joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451e40
Capabilities:
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x270
mov eax, dword [0x4a0088]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21a]
push 0x20a
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x451e92
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
add eax, 0xffffff07
cmp eax, 0xfffffefc
jae 0x451eab
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f7d0
mov eax, ebx
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret
push str.control.exe
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor ebx, ebx
test eax, eax
je 0x451e94
lea esi, [ebp - 0x220]
mov dword [esi], ebx
mov ecx, esi
call fcn.00451c90
mov eax, dword [esi]
mov dword [ebp - 0x278], eax
mov ecx, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
push eax
push ecx
call fcn.00451d80
add esp, 8
lea ecx, [eax + 1]
mov dword [ebp - 0x27c], ecx
lea ecx, [eax + eax]
add ecx, 2
xor esi, esi
dec esi
cmp eax, 0xffffffff
cmovge esi, ecx
push esi
call fcn.0044f117
add esp, 4
push esi
push ebx
mov esi, eax
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp - 0x278]
mov eax, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
push eax
push 0xffffffffffffffff
push dword [ebp - 0x27c]
push esi
call fcn.00451de0
add esp, 0x14
xorps xmm0, xmm0
lea eax, [ebp - 0x264]
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x14], xmm0
movups xmmword [eax + 4], xmm0
mov dword [eax], 0x44
mov dword [eax + 0x2c], 1
mov word [eax + 0x30], 0xa
lea ecx, [ebp - 0x274]
movups xmmword [ecx], xmm0
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
je 0x451fa5
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x274]
call edi
push dword [ebp - 0x270]
call edi
push esi
call fcn.0044f120
add esp, 4
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x451e94
push eax
call fcn.0044f120
add esp, 4
jmp 0x451e94
Function at 0x454bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x4a0088]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x454c62
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x454c62
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x454c60
mov ebx, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, ebx
mov ebx, edx
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push dword [ebp - 0x38]
call edi
cmp eax, 3
je 0x454c76
cmp eax, 1
je 0x454c3c
test eax, eax
jne 0x454c60
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x34]
sub edi, ebx
je 0x454c57
push dword [esi + 0x4c]
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x454c60
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x454c62
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f7d0
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x3d], 0
mov bl, 1
jmp 0x454c62
Function at 0x401ce6
Capabilities:
Encode data using xor

Disassembly:
test byte [eax - 0x71838f05], al
aas
dec ecx
cmp dword [ebx], eax
sbb cl, byte [esi]
sub byte [edi + edi*8], 0x90
scasb al, byte es:[edi]
dec edi
imul ebx, dword [eax], 0xd3f5282a
std
xor ebx, 0xdb5d1dc8
push edi
inc edi
adc eax, edi
inc ecx
or eax, 0x151eb8e2
sbb ah, byte [edx]
cmpsd dword [esi], dword es:[edi]
lahf
jl 0x401ce8
sti
jo 0x401d67
invalid
sub esp, dword [ebx - 0x752ce9ff]
das
imul edx, dword [ebx - 0x346d5bb2], 0xffffffa1
push ss
fxch st(3)
stosd dword es:[edi], eax
popfd
enter 0xffffffffffff93a5, 0x7e
xchg byte [edx], cl
adc cl, byte [edx - 0x30]
sti
invalid
xchg bh, dh
xchg ebp, eax
push edx
push ss
mov es, word [esi + edx*2 - 0xd]
into
push edi
jnp 0xdec3e57b
add dword [edi + eax - 0x3e4e5378], 0x4c
jo 0x401dc7
jmp 0x134e25a4
push cs
adc edx, dword [edx + edx*2 + 0x786ee40b]
jne 0x401dd4
imul ecx, dword [edx - 0x53], 0xe5450831
jle 0x401da0
pop esp
sub dword [ebp + 0x60cc4efa], 0x2585f9fe
pushal
fiadd word [ebx + 0xf6f19aa]
stc
test dword [0xaa83de60], esp
sbb dword [edi + 0xf], ebp
pushfd
push cs
loope 0x401db3
lgs eax, [ebx]
in al, dx
or edx, dword [edi - 0x22]
stc
push edi
fdivp st(1)
lcall 0xaf75, 0x88fb0657
dec esi
add dword [edx + 0x3c], 0xffffffb1
das
inc eax
mov bl, 0x45
sbb eax, 0x5176096e
outsb dx, byte [esi]
or dword [esi + 0x51], esi
jne 0x401d85
adc eax, 0xd767d5c5
add eax, 0x361df3a6
shl dword [ecx - 0x33c43fdb], 1
sbb eax, 0x25a1d136
sar byte [ebx], 0xcc
pop ebx
add eax, 0x54618df1
arpl word [ebp - 0x600b5cb4], dx
dec edi
or byte [ebp + 0x2beb64d9], dl
inc edi
add edi, 0x42b9083c
add eax, 0xc06c0314
leave
pop esi
mov dh, 0xac
push edi
out 0x8f, eax
dec esi
test al, 0x63
jbe 0x401e15
mov dl, 0xe0
adc al, 1
scasd eax, dword es:[edi]
push es
sbb esi, edx
sub byte [esi + 0x5223660c], 0xef
and edx, dword [edx - 0x11]
mov dl, 0xc8
sal dword [ebp + 0x64], 1
fsubr qword [esi - 0x5c4dc875]
or ecx, dword cs:[edi]
scasd eax, dword es:[edi]
cdq
push esp
lcall 0x48b8, 0xa127bfcc
hlt
Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401029
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401021
cmp al, 0x22
jne 0x401015
cmp byte [esi], 0x22
jne 0x401033
inc esi
jmp 0x401033
cmp al, 0x20
jle 0x401033
inc esi
cmp byte [esi], 0x20
jg 0x40102d
mov al, byte [esi]
test al, al
je 0x40103d
cmp al, 0x20
jle 0x401026
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00402aca
push 0x404004
push section..data
call fcn.00402ab0
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40106d
movzx eax, word [ebp - 0x14]
jmp 0x401070
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00402ae2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4012a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x404280], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.trast
push str.bask
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4012e8
xor eax, eax
jmp 0x401303
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, esp
lodsb al, byte [esi]
js 0x401e9d
mov esi, dword [ebp + 0xc]
push esi
lea eax, [ebp + 0x19]
sar byte [eax + 0x50], 1
push esi
call fcn.004086e0
mov ecx, dword [ebp + 8]
mov edx, dword [0x40c0a9]
push eax
push ecx
and dword [ebx - 0x2b53979c], 0x40
add byte [edx - 1], dl
adc eax, 0x40c12f
fisubr dword [esi + edx*2 - 0x3b7cff52]
adc al, 0x85
sal byte [edi + ecx + 0x50], 0x68
and dl, dl
inc eax
sub byte [ebp + edx + 0x30], 0xc1
inc eax
add byte [ebx - 0xa9693c], al
adc eax, 0x40c187

Function at 0x4066b9
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x4066bb
ret

Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
in eax, 8
ret
push ebp
mov esp, ebx
push esi
in al, dx
adc al, 0x83
jge 0x407f09
dec edi
jl 0x407f03
mov dword [ebp + 0x10], 0x4e
fld qword [ebp + 8]
cmpsb byte [esi], byte es:[edi]
in al, dx
xor dl, al
frstor dword [edx]
mov esi, dword [eax]
sbb byte [ebx - 0x75], dl
pop ebp
and byte [esi + 0x33], dl
not byte [edi - 0x21]
loopne 0x407f59
ret 0x22dd
jne 0x407ebb
mov dword [ecx], esi
test ah, 0x8c
mov edi, ebx
invalid
jnp 0x407fcd
lea esi, [ebx + 0x50]
out 0xf3, al
jbe 0x407fb9
fucom st(1)
in al, dx
fcomp qword [0x40c230]
loopne 0x407f64
les eax, [ebx + edi*2 + 0x48]
fld qword [ebp - 0x14]
and al, 0xd
adc dl, cl
inc eax
add byte [ebp - 0x6e0f20bb], cl
in al, dx
or byte [ecx], bl
sbb al, 0x24
call dword [0x40c19e]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x8c342]
xor ah, al
or al, 0x4e
fmul qword [eax + eax - 0x17ffe53d]
fidiv dword [0x5d770000]
and byte [ecx + 0x4c82a30], dh
push cs
mov ecx, dword [ebp - 4]
inc ecx
cmp ebp, dword [edx]
mov dword [ebp - 4], ecx
stosb byte es:[edi], al
test al, 0x2a
inc ebx
sar dword [ebx], cl
adc ecx, dword [esp + ebx*2 + 0x170d16b2]
inc edi
inc esi
cmp esi, eax
salc
imul bl
push eax
fld qword [ebp - 0x75]
fcomp qword [0x40c230]
fnstsw ax
and eax, 0x4100
jne 0x40801d
fld qword [ebp + 8]
fmul qword [0x40c2f8]
fst qword [ebp - 0xc]
fld st(0)
fcomp qword [0x40c228]
fnstsw ax
test ah, 0x5b
jp 0x40801b
xor dl, byte [ebp + 8]
fmul qword [0x7d40c2f8]
dec esi
fld st(0)
fcomp qword [0x40c228]
fnstsw ax
test ah, 5
jnp 0x407ffa
int 0x5d
test byte [ecx + 0x2ebfc75], cl
fstp st(0)
imul eax, dword [ebp - 0x3a], 0xffffff8d
xor al, 0x18
mov esp, dword [edx]
sbb al, 0xd
sal byte [ebp + 0x7b], 3
jnp 0x40802e
jne 0x408029
mov esi, ebp
cmc
adc al, 0x36
jae 0x408021
mov eax, dword [ebp + 0x10]
pop edi
neg eax
mov dword [ecx], eax
mov byte [ebx], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov cl, 5
or al, 0x8b
push ss
xor byte [esi - 0x14], dl
jne 0x408795
push eax
and dl, byte [esi - 0x18]
mov dl, 0x1d
add byte [eax - 0x75], bl
invalid
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40b750
Capabilities:
Encode data using xor

Disassembly:
rcl byte [edi + 0x33], 0xff
mov eax, dword [esp + 0x10]
or eax, eax
jge 0x40b770
inc edi
jecxz 0x40b7b3
and al, 0xc
neg eax
neg edx
movsb byte es:[edi], byte [esi]
fadd dword [eax]
mov dword [edi], esi
and al, 0x10
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x18]
or eax, dword [edi + 0x548bd67d]
and al, 0x14
neg eax
neg edx
sbb eax, 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
or eax, eax
cmp bl, byte [ebx]
mov esi, dword [ecx]
adc byte [edx + 0x1024448b], dl
aam 0xd2
div ecx
mov eax, dword [esp + 0xc]
div ecx
mov eax, edx
xor edx, esp
dec edi
jns 0x40b774
jmp 0x40b7fd
adc byte [ebp + 0x7e0c24cb], dh
retf
pop edi
push esp
ret 0x3a
Function at 0x805e54
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805e5a
pop ebp
sub ebp, 6
sub ebp, 0x405e54
jmp 0x805eb8
jmp 0x805ec1
mov eax, 0x405e54
add eax, ebp
add eax, 0x93
mov ecx, 0x635
mov edx, 0x309c151a
xor byte [eax], dl
inc eax
dec ecx
jne 0x805ed8
jmp 0x805eeb
jo 0x805f47
jb 0x805f09
or bl, byte [edx]
sbb dh, byte [edx + 0x1a]
salc
sbb bl, byte ss:[ebx + 0x1a9b58ea]
push 0x9b58ea9b
sbb ch, byte [eax + 0x29]
fimul dword [edx - 0x1b]
invalid
retf
mov ah, 0x3d
sub eax, 0x3e361b1a
jb 0x805f5d
sbb bl, byte [edx]
sbb dh, dl
pop ds
sbb bl, byte [edx]
sbb dh, bl
xor bl, byte [edx]
sbb bl, byte [edx]
dec edi
xchg ecx, eax
not byte [ecx + 0x1a1a129f]
sbb dl, byte [ecx + 0x1a1a168f]
sbb dl, byte [ecx + 0x1a1a0a97]
sbb bl, bl
sbb byte [ebx], ch
sbb bl, byte [edx]
xchg ecx, eax
xchg edi, eax
or bl, byte [edx]
sbb bl, byte [edx]
fcomi st(3)
sbb byte [ebx], ch
sbb byte [ecx + 0x15531ed8], bl
lahf
out dx, al
in eax, 0xe5
in eax, 0x47
fcom dword [esi]
sbb dl, byte [ecx + 0x1a1e3e96]
sbb bl, byte [edx]
jb 0x805f3a
sub al, 0x13
sbb dh, byte [edx - 0x4c]
cmp eax, 0x361b1a2d
dec ebx
dec ebx
pop ds
sbb bl, byte [edx]
sbb dh, bl
push ecx
sbb byte [edx], bl
sbb cl, byte [edi - 0x6f]
mul ch
outsd dx, dword [esi]
push ss
in eax, 0x6f
adc dh, dl
sbb bl, byte fs:[edx]
sbb dl, byte [ecx + 0x1a1a12a7]
sbb bl, byte [ebx - 0x23016815]
adc byte [ebx - 0x23016815], bl
adc byte [ecx], ch
rcr dword [ebx + 0x2b1ff9e8], cl
neg dword [ebx + 0x2b1ff9e8]
imul dword [ecx]
enter 0xfffffffffffff299, 0x1f
push edx
adc eax, 0x1a1a549e
sbb dl, byte [0x1a1a5292]
sbb bh, byte [ecx + edx*4 + 6]
and ebx, dword [edx - 0x61ea0d1f]
add byte [edx], bl
sbb bl, byte [edx]
lcall 0x1a0b, 0x9e15f3e1
sbb bl, byte [edx]
jl 0x805f8a
loope 0x805fd6
aas
adc eax, 0x1a1a0f9e
sbb bl, byte [ebx - 0xd]
salc
in eax, 0xe5
in eax, 0x33
push esi
and ebx, dword [ebx]
cdq
fistp dword [edi]
cdq
push ds
repe cmpsd dword [esi], dword es:[edi]
in eax, 0xe5
in eax, 0x33
dec esi
and ebx, dword [eax]
cdq
fistp dword [ecx + ebx*4]
invalid
Function at 0x230027c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x230027ca
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
ret 0xc

Function at 0x230027f0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x230027fa
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
ret 0xc

Function at 0x23002f50
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
mov eax, dword [ebx + 0x1c]
push edi
cmp eax, 0xffffffff
je 0x23002fa0
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x23002fb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x23002f97
push eax
mov ecx, ebx
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push str.FindNextFile___s___failed_with_0x_08X_error
call dword [sym.imp.Logger.dll_void___cdecl_logError_wchar_t_const__]
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
mov ecx, ebx
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call ebp
mov dword [ebx + 0x1c], eax
cmp eax, 0xffffffff
je 0x2300303c
lea esi, [edi + 0x2c]
mov ecx, 0x23007e70
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x23002fe7
test dx, dx
je 0x23002fe3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x23002fe7
add eax, 4
add ecx, 4
test dx, dx
jne 0x23002fc1
xor eax, eax
jmp 0x23002fec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x23002f60
mov ecx, 0x23007f0c
mov eax, esi
jmp 0x23003000
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x23003026
test dx, dx
je 0x23003022
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x23003026
add eax, 4
add ecx, 4
test dx, dx
jne 0x23003000
xor eax, eax
jmp 0x2300302b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x23002f60
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, ebx
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push 0x23007eb0
call dword [sym.imp.Logger.dll_void___cdecl_logError_wchar_t_const__]
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
Function at 0x230030f0
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x2300678b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x2300d454]
xor eax, esp
mov dword [esp + 0x228], eax
push esi
mov eax, dword [0x2300d454]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24c]
mov ecx, dword [ecx]
mov esi, dword [esp + 0x248]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x258]
lea edx, [esp + 0x3c]
push edx
push eax
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x230031ab
lea eax, [esp + 0x28]
xor edx, edx
push eax
lea ecx, [esp + 0x10]
mov word [esp + 0x232], dx
call fcn.230011d0
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [esp + 0x240], 0
call dword [0x230070fc]
lea ecx, [esp + 0xc]
mov dword [esp + 0x23c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.23005c68
add esp, 0x238
ret 0xc

Function at 0x23003670
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push edi
lea eax, [esp + 0x18]
push eax
push 0
mov edi, ecx
mov edx, dword [edi]
lea ecx, [esp + 0x10]
push ecx
push 0
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2300370f
push ebx
mov ebx, dword [esp + 0x1c]
shr ebx, 1
jne 0x230036b5
mov ecx, dword [esp + 0x20]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
push esi
mov esi, dword [esp + 0x24]
push ebx
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::resize_unsigned_int_]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::begin_void_]
mov ecx, eax
call fcn.23001970
lea ecx, [esp + 0x20]
push ecx
push eax
mov eax, dword [edi]
lea edx, [esp + 0x18]
push edx
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2300370d
dec ebx
push ebx
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0
jne 0x2300370b
push ebx
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::resize_unsigned_int_]
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x23005c68
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2300d454]
jne 0x23005c72
repz ret
jmp fcn.23006169
Function at 0x19d1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x19d11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x19d107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x19d106a
add dl, dl
jne 0x19d1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x19d10dc
xor eax, eax
add dl, dl
jne 0x19d1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x19d117d
add dl, dl
jne 0x19d10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19d10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19d10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19d10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x19d10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x19d1075
mov eax, 1
add dl, dl
jne 0x19d10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19d10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x19d10e1
sub eax, ebx
mov ebx, 1
jne 0x19d1128
mov ecx, 1
add dl, dl
jne 0x19d110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x19d1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x19d1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x19d1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x19d113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x19d114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x19d1136
cmp eax, 0x7d00
jae 0x19d116d
cmp eax, 0x500
jb 0x19d1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x19d1075
cmp eax, 0x7f
ja 0x19d1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x19d1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x19d119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x19d1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x40893d
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
mov esi, esi
add esi, 0x3491ce04
call fcn.00408978
sub eax, 0xe872d549
mov eax, eax
xor dword [ebx], ecx
sub esi, eax
inc ebx
sub esi, 0xca87aac6
add eax, 0xa32a35be
cmp ebx, edx
jne fcn.0040893d
mov eax, 0x59cd4ae0
add eax, 0x537b8f64
ret