joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100403c1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1004033d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10040539
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10040539
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100404e8
jg 0x1004041a
test eax, eax
je 0x100404de
push 1
push 0x1000
call fcn.1002fb55
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10040440
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x100404d5
push 0x8000
push ebx
call fcn.1004026e
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1004046c
jg 0x10040467
cmp ecx, 0x1000
jb 0x1004046c
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1003efb4
add esp, 0x10
cmp eax, 0xffffffff
je 0x100404b1
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10040467
jl 0x10040498
test ecx, ecx
jne 0x10040459
push dword [ebp - 0xc]
push ebx
call fcn.1004026e
push esi
call fcn.1002fbb2
add esp, 0xc
xor edi, edi
jmp 0x1004054a
cmp byte [edi + 0x24], 0
je 0x100404c8
cmp dword [edi + 0x20], 5
jne 0x100404c8
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100404d3
mov edi, dword [edi + 0x18]
jmp 0x100404d5
xor edi, edi
push esi
call fcn.1002fbb2
pop ecx
jmp 0x1004054a
test ecx, ecx
jg 0x100404aa
jl 0x100404e8
test eax, eax
jae 0x100404aa
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10034ccf
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1004050b
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100404aa
jmp 0x10040542
push ebx
call fcn.1003d361
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100404aa
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x1004054a
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x10040547
mov edi, dword [edi + 0x18]
jmp 0x1004054a
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10034ccf
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b7a1
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.1000de50
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.1002668d
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.1002668d
push 0x10038198
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.1002668d
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.1000de50
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000b846
sub ecx, edx
cmp ecx, 6
jbe 0x1000b86d
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.1002668d
pop ecx
pop ecx
test eax, eax
jne 0x1000b86d
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000b874
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x10036ae3
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.1002668d
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.1000d8d0
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000b8ee
mov ax, word [0x100381c4]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x824
ret

Function at 0x1002668d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1002669c
pop dword [ebp - 0x1c]
mov eax, 0xfcb5cb82
sub eax, 0xecb364e6
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3faf9
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0xb30da1c9
add ecx, 0x4cf2a6b0
mov esi, eax
mov edi, 0xf8d78bc4
add edi, 0x172cd43c
add edi, dword [ebp - 0x1c]
mov edx, 0x8db58e7e
sub edx, 0x4c98d987
xor dword [ebp - 0xc], edi
mov ebx, dword [edi]
add ebx, edx
add dword [ebp - 4], ebx
mov dword [esi], ebx
sub dword [ebp - 0xc], ebx
add esi, 0xcda08fa1
add esi, 0x325f7063
add edi, 0xc5a3514c
sub edi, 0xc5a35148
loop 0x100266f6
add eax, 0x551747b8
add eax, 0xaae9ccff
mov ebx, eax
add eax, 5
mov ecx, 0x1f145330
add ecx, 0xf0ebacd0
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x403e59
pop dword [ebp - 0x1c]
mov eax, 0x403e59
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x41dc5d39
add dword [ebp - 0x2c], 0xc75e812
mov dword [ebp - 0x28], 0x11e33339
add dword [ebp - 0x28], 0x2050190c
mov dword [ebp - 0x24], 0x6c233d4
sub dword [ebp - 0x24], 0xba75efa6
mov dword [ebp - 0x20], 0xf1468f45
add dword [ebp - 0x20], 0xeb970bb
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x739a34fd
sub eax, 0x7359c499
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x1172a32b
add dword [ebp - 0x2c], 0x62ffc62b
mov dword [ebp - 0x28], 0x8bb270ce
sub dword [ebp - 0x28], 0x4a460f59
mov dword [ebp - 0x24], 0x1448f6d9
add dword [ebp - 0x24], 0x4f267593
mov dword [ebp - 0x20], 0xa502e375
add dword [ebp - 0x20], 0x5afd1c8b
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xe1143fdf
sub eax, 0xe0d3cf37
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x33829
push 0
call eax
mov ecx, 0xd391b732
add ecx, 0x2c6e83db
mov ebx, eax
mov esi, 0x65f31bf1
add esi, 0x9a4de40f
add esi, dword [ebp - 0x1c]
mov edi, 0x2caaf30a
sub edi, 0xff240653
xor dword [ebp - 0xc], 0x8946841a
mov edx, dword [esi]
sub dword [ebp - 8], edx
sub edx, edi
xor dword [ebp - 8], esi
mov dword [ebx], edx
add dword [ebp - 4], eax
add ebx, 4
add esi, 4
loop 0x403f76
add eax, 0x7e1523d8
sub eax, 0x7e1444d1
mov ebx, eax
add eax, 0x40306f13
add eax, 0xbfcf90f2
mov ecx, 0xe5598111
add ecx, 0x1ae67eef
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10006724
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
xor eax, eax
mov dword [edi], 0x100015dc
mov dword [edi + 0x38], eax
push 0x10001670
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
call fcn.10010aaa
mov dword [edi + 4], eax
test eax, eax
je 0x100067db
push ebx
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x10001688
push eax
call esi
push 0x10001698
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
push 0x100016ac
push dword [edi + 4]
mov dword [edi + 0x14], eax
call esi
push 0x100016bc
push dword [edi + 4]
mov dword [edi + 0x18], eax
call esi
push 0x100016d0
push dword [edi + 4]
mov dword [edi + 0x1c], eax
call esi
mov ebx, 0x100016e8
push ebx
push dword [edi + 4]
mov dword [edi + 0x20], eax
call esi
push ebx
push dword [edi + 4]
mov dword [edi + 0x24], eax
call esi
push 0x100016f4
push dword [edi + 4]
mov dword [edi + 0x28], eax
call esi
push 0x10001710
push dword [edi + 4]
mov dword [edi + 0x2c], eax
call esi
push 0x10001724
push dword [edi + 4]
mov dword [edi + 0x30], eax
call esi
pop esi
mov dword [edi + 0x34], eax
mov dword [edi + 8], 1
pop ebx
mov eax, edi
pop edi
ret

Function at 0x10010aaa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10010ab9
pop dword [ebp - 0x40]
mov eax, 0xff59483d
add eax, 0x10a7c27c
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x22abc538
sub dword [ebp - 0x50], 0xd4597fed
mov dword [ebp - 0x4c], 0xfac0889f
sub dword [ebp - 0x4c], 0xc88d3c5a
mov dword [ebp - 0x48], 0x3dcb123b
add dword [ebp - 0x48], 0xe8131f3
mov dword [ebp - 0x44], 0xa50f8037
sub dword [ebp - 0x44], 0xa50f8037
lea eax, [ebp - 0x50]
push eax
mov eax, 0x507110fa
add eax, 0xbf8f00be
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xcc7ff24d
sub dword [ebp - 0x50], 0x580d88f7
mov dword [ebp - 0x4c], 0xc856e351
add dword [ebp - 0x4c], 0x79157e24
mov dword [ebp - 0x48], 0x112810d9
add dword [ebp - 0x48], 0x52475b93
mov dword [ebp - 0x44], 0x94ac6f8
add dword [ebp - 0x44], 0xf6b53908
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3c022
push 0
call eax
mov ecx, 0x81a5be7c
sub ecx, 0x81a57157
xor esi, esi
add esi, eax
mov edx, 0x3c28416c
add edx, 0xd3dac894
add edx, dword [ebp - 0x40]
mov edi, 0x5193bf4b
sub edi, 0x8708127
sub dword [ebp - 0x28], edi
mov ebx, dword [edx]
xor dword [ebp - 0x28], edx
sub ebx, edi
mov dword [esi], ebx
xor dword [ebp - 0x38], esi
add esi, 0xc5250391
add esi, 0x3adafc73
add edx, 0x14ca5204
add edx, 0xeb35ae00
loop 0x10010bd8
add eax, 0x12767
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x23c982f6
add ecx, 0xec367d0a
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1001341b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10002830]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x1001354d
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.MSO.dll_Ordinal_6137]
cmp eax, 0xffffffff
je 0x1001346d
test al, 0x10
je 0x1001346d
push 0x103
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.10010aaa
jmp 0x100134da
call fcn.10010aaa
xor eax, eax
push eax
push eax
push eax
push eax
push 0x100
lea eax, [ebp - 0x20c]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.msvcr100.dll__wsplitpath_s]
lea eax, [ebp - 0x20c]
push eax
call fcn.10010aaa
add esp, 0x28
test eax, eax
je 0x100134a0
dec eax
add eax, eax
cmp eax, 0x200
jae 0x10013468
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
mov esi, 0x103
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10010aaa
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
mov eax, dword [edi + 4]
test eax, eax
je 0x100134f9
lea ecx, [ebp - 0x414]
push ecx
push eax
call fcn.10010aaa
neg eax
sbb eax, eax
and eax, 0xfffffc16
jmp 0x10013552
lea eax, [ebp - 0x414]
push eax
call fcn.10010aaa
lea esi, [eax*2 + 0x1a]
push esi
call dword [sym.imp.msvcr100.dll_malloc]
pop ecx
pop ecx
mov dword [edi + 4], eax
test eax, eax
je 0x10013546
shr esi, 1
push esi
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.10010aaa
push esi
push dword [edi + 4]
push 0x100012d4
call ebx
push esi
push dword [edi + 4]
push 0x10001ec4
call ebx
xor eax, eax
jmp 0x10013552
mov eax, 0xfffffc0d
jmp 0x10013552
mov eax, 0xfffffc16
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100155e0
leave
ret 4

Function at 0x100155e0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10002830]
jne fcn.10015aa0
ret
Function at 0x4010c0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x42e618]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
mov al, 1
push edi
lea ebx, [ebx]
movzx edx, al
mov byte [ebp + edx - 0x104], cl
mov dl, al
and dl, 0x80
mov byte [ebp + ecx - 0x204], al
inc ecx
neg dl
sbb dl, dl
mov bl, al
and dl, 0x1b
add bl, bl
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x4010e0
mov al, 1
mov ecx, 0x45e280
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
and dl, 0x1b
add al, al
xor al, dl
cmp ecx, 0x45e2a8
jl 0x401115
mov dword [0x45d680], 0x63
mov dword [0x46084c], 0
jmp loc.0046f9c8
Function at 0x410c00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4261f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42e618]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x410d91
cmp byte [ebx + 0x49], 0
je 0x410d91
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x410d85
lea esi, [ebp - 0x2c]
call fcn.00410800
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x410c73
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
mov edi, dword [ebp - 0x1c]
add edi, edx
push edi
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x410cac
dec eax
je 0x410cb0
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x410d8c
call fcn.0040f4b0
xor al, al
jmp 0x410d93
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x410cc0
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x410ced
cmp edi, 0x10
jae 0x410ccf
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.00414872
add esp, 0x10
cmp esi, eax
jne 0x410d7d
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x410d89
test esi, esi
jne 0x410c67
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x410dae
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x410dae
cmp edi, esi
jae 0x410d66
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.004113b0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x410c67
mov ecx, eax
cmp edi, 0x10
jae 0x410d42
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x410d5d
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x410c61
test esi, esi
jne 0x410d38
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x410d75
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x410c61
lea ecx, [ebp - 0x2c]
jmp 0x470e18
xor al, al
jmp 0x410d93
lea ecx, [ebp - 0x2c]
call fcn.0040f4b0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413878
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.00412673
int3
Function at 0x411d10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426548
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42e618]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x1c]
push 0x42f7a8
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040c790
add esp, 8
lea ecx, [ebp - 0x18]
push 0x42f3c4
push ecx
mov byte [ebp - 4], 1
call fcn.0040c790
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push 0x6a
mov byte [ebp - 4], 3
call fcn.00406d70
add esp, 4
cmp eax, ebx
je 0x411da1
push eax
lea eax, [ebx + 0x6a]
lea edi, [ebp - 0x14]
call fcn.00406930
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx - 0xc], ebx
je 0x411e2d
mov edx, dword [ebp - 0x18]
cmp dword [edx - 0xc], ebx
je 0x411e2d
cmp dword [esi - 0xc], ebx
je 0x411e2d
xor eax, eax
mov dword [ebp - 0x14], eax
nop
cmp eax, 2
jge 0x411e2d
xor ecx, ecx
cmp eax, ebx
setne cl
push 2
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
add ecx, 0x80000001
mov dword [ebp - 0x20], ebx
call fcn.00411c90
test eax, eax
jne 0x411e11
mov edi, dword [ebp - 0x18]
cmp esi, ebx
je 0x411e11
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push ebx
push edi
mov edi, dword [ebp - 0x28]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x411e14
mov edi, dword [ebp - 0x28]
cmp edi, ebx
je 0x411e22
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
jmp 0x411dc0
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x411e4d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411e70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411e92
mov ecx, dword [eax]
jmp 0x46fb58
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4085f0
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xf7
push es
fnstenv [edx - 0x4eda1996]
mov dword [0xf2e165f6], eax
and eax, 0x65f6a3b1
loope 0x40852c
jno 0x40853a
stosb byte es:[edi], al
aaa
inc byte [edi - 0x6c0488d0]
mov esp, 0xb006035e
add al, ah
pop es
test al, 0x2e
sub byte [edx + 0x43], bh
rol dword [ebp + esi - 0x4f381ee], cl
imul esp, edx, 0x4803c988
iretd
scasd eax, dword es:[edi]
xor dword [0xe27f7b46], edi
and ebx, dword [edi + 0x45a01066]
push esi
pop es
in al, 0x2e
cld
cld
inc ecx
lock xor ebx, dword [esi + 0x5d]
adc eax, 0x46a49b51
jno 0x408588
nop
pop ebx
add dword [ebp + ebp*8 + 0x32afd5bb], 0xffffffd0
test ch, ch
in eax, dx
mov ebx, 0xd032afd5
loopne 0x408533
das
test al, 0xb6
out 1, eax
push edi
shl byte [ecx - 0x3a0e8b8c], cl
jns 0x408566
std
invalid
cmp byte [eax + edx*2 + 0x2c], cl
mov eax, esi
sub dword [esp + ebp*8], ebx
movsd dword es:[edi], dword [esi]
jp 0x408588
sub edi, dword [ebx + ebp*8]
mov al, byte cs:[0x1d62a49f]
lahf
adc byte [eax + 4], 0x4e
das
cmp al, 0xda
stc
jnp 0x408558
pop ecx
adc byte [edi + 0x5bd7cbb3], dl
int1
sahf
cmpsb byte [esi], byte es:[edi]
xor eax, 0x883765
inc ebx
mov esi, 0x7680f820
insd dword es:[edi], dx
inc ebp
dec ecx
jbe 0x4085ec
ja 0x408576
mov esp, 0x99e2d9f8
loop 0x408587
sahf
cdq
cld
and dword [ebx], edx
inc ebp
lds ebx, [ebp - 0x71b2543c]
cmp eax, 0x40e00dd2
salc
pushal
and byte [edi], 0xd7
mov eax, 0xe6e0f329
pop esi
add dh, al
rcr dword [ebx - 0x7893276a], 1
mov ah, 0xfe
arpl word [esi - 0x4a], bx
imul ecx, eax, 0xedecb8c1
mov dh, 0x1e
inc ebp
push ss
inc esi
or byte [edi - 0x42], 0x77
test byte [edx], dh
xor dword [ebx + 0x2739eef1], eax
ja 0x4085ad
xor dh, byte [ecx]
xor ecx, 0xffffffee
cmp dword [edi], esp
xchg ch, ah
add eax, dword [esi - 0x495f2fb8]
jae 0x408663
xchg esi, eax
xchg esi, eax
imul ecx, dword [edi - 0x1d], 0xe10e69cf
pop ss
inc eax
push ss
xchg esi, eax
jecxz 0x408627
adc eax, 0x70910ce3
pushfd
pop eax
xor al, 0xfd
and byte [edx], ah
inc esp
mov edi, 0x7e7b52a1
comiss xmm6, dword [ecx]
inc edi
xchg ecx, eax
lds esi, [ecx - 0x19]
int3
invalid
Function at 0x449f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sal byte [esi], 0xa2
mov dh, 0xaf
jge 0x449ff5
and eax, ecx
adc al, 0x13
pop esi
mov byte [eax - 0x35], dl
sbb dword [edi + 0x38], ebx
push ds
test eax, 0xce1f371
adc al, bh
mov byte [0x8dacfea], al
mov al, 0xd1
and al, 0x56
xchg esi, eax
xchg esp, eax
inc ebp
invalid
jbe 0x44a055
or al, byte [ebx + 0x58]
adc dword [ecx - 0x12], ebx
invalid
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov esi, dword [ebx]
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x44a09f
xor edi, edi
mov dword [edx], edi
cmp eax, 0x7b
jne 0x44a0ba
cmp word [esi + 2], 0x5e
jne 0x44a082
mov dword [edx], 1
add esi, 2
mov eax, edi
add esi, 2
movzx ecx, word [esi]
test cx, cx
je 0x44a09f
cmp ecx, 0x7d
je 0x44a0b1
mov word [ebp + eax*2 - 0x58], cx
inc eax
cmp eax, 0x1f
jl 0x44a084
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x2e
xor eax, eax
mov dword [ebx], esi
pop edi
pop esi
pop ebx
leave
ret
xor ecx, ecx
mov word [ebp + eax*2 - 0x58], cx
jmp 0x44a0c4
mov word [ebp - 0x58], ax
xor eax, eax
mov word [ebp - 0x56], ax
mov eax, 0xa9
mov dword [ebx], esi
mov dword [ebp - 0xc], eax
lea edx, [eax + edi]
sar edx, 1
lea ecx, [ebp - 0x58]
imul eax, edx, 6
mov dword [ebp - 8], ecx
movzx eax, word [eax + fcn.004c4f50]
add eax, 0x4c5440
mov dword [ebp - 4], eax
movzx ecx, word [ecx]
mov eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
test cx, cx
jne 0x44a100
cmp byte [eax], 0
je 0x44a13f
movzx eax, byte [eax]
add dword [ebp - 8], 2
mov ebx, eax
inc dword [ebp - 4]
cmp cx, ax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
je 0x44a0eb
cmp word [ebp - 0x18], ax
jbe 0x44a128
mov eax, dword [ebp - 0xc]
lea edi, [edx + 1]
jmp 0x44a12d
mov eax, edx
mov dword [ebp - 0xc], eax
cmp edi, eax
jl 0x44a0ce
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x2f
jmp 0x44a0a8
mov ecx, dword [ebp + 8]
xor eax, eax
imul esi, edx, 6
inc eax
movzx edx, word [esi + 0x4c4f52]
mov dword [ecx], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [esi + 0x4c4f54]
mov dword [ecx], edx
jmp 0x44a0ac