joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402025
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
shr edi, 2
xor ebx, ebx
mov eax, edi
mov dword [ebp - 4], 1
shr eax, 1
mov ecx, ebx
add eax, 3
mov dword [esi], eax
add esi, 0x10
test edi, edi
je 0x40205c
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x40204f
mov edx, dword [esi + edi*4 - 4]
imul eax, edi, 0xc
add eax, 0x70
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jne 0x4020ca
movzx eax, dl
mov ebx, dword [ebp - 4]
push 0x1b
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
shr edx, 8
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + str.cw]
xor edx, ebx
add ebx, ebx
or edx, ecx
test ebx, 0x100
pop eax
cmovne ebx, eax
mov dword [ebp - 4], ebx
mov ebx, edi
jmp 0x402117
cmp ebx, 4
jne 0x40211a
cmp edi, 6
jbe 0x40211a
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + str.cw]
or edx, ecx
mov eax, dword [ebp + 8]
xor edx, dword [esi]
dec ebx
mov dword [esi + edi*4], edx
add esi, 4
cmp esi, eax
jne 0x40206b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x402df3
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x44f094]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x402e3c
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402e3c
push 0xc00
call eax
test eax, eax
jne 0x402ed7
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402ed7
cmp eax, 0x104
ja 0x402ed7
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x402e73
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.userenv], 0
push esi
mov esi, str.userenv
je 0x402ed6
push ebx
push edi
lea edi, [ebp - 0x2d4]
push 0x6c
lea edi, [edi + eax*2]
pop ebx
mov ecx, edi
jmp 0x402e9d
movzx eax, al
mov word [ecx], ax
add ecx, 2
mov al, byte [esi]
inc esi
test al, al
jne 0x402e94
push 0x2e
pop eax
push 0x64
mov word [ecx], ax
pop eax
mov word [ecx + 2], ax
xor eax, eax
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov word [ecx + 4], bx
mov word [ecx + 6], bx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x402e90
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043237e
mov esp, ebp
pop ebp
ret
Function at 0x407a12
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.004387ce
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x407a3e
call fcn.00407924
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x409bb2
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x440861
call fcn.0043262f
cmp byte [0x455910], 0
mov edi, dword [ebp + 8]
jne 0x409bf2
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00408b11
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.004325e5
pop ecx
test esi, esi
je 0x409c00
mov al, 1
jmp 0x409c46
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x409bec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x409c11
xor al, al
jmp 0x409c46
lea ecx, [ebp - 0x50]
call fcn.0040a46e
lea ecx, [ebp - 0x28]
call fcn.00407e9d
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0040a68a
test al, al
je 0x409c3b
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.004325e5
pop ecx
mov al, bl
call fcn.004325f8
ret 4

Function at 0x409c4e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x455910], 0
jne 0x409c88
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b11
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004325e5
pop ecx
test esi, esi
pop esi
je 0x409c97
mov al, 1
jmp 0x409c99
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x409c82
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x409e29
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040aca9
cmp eax, 0xffffffff
je 0x409e56
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x409e56
and eax, 0xfffffffe
push eax
push esi
call fcn.0040a3ca
test al, al
je 0x409e8e
cmp byte [0x455910], 0
push esi
jne 0x409e84
lea eax, [ebp - 0xc]
push eax
call fcn.00408b11
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004325e5
pop ecx
test esi, esi
je 0x409e8e
mov al, 1
jmp 0x409e90
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jmp 0x409e7e
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40a10b
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x455910], 0
jne 0x40a143
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b11
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004325e5
pop ecx
test esi, esi
pop esi
je 0x40a150
mov al, 1
jmp 0x40a152
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jmp 0x40a13d
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x40a31e
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x455910], 0
jne 0x40a355
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b11
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004325e5
test esi, esi
pop ecx
setne al
pop esi
jmp 0x40a364
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40a3ca
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x455910], 0
jne 0x40a405
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b11
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004325e5
pop ecx
test esi, esi
pop esi
je 0x40a415
mov al, 1
jmp 0x40a417
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jmp 0x40a3ff
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x40aca9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x455910], 0
jne 0x40acdd
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b11
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004325e5
pop ecx
mov eax, esi
pop esi
jmp 0x40acf0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aebb
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40aee5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40aee5
xor al, al
jmp 0x40aef9
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4185a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4411f0
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x44f094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0xa8]
call fcn.00418657
lea ecx, [esi + 0x78]
call fcn.00418657
push dword [esi + 0x30]
call fcn.004325e5
push dword [esi + 0x24]
call fcn.004325e5
push dword [esi + 0x18]
call fcn.004325e5
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41860c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x418620
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x418634
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x418647
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b541
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x44096b
call fcn.0043262f
mov esi, ecx
push 0
push dword [ebp + 0xc]
lea ecx, [esi + 0x68]
push dword [ebp + 8]
call fcn.0041b0b0
push 0xce4
lea eax, [ebp - 0x18]
push eax
call fcn.0041a13d
push dword [eax]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.0040bf18
push dword [ebp - 0x18]
call fcn.004325e5
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.004325f8
ret 8
Function at 0x4313b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x44f094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push 0x208
push esi
push eax
call fcn.00433f00
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43144c
push edi
push esi
call fcn.00431703
push dword [edi]
and dword [ebp - 0x210], 0
call fcn.004325dc
pop ecx
push 0
lea ecx, [ebp - 0x210]
mov dword [ebx], eax
push ecx
push dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043237e
mov esp, ebp
pop ebp
ret 8

Function at 0x431703
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43172e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43172e
xor al, al
jmp 0x431742
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4062b6
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esi], edi
je 0x4062c4
inc ecx
add esi, 4
cmp ecx, edx
jb fcn.004062b6
jmp 0x4062e1
int1
cmp ecx, edx
jae 0x4062de
lea eax, [eax - 0x78]
adc byte [ebx + 0x34410472], cl
xor cl, byte [ebx - 0x3d7cf386]
add al, 0x4e
mov esi, dword [edx + 4]
inc ecx
xor al, 0x32
mov edi, dword [edx + 0xc]
add edx, 4
dec esi
cmp ecx, esi
jb 0x4062cd
dec dword [eax + 0xc]
mov edx, dword [eax + 0x1010]
xor ecx, ecx
test edx, edx
jbe 0x406327
lea esi, [eax + 0x8a14]
cmp dword [esi], edi
je 0x406301
inc ecx
cmp dword [edx + 0x72ca3bec], 0xfffffff4
jmp 0x406327
mov esi, 0xe773ca3b
lea edx, [eax + ecx*4 + 0x801014]
mov ebx, ebp
add al, 0x41
cmp dword [ebx], eax
mov esi, dword [eax + 0x21001010]
xor eax, 4
dec esi
cmp ecx, esi
jb 0x40630d
dec dword [eax + 0xd710]
mov edx, dword [eax + 0x6e14]
dec edx
leave
test ebx, ecx
fnstcw word [edx]
lea edx, [ebx + 0x18]
and byte [eax], al
std
cmp dword [esi], edi
je 0x406347
mov ah, 0x83
mov byte [ebx + edi], 4
jb 0x406339
jmp 0x40636d
dec edx
retf 0x1b73
add byte [eax], al
push ecx
mov byte [ebx + 0x17001230], dh
stc
jne 0x406382
test dword [ebx + 0x7e], eax
pop es
jnp 0x406306
mov byte [eax], bl
xor byte [eax], al
add bl, ah
out 0x1d, eax
rcr byte [ebx - 0x75], 0xe5
jecxz 0x40636b
sbb eax, 0xe58b5bc0
push edx
adc byte [eax], cl
add bl, byte [edi + 0x5e]
add ecx, dword [ecx]
pop esp
add byte [eax], al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x406a9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
xor esi, esi
mov cx, word [eax + 0xe]
lea ecx, [ecx + ecx*4]
lea ecx, [esi + edi*4]
lea edx, [ecx + ecx*4]
mov ecx, dword [ebp + 8]
shl edx, 3
mov esi, esp
xor edx, edx
fimul word [ebx - 0x2876f3b0]
add al, 0x33
shl byte [esi - 0x75], cl
push ds
or cl, byte [ecx - 0x2dccf7af]
in eax, dx
mov edx, dword [eax + 8]
mov dword [ecx + 0xc], edx
xor edx, edx
mov dx, word [eax + 6]
mov dword [ecx + 0x10], edx
xor edx, edx
xlatb
mov edx, dword [eax + 2]
dec edx
mov dword [ecx - 0x17], edx
xor edx, edx
mov dx, word [eax]
sub edx, 0x95076c
mov dword [ecx + 0x18], edx
sbb byte [ebx], dh
shl byte [esi - 0x75], cl
push eax
add al, 0x89
pop esp
sbb al, 0x8b
push ecx
adc al, 0x66
mov edi, dword [esi + 0x36]
mov edx, dword [edx*4 - 0x64bf3dc0]
lea ebx, [edi + 0x32]
push dword [ebx]
test byte [ecx - 0x2dccdffa], 0x89
push ecx
and al, 0xe1
push ecx
sub byte [esi - 0x75], ah
xor byte [ebx + 0x3c3c6], cl
add byte [eax - 0x7cb7fa67], al
enter 0x7bfc, 0x75
sub cl, byte [ebx - 0x6566a83a]
nop
add dword [eax], eax
add bh, dh
mov dword [ebp - 0x69], ebp
ror byte [edi], cl
sbb cl, byte [ebx + 0x64bec6]
add byte [eax], al
cdq
idiv esi
test edx, edx
je 0x406a7d
mov eax, dword [edi + 0x3a258300]
jle 0x406b01
inc eax
mov dword [ecx + 0x20], eax
pop esi
pop ebp
imul edx, dword [eax + 0x68909090], 0xffffff90
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 0x57ff00e0
push ebx
push esi
mov esp, dword [eax + edx]
push eax
mov ebp, dword [ebx - 0x743174f4]
invalid
Function at 0x4082b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ss
in al, dx
lcall 0x5717, 0x7e8d6753
pop ss
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword gs:[ebp - 5]
lea ecx, [ebp + 0x57]
xor edx, edx
xor al, 0x66
mov edx, dword [eax - 0x37]
push ecx
push 1
jno 0x4082ba
sbb al, cl
jmp [ebx + ecx*4 + 0x8458bd8]

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4099df
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00409b50

Function at 0x409b50
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x422b60]
push esi
push edi
test ecx, ecx
je 0x409c40
cmp ecx, 0xffffffff
je 0x409c40
mov esi, 0x1388
cmp dword [0x422b6c], esi
ja 0x409c40
cmp byte [0x41d001], 0
je 0x409bc7
mov eax, dword [ebp + 8]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x409b8f
push 0
lea edx, [ebp - 4]
push edx
sub eax, edi
push eax
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc dword [0x422b6c]
cmp dword [0x422b6c], esi
jne 0x409c46
push 0x4024c4
call fcn.00409b50
jmp 0x409c46
mov edi, dword [sym.imp.ole32.dll_CoTaskMemAlloc]
push 8
call edi
mov esi, eax
test esi, esi
jne 0x409bde
mov eax, 0x8007000e
jmp 0x409c48
mov eax, dword [ebp + 8]
and dword [esi + 4], 0
and dword [esi], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x409beb
sub eax, ecx
inc eax
push eax
call edi
mov dword [esi], eax
test eax, eax
jne 0x409c07
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x409bd7
mov ecx, dword [ebp + 8]
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x409c0d
sub ecx, edi
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00412cd6
mov eax, dword [0x422bb8]
add esp, 0xc
test eax, eax
je 0x409c32
mov dword [eax + 4], esi
jmp 0x409c38
mov dword [0x422bbc], esi
mov dword [0x422bb8], esi
jmp 0x409c46
inc dword [0x422b90]
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x412cb1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], 6
add byte [eax], al
mov dword [ebp - 0x24], 4
xor ebx, ebx
inc ebx
mov edi, 6
mov dword [ebp - 0x14], 0x4281fa
inc edx
add byte [ebx - 0x74ff1f9b], al
push ebp
in al, dx
movzx edx, byte [edx + 2]
shl edx, 9
add dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
invalid

Function at 0x412cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], 6
add byte [eax], al
mov dword [ebp - 0x24], 4
xor ebx, ebx
inc ebx
mov edi, 6
mov dword [ebp - 0x14], 0x4281fa
inc edx
add byte [ebx - 0x74ff1f9b], al
push ebp
in al, dx
movzx edx, byte [edx + 2]
shl edx, 9
add dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
invalid

Function at 0x412ce2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], 6
add byte [eax], al
mov dword [ebp - 0x24], 4
xor ebx, ebx
inc ebx
mov edi, 6
mov dword [ebp - 0x14], 0x4281fa
inc edx
add byte [ebx - 0x74ff1f9b], al
push ebp
in al, dx
movzx edx, byte [edx + 2]
shl edx, 9
add dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
invalid
Function at 0x413b2d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7f4
mov eax, dword [0x41d174]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x7f4], eax
push 2
mov esi, 0x7d0
xor ecx, ecx
pop edx
mov eax, esi
mul edx
seto cl
mov dword [ebp - 0x7f0], edi
mov dword [ebp - 0x7e0], esi
neg ecx
or eax, ecx
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [ebp - 0x7d8], eax
xor eax, eax
cmp dword [ebp - 0x7d8], eax
jne 0x413b92
mov eax, 0x8007000e
jmp 0x413d19
push ebx
lea ecx, [ebp - 0x7dc]
push ecx
lea ecx, [ebp - 0x7d4]
push ecx
lea ecx, [ebp - 0x7ec]
push ecx
push eax
lea ecx, [ebp - 0x7e0]
push ecx
push dword [ebp - 0x7d8]
mov dword [ebp - 0x7e8], eax
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RegEnumValueW]
mov dword [ebp - 0x7e0], esi
mov dword [ebp - 0x7dc], esi
call edi
mov ebx, 0x103
jmp 0x413c98
cmp dword [ebp - 0x7e0], esi
jb 0x413bfa
push 1
push 0x5ca
push 0x406808
push 0x406bcc
call fcn.004155fc
cmp dword [ebp - 0x7dc], esi
jb 0x413c18
push 1
push 0x5cb
push 0x406808
push 0x406bb0
call fcn.004155fc
cmp dword [ebp - 0x7e4], 0
jne 0x413caa
push dword [ebp - 0x7dc]
lea eax, [ebp - 0x7d4]
push eax
push dword [ebp - 0x7ec]
push 0
push dword [ebp - 0x7d8]
push dword [ebp - 0x7f4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x413cdc
inc dword [ebp - 0x7e8]
lea eax, [ebp - 0x7dc]
push eax
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x7ec]
push eax
push 0
lea eax, [ebp - 0x7e0]
push eax
push dword [ebp - 0x7d8]
mov dword [ebp - 0x7e0], esi
push dword [ebp - 0x7e8]
mov dword [ebp - 0x7dc], esi
push dword [ebp - 0x7f0]
call edi
mov dword [ebp - 0x7e4], eax
cmp eax, ebx
jne 0x413bdc
xor esi, esi
jmp 0x413d0a
cmp dword [ebp - 0x7e4], 0x522
je 0x413d05
cmp dword [ebp - 0x7e4], 5
je 0x413d05
push 1
push 0x5cc
push 0x406808
push 0x4067f4
call fcn.004155fc
mov esi, 0x8011002b
jmp 0x413d0a
cmp eax, 0x522
je 0x413d05
cmp eax, 5
je 0x413d05
push 1
push 0x5d0
push 0x406808
push 0x4067f4
call fcn.004155fc
mov esi, 0x80110025
jmp 0x413d0a
mov esi, 0x80110823
push dword [ebp - 0x7d8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00412cc0
leave
ret 8
Function at 0x414bf1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], 0x7d0
cmp dword [ebp + 8], edi
je 0x414c2a
cmp dword [ebp + 8], 1
je 0x414c2a
push 1
push 0x51f
push 0x406808
push 0x407178
call fcn.004155fc
test dword [ebx + 4], 3
je 0x414c5c
push 1
push 0x520
push 0x406808
push 0x406b00
call fcn.004155fc
test dword [ebx + 4], 3
je 0x414c5c
mov eax, 0x80110045
jmp 0x414da4
mov eax, dword [ebp - 8]
push 2
xor ecx, ecx
pop edx
mul edx
seto cl
neg ecx
or eax, ecx
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp ecx, edi
jne 0x414c87
mov eax, 0x8007000e
jmp 0x414da4
mov eax, dword [ebp + 8]
sub eax, edi
push esi
je 0x414ccb
dec eax
je 0x414cb4
push 1
push 0x533
push 0x406808
push 0x407140
call fcn.004155fc
mov dword [ebp - 4], 0x8000ffff
jmp 0x414d7c
push edi
push edi
push edi
push edi
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp + 0xc]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_RegEnumValueW]
jmp 0x414ce0
push edi
push edi
push edi
push edi
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp + 0xc]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_RegEnumKeyExW]
cmp dword [ebp - 8], 0x7d0
mov esi, eax
jb 0x414d01
push 1
push 0x538
push 0x406808
push 0x407114
call fcn.004155fc
cmp esi, edi
je 0x414d3a
cmp esi, 0x522
je 0x414d31
cmp esi, 5
je 0x414d31
push 1
push 0x53a
push 0x406808
push 0x4067f4
call fcn.004155fc
mov dword [ebp - 4], 0x8011002b
jmp 0x414d7c
mov dword [ebp - 4], 0x80110823
jmp 0x414d7c
mov eax, dword [ebp + 8]
sub eax, edi
je 0x414d69
dec eax
jne 0x414d7c
mov esi, 0x4026c8
cmp dword [ebp - 8], edi
jne 0x414d63
push esi
push 0x7d0
push dword [ebp - 0xc]
call fcn.00409cfe
cmp eax, edi
mov dword [ebp - 4], eax
jl 0x414d7c
push dword [ebp - 0xc]
push esi
jmp 0x414d71
push 0x4026c8
push dword [ebp - 0xc]
push edi
mov ecx, ebx
call fcn.004146d5
mov dword [ebp - 4], eax
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 4], edi
pop esi
jge 0x414da1
push 1
push 0x550
push 0x406808
push 0x406c54
call fcn.004155fc
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 8

Function at 0x41637a
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x41d174]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push ecx
push eax
push 0x407fd0
lea eax, [ebp - 0x228]
xor esi, esi
push 0x111
push eax
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], esi
call fcn.00413e9b
add esp, 0x14
test eax, eax
jge 0x4163c4
xor eax, eax
jmp 0x4163fb
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x230]
push eax
push esi
lea eax, [ebp - 0x22c]
push eax
push esi
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x4163f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4163c0
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00412cc0
leave
ret 4