joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435368
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x82c
mov ecx, 0x200
mov eax, 0xffffffff
mov dword [esp + 0x18], edi
lea edi, [esp + 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
rep stosd dword es:[edi], eax
xor ebx, ebx
mov eax, dword [ebx*8 + 0x470c80]
mov edx, dword [ebx*8 + 0x470c84]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
push 0x800
lea ecx, [esp + 0x30]
push ecx
push dword [esp + 0x30]
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov edi, eax
test eax, eax
je 0x43540c
mov dword [esp + 8], edi
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], edx
mov edx, 0x467020
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.004199f0
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], 0x40a8d8
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [esp], 0x467020
call fcn.004199f0
inc ebx
cmp ebx, 3
jb 0x435398
mov dword [esp + 0xc], 0x40a7f4
lea eax, [esp + 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], 0x467020
call fcn.004199f0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x82c
ret

Function at 0x436264
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
call fcn.00403068
mov dword [esp + 4], eax
push dword [esp + 0x28]
lea eax, [esp + 8]
call fcn.00403174
push dword [esp + 0x2c]
push dword [esp + 0x2c]
lea eax, [esp + 0x1c]
call fcn.00448a44
lea eax, [esp + 0x14]
call fcn.00448a88
xor al, 1
je 0x4362c4
lea eax, [esp + 0x14]
call fcn.00448aa0
push eax
lea eax, [esp + 8]
call fcn.00403e60
lea eax, [esp + 0x14]
call fcn.00448b88
lea eax, [esp + 0x14]
call fcn.00448a88
xor al, 1
jne 0x43629b
lea eax, [esp + 4]
call fcn.004031b0
add esp, 0x24
ret 8

Function at 0x436850
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.00449274
xor al, 1
je 0x43688b
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0044927c
push eax
mov eax, ebx
call fcn.00403448
lea eax, [esp + 8]
call fcn.00449298
lea eax, [esp + 8]
call fcn.00449274
xor al, 1
jne 0x436860
pop ebx
ret 8
Function at 0x437810
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x437a35
push edx
mov edx, 0x4697f0
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x134
mov dword [ebp - 0x13c], ebx
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x18], eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ebp - 0x128], 0xffffffff
mov dword [ebp - 0x144], 0x64
mov dword [ebp - 0x148], edx
call fcn.00417ad0
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x12c], edx
call fcn.004284c4
push dword [ebp + 0x10]
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x120]
push dword [ebp + 0xc]
call fcn.004173fc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x120]
call fcn.00417340
mov edi, eax
lea eax, [ebp - 0x124]
push eax
mov edx, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
push edx
push ecx
push 0
push edi
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
cmp eax, 0xea
jne 0x437930
lea ecx, [ebp - 0x130]
mov edx, 0x4697f0
push ecx
push dword [ebp - 0x124]
push edx
call fcn.00412b28
lea eax, [ebp - 0x120]
call fcn.00417340
mov edi, eax
lea eax, [ebp - 0x124]
push eax
mov edx, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
push edx
push ecx
push 0
push edi
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
add esp, 0xc
push esi
mov ecx, 0x437a60
xor ebx, ebx
push ecx
mov edi, 0x428748
mov eax, 0x2c7
push ebx
push edi
push 0x16
call fcn.0043719c
mov edx, dword [ebp - 0x128]
cmp edx, dword [ebp - 0x18]
sete cl
mov edx, 0x437aa8
push ecx
xor ebx, ebx
push edx
push ebx
call fcn.004044f4
mov eax, dword [ebp - 0x128]
cmp eax, 3
je 0x4379aa
mov esi, 0x46de10
push esi
call fcn.0041407c
add esp, 4
mov ecx, 0x4377e8
push ecx
mov edx, 0x428748
mov edi, 0x16
push 0x27
mov ebx, eax
mov eax, ebx
push edx
push edi
push 0x2d3
push 0
call fcn.004286b4
push eax
call fcn.00413d00
lea esi, [ebp - 0x130]
mov ecx, 0x4697f0
push esi
push dword [ebp - 0x124]
push ecx
call fcn.00412b28
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x130]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0xc]
push 0xffffffffffffffff
push ecx
push 0x471090
call fcn.004156d8
add esp, 0xc
call fcn.004379fd
jmp 0x437a10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x138]
mov edi, dword [ebp - 0x134]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x437b10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x437c5e
push edx
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x12c
mov dword [ebp - 0x13c], ebx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x120]
mov dword [ecx], 0
mov dword [ecx + 4], 0
push dword [ebp + 0x10]
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x12c], 8
push dword [ebp + 0xc]
call fcn.004173fc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x12c]
push edx
lea ebx, [ebp - 0x130]
lea eax, [ebp - 0x120]
push dword [ebp + 8]
push ebx
push 0
call fcn.00417340
push eax
push dword [ebp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov ecx, 0x437c68
xor esi, esi
push eax
mov edx, 0x428748
mov eax, 0x2a5
push ecx
push esi
push edx
push 0x16
call fcn.0043719c
mov dword [ebp - 4], 0xffffffff
call fcn.00437bd4
jmp 0x437be0
mov ecx, dword [ebp - 0x130]
cmp ecx, dword [ebp - 0x18]
sete bl
mov edx, 0x437c74
push ebx
xor esi, esi
push edx
push esi
call fcn.004044f4
mov eax, dword [ebp - 0x130]
cmp eax, 0xb
je 0x437c39
mov ecx, 0x437ae0
mov edx, 0x428748
mov ebx, 0x16
push ecx
push 0x2f
push edx
push ebx
push 0x2b0
push esi
mov esi, 0x46de10
push esi
call fcn.0041407c
add esp, 4
call fcn.004286b4
push eax
call fcn.00413d00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x138]
mov edi, dword [ebp - 0x134]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x437cdc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x437e36
push edx
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x12c
mov dword [ebp - 0x13c], ebx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x120]
mov dword [ecx], 0
push dword [ebp + 0x10]
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x12c], 4
push dword [ebp + 0xc]
call fcn.004173fc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x12c]
push edx
lea ebx, [ebp - 0x130]
lea eax, [ebp - 0x120]
push dword [ebp + 8]
push ebx
push 0
call fcn.00417340
push eax
push dword [ebp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov ecx, 0x437e40
xor esi, esi
push eax
mov edx, 0x428748
mov eax, 0x281
push ecx
push esi
push edx
push 0x16
call fcn.0043719c
mov dword [ebp - 4], 0xffffffff
call fcn.00437d99
jmp 0x437da5
mov ecx, dword [ebp - 0x130]
cmp ecx, dword [ebp - 0x18]
sete bl
mov edx, 0x437e4c
push ebx
xor esi, esi
push edx
push esi
call fcn.004044f4
mov eax, dword [ebp - 0x130]
cmp eax, 4
je 0x437e11
cmp eax, 5
je 0x437dd2
jmp 0x437ddd
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
bswap ecx
mov dword [edx], ecx
jmp 0x437e11
mov ebx, 0x437cac
mov edx, 0x428748
mov esi, 0x16
push ebx
mov eax, 0x46de10
push 0x2f
push edx
push esi
push 0x297
push 0
push eax
call fcn.0041407c
add esp, 4
call fcn.004286b4
push eax
call fcn.00413d00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x138]
mov edi, dword [ebp - 0x134]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4381dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x438471
push edx
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x13c
mov dword [ebp - 0x148], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x150], ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x14c], esi
lea esi, [ebp - 0x144]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x124]
mov dword [edi], 0
mov dword [edi + 4], 0
push dword [ebp + 0x10]
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x130], 8
push dword [ebp + 0xc]
call fcn.004173fc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x124]
call fcn.00417340
lea ecx, [ebp - 0x134]
lea ecx, [ebp - 0x130]
lea edx, [ebp - 0x144]
push ecx
push edx
lea edx, [ebp - 0x134]
push edx
push 0
push eax
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xea
jne 0x4382e3
push dword [ebp - 0x130]
mov ecx, 0x4693c0
push ecx
call fcn.00417ad0
mov esi, edx
lea eax, [ebp - 0x124]
call fcn.00417340
lea ecx, [ebp - 0x130]
push ecx
lea edx, [ebp - 0x134]
push esi
push edx
push 0
push eax
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [ebp - 0x1c], eax
add esp, 8
push dword [ebp - 0x1c]
mov edx, 0x43847c
xor ebx, ebx
push edx
mov ecx, 0x428748
mov eax, 0x221
push ebx
push ecx
push 0x16
call fcn.0043719c
mov edx, dword [ebp - 0x134]
cmp edx, dword [ebp - 0x18]
sete cl
mov edx, 0x438488
push ecx
xor ebx, ebx
push edx
push ebx
call fcn.004044f4
mov ebx, dword [ebp - 0x134]
cmp ebx, 0xb
ja case.0x43832b.0
jmp dword [ebx*4 + 0x471110]
mov dword [ebp - 0x138], esi
mov ecx, dword [ebp - 0x130]
shr ecx, 1
mov dword [ebp - 0x13c], ecx
cmp dword [ebp - 0x13c], 0
je 0x438387
mov edx, dword [ebp - 0x13c]
lea ecx, [esi + edx*2]
mov eax, dword [ebp - 0x13c]
cmp word [ecx - 2], 0
jne 0x438387
lea ebx, [ebp - 0x13c]
mov edx, 0x473810
push ebx
mov eax, dword [ebp - 0x13c]
lea esi, [eax - 1]
push esi
push edx
call fcn.00410cd0
add esp, 0xc
push dword [ebp - 0x138]
push dword [ebp - 0x13c]
call fcn.00449618
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x438415
mov eax, dword [ebp - 0x144]
call fcn.0044962c
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x438415
mov eax, dword [ebp - 0x144]
bswap eax
call fcn.0044962c
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x438415
push dword [ebp - 0x140]
push dword [ebp - 0x144]
call fcn.00449634
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x438415
mov ecx, 0x46de10
push ecx
call fcn.0041407c
add esp, 4
mov edi, 0x4377e8
push edi
mov edx, 0x428748
mov esi, 0x16
push 0x27
mov ebx, eax
mov eax, ebx
push edx
push esi
push 0x247
push 0
call fcn.004286b4
push eax
call fcn.00413d00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc]
push 0xffffffffffffffff
push ecx
push 0x471140
call fcn.004156d8
add esp, 0xc
call fcn.00438439
jmp 0x43844c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x150]
mov esi, dword [ebp - 0x14c]
mov edi, dword [ebp - 0x148]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x438c84
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x438e65
push edx
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x30], ebx
xor ebx, ebx
push 0xffffffffffffffff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], eax
push dword [eax + 8]
call sub.KERNEL32.DLL_WaitForSingleObject
mov eax, dword [ebp - 0x18]
push 0
push 1
mov ecx, dword [ebp - 0x18]
inc dword [eax + 0x30]
push dword [ecx + 8]
call sub.KERNEL32.DLL_ReleaseSemaphore
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x10]
mov esi, dword [eax]
call dword [esi + 0x1c]
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov edx, dword [ebp - 0x18]
push dword [edx + 0xc]
call sub.KERNEL32.DLL_WaitForSingleObject
mov esi, eax
cmp eax, 0x102
sete cl
mov edx, dword [ebp - 0x18]
mov byte [ebp - 0x1c], cl
lea ecx, [edx + 0x14]
push ecx
call sub.KERNEL32.DLL_EnterCriticalSection
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x18]
mov edi, dword [edx + 0x34]
test edi, edi
je 0x438d79
cmp byte [ebp - 0x1c], 0
je 0x438d38
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x30], 0
je 0x438d31
mov edx, dword [ebp - 0x18]
xor edi, edi
dec dword [edx + 0x30]
jmp 0x438d38
mov dword [ecx + 0x2c], 1
mov ecx, dword [ebp - 0x18]
dec dword [ecx + 0x34]
mov edx, dword [ecx + 0x34]
test edx, edx
jne 0x438dc0
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x30], 0
je 0x438d63
push 0
push 1
mov edx, dword [ebp - 0x18]
push dword [edx + 8]
call sub.KERNEL32.DLL_ReleaseSemaphore
mov esi, eax
xor edi, edi
jmp 0x438dc0
mov edx, dword [ebp - 0x18]
mov ebx, dword [edx + 0x2c]
test ebx, ebx
je 0x438dc0
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x2c], 0
jmp 0x438dc0
mov ecx, dword [ebp - 0x18]
inc dword [ecx + 0x2c]
mov edx, dword [ecx + 0x2c]
cmp edx, 0x3fffffff
jne 0x438dc0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x18]
push dword [ecx + 8]
call sub.KERNEL32.DLL_WaitForSingleObject
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x2c]
push 0
mov edx, dword [ebp - 0x18]
mov esi, eax
sub dword [edx + 0x30], ecx
push 1
mov ecx, dword [ebp - 0x18]
push dword [ecx + 8]
call sub.KERNEL32.DLL_ReleaseSemaphore
mov edx, dword [ebp - 0x18]
mov esi, eax
mov dword [edx + 0x2c], 0
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + 0x14]
push edx
call sub.KERNEL32.DLL_LeaveCriticalSection
cmp edi, 1
jne 0x438dfc
test ebx, ebx
jle 0x438de9
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x18]
push dword [ecx + 0xc]
call sub.KERNEL32.DLL_WaitForSingleObject
dec ebx
mov esi, eax
test ebx, ebx
jg 0x438dd5
push 0
push 1
mov ebx, dword [ebp - 0x18]
push dword [ebx + 8]
call sub.KERNEL32.DLL_ReleaseSemaphore
mov esi, eax
jmp 0x438e11
test edi, edi
je 0x438e11
push 0
push 1
mov eax, dword [ebp - 0x18]
push dword [eax + 0xc]
call sub.KERNEL32.DLL_ReleaseSemaphore
mov esi, eax
mov esi, dword [ebp - 0x18]
mov eax, dword [esi + 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
movsx eax, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov esp, ebp
xor al, 1
pop ebp
ret 4
Function at 0x439cb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
push eax
mov eax, 1
push 0
call fcn.00449d50
xor al, 1
je 0x439cda
call fcn.00424498
mov eax, 1
push ebx
push 0
call fcn.00449d50
xor al, 1
jne 0x439cc4
pop ebx
ret

Function at 0x43db20
Capabilities:
Get file attributes

Disassembly:
push eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
pop ecx
ret

Function at 0x43df30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
pop ecx
ret

Function at 0x440dc4
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x1c]
mov dword [esp], ebx
mov ebx, edx
mov dword [esp + 4], esi
mov esi, dword [esp + 0x18]
and esi, 0xfffffffc
mov dword [esp + 8], edi
add esi, edx
cmp edx, esi
mov dword [esp + 0xc], eax
je 0x440e20
mov ecx, dword [ebx]
add ebx, 4
imul edx, ecx, 0xcc9e2d51
mov ecx, edx
rol edx, 0xf
mov ecx, edx
imul edx, ecx, 0x1b873593
mov ecx, edx
xor dword [esp + 0xc], ecx
mov edx, dword [esp + 0xc]
rol edx, 0xd
lea edx, [edx + edx*4 - 0x19ab949c]
cmp ebx, esi
mov dword [esp + 0xc], edx
jne 0x440dec
mov edx, dword [esp + 0x18]
mov eax, edx
xor ecx, ecx
and eax, 3
cmp eax, 1
je 0x440e4e
cmp eax, 2
je 0x440e45
cmp eax, 3
je 0x440e3e
jmp 0x440e6e
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
movzx esi, byte [ebx + 1]
shl esi, 8
xor ecx, esi
movzx edi, byte [ebx]
xor ecx, edi
imul eax, ecx, 0xcc9e2d51
mov esi, eax
mov ecx, eax
rol esi, 0xf
mov ecx, esi
imul edi, ecx, 0x1b873593
mov ecx, edi
xor dword [esp + 0xc], ecx
xor dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
movsx ebx, word [esp + 0xe]
and ebx, 0xffff
xor dword [esp + 0x10], ebx
imul eax, dword [esp + 0x10], 0x85ebca6b
mov dword [esp + 0x10], eax
shr eax, 0xd
xor dword [esp + 0x10], eax
imul esi, dword [esp + 0x10], 0xc2b2ae35
mov dword [esp + 0x10], esi
movsx edi, word [esp + 0x12]
and edi, 0xffff
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x10]
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x14
ret 8

Function at 0x449648
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], esi
mov esi, eax
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x18], edi
mov dword [esi], 0
mov eax, dword [ebx]
call fcn.004284c4
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edi, eax
cmp eax, 0xea
je 0x4496ac
mov eax, edi
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x1c
ret 0xc
mov dword [esp + 8], ebx
mov ecx, dword [ebx]
add ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], 0x46dc30
call fcn.00410cd0
mov eax, dword [ebx]
call fcn.004284c4
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edi, eax
cmp eax, 0xea
jne 0x449694
jmp 0x4496ac
Function at 0x4496f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], esi
mov esi, eax
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x18], edi
mov dword [esi], 0
mov eax, dword [ebx]
call fcn.004284c4
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumValueW
mov edi, eax
cmp eax, 0xea
je 0x449754
mov eax, edi
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x1c
ret 0xc
mov dword [esp + 8], ebx
mov ecx, dword [ebx]
add ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], 0x46dc30
call fcn.00410cd0
mov eax, dword [ebx]
call fcn.004284c4
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumValueW
mov edi, eax
cmp eax, 0xea
jne 0x44973c
jmp 0x449754

Function at 0x44bac8
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
lea eax, [esp + 8]
call fcn.00402898
xor al, 1
je 0x44baef
inc ebx
lea eax, [esp + 8]
call fcn.00402974
lea eax, [esp + 8]
call fcn.00402898
xor al, 1
jne 0x44bad8
mov eax, ebx
pop ebx
ret 8

Function at 0x44cb94
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.00402898
xor al, 1
je 0x44cbcf
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.004028e4
push eax
mov eax, ebx
call fcn.004520e0
lea eax, [esp + 8]
call fcn.00402974
lea eax, [esp + 8]
call fcn.00402898
xor al, 1
jne 0x44cba4
pop ebx
ret 8
Function at 0x44e330
Capabilities:
Resume thread

Disassembly:
sub esp, 0x14
mov dword [esp + 0xc], edi
mov edi, eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov ecx, dword [eax + 0xc]
push ecx
sub esp, 4
call sub.KERNEL32.DLL_GetCurrentThreadId
add esp, 4
pop ecx
cmp ecx, eax
je 0x44e399
push dword [edi + 8]
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 0xffffffff
jne 0x44e399
mov eax, edi
call fcn.0042446c
xor al, 1
je 0x44e388
mov eax, edi
call fcn.004246d0
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x14
ret
mov edx, 0x44e318
mov ebx, 0x17
push edx
push ebx
call fcn.0042f240
movsx ecx, byte [edi + 0x4c]
xor cl, 1
je 0x44e3aa
mov esi, dword [edi + 0x48]
mov eax, dword [esi]
mov dword [esi + 4], eax
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ecx, 8
xor eax, eax
add edi, 0x54
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x14
ret

Function at 0x44f12c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.00453824
lea esi, [esp + 0x30]
lea edi, [esp + 0x18]
mov dword [esp + 8], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x18]
call fcn.0044eff0
xor al, 1
je 0x44f183
lea eax, [esp + 0x18]
call fcn.0044efb8
push edx
push eax
lea eax, [esp + 0x10]
call fcn.0045385c
lea eax, [esp + 0x18]
call fcn.0044f004
lea eax, [esp + 0x18]
call fcn.0044eff0
xor al, 1
jne 0x44f159
lea eax, [esp + 8]
call fcn.00453a6c
mov esi, dword [esp]
mov edi, dword [esp + 4]
add esp, 0x2c
ret 0x14
Function at 0x4502b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x34
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x28], edi
mov edi, 0xffff
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x30], eax
mov esi, dword [eax]
cmp esi, ebp
jae 0x450493
mov ecx, dword [esp + 0x3c]
movzx ebx, byte [ecx + esi]
test bl, 0x80
je 0x450425
mov byte [esp + 0x2c], bl
mov edx, 1
movzx ecx, byte [esp + 0x2c]
mov ebx, ecx
movsx eax, bl
movsx ecx, dl
shl al, cl
test al, 0x80
jne 0x45031a
mov bl, byte [esp + 0x2c]
cmp edx, 1
je 0x450447
jmp 0x450326
inc edx
cmp edx, 4
ja 0x450447
jmp 0x4502ff
mov ecx, 7
mov edi, 1
sub ecx, edx
shl edi, cl
dec edi
movzx ecx, bl
and edi, ecx
lea ecx, [edx + esi - 1]
cmp ecx, ebp
jae 0x450447
lea ecx, [esi + 1]
cmp ecx, ebp
jae 0x4504a7
mov ecx, dword [esp + 0x3c]
add ecx, esi
movzx eax, byte [ecx + 1]
movzx ecx, bl
and cl, 0xfe
cmp cl, 0xc0
je 0x450447
cmp bl, 0xe0
jne 0x450381
movzx ecx, al
and cl, 0xe0
cmp cl, 0x80
je 0x450447
cmp bl, 0xf0
jne 0x450395
movzx ecx, al
and cl, 0xf0
cmp cl, 0x80
je 0x450447
cmp bl, 0xf8
jne 0x4503a9
movzx ecx, al
and cl, 0xf8
cmp cl, 0x80
je 0x450447
cmp bl, 0xfc
jne 0x4503bd
movzx ecx, al
and cl, 0xfc
cmp cl, 0x80
je 0x450447
mov ebx, 1
cmp edx, ebx
je 0x4503fd
lea ecx, [ebx + esi]
cmp ecx, ebp
jae 0x4504bb
lea ecx, [ebx + esi]
mov eax, dword [esp + 0x3c]
movzx ecx, byte [ecx + eax]
mov byte [esp + 0x2c], cl
and cl, 0xc0
cmp cl, 0x80
jne 0x450447
shl edi, 6
movzx ecx, byte [esp + 0x2c]
and ecx, 0x3f
or edi, ecx
inc ebx
cmp ebx, edx
jne 0x4503c6
cmp edi, 0xd800
jb 0x450417
lea ecx, [edi - 0xe000]
cmp ecx, 0x101fff
jbe 0x450417
xor ecx, ecx
jmp 0x45041c
mov ecx, 1
xor cl, 1
jne 0x450447
add esi, edx
jmp 0x450429
movzx edi, bl
inc esi
mov edx, dword [esp + 0x30]
mov eax, edi
mov dword [edx], esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x34
ret 8
mov ecx, 0x43c2e0
mov ebx, 0x11
mov edx, 0x45029c
mov dword [esp + 0x14], 0x124
mov eax, 0x16
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004198f0
mov eax, edi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x34
ret 8
mov dword [esp + 4], 0xdf
mov dword [esp], 0x43c2e0
call fcn.00410c8c
mov dword [esp + 4], 0x107
mov dword [esp], 0x43c2e0
call fcn.00410c8c
mov dword [esp + 4], 0x111
mov dword [esp], 0x43c2e0
call fcn.00410c8c
int3

Function at 0x453ba4
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.0045544c
xor al, 1
je 0x453bdf
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00455454
push eax
mov eax, ebx
call fcn.00403448
lea eax, [esp + 8]
call fcn.00455470
lea eax, [esp + 8]
call fcn.0045544c
xor al, 1
jne 0x453bb4
pop ebx
ret 8
Function at 0x456820
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.004575d4
xor al, 1
je 0x45685b
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.004575dc
push eax
mov eax, ebx
call fcn.00403448
lea eax, [esp + 8]
call fcn.004575f8
lea eax, [esp + 8]
call fcn.004575d4
xor al, 1
jne 0x456830
pop ebx
ret 8