joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411210
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d0c
call fcn.0042a280
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x5ec]
push ebx
push str..PhysicalDrive_d
push eax
mov edi, ebx
call fcn.0040a0c1
add esp, 0xc
lea eax, [ebp - 0x5ec]
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x411443
push 0xc
lea eax, [ebp - 0x2d08]
mov dword [ebp - 0x2d0c], ebx
push ebx
push eax
call fcn.00443480
push 0x2710
lea eax, [ebp - 0x2cfc]
mov dword [ebp - 0x2d08], ebx
push ebx
push eax
mov dword [ebp - 0x2d04], ebx
call fcn.00443480
add esp, 0x18
lea eax, [ebp - 0x2d0c]
push ebx
push eax
push 0x2710
lea eax, [ebp - 0x2cfc]
push eax
push 0xc
lea eax, [ebp - 0x2d08]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41138c
push 0x3e8
lea eax, [ebp - 0x3ec]
push edi
push eax
call fcn.00443480
mov edx, dword [ebp - 0x2cf0]
lea ecx, [ebp - 0x2cfc]
push 0x4fa050
push edi
call fcn.004110a6
mov edx, dword [ebp - 0x2cec]
lea ecx, [ebp - 0x2cfc]
push 0x4fa450
push edi
call fcn.004110a6
mov edx, dword [ebp - 0x2ce4]
lea eax, [ebp - 0x3ec]
push eax
push 1
lea ecx, [ebp - 0x2cfc]
call fcn.004110a6
push 0x4fa450
push 0x4fa850
call fcn.004507e0
add esp, 0x2c
cmp byte [0x4f9a40], 0
jne 0x41137e
movzx eax, byte [ebp - 0x3ec]
push eax
call fcn.004517f2
pop ecx
test eax, eax
jne 0x411369
movzx eax, byte [ebp - 0x3d9]
push eax
call fcn.004517f2
pop ecx
test eax, eax
je 0x41137e
lea eax, [ebp - 0x3ec]
push eax
push 0x4f9a40
call fcn.004507e0
pop ecx
pop ecx
jmp 0x41138e
cmp byte [0x4fa850], 0
je 0x41138e
xor edi, edi
inc edi
jmp 0x41138e
call ebx
push 0x2710
lea eax, [ebp - 0x2cfc]
push 0
push eax
call fcn.00443480
add esp, 0xc
lea eax, [ebp - 0x2d0c]
xor ecx, ecx
push ecx
push eax
push 0x2710
lea eax, [ebp - 0x2cfc]
push eax
push ecx
push ecx
push 0x2d0c10
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41143a
push 0x3e8
lea eax, [ebp - 0x3ec]
push 0
push eax
call fcn.00443480
lea eax, [ebp - 0x2cec]
push eax
lea eax, [ebp - 0x3ec]
push eax
call fcn.004507e0
add esp, 0x14
cmp byte [0x4f9a40], 0
jne 0x41143c
movsx eax, byte [ebp - 0x3ec]
push eax
call fcn.004517f2
pop ecx
test eax, eax
jne 0x411422
movsx eax, byte [ebp - 0x3d9]
push eax
call fcn.004517f2
pop ecx
test eax, eax
je 0x41143c
lea eax, [ebp - 0x3ec]
push eax
push 0x4f9a40
call fcn.004507e0
pop ecx
xor edi, edi
pop ecx
inc edi
jmp 0x41143c
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428f89
mov esp, ebp
pop ebp
ret
Function at 0x411e60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0042a280
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.00411cb9
push 0x800
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.00443480
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x1008], ebx
push ebx
push eax
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
call fcn.00443480
add esp, 0x18
lea eax, [ebp - 0x804]
mov ecx, 0x400
push ecx
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1008]
push eax
push ecx
lea eax, [ebp - 0x1004]
push eax
push 0x4bb5a4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1008]
mov edx, esi
push edi
call fcn.00411db3
pop ecx
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428f89
mov esp, ebp
pop ebp
ret

Function at 0x411f15
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0042a280
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00411cb9
mov edi, 0x800
mov esi, eax
push edi
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.00443480
xor eax, eax
push edi
push eax
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x101c], eax
mov dword [ebp - 0x1018], eax
lea eax, [ebp - 0x810]
push eax
call fcn.00443480
add esp, 0x18
lea eax, [ebp - 0x810]
mov ecx, 0x400
push ecx
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x1014]
push eax
push ecx
lea eax, [ebp - 0x1010]
push eax
push 0x4bb5a4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1014]
lea edi, [ebp - 0xf]
xor eax, eax
mov byte [ebp - 0x10], 0
stosd dword es:[edi], eax
mov edx, esi
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
push eax
call fcn.00411db3
push ebx
lea ecx, [ebp - 0x10]
call fcn.004102e1
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428f89
mov esp, ebp
pop ebp
ret
Function at 0x413f5f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
mov ebx, ecx
push edi
push eax
call fcn.00443480
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x218]
push eax
push edi
push 0x44b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x244], eax
xor eax, eax
push 7
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], edi
lea edi, [ebp - 0x234]
pop ecx
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x238], 5
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebx + 0x3c]
call dword [sym.imp.USER32.dll_HideCaret]
mov eax, dword [ebx + 0xb0]
cmp eax, dword [ebx + 0xb4]
je 0x41403d
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428f89
mov esp, ebp
pop ebp
ret 4

Function at 0x417cf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49be27
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4cf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 1
mov dword [ebp - 0x14], esi
call fcn.00466890
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 2
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 9
call fcn.00469420
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xa
call fcn.00469420
mov byte [esi + 0x5c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41baa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c43e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4cf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x10]
mov dword [edi + 0xc], 0
call fcn.00469420
mov dword [ebp - 4], 0
mov eax, dword [edi + 8]
mov dword [edi], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.0
mov dword [edi + 4], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 8], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.2.0
mov eax, dword [edi + 8]
mov eax, dword [eax + 4]
mov dword [eax + edi + 4], 0
mov dword [edi + 0x24], vtable.CryptoPP::ModExpPrecomputation.0
mov dword [edi + 0x28], 0
lea esi, [edi + 0x2c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer_.0
call fcn.00469420
mov byte [ebp - 4], 2
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], 0
call fcn.00469420
mov dword [esi + 0x30], 0
mov eax, edi
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x421462
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 0xc], edx
cmp dword [edi + 0x6c], eax
jb 0x421501
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004416d0
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x4214b6
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x4214dd
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x4215bc
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x42152e
xor eax, eax
jmp 0x42157f
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x42154b
mov edx, dword [esi]
push ecx
mov ecx, dword [esi + 0x30]
call fcn.00421e09
jmp 0x421563
cmp eax, 2
jne 0x421567
mov edx, dword [esi]
test edx, edx
jne 0x42155a
xor eax, eax
jmp 0x421564
push ecx
mov ecx, dword [esi + 0x30]
call fcn.0041f014
pop ecx
mov dword [esi + 0x30], eax
push dword [ebp - 8]
push dword [esi]
push dword [ebp - 0xc]
call fcn.004416d0
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x4215a7
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x4215bc
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x421473
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42528c
Capabilities:
Write file on windows

Disassembly:
push 0x38
mov eax, 0x49ca72
call fcn.00429ad7
mov ebx, ecx
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x4252a8
cmp word [eax], si
jne 0x4252b3
lea eax, [ebx + 0x1c]
cmp dword [eax + 0x14], 8
jb 0x4252b3
mov eax, dword [eax]
push 0x4bae8c
push eax
call fcn.0044fc56
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4252db
push 0x4caeb4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 3
push eax
call fcn.0044395c
mov esi, dword [ebx + 0x4c]
xor eax, eax
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x40], al
mov dword [ebp - 4], eax
cmp esi, dword [ebx + 0x50]
je 0x425318
mov ecx, dword [esi]
cmp dword [ebx + 0x44], eax
jne 0x425304
push edi
call fcn.004246e4
jmp 0x42530d
lea eax, [ebp - 0x40]
push eax
call fcn.0042472a
add esi, 4
push 0
pop eax
cmp esi, dword [ebx + 0x50]
jne 0x4252f5
cmp dword [ebx + 0x44], eax
je 0x425374
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.0040b300
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.00425575
test eax, eax
je 0x425365
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push eax
call fcn.0044f8b0
add esp, 0x10
xor esi, esi
lea ecx, [ebp - 0x28]
push esi
push 1
call fcn.00408b84
jmp 0x425376
xor esi, esi
push edi
call fcn.0044f50d
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.00408bf0
call fcn.00429a81
ret 4
Function at 0x425dd2
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], esi
test edi, edi
je 0x425e44
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x425df8
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
cmp eax, 0x3fffffff
jg 0x425e44
add eax, eax
call fcn.00429a40
mov esi, esp
test esi, esi
je 0x425e41
mov ecx, dword [ebp - 0x1c]
push ebx
push ebx
mov byte [esi], bl
lea eax, [ecx + ecx]
push eax
push esi
push 0xffffffffffffffff
push edi
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, esi
mov esi, dword [ebp - 0x18]
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push 0x7b
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_htons]
push ebx
mov word [ebp - 0x12], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x425e84
push ebx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x425ead
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
inc eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428f89
mov esp, ebp
pop ebp
ret 8
xor eax, eax
jmp 0x425e97

Function at 0x425eb1
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push esi
push edi
mov edi, 0x3e8
mov esi, dword [ebp + 8]
div edi
xor edi, edi
mov dword [ebp - 0x110], eax
inc edi
mov eax, dword [ecx]
xor ecx, ecx
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x110]
push eax
push ecx
push ecx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], edx
push eax
push ecx
mov dword [ebp - 0x108], edi
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
jne 0x425f14
xor eax, eax
jmp 0x425f1f
xor ecx, ecx
test eax, eax
mov eax, edi
setne cl
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428f89
mov esp, ebp
pop ebp
ret 8
Function at 0x4261c4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x49cb24
call fcn.00429b0e
mov ebx, edx
push 0x801
call fcn.00429473
xor edi, edi
mov esi, eax
mov dword [ebp - 4], edi
mov dword [esp], 0x801
push edi
push esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0x800
call fcn.00443480
add esp, 0xc
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push edi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x14], edi
je 0x426256
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x18], 1
jne 0x42624d
push esi
call fcn.004066d4
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push esi
call fcn.0040665b
inc edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x426261
push esi
call fcn.00429243
pop ecx
mov eax, edi
call fcn.00429a6c
ret

Function at 0x42acb5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x45015f
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044fffa

Function at 0x45c71e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045c59d

Function at 0x460151
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045fabf

Function at 0x46015c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045fcfa

Function at 0x468110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49dd68
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4cf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x24]
mov esi, eax
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push esi
call dword [eax + 0x28]
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0x30]
call eax
mov edx, dword [esi]
mov ecx, esi
push 1
mov bl, al
call dword [edx]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x483c90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x20]
mov ecx, esi
shr ecx, 2
push edi
test ecx, ecx
je 0x483d55
mov edi, dword [esp + 0x20]
cmp ecx, 8
jb 0x483d30
mov ebx, ecx
lea eax, [edi + 0x10]
mov esi, ebp
and ebx, 0xfffffff8
sub esi, edi
xorps xmm3, xmm3
mov dword [esp + 0x10], esi
movaps xmm2, xmm3
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebp + edx*4]
add edx, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edi + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edx, ebx
jb 0x483ce0
mov edi, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edx, ecx
jae 0x483d55
mov esi, ebp
lea edi, [edi + edx*4]
sub esi, dword [esp + 0x20]
sub ecx, edx
add edx, ecx
mov eax, dword [edi + esi]
lea edi, [edi + 4]
xor eax, dword [edi - 4]
or ebx, eax
sub ecx, 1
jne 0x483d41
mov esi, dword [esp + 0x24]
shl edx, 2
sub esi, edx
jne 0x483d6b
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x20]
add ebp, edx
add ecx, edx
mov eax, ebx
shr eax, 0x10
mov edx, ebx
shr edx, 0x18
xor edi, edi
or dl, al
mov dword [esp + 0x20], ecx
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
mov dword [esp + 0x10], edx
test esi, esi
je 0x483e45
cmp esi, 0x20
jb 0x483e29
mov ebx, esi
mov edx, ebp
and ebx, 0xffffffe0
xorps xmm3, xmm3
sub edx, ecx
mov eax, ecx
mov dword [esp + 0x14], edx
movaps xmm2, xmm3
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ecx - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [edi + ebp + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ebx
jb 0x483dc0
por xmm2, xmm3
mov ecx, dword [esp + 0x20]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
cmp edi, esi
jae 0x483e45
sub ebp, dword [esp + 0x20]
add ecx, edi
sub esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
sub esi, 1
jne 0x483e35
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x483e60
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, edx
shr edi, 2
test edi, edi
je 0x483f07
cmp edi, 8
jb 0x483ee0
lea eax, [esi - 4]
lea eax, [eax + edi*4]
lea ecx, [ebp - 4]
lea ecx, [ecx + edi*4]
cmp ebp, eax
ja 0x483e99
cmp ecx, esi
jae 0x483ee0
mov ecx, edi
lea eax, [ebp + 0x10]
mov edx, esi
and ecx, 0xfffffff8
sub edx, ebp
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + ebx*4]
add ebx, 8
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, ecx
jb 0x483eb1
mov ebp, dword [esp + 0x18]
cmp ebx, edi
jae 0x483f07
lea ecx, [ebx*4]
mov edx, esi
sub edi, ebx
add ecx, ebp
sub edx, ebp
add ebx, edi
mov eax, dword [ecx + edx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edi, 1
jne 0x483ef5
mov edx, dword [esp + 0x20]
shl ebx, 2
sub edx, ebx
je 0x483f84
add ebp, ebx
add esi, ebx
xor edi, edi
test edx, edx
je 0x483f84
cmp edx, 0x20
jb 0x483f6b
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, edx
add ecx, edx
cmp ebp, eax
ja 0x483f2f
cmp ecx, esi
jae 0x483f6b
mov ecx, edx
mov ebx, esi
and ecx, 0xffffffe0
mov eax, ebp
sub ebx, ebp
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [esi + edi + 0x10]
add edi, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x483f40
cmp edi, edx
jae 0x483f84
sub esi, ebp
lea ecx, [edi + ebp]
sub edx, edi
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x483f76
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret