joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48eda0
Capabilities:
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov eax, dword [0x50302c]
xor eax, esp
mov dword [esp + 0xc], eax
push 0
push 0x34
push 1
call fcn.00436250
add esp, 0xc
mov esi, eax
mov dword [eax + 0x30], 0x4d9b64
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], 0
mov dword [eax], 0
push ebx
call fcn.0043bc00
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi + 0x24], 0
push 9
push str..pipe_
push ebx
call fcn.004b18c0
add esp, 0xc
test eax, eax
je 0x48ee26
push 0xd0
push str._home_simon_mem_.build_workdirs_bob_qvbm9mtj_putty_windows_named_pipe_server.c
push str.strncmp_pipename___.pipe___9___0
call fcn.004ad8b3
add esp, 0xc
lea ebp, [esi + 0x2c]
lea ebx, [esi + 4]
mov eax, dword [esp + 0x24]
add eax, 9
push 0x5c
push eax
call fcn.004a0fb0
add esp, 8
test eax, eax
je 0x48ee59
push 0xd1
push str._home_simon_mem_.build_workdirs_bob_qvbm9mtj_putty_windows_named_pipe_server.c
push str.strchr_pipename__9_____NULL
call fcn.004ad8b3
add esp, 0xc
mov edi, esi
add edi, 0x30
push ebp
push ebx
push esi
push 0xc0000000
call fcn.00439b30
add esp, 0x10
test al, al
je 0x48ef2c
mov dword [esp], 0xc
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov eax, esp
push eax
push 0
push 0x1000
push 0x1000
push 0xff
push 8
push 0x40080003
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x48ef08
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x20], eax
push esi
push 0x48ef50
push eax
call fcn.00425ea0
add esp, 0xc
mov dword [esi + 0x24], eax
mov ecx, esi
xor edx, edx
call fcn.0048ef60
jmp 0x48ef2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043a050
add esp, 4
push eax
push dword [esp + 0x28]
push str.unable_to_create_named_pipe__s:__s
call fcn.00435810
add esp, 0xc
mov dword [ebp], eax
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0049e0f0
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48ef60
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov esi, ecx
mov eax, dword [0x50302c]
xor eax, esp
mov dword [esp + 0xc], eax
lea ebp, [ecx + 0x10]
jmp 0x48efc1
mov dword [esp], 0xc
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov eax, esp
push eax
push 0
push 0x1000
push 0x1000
push 0xff
push 8
push 0x40000003
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x48f021
test bl, 1
jne 0x48eff0
push ebp
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x48eff2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x48eff2
mov edi, eax
cmp eax, 0x217
je 0x48eff2
jmp 0x48f07f
xor ebx, ebx
mov edi, dword [esi + 0xc]
mov eax, dword [esi + 0x28]
mov dword [esp], edi
mov ecx, dword [eax]
mov edx, dword [esp]
push edx
push 0x48f120
push eax
call dword [ecx + 0x10]
add esp, 0xc
test eax, eax
je 0x48ef80
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48ef80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call fcn.0043a050
add esp, 4
push eax
push str.Error_while_listening_to_named_pipe:__s
call fcn.00435810
add esp, 8
mov ebx, eax
push dword [esi + 8]
call fcn.004323f0
add esp, 4
mov ecx, dword [esi + 0x28]
add esi, 0x30
mov edx, dword [ecx]
push edi
push ebx
push 0
push eax
push 1
push esi
push ecx
call dword [edx]
add esp, 0x1c
push ebx
call fcn.004362e0
add esp, 4
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0049e0f0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp edi, 0x3e5
jne 0x48f029
jmp 0x48f06c

Function at 0x491470
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x20]
test edi, edi
je 0x49149a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea esi, [edi - 1]
mov ebx, edi
and ebx, 3
cmp esi, 3
jae 0x4914a1
xor esi, esi
test ebx, ebx
jne 0x4914ee
jmp 0x491503
mov eax, 1
jmp 0x49150d
mov dword [esp], ebx
and edi, 0xfffffffc
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
xor bl, byte [ecx]
mov bh, byte [eax + 1]
movzx ebp, bl
xor bh, byte [ecx + 1]
or ebp, esi
mov bl, byte [eax + 2]
xor bl, byte [ecx + 2]
movzx esi, bh
movzx ebx, bl
or ebx, esi
or ebx, ebp
movzx edx, byte [eax + 3]
add eax, 4
xor dl, byte [ecx + 3]
add ecx, 4
movzx esi, dl
or esi, ebx
add edi, 0xfffffffc
jne 0x4914b0
mov ebx, dword [esp]
test ebx, ebx
je 0x491503
xor edi, edi
movzx edx, byte [eax + edi]
xor dl, byte [ecx + edi]
movzx edx, dl
or esi, edx
add edi, 1
cmp ebx, edi
jne 0x4914f0
mov eax, 0x100
sub eax, esi
shr eax, 8
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49adb0
Capabilities:
Hash data using sha512

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x10]
cmp ebx, 0x41
jb 0x49add0
push pe_nt_image_headers32
push str._home_simon_mem_.build_workdirs_bob_qvbm9mtj_putty_crypto_blake2.c
push str.hashlen___ssh_blake2b.hlen
call fcn.004ad8b3
add esp, 0xc
push 0
push 0xf0
push 1
call fcn.00436250
add esp, 0xc
lea edx, [eax + 0xe4]
mov dword [eax + 0xe4], 0x4da508
mov dword [eax + 0x40], ebx
lea ecx, [eax + 0xd8]
mov dword [eax + 0xd8], 0x49b0f0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], ecx
mov dword [eax + 0xe8], ecx
mov ecx, 0x10
mov edi, eax
mov esi, 0x4da538
rep movsd dword es:[edi], dword [esi]
xor ebx, 0xf2bdc908
mov dword [eax], ebx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
mov dword [eax + 0xcc], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov eax, edx
pop esi
pop edi
pop ebx
ret
Function at 0x49e977
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49e9b6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49e9b6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49e9b6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x49e9b6
cmp dword [ecx + 0x74], 0xe
jbe 0x49e9b6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4b27b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b27dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b27dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4b2bb1
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4dc008
push 0x4dc000
push str.FlsAlloc
push 0x1e
call fcn.004b3244
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b2be5
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x4b2beb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4b2c2f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4dc018
push 0x4dc010
push str.FlsGetValue
push 0x20
call fcn.004b3244
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b2c66
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4ba0b1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4ba14e
push ebx
push esi
call fcn.004ba19f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004b9ffa
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4ba0fb
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4ba14d
push edi
push eax
call fcn.004b4ef1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4ba11b
call fcn.004b45a6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4ba14c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004b9ffa
add esp, 0x20
test eax, eax
jne 0x4ba13a
push edi
call fcn.004b45a6
jmp 0x4ba142
push ebx
call fcn.004b45a6
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4ba151
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4ba162
pop esi
ret
push ebx
push edi
push esi
call fcn.004ba19f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004b4ef1
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4ba18a
push ebx
push esi
push edi
call fcn.004a08d0
add esp, 0xc
push 0
call fcn.004b45a6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4ba1e1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ba44a

Function at 0x4ba957
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ba962
Function at 0x4bc951
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bc95c
Function at 0x4bd5a1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x505b48]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4bd5e1
cmp byte [ebx], 0xa
jne 0x4bd5e1
or byte [eax + edi + 0x28], 4
jmp 0x4bd5e6
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4bd6e4
mov al, byte [edx]
cmp al, 0x1a
je 0x4bd6c6
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4bd615
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4bd63a
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4bd644
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4bd5f7
jmp 0x4bd6e4
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4bd6c1
cmp dword [ebp - 0xc], 0
je 0x4bd6c1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x505b48]
test byte [eax + edi + 0x28], 0x48
je 0x4bd69b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4bd686
mov byte [esi], dl
jmp 0x4bd697
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x505b48]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4bd6e4
cmp byte [ebp - 1], 0xa
jne 0x4bd6aa
cmp esi, ebx
jne 0x4bd6aa
mov byte [esi], 0xa
jmp 0x4bd6e3
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004c3ca1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4bd6e4
mov byte [esi], 0xd
jmp 0x4bd6e3
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x505b48]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4bd6e0
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4bd6e4
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4bd6ed
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x505b48]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4bd730
cmp word [esi], dx
jne 0x4bd730
or byte [edi + eax + 0x28], 4
jmp 0x4bd735
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4bd888
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4bd868
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4bd777
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4bd7ad
cmp eax, edx
jae 0x4bd7b9
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4bd74f
jmp 0x4bd888
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4bd864
cmp dword [ebp - 0x14], 0
je 0x4bd864
mov eax, dword [ebx*4 + 0x505b48]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4bd83c
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4bd805
mov word [esi], cx
jmp 0x4bd838
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x505b48]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x505b48]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x505b48]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4bd888
pop ebx
cmp word [ebp - 4], bx
jne 0x4bd84d
cmp esi, dword [ebp + 0xc]
jne 0x4bd84d
mov word [esi], bx
jmp 0x4bd885
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004c3ca1
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4bd888
push 0xd
jmp 0x4bd881
mov ecx, dword [ebx*4 + 0x505b48]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4bd87f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4bd888
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x23673f13
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.23672856
mov eax, dword [0x236a9d68]
mov ebp, dword [esp + 0x10]
cmp eax, 1
je 0x23684ce5
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x236a9998], 1
mov byte [0x236a9d64], bl
jne 0x23673f87
mov ecx, dword [0x236a9ac4]
test ecx, ecx
je 0x23673f75
mov esi, dword [0x236a9ac0]
sub esi, 4
cmp esi, ecx
jb 0x23673f75
mov eax, dword [esi]
test eax, eax
je 0x23673f6e
call eax
mov ecx, dword [0x236a9ac4]
sub esi, 4
cmp esi, ecx
jae 0x23673f60
push 0x236a9d54
push 0x236a9d4c
call fcn.23672834
add esp, 8
push 0x236a9d60
push 0x236a9d58
call fcn.23672834
add esp, 8
test ebx, ebx
je 0x23684cf8
call fcn.23672861
pop esi
pop ebp
pop ebx
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x23673f2d
push ebp
mov dword [0x236a9d68], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x2367ac38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
lea eax, [ebp - 4]
push esi
push eax
push str.Licenses
push SQLAllocEnv
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x23683699
lea eax, [ebp - 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push eax
lea eax, [ebp - 0xd0]
mov dword [ebp - 8], 0xc8
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x2367acf7
lea eax, [ebp - 0xd0]
push eax
push str.Licensing:_Copying_the_keys_may_be_a_violation_of_established_copyrights.
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x2367acf7
push dword [ebp + 8]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.2367ad06
pop ecx
lea eax, [ebp - 8]
pop ecx
mov dword [ebp - 8], 0xc8
push eax
lea eax, [ebp - 0xd0]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x2367acf7
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret
xor eax, eax
jmp 0x2367ad03

Function at 0x2367ad06
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [ebp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.2367adc3
cmp byte [ebx], 0
pop ecx
mov edx, ebx
je 0x2367ad48
inc edx
cmp byte [edx], 0
jne 0x2367ad42
mov ecx, dword [ebp + 8]
dec edx
mov dword [ebp + 0xc], edx
mov edi, ecx
cmp byte [ecx], 0
je 0x2367ad5c
inc edi
cmp byte [edi], 0
jne 0x2367ad56
dec edi
mov eax, ecx
cmp ecx, edi
jae 0x2367ad7e
mov esi, ebx
sub esi, ecx
mov cl, byte [eax]
xor byte [eax + esi], cl
movsx ecx, byte [eax + esi]
add dword [ebp - 4], ecx
inc eax
cmp eax, edi
jb 0x2367ad67
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
cmp ebx, edx
mov eax, ebx
jae 0x2367ad8a
inc eax
dec edx
cmp eax, edx
jb 0x2367ad84
push 0xa
lea edi, [eax - 1]
mov eax, dword [ebp - 4]
xor edx, edx
pop esi
div esi
mov eax, ecx
mov esi, ebx
add dl, 0x61
cmp ebx, edi
ja 0x2367adbb
mov cl, byte [esi]
and cl, 0xf
add cl, dl
mov byte [eax], cl
mov cl, byte [esi]
sar cl, 4
inc eax
add cl, dl
mov byte [eax], cl
inc eax
inc esi
cmp esi, edi
jbe 0x2367ada2
and byte [eax], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x23686049
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x78], 0
je 0x23686080
mov edi, dword [esi + 0x98]
test edi, edi
je 0x23686080
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [esi + 0x78]
lea eax, [ebp - 4]
push eax
push esi
call fcn.2369a22f
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ax, word [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x2368a5a2
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x2368a5ba
mov ebx, dword [eax + 0x78]
test ebx, ebx
jne 0x2368a5c6
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
mov edi, dword [esi + 0x138]
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x2368a5f3
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 4]
mov ecx, ebx
push eax
push dword [esi + 0xd4]
call fcn.2369a22f
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
movsx eax, word [ebp - 4]
jmp 0x2368a5c1

Function at 0x23695a0f
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
push 1
pop eax
lea esi, [esp + 0x14]
mov ebx, dword [esi]
add esi, 4
test ebx, ebx
je 0x23695a44
mov edi, dword [esi]
add esi, 4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push 1
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
neg eax
sbb eax, eax
inc eax
jne 0x23695a19
pop edi
pop esi
pop ebx
ret

Function at 0x23696602
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push SQLAllocEnv
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x236966be
mov eax, dword [ebp + 0x10]
push edi
push 0
mov ecx, dword [eax]
mov eax, dword [ebp + 0x14]
lea edx, [eax + 0x104]
push edx
lea edx, [eax + 0x11d]
push str.Version
push edx
push str.TypeLib
push dword [ebp + 0xc]
push str.ProgID
push ecx
push str.VersionIndependentProgID
push eax
push str.InprocServer32
push ecx
push 0x236ab748
push dword [ebp - 4]
call fcn.23695a0f
add esp, 0x38
mov dword [ebp + 0x10], eax
lea eax, [ebp + 8]
push eax
push 0x236a5e10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jl 0x236966b3
push esi
mov esi, str.Apartment
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push 0
push 0x236a5e00
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 8]
call edi
pop esi
push dword [ebp - 4]
call edi
mov eax, dword [ebp + 0x10]
pop edi
leave
ret
xor eax, eax
leave
ret
Function at 0x236966c2
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push str.CLSID_sInprocServer32
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0xc
lea eax, [ebp - 0x8c]
mov ebx, SQLAllocEnv
push eax
push ebx
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push str.CLSID_sProgID
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
push ebx
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push str.CLSID_sVersionIndependentProgID
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
push ebx
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push str.CLSID_sTypeLib
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
push ebx
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push str.CLSID_sVersion
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
push ebx
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push str.CLSID_s
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
push ebx
call edi
pop edi
pop esi
pop ebx
leave
ret