joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408550
Capabilities:
Encrypt data using chaskey
Encrypt data using speck

Disassembly:
or cl, 0x46
adc al, 0xcd
pop ds
std
sbb al, 0xde
sbb al, 0xfe
mov byte [edx + 0x60], 0xbe
invalid

Function at 0x408560
Capabilities:
Encrypt data using chaskey
Encrypt data using speck

Disassembly:
push 0x63
mov esi, 0xa3c69cbe
and dword [edx + 0x7d], 0x2c7b7875
xor esi, esi
inc esi
cmc
insb byte es:[edi], dx
push ecx
xor edi, dword [ecx]
add eax, 0xd2cbf1eb
stosd dword es:[edi], eax
jle 0x4085e6
jo 0x4085cf
std
push 0x71
jnp 0x4085a6
xchg dl, ch
or dword [ebx - 0x4c], edi
sub byte [edi], bl
add dh, byte [ebp - 0x4c9a5c43]
inc edx
mov dh, 0xb5
mov al, dh
and byte [eax - 0x78], ch
out dx, al
rcl eax, 1
jmp 0x2a1c616e
push ebx
push eax
push esp
sub ebx, dword [eax + 0x14a6c684]
add dword [ecx + 0x476984b7], ebp
sub eax, dword [ebx + 0x3b]
nop
insb byte es:[edi], dx
scasb al, byte es:[edi]
lea esi, [edi + 0x12]
scasb al, byte es:[edi]
test eax, 0x3f332caa

Function at 0x40e470
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x4124bf
je 0x40934d
jmp 0x411853
adc dl, dl
jmp 0x441085
jmp 0x40e39b
jmp 0x41230d
dec eax
lea eax, [ebx + edx*4]
jmp 0x407fdb
jbe 0x40f2f3
call fcn.004128d5
jmp 0x4069a5
jmp 0x410729
pop ecx
jmp 0x4071c8
adc dl, dl
jmp 0x4066dd
jmp 0x41459c
mov byte [ebp - 2], dl
jmp 0x407a9a
adc dl, dl
jmp 0x414c38
adc dl, dl
jmp 0x40ef4f
dec eax
lea eax, [eax - 0x5aded97a]
setb dh
mov al, 0x9b
not ah
dec eax
bswap eax
dec eax
lea eax, [ebx + edx*4 + 0x400]
jmp 0x4410f4
jmp 0x4086b0
jmp 0x44136e
jmp 0x410b1e
mov byte [ebp - 2], dl
jmp 0x407a9a
jmp 0x441574
adc dl, dl
jmp 0x41538b
call fcn.004128d5
jmp 0x40912d
mov cl, 0xc3
pop ecx
jmp 0x408d65
mov byte [ebp - 2], dl
jmp 0x407a9a
call fcn.004128d5
jmp 0x40e91f
dec eax
lea eax, [edx*4 - 0x1fdf8d73]
movzx eax, bl
dec eax
lea eax, [ebx + edx*4]
jmp 0x413857
mov byte [ebp - 2], dl
jae 0x413539
mov bl, dh
jmp 0x414a69
jmp 0x411820
jmp 0x406787
je 0x40934d
movsx ax, dl
dec eax
lea eax, [ebx - 0x68042760]
jmp 0x4078a2
jmp 0x4117dc
pop ebx
jmp 0x40825e
jae 0x413539
dec eax
xchg ebx, ecx
pop ebx
not cx
jmp 0x410c8e
dec eax
movzx ecx, dl
not ch
setne cl
pop ecx
jmp 0x4149a7
jmp 0x443f9f
jmp 0x40f91e
jae 0x413539
mov bh, 0xe6
pop ebx
ja 0x415014
bswap cx
bswap cx
movzx cx, dl
pop ecx
jmp 0x441080
mov dh, 0
jmp 0x413de7
jb 0x41067e
call fcn.004128d5
jmp 0x406ac2
jb 0x407a83
cmc
test dl, 0xf5
cmp esp, 0x973d3412
stc
xor dh, dl
clc
test dh, 1
mov dh, cl
mov dh, 0
jmp 0x40888f
call fcn.004128d5
jmp 0x408023
jb 0x407a83
bt esi, ecx
stc
clc
xor dh, dl
clc
cmp bl, 0xb2
test dh, 1
not dh
mov dh, 0x13
mov dh, al
jmp 0x4410d9

Function at 0x4109e0
Capabilities:
Encode data using xor

Disassembly:
fistp word [ebx]
sar byte [esi - 0x10], 1
and ah, byte [edx]
cld
xor al, 0xe1
pop ebp
jno 0x4109e5
and al, byte [eax]
bswap esp
mov bl, 0xf
out dx, eax
cli
add dh, ah
into
dec esp
fxch st(3)
test eax, 0x2945a2ba
inc ebp
sub dword [edx], edx
mov edi, dword [ecx + ebp*2 + 0x5c1]
or cl, byte [0x2fefeae1]
or edi, edx
std
loopne 0x410a5e
sub eax, 0x7c17bcdc
retf
cmp cl, byte [eax + 0xe]
popal
inc ecx
iretd
Function at 0x413a70
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x406f57
movsx ax, al
dec eax
lea eax, [ebx + edx*4]
jmp 0x408798

Function at 0x42c210
Capabilities:
Encode data using xor

Disassembly:
aas
or dh, byte [ebx - 0x54]
cmp dword [ecx + 0x3e72eb0b], 0xffffffb8
dec esi
invalid
jnp 0x42c26e
jl 0x42c218
mul byte [ecx]
sti
nop
add edi, ebx
push cs
dec ecx
mov ecx, dword [esi]
shl dword [esp + edi*4], 0x17
mov al, 0x58
pop eax
pop eax
adc dl, byte [ebx]
pop edi
les eax, [ebp + 0x15]
loope 0x42c19e
test dword [esi - 0x2088a1d1], eax
xchg byte [edi], ch
pop esi
ja 0x42c1fd
xor al, 0x2d
mov cl, byte [ebx + 0x76]
fdiv qword [esi - 0x2e]
and esi, edx
in al, 0xe2
xor dh, byte [ebx + 0x50]
inc ebp
mov eax, dword [ebx]
movq qword [esi + 0xbaee67a], mm0
and eax, 0x2cf44bd3
push cs
push cs
xor ebp, dword [ebx + 0x44ac4bd0]
test eax, 0x6991d45f
mov eax, 0x233806f6
sbb al, 0x26
test byte [esi - 0x31], dh
jmp dword [esi + 0x3069824]
clc
add bh, byte [esi + 0x681fa7aa]
invalid

Function at 0x44e280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [ebp + 0xc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test esi, esi
je 0x44e2b1
cmp esi, 0xffffffff
je 0x44e2b1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret 8

Function at 0x44e2f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4be4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x44e3ce
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x4a08c8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44e3ce
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x44e38d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub ecx, 0xd53e8000
push 0
push 0x2710
sbb eax, 0x19db1de
push eax
push ecx
call fcn.0048d090
jmp 0x44e391
xor eax, eax
xor edx, edx
push 8
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 0xb
push 0
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048c845
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0048c845
mov esp, ebp
pop ebp
ret 8
Function at 0x4544a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4be4b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x18]
push 0x208
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x210], 0x208
cmp dword [ebx + 0x14], 8
jb 0x4544ff
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 8
jb 0x454507
mov edi, dword [edi]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push ebx
push edi
push dword [ebp - 0x218]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, esi
test eax, eax
je 0x454549
push dword [ebp - 0x214]
call fcn.00401ff0
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048c845
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, dword [ebp - 0x210]
shr eax, 1
dec eax
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004045a0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048c845
mov esp, ebp
pop ebp
ret
Function at 0x4584d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x458601
test al, 3
jne 0x458601
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x4585bc
cmp edi, 8
jb 0x458585
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x458534
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x4585c0
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x4585a2
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x4585c4
xor edi, edi
jmp 0x4585c4
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x4585d8
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x4586c4
cmp ecx, 0x20
jb 0x4586a5
mov esi, ecx
add eax, 0x10
and esi, 0xffffffe0
xorps xmm3, xmm3
mov dword [esp + 0x1c], esi
xorps xmm2, xmm2
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
nop dword [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edi + ebx]
add edi, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x458640
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x4586c4
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x4586b4
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x470240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490400
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4be4b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
cmp eax, ecx
mov edx, dword [esi + 0x38]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 0
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x470297
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x4702a8
push 0x3c
push esi
call fcn.0048c837
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47c3c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49825b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4be4b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x238], esi
test eax, eax
je 0x47c517
test edi, edi
je 0x47c517
xor ebx, ebx
mov dword [ebp - 0x21c], 7
xor ecx, ecx
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x234]
push ecx
push 0x20019
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47c4d8
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], 0x208
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x238]
push eax
push ebx
push edi
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47c4cc
cmp dword [ebp - 0x238], 1
jne 0x47c4cc
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47c4a4
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.004045a0
mov ebx, dword [ebp - 0x220]
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x22c]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi], eax
mov eax, dword [ebp - 0x21c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x228]
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0x224]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
jmp 0x47c52a
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048c845
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47de00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498548
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4be4b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4be2fc], 0xffffffff
jne 0x47df71
lea eax, [ebp - 0x58]
push 1
push eax
call fcn.00484ef0
push str.cfgs_setup.cfg
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.00401680
add esp, 0x14
mov edx, dword [ebp - 0x44]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x47de99
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47de8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x47de8f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0048c837
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
call fcn.004045a0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push str.SupportNewLangs
push str.Local
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x14]
mov dword [0x4be2fc], eax
cmp edx, 8
jb 0x47df21
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47df17
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47df61
push edx
push ecx
call fcn.0048c837
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x47df71
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47df67
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x47df67
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0048c837
add esp, 8
cmp dword [0x4be2fc], 1
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048c845
mov esp, ebp
pop ebp
ret
Function at 0x47e760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4be4b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
push edi
mov dword [ebp - 0xc], 0
lea edi, [ecx + 2]
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47e7a0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1c]
call fcn.004045a0
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x20]
push ecx
push 0x20219
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], 0
cmovae eax, dword [ebp - 0x1c]
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x47e84b
push dword [ebp - 0x20]
call edi
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x20]
push ecx
push 0x20119
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x47e84b
push dword [ebp - 0x20]
call edi
mov esi, 0x80004005
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x47e899
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47e88f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x47e88f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov eax, dword [ebp + 0x18]
add eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x20]
mov esi, eax
call edi
test esi, esi
jne 0x47e814
mov eax, dword [ebp - 0x24]
cmp eax, 1
je 0x47e88b
cmp eax, 2
jne 0x47e814
xor esi, esi
jmp 0x47e819
push edx
push ecx
call fcn.0048c837
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0048c845
mov esp, ebp
pop ebp
ret

Function at 0x47ea70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x47eaa4
xor al, al
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0x14]
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x47eab4
mov ecx, dword [esi]
mov esi, ecx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret
Function at 0x47f210
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ecx]
cmp esi, 0x10
je 0x47f227
cmp esi, 0x20
jne 0x47f3fb
shr esi, 2
mov edx, 4
cmp esi, edx
mov dword [ebp - 0xc], esi
mov eax, esi
cmovb eax, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [eax*4 + 0x1c]
mov dword [ebp - 8], eax
test edi, edi
je 0x47f3fa
mov dword [edi], 0x10
push ebx
mov dword [edi + 4], eax
xor ebx, ebx
add edi, 8
test esi, esi
je 0x47f292
lea edx, [ecx + 5]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*4], ecx
inc ebx
cmp ebx, esi
jl 0x47f265
mov eax, dword [ebp - 8]
mov ebx, dword [edi + ebx*4 - 4]
mov ecx, esi
cmp esi, eax
jge 0x47f37a
mov dword [ebp + 8], 0
mov dword [ebp - 4], edi
lea ebx, [ebx]
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x47f310
mov eax, dword [ebp + 8]
cdq
idiv esi
mov dl, byte [eax + 0x4a6db0]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + str.cw]
movzx eax, dl
xor esi, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx eax, bl
shl esi, 8
shr ebx, 0x18
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx ebx, byte [ebx + str.cw]
shl esi, 8
xor ebx, esi
mov esi, dword [ebp - 0xc]
jmp 0x47f35d
cmp esi, 6
jbe 0x47f35d
cmp edx, 4
jne 0x47f35d
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
xor edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + str.cw]
xor edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + str.cw]
xor ebx, edx
mov eax, dword [ebp - 4]
inc dword [ebp + 8]
xor ebx, dword [eax]
add eax, 4
mov dword [edi + ecx*4], ebx
inc ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x47f2b0
xor esi, esi
sub ecx, 1
js 0x47f3f9
lea eax, [edi + eax*4]
mov dword [ebp + 8], eax
mov ebx, dword [edi + ecx*4]
cmp esi, 4
jl 0x47f3e9
cmp ecx, 4
jb 0x47f3e9
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x4a83d0]
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x4a87d0]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x4a7fd0]
movzx eax, bl
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x4a8bd0]
mov eax, dword [ebp + 8]
jmp 0x47f3eb
mov edx, ebx
mov dword [eax], edx
inc esi
add eax, 4
sub ecx, 1
mov dword [ebp + 8], eax
jns 0x47f387
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47fed0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x4800a8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4800a8
test bl, 3
jne 0x4800a8
lea eax, [ebx - 1]
xor edx, edx
add eax, ecx
mov dword [ebp - 8], edx
cmp byte [eax], 0x3d
jne 0x47ff1a
inc edx
dec eax
mov dword [ebp - 8], edx
cmp edx, 2
ja 0x4800a8
cmp byte [eax], 0x3d
je 0x47ff07
shr ebx, 2
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
test ebx, ebx
je 0x48009d
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
mov al, byte [esi - 2]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x47ff42
sub al, 0x41
jmp 0x47ff71
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x47ff4e
sub al, 0x47
jmp 0x47ff71
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x47ff5a
add al, 4
jmp 0x47ff71
cmp al, 0x2b
jne 0x47ff62
mov al, 0x3e
jmp 0x47ff71
cmp al, 0x2f
jne 0x47ff6a
mov al, 0x3f
jmp 0x47ff71
cmp al, 0x3d
sete al
sub al, 1
mov dl, byte [esi - 1]
lea ecx, [edx - 0x41]
cmp cl, 0x19
ja 0x47ff81
sub dl, 0x41
jmp 0x47ffb5
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x47ff8e
sub dl, 0x47
jmp 0x47ffb5
lea ecx, [edx - 0x30]
cmp cl, 9
ja 0x47ff9b
add dl, 4
jmp 0x47ffb5
cmp dl, 0x2b
jne 0x47ffa4
mov dl, 0x3e
jmp 0x47ffb5
cmp dl, 0x2f
jne 0x47ffad
mov dl, 0x3f
jmp 0x47ffb5
cmp dl, 0x3d
sete dl
dec dl
mov bl, byte [esi]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x47ffc4
sub bl, 0x41
jmp 0x47fff8
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x47ffd1
sub bl, 0x47
jmp 0x47fff8
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x47ffde
add bl, 4
jmp 0x47fff8
cmp bl, 0x2b
jne 0x47ffe7
mov bl, 0x3e
jmp 0x47fff8
cmp bl, 0x2f
jne 0x47fff0
mov bl, 0x3f
jmp 0x47fff8
cmp bl, 0x3d
sete bl
dec bl
mov ah, byte [esi + 1]
mov cl, ah
sub cl, 0x41
cmp cl, 0x19
ja 0x48000a
sub ah, 0x41
jmp 0x480042
mov cl, ah
sub cl, 0x61
cmp cl, 0x19
ja 0x480019
sub ah, 0x47
jmp 0x480042
mov cl, ah
sub cl, 0x30
cmp cl, 9
ja 0x480028
add ah, 4
jmp 0x480042
cmp ah, 0x2b
jne 0x480031
mov ah, 0x3e
jmp 0x480042
cmp ah, 0x2f
jne 0x48003a
mov ah, 0x3f
jmp 0x480042
cmp ah, 0x3d
sete ah
dec ah
cmp al, 0xff
je 0x4800a8
cmp dl, 0xff
je 0x4800a8
cmp bl, 0xff
je 0x4800a8
cmp ah, 0xff
je 0x4800a8
mov esi, dword [ebp + 0xc]
mov cl, dl
shl al, 2
shr cl, 4
or cl, al
shl dl, 4
mov byte [edi + esi], cl
mov al, bl
mov ecx, esi
shr al, 2
mov esi, dword [ebp - 4]
or al, dl
shl bl, 6
add esi, 4
or bl, ah
mov dword [ebp - 4], esi
mov byte [edi + ecx + 1], al
mov eax, dword [ebp + 8]
inc eax
mov byte [edi + ecx + 2], bl
add edi, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x47ff33
mov edx, dword [ebp - 8]
sub edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret