joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43eae4
Capabilities:
Encode data using base64

Disassembly:
jmp 0x44ac53
call fcn.00401b1b
xor ecx, ecx
push eax
movzx bx, al
jmp 0x1c3c7c8
je 0x44965c
push ebx
jmp 0x449652
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 8
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x18], 0
push 8
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x18
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x20], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
jmp 0x40acb7
call fcn.00456f0f
add esp, 4
cbw
pop eax
mov dword [0x1c11968], eax
cmove bx, si
setbe bl
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
jmp 0x4192e3
mov eax, 0x1c103f9
push eax
shr bh, cl
bswap ebx
adc ebx, esp
mov ebx, dword [0x1c11968]
test ebx, ebx
jmp 0x4326ab
Function at 0x44330b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push dword [ebp + 8]
call fcn.004433ec
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1000
jle 0x4433dc
mov dword [ebp - 8], esp
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
cmp dword [ebp - 8], esp
je 0x443373
push 0xab
push 0x40b0c2f
push 6
call fcn.00456f15
add esp, 0xc
mov dword [0x1c119ec], eax
push dword [0x1c119ec]
push dword [ebp + 8]
call fcn.0044373a
mov dword [ebp - 8], esp
push 0x1000
push dword [0x1c119ec]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_RtlZeroMemory]
nop
nop
cmp dword [ebp - 8], esp
je 0x4433ba
push 0x10b
push 0x40b0c2f
push 6
call fcn.00456f15
add esp, 0xc
fild dword [0x1c119ec]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1c10792]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.00401194
jmp 0x4433e6
mov eax, 0
jmp 0x4433e6
mov esp, ebp
pop ebp
ret 4
Function at 0x4433ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov eax, 0x1c1079a
test eax, eax
je 0x443426
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00456f09
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x443437
push ebx
call fcn.00456f0f
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push 0x40
push 0x1000
push 0x1000
push 0
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x44347d
push 0x3f8
push 0x40a2344
push 6
call fcn.00456f15
add esp, 0xc
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0x80000301
push 0
push dword [ebp - 8]
push htons
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4434a3
mov eax, 0x46e255
push eax
push 3
mov ebx, 0x914
call fcn.00459780
add esp, 0x28
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x9e0
call fcn.00457a30
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
push 0x80000301
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9e0
call fcn.00457a30
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x34]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
push 0
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
push 0
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
push 0
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0044364a
push 0x80000401
push edx
push eax
push 1
mov ebx, 0x9dc
call fcn.00457950
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0x8000
push 0
push dword [ebp - 8]
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x44362a
push 0x4cf
push 0x40a2344
push 6
call fcn.00456f15
add esp, 0xc
mov eax, dword [ebp - 0xc]
jmp 0x443632
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x443643
push ebx
call fcn.00456f0f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x44373a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov eax, 0x1c1080d
test eax, eax
je 0x44377b
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00456f09
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x44378c
push ebx
call fcn.00456f0f
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], esp
push 0x40
push 0x1000
push 0x1000
push 0
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4437d2
push 0xe84
push 0x40a2345
push 6
call fcn.00456f15
add esp, 0xc
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0x80000301
push 0
push dword [ebp - 8]
push htons
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4437f8
mov eax, 0x46e255
push eax
push 3
mov ebx, 0x914
call fcn.00459780
add esp, 0x28
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x9e0
call fcn.00457a30
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push 0x80000301
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9e0
call fcn.00457a30
add esp, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push 0x80000301
push 0
push dword [ebp + 0xc]
push 1
mov ebx, 0x9e0
call fcn.00457a30
add esp, 0x10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
push 0
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
push 0
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
push 0
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0044364a
push 0x80000401
push edx
push eax
push 1
mov ebx, 0x9dc
call fcn.00457950
add esp, 0x10
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], esp
push 0x8000
push 0
push dword [ebp - 8]
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x443997
push 0xf75
push 0x40a2345
push 6
call fcn.00456f15
add esp, 0xc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x4439a2
push edx
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4439b4
push ebx
call fcn.00456f0f
add esp, 4
pop eax
pop edx
mov esp, ebp
pop ebp
ret 8
Function at 0x443b7c
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push 0x2c
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x2c], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xb
rep stosd dword es:[edi], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
push 0x10
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x38], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 8
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x3c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push ebx
push 0xc
call fcn.00456f09
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x1c10a17
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push ebx
mov ebx, edi
mov ecx, 1
push ecx
push ebx
push 0xc
call fcn.00456f09
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
pop ebx
pop ecx
add ebx, 4
dec ecx
jne 0x443c66
pop ebx
add ebx, 4
push ebx
push 0xc
call fcn.00456f09
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x1c10a17
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push ebx
mov ebx, edi
mov ecx, 1
push ecx
push ebx
push 0x18
call fcn.00456f09
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
pop ebx
pop ecx
add ebx, 4
dec ecx
jne 0x443cbf
pop ebx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x60], 0
push 0x18
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x64], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
push 0x10
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x68], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
add ebx, 0xc
push ebx
push 0xc
call fcn.00456f09
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x1c10a17
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push ebx
mov ebx, edi
mov ecx, 1
push ecx
push ebx
push 0x18
call fcn.00456f09
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
pop ebx
pop ecx
add ebx, 4
dec ecx
jne 0x443d98
pop ebx
push 0xc
call fcn.00456f09
add esp, 4
mov dword [ebp - 0x6c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
jmp loc.01c3f274
Function at 0x448d18
Capabilities:
Authenticate hmac

Disassembly:
jmp loc.01c2f7be
push ebp
mov ebp, esp
sub esp, 0x88
push 0xc
call fcn.00456f09
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push 8
call fcn.00456f09
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0xc], 0
jmp 0x419720

Function at 0x4578b0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.00460cee
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x45791a
push esi
lea edi, [eax + 0x400]
call fcn.00460ce3
push edi
call fcn.00460cee
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x4578ea
push esi
xor edi, edi
call dword [0x1c12048]
add esp, 4
test eax, eax
je 0x457936
push eax
push esi
call fcn.0045b1d0
add esp, 8
mov edi, eax
push esi
call fcn.00460ce3
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x457b10
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x457b2e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x457b23
pop esi
ret

Function at 0x4585f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x458682
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x458674
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x45866c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x458635
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x458ce0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x458d60
push edi
call dword [0x1c12048]
add esp, 4
test eax, eax
jbe 0x458d60
test esi, esi
je 0x458d1e
cmp esi, 0xffffffff
je 0x458d1e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x458da2
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x458d4c
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x458d60
jmp 0x458d5b
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x458d60
mov ebp, 1
test esi, esi
je 0x458da2
cmp esi, 0xffffffff
je 0x458da2
test ebp, ebp
jne 0x458dd9
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x458daf
call edi
test eax, eax
je 0x458da2
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x458dd9
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x458d8a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x458da2
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x458dd9
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x458dbc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call dword [0x1c12048]
inc eax
push eax
call fcn.00457310
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
Function at 0x459400
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x45940d
xor eax, eax
pop esi
ret
push esi
call dword [0x1c12048]
add esp, 4
test eax, eax
jne 0x45941d
pop esi
ret
cmp eax, 1
jne 0x45942b
cmp byte [esi], 0x5c
jne 0x45942b
xor eax, eax
pop esi
ret
push esi
call fcn.004591b0
add esp, 4
test eax, eax
je 0x45943f
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x4596a0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.0045b420
mov edi, dword [esp + 0x28]
mov ebp, eax
push edi
xor esi, esi
call dword [0x1c12048]
add esp, 8
test ebp, ebp
je 0x45976a
test eax, eax
je 0x45976a
inc eax
push ebx
push eax
call fcn.00460cee
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00460f90
mov esi, eax
add esp, 0xc
test esi, esi
je 0x45970c
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x459746
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x459759
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call fcn.00460ce3
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x45ac80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x45aca1
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x45acfb
inc edi
cmp edi, esi
jl 0x45ac95
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x45ad30
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x45acea
cmp byte [eax], bl
je 0x45ad05
cmp byte [eax + 1], bl
je 0x45ad0e
cmp byte [eax + 2], bl
je 0x45ad18
cmp byte [eax + 3], bl
je 0x45ad24
add eax, 4
cmp eax, edi
jb 0x45acc1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x460bf8
Capabilities:
Authenticate hmac

Disassembly:
mov ah, 0x85
fucomi st(1)
out dx, eax
or edi, dword [esi + 1]
call fcn.0044e5b5
test eax, eax
jmp loc.01c41b9a
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x25011f7d
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x721a468b
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x530630]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call fcn.004cc009
mov ecx, dword [ebp + 8]
add esp, 4
lea edx, [ebp - 0x18]
push esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0x50a560
mov dword [ebp - 8], fcn.004036d0
xor eax, 0x10
mov ecx, 0x10
lea edx, [ebp - 5]
push edi
movzx esi, byte [edx + ecx - 0x10]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
dec ecx
xor eax, esi
cmp ecx, 1
jae 0x403251
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004cab85
mov esp, ebp
pop ebp
ret

Function at 0x40a550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, edx
shr ecx, 5
mov eax, edx
xor eax, dword [ebp + 8]
inc ecx
cmp edx, ecx
jb 0x40a581
push ebx
push edi
movzx edi, byte [esi + edx - 1]
mov ebx, eax
shl ebx, 5
add edi, ebx
mov ebx, eax
shr ebx, 2
add edi, ebx
sub edx, ecx
xor eax, edi
cmp edx, ecx
jae 0x40a564
pop edi
pop ebx
pop ebp
ret
Function at 0x40a6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov eax, esi
push edi
mov edi, dword [ebx + 0x30]
shr eax, 5
xor edi, esi
inc eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], edi
mov ecx, esi
cmp esi, eax
jb 0x40a714
lea esp, [esp]
mov edx, dword [ebp + 0xc]
movzx edx, byte [edx + ecx - 1]
mov ebx, edi
shl ebx, 5
add edx, ebx
mov ebx, edi
shr ebx, 2
add edx, ebx
sub ecx, eax
xor edi, edx
cmp ecx, eax
jae 0x40a6f0
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], edi
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x18]
dec eax
and eax, edi
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x40a797
cmp edi, dword [eax + 8]
jne 0x40a791
cmp esi, dword [eax + 0xc]
jne 0x40a791
mov edi, dword [ebp + 0xc]
mov ecx, esi
lea edx, [eax + 0x10]
cmp esi, 4
jb 0x40a757
jmp 0x40a740
mov ebx, dword [edi]
cmp ebx, dword [edx]
jne 0x40a78b
sub ecx, 4
add edx, 4
add edi, 4
cmp ecx, 4
jae 0x40a740
mov ebx, dword [ebp - 4]
test ecx, ecx
je 0x40a825
mov bl, byte [edx]
cmp bl, byte [edi]
jne 0x40a78b
cmp ecx, 1
jbe 0x40a822
mov bl, byte [edx + 1]
cmp bl, byte [edi + 1]
jne 0x40a78b
cmp ecx, 2
jbe 0x40a822
mov dl, byte [edx + 2]
cmp dl, byte [edi + 2]
je 0x40a822
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
jne 0x40a724
mov eax, dword [ebx + 0x20]
cmp dword [ebx + 0x1c], eax
jb 0x40a7b5
cmp eax, 0x3ffffffe
jg 0x40a7b5
mov ecx, dword [ebp + 8]
add eax, eax
push eax
push ecx
call fcn.0040a590
add esp, 8
mov edx, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x18]
dec edx
and edx, edi
lea edx, [ecx + edx*4]
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx + 0xc]
lea eax, [esi + 0x11]
push eax
mov eax, dword [ebx]
push 4
mov dword [ebp - 8], edx
mov edx, dword [ebx + 4]
push 0
push edx
call eax
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x40a842
lea eax, [esi + 0x11]
test eax, eax
je 0x40a842
cmp byte [ebx + 0x37], 0
je 0x40a815
mov esi, dword [ebp + 8]
push 1
call fcn.0040e7e0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
add eax, 0x11
push eax
push 4
push edi
push ecx
call edx
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x40a83f
mov eax, dword [ebp + 8]
mov ebx, 4
call fcn.0040af30
mov ebx, dword [ebp - 4]
mov cl, byte [eax + 5]
mov dl, byte [ebx + 0x34]
xor cl, 3
xor dl, 3
test cl, dl
jne 0x40a890
pop edi
pop esi
mov byte [eax + 5], cl
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
lea eax, [esi + 0x11]
add dword [ebx + 0xc], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40a852
lea eax, [ebx + 0x3c]
mov cl, byte [ebx + 0x34]
and cl, 3
mov byte [edi + 5], cl
mov ecx, dword [ebp + 0xc]
mov byte [edi + 4], 4
mov edx, dword [eax]
mov dword [edi], edx
mov dword [eax], edi
mov eax, dword [ebp - 0xc]
push esi
push ecx
lea edx, [edi + 0x10]
push edx
mov dword [edi + 0xc], esi
mov dword [edi + 8], eax
mov byte [edi + 6], 0
call fcn.004ca090
mov eax, dword [ebp - 4]
add esp, 0xc
mov byte [edi + esi + 0x10], 0
inc dword [eax + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret