joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4441d4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x444265
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.00443c20
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404024
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x44424f
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x534ee0]
call fcn.00404f7c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x443a90]
call fcn.0040b2f4
call fcn.00403620
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44426c
lea eax, [ebp - 0x10]
call fcn.00403be4
ret

Function at 0x444278
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x444313
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404024
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4442ed
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x535114]
call fcn.00404f7c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x443a90]
call fcn.0040b2f4
call fcn.00403620
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00443c50
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44431a
lea eax, [ebp - 0x10]
call fcn.00403be4
ret

Function at 0x44a01c
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x44a055
mov eax, dword [0x534f4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x44a048
push ebx
push 0x44a05c
call fcn.0042e1e0
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_OpenClipboard
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
pop ebx
ret
Function at 0x44a07c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044a01c
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x44a0ee
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x44a0c2
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00403d98
jmp 0x44a0c9
mov eax, ebx
call fcn.00403be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a0f5
cmp dword [ebp - 8], 0
je 0x44a0e5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.00449ff0
ret

Function at 0x44a0fc
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a1da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044a01c
xor edx, edx
push ebp
push 0x44a1bd
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x44a186
mov edx, ebx
mov eax, dword [0x4170b8]
call fcn.0041b73c
test al, al
je 0x44a176
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0041b610
call fcn.004036c0
jmp 0x44a1c4
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x44a141
lea edx, [ebp - 8]
mov eax, dword [0x534d74]
call fcn.00404f7c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x406bf8]
call fcn.0040b2c0
call fcn.00403620
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a1c4
mov eax, dword [ebp - 4]
call fcn.00449ff0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a1e1
lea eax, [ebp - 8]
call fcn.00403be4
ret

Function at 0x44a1e8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044a01c
xor eax, eax
push ebp
push 0x44a240
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a247
mov eax, dword [ebp - 4]
call fcn.00449ff0
ret
Function at 0x44a250
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044a01c
xor edx, edx
push ebp
push 0x44a2a5
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a2ac
mov eax, dword [ebp - 4]
call fcn.00449ff0
ret

Function at 0x44a31c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044a01c
xor eax, eax
push ebp
push 0x44a391
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00449fd4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0041b710
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x44a37b
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a398
mov eax, dword [ebp - 4]
call fcn.00449ff0
ret

Function at 0x44a3a0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044a01c
xor eax, eax
push ebp
push 0x44a415
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00449fd4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x44a3ff
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a41c
mov eax, dword [ebp - 4]
call fcn.00449ff0
ret
Function at 0x44bbcc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x44bda1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [esi + 0x2c], 0
jne 0x44bd88
mov eax, dword [esi + 0x24]
call fcn.00403e60
test eax, eax
jne 0x44bc21
mov eax, dword [esi + 0x28]
call fcn.00403e60
test eax, eax
jne 0x44bc21
mov eax, esi
call fcn.0044be40
jmp 0x44bd88
cmp dword [esi + 0x94], 0
jne 0x44bc58
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x24]
call fcn.004083ec
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5367c4]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x94], eax
cmp dword [esi + 0x98], 0
jne 0x44bc8f
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x28]
call fcn.004083ec
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5367c4]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.0044be80
mov ebx, eax
test bl, bl
jne 0x44bd3d
mov eax, dword [esi + 0x24]
call fcn.00403e60
test eax, eax
jne 0x44bcc7
mov eax, dword [esi + 0xb0]
call fcn.00403e60
test eax, eax
je 0x44bd3d
mov eax, dword [esi + 0xb0]
call fcn.00403e60
test eax, eax
je 0x44bce9
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0xb0]
call fcn.004083ec
jmp 0x44bd15
push dword [esi + 0x24]
push 0x44bdbc
push dword [esi + 0x28]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00403f20
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.004083ec
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jl 0x44bd3d
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.0044be80
mov ebx, eax
test bl, bl
jne 0x44bd4a
mov eax, esi
call fcn.0044be40
jmp 0x44bd88
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x44bd59
mov dword [esi + 0x9c], eax
jmp 0x44bd63
mov dword [esi + 0x9c], 1
mov eax, esi
call fcn.0044bef8
test al, al
je 0x44bd88
mov eax, esi
mov bx, 0xfff0
call fcn.00403150
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.0044bfa4
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bda8
lea eax, [ebp - 0x108]
call fcn.00403be4
ret
Function at 0x45b2ec
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, 3
cdq
idiv ecx
mov ebx, eax
mov edx, ebx
add edx, 4
mov eax, esi
call fcn.00404190
mov eax, esi
call fcn.00404030
push eax
mov edx, ebx
add edx, 2
xor ecx, ecx
pop eax
call fcn.00402d10
cmp byte [ebp - 1], 0
jne 0x45b35f
mov eax, esi
call fcn.00404030
mov dl, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov al, byte [ebp - 1]
sub al, 1
jb 0x45b378
sub al, 2
jb 0x45b37f
jmp 0x45b384
mov ebx, 2
jmp 0x45b384
mov ebx, 1
mov eax, esi
call fcn.00404030
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x45b466
test edi, edi
jle 0x45b3e0
mov eax, esi
call fcn.00404030
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.00404030
mov byte [eax + ebx - 1], 0
jmp 0x45b45a
test edi, edi
jge 0x45b426
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.00404030
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x45b45a
mov eax, esi
call fcn.00404030
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.00404030
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x45b39c
mov al, byte [ebp - 1]
sub al, 1
jb 0x45b476
sub al, 2
jb 0x45b4af
jmp 0x45b4f6
cmp edi, 2
jne 0x45b47c
dec ebx
mov eax, ebx
sub eax, 2
jl 0x45b4f6
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.00404030
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x532e40]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x45b48c
jmp 0x45b4f6
cmp edi, 2
jne 0x45b4b5
dec ebx
test ebx, ebx
jle 0x45b4f1
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.00404030
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x532e44]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x45b4c1
jmp 0x45b4f1
inc ebx
mov eax, esi
call fcn.00404030
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x45b4e4
mov eax, esi
mov edx, ebx
call fcn.00404190
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45d0fc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45d24f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d22f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00403d88
lea eax, [ebp - 0x118]
mov edx, 0x45d264
call fcn.00403e68
mov eax, dword [ebp - 0x118]
call fcn.00404024
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x45d1a1
lea eax, [ebp - 0x111]
call fcn.004082fc
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00403cc8
jmp 0x45d1a8
mov eax, esi
call fcn.00403be4
cmp bl, 0x61
jae 0x45d1c9
lea edx, [ebp - 0x118]
mov eax, dword [esi]
call fcn.0040beb8
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.00403c7c
jmp 0x45d1e3
lea edx, [ebp - 0x118]
mov eax, dword [esi]
call fcn.0040be2c
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.00403c7c
lea eax, [ebp - 0x118]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0xb
lea edx, [ebp - 0x120]
xor ecx, ecx
mov eax, 0x45d270
call fcn.004089d4
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.00403c7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d236
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x460448
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404024
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x460461
test al, 0x10
jne 0x460465
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x461838
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x310], ecx
mov dword [ebp - 0x314], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x461945
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x144], 0
jne 0x46187c
lea eax, [ebx + 0x144]
mov edx, 0x46195c
call fcn.00403c38
lea eax, [ebp - 0x310]
mov edx, dword [ebx + 0x144]
mov dl, byte [edx + 2]
call fcn.00403d88
mov edx, dword [ebp - 0x310]
lea eax, [ebp - 0x10c]
call fcn.004083ec
push pe_nt_image_headers32
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x10c]
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x46191b
lea ecx, [ebp - 0x310]
movzx eax, word [ebp - 4]
mov edx, 4
call fcn.00407bd8
mov eax, dword [ebp - 0x310]
push eax
mov eax, dword [ebp - 4]
call fcn.00406a80
movzx eax, ax
lea ecx, [ebp - 0x314]
mov edx, 4
call fcn.00407bd8
mov edx, dword [ebp - 0x314]
mov eax, esi
pop ecx
call fcn.00403eac
jmp 0x461927
mov eax, esi
mov edx, 0x461968
call fcn.00403c7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46194c
lea eax, [ebp - 0x314]
mov edx, 2
call fcn.00403c08
ret

Function at 0x46297c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, ecx
mov dword [esp], edx
mov byte [esp + 4], 0
mov ebx, 1
lea eax, [esp + 8]
push eax
mov edx, esi
mov eax, dword [esp + 4]
mov ecx, ebx
call fcn.00405390
cmp ebx, dword [esp + 8]
jne 0x462a1e
xor ebx, ebx
mov bl, byte [esi + 1]
inc ebx
mov edx, ebx
test edx, edx
jl 0x4629c3
inc edx
lea eax, [esi + 1]
mov cl, byte [eax]
xor cl, 0xff
mov byte [eax], cl
inc eax
dec edx
jne 0x4629b8
lea eax, [esp + 8]
push eax
lea edx, [esi + 1]
mov eax, dword [esp + 4]
mov ecx, ebx
call fcn.00405390
cmp ebx, dword [esp + 8]
jne 0x462a1e
xor ebx, ebx
mov bl, byte [esi + 0x101]
inc ebx
mov edx, ebx
test edx, edx
jl 0x4629fd
inc edx
lea eax, [esi + 0x101]
mov cl, byte [eax]
xor cl, 0xff
mov byte [eax], cl
inc eax
dec edx
jne 0x4629f2
lea eax, [esp + 8]
push eax
lea edx, [esi + 0x101]
mov eax, dword [esp + 4]
mov ecx, ebx
call fcn.00405390
cmp ebx, dword [esp + 8]
jne 0x462a1e
mov byte [esp + 4], 1
mov al, byte [esp + 4]
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x462a28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, ecx
mov dword [esp], edx
mov byte [esp + 4], 0
mov eax, ebx
xor ecx, ecx
mov edx, 0x201
call fcn.00402d10
mov esi, 1
lea eax, [esp + 8]
push eax
mov edx, ebx
mov eax, dword [esp + 4]
mov ecx, esi
call fcn.0040532c
cmp esi, dword [esp + 8]
jne 0x462b3b
mov esi, 1
lea eax, [esp + 8]
push eax
lea edx, [ebx + 1]
mov eax, dword [esp + 4]
mov ecx, esi
call fcn.0040532c
cmp esi, dword [esp + 8]
jne 0x462b3b
mov al, byte [ebx + 1]
xor al, 0xff
mov byte [ebx + 1], al
mov esi, eax
and esi, 0xff
lea eax, [esp + 8]
push eax
lea edx, [ebx + 2]
mov eax, dword [esp + 4]
mov ecx, esi
call fcn.0040532c
cmp esi, dword [esp + 8]
jne 0x462b3b
xor edx, edx
mov dl, byte [ebx + 1]
test edx, edx
jle 0x462acc
lea eax, [ebx + 2]
mov cl, byte [eax]
xor cl, 0xff
mov byte [eax], cl
inc eax
dec edx
jne 0x462ac1
mov esi, 1
lea eax, [esp + 8]
push eax
lea edx, [ebx + 0x101]
mov eax, dword [esp + 4]
mov ecx, esi
call fcn.0040532c
mov al, byte [ebx + 0x101]
xor al, 0xff
mov byte [ebx + 0x101], al
mov esi, eax
and esi, 0xff
lea eax, [esp + 8]
push eax
lea edx, [ebx + 0x102]
mov eax, dword [esp + 4]
mov ecx, esi
call fcn.0040532c
cmp esi, dword [esp + 8]
jne 0x462b3b
xor edx, edx
mov dl, byte [ebx + 0x101]
test edx, edx
jle 0x462b36
lea eax, [ebx + 0x102]
mov cl, byte [eax]
xor cl, 0xff
mov byte [eax], cl
inc eax
dec edx
jne 0x462b2b
mov byte [esp + 4], 1
mov al, byte [esp + 4]
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x462e44
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404014
xor eax, eax
push ebp
push 0x462fc7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00463254
test al, al
je 0x462fa9
mov dl, 1
mov eax, dword [0x443ae4]
call fcn.00443c78
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x462f97
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00443d0c
xor ecx, ecx
mov edx, 0x462fe0
mov eax, dword [ebp - 0x10]
call fcn.00443e68
xor eax, eax
push ebp
push 0x462ee0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0x10]
call fcn.00443f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x462eea
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00443d0c
mov edx, 0x462fe0
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.00443e68
xor eax, eax
push ebp
push 0x462f2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0x10]
call fcn.00443f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x462f36
cmp byte [ebp - 5], 0
jne 0x462f4b
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00443d0c
jmp 0x462f58
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00443d0c
mov edx, 0x462fe0
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.00443e68
mov eax, dword [ebp - 4]
cmp byte [eax + 0x25], 0
je 0x462f8d
lea edx, [ebp - 0x14]
mov eax, dword [0x534f4c]
mov eax, dword [eax]
call fcn.00434488
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00444130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x462fa1
mov eax, dword [ebp - 0x10]
call fcn.0040301c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462fce
lea eax, [ebp - 0x14]
call fcn.00403be4
lea eax, [ebp - 0xc]
call fcn.00403be4
ret
Function at 0x46305c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404014
xor eax, eax
push ebp
push 0x46320d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 1
je 0x4631bf
mov eax, dword [ebp - 4]
add eax, 0x28
mov edx, dword [ebp - 8]
call fcn.00403c38
lea eax, [ebp - 0x10]
call fcn.00403be4
mov dl, 1
mov eax, dword [0x443ae4]
call fcn.00443c78
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46319e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.00443d0c
xor ecx, ecx
mov edx, 0x463224
mov eax, dword [ebp - 0xc]
call fcn.00443e68
xor eax, eax
push ebp
push 0x463118
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0044415c
cmp dword [ebp - 0x10], 0
je 0x46310e
mov eax, dword [ebp - 4]
mov byte [eax + 0x24], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46312a
cmp dword [ebp - 0x10], 0
jne 0x463194
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00443d0c
mov edx, 0x463224
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.00443e68
xor eax, eax
push ebp
push 0x463182
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0044415c
cmp dword [ebp - 0x10], 0
je 0x463178
mov eax, dword [ebp - 4]
mov byte [eax + 0x24], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x463194
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4631a8
cmp dword [ebp - 0x10], 0
setne al
mov edx, dword [ebp - 4]
mov byte [edx + 0x25], al
mov eax, dword [ebp - 0xc]
call fcn.0040301c
jmp 0x4631ef
mov eax, dword [ebp - 4]
call fcn.00463254
test al, al
jne 0x4631ef
cmp dword [ebp - 8], 0
je 0x4631ef
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov edx, dword [ebp - 8]
call fcn.00403f70
je 0x4631ef
mov eax, dword [ebp - 4]
add eax, 0x28
mov edx, dword [ebp - 8]
call fcn.00403c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463214
lea eax, [ebp - 0x10]
call fcn.00403be4
lea eax, [ebp - 8]
call fcn.00403be4
ret