joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446241
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x446266
mov eax, dword [esi + 0xc]
push 8
add eax, dword [esi + 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0044b470
add esp, 0xc
jmp 0x446279
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.0044b221
add esp, 0x10
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
shl eax, 8
or eax, ecx
add dword [esi + 0xc], 8
movzx ecx, byte [ebp - 2]
shl eax, 8
or eax, ecx
and byte [ebp - 4], 0
movzx ecx, byte [ebp - 1]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 8]
push 0x49c020
mov dword [ecx], eax
lea eax, [ebp - 8]
push eax
call fcn.0044b3e0
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
pop esi
leave
ret 4

Function at 0x4685d0
Capabilities:
Encode data using xor

Disassembly:
mov cl, 9
add byte [eax - 0x53fff64f], bh
mov cl, 9
add byte [eax - 0x71fff64f], ah
mov cl, 9
add byte [eax - 0x4f], bh
or dword [eax], eax
mov cl, 9
add byte [esi - 0x4f], cl
or dword [eax], eax
inc edx
mov cl, 9
add byte [edx], ch
mov cl, 9
add byte [edx], dl
mov cl, 9
add byte [esi], al
push es
push es
mov cl, 9
add al, bh
mov al, 9
add dl, ch
mov al, 9
add dh, dl
mov al, 9
add dl, cl
mov al, 9
add byte [eax], ch
mov dl, 9
add byte [esi - 0x4e], al
or dword [eax], eax
pop edx
mov dl, 9
add byte [edx - 0x4e], ch
or dword [eax], eax
xor byte [edx - 0x4d71fff7], 9
add byte [esp + ebx*4], bl
or dword [eax], eax
adc al, 0x9c
or dword [eax], eax
cli
wait
or dword [eax], eax
loopne 0x4685a5
or dword [eax], eax
aam 0x9b
or dword [eax], eax
les ebx, [ebx - 0x644dfff7]
or dword [eax], eax
cwde
wait
or dword [eax], eax
mov ds, word [ebx - 0x6487fff7]
or dword [eax], eax
pushal
wait
or dword [eax], eax
push eax
wait
or dword [eax], eax
inc eax
wait
or dword [eax], eax
xor byte [ebx - 0x64ddfff7], bl
or dword [eax], eax
push cs
wait
or dword [eax], eax
cli
lcall 9, 0x9aea0009
ficomp word [edx - 0x6537fff7]
or dword [eax], eax
mov eax, 0xaa00099a
lcall 9, 0x9a9c0009
mov ds, word [edx - 0x6585fff7]
or dword [eax], eax
push 0x5000099a
lcall 9, 0x9a340009
sbb al, 0x9a
or dword [eax], eax
adc al, 0x9a
or dword [eax], eax
add al, 0x9a
or dword [eax], eax
mov dh, 0xb2
or dword [eax], eax
invalid
Function at 0x48bcd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x81000]
push edi
or ebp, 0xffffffff
jmp 0x48bcf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48bcf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48bce8
mov eax, 1
add ebx, ebx
jne 0x48bd0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48bd1c
jne 0x48bd3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48bd3b
dec eax
add ebx, ebx
jne 0x48bd28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48bd00
add ebx, ebx
jne 0x48bd37
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48bd8d
xor ecx, ecx
sub eax, 3
jb 0x48bd53
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48bdc2
sar eax, 1
mov ebp, eax
jmp 0x48bd5e
add ebx, ebx
jne 0x48bd5e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48bd2c
inc ecx
add ebx, ebx
jne 0x48bd6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48bd2c
add ebx, ebx
jne 0x48bd79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48bd6e
jne 0x48bd8a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48bd6e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48bdac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48bd9e
jmp 0x48bcee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48bdac
add edi, ecx
jmp 0x48bcee
pop esi
mov edi, esi
mov ecx, 0x3ef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48bdca
cmp byte [edi], 6
jne 0x48bdca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48bdcf
lea edi, [esi + 0x88000]
mov eax, dword [edi]
or eax, eax
je 0x48be47
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8b000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8b08c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48bdfc
mov ecx, edi
jns 0x48be2b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8b090]
or eax, eax
je 0x48be41
mov dword [ebx], eax
add ebx, 4
jmp 0x48be19
call dword [esi + 0x8b098]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x48be78
cmp al, 0xef
ja 0x48be6b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x48be4d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x48be5a
mov ebp, dword [esi + 0x8b094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48beac
sub esp, 0xffffff80
jmp 0x40ed35
Function at 0x408fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 0x1000c
je 0x40900a
cmp eax, 0x20004
je 0x408fd0
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
xor eax, eax
test esi, esi
je 0x40906a
mov ecx, dword [ebp + 8]
sub edi, ecx
mov edx, dword [ebp + 0x10]
mov bl, byte [edx]
lea edx, [eax + ecx]
lea ecx, [ebx + eax]
xor cl, al
sub bl, cl
mov ecx, dword [ebp + 8]
add bl, 0x62
xor bl, byte [edi + edx]
xor bl, al
inc eax
mov byte [edx], bl
cmp eax, esi
jb 0x408fe2
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
xor eax, eax
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0xc], eax
jbe 0x40906a
mov ebx, dword [ebp + 8]
sub edi, ebx
nop dword [eax]
mov edx, dword [ebp + 0x10]
lea esi, [eax + ebx]
inc al
movzx eax, al
mov bl, byte [edx]
mov cl, byte [edx + 1]
imul edx, eax, 0xb
mov eax, dword [ebp + 0x14]
shr eax, 1
sub dl, al
mov al, byte [edi + esi]
add dl, cl
sub al, 0x7b
xor dl, byte [ebp + 0x14]
sub dl, 8
add dl, cl
xor dl, al
lea eax, [ebx + 1]
xor dl, al
mov eax, dword [ebp + 0x14]
xor dl, al
inc eax
xor dl, bl
mov dword [ebp + 0x14], eax
mov ebx, dword [ebp + 8]
xor dl, 0xbc
inc dl
mov byte [esi], dl
cmp eax, dword [ebp + 0xc]
jb 0x409020
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x409b40
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
push esi
mov esi, ecx
mov edx, dword [esi + 0x800]
xor eax, edx
movzx eax, al
mov ecx, dword [esi + 0x808]
shr edx, 8
mov eax, dword [esi + eax*4 + 0x400]
xor eax, edx
mov dword [esi + 0x800], eax
movzx eax, al
add eax, dword [esi + 0x804]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x804], eax
movzx eax, byte [esi + 0x807]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [esi + eax*4 + 0x400]
mov ax, cx
mov dword [esi + 0x808], ecx
or ax, 3
movzx eax, ax
mov ecx, eax
xor ecx, 1
imul ecx, eax
sar ecx, 8
mov byte [esi + 0x80c], cl
pop esi
pop ebp
ret 4

Function at 0x409bc0
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
xor edx, edx
lea esi, [edi + 0x400]
nop dword [eax]
mov eax, edx
shr eax, 1
test dl, 1
je 0x409bde
xor eax, 0xedb88320
test al, 1
je 0x409beb
shr eax, 1
xor eax, 0xedb88320
jmp 0x409bed
shr eax, 1
test al, 1
je 0x409bfa
shr eax, 1
xor eax, 0xedb88320
jmp 0x409bfc
shr eax, 1
test al, 1
je 0x409c09
shr eax, 1
xor eax, 0xedb88320
jmp 0x409c0b
shr eax, 1
test al, 1
je 0x409c18
shr eax, 1
xor eax, 0xedb88320
jmp 0x409c1a
shr eax, 1
test al, 1
je 0x409c27
shr eax, 1
xor eax, 0xedb88320
jmp 0x409c29
shr eax, 1
test al, 1
je 0x409c36
shr eax, 1
xor eax, 0xedb88320
jmp 0x409c38
shr eax, 1
test al, 1
je 0x409c45
shr eax, 1
xor eax, 0xedb88320
jmp 0x409c47
shr eax, 1
mov ecx, eax
mov dword [esi], eax
shl ecx, 8
add esi, 4
xor ecx, edx
shr eax, 0x18
inc edx
mov dword [edi + eax*4], ecx
cmp edx, 0x100
jb 0x409bd0
pop edi
pop esi
ret
Function at 0x409ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x810]
push ebx
push esi
mov esi, dword [ecx + 0x814]
push edi
mov dword [ebp - 0x10], 0x40
mov bl, byte [esi + edx]
xor bl, byte [eax + edx]
mov al, byte [eax + edx - 1]
xor al, byte [esi + edx - 1]
lea edx, [ecx + 0x1c8dc]
movzx esi, al
movzx eax, bl
shl esi, 6
shl eax, 7
add edx, eax
mov dword [ebp + 8], esi
mov dword [ebp - 4], edx
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0xc], 0x10000
mov dword [ebp - 8], eax
nop dword [eax]
movzx ebx, word [edx]
xor edi, edi
add ebx, eax
mov eax, ebx
shr eax, 0x18
mov edx, dword [ecx + eax*4]
lea eax, [ecx + eax*4]
shr edx, 8
xor edx, ebx
mov dword [ebp - 0x14], eax
shr edx, 2
and edx, 0x3f
lea eax, [esi + edx]
xor esi, esi
cmp si, word [ecx + eax*2 + 0x148dc]
mov esi, dword [ebp + 8]
jae 0x409faf
add edx, esi
lea eax, [ecx + 0x148dc]
lea esi, [ecx + 0x8dc]
lea eax, [eax + edx*2]
lea esi, [esi + edx*4]
mov dword [ebp - 0x18], eax
add esi, edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
add eax, dword [ebp + 8]
inc edi
movzx edx, word [ecx + eax*2 + 0x1c8dc]
mov eax, dword [ebp - 0x14]
xor edx, dword [eax]
mov eax, dword [ecx + 0x20256dc]
shr edx, 8
and edx, 3
or edx, ebx
mov dword [ecx + eax*4 + 0x256dc], edx
mov eax, dword [ebp - 0x18]
inc dword [ecx + 0x20256dc]
movzx eax, word [eax]
cmp edi, eax
jl 0x409f70
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
add eax, 0x10000
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], eax
jne 0x409f20
add edx, 2
sub dword [ebp - 0x10], 1
mov dword [ebp - 4], edx
jne 0x409f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c9e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x551764]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x15c], ecx
xor ebx, ebx
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x158], edx
push ecx
push 1
push ebx
push eax
push SysReAllocString
mov dword [ebp - 0x154], 0
mov byte [ebp - 0x149], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cbc2
push esi
push edi
nop word [eax + eax]
mov edi, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
push eax
xor esi, esi
push esi
push esi
push 1
push ebx
push edi
mov dword [ebp - 0x150], esi
call dword [sym.imp.Ntdll.dll_NtEnumerateValueKey]
mov eax, dword [ebp - 0x150]
test eax, eax
je 0x40cac5
add eax, 4
push eax
push 8
push dword [0x576b44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40cac5
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x150]
push esi
push 1
push ebx
push edi
call dword [sym.imp.Ntdll.dll_NtEnumerateValueKey]
mov edi, dword [esi + 0x10]
mov eax, dword [esi + 8]
add edi, 0x14
add edi, esi
add eax, esi
cmp eax, edi
jne 0x40cac5
push dword [esi + 0xc]
push eax
add eax, 2
push eax
call fcn.004c97a0
add dword [esi + 8], 2
add esp, 0xc
xor eax, eax
mov word [edi], ax
inc ebx
test esi, esi
je 0x40cb9f
cmp byte [ebp - 0x149], 0
jne 0x40cb9f
cmp dword [esi + 4], 3
jne 0x40cb8b
cmp dword [esi + 0xc], 0x10c
jne 0x40cb8b
lea eax, [ebp - 0x34]
push eax
mov eax, dword [esi + 8]
add eax, esi
push 0x10c
push eax
call fcn.00439470
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x34]
push 0x100
push eax
call fcn.00433590
push 0
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x148]
push eax
push 0x20
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x158]
movups xmmword [ebp - 0x14], xmm0
push dword [eax + 0x28c]
call fcn.00433c70
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x54]
add esp, 0x30
mov edi, 0x1c
mov ecx, dword [eax + 0x28c]
nop word [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40cb8b
add ecx, 4
add edx, 4
sub edi, 4
jae 0x40cb60
mov ecx, dword [ebp - 0x15c]
lea edx, [ebp - 0x34]
push 0x20
call fcn.00430d60
add esp, 4
mov byte [ebp - 0x149], 1
push esi
push 0
push dword [0x576b44]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40ca40
push dword [ebp - 0x154]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x149]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c715a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004c715a
mov esp, ebp
pop ebp
ret
Function at 0x40cc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e4488
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x551764]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov ebx, ecx
lea edx, [ebp - 0x10]
call fcn.00430c80
test eax, eax
jne 0x40ccbe
nop dword [eax]
mov edi, dword [ebp - 0x10]
mov esi, dword [edi*4 + 0x576b70]
test esi, esi
je 0x40ccbe
cmp byte [esi + 0x84], 0
jne 0x40cc9a
lea eax, [esi + 0x42]
mov edx, 0x41
nop
mov cl, byte [eax - 0x42]
lea eax, [eax + 1]
sub cl, 0xb
xor cl, 0xf4
mov byte [eax - 1], cl
sub edx, 1
jne 0x40cc80
mov byte [esi + 0x83], dl
mov edx, dword [ebp + 0xc]
lea eax, [esi + 0x42]
mov ecx, dword [ebp + 8]
push eax
call fcn.0040c8c0
add esp, 4
test al, al
jne 0x40ccd5
lea edx, [ebp - 0x10]
mov ecx, ebx
call fcn.00430c80
test eax, eax
je 0x40cc60
mov eax, 0x56
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [edi*4 + 0x576b70]
cmp byte [esi + 0x84], 0
jne 0x40cd08
lea ecx, [esi + 0x42]
mov edx, 0x41
nop dword [eax]
mov al, byte [ecx - 0x42]
lea ecx, [ecx + 1]
sub al, 0xb
xor al, 0xf4
mov byte [ecx - 1], al
sub edx, 1
jne 0x40ccf0
mov byte [esi + 0x83], dl
lea eax, [esi + 0x42]
push eax
push 0x6610
lea ecx, [ebp - 0x48]
call fcn.0042c5a0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 0
mov eax, dword [ecx + 0x8d4]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0x8d8]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x194]
push eax
call fcn.0042c880
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.0042cc10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ce10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9e0
mov eax, dword [0x551764]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x9dc], edx
xor esi, esi
mov dword [ebp - 0x9d8], ecx
nop word [eax + eax]
mov ecx, eax
mov dword [ebp + esi*4 - 0x9d4], eax
shr ecx, 0x1e
inc esi
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
cmp esi, 0x270
jb 0x40ce40
lea edi, [ebp - 0x9d4]
xor ebx, ebx
mov dword [ebp - 0x14], edi
mov esi, 1
test edx, edx
je 0x40cee9
sub esi, 1
mov dword [ebp - 0x10], esi
jne 0x40ce8c
lea ecx, [ebp - 0x9d4]
call fcn.0042bb10
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov ecx, dword [edi]
mov eax, ecx
shr eax, 0xb
add edi, 4
xor ecx, eax
mov dword [ebp - 0x14], edi
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor ecx, eax
mov eax, 0x446f8657
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
movzx eax, al
imul eax, eax, 0x65
sub cl, al
mov eax, dword [ebp - 0x9d8]
add cl, 0x16
mov byte [eax + ebx], cl
inc ebx
cmp ebx, dword [ebp - 0x9dc]
jb 0x40ce73
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c715a
mov esp, ebp
pop ebp
ret
Function at 0x40cf00
Capabilities:
Encode data using xor
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x551764]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x114
push 8
push dword [0x576b44]
mov dword [ebp - 0x214], 0x104
xor esi, esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x21c], ebx
test ebx, ebx
je 0x40cfe2
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ax, word [ebp - 0x20c]
xor edx, edx
xor ecx, ecx
cmp dx, ax
jae 0x40cf82
movzx eax, ax
nop dword [eax + eax]
inc ecx
rol esi, 7
xor esi, eax
movzx eax, word [ebp + ecx*2 - 0x20c]
cmp ecx, eax
jb 0x40cf70
lea eax, [ebx + 0x14]
sub ebx, 0x52f2e4
push edi
mov dword [ebp - 0x210], eax
xor edi, edi
nop dword [eax]
nop dword [eax + eax]
push esi
push dword [edi + 0x52f2e4]
lea ecx, [ebp - 0x210]
mov dword [ebx + edi + 0x52f2e4], eax
push 0
push 0
push ecx
push 0x20
push eax
call fcn.0040e3c0
mov eax, dword [ebp - 0x210]
add edi, 4
add eax, 2
add esp, 0x1c
mov dword [ebp - 0x210], eax
cmp edi, 0x10
jb 0x40cfa0
mov eax, dword [ebp - 0x21c]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004c715a
mov esp, ebp
pop ebp
ret

Function at 0x40d000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 0x220]
xorps xmm0, xmm0
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x14], 0
mov edx, dword [ecx + 0x224]
mov dword [ebp - 4], 0
push edi
movups xmmword [ebp - 0x24], xmm0
test edx, edx
ja 0x40d040
jb 0x40d039
cmp eax, 0x300
jae 0x40d040
mov ebx, eax
mov dword [ebp - 0xc], edx
jmp 0x40d04c
mov ebx, 0x300
mov dword [ebp - 0xc], 0
sub eax, ebx
lea edi, [esi + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], eax
sbb edx, 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0xc], edx
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x18], edx
push eax
push ebx
push edi
push dword [ecx + 0x288]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x40d0f5
add eax, 0x18
add eax, esi
mov dword [esi + 0x14], eax
lea ecx, [eax - 5]
mov dword [esi + 0x10], ecx
cmp byte [ecx], 0x7c
jne 0x40d0f5
cmp byte [ecx + 1], 0x25
jne 0x40d0f5
cmp byte [ecx + 2], 0x5e
jne 0x40d0f5
cmp byte [ecx + 3], 0x26
jne 0x40d0f5
cmp byte [ecx + 4], 0x2a
jne 0x40d0f5
add ecx, 0xffffff7b
mov dword [esi + 0xc], ecx
cmp byte [ecx], 0x7c
jne 0x40d0f5
cmp byte [ecx + 1], 0x25
jne 0x40d0f5
cmp byte [ecx + 2], 0x5e
jne 0x40d0f5
cmp byte [ecx + 3], 0x26
jne 0x40d0f5
cmp byte [ecx + 4], 0x2a
jne 0x40d0f5
dec ecx
cmp ecx, edi
jb 0x40d0f5
cmp byte [ecx], 0x7c
jne 0x40d0f0
cmp byte [ecx + 1], 0x25
jne 0x40d0f0
cmp byte [ecx + 2], 0x5e
jne 0x40d0f0
cmp byte [ecx + 3], 0x26
jne 0x40d0f0
cmp byte [ecx + 4], 0x2a
je 0x40d101
dec ecx
cmp ecx, edi
jae 0x40d0d3
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov dword [esi + 8], ecx
sub eax, esi
sub eax, 0x18
cdq
add eax, dword [ebp - 8]
pop edi
adc edx, dword [ebp - 0xc]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x551764]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push edi
mov edi, ecx
mov word [ebp - 0x404], ax
call fcn.0042bbf0
push eax
lea ecx, [ebp - 0x404]
call fcn.0040fb00
call fcn.0042bc60
push eax
lea ecx, [ebp - 0x404]
call fcn.0040fb00
call fcn.0042bcc0
push eax
lea ecx, [ebp - 0x404]
call fcn.0040fb00
mov esi, dword [0x576f68]
add esp, 0xc
test esi, esi
jne 0x40fc08
push 0x104
push 8
push dword [0x576b44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40fc08
push esi
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov eax, dword [0x576b34]
mov dword [0x576f68], esi
test eax, eax
je 0x40fc1e
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x40fc20
mov eax, esi
push eax
lea ecx, [ebp - 0x404]
call fcn.0040fb00
lea ecx, [ebp - 0x404]
add esp, 4
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40fc40
sub ecx, edx
sar ecx, 1
push edi
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.00435900
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
call fcn.004c715a
mov esp, ebp
pop ebp
ret

Function at 0x413060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push 1
push esi
push edx
push SysReAllocString
mov edi, ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41311c
push edi
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
mov dword [ebp - 4], 0x20
lea eax, [ebp - 4]
mov ecx, 1
push eax
lea eax, [edi + 8]
cmove esi, ecx
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x537364
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4130df
cmp dword [ebp - 8], 3
jne 0x4130df
cmp dword [ebp - 4], 0x20
jne 0x4130df
inc esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [edi + 0x28]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x53736c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413113
cmp dword [ebp - 8], 3
jne 0x413113
cmp dword [ebp - 4], 0x10
jne 0x413113
inc esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 3
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4138f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x534
mov eax, dword [0x551764]
xor eax, esp
mov dword [esp + 0x530], eax
push ebx
push esi
mov ebx, edx
mov dword [esp + 0x14], edx
push edi
mov edi, ecx
mov dword [esp + 0x24], edi
lea esi, [ebx + 1]
nop dword [eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x413920
sub ebx, esi
lea edx, [ecx + 2]
mov dword [esp + 0x20], ebx
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413930
push 0
push 0
sub ecx, edx
lea eax, [esp + 0x438]
push 0x104
sar ecx, 1
push eax
lea eax, [ecx + 1]
push eax
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x1c], 0
nop dword [eax + eax]
push esi
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.004353f0
lea ecx, [esp + 0x43c]
add esp, 0xc
xor edi, edi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413990
sub ecx, edx
je 0x413a56
mov esi, 0x576f84
lea ebx, [ecx - 1]
neg esi
shr ebx, 1
mov dword [esp + 0x14], esi
inc ebx
mov eax, dword [esp + 0x28]
lea esi, [esp + esi + 0x430]
inc eax
mov edx, 0x10
movzx ecx, al
mov dword [esp + 0x28], ecx
mov eax, dword [esp + ecx*4 + 0x30]
add eax, dword [esp + 0x2c]
movzx eax, al
mov dword [esp + 0x2c], eax
mov eax, dword [esp + eax*4 + 0x30]
add eax, dword [esp + ecx*4 + 0x30]
movzx eax, al
mov al, byte [esp + eax*4 + 0x30]
mov byte [esp + 0x13], al
mov eax, 0x576f84
nop
lea ecx, [edx - 0xe]
test ecx, ecx
je 0x413a06
mov cl, byte [esi + eax]
test cl, cl
je 0x413a06
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4139f0
mov esi, dword [esp + 0x14]
lea ecx, [eax - 1]
test edx, edx
cmovne ecx, eax
add esi, 2
mov dword [esp + 0x14], esi
mov byte [ecx], 0
movsx eax, byte [0x576f84]
mov cl, byte [eax + 0x533a08]
movsx eax, byte [0x576f85]
shl cl, 4
or cl, byte [eax + 0x533a08]
xor cl, byte [esp + 0x13]
mov byte [esp + edi + 0x430], cl
inc edi
sub ebx, 1
jne 0x4139b0
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
xor ecx, ecx
test edi, edi
je 0x413a7e
nop dword [eax]
mov eax, ecx
xor edx, edx
div ebx
mov al, byte [esp + ecx + 0x430]
not al
xor al, byte [edx + esi]
mov byte [esp + ecx + 0x430], al
inc ecx
cmp ecx, edi
jb 0x413a60
cmp edi, 0x104
jae 0x413ad4
mov eax, dword [esp + 0x1c]
inc eax
mov byte [esp + edi + 0x430], 0
mov dword [esp + 0x1c], eax
cmp eax, 2
jb 0x413970
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x430]
push edi
push esi
push edi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [esp + 0x53c]
xor eax, eax
mov word [esi + edi*2], ax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c715a
mov esp, ebp
pop ebp
ret
call fcn.004c72dd
int3