joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ba90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4247ab
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x42fab0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x118], eax
call fcn.0040ab90
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x114]
push edx
xor edi, edi
push edi
push edi
mov esi, eax
push 0x4269b4
push esi
mov dword [ebp - 0x120], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
mov dword [ebp - 0x11c], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x11c], edi
je 0x40bb85
mov eax, 8
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], edi
mov dword [ebp - method.CArrayPtr_struct_TUNNELING_RULE_.virtual_0], vtable.CArrayPtr_struct_TUNNELING_RULE_.0
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], edi
mov dword [ebp - method.CArrayPtr_struct_TUNNELING_RULE_.virtual_0], vtable.CSortableArrayPtr_struct_PROXY_SERVER_EX__unsigned_long_int_.0
mov dword [ebp - 0x124], edi
lea eax, [ebp - 0x14c]
push eax
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.0040aca0
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], 0xffffffff
call fcn.00405760
lea eax, [edi + 1]
jmp 0x40bb9c
mov ecx, dword [ebp - 0x118]
push ecx
lea edx, [ebp - 0x114]
push ebx
push edx
call fcn.0040b520
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041449d
mov esp, ebp
pop ebp
ret
Function at 0x40cdc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4249cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x42fab0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov eax, 1
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], 0x3e8
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], vtable.CCArray.0
lea ecx, [esi + 0x40]
mov dword [ebp - 4], edi
mov dword [esi + 0x3c], edi
call fcn.00412150
push 0x12
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40df00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea edi, [eax + 1]
push edi
call fcn.00414885
add esp, 4
mov esi, eax
push edi
push esi
push ebx
mov byte [esi], 0
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40df30
mov ecx, dword [ebp + 0xc]
sub eax, edx
push eax
push esi
call fcn.0040d680
push esi
call fcn.0041488a
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40e280
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x42fab0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp dword [0x42f6f4], esi
push edi
mov edi, ecx
jge 0x40e2da
lea eax, [ebp - 0xd8]
push eax
mov dword [ebp - 0xd8], 0x94
mov dword [0x42f6f4], esi
call dword [0x42521c]
test eax, eax
je 0x40e2d4
xor ecx, ecx
cmp dword [ebp - 0xc8], 2
sete cl
mov dword [0x42f6f4], ecx
cmp dword [0x42f6f4], esi
mov eax, edi
je 0x40e486
call fcn.0040e220
cmp eax, 0x6d6f632e
ja 0x40e46a
je 0x40e455
cmp eax, 0x646d632e
je 0x40e471
cmp eax, 0x6578652e
jne 0x40e4a4
push ebx
mov ebx, dword [0x42518c]
push esi
push esi
push 3
push esi
push 3
push 0x80000100
push edi
mov word [ebp - 0xea], si
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e34f
push 0
push 0
push 3
push 0
push 3
push accept
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x40e51e
push 0
lea edx, [ebp - 0xe8]
push edx
push 0
push esi
call dword [0x425170]
test eax, eax
je 0x40e377
push 0
lea eax, [ebp - 0xe8]
push eax
push 0
push esi
call dword [0x425174]
mov edi, dword [0x425178]
push 0
lea ecx, [ebp - 0xe0]
push ecx
push 0x40
lea edx, [ebp - 0x44]
push edx
push esi
call edi
test eax, eax
je 0x40e517
cmp dword [ebp - 0xe0], 0x40
jne 0x40e517
cmp word [ebp - 0x44], 0x5a4d
jne 0x40e517
mov eax, dword [ebp - 8]
mov ebx, dword [0x42517c]
push 0
push 0
push eax
push esi
call ebx
push 0
lea ecx, [ebp - 0xe0]
push ecx
push 0x40
lea edx, [ebp - 0x128]
push edx
push esi
call edi
mov ax, word [ebp - 0x128]
cmp ax, 0x4550
jne 0x40e4b6
mov eax, dword [ebp - 8]
push 0
push 0
add eax, 0x48
push eax
push esi
call ebx
push 0
lea ecx, [ebp - 0xe0]
push ecx
push 4
lea edx, [ebp - 0xdc]
push edx
push esi
call edi
movzx ax, byte [ebp - 0xda]
mov ah, byte [ebp - 0xdc]
mov ecx, dword [ebp - 8]
push 0
push 0
add ecx, 0x5c
push ecx
push esi
mov word [ebp - 0xea], ax
call ebx
push 0
lea edx, [ebp - 0xe0]
push edx
push 4
lea eax, [ebp - 0xdc]
push eax
push esi
call edi
cmp word [ebp - 0xdc], 2
je 0x40e4ec
jmp 0x40e4e3
pop edi
mov eax, 0x5a4d
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041449d
mov esp, ebp
pop ebp
ret
cmp eax, 0x7461622e
jne 0x40e4a4
pop edi
mov eax, 0x4550
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041449d
mov esp, ebp
pop ebp
ret
call fcn.0040e220
cmp eax, 0x6578652e
je 0x40e30e
cmp eax, 0x6d6f632e
je 0x40e455
cmp eax, 0x7461622e
je 0x40e455
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041449d
mov esp, ebp
pop ebp
ret
cmp ax, 0x454c
je 0x40e4da
cmp ax, 0x454e
jne 0x40e4da
mov al, byte [ebp - 0xf2]
cmp al, 2
je 0x40e4d0
test al, al
jne 0x40e4da
cmp word [ebp - 0xea], 0
jne 0x40e4ec
mov word [ebp - 0x128], 0x5a4d
mov word [ebp - 0xea], 0
push esi
call dword [0x425180]
movzx eax, word [ebp - 0xea]
movzx ecx, word [ebp - 0x128]
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041449d
mov esp, ebp
pop ebp
ret
push esi
call dword [0x425180]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0041449d
mov esp, ebp
pop ebp
ret
Function at 0x40ef30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424baa
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x42fab0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x420], edi
mov ecx, 1
mov dword [ebp - 4], ecx
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], 0x3e8
mov dword [ebx + 0x10], edi
mov dword [ebx], vtable.CCArray.0
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x420], ecx
jne 0x40efa0
mov eax, 0x425480
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x414]
push edx
push ecx
push edi
push eax
push accept
call esi
test eax, eax
jne 0x40f14a
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0x414]
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x424]
push edx
push edi
push 0x425480
push eax
mov dword [ebp - 0x41c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f13d
mov ecx, dword [ebp - 0x414]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
lea edx, [ebp - 0x414]
push edx
push 0x20000
push 0
lea eax, [ebp - 0x410]
push eax
push accept
call esi
test eax, eax
jne 0x40f14a
mov edx, dword [ebp - 0x414]
lea ecx, [ebp - 0x418]
push ecx
push 0x20000
push eax
push str.Shell
push edx
call esi
test eax, eax
jne 0x40f132
mov eax, dword [ebp - 0x414]
push eax
call edi
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x418]
push ecx
push 0x20000
push 0
push str.opennew
push eax
mov dword [ebp - 0x414], eax
call esi
test eax, eax
je 0x40f0a2
mov eax, dword [ebp - 0x414]
lea edx, [ebp - 0x418]
push edx
push 0x20000
push 0
push str.Open
push eax
call esi
test eax, eax
jne 0x40f132
mov edx, dword [ebp - 0x414]
push edx
call edi
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x418]
push ecx
push 1
push 0
push str.Command
push eax
mov dword [ebp - 0x414], eax
call esi
test eax, eax
jne 0x40f127
mov edx, dword [ebp - 0x414]
push edx
call edi
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x424]
push edx
push 0
push 0x425480
push eax
mov dword [ebp - 0x41c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f11c
lea ecx, [ebp - 0x410]
push ecx
mov ecx, ebx
call fcn.004012f0
mov edx, dword [ebp - 0x418]
push edx
call edi
jmp 0x40f14a
mov eax, dword [ebp - 0x414]
push eax
call edi
jmp 0x40f14a
mov ecx, dword [ebp - 0x414]
push ecx
call edi
jmp 0x40f14a
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call fcn.004013f0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041449d
mov esp, ebp
pop ebp
ret
Function at 0x40f880
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, dword [ebp + 8]
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [0x425150]
test eax, eax
jne 0x40f8a0
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp - 0x1c]
push ecx
push edx
push esi
call dword [0x425100]
test eax, eax
jne 0x40f8bd
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
lea ecx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
push ebx
sub edi, esi
xor ebx, ebx
test eax, eax
mov dword [ebp - 4], eax
jbe 0x40f903
lea eax, [ecx + 0x10]
mov edi, edi
mov ecx, dword [eax]
mov edx, dword [eax - 8]
cmp ecx, edx
mov esi, dword [eax - 4]
ja 0x40f8ee
mov ecx, edx
cmp edi, esi
jb 0x40f8f8
add ecx, esi
cmp edi, ecx
jbe 0x40f90c
add ebx, 1
add eax, 0x28
cmp ebx, dword [ebp - 4]
jb 0x40f8e0
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
add ebx, 1
mov dword [edx], ebx
sub edi, esi
pop ebx
mov dword [eax], edi
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40fbd0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x42b1a8
push 0x416b80
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x15c0
call fcn.00416b50
mov eax, dword [0x42fab0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x15d0], eax
mov dword [ebp - 4], 0
push str.Kernel32.dll
call dword [0x425140]
mov esi, eax
test esi, esi
je 0x40fda9
push str.CreateToolhelp32Snapshot
push esi
mov edi, dword [0x425144]
call edi
mov ebx, eax
push str.Module32First
push esi
call edi
mov dword [ebp - 0x15cc], eax
push str.Module32Next
push esi
call edi
mov edi, eax
mov dword [ebp - 0x15d4], edi
test ebx, ebx
je 0x40fda9
mov esi, dword [ebp - 0x15cc]
test esi, esi
je 0x40fda9
test edi, edi
je 0x40fda9
call dword [0x425148]
push eax
push 8
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40fda9
mov dword [ebp - 0x15c8], 0x224
lea ecx, [ebp - 0x15c8]
push ecx
push ebx
call esi
test eax, eax
je 0x40fda9
lea edx, [ebp - 0x13a4]
push edx
push 0x4e20
push 0
lea eax, [ebp - 0x14a8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40fd8c
lea ecx, [ebp - 0x15d8]
push ecx
lea edx, [ebp - 0x15cc]
push edx
push 0x42721c
lea eax, [ebp - 0x13a4]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40fd5b
mov esi, dword [ebp - 0x15cc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x14]
mov esi, dword [esi + 0x10]
mov edi, dword [ebp - 0x15b0]
push edi
mov edi, dword [ebp - 0x15b4]
push edi
movzx edi, ax
push edi
shr eax, 0x10
push eax
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx ecx, dx
push ecx
shr edx, 0x10
push edx
movzx edx, si
push edx
shr esi, 0x10
push esi
lea eax, [ebp - 0x14a8]
push eax
push str._s_Product_Version___d._d._d._d__File_Version___d._d._d._d_Base_08X_Size_08X
lea ecx, [ebp - 0x13a4]
push ecx
call fcn.00414aba
add esp, 0x34
mov edi, dword [ebp - 0x15d4]
jmp 0x40fd76
lea edx, [ebp - 0x14a8]
push edx
push 0x4271c4
lea eax, [ebp - 0x13a4]
push eax
call fcn.00414aba
add esp, 0xc
mov ecx, dword [ebp - 0x15d0]
push ecx
lea edx, [ebp - 0x13a4]
push edx
call fcn.0040f930
add esp, 8
lea eax, [ebp - 0x15c8]
push eax
push ebx
call edi
test eax, eax
jne 0x40fcb3
jmp 0x40fda9
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041449d
mov esp, ebp
pop ebp
ret
Function at 0x4107a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub esp, 0xc
push esi
lea eax, [ebp - 8]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4107f8
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 1]
push ecx
push esi
push esi
push edx
push eax
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, 0xea
jne 0x4107ee
xor esi, esi
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410810
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x42fab0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 2
lea eax, [esi + 1]
push 0x4273e8
push eax
call fcn.00416d16
add esp, 0xc
test eax, eax
jne 0x4108cf
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push esi
call dword [0x425168]
test eax, eax
je 0x410867
lea esi, [ebp - 0x108]
lea edx, [ebp - 0x10c]
push edx
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4108cf
cmp dword [ebp + 0x14], eax
je 0x4108b4
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x410890
sub eax, edx
add eax, 1
push eax
mov eax, dword [ebp - 0x10c]
push esi
push 1
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4108c2
mov ecx, dword [ebp - 0x10c]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041449d
mov esp, ebp
pop ebp
ret

Function at 0x410fc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push esi
lea eax, [ebp - 4]
push eax
push ecx
xor esi, esi
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x410fff
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push edx
push eax
push 0x8000
push ecx
push esi
call fcn.00410ef0
mov edx, dword [ebp - 4]
push edx
mov esi, eax
call fcn.00410ed0
add esp, 0x18
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [eax]
add edi, 8
test ecx, ecx
jle 0x4114c4
push ebx
mov dword [ebp + 0xc], ecx
push esi
jmp 0x411470
mov esi, dword [eax + 4]
lea esi, [esi + esi - 2]
test esi, esi
jl 0x4114ab
jmp 0x411480
mov ebx, dword [edx]
mov eax, dword [edx + 4]
sub eax, dword [edi + esi*4 + 4]
mov cl, bl
and cl, 0x1f
ror eax, cl
xor eax, ebx
mov dword [edx + 4], eax
sub ebx, dword [edi + esi*4]
mov cl, al
and cl, 0x1f
ror ebx, cl
xor ebx, eax
sub esi, 2
mov dword [edx], ebx
jns 0x411480
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov ecx, dword [ecx]
sub dword [edx], ecx
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
sub dword [edx + 4], ecx
add edx, 8
sub dword [ebp + 0xc], 1
jne 0x411470
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x4114d0
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
mov eax, ebx
cdq
and edx, 3
add eax, edx
push edi
mov edi, eax
sar edi, 2
mov edx, ebx
and edx, reloc.WS2_32.dll_closesocket
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
jns 0x411508
dec edx
or edx, 0xfffffffc
inc edx
je 0x411510
add edi, 1
mov dword [ebp - 4], edi
lea eax, [edi*4]
push eax
call fcn.004170b7
add esp, 4
test edi, edi
mov edx, eax
mov dword [ebp + 0x10], edx
jle 0x411534
mov ecx, edi
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 4]
test ebx, ebx
jle 0x411550
mov ecx, dword [ebp + 0xc]
mov eax, edx
sub ecx, edx
nop
mov dl, byte [ecx + eax]
mov byte [eax], dl
add eax, 1
sub ebx, 1
jne 0x411540
mov edx, dword [ebp + 0x10]
mov eax, dword [esi]
mov ebx, dword [ebp - 0x10]
mov dword [eax], 0xb7e15163
mov eax, 1
cmp ebx, eax
jle 0x41157f
mov ecx, dword [esi]
mov edx, dword [ecx + eax*4 - 4]
lea ecx, [ecx + eax*4]
sub edx, 0x61c88647
add eax, 1
cmp eax, ebx
mov dword [ecx], edx
jl 0x411564
mov edx, dword [ebp + 0x10]
cmp edi, ebx
jle 0x41158b
lea eax, [edi + edi*2]
mov dword [ebp - 0xc], eax
jmp 0x411591
lea ecx, [ebx + ebx*2]
mov dword [ebp - 0xc], ecx
xor edi, edi
xor ebx, ebx
cmp dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
jle 0x4115f2
jmp 0x4115a3
mov esi, dword [ebp + 8]
mov eax, edi
cdq
idiv dword [ebp - 0x10]
mov eax, dword [esi]
mov ecx, dword [ebp - 8]
add ecx, ebx
add edx, edx
add edx, edx
add ecx, dword [eax + edx]
add eax, edx
rol ecx, 3
mov dword [eax], ecx
mov eax, dword [esi]
mov ebx, dword [edx + eax]
mov eax, edi
cdq
idiv dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + edx*4]
add edi, 1
lea esi, [ecx + edx*4]
mov edx, dword [ebp - 8]
mov cl, bl
add cl, dl
add eax, edx
and cl, 0x1f
add eax, ebx
rol eax, cl
cmp edi, dword [ebp - 0xc]
mov dword [esi], eax
mov dword [ebp - 8], eax
jl 0x4115a0
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
test ecx, ecx
jle 0x4115ff
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
push edx
call fcn.0041717a
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411660
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
push ebx
push esi
xor ebx, ebx
xor esi, esi
test eax, eax
push edi
mov dword [ebp - 4], eax
je 0x411710
mov edi, dword [ebp + 0xc]
jmp 0x411684
mov eax, dword [ebp - 4]
add dword [ebp + 8], 1
push eax
call fcn.004172cf
add esp, 4
test eax, eax
jne case.default.0x4116b0
mov eax, dword [ebp - 4]
cmp eax, 0x3d
je 0x411710
movzx eax, byte [eax + 0x427480]
cmp eax, 0xff
je 0x411719
cmp ebx, 3
ja case.default.0x4116b0
jmp dword [ebx*4 + 0x411724]
add al, al
add al, al
mov byte [esi + edi], al
mov ebx, 1
jmp case.default.0x4116b0
mov ecx, eax
sar ecx, 4
or byte [esi + edi], cl
shl al, 4
mov byte [esi + edi + 1], al
add esi, 1
mov ebx, 2
jmp case.default.0x4116b0
mov edx, eax
sar edx, 2
or byte [esi + edi], dl
shl al, 6
mov byte [esi + edi + 1], al
add esi, 1
mov ebx, 3
jmp case.default.0x4116b0
or byte [esi + edi], al
add esi, 1
xor ebx, ebx
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
test eax, eax
mov dword [ebp - 4], eax
jne 0x411681
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4136b0
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
mov eax, ecx
jmp 0x4135c0

Function at 0x413f24
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413f7c
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x425480
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413f6f
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x413f7e
xor eax, eax
pop esi
leave
ret 4
Function at 0x412490
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48b0bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047f2ce
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x412512
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047c6d7
mov eax, dword [eax]
push 0x4a9210
push eax
call fcn.0046f004
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047f559
test bl, bl
je 0x412512
push 0x4a9210
lea ecx, [esp + 0xc]
call fcn.0047f8e9
push 0x4acd8c
lea ecx, [esp + 0xc]
call fcn.0047f8e9
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41254e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047f559
jmp 0x412619
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4125d2
lea edx, [esp + 0x7c]
push 0x4acd88
push edx
call fcn.0046f004
add esp, 8
test eax, eax
je 0x4125d2
lea eax, [esp + 0x7c]
push 0x4acd84
push eax
call fcn.0046f004
add esp, 8
test eax, eax
je 0x4125d2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x412562
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047f559
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x412e10
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x412e72
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc