78e21e]
mov eax, dword [0x5c78e21e]
arpl word [edx], cx
inc edx
cld
ja 0x51f03f
add bh, dh
stc
or dh, bl
ret 0xf714
lea esi, gs:[ebx]
shl byte [edx - 0x2f1a0e42], 0xc9
leave
wait
jae 0x51efe5
inc edx
aas
out dx, al
dec ebx
sbb ch, dl
inc eax
inc edi
enter 0xffffffffffffbf56, 0x24
push ecx
cmp cl, byte [edi - 0x78]
cmp dword [ecx + 0x67], esi
fild qword [ebp - 0x5f3e7c78]
xor esi, dword [ebx]
wait
sar byte [esi - 0x13538f9e], 1
mov byte [ebx - 0x55edef4e], bl
ja 0x51f048
jmp 0x757cbab
Function at 0x61ff0d
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x197195f6
push edx
jp 0x61ff1a
sub byte [esi - 0x3059d49c], 0x21
adc al, dh
mov al, 0x56
in al, 0xd5
invalid
jae 0x61fecf
fbstp tbyte [ebp]
stc
mov bh, 0x2f
sbb byte [ecx + 0x5d], al
stosb byte es:[edi], al
mov bl, 0xb4
dec esi
mov ah, 0x4e
xchg ecx, eax
xchg edi, eax
jno 0x61ff67
leave
into
shl dword [edi - 0x2e], 0xc
adc ebx, 0xc7ae2740
lcall 0xb3d6, 0x93e78a25
adc eax, 0xd6b21d19
and al, 0x3f
and dword [edi - 0x7c], esp
mov al, byte [0x1e80b817]
jne 0x61ffaf
xchg esp, eax
inc ebx
daa
pop ebx
daa
or ah, byte [eax + 0x7ddda32e]
sub eax, 0x67ca5ce1
sbb eax, 0xa8274035
mov bh, 0xd0
cmpsd dword [esi], dword es:[edi]
mov byte [ecx + 0x59f3e200], bl
loope 0x61ff4c
mov dword [0xe12d7ddd], eax
pop esp
retf 0x1d67
pop ebp
jne 0x61ffa3
mov bh, 0x21
pushal
lahf
daa
xchg ecx, eax
adc esi, eax
dec esi
xor dword [edx], ecx
pushal
mov edx, 0x2591d950
jbe 0x61ffd4
dec eax
inc edx
insb byte es:[edi], dx
mov edi, es
in eax, dx
lodsd eax, dword [esi]
xor byte [ebx + 0x4e533d30], ch
jl 0x61ffe3
in al, dx
and al, 0x80
adc byte [ecx], al
push es
fsub st(2)
lcall 0xe009, 0x91e38068
cmpsd dword [esi], dword es:[edi]
and eax, 0x104635e9
mov dword [esi - 0x5065fe76], edi
cmp bl, byte [esi]
daa
mov ebp, 0xe39ab0c6
aaa
lcall 0xc6bd, 0x271e3aaf
mov al, 0x9a
jecxz 0x61ffe5
jbe 0x61ff47
xchg edi, eax
and dword [esi], esi
sbb al, 0xf1
scasd eax, dword es:[edi]
wait
xchg ecx, eax
leave
xor eax, 0x117d3152
test dword [eax + 0x2e8ff157], 0xfe081e21
out 0xaf, eax
xor al, 0x4b
cmp ebx, dword [edi - 0x4e]
imul ebx, dword [ebx], 0xe4257a43
dec edx
aad 0xbf
mov ecx, 0x364810cb
imul esi, dword [ecx + 0x5237f1ca], 0x2a
mov ah, 0xfe
push edi
mov al, 0x56
sub dh, byte [esi + edi*8 + 0x56b05765]
invalid
movsb byte es:[edi], byte [esi]
and al, 0x51
out 0x11, eax
rol dword [eax - 7], cl
sub dh, al
and byte [edi], dl
invalid
Function at 0x65979d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x661408
cmp edx, dword [eax]
je 0x6597bf
add eax, 8
inc ecx
cmp eax, 0x661498
jl 0x6597b0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x661408]
jne 0x6598ed
mov eax, dword [0xa5bf68]
cmp eax, 1
je 0x6598c7
test eax, eax
jne 0x6597f0
cmp dword [0x661334], 1
je 0x6598c7
cmp edx, 0xfc
je 0x6598ed
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659827
lea eax, [ebp - 0x1a4]
push 0x65e970
push eax
call fcn.0065a180
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a610
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65986a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a610
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e96c
push edi
call fcn.0065c4e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65e950
push eax
call fcn.0065a180
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a190
lea eax, [ebp - 0xa0]
push 0x65e94c
push eax
call fcn.0065a190
push dword [esi + 0x66140c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a190
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65e924
push eax
call fcn.0065c454
add esp, 0x2c
pop edi
jmp 0x6598ed
lea eax, [ebp + 8]
lea esi, [esi + 0x66140c]
push 0
push eax
push dword [esi]
call fcn.0065a610
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1401ea5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x44
mov dl, 0x57
pop ecx
lea edi, [ebx + 0x44]
cmp dword [ebp + 0x14], ecx
jle 0x1401ecf
xor byte [ecx + ebx], dl
mov al, byte [ecx + ebx]
add al, 0x57
add dl, al
inc ecx
cmp ecx, dword [ebp + 0x14]
jl 0x1401ebf
and dword [ebp + 0x14], 0
cmp dword [edi + 4], 0
jl 0x1401f27
push esi
lea esi, [ebx + 0x64]
cmp dword [esi + 8], 0
je 0x1401ee9
mov eax, dword [esi - 8]
mov dword [ebp - 4], eax
mov eax, dword [esi - 4]
mov ecx, dword [esi]
cmp eax, ecx
jle 0x1401f05
sub eax, ecx
push eax
mov eax, dword [esi - 8]
add eax, ecx
push 0
push eax
call fcn.01402c00
add esp, 0xc
mov eax, dword [esi + 4]
push dword [esi]
add eax, ebx
push eax
push dword [esi - 8]
call fcn.01402c60
add esp, 0xc
inc dword [ebp + 0x14]
mov eax, dword [ebp + 0x14]
add esi, 0x14
cmp eax, dword [edi + 4]
jle 0x1401edd
pop esi
push edi
call fcn.01401f51
mov eax, dword [edi + 0x10]
pop ecx
push 0
push 1
push 0
sub eax, 0xc
call eax
mov eax, dword [edi + 8]
push dword [ebp + 0x10]
xor eax, 0x7a32bc85
call eax
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop ebx
leave
ret

Function at 0x14020eb
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x1402115
push dword [esp + 0xc]
call fcn.01402b80
pop ecx
inc eax
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8