joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10094cc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10094e68
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x280]
call eax
test al, al
je 0x10094e68
mov eax, dword [0x100f8ae8]
cmp dword [eax + 0x174], 0xffffffff
je 0x10094e68
cmp byte [0x100d472c], 0
je 0x10094d0a
mov byte [0x100cb750], 1
mov eax, dword [0x100f8db4]
add eax, 0xffffff8c
xor eax, 0x7967ef5e
cmp dword [eax + ebx], 0
mov eax, dword [0x100f8d7c]
setle cl
add eax, 0xffffff9a
xor eax, 0x7967ef50
xor edi, edi
mov byte [eax + ebx], cl
mov eax, dword [0x100f8d70]
add eax, 0xffffff9d
xor eax, 0x7967ef4d
mov dword [eax + ebx + 0xc], 0
mov eax, dword [0x100f8d74]
add eax, 0xffffff9c
xor eax, 0x7967ef4e
mov dword [eax + ebx + 0xc], 0
mov ecx, dword [0x100f8d78]
lea eax, [ecx - 0x65]
xor eax, 0x7967ef4f
mov edx, dword [eax + ebx + 0xc]
mov dword [ebp - 4], edx
test edx, edx
je 0x10094dbe
lea eax, [ecx - 0x65]
xor eax, 0x7967ef4f
mov eax, dword [eax + ebx]
mov esi, dword [eax + edi*4]
lea ebx, [eax + edi*4]
test esi, esi
je 0x10094db6
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x10094daa
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x10094da7
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov edx, dword [ebp - 4]
mov dword [ebx], 0
mov ecx, dword [0x100f8d78]
mov ebx, dword [ebp + 8]
inc edi
cmp edi, edx
jb 0x10094d73
lea eax, [ecx - 0x65]
xor eax, 0x7967ef4f
lea ecx, [ebx + 8]
push 0
mov dword [eax + ebx + 0xc], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [0x100f8afc]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10094e52
nop dword [eax]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [ecx + esi], 0
jne 0x10094e16
xor edx, edx
test ecx, ecx
je 0x10094e3c
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10094e23
cmp edi, 0x79705c5e
je 0x10094e47
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10094e52
mov ecx, dword [ebp - 4]
jmp 0x10094e00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + ebx*4]
jmp 0x10094e54
xor ecx, ecx
push 0
push dword [ebp + 8]
push 0
call dword [0x100f8be0]
mov byte [0x100cb750], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100aad00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.100ab570
mov edx, dword [eax + 4]
test edx, edx
je 0x100aada7
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x100aad7c
cmp eax, edx
jne 0x100aad74
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100aad84
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x100aad84
cmp eax, edx
jne 0x100aad84
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [edi + 8]
mov eax, dword [edx + 4]
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.1002e1e0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100aae30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x1c
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp edx, edi
jne 0x100aae4e
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x1c], esi
xor ecx, eax
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [esi + eax*8]
mov dword [ebp - 0x10], ecx
lea eax, [esi + eax*8]
mov esi, dword [edx]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.1002e1e0
dec dword [ebx + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0xc]
je 0x100aaede
nop dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x100aaeed
mov edx, esi
mov esi, dword [esi]
call fcn.1002e1e0
dec dword [ebx + 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x18], eax
jne 0x100aaec0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x10], eax
jne 0x100aaf0d
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x100aaf10
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x100aaefa
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
cmp esi, edi
je 0x100aaefa
nop word [eax + eax]
movzx eax, byte [esi + 8]
mov edx, esi
xor eax, 0x811c9dc5
mov edi, esi
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
mov esi, dword [esi]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
call fcn.1002e1e0
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
je 0x100aaf9a
nop word [eax + eax]
mov eax, dword [ebp + 0xc]
mov edi, esi
cmp esi, eax
je 0x100aafc3
mov edx, esi
mov esi, dword [esi]
call fcn.1002e1e0
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
jne 0x100aaf80
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
cmp esi, edi
jne 0x100aaf20
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100ab5e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7ab5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100cb040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100ab570
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100ab66a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100ab7b0
cmp dword [ebx + 8], 0xfffffff
jne 0x100ab67e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100adb42
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c07a0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100c07a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100ab763
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100aedb0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100ab745
cmp eax, 0x200
jae 0x100ab743
shl eax, 3
cmp eax, ecx
jae 0x100ab745
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10047d20
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100ab570
mov edx, dword [eax]
jmp 0x100ab766
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100ab791
mov dword [ecx + eax*8], esi
jmp 0x100ab7a3
cmp ebx, edx
jne 0x100ab79a
mov dword [ecx + eax*8], esi
jmp 0x100ab7a7
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100ab7a7
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100abc70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7ab5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100cb040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100ab570
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100abcfa
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100abe42
cmp dword [ebx + 8], 0xfffffff
jne 0x100abd0e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100adb42
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c07a0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100c07a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100abdf5
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100aedb0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100abdd7
cmp eax, 0x200
jae 0x100abdd5
shl eax, 3
cmp eax, ecx
jae 0x100abdd7
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10047d20
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100ab570
mov edx, dword [eax]
jmp 0x100abdf8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100abe23
mov dword [ecx + eax*8], esi
jmp 0x100abe35
cmp ebx, edx
jne 0x100abe2c
mov dword [ecx + eax*8], esi
jmp 0x100abe39
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100abe39
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret

Function at 0x407282
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x407291
pop dword [ebp - 8]
mov eax, 0x407291
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xe921759f
sub dword [ebp - 0x18], 0x9acf3054
mov dword [ebp - 0x14], 0x8d272eda
add dword [ebp - 0x14], 0xa50c1d6b
mov dword [ebp - 0x10], 0x6fe33754
sub dword [ebp - 0x10], 0x2396f326
mov dword [ebp - 0xc], 0x9e22334b
add dword [ebp - 0xc], 0x61ddccb5
lea eax, [ebp - 0x18]
push eax
mov eax, 0xc7e63f0c
add eax, 0x385a9128
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xf6bb1d12
sub dword [ebp - 0x18], 0x8248b3bc
mov dword [ebp - 0x14], 0x21917e44
sub dword [ebp - 0x14], 0xe0251ccf
mov dword [ebp - 0x10], 0x5297fc1b
sub dword [ebp - 0x10], 0xef288faf
mov dword [ebp - 0xc], 0xa29768c4
sub dword [ebp - 0xc], 0xa29768c4
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x37fc5
push 0
call eax
mov ecx, 0x3041be56
add ecx, 0xcfbe863b
mov esi, eax
mov edi, 0x3e4e8f41
sub edi, 0x3e0c7f41
add edi, dword [ebp - 8]
mov ebx, 0x556c17aa
sub dword [ebp - 4], 0x1ceb92fb
mov edx, dword [edi]
xor dword [ebp - 4], ebx
sub edx, ebx
sub dword [ebp - 4], ecx
mov dword [esi], edx
mov dword [ebp - 4], 0x46cc11a3
add esi, 4
add edi, 4
loop 0x4073a3
add eax, 0xcee536fc
add eax, 0x311bce1b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xccea569f
sub ecx, 0xccaa569f
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10008ec6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1000bb8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000bb9a
pop dword [ebp - 0x28]
mov eax, 0xacbc0cd0
add eax, 0x6344aeca
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x38832
push 0
mov eax, 0x3de21d9b
sub eax, 0x2de14c93
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x2d073cc9
add ecx, 0xd2f90fc3
mov edi, eax
mov esi, 0x3850a073
add esi, 0xd7b1738d
add esi, dword [ebp - 0x28]
mov ebx, 0x9095ac46
add dword [ebp - 8], ebx
mov edx, dword [esi]
sub dword [ebp - 0xc], 0xc6d11837
xor edx, ebx
xor dword [ebp - 0x18], edi
mov dword [edi], edx
mov dword [ebp - 0x20], 0x5b2bf0e1
add edi, 0x8e9daff2
add edi, 0x71625012
add esi, 0xc1e637b
add esi, 0xf3e19c89
loop 0x1000bbf3
add eax, 0xd040ae28
sub eax, 0xd03f8925
mov ebx, eax
add eax, 0x61cadeac
sub eax, 0x61cadea7
mov ecx, 0x1ff7a2e5
add ecx, 0xf0085d1b
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040a7e3
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040a7e3
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040a7e3
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040a7e3
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040a7e3
mov dword [0x41203c], eax
call fcn.0040a7e3
test eax, eax
jge 0x402550
push 8
call fcn.0040a7e3
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040a7e3
pop ecx
push 1
call fcn.0040a7e3
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040a7e3
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040a7e3
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040a7e3
jmp 0x402495

Function at 0x40a7e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40a7f2
pop dword [ebp - 0x28]
mov eax, 0x40a7f2
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x37abf
push 0
mov eax, 0xa0d5aa17
sub eax, 0xa094c93f
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x41da
mov edx, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x28]
mov esi, 0x11f423d4
mov ebx, dword [edi]
add dword [ebp - 0x1c], 0xdfa848b6
xor ebx, esi
mov dword [edx], ebx
sub dword [ebp - 0x10], 0x5d0e675a
add edx, 4
add edi, 4
loop 0x40a83a
add eax, 0xfa3b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1082d5e6
sub ecx, 0x1042d5e6
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40c279
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40c288
pop dword [ebp - 0x24]
mov eax, 0x40c288
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xd299de93
sub dword [ebp - 0x34], 0x84479948
mov dword [ebp - 0x30], 0xb1a5abac
sub dword [ebp - 0x30], 0x7f725f67
mov dword [ebp - 0x2c], 0xe3a22f30
sub dword [ebp - 0x2c], 0x9755eb02
mov dword [ebp - 0x28], 0x58908b6a
sub dword [ebp - 0x28], 0x58908b6a
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xf8db8631
sub dword [ebp - 0x34], 0x84691cdb
mov dword [ebp - 0x30], 0xb92c33b9
sub dword [ebp - 0x30], 0x77bfd244
mov dword [ebp - 0x2c], 0x954acee
sub dword [ebp - 0x2c], 0xa5e54082
mov dword [ebp - 0x28], 0x5d86cc67
sub dword [ebp - 0x28], 0x5d86cc67
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x59fa8d01
add eax, 0xa647a423
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x40c87
push 0
call eax
mov ecx, 0x4abcdc83
sub ecx, 0x4abc8820
xor ebx, ebx
add ebx, eax
mov esi, 0x6d6b027d
sub esi, 0x6d27be7d
add esi, dword [ebp - 0x24]
mov edi, 0x7beaf04b
add edi, 0x3ef322db
sub dword [ebp - 4], edi
mov edx, dword [esi]
xor edx, edi
sub dword [ebp - 0x20], 0x2c88aa8
mov dword [ebx], edx
sub dword [ebp - 0x20], 0xb2a93902
add ebx, 0x574947a6
add ebx, 0xa8b6b85e
add esi, 0x87b532fe
add esi, 0x784acd06
loop 0x40c3a2
add eax, 0x1445f
mov ebx, eax
add eax, 0x7abf17fa
sub eax, 0x7abf17f5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret