joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418ec6
Capabilities:
Get common file path
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3100
call fcn.0042dc00
mov eax, dword [0x6041f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x104
mov dword [ebp - 0x3100], ecx
push esi
xor ebx, ebx
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.00444fb0
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00444fb0
add esp, 0x18
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movsx eax, byte [ebp - 0x108]
push eax
push str.._c:
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040a3f9
add esp, 0x10
lea eax, [ebp - 0x20c]
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x418f59
mov al, 1
jmp 0x41906b
push edi
push 0x2710
lea eax, [ebp - 0x30ec]
mov dword [ebp - 0x30fc], ebx
push ebx
push eax
call fcn.00444fb0
mov edi, 0x3e8
lea eax, [ebp - 0x9dc]
push edi
push ebx
push eax
call fcn.00444fb0
push edi
lea eax, [ebp - 0x5f4]
push ebx
push eax
call fcn.00444fb0
xor eax, eax
lea edi, [ebp - 0x30f8]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x30fc]
push eax
push 0x2710
lea eax, [ebp - 0x30ec]
mov dword [ebp - 0x30f8], ebx
push eax
push 0xc
lea eax, [ebp - 0x30f8]
mov dword [ebp - 0x30f4], ebx
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x418fe1
mov bl, 2
jmp 0x419061
lea eax, [ebp - 0x5f4]
push eax
push ebx
push dword [ebp - 0x30dc]
lea eax, [ebp - 0x30ec]
push eax
call fcn.0041907b
lea eax, [ebp - 0x9dc]
push eax
push 1
push dword [ebp - 0x30d4]
lea eax, [ebp - 0x30ec]
push eax
call fcn.0041907b
lea ecx, [ebp - 0x5f4]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419022
mov edi, dword [ebp - 0x3100]
lea eax, [ebp - 0x5f4]
sub ecx, edx
push ecx
push eax
mov ecx, edi
call fcn.0041a506
lea edx, [ebp - 0x9dc]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x419049
sub edx, ecx
lea eax, [ebp - 0x9dc]
push edx
push eax
mov ecx, edi
call fcn.0041a506
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d205
mov esp, ebp
pop ebp
ret
Function at 0x419200
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
push edi
push 2
mov byte [ebp - 1], dl
lea ecx, [ebx + 2]
pop edi
mov ax, word [ebx]
add ebx, edi
cmp ax, dx
jne 0x419216
sub ebx, ecx
xor ecx, ecx
sar ebx, 1
lea esi, [ebx + 1]
mov eax, esi
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042dbe8
push esi
mov edi, eax
push 0
push edi
call fcn.00402914
push dword [ebp + 8]
push esi
push edi
call fcn.00452e28
add esp, 0x1c
xor esi, esi
movzx eax, word [edi + esi*2]
cmp eax, 0x5c
je 0x419262
cmp eax, 0x2f
jne 0x41929e
mov dword [ebp - 8], eax
xor eax, eax
push edi
mov word [edi + esi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x419297
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4192a5
mov eax, dword [ebp + 0xc]
mov byte [ebp - 1], 1
cmp dword [eax + 0x24], 0
je 0x419297
push edi
mov ecx, eax
call fcn.004191e3
mov eax, dword [ebp - 8]
mov word [edi + esi*2], ax
inc esi
cmp esi, ebx
jbe 0x419254
jmp 0x4192a9
mov byte [ebp - 1], 0
push edi
call fcn.0042db05
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419350
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6041f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
push edi
push eax
call fcn.00444fb0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0xc]
or eax, 0x8000
cmp byte [ebp + 0x10], 0
push edi
cmove eax, dword [ebp + 0xc]
push edi
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x4193b5
xor eax, eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x4193c3
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00404305
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0042d205
mov esp, ebp
pop ebp
ret
Function at 0x419418
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push edi
je 0x4194c8
cmp dword [ebp + 0xc], 0
je 0x4194c8
push 0
push 0x80
push 3
push 0
push 5
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41945d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4194cb
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 8], edi
cmp edi, 0xffffffff
je 0x419455
jb 0x419479
push 8
pop eax
jmp 0x4194cb
push esi
mov esi, eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x419485
mov dword [eax], edi
inc esi
push esi
call fcn.0042dbe8
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
push esi
push eax
mov dword [ecx], eax
call fcn.00444fb0
add esp, 0x10
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
push esi
push eax
mov eax, dword [ebp + 0xc]
push edi
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
test eax, eax
je 0x419455
cmp dword [ebp + 8], edi
jne 0x4194c8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4194cb
xor eax, eax
inc eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4194d1
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0x10], ebx
je 0x4195f4
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], ebx
je 0x4195f3
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x4194fe
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4195f3
push 0x593582
push eax
call fcn.0042dfa7
mov dword [ebp + 8], eax
pop ecx
pop ecx
test eax, eax
je 0x4195f3
cmp dword [esi + 0x14], 0x10
jb 0x419533
mov esi, dword [esi]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4195dd
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
push dword [ebp + 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4195dd
mov eax, dword [ebp - 0x14]
push 0x593582
push 0x80
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 0xc], ecx
call fcn.0042dfa7
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4195df
cmp dword [edi + 0x14], 0x10
jb 0x419592
mov edi, dword [edi]
push edi
push dword [ebp - 0xc]
push str.StringFileInfo_08lx_s
push 0x80
push esi
call fcn.0040a3f9
add esp, 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4195d9
mov ecx, dword [ebp - 4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4195c4
sub ecx, edx
push ecx
push dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
call fcn.0040679a
mov bl, 1
jmp 0x4195df
mov esi, ebx
push dword [ebp + 8]
call fcn.0042db05
pop ecx
test esi, esi
je 0x4195f3
push esi
call fcn.0042db05
pop ecx
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4195fc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
test eax, eax
je 0x41965f
xor edi, edi
cmp word [eax], di
je 0x41965f
push edi
push 0x80
push 2
push edi
push edi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x419635
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x419654
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x419662
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x419d2e
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x41a6f8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x6041f8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x41a717
xor eax, eax
jmp 0x41a784
push ebx
push esi
mov ebx, 0x22c
lea eax, [ebp - 0x230]
push ebx
push 0
push eax
call fcn.00444fb0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x41a780
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], ebx
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x41a775
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0045b16f
pop ecx
pop ecx
test eax, eax
je 0x41a793
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41a755
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0042d205
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x228]
jmp 0x41a782
Function at 0x41ae63
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x6c
mov eax, 0x589376
call fcn.0042d9c2
mov esi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
mov edx, dword [ebp + 0x18]
test edx, edx
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x74], eax
mov eax, 0x5f5dc4
cmovne eax, edx
mov dword [ebp - 0x78], ebx
push eax
call fcn.00404305
xor ecx, ecx
add esi, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
cmp dword [esi + 0x10], ecx
ja 0x41aed1
lea eax, [ebp - 0x58]
push eax
call fcn.0041a52d
pop ecx
push eax
mov ecx, esi
call fcn.0040682c
lea ecx, [ebp - 0x58]
call fcn.00406942
xor ecx, ecx
cmp dword [esi + 0x14], 8
jb 0x41aed9
mov esi, dword [esi]
lea eax, [ebp - 0x5c]
push eax
push 0x20119
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x41af0d
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
mov ecx, edi
call fcn.00404305
jmp 0x41b03c
lea eax, [ebp - 0x6c]
push eax
push 0x20119
push 0
push 0x58f348
push dword [ebp - 0x5c]
call esi
test eax, eax
je 0x41af3d
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
jmp 0x41af01
lea eax, [ebp - 0x68]
push eax
push 0x20119
push 0
push dword [ebp - 0x70]
push dword [ebp - 0x6c]
call esi
test eax, eax
je 0x41af66
push dword [ebp - 0x6c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x5c]
call esi
jmp 0x41af2f
lea eax, [ebp - 0x64]
push eax
push 0x20119
push 0
push dword [ebp - 0x74]
push dword [ebp - 0x68]
call esi
test eax, eax
je 0x41af8d
push dword [ebp - 0x64]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x68]
jmp 0x41af5d
lea eax, [ebp - 0x28]
xor esi, esi
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
call fcn.004065a8
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 1
push eax
push esi
push esi
push esi
push ebx
push dword [ebp - 0x64]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x60], esi
call ebx
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x41b00f
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x60], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042dbe8
push dword [ebp - 0x60]
mov esi, eax
push 0
push esi
call fcn.00444fb0
add esp, 0x10
lea eax, [ebp - 0x60]
push eax
push esi
push 0
push 0
push dword [ebp - 0x78]
push dword [ebp - 0x64]
call ebx
test eax, eax
jne 0x41b008
push esi
lea ecx, [ebp - 0x40]
call fcn.004042de
push esi
call fcn.0042db05
pop ecx
push dword [ebp - 0x64]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x68]
call esi
push dword [ebp - 0x6c]
call esi
push dword [ebp - 0x5c]
call esi
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.004044d6
lea ecx, [ebp - 0x40]
call fcn.00406942
lea ecx, [ebp - 0x28]
call fcn.00406942
mov eax, edi
call fcn.0042d96c
ret 0x14
Function at 0x41b04e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x6041f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
cmp dword [esi + 0x14], ebx
ja 0x41b0a6
lea eax, [ebp - 0x1c]
push eax
call fcn.0041a52d
pop ecx
lea ecx, [esi + 4]
push eax
call fcn.0040682c
lea ecx, [ebp - 0x1c]
call fcn.00406942
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x41b0b1
mov eax, dword [eax]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x20]
push ecx
push 0xf013f
push ebx
push eax
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x41b0d4
xor al, al
jmp 0x41b18d
lea eax, [ebp - 0x24]
push eax
push 0xf013f
push ebx
push 0x58f348
push dword [ebp - 0x20]
call esi
test eax, eax
je 0x41b0f7
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41b0cd
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x41b129
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x20]
call esi
jmp 0x41b0cd
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41b17c
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41b14e
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call esi
mov bl, 1
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d205
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41b381
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x41b393
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x41b3d8
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], 0
pop esi
pop ebx
ret

Function at 0x41b44c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea edx, [ecx + 8]
mov esi, 0x270
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x41b455
pop esi
ret

Function at 0x41b48d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul edx, dword [ebp + 0xc]
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x41b4a4
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x41c431
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x6041f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x20c]
push 0
mov dword [ebp - 0x220], edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x21c], esi
call fcn.00444fb0
add esp, 0xc
mov ebx, 0x20019
lea eax, [ebp - 0x210]
push eax
push ebx
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x41c4f6
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x218]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41c4ea
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push dword [ebp - 0x218]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x41c51b
cmp edi, reloc.WS2_32.dll_bind
jne 0x41c51b
cmp ebx, 0x20019
jne 0x41c51b
mov esi, dword [ebp - 0x21c]
mov ebx, 0x20119
jmp 0x41c480
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push eax
call fcn.00404305
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x220]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0042d205
mov esp, ebp
pop ebp
ret
Function at 0x41d88b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 4], 0
je 0x41d8bb
push esi
xor esi, esi
cmp dword [edx + 0x3cc], esi
jle 0x41d8ba
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, ecx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
inc esi
cmp esi, dword [edx + 0x3cc]
jl 0x41d8aa
pop edi
pop esi
pop ebp
ret 8

Function at 0x41dab1
Capabilities:
Encode data using base64

Disassembly:
push 0x10
mov eax, 0x589542
call fcn.0042d98e
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], 0xf
mov byte [eax], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 1
cmp dword [ebp + 0x10], ebx
je 0x41dc3c
mov eax, dword [ebp + 0x10]
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + edi - 0x14], al
inc edi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x41db82
mov esi, dword [ebp + 8]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
cmp dword [0x604084], 0x10
mov ecx, 0x604070
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x604070]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.0040a38e
inc edi
cmp edi, 4
jl 0x41db4a
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x41daec
mov dword [ebp + 0x10], edi
test edi, edi
je 0x41dc39
mov eax, edi
cmp edi, esi
jge 0x41dbb8
cmp eax, esi
jae 0x41dc42
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x41dba0
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x41dc24
mov esi, dword [ebp + 8]
mov edi, eax
cmp dword [0x604084], 0x10
mov ecx, 0x604070
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x604070]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.0040a38e
inc ebx
cmp ebx, edi
jl 0x41dbf5
mov edi, dword [ebp + 0x10]
push 3
pop esi
cmp edi, esi
jge 0x41dc39
sub esi, edi
mov ecx, dword [ebp + 8]
push 0x3d
call fcn.0040a38e
sub esi, 1
jne 0x41dc2a
mov eax, dword [ebp + 8]
call fcn.0042d957
ret
call fcn.0042e0d5
int3
Function at 0x4293d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a110
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x6041f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x67
push 0x6f
push 0x6c
push 0x74
push 0x6e
push 0x65
push 0x74
push 0x6e
push 0x6f
push 0x43
push 0x70
push 0x74
push 0x74
push 0x48
push 0x77
push 0x6f
push 0x68
push 0x53
push str._c_c_c_c_c_c_c_c_c_c_c_c_c_c_c._c_c_c
lea eax, [ebp - 0x28]
push eax
call fcn.0040d6ae
add esp, 0x50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040631b
mov byte [ebp - 4], 1
push 0x58e754
lea ecx, [ebp - 0x40]
call fcn.004071bd
push 0x58e758
lea ecx, [ebp - 0x40]
call fcn.004071bd
push 0x58e62c
lea ecx, [ebp - 0x40]
call fcn.004071bd
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.0040b2bd
lea ecx, [ebp - 0x40]
call fcn.004045b2
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x429492
mov byte [ebp - 0x82], 1
jmp 0x429499
mov byte [ebp - 0x82], 0
mov al, byte [ebp - 0x82]
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040699b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040699b
mov al, byte [ebp - 0x81]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042d205
mov esp, ebp
pop ebp
ret