joyce8/EMBER2024-capa huggingface dataset:
Function at 0x647284
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor al, 0x51
lea edx, reloc.KERNEL32.dll_GetSystemTimeAsFileTime
mov dh, byte [esp]
mov edx, esi
mov edx, dword [esp]
jmp 0x6472a4
pop word [esp]
lea esp, [esp + 2]
jmp 0x64726e
lea edx, [ecx + edi]
bswap edx
call fcn.0064728e
mov edx, eax
mov dx, di
jmp 0x6472eb
dec esi
mov ax, word [esp]
ror edx, cl
jg 0x64730b
jle 0x647313
mov edi, 0x47b4ad3d
lodsd eax, dword [esi]
invalid
mov edx, ebp
jmp 0x647334
mov eax, edx
jmp 0x647344
mov eax, edx
adc al, 0x2f
push edx
mov dx, word [esp + 2]
bswap edx
jmp 0x6473ab
add cl, al
bswap edx
mov ah, ch
mov ax, 0xa8cd
mov dx, word [esp]
jmp 0x6472d3
adc al, 0x2f
push edx
mov dx, word [esp + 2]
jmp 0x6473a9
lea edx, [eax + esi]
call fcn.00647374
lea esp, [esp + 4]
xor bl, 0x19
lea edx, [edx + ebp]
lea edx, [eax*4]
jmp 0x647571
bswap edx
bt dx, bp
lea esp, [esp + 4]
dec bl
jmp 0x64738a
sete al
mov al, 0x24
lea eax, [ebx + ebx]
jmp 0x64744a
sete al
mov al, 0x24
lea eax, [ebx + ebx]
shr ah, cl
rdtsc
lea esp, [esp + 0x18]
sub bl, 0xaa
jmp 0x64741e
mov ax, di
jmp 0x647400
setno dl
mov eax, dword [esp]
jmp 0x6473e2
add bl, 0x57
dec eax
jge 0x64742e
xchg dl, ah
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x64746d
neg dx
jnp 0x6473f8
setno dl
mov eax, dword [esp]
mov ax, di
jmp 0x647400
xchg dl, ah
jmp 0x647466
shr ah, cl
rdtsc
jmp 0x6473d9
sub esp, 0xe
lea esp, [esp + 2]
mov eax, ebx
call fcn.00647432
lea esp, [esp + 4]
mov dx, word [esp]
mov edx, 0x1271b90e
setno dl
jmp fcn.00643d75
push dword [esp + 5]
ror bl, 0
jg 0x6473cd
jle 0x6473b7
mov edx, 0xdd56be36
lea edx, [eax + edx]
setge dh
xchg dword [esp], edi
jmp 0x6474de
mov dl, 0x11
mov dl, al
mov edx, dword [esp]
mov dx, 0x2e75
not edx
lea edi, reloc.KERNEL32.dll_GetSystemTimeAsFileTime
jmp 0x647539
mov eax, 0xf43a8994
xchg word [esp + 4], ax
jmp 0x6474b0
xor dl, bl
call fcn.00647513
sub esp, 0x14
jg 0x647507
mov eax, 0xf43a8994
xchg word [esp + 4], ax
push dword [esp + 5]
jmp 0x6474b4

Function at 0x64728e
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol al, 0
lea edx, [edi*4]
mov edx, dword [esp]
jmp 0x6472c4
bsf dx, cx
jge 0x6472ae
mov edx, eax
mov dx, di
mov edx, ebp
jmp 0x647334

Function at 0x647374
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp]
mov dx, bp
mov ax, sp
jmp 0x647392

Function at 0x73e851
Capabilities:
Read file on windows

Disassembly:
popal
clc
push ecx
lea esp, [esp + 4]
popfd
push 0
jmp 0x73e837
pushfd
pushfd
std
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x73e861
lea esp, [esp + 0x1c]
pushal
mov edi, 0xba249e21
mov al, 0x45
rdtsc
jmp 0x73e824
lea esp, [esp + 0x1c]
clc
sub esp, 0x1c
push dword [esp + 0x17]
call fcn.007fed80
clc
jle 0x73e861
mov eax, dword [esi - reloc.KERNEL32.dll_GetSystemTimeAsFileTime]
cmpsb byte [esi], byte es:[edi]
push ebp
adc dword [esi - 0x3f], 0xd23cbc80
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push 1
push edx
call fcn.0079e39a
add esp, 0x10
ret 0xc
Function at 0x741504
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x38
mov eax, dword [0x7f6f84]
xor eax, esp
mov dword [esp + 0x34], eax
push ebp
push esi
mov esi, edx
movzx eax, word [esi + 0x46]
test ax, ax
mov dword [esp + 0x10], ecx
jne 0x741546
mov eax, dword [esp + 0x44]
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov eax, 1
pop esi
pop ebp
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0079df8e
add esp, 0x38
ret
jbe 0x7415e2
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ebp, [ecx + edx + 0x18]
push 0
mov eax, ebp
cdq
push edx
push eax
mov eax, dword [edi + 8]
push ebx
call eax
test eax, eax
jne 0x7415e2
cmp word [esi + 0x46], ax
mov dword [esp + 0xc], eax
jbe 0x7415e2
mov edi, edi
mov edx, dword [edi + 4]
push 0x28
lea ecx, [esp + 0x18]
push ecx
push ebx
call edx
cmp eax, 0x28
jne 0x7415e2
lea eax, [esp + 0x14]
call fcn.007412f4
test eax, eax
je 0x7415e2
mov ecx, dword [esp + 0x44]
cmp ecx, dword [esp + 0x20]
jb 0x7415f5
cmp dword [esp + 0x28], 0
je 0x7415bb
lea eax, [esp + 0x14]
mov ecx, esi
call fcn.007414c4
mov ecx, dword [esp + 0x20]
add eax, ecx
cmp dword [esp + 0x44], eax
jb 0x74161f
add ebp, 0x28
push 0
mov eax, ebp
cdq
push edx
push eax
mov eax, dword [edi + 8]
push ebx
call eax
test eax, eax
jne 0x7415e2
mov eax, dword [esp + 0xc]
movzx ecx, word [esi + 0x46]
add eax, 1
cmp eax, ecx
mov dword [esp + 0xc], eax
jl 0x741574
xor eax, eax
pop esi
pop ebp
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0079df8e
add esp, 0x38
ret
cmp dword [esp + 0xc], 0
jne 0x7415e2
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
mov dword [eax + 4], 0
mov eax, 1
pop esi
pop ebp
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0079df8e
add esp, 0x38
ret
cmp word [esi + 0x44], 0x8664
mov esi, dword [esi + 0x78]
cmp esi, 0x1000
mov eax, dword [esp + 0x28]
jl 0x741639
and eax, 0xfffffe00
xor edx, edx
xor esi, esi
sub eax, ecx
sbb edx, esi
xor ecx, ecx
add eax, dword [esp + 0x44]
pop esi
adc edx, ecx
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x38]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0079df8e
add esp, 0x38
ret
Function at 0x741674
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov ebx, ecx
mov esi, eax
mov eax, dword [edi + 0xc]
push ebx
call eax
mov ecx, dword [edi + 8]
push 2
push 0
push 0
push ebx
mov ebp, eax
mov dword [esp + 0x28], edx
call ecx
mov edx, dword [edi + 0xc]
push ebx
call edx
mov ecx, dword [edi + 8]
push 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push eax
push ebp
push ebx
mov dword [esp + 0x20], edx
call ecx
mov ebp, dword [esp + 0x10]
test ebp, ebp
ja 0x7416c5
cmp dword [esp + 0xc], 0x40
jb 0x7417fc
mov edx, dword [edi + 8]
push 0
push 0
push 0
push ebx
call edx
test eax, eax
jne 0x7417fc
mov eax, dword [edi + 4]
push 0x40
push esi
push ebx
call eax
cmp eax, 0x40
jne 0x7417fc
cmp byte [0x7f8394], 0
jne 0x741729
movsx cx, byte [esi + 1]
movsx dx, byte [esi]
shl cx, 8
add cx, dx
mov word [esi], cx
movsx eax, byte [esi + 0x3f]
movsx ecx, byte [esi + 0x3e]
movsx edx, byte [esi + 0x3d]
shl eax, 8
add eax, ecx
movsx ecx, byte [esi + 0x3c]
shl eax, 8
add eax, edx
shl eax, 8
add eax, ecx
mov dword [esi + 0x3c], eax
cmp word [esi], 0x5a4d
jne 0x7417fc
mov eax, dword [esi + 0x3c]
cdq
cmp ebp, edx
jb 0x7417fc
ja 0x74174c
cmp dword [esp + 0xc], eax
jb 0x7417fc
push edx
push eax
push edi
mov edx, ebx
call fcn.0073f0d4
add esp, 0xc
test eax, eax
je 0x7417fc
mov edx, dword [edi + 4]
push 4
lea ebp, [esi + 0x40]
push ebp
push ebx
call edx
cmp eax, 4
jne 0x7417fc
cmp byte [0x7f83f4], 0
jne 0x7417a1
movsx eax, byte [ebp + 3]
movsx ecx, byte [ebp + 2]
movsx edx, byte [ebp + 1]
shl eax, 8
add eax, ecx
movsx ecx, byte [ebp]
shl eax, 8
add eax, edx
shl eax, 8
add eax, ecx
mov dword [ebp], eax
cmp dword [ebp], reloc.KERNEL32.dll_GetSystemTimeAsFileTime
jne 0x7417fc
mov edx, dword [edi + 4]
push 0x14
lea ebp, [esi + 0x44]
push ebp
push ebx
call edx
cmp eax, 0x14
jne 0x7417fc
mov eax, ebp
call fcn.007412a4
test eax, eax
je 0x7417fc
movzx eax, word [ebp]
cmp ax, 0x14c
jne 0x7417e3
add esi, 0x58
push edi
call fcn.00741124
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp ax, 0x8664
jne 0x7417fc
add esi, 0x58
push edi
call fcn.00740fa4
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x78248d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.0079f524
mov eax, dword [0x7f6f84]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
test eax, eax
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
jbe 0x782620
push ebx
add eax, reloc.KERNEL32.dll_GetSystemTimeAsFileTime
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
add eax, 1
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
xor eax, eax
mov ah, byte [esi + 1]
add esi, 1
movzx ecx, byte [esi + 1]
add esi, 1
movzx edx, byte [esi + 1]
or ebx, eax
add esi, 1
movzx eax, byte [esi + 1]
shl ecx, 0x10
add esi, 1
or ebx, ecx
xor ecx, ecx
mov ch, byte [esi + 1]
add esi, 1
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 1]
or eax, ecx
add esi, 1
movzx ecx, byte [esi + 1]
add esi, 1
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 1
mov byte [edi], dl
mov byte [ebp], al
call fcn.0078c104
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.0078c184
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.007bc384
push ebp
call fcn.0078c104
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.0078c184
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.007bc384
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
add eax, 1
shr edx, 8
add esp, 0x30
mov byte [eax], dl
add eax, 1
add eax, 1
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
add eax, 1
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
add eax, 1
add eax, 1
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
add eax, 1
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
add eax, 1
mov byte [eax], cl
mov edx, ecx
shr edx, 8
add eax, 1
mov byte [eax], dl
mov edx, ecx
add eax, 1
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x7824ab
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.0079df8e
add esp, 0xa0
ret
Function at 0x791cc4
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x791cdd
mov esi, edi
mov edi, eax
jmp 0x791cdf
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x791cef
mov eax, ebx
jmp 0x791cf9
push eax
push ebx
call fcn.007549a4
add esp, 8
test eax, eax
jne 0x791d01
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x791d1f
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x791d08
cmp eax, dword [esi + 4]
jge 0x791d36
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x791d24
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x791d59
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x791d56
sub eax, 1
test eax, eax
jg 0x791d46
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x84ba2f
Capabilities:
Encode data using xor

Disassembly:
jmp 0x84b8fb
pop ecx
jmp 0x84bbdf
add ebx, 0x58293fd2
jmp 0x84b9bd
cmp ebx, 0x5829409e
je 0x84ba21
jne 0x84b1cf
or eax, 0x8f7c1585
pop eax
mov ebp, 0x3ec3a436
mov ecx, 0xdebb2bad
sub eax, 0xc39dceac
lea eax, [ecx + ecx]
lea eax, [ebp - 0xe6]
push esi
mov al, cl
bsr eax, esp
mov dword [esp], ecx
jmp 0x84ba10
cld
lea ecx, [edx + 0x9f]
mov ch, bh
bswap eax
push edi
bsr eax, ebp
jmp 0x84ba67
call 0x84ba2f
push ebx
je 0x84ba7a
jb 0x84ba9b
jo 0x84ba6f
add cl, ch
rcr dword [ebx], 0
add byte [edx], ch
lea ecx, [eax + ebp]
mov cx, word [esp]
mov di, word [esp]
mov edi, dword [esp]
lea edi, [ebp*4]
lea edi, [esi*4]
cmp al, 0xb5
add byte [eax], al
add byte [eax], al
mov edi, dword [esp]
jmp 0x84ba45
add dword [edx], reloc.KERNEL32.dll_GetSystemTimeAsFileTime
test dword [edx], reloc.KERNEL32.dll_GetSystemTimeAsFileTime
inc esp
neg esi
sub ecx, fcn.0084b1b8
mov dword [ecx + 0x84b789], eax
movzx ebx, byte [eax]
jmp 0x84b983
Function at 0x85d799
Capabilities:
Encode data using xor

Disassembly:
call 0x85ba2b
jmp 0x85d71e
pushfd
pushal
push dword [esp + 3]
lea esp, [esp + 0x24]
jmp 0x85d667
pushal
lea ebx, reloc.KERNEL32.dll_GetSystemTimeAsFileTime
popal
stc
call fcn.0085d619
mov dword [esp], ecx
sub ch, cl
pushfd
mov eax, 0x5490b9f7
sub esp, 0xf
mov al, byte [esp + 7]
jmp 0x85d757
dec eax
not eax
pushal
call 0x85d6c7
inc ebx
sub esp, 0x15
mov al, byte [esp + 0xc]
mov al, dl
jmp 0x85d70d
pushfd
mov dword [esp + 5], edi
bt bp, di
pop word [esp + 0xe]
mov ebp, dword [esp + 0x2a]
bsr ax, bx
jmp 0x85d6bd
cmp dword [esp + 4], 0
jmp 0x85d734
neg eax
lea esp, [esp + 1]
mov eax, dword [esp + 0x67]
lea esp, [esp + 0x6c]
popfd
jmp 0x85d6f7
pop eax
jmp 0x85d740
jne 0x85d59b
pushal
jmp 0x85ba26
sub eax, 0xa10f40c0
jmp 0x85d789
lea esp, [esp + 3]
mov ecx, dword [esp + 0x10]
xchg ah, al
sub esp, 0x12
xchg word [esp + 6], bp
mov word [esp + 3], si
jmp 0x85d6df
call 0x85d799
or eax, dword [eax]
add byte [eax], al
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
fcom dword [edx]
lea ebx, [edi + ebp*2]
jbe 0x85d789
adc al, 0
add byte [eax], al
inc esp
outsd dx, dword [esi]
arpl word [ebp + 0x6d], si
outsb dx, byte gs:[esi]
je 0x85d7fe
jb 0x85d81f
jo 0x85d817
jb 0x85d828
imul esp, dword [ebp + 0x73], reloc.KERNEL32.dll_GetSystemTimeAsFileTime
in eax, dx
invalid
inc dword [esp + 8]
jmp 0x85d982
jne 0x85d7c4
lds esi, [edx + ebx - 7]
je 0x85d81b
stc
jl 0x85d816
jne 0x85d78a
inc esi
ror dword [ecx - 0x27], 0xb8
dec ebx
pushfd
push 0xac5d228b
mov edi, 0x247c839c
and al, 4
add bl, ch
loop 0x85d87c
add al, 0
jmp 0x85d7fd
pushal
call 0x85d822
add byte [eax], al
xchg al, ch
cmp al, 0
add byte [eax], al
cmp byte [ecx + 0x36b34021], dh
mov cl, 0x21
inc eax
mov bl, 0x36
cmp dh, byte [edx + 0x35b24720]
xor esi, dword [edi + reloc.KERNEL32.dll_GetSystemTimeAsFileTime]
sub al, byte [ebp - 0x7f]
jmp 0x10b92f5
out 0xe2, eax
invalid
popfd
ret

Function at 0x85f0e8
Capabilities:
Enumerate pe sections

Disassembly:
xchg edx, edi
bswap edx
neg bp
not ebp
mov ebp, dword [esp]
jmp 0x85f1bf
lea ebp, [edx*4]
lea ebp, [edx + esi]
neg di
mov ebp, dword [esp + 0x10]
bswap edi
neg di
jmp 0x85f109
mov di, 0x7cd
mov edx, dword [esp + 6]
mov di, word [esp]
not ebp
dec edi
bswap edi
jmp 0x85f11f
Function at 0x401090
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.shlwapi.dll_PathSkipRootW]
mov edi, dword [sym.imp.kernel32.dll_CreateDirectoryW]
sub esp, 4
test eax, eax
je 0x401120
mov ebx, eax
movzx eax, word [eax]
mov edi, dword [sym.imp.kernel32.dll_CreateDirectoryW]
test ax, ax
jne 0x4010ec
jmp 0x401120
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x401120
cmp ax, 0x5c
jne 0x4010e0
xor eax, eax
add ebx, 2
mov word [ebx - 2], ax
mov dword [esp + 4], 0
mov dword [esp], esi
call edi
mov edx, 0x5c
sub esp, 8
mov word [ebx - 2], dx
movzx eax, word [ebx]
test ax, ax
jne 0x4010ec
lea esi, [esi]
mov dword [esp + 4], 0
mov dword [esp], esi
call edi
mov edx, eax
sub esp, 8
mov eax, 1
test edx, edx
jne 0x40114e
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xb7
sete al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401890
Capabilities:
Check if process is running under wine
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
lea eax, [ebp - 0x10]
sub esp, 0x1c
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineMenuFiles
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
test eax, eax
jne 0x401920
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x40192a
cmp word [esi], 0
mov eax, esi
je 0x40193d
nop
add eax, 2
cmp word [eax], 0
jne 0x4018d0
sub eax, esi
add eax, 2
mov dword [esp + 0x10], esi
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
mov ebx, eax
mov dword [esp], edi
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], eax
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x4018de

Function at 0x401950
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0x1000
sub esp, 0x1c
jmp 0x401970
cmp ebx, eax
jg 0x4019c0
lea ebx, [eax + 1]
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
lea esi, [ebx + ebx]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x4019ca
lea eax, [ebp + 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp], 4
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vswprintf]
test eax, eax
jns 0x401960
mov ebx, esi
jmp 0x401967
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [section..data], 2
jne 0x4019e0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.out_of_memory_n
mov dword [esp + 8], str.xmalloc
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401550
jmp 0x4019d3
Function at 0x401a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, edx
push ebx
sub esp, 0x18
movzx ecx, word [edx]
mov dword [ebp - 0x10], eax
test cx, cx
je 0x401a68
lea edi, [edx + 2]
xor edx, edx
lea esi, [esi]
mov ebx, 0x10
lea esi, cs:[esi]
lea esi, [esi]
mov eax, edx
shr dx, 1
xor eax, ecx
shr cx, 1
and eax, 1
neg eax
and ax, 0xa001
xor edx, eax
sub ebx, 1
jne 0x401a40
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x401a30
movzx edi, dx
mov ebx, dword [sym.imp.ucrtbase.dll_wcsrchr]
mov dword [esp], esi
mov dword [esp + 4], 0x5c
call ebx
mov dword [esp + 4], 0x2e
lea ecx, [eax + 2]
test eax, eax
cmovne esi, ecx
mov dword [esp], esi
call ebx
mov edx, eax
sub edx, esi
sar edx, 1
test eax, eax
je 0x401ac1
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], str._04X__.s._d
mov dword [esp + 0x10], eax
call fcn.00401950
add esp, 0x18
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [esi], 0
je 0x401ae1
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x401ad0
sub eax, esi
sar eax, 1
mov edx, eax
jmp 0x401a9a
xor edx, edx
jmp 0x401a9a

Function at 0x401af0
Capabilities:
Query or enumerate registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, 0x800
sub esp, 0x28
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x800
jmp 0x401b29
cmp eax, 0xea
jne 0x401b88
mov eax, dword [ebp - 0x10]
lea ebx, [eax + eax]
mov dword [ebp - 0x10], ebx
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x401b9d
lea eax, [ebp - 0x10]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
jne 0x401b10
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
xor edi, edi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [section..data], 2
jne 0x401bb3
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.out_of_memory_n
mov dword [esp + 8], str.xmalloc
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401550
jmp 0x401ba6
Function at 0x401be0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x10
cmp word [eax], 0
je 0x401c28
nop
add eax, 2
cmp word [eax], 0
jne 0x401bf0
sub eax, ebx
add eax, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x401c2f
xor edx, edx
lea esi, [esi]
movzx ecx, word [ebx + edx]
mov word [eax + edx], cx
add edx, 2
test cx, cx
jne 0x401c10
mov ebx, dword [ebp - 4]
leave
ret
mov eax, 2
jmp 0x401bfe
test byte [section..data], 2
jne 0x401c45
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.out_of_memory_n
mov dword [esp + 8], str.xmalloc
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401550
jmp 0x401c38

Function at 0x401c70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [ebp - 0x10], edx
call edx
sub esp, 0x18
mov edi, eax
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x10]
test eax, eax
je 0x401cfc
mov ebx, eax
mov dword [esp + 0x14], edi
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, ebx
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [section..data], 2
jne 0x401d12
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.out_of_memory_n
mov dword [esp + 8], str.xmalloc
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401550
jmp 0x401d05

Function at 0x401d40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x24
mov edx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [ebp - 0x10], edx
call edx
sub esp, 0x20
mov edi, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x10]
test eax, eax
je 0x401dea
mov ebx, eax
mov dword [esp + 0x14], edi
mov dword [esp + 8], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, ebx
sub esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [section..data], 2
jne 0x401e00
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.out_of_memory_n
mov dword [esp + 8], str.xmalloc
mov dword [esp + 4], 0x40c000
mov dword [esp], 1
call fcn.00401550
jmp 0x401df3