joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4068db
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068ff
xor eax, eax
test eax, eax
je 0x406912
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406912
xor ecx, ecx
jmp 0x406915
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a38
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43110c], 0
push esi
jne 0x406a6f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a49
mov dword [ecx*4 + 0x431108], eax
inc ecx
cmp ecx, 0x100
jl 0x406a44
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406aa0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431108]
xor eax, esi
inc ecx
dec edx
jne 0x406a82
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2b3f1cd8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1bcc4c74
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x441fab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x441fba
pop dword [ebp - 0x10]
mov eax, 0xe05671e0
add eax, 0x1fedadda
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xe6226199
sub dword [ebp - 0x20], 0x97d01c4e
mov dword [ebp - 0x1c], 0x89b2c1c7
sub dword [ebp - 0x1c], 0x577f7582
mov dword [ebp - 0x18], 0xfd29669c
add dword [ebp - 0x18], 0x4f22dd92
mov dword [ebp - 0x14], 0x52bff685
sub dword [ebp - 0x14], 0x52bff685
lea eax, [ebp - 0x20]
push eax
mov eax, 0xbd8cf2ad
add eax, 0x42b8bdb7
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xcc956b8c
sub dword [ebp - 0x20], 0x58230236
mov dword [ebp - 0x1c], 0x614c2cf2
add dword [ebp - 0x1c], 0xe0203483
mov dword [ebp - 0x18], 0xc53cf30
sub dword [ebp - 0x18], 0xa8e462c4
mov dword [ebp - 0x14], 0xf32d912
sub dword [ebp - 0x14], 0xf32d912
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xc1142504
add eax, 0x3f318b7c
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x4e116
push 0
call eax
mov ecx, 0xcb24b691
sub ecx, 0xcb246bc5
mov edx, eax
mov edi, 0x476000
add edi, dword [ebp - 0x10]
mov esi, 0x925d31b1
sub dword [ebp - 8], 0x79ef33de
mov ebx, dword [edi]
mov dword [ebp - 4], 0x259da331
xor ebx, esi
xor dword [ebp - 4], 0x551e52e
mov dword [edx], ebx
add dword [ebp - 0xc], eax
add edx, 4
add edi, 4
loop 0x4420d0
add eax, 0x79e22398
sub eax, 0x79e10595
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7af1a037
add ecx, 0x854e5fc9
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10001c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10001c78
cmp byte [esi + ebx - 1], 0xa
je 0x10001c4c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10007084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x100022a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10002478
mov edi, dword [0x10007084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10002387
test byte [0x10003030], 8
jne 0x10002420
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10003040], 8
jne 0x100023e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10002329
cmp esi, 3
jbe 0x10002398
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1000233a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10005268]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10002329
mov dword [esp], 0x10003040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10002300
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10002300
mov dword [esp], 0x10003030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100022eb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x100022f3
mov eax, 0xffffffff
jmp 0x10002387
Function at 0x1005ead5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10069750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10050c78
mov dword [ebp - 0x14], eax
cmp dword [0x1060d4dc], esi
jne 0x1005ebc8
push 0x800
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1005eb55
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1005eca8
push esi
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1005eca8
push 0x10007528
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005eca8
push eax
call ebx
push 0x10007534
push edi
mov dword [0x1060d4dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007544
push edi
mov dword [0x1060d4e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007558
push edi
mov dword [0x1060d4e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060d4ec], eax
test eax, eax
je 0x1005ebc5
push 0x10007574
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060d4e8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1005ebed
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1005ebe0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1005ec02
push 4
pop eax
jmp 0x1005ecaa
cmp dword [ebp - 0x14], esi
je 0x1005ec02
push dword [0x1060d4dc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1005ebe7
mov eax, dword [0x1060d4e8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1005ec60
cmp dword [0x1060d4ec], edi
je 0x1005ec60
push eax
call ebx
push dword [0x1060d4ec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1005ec60
test eax, eax
je 0x1005ec60
call ecx
test eax, eax
je 0x1005ec55
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1005ec55
test byte [ebp - 8], 1
jne 0x1005ec60
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1005ec90
mov eax, dword [0x1060d4e0]
cmp eax, edi
je 0x1005ec8d
push eax
call ebx
test eax, eax
je 0x1005ec8d
call eax
mov esi, eax
test esi, esi
je 0x1005ec8d
mov eax, dword [0x1060d4e4]
cmp eax, edi
je 0x1005ec8d
push eax
call ebx
test eax, eax
je 0x1005ec8d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1060d4dc]
call ebx
test eax, eax
je 0x1005eca8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1005ecaa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004e18c
mov esp, ebp
pop ebp
ret
Function at 0x401e10
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor edx, edx
mov eax, 0x177f
test edi, edi
jle 0x401e4d
push esi
mov esi, dword [esp + 0xc]
lea ecx, [eax + eax*8]
lea ecx, [eax + ecx*4]
shl ecx, 4
add ecx, eax
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*8]
lea eax, [eax + ecx*2 + 0x75]
mov cl, byte [edx + esi]
and eax, 0xffff
xor cl, al
mov byte [edx + esi], cl
inc edx
cmp edx, edi
jl 0x401e25
pop esi
pop edi
ret
Function at 0x4020c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x31c
lea eax, [esp + 0x21c]
push ebx
push ebp
push esi
push edi
push 0x100
push eax
call fcn.00403df0
add esp, 8
lea ecx, [esp + 0x18]
lea edx, [esp + 0x22c]
push ecx
push 1
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4022cb
push eax
mov dword [esp + 0x14], eax
push eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x34]
push ecx
push edx
push 0
push eax
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x4022c0
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x24]
lea ebx, [esp + 0x128]
test ecx, ecx
lea ebp, [esp + 0x24]
je 0x40222b
lea edx, [esp + 0x128]
test edx, edx
je 0x40222b
lea eax, [esp + 0x10]
test eax, eax
je 0x40222b
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x24]
mov dword [esp + 0x1c], 0
lea edi, [esp + ecx + 0x24]
cmp edx, edi
jae 0x402227
xor esi, esi
xor eax, eax
xor edx, edx
cmp ebp, edi
jae 0x4021f7
movsx ecx, byte [ebp]
cmp ecx, 0x41
jb 0x4021a9
cmp ecx, 0x5a
ja 0x4021a9
add ecx, 0xffffffbf
jmp 0x4021e0
cmp ecx, 0x61
jb 0x4021b8
cmp ecx, 0x7a
ja 0x4021b8
add ecx, 0xffffffb9
jmp 0x4021e0
cmp ecx, 0x30
jb 0x4021c7
cmp ecx, 0x39
ja 0x4021c7
add ecx, 4
jmp 0x4021e0
cmp ecx, 0x2b
jne 0x4021d3
mov ecx, 0x3e
jmp 0x4021e0
sub ecx, 0x2f
neg ecx
sbb ecx, ecx
and ecx, 0xffffffc0
add ecx, 0x3f
inc ebp
cmp ecx, 0xffffffff
jne 0x4021e9
dec edx
jmp 0x4021f1
shl esi, 6
or esi, ecx
add eax, 6
inc edx
cmp edx, 4
jl 0x402192
mov ecx, 0x18
sub ecx, eax
cdq
and edx, 7
add eax, edx
sar eax, 3
shl esi, cl
test eax, eax
jle 0x40221f
add dword [esp + 0x1c], eax
mov ecx, esi
shr ecx, 0x10
mov byte [ebx], cl
shl esi, 8
inc ebx
dec eax
jne 0x402211
cmp ebp, edi
jb 0x40218c
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x128]
push edi
push edx
mov byte [esp + edi + 0x130], 0
call fcn.00401e10
mov esi, dword [esp + 0x338]
add esp, 8
lea eax, [esp + 0x128]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40227a
test cl, cl
je 0x402276
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40227a
add eax, 2
add esi, 2
test cl, cl
jne 0x402252
xor eax, eax
jmp 0x40227f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4022db
mov eax, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x24]
push 0
push ecx
lea edx, [esp + 0x20]
push 0
lea ecx, [esp + 0x34]
inc eax
push edx
mov edx, dword [esp + 0x2c]
push ecx
push eax
push edx
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x40213e
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x31c
ret
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
Function at 0x402300
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
lea ecx, [eax + 0x75]
jle 0x40233d
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
sub esi, edx
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*2 + 0x45]
mov al, byte [esi + edx]
and ecx, 0x7ffff
xor al, cl
mov byte [edx], al
inc edx
dec edi
jne 0x40231b
pop esi
pop edi
ret

Function at 0x402400
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
lea eax, [esp + 0xc]
push ebx
push esi
push edi
push eax
push 1
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40242e
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 0x10
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 0
push esi
push ecx
call edi
test eax, eax
je 0x402468
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 0x10
cmp dword [esp + 0x10], 1
je 0x402485
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 0x10
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jbe 0x4024a7
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 0x10
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
push edx
lea eax, [esp + 0x14]
push ebx
push eax
push 0
push esi
push ecx
call edi
test eax, eax
je 0x4024de
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 0x10
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 8
ret 0x10
Function at 0x402500
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xb0
lea eax, [esp + 0x50]
push 0x60
push eax
call fcn.00404480
lea ecx, [esp + 0x18]
push 0x20
push ecx
call fcn.004044b0
lea edx, [esp + 0x40]
push 0x20
push edx
call fcn.004044e0
add esp, 0x18
lea eax, [esp + 4]
lea ecx, [esp + 0x50]
push eax
push 0x20019
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4025ed
mov eax, dword [esp + 4]
test eax, eax
je 0x4025ed
lea edx, [esp]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x20]
push 0
push ecx
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], 4
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xb8]
test edx, edx
setne dl
test eax, eax
mov byte [eax], dl
je 0x4025d6
mov eax, dword [esp + 0xc0]
mov edx, dword [esp + 0xbc]
lea ecx, [esp + 4]
mov dword [esp + 4], eax
push ecx
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x40]
push 0
push ecx
push edx
mov dword [esp + 0x24], 0
call esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
add esp, 0xb0
ret 0xc
xor al, al
add esp, 0xb0
ret 0xc
Function at 0x403260
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 8]
xor ecx, ecx
test edi, edi
jle 0x40329c
push ebx
push esi
mov esi, dword [esp + 0x18]
lea edx, [eax + 0x2b]
mov bl, byte [ecx + esi]
lea eax, [edx + edx*4]
shl eax, 5
add eax, edx
lea eax, [eax + eax*2]
and eax, 0x3ffff
mov edx, eax
sar edx, 3
xor bl, dl
mov byte [ecx + esi], bl
inc ecx
cmp ecx, edi
jl 0x403275
pop esi
pop ebx
pop edi
ret 0xc
Function at 0x4037f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x8c
lea eax, [esp + 0xc]
push 0x80
push eax
call fcn.00403e50
add esp, 8
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4038a2
lea eax, [esp + 0xc]
push 0x80
push eax
call fcn.00403e80
add esp, 8
lea ecx, [esp + 8]
lea edx, [esp]
lea eax, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
push edx
push 0
push 0
push eax
push ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403897
mov eax, dword [esp]
test eax, eax
je 0x403897
mov ecx, dword [esp + 4]
lea edx, [esp]
push 4
push edx
push 4
lea eax, [esp + 0x18]
push 0
push eax
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x8c
ret

Function at 0x403a10
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x80
lea eax, [esp]
push esi
push 0x80
push eax
call fcn.004046c0
add esp, 8
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
lea edx, [esp + 4]
push 0x80
push edx
mov dword [0x40c918], eax
call fcn.00404510
mov ecx, dword [0x40c918]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
add esp, 8
lea eax, [esp + 4]
push eax
push ecx
call esi
lea edx, [esp + 4]
push 0x80
push edx
mov dword [0x40c8fc], eax
call fcn.00404540
mov ecx, dword [0x40c918]
add esp, 8
lea eax, [esp + 4]
push eax
push ecx
call esi
lea edx, [esp + 4]
push 0x80
push edx
mov dword [0x40c90c], eax
call fcn.00404570
mov ecx, dword [0x40c918]
add esp, 8
lea eax, [esp + 4]
push eax
push ecx
call esi
lea edx, [esp + 4]
push 0x80
push edx
mov dword [0x40c908], eax
call fcn.004045a0
mov ecx, dword [0x40c918]
add esp, 8
lea eax, [esp + 4]
push eax
push ecx
call esi
lea edx, [esp + 4]
push 0x80
push edx
mov dword [0x40c904], eax
call fcn.004045d0
mov ecx, dword [0x40c918]
add esp, 8
lea eax, [esp + 4]
push eax
push ecx
call esi
lea edx, [esp + 4]
push 0x80
push edx
mov dword [0x40c910], eax
call fcn.00404600
mov ecx, dword [0x40c918]
add esp, 8
lea eax, [esp + 4]
push eax
push ecx
call esi
lea edx, [esp + 4]
push 0x80
mov dword [0x40c8f4], eax
push edx
call fcn.00404630
mov ecx, dword [0x40c918]
add esp, 8
lea eax, [esp + 4]
push eax
push ecx
call esi
lea edx, [esp + 4]
push 0x80
push edx
mov dword [0x40c900], eax
call fcn.00404660
mov ecx, dword [0x40c918]
add esp, 8
lea eax, [esp + 4]
push eax
push ecx
call esi
lea edx, [esp + 4]
push 0x80
push edx
mov dword [0x40c914], eax
call fcn.00404690
mov ecx, dword [0x40c918]
add esp, 8
lea eax, [esp + 4]
push eax
push ecx
call esi
mov dword [0x40c8f8], eax
pop esi
add esp, 0x80
ret
Function at 0x403bb0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x160
lea eax, [esp + 0x50]
push esi
push 0x60
push eax
call fcn.00404090
add esp, 8
lea ecx, [esp + 0x54]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea edx, [esp + 0x54]
push 0x60
push edx
mov dword [0x40c94c], eax
call fcn.004042d0
mov ecx, dword [0x40c94c]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
add esp, 8
lea eax, [esp + 0x54]
push eax
push ecx
call esi
lea edx, [esp + 0xf4]
push 0x20
push edx
mov dword [0x40c93c], eax
call fcn.00404330
lea eax, [esp + 0xbc]
push 0x20
push eax
call fcn.00404360
mov edx, dword [0x40c94c]
add esp, 0x10
lea ecx, [esp + 0xb4]
push ecx
push edx
call esi
mov ecx, dword [0x40c94c]
mov dword [0x40c920], eax
lea eax, [esp + 0xf4]
push eax
push ecx
call esi
lea edx, [esp + 0x134]
push 0x30
push edx
mov dword [0x40c928], eax
call fcn.00404390
lea eax, [esp + 0x44]
push 0x18
push eax
call fcn.004043f0
lea ecx, [esp + 0x34]
push 0x18
push ecx
call fcn.004043c0
mov eax, dword [0x40c94c]
add esp, 0x18
lea edx, [esp + 0x134]
push edx
push eax
call esi
mov edx, dword [0x40c94c]
lea ecx, [esp + 0x24]
push ecx
push edx
mov dword [0x40c938], eax
call esi
mov ecx, dword [0x40c94c]
mov dword [0x40c940], eax
lea eax, [esp + 0x3c]
push eax
push ecx
call esi
lea edx, [esp + 0x114]
push 0x20
push edx
mov dword [0x40c944], eax
call fcn.00404210
add esp, 8
lea eax, [esp + 0x114]
mov ecx, dword [0x40c94c]
push eax
push ecx
call esi
lea edx, [esp + 0xd4]
push 0x20
push edx
mov dword [0x40c934], eax
call fcn.00404240
mov ecx, dword [0x40c94c]
add esp, 8
lea eax, [esp + 0xd4]
push eax
push ecx
call esi
lea edx, [esp + 0x54]
push 0x60
push edx
mov dword [0x40c924], eax
call fcn.00404270
mov ecx, dword [0x40c94c]
add esp, 8
lea eax, [esp + 0x54]
push eax
push ecx
call esi
lea edx, [esp + 4]
push 0x10
push edx
mov dword [0x40c92c], eax
call fcn.004041e0
mov ecx, dword [0x40c94c]
add esp, 8
lea eax, [esp + 4]
push eax
push ecx
call esi
lea edx, [esp + 0x14]
push 0x10
push edx
mov dword [0x40c930], eax
call fcn.004041b0
mov ecx, dword [0x40c94c]
add esp, 8
lea eax, [esp + 0x14]
push eax
push ecx
call esi
lea edx, [esp + 0x54]
push 0x60
push edx
mov dword [0x40c91c], eax
call fcn.004042a0
mov ecx, dword [0x40c94c]
add esp, 8
lea eax, [esp + 0x54]
push eax
push ecx
call esi
mov dword [0x40c948], eax
pop esi
add esp, 0x160
ret

Function at 0x403d90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jle 0x403ddc
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
push edi
mov ecx, ebp
sub esi, ebp
mov edi, ebx
lea edx, [eax + eax*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
lea edx, [edx + edx*8]
lea eax, [eax + edx*2 - 0x2a37f]
mov dl, byte [esi + ecx]
and eax, 0xfffff
xor dl, al
mov byte [ecx], dl
inc ecx
dec edi
jne 0x403dae
pop edi
mov byte [ebx + ebp], 0
pop esi
pop ebp
pop ebx
ret 0x10
mov eax, dword [esp + 0x14]
mov byte [ebx + eax], 0
pop ebx
ret 0x10