joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d3795ca
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov byte [ebp - 1], 0
cmp dword [ebp + 0x10], esi
je 0x6d3795f7
push dword [0x6d38bc9c]
mov eax, dword [edi]
push dword [ebp + 0x10]
push edi
call dword [eax + 0x17c]
mov ebx, eax
cmp ebx, esi
jne 0x6d379600
push esi
push edi
call sym.java.dll__JNU_ThrowNullPointerException_8
jmp 0x6d379651
push esi
push ebx
push edi
call fcn.6d37e410
mov esi, eax
test esi, esi
je 0x6d379651
push esi
call sub.jvm.dll__JVM_NativePath_4
push 0
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x6d379649
push esi
test al, 0x10
je 0x6d379636
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
jmp 0x6d37963c
call dword [sym.imp.kernel32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
test eax, eax
jne 0x6d379649
mov byte [ebp - 1], 1
push esi
push ebx
push edi
call sym.java.dll__JNU_ReleaseStringPlatformChars_12
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x6d3799d1
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov byte [ebp - 1], 0
cmp dword [ebp + 0x10], edi
je 0x6d3799fe
push dword [0x6d38bc9c]
mov eax, dword [esi]
push dword [ebp + 0x10]
push esi
call dword [eax + 0x17c]
mov ebx, eax
cmp ebx, edi
jne 0x6d379a07
push edi
push esi
call sym.java.dll__JNU_ThrowNullPointerException_8
jmp 0x6d379a42
push edi
push ebx
push esi
call fcn.6d37e410
mov edi, eax
test edi, edi
je 0x6d379a42
push edi
call sub.jvm.dll__JVM_NativePath_4
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x6d379a3a
or eax, 1
push eax
push edi
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
je 0x6d379a3a
mov byte [ebp - 1], 1
push edi
push ebx
push esi
call sym.java.dll__JNU_ReleaseStringPlatformChars_12
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x6d379abb
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
xor edi, edi
cmp dword [ebp + 0x10], ebx
je 0x6d379ae9
push dword [0x6d38bc9c]
mov eax, dword [esi]
push dword [ebp + 0x10]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x6d379af3
push 0
push esi
call sym.java.dll__JNU_ThrowNullPointerException_8
jmp 0x6d379b52
push 0
push eax
push esi
call fcn.6d37e410
mov dword [ebp + 0x10], eax
test eax, eax
je 0x6d379b52
push eax
call sub.jvm.dll__JVM_NativePath_4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x6d379b46
mov eax, dword [ebp + 0x14]
sub eax, 0
je 0x6d379b40
dec eax
je 0x6d379b38
dec eax
jne 0x6d379b46
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
jmp 0x6d379b46
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
jmp 0x6d379b46
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push esi
call sym.java.dll__JNU_ReleaseStringPlatformChars_12
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
leave
ret 0x10

Function at 0x6d37a246
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [0x6d38bca0]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.6d3753cb
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x6d37a267
xor al, al
jmp 0x6d37a298
push ebx
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
push eax
push esi
call fcn.6d37e410
push esi
mov ebx, eax
call dword [sym.imp.msvcr100.dll_free]
add esp, 0xc
cmp ebx, 0xffffffff
je 0x6d37a2a7
mov eax, dword [esp + 0x18]
dec eax
je 0x6d37a295
dec eax
je 0x6d37a29c
dec eax
dec eax
jne 0x6d37a2a7
mov al, 1
pop ebx
pop esi
ret 0x10
mov al, 1
test bl, 0x10
jne 0x6d37a297
test al, bl
je 0x6d37a297
xor al, al
jmp 0x6d37a297

Function at 0x6d37a2ab
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x14], 4
push edi
mov byte [ebp - 1], 0
je 0x6d37a34d
cmp dword [ebp + 0x14], 1
je 0x6d37a34d
push dword [0x6d38bca0]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.6d3753cb
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x6d37a2e6
xor al, al
jmp 0x6d37a350
push ebx
push esi
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
push edi
call esi
mov ebx, dword [sym.imp.msvcr100.dll_free]
cmp eax, 0xffffffff
je 0x6d37a342
test eax, 0x400
je 0x6d37a31b
push edi
call fcn.6d379bba
pop ecx
mov dword [ebp + 0x14], eax
test eax, eax
je 0x6d37a342
push edi
call ebx
mov edi, dword [ebp + 0x14]
pop ecx
push edi
call esi
cmp eax, 0xffffffff
je 0x6d37a342
test al, 0x10
jne 0x6d37a342
cmp byte [ebp + 0x18], 0
je 0x6d37a32f
and eax, 0xfffffffe
jmp 0x6d37a332
or eax, 1
push eax
push edi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x6d37a342
mov byte [ebp - 1], 1
push edi
call ebx
mov al, byte [ebp - 1]
pop ecx
pop esi
pop ebx
jmp 0x6d37a350
mov al, byte [ebp + 0x18]
pop edi
leave
ret 0x18
Function at 0x6d37a4a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
xor esi, esi
push esi
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.6d37e410
mov edi, eax
add esp, 0xc
cmp edi, esi
jne 0x6d37a4c7
xor al, al
jmp 0x6d37a536
push esi
push 0x200080
push 1
push esi
push 3
push 0xc0000000
push edi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x6d37a525
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
cmp esi, 0x50
je 0x6d37a51b
cmp esi, 0xb7
je 0x6d37a51b
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x6d37a51b
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
push str.Could_not_open_file
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowIOExceptionWithLastError_8
push edi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
jmp 0x6d37a4c3
push edi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
ret 0xc

Function at 0x6d37a53b
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push dword [0x6d38bca0]
xor bl, bl
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.6d3753cb
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x6d37a55f
xor al, al
jmp 0x6d37a59f
push 0x80
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6d37a595
push esi
test al, 0x10
je 0x6d37a584
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
jmp 0x6d37a58a
call dword [sym.imp.kernel32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
test eax, eax
jne 0x6d37a595
mov bl, 1
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
mov al, bl
pop esi
pop ebx
ret 0xc
Function at 0x6d37c007
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
push edi
push 0
push dword [esp + 0x20]
push esi
call dword [eax + 0x2e0]
mov edi, eax
push edi
push dword [esp + 0x1c]
call dword [sym.imp.advapi32.dll_RegDeleteKeyA]
push 0
push edi
push dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esi]
push esi
call dword [eax + 0x300]
pop edi
pop esi
mov eax, ebx
pop ebx
ret 0x10

Function at 0x6d37c34e
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.advapi32.dll_CryptAcquireContextA]
push edi
xor ebx, ebx
push ebx
push 1
push ebx
mov edi, str.J2SE
push edi
lea eax, [ebp - 8]
push eax
mov byte [ebp - 1], bl
call esi
test eax, eax
jne 0x6d37c389
push 8
push 1
push ebx
push edi
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jne 0x6d37c389
xor al, al
jmp 0x6d37c3da
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x2ac]
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x2e0]
mov edi, eax
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_CryptGenRandom]
test eax, eax
je 0x6d37c3bf
mov byte [ebp - 1], 1
mov eax, dword [esi]
push ebx
push edi
push dword [ebp + 0x10]
push esi
call dword [eax + 0x300]
push ebx
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x6d381820
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d38bb70]
jne 0x6d38182a
repz ret
jmp fcn.6d381dab
Function at 0x4023bd
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push 0x80000301
push 0
push 3
push 0x80000004
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402411
mov eax, 0x42225d
push eax
push 2
mov ebx, 0x134
call fcn.004153e0
add esp, 0x1c
mov dword [ebp - 0x1c], eax
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40243a
mov eax, 0x42225d
push eax
push 1
mov ebx, 0x130
call fcn.00415430
add esp, 0x10
mov dword [ebp - 0x20], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x402463
mov eax, 0x42225d
push eax
push 1
mov ebx, 0x130
call fcn.00415430
add esp, 0x10
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x20]
push dword [ebp - 8]
push dword [ebp - 0x1c]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
nop
nop
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4024ac
push ebx
call fcn.00413f49
add esp, 4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4024c6
mov eax, 0
jmp 0x402514
push 0x80000301
push 0
push 0x40
push 0x80000301
push 0
push dword [ebp - 0x14]
push 2
mov ebx, 0xc4
call fcn.00415440
add esp, 0x1c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x40
jne 0x40250a
mov eax, 1
jmp 0x402514
mov eax, 0
jmp 0x402514
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402525
push ebx
call fcn.00413f49
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x402535
push ebx
call fcn.00413f49
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4050c6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x405106
mov eax, 0
jmp 0x4051d7
cmp dword [ebp + 0x14], 0
je 0x40511a
mov eax, 0x100
jmp 0x40511f
mov eax, 0x200
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 0x18]
push 2
mov ebx, 0xc8
call fcn.004153c0
add esp, 0x1c
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x405165
add eax, 8
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40518a
mov eax, 0
jmp 0x4051d7
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
je 0x4051a8
add eax, 8
push eax
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
nop
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
nop
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x4051d7
mov esp, ebp
pop ebp
ret 0x14

Function at 0x406c9c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x406ce3
cmp ebx, 0x20
je 0x406ce3
cmp ebx, 0xffffffe0
je 0x406ce3
jne 0x406cec
add eax, 1
cmp esi, eax
je 0x406cf9
jne 0x406cc8
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x406cfd
jne 0x406cc4
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4
Function at 0x406d11
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x406dd2
test ecx, ecx
je 0x406dd2
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x406dd2
test ebx, ebx
je 0x406dd2
mov ebx, eax
add ebx, edx
je 0x406dd2
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x406dd2
cmp dword [edx + eax + 0x14], 0
je 0x406dd2
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x406dd2
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x406dc2
test dl, dl
je 0x406dbe
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x406dc2
add edi, 2
add esi, 2
test dl, dl
jne 0x406da2
xor eax, eax
jmp 0x406dc7
sbb eax, eax
or eax, 1
test eax, eax
je 0x406dde
inc ebp
cmp ebp, dword [esp + 4]
jb 0x406d8f
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x407d3f
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x407d6d
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x407d64
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x407d5c
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x407d8e
mov esp, ebp
pop ebp
ret

Function at 0x407d92
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x407dfe
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x407e2b
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x407e1a
xor ecx, eax
xor edx, ebx
dec edi
jne 0x407e0b
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x407e51
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x407df2
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x407e7d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4159f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x415a82
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x415a74
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x415a6c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x415a35
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x415a90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [esp + 0x11c]
push ebp
push esi
push edi
push eax
call fcn.00416e50
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov ebp, eax
mov dword [esp + 0x18], esi
call dword [0x443f40]
add esp, 8
test ebp, ebp
je 0x415b77
test eax, eax
je 0x415b77
inc eax
push ebx
push eax
call fcn.00417151
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004174a0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x415b0b
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x415b5f
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push esi
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x415b4c
cmp eax, 0xea
jne 0x415b54
mov dword [esp + 0x14], 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0041715f
mov eax, dword [esp + 0x18]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x114
ret
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x114
ret
Function at 0x415b90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00416e50
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call dword [0x443f40]
add esp, 8
test ebx, ebx
je 0x415cd4
test eax, eax
je 0x415cd4
inc eax
push eax
call fcn.00417151
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004174a0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x415c02
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x415cc1
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.00417151
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x415c8a
cmp eax, 0xea
jne 0x415cad
push esi
call fcn.0041715f
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00417151
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x415c55
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x415c98
cmp eax, 2
jne 0x415cad
push esi
call dword [0x443f40]
push eax
push esi
call fcn.00416b90
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call fcn.0041715f
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0041715f
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x415cfd
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x415d09
mov esi, dword [esp + 0x40]
test esi, esi
je 0x415d09
push esi
call dword [0x443f40]
push eax
push esi
call fcn.00416b90
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x415ec0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x415ede
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x415ed3
pop esi
ret
Function at 0x416470
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x4164a2
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], 0x100
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x416502
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x4164d9
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x4165b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x41664c
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x4165db
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret