joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002e70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002e80
sub eax, edx
mov edx, eax
xor eax, eax
xor ecx, ecx
test edx, edx
jle 0x10002ead
push edi
movsx edi, byte [ecx + esi]
add edi, eax
imul edi, edi, 0x401
mov eax, edi
shr edi, 6
inc ecx
xor eax, edi
cmp ecx, edx
jl 0x10002e94
pop edi
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
pop esi
ret

Function at 0x10003b40
Capabilities:
Enumerate browser history

Disassembly:
push 0xffffffffffffffff
push 0x10013108
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x100180d8]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100180d8]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
xor ebp, ebp
xor eax, eax
mov esi, ecx
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], ebp
mov word [esp + 0x58], ax
lea ecx, [esp + 0x20]
push ecx
push 0x100144b0
mov ebx, 1
push ebx
push ebp
push str._J7_
mov dword [esp + 0x90], ebp
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x10003bcb
cmp dword [esp + 0x6c], 8
jb 0x10003bc4
mov edx, dword [esp + 0x58]
push edx
call fcn.10005112
add esp, 4
xor al, al
jmp 0x10003cc1
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jge 0x10003bfb
cmp dword [esp + 0x6c], 8
jb 0x10003bc4
mov ecx, dword [esp + 0x58]
push ecx
call fcn.10005112
add esp, 4
xor al, al
jmp 0x10003cc1
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x30]
push ecx
push ebx
push eax
call edx
test eax, eax
jl 0x10003c5a
mov edi, 0x74
jmp 0x10003c20
cmp dword [esp + 0x1c], ebp
je 0x10003c5a
mov eax, dword [esp + 0x30]
cmp word [eax], 0x68
jne 0x10003c3f
cmp word [eax + 2], di
jne 0x10003c3f
cmp word [eax + 4], di
jne 0x10003c3f
add dword [esi + 0x54], ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x30]
push edx
push ebx
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jge 0x10003c20
mov eax, dword [esi + 0x10]
mov dword [esp + 0x14], eax
cmp dword [esi + 0xc], eax
jbe 0x10003c6b
call fcn.100062b2
mov ebp, dword [esi + 0x28]
mov ecx, dword [esi]
mov dword [esp + 0x24], ecx
cmp dword [esi + 0x24], ebp
jbe 0x10003c7e
call fcn.100062b2
mov edi, dword [esi + 0x24]
mov ebx, dword [esi + 0x18]
cmp edi, dword [esi + 0x28]
jbe 0x10003c8e
call fcn.100062b2
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esp + 0x24]
push edx
push ebp
push ebx
push edi
push eax
mov eax, dword [esp + 0x28]
push eax
push ecx
mov ecx, esi
call fcn.100038d0
cmp dword [esp + 0x6c], 8
jb 0x10003cbf
mov edx, dword [esp + 0x58]
push edx
call fcn.10005112
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.100052c3
add esp, 0x6c
ret
Function at 0x10004500
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x100131a8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100180d8]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100180d8]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4c]
push 0
push 0x20
push 3
push 0
push 0
push 0x80000000
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004619
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [esp + 0x18], eax
call fcn.10004f94
mov edi, eax
mov eax, dword [esp + 0x18]
inc eax
push eax
call fcn.10004f94
mov ecx, dword [esp + 0x1c]
inc ecx
push ecx
push 0
push edi
mov ebp, eax
call fcn.10005770
mov eax, dword [esp + 0x28]
add esp, 0x14
push 0
lea edx, [esp + 0x18]
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
call fcn.10001f50
mov ecx, dword [esp + 0x14]
push ecx
push ebp
xor esi, esi
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x50], esi
call fcn.10002bb0
cmp dword [esp + 0x30], 0x64
jbe 0x10004608
push 0xffffffffffffffff
push esi
lea edx, [esp + 0x24]
push edx
lea ecx, [ebx + 4]
call fcn.10001540
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x40]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], esi
push eax
mov byte [ecx + 4], 0
call fcn.10001540
mov ecx, ebx
call fcn.10004240
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44], 0xffffffff
call fcn.10001410
xor al, al
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100052c3
add esp, 0x34
ret 4
Function at 0x10004d30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x18], ebx
lea esi, [ebx + 1]
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x10004d6e
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [esp + 0xc], ebx
je 0x10004d79
mov esi, 0x101
lea ecx, [esp + 0x10]
push ecx
push esi
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jle 0x10004da0
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x10004e26
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x10004e26
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebx
push str.InstallDate
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jle 0x10004de2
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x10004e1b
cmp dword [esp + 0xc], ebx
je 0x10004e1b
lea edx, [esp + 0x18]
push edx
call fcn.10006ce9
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
add esp, 4
cmp ecx, eax
jbe 0x10004e1b
sub ecx, eax
mov eax, 0x91a2b3c5
mul ecx
shr edx, 0xb
mov eax, 0xaaaaaaab
mul edx
mov ebx, edx
shr ebx, 4
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x14
ret

Function at 0x10004e30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push 1
xor esi, esi
push esi
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters
push 0x80000002
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jle 0x10004e62
and eax, 0xffff
or eax, 0x80070000
cmp eax, esi
jl 0x10004eb1
mov eax, dword [esp + 4]
cmp eax, esi
je 0x10004eb1
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push esi
push esi
push str.BootId
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
jle 0x10004ea0
and eax, 0xffff
or eax, 0x80070000
cmp eax, esi
jl 0x10004ea6
mov esi, dword [esp + 8]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x100052c3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100180d8]
jne 0x100052cd
repz ret
jmp fcn.1000724a
Function at 0x1001064e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000807b
and dword [ebp - 4], 0
cmp dword [0x1001a328], 0
mov ebx, eax
jne 0x100106ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100107b0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100107b0
push eax
call fcn.10008009
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1001a328], eax
call esi
push eax
call fcn.10008009
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1001a32c], eax
call esi
push eax
call fcn.10008009
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1001a330], eax
call esi
push eax
call fcn.10008009
pop ecx
mov dword [0x1001a338], eax
test eax, eax
je 0x100106ff
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10008009
pop ecx
mov dword [0x1001a334], eax
mov eax, dword [0x1001a334]
cmp eax, ebx
je 0x10010757
cmp dword [0x1001a338], ebx
je 0x10010757
push eax
call fcn.10008084
push dword [0x1001a338]
mov esi, eax
call fcn.10008084
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10010757
test edi, edi
je 0x10010757
call esi
test eax, eax
je 0x1001074e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001074e
test byte [ebp - 0xc], 1
jne 0x10010757
or dword [ebp + 0x10], 0x200000
jmp 0x10010790
mov eax, dword [0x1001a32c]
cmp eax, ebx
je 0x10010790
push eax
call fcn.10008084
pop ecx
test eax, eax
je 0x10010790
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10010790
mov eax, dword [0x1001a330]
cmp eax, ebx
je 0x10010790
push eax
call fcn.10008084
pop ecx
test eax, eax
je 0x10010790
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1001a328]
call fcn.10008084
pop ecx
test eax, eax
je 0x100107b0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100107b2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2e00bb4f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x2e00bb5e
pop dword [ebp - 0x14]
mov eax, 0xbc09f455
sub eax, 0x8e0938f7
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x637dd6c5
add dword [ebp - 0x24], 0xead46e86
mov dword [ebp - 0x20], 0xd99d2c3d
add dword [ebp - 0x20], 0x58962008
mov dword [ebp - 0x1c], 0x9a871aac
add dword [ebp - 0x1c], 0xb1c52982
mov dword [ebp - 0x18], 0xfcd7a99b
add dword [ebp - 0x18], 0x3285665
lea eax, [ebp - 0x24]
push eax
mov eax, 0x84eaddb0
sub eax, 0x56e7ace8
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xaf134ded
sub dword [ebp - 0x24], 0x3aa0e497
mov dword [ebp - 0x20], 0xc22fe7b1
sub dword [ebp - 0x20], 0x80c3863c
mov dword [ebp - 0x1c], 0x14eac8a1
sub dword [ebp - 0x1c], 0xb17b5c35
mov dword [ebp - 0x18], 0xc96538cd
add dword [ebp - 0x18], 0x369ac733
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xf5890755
sub eax, 0xc785d699
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3bc64
push 0
call eax
mov ecx, 0x3a1b550c
sub ecx, 0x3a1b2252
mov edx, eax
mov edi, 0xc2545977
sub edi, 0x944edb77
add edi, dword [ebp - 0x14]
mov esi, 0x976d705f
add esi, 0x1eec3bc9
mov dword [ebp - 0xc], 0x680ba33a
mov ebx, dword [edi]
xor dword [ebp - 4], 0x903d8696
xor ebx, esi
xor dword [ebp - 0x10], edx
mov dword [edx], ebx
sub dword [ebp - 0x10], ebx
add edx, 4
add edi, 4
loop 0x2e00bc80
add eax, 0xb69ff38
sub eax, 0xb69417d
xor ebx, ebx
add ebx, eax
add eax, 0xf005baaa
add eax, 0xffa455b
mov ecx, 0xa96d9243
add ecx, 0x84926dbd
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x2e01416e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e0306d8
call fcn.2e001511
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014eb5
test ax, ax
je 0x2e014216
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014216
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01420d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e00bb4f
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014200
push esi
mov ecx, edi
call fcn.2e010e6c
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e00bb4f
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e00155b
ret
Function at 0x2e014ca3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030759
call fcn.2e02e6de
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014da7
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e014b8d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010d8f
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014d65
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014d5c
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e00bb4f
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014d4e
push esi
mov ecx, edi
call fcn.2e010e6c
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e00bb4f
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014da7
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014d9e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e00bb4f
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e00bb4f
pop ecx
pop ecx
mov al, bl
call fcn.2e02e6bc
ret 8

Function at 0x2e014de1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e03078d
call fcn.2e001511
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014e1b
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014e81
lea eax, [ebp - 0x14]
mov edi, 0x2e033941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014e78
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014e78
inc eax
push eax
call fcn.2e00bb4f
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014e6a
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010e6c
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e00bb4f
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e00155b
ret 8
Function at 0x2e01e565
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030a97
call fcn.2e02e6de
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e683
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e67a
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e00bb4f
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e66d
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010e6c
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e00bb4f
test al, al
jne 0x2e01e620
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e00bb4f
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e623
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e65d
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e654
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e00bb4f
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e00bb4f
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e00bb4f
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e6bc
ret
Function at 0x406302
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x426d74], 0
push esi
jne 0x406339
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406313
mov dword [ecx*4 + 0x426d70], eax
inc ecx
cmp ecx, 0x100
jl 0x40630e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40636a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x426d70]
xor eax, esi
inc ecx
dec edx
jne 0x40634c
pop edi
not eax
pop esi
ret 0xc

Function at 0x430002
Capabilities:
Check for software breakpoints
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4433239d
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x44335a95
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x43227f87
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x11d95dd7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x432522
Capabilities:
Encode data using xor

Disassembly:
fadd dword [esi + 0x66]
in al, dx
test al, 0x6e
cmc
int1
shr dword [ebx], 0xc2
fild word [edx + ebp - 0x75]
shl esi, 0xef
jnp 0x432513
pop ebx
xlatb
pushfd
aas
lodsb al, byte [esi]
jb 0x43255c
dec eax
sbb eax, 0x278a9e5b
daa
or al, 0x2d
pop edx
pop eax
adc dword [eax], 0xffffffcf
jecxz 0x43253a
mov al, byte [0x82c91e33]
out 0x44, al
xor eax, 0xd3c7f39d
xor ebx, esi
xchg edi, eax
sbb ebp, dword [edx]
in al, dx
xor al, 0x53
in al, 0xd7
and ah, byte [0x3219a421]
push edi
jne 0x432505
mov fs, word [edx - 0x6e]
mov ebx, 0xa4d9cf72
cmc
rcl byte [0xd8b70017], cl
add byte [edi + 0x5a3bb2d8], dh
inc esi
add eax, 0x25021672
jbe 0x4324ed
dec edi
jb 0x43255e
fdiv dword [ebx]
xor al, 0x2c
add eax, 0xb3bc8469
add esp, dword [edi + 0x2400bd9b]
fsub st(3)
mov al, byte [0x24e705f]
cmpsd dword [esi], dword es:[edi]
adc esp, dword [esi]
pop edx
dec ebx
mov esp, 0x9ba703b3
mov ebp, 0xd82e2400
jecxz 0x4324e6
pop edi
jo 0x432597
add ah, byte [edi + 0x4b5a2613]
push edi
sub dword [ebx - 0x39d73027], 0xfffffff0
invalid
add edx, dword [esi + 0x5fc73370]
and cl, byte [edi + 0x60]
nop
clc
pop ecx
xchg ebx, eax
inc esp
stosb byte es:[edi], al
invalid
inc edi
jo 0x432593
invalid

Function at 0x5afca7
Capabilities:
Encode data using xor

Disassembly:
imul edi, dword [ebx + 0x73], 0x19d20982
mov byte [0x8239320d], al
xor dl, dl
mov cl, 0x2d
mov ebx, 0xe92689a6
mov ebx, 0xe92689a6
fstp qword [ecx - 6]
inc ebp
nop
xor byte [edx + 0x212010b4], dl
cmc
jno 0x5afc5f
jle 0x5afc7d
ja 0x5afc5f
fidiv word [eax]
add ah, ah
std
inc esi
and ah, byte [ebp - 0x22]
pop ds
ficomp word gs:[edi]
jge 0x5afc99
adc ecx, dword [edi]
out dx, al
mov al, 0x3c
outsb dx, byte ds:[esi]
cmpsb byte [esi], byte es:[edi]
push edx
nop
mov eax, dword [0xa2f572c2]
or dword [edx - 0x291711e7], edx
mov esp, 0x2de4dde
dec ebp
fiadd word [edx]
movsd dword es:[edi], dword cs:[esi]
test ebp, 0x95dfbd16
out dx, al
call 0xedd672a3
jne 0x5afd24
in eax, dx
jne 0x5afd24
in eax, dx
push cs
adc ebx, dword [edi]
cmp dh, byte [eax - 0x212db50b]
ret 0xe942
je 0x5afd0d
jno 0x5afc4d
dec ecx
push edx
inc edi
imul edx, dword [esi - 0x164ce94e], 0xf99c36c9
mov esi, 0xde49cedd
pop ecx
and bh, byte [edx - 0x29]
push 0xb5379742
pop ebp
jbe 0x5afd17
mov ch, 0x44
retf 0x3917
push ecx
mov bh, 0x82
out 0x42, al
pop ds
and al, 0x6a
shl dword [0x811f4586], 1
and eax, 0x811f4586
add esp, ebp
scasb al, byte es:[edi]
and al, bh
pop edi
xor bl, byte [ecx]
and bh, byte [ecx + 1]
cld
outsb dx, byte [esi]
inc esp
sbb ch, 0x67
mov cl, 0x27
test eax, 0x84aef792
mov dl, 0xdd
cmp eax, 0x843ca3b9
test byte [edx - 0x5c46c223], dh
cmp al, 0x84
jns 0x5afcdf
jns 0x5afcc5
jns 0x5afd33
cmpsd dword [esi], dword es:[edi]
add ecx, dword [ecx + 0x1419e847]
out dx, eax
popfd
outsb dx, byte [esi]
loop 0x5afd9c
push ss
clts
outsb dx, byte [esi]
test edx, 0x47598378
jbe 0x5afd50
pop ds
sbb ecx, dword [edi]
call 0x82c4f1c7
out 0xea, al
dec eax
ret 0xf9db
mov byte [0x3389ca41], al
retf