joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005a48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10005a57
pop dword [ebp - 0x14]
mov eax, 0x10005a57
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x99b74ebf
add dword [ebp - 0x24], 0xb49af68c
mov dword [ebp - 0x20], 0x6e941d44
sub dword [ebp - 0x20], 0x3c60d0ff
mov dword [ebp - 0x1c], 0x38176539
sub dword [ebp - 0x1c], 0xebcb210b
mov dword [ebp - 0x18], 0x5ffca395
add dword [ebp - 0x18], 0xa0035c6b
lea eax, [ebp - 0x24]
push eax
mov eax, 0xc7d48ef7
sub eax, 0xb7d3ced3
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xc802eae2
sub dword [ebp - 0x24], 0x5390818c
mov dword [ebp - 0x20], 0xdfa80f4c
sub dword [ebp - 0x20], 0x9e3badd7
mov dword [ebp - 0x1c], 0x68493906
sub dword [ebp - 0x1c], 0x4d9cc9a
mov dword [ebp - 0x18], 0x837f12ff
add dword [ebp - 0x18], 0x7c80ed01
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x66428a23
add eax, 0xa9be3609
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3a33a
push 0
call eax
mov ecx, 0x8e989675
sub ecx, 0x8e984586
mov edx, eax
mov ebx, 0x2e6e3e5a
add ebx, 0xe19635a6
add ebx, dword [ebp - 0x14]
mov edi, 0x568ee26
mov dword [ebp - 4], 0x401f12ff
mov esi, dword [ebx]
add dword [ebp - 8], 0x11d2f5ac
sub esi, edi
xor dword [ebp - 0x10], eax
mov dword [edx], esi
add dword [ebp - 8], edx
add edx, 0x1403c69f
sub edx, 0x1403c69b
add ebx, 0x3f0af392
add ebx, 0xc0f50c72
loop 0x10005b6e
add eax, 0x45aaf6d1
add eax, 0xba563fbe
mov ebx, eax
add eax, 0x3cacae65
add eax, 0xc35351a0
mov ecx, 0x712ade7a
add ecx, 0x9ed52186
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x409489
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4094af
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4094af
xor al, al
jmp 0x4094cf
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004176b0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x409724
Capabilities:
Get common file path

Disassembly:
push 0x30
mov eax, 0x421683
call fcn.00416b21
mov eax, dword [ebp + 0xc]
and dword [eax + 4], 0
mov eax, dword [eax]
mov edi, dword [ebp + 8]
xor ecx, ecx
push edi
mov word [eax], cx
call fcn.0040116f
movzx esi, word [edi]
mov ebx, eax
cmp ebx, 1
jl 0x409861
cmp si, 0x5c
je 0x409861
cmp si, 0x2e
jne 0x40977d
cmp ebx, 1
je 0x409861
cmp ebx, 2
jne 0x40977d
cmp word [edi + 2], si
je 0x409861
lea ecx, [ebp - 0x18]
call fcn.0040320a
and dword [ebp - 4], 0
cmp ebx, 3
jle 0x4097b1
cmp word [edi + 2], 0x3a
jne 0x4097b1
cmp word [edi + 4], 0x5c
jne 0x4097b1
cmp si, 0x61
jb 0x4097a8
cmp si, 0x7a
jbe 0x409803
add esi, 0xffffffbf
cmp si, 0x19
jbe 0x409803
mov esi, 0x105
cmp dword [ebp - 0x10], esi
jg 0x4097c4
push esi
lea ecx, [ebp - 0x18]
call fcn.0040110f
mov ebx, dword [ebp - 0x18]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
mov esi, eax
call fcn.0040116f
xor edx, edx
lea ecx, [ebx + eax*2]
mov word [ecx], dx
mov dword [ebp - 0x14], eax
test esi, esi
je 0x40986b
cmp esi, 0x104
ja 0x40986b
cmp word [ecx - 2], 0x5c
je 0x409803
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.00408670
push str.__
lea ecx, [ebp - 0x3c]
call fcn.00401647
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.004096a4
push edi
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.004096e4
mov ecx, dword [ebp + 0xc]
push eax
mov byte [ebp - 4], 3
call fcn.00408639
push dword [ebp - 0x24]
call fcn.00408bfb
push dword [ebp - 0x30]
call fcn.00408bfb
push dword [ebp - 0x3c]
call fcn.00408bfb
push dword [ebp - 0x18]
call fcn.00408bfb
add esp, 0x10
mov al, 1
call fcn.00416bf9
ret 8
push ebx
call fcn.00408bfb
pop ecx
xor al, al
jmp 0x409863

Function at 0x409c01
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
and dword [esi + 4], 0
mov eax, dword [esi]
push edi
mov edi, ecx
xor ecx, ecx
mov word [eax], cx
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
test ebx, ebx
jne 0x409c30
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
inc eax
jmp 0x409c6a
push ebx
mov ecx, esi
call fcn.00403fa3
inc ebx
push ebx
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, dword [esi]
push edi
mov ebx, eax
call fcn.0040116f
xor ecx, ecx
mov word [edi + eax*2], cx
mov dword [esi + 4], eax
test ebx, ebx
jne 0x409c68
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
neg eax
jmp 0x409c6a
mov al, 1
pop edi
pop esi
pop ebx
ret 4
Function at 0x40cb18
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea edi, [eax + 0x1c]
shr eax, 2
mov esi, eax
shr esi, 1
add esi, 3
mov dword [ecx], esi
add ecx, 0x10
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], eax
test eax, eax
jbe 0x40cb4f
mov ebx, dword [edx]
mov dword [ecx + esi*4], ebx
inc esi
add edx, 4
cmp esi, eax
jb 0x40cb42
cmp esi, edi
jae 0x40cc32
mov edx, esi
sub edx, eax
lea eax, [ecx + edx*4]
mov dword [ebp - 4], eax
xor edx, edx
mov eax, esi
div dword [ebp + 8]
mov edi, dword [ecx + esi*4 - 4]
mov dword [ebp - 8], eax
test edx, edx
jne 0x40cbc8
mov eax, edi
mov edx, 0xff
and eax, edx
movzx eax, byte [eax + str.cw]
mov ebx, edi
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
shl eax, 8
or eax, ebx
mov ebx, edi
shr edi, 8
and edi, edx
shr ebx, 0x10
and ebx, edx
movzx edx, byte [edi + str.cw]
movzx ebx, byte [ebx + str.cw]
mov edi, dword [ebp - 8]
movzx edi, byte [edi + 0x42ced8]
shl eax, 8
or eax, ebx
xor edx, edi
shl eax, 8
or eax, edx
mov edi, eax
jmp 0x40cc1a
cmp dword [ebp + 8], 6
jbe 0x40cc1a
cmp edx, 4
jne 0x40cc1a
mov edx, edi
shr edx, 0x10
mov ebx, edi
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
mov eax, 0xff
and edx, eax
movzx edx, byte [edx + str.cw]
shl ebx, 8
or edx, ebx
mov ebx, edi
shr ebx, 8
and ebx, eax
movzx ebx, byte [ebx + str.cw]
shl edx, 8
and edi, eax
movzx eax, byte [edi + str.cw]
or edx, ebx
shl edx, 8
or edx, eax
mov edi, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add dword [ebp - 4], 4
xor eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x40cb61
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40d8af
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jb 0x40da0a
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x40d8ed
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x40d8f2
inc edi
cmp edi, dword [ebp - 4]
jb 0x40d8e4
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x40d9ea
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x40d949
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x40d91d
cmp cl, 0xff
jne 0x40d974
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x40d982
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x40d989
dec ecx
shl edx, cl
and edx, 7
je 0x40d90e
movzx ecx, byte [edx + 0x423a98]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x423a90], 0
mov cl, byte [ebx + 4]
je 0x40d971
test cl, cl
je 0x40d971
cmp cl, 0xff
jne 0x40d90e
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x40d8df
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x40d9bd
movzx esi, byte [edx + 0x423a98]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x40d9a8
cmp al, 0xff
jne 0x40d9ba
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x40d93b
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x40d8df
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret 0x14

Function at 0x40f903
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret 4

Function at 0x40fc50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call fcn.00417abb
mov ecx, dword [ebp + 8]
add esp, 0x18
push eax
mov dword [ecx], eax
call fcn.0040fc0b
pop ebp
ret 0xc
Function at 0x41099e
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, 0x105
push eax
push eax
mov ecx, esi
call fcn.00403fa3
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [esi]
push edi
mov ebx, eax
call fcn.0040116f
xor ecx, ecx
mov word [edi + eax*2], cx
mov dword [esi + 4], eax
dec ebx
mov eax, 0x103
cmp eax, ebx
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret 4

Function at 0x410a7a
Capabilities:
Set file attributes

Disassembly:
push 0xc
mov eax, 0x421d84
call fcn.00416b21
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call esi
test eax, eax
je 0x410a9c
mov al, 1
jmp 0x410adc
lea ecx, [ebp - 0x18]
call fcn.0040320a
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00409876
test al, al
je 0x410ad1
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
mov esi, eax
call fcn.00408bfb
test esi, esi
setne al
jmp 0x410adb
push dword [ebp - 0x18]
call fcn.00408bfb
xor al, al
pop ecx
call fcn.00416bf9
ret 8

Function at 0x410b45
Capabilities:
Create directory

Disassembly:
push 0xc
mov eax, 0x421d84
call fcn.00416b21
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
je 0x410b66
mov al, 1
jmp 0x410bb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x410bb1
lea ecx, [ebp - 0x18]
call fcn.0040320a
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00409876
test al, al
je 0x410ba8
push 0
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
mov esi, eax
call fcn.00408bfb
test esi, esi
pop ecx
setne al
jmp 0x410bb3
push dword [ebp - 0x18]
call fcn.00408bfb
pop ecx
xor al, al
call fcn.00416bf9
ret 4

Function at 0x410e18
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, 0x105
push edi
mov ecx, esi
call fcn.00403fa3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, dword [esi]
push edi
mov ebx, eax
call fcn.0040116f
xor ecx, ecx
mov word [edi + eax*2], cx
mov dword [esi + 4], eax
dec ebx
mov eax, 0x103
cmp eax, ebx
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret 4

Function at 0x410e58
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, 0x105
push edi
mov ecx, esi
call fcn.00403fa3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [esi]
push edi
mov ebx, eax
call fcn.0040116f
xor ecx, ecx
mov word [edi + eax*2], cx
mov dword [esi + 4], eax
dec ebx
mov eax, 0x103
cmp eax, ebx
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret 4
Function at 0x4130b7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0
push dword [ebp + 0xc]
mov esi, ecx
mov al, byte [esi + 0x139]
push dword [ebp + 8]
lea ecx, [esi + 0x70]
mov byte [esi + 0x88], al
call fcn.00413069
push 0x45
lea eax, [ebp - 0xc]
push eax
call fcn.0040c825
push dword [eax]
add esi, 0x74
mov ecx, esi
call fcn.00411a09
push dword [ebp - 0xc]
call fcn.00408bfb
pop ecx
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
leave
ret 8

Function at 0x4138be
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1f8c]
mov eax, 0x200c
call fcn.00417ea0
mov eax, dword [0x42d330]
xor eax, ebp
mov dword [ebp + 0x1f88], eax
push esi
push edi
mov edi, 0x2000
push edi
xor esi, esi
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00417d60
add esp, 0xc
push edi
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp - 0x7c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocString
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 4
lea eax, [ebp - 0x80]
push eax
push 4
push esi
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x20
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1f88]
pop edi
xor ecx, ebp
pop esi
call fcn.00416b12
add ebp, 0x1f8c
leave
ret

Function at 0x413a48
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x42d330]
xor eax, ebp
mov dword [ebp + 0x398], eax
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x78], ax
xor esi, esi
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.00417d60
add esp, 0xc
push 0x208
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push edi
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push esi
push eax
call fcn.00417d60
push str.Applications_
mov edi, 0x104
lea eax, [ebp + 0x190]
push edi
push eax
call fcn.00417f66
lea eax, [ebp - 0x78]
push 0x5c
push eax
call fcn.00417e68
inc eax
inc eax
push eax
lea eax, [ebp + 0x190]
push edi
push eax
call fcn.00417ecb
add esp, 0x2c
push esi
lea eax, [ebp - 0x7c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp + 0x190]
push eax
push SysReAllocString
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor eax, eax
push 2
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x80]
push eax
push 1
push esi
push str.IsHostApp
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x398]
pop edi
xor ecx, ebp
pop esi
call fcn.00416b12
add ebp, 0x39c
leave
ret
Function at 0x416b12
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42d330]
jne 0x416b1c
repz ret
jmp fcn.004199fc

Function at 0x41c3cc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00418676
and dword [ebp - 4], 0
cmp dword [0x431024], 0
mov ebx, eax
jne 0x41c47d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41c52e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41c52e
push eax
call fcn.00418604
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x431024], eax
call esi
push eax
call fcn.00418604
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x431028], eax
call esi
push eax
call fcn.00418604
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43102c], eax
call esi
push eax
call fcn.00418604
pop ecx
mov dword [0x431034], eax
test eax, eax
je 0x41c47d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00418604
pop ecx
mov dword [0x431030], eax
mov eax, dword [0x431030]
cmp eax, ebx
je 0x41c4d5
cmp dword [0x431034], ebx
je 0x41c4d5
push eax
call fcn.0041867f
push dword [0x431034]
mov esi, eax
call fcn.0041867f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41c4d5
test edi, edi
je 0x41c4d5
call esi
test eax, eax
je 0x41c4cc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41c4cc
test byte [ebp - 0xc], 1
jne 0x41c4d5
or dword [ebp + 0x10], 0x200000
jmp 0x41c50e
mov eax, dword [0x431028]
cmp eax, ebx
je 0x41c50e
push eax
call fcn.0041867f
pop ecx
test eax, eax
je 0x41c50e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41c50e
mov eax, dword [0x43102c]
cmp eax, ebx
je 0x41c50e
push eax
call fcn.0041867f
pop ecx
test eax, eax
je 0x41c50e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431024]
call fcn.0041867f
pop ecx
test eax, eax
je 0x41c52e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41c530
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x401443
pop dword [ebp - 0x18]
mov eax, 0xc56357c8
sub eax, 0xc5234385
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x1c561f85
add dword [ebp - 0x28], 0x31fc25c6
mov dword [ebp - 0x24], 0x73cbd59a
sub dword [ebp - 0x24], 0x41988955
mov dword [ebp - 0x20], 0x5109c90c
sub dword [ebp - 0x20], 0x4bd84de
mov dword [ebp - 0x1c], 0x427efb2f
add dword [ebp - 0x1c], 0xbd8104d1
lea eax, [ebp - 0x28]
push eax
mov eax, 0xe3081c41
add eax, 0x1d3864c3
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xba923bcb
add dword [ebp - 0x28], 0xb9e02d8b
mov dword [ebp - 0x24], 0x6f52148a
sub dword [ebp - 0x24], 0x2de5b315
mov dword [ebp - 0x20], 0x5074172
add dword [ebp - 0x20], 0x5e682afa
mov dword [ebp - 0x1c], 0x32a79dcc
sub dword [ebp - 0x1c], 0x32a79dcc
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xa7900b8a
add eax, 0x58b07576
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x36056
push 0
call eax
mov ecx, 0x3eec
mov edx, eax
mov ebx, 0x762c459
sub ebx, 0x71be059
add ebx, dword [ebp - 0x18]
mov edi, 0xa445bdb4
add edi, 0xb5b1557f
sub dword [ebp - 0xc], ebx
mov esi, dword [ebx]
sub dword [ebp - 4], 0x9fe454a1
xor esi, edi
sub dword [ebp - 0x10], 0xf131a807
mov dword [edx], esi
add dword [ebp - 0xc], esi
add edx, 0xb0f9a697
add edx, 0x4f06596d
add ebx, 0x5371916f
add ebx, 0xac8e6e95
loop 0x40155f
add eax, 0xe67eb537
sub eax, 0xe67dc6b4
mov ebx, eax
add eax, 0xf323ce61
add eax, 0xcdc31a4
mov ecx, 0x987566b7
sub ecx, 0x983566b7
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x1001b8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x1001b889

Function at 0x10028810
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.1006c120
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret

Function at 0x100349e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1c
call fcn.1006d450
mov eax, dword [0x100adb80]
xor eax, esp
mov dword [esp + 0x18], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0x10], ecx
mov ecx, dword [ebp + 0x18]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [esp + 0x14], edx
test ecx, ecx
jle 0x10034ae7
mov ebx, dword [ebp + 0x10]
lea edi, [ebx + 3]
lea esi, [eax + 2]
sub ebx, eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.10033760
movzx eax, byte [edi - 3]
movzx edx, byte [esp + 0x28]
movzx ecx, byte [esp + 0x29]
xor eax, edx
movzx edx, byte [esp + 0x2a]
mov byte [esi - 2], al
mov byte [esp + 0x20], al
movzx eax, byte [edi - 2]
xor eax, ecx
movzx ecx, byte [esp + 0x2b]
mov byte [esi - 1], al
mov byte [esp + 0x21], al
movzx eax, byte [esi + ebx]
xor eax, edx
movzx edx, byte [esp + 0x2c]
mov byte [esi], al
mov byte [esp + 0x22], al
movzx eax, byte [edi]
xor eax, ecx
movzx ecx, byte [esp + 0x2d]
mov byte [esi + 1], al
mov byte [esp + 0x23], al
movzx eax, byte [edi + 1]
xor eax, edx
movzx edx, byte [esp + 0x2e]
mov byte [esi + 2], al
mov byte [esp + 0x24], al
movzx eax, byte [edi + 2]
xor eax, ecx
movzx ecx, byte [esp + 0x2f]
mov byte [esi + 3], al
mov byte [esp + 0x25], al
movzx eax, byte [edi + 3]
xor eax, edx
mov byte [esi + 4], al
mov byte [esp + 0x26], al
movzx eax, byte [edi + 4]
xor eax, ecx
mov byte [esi + 5], al
add esp, 0xc
add edi, 8
add esi, 8
dec dword [esp + 0xc]
mov byte [esp + 0x1b], al
jne 0x10034a32
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1006bd1f
mov esp, ebp
pop ebp
ret