joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4082e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x44d1fc], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408329
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x408306
mov dword [edx*4 + 0x44d1f8], eax
inc edx
cmp edx, 0x100
jne 0x4082ff
mov eax, dword [ebp + 8]
not eax
jmp 0x408343
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x44d1f8]
test ebx, ebx
jne 0x408330
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x2c303f5b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x20500526
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0xda1e8b
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push 0x27
push esi
push 0xda1f80
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
mov eax, dword [ebp + 8]
je 0xda3001
and dword [eax], 0
movzx eax, word [esi]
push 2
pop ecx
cmp ax, 0x22
jne 0xda2ff6
nop
nop
nop
nop
nop
nop
add esi, ecx
movzx eax, word [esi]
test ax, ax
je 0xda1ee0
cmp ax, 0x22
jne 0xda1ed0
cmp word [esi], 0x22
jne 0xda1ee8
add esi, ecx
movzx eax, word [esi]
test ax, ax
je 0xda1ef6
cmp ax, 0x20
jbe 0xda1ee6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
inc edi
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0xda1f4e
push esi
push edi
push ebx
call fcn.00da20e3
test eax, eax
jl 0xda1f4e
push 0xda1f74
push edi
push ebx
call fcn.00da1fd5
test eax, eax
jne 0xda1f1e
push 0xda1f68
push edi
push ebx
call fcn.00da1fd5
test eax, eax
jne 0xda1f1e
push 0xda1f58
push edi
push ebx
call fcn.00da1fd5
test eax, eax
jne 0xda1f1e
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
cmp ax, 0x20
ja 0xda300f
jmp 0xda1ee8
mov dword [eax], 1
add esi, 0x4e
jmp 0xda1eba
add esi, ecx
cmp word [esi], 0x20
ja 0xda300f
jmp 0xda1ee8
Function at 0xda27bb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
test byte [0xdac074], 1
push esi
push edi
mov esi, 0xdac1fc
jne 0xda27ec
or dword [0xdac074], 1
mov ecx, esi
call fcn.00da1c03
push 0xda171b
call fcn.00da2324
pop ecx
lea eax, [ebp - 0x14]
xor edi, edi
push eax
mov ecx, esi
mov dword [ebp - 0x14], edi
call fcn.00da2695
cmp eax, edi
mov dword [ebp - 0x20], eax
jl 0xda297d
test byte [0xdac074], 2
push ebx
mov ebx, 0x80000002
jne 0xda284f
or dword [0xdac074], 2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push 0x10
push 0xda2a24
push 0xda2998
push ebx
mov dword [ebp - 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
je 0xda3b56
mov byte [0xdac045], 0
cmp byte [0xdac045], 0
jne 0xda2986
cmp dword [ebp + 0x14], edi
mov dword [ebp + 0x14], edi
jne 0xda2986
cmp byte [0xdac044], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0xda2ac8
jne 0xda2893
lea eax, [ebp - 4]
push eax
push 1
push 0
push edi
push ebx
call esi
test eax, eax
je 0xda2897
mov byte [0xdac044], 1
and dword [ebp - 4], 0
cmp byte [0xdac043], 0
jne 0xda28c1
cmp dword [ebp + 0x14], 0
jne 0xda28c1
lea eax, [ebp - 8]
push eax
push 1
push 0
push edi
push 0x80000001
call esi
test eax, eax
je 0xda28c5
mov byte [0xdac043], 1
and dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
push 1
push 0
mov edi, 0xda2a50
push edi
push ebx
call esi
test eax, eax
jne 0xda3b6c
cmp byte [0xdac042], 0
jne 0xda2908
cmp dword [ebp + 0x14], 0
jne 0xda2908
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push edi
push 0x80000001
call esi
test eax, eax
je 0xda290c
mov byte [0xdac042], 1
and dword [ebp - 0xc], 0
and dword [ebp + 0x14], 0
cmp dword [ebp - 4], 0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
jne 0xda3b75
cmp dword [ebp - 8], 0
jne 0xda3b8f
cmp dword [ebp - 0xc], 0
jne 0xda3ba9
cmp dword [ebp - 0x10], 0
je 0xda2955
lea eax, [ebp + 0x14]
push eax
push edi
push ebx
push dword [esi]
push dword [ebp - 0x10]
call fcn.00da2b51
test al, al
jne 0xda3bc1
cmp dword [0xdac1fc], 0xffffffff
je 0xda3bc6
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0x10]
call esi
push dword [ebp - 0xc]
call esi
pop ebx
mov eax, dword [ebp - 0x20]
pop edi
pop esi
leave
ret 0x10
mov dword [ebp + 0x14], 1
jmp 0xda2868
cmp dword [ebp - 0x1c], 1
jne 0xda2848
mov byte [0xdac045], 1
jmp 0xda2986
and dword [ebp - 0x10], 0
jmp 0xda28de
lea eax, [ebp + 0x14]
push eax
push edi
push ebx
push dword [esi]
push dword [ebp - 4]
call fcn.00da934a
test al, al
je 0xda2923
jmp 0xda3bc1
lea eax, [ebp + 0x14]
push eax
push edi
push ebx
push dword [esi]
push dword [ebp - 8]
call fcn.00da934a
test al, al
je 0xda292d
jmp 0xda3bc1
lea eax, [ebp + 0x14]
push eax
push edi
push ebx
push dword [esi]
push dword [ebp - 0xc]
call fcn.00da2b51
test al, al
je 0xda2937
mov eax, dword [ebp + 0x14]
jmp 0xda3bc9
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
jmp 0xda2962
Function at 0xda2b51
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov byte [ebp - 1], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0xda39d1
mov al, byte [ebp - 1]
pop ebx
leave
ret 0x14
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
push edi
push 4
pop edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x10
push dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
push ebx
push dword [ebp - 8]
call esi
test eax, eax
jne 0xda3a11
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x14], ebx
je 0xda3a08
cmp eax, ebx
je 0xda3a08
cmp eax, 1
jne 0xda3a11
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov byte [ebp - 1], 1
mov dword [ebp + 0xc], edi
cmp byte [ebp - 1], bl
jne 0xda3a4d
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x10
push 0xda6c14
push ebx
push dword [ebp - 8]
call esi
test eax, eax
jne 0xda3a4d
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x14], ebx
je 0xda3a44
cmp eax, ebx
je 0xda3a44
cmp eax, 1
jne 0xda3a4d
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
jmp 0xda2b79
Function at 0xda2d3e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6a8
mov eax, dword [0xdac050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
push edi
mov dword [ebp - 0x690], eax
call fcn.00da2d81
test eax, eax
jne 0xda3328
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00da16b1
leave
ret 4
call sub.iertutil.dll_Ordinal_42
test eax, eax
je 0xda2d6d
call sub.iertutil.dll_Ordinal_44
test eax, eax
jne 0xda2d6d
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0xda34c9
push 0xda35f0
push esi
lea eax, [ebp - 0x28c]
push eax
call fcn.00da7287
test eax, eax
jl 0xda34c9
push edi
push edi
push 3
push edi
push 1
push 0x80
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x694], eax
cmp eax, 0xffffffff
je 0xda34c9
lea ecx, [ebp - 0x6a8]
push ecx
push edi
lea ecx, [ebp - 0x6a0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0xda34bd
mov eax, 0x1c81080
cmp dword [ebp - 0x69c], eax
jb 0xda33d7
cmp dword [ebp - 0x6a4], eax
jae 0xda34bd
mov eax, dword [0xdac5e0]
cmp eax, edi
jne 0xda33e5
call fcn.00da6d7c
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x200
lea ecx, [ebp - 0x68c]
push ecx
push 0x2c3
push eax
call esi
test eax, eax
je 0xda34bd
mov eax, dword [0xdac5e0]
cmp eax, edi
jne 0xda3415
call fcn.00da6d7c
push 0x40
lea ecx, [ebp - 0x84]
push ecx
push 0x2d3
push eax
call esi
test eax, eax
je 0xda34bd
push 0x31
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x68c]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0xda34bd
push ebx
lea eax, [ebp - 0x698]
push eax
call fcn.00da7209
test eax, eax
jne 0xda3471
cmp dword [ebp - 0x698], edi
je 0xda346a
mov ebx, 0xda3590
jmp 0xda3476
mov ebx, 0xda3530
jmp 0xda3476
mov ebx, 0xda34d0
mov eax, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0xda347b
sub eax, ecx
sar eax, 1
lea esi, [eax + 1]
lea eax, [esi + esi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0xda34bc
mov eax, dword [ebp - 0x690]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x690]
push ebx
push esi
push edi
mov dword [eax], edi
call fcn.00da20e3
pop ebx
push dword [ebp - 0x694]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
jmp 0xda2d6d
Function at 0xda2e3f
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0xda2e58
call fcn.00da2e5e
test al, al
je 0xda7682
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0xdac050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x224]
push eax
call fcn.00da74ae
test eax, eax
je 0xda778a
push esi
push edi
push 6
pop ecx
push ebx
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x224]
mov esi, 0xda77a8
lea edi, [ebp - 0x1c]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0xda7788
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0xda7798
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.00da72e1
add esp, 0x14
test eax, eax
jl 0xda7788
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x480]
push esi
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x480], edi
xor eax, eax
lea edi, [ebp - 0x43c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x480]
push eax
push esi
push esi
push 0x8000020
push esi
push esi
push esi
lea eax, [ebp - 0x224]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0xda7788
push dword [ebp - 0x43c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x438]
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00da16b1
leave
ret

Function at 0xda6d7c
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0xdac050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0xdac5e0]
test eax, eax
jne 0xda6e39
push 0x11c
push eax
lea eax, [ebp - 0x328]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
mov dword [ebp - 0x328], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0xda6e2b
cmp dword [ebp - 0x318], 2
jne 0xda6e21
cmp dword [ebp - 0x324], 6
jae 0xda6e21
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0xdac058]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0xda6e2b
push 0
push 8
lea eax, [ebp - 0x20c]
push eax
call fcn.00da85fb
mov dword [0xdac5e0], eax
cmp eax, dword [0xdac058]
jne 0xda6e2b
push eax
call fcn.00da844e
jmp 0xda6e2b
mov eax, dword [0xdac058]
mov dword [0xdac5e0], eax
mov eax, dword [0xdac5e0]
test eax, eax
jne 0xda6e39
mov eax, dword [0xdac058]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00da16b1
leave
ret
Function at 0xda74ae
Capabilities:
Accept command line arguments
Persist via active setup registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0xdac050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x2e
pop ecx
mov esi, 0xda75c8
lea edi, [ebp - 0xc0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xc8]
push eax
push 1
movsw word es:[edi], word [esi]
xor edi, edi
push edi
lea eax, [ebp - 0xc0]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xda759e
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push edi
push ebx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
push ebx
lea eax, [ebp - 0xc4]
push eax
push edi
push 0xda75b4
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0xda7592
cmp dword [ebp - 0xc4], 1
je 0xda7554
cmp dword [ebp - 0xc4], 2
jne 0xda7592
mov eax, dword [ebp - 0xcc]
shr eax, 1
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
lea eax, [ebp - 0xd0]
push eax
push ebx
mov dword [ebp - 0xd0], edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, edi
je 0xda7592
push dword [esi]
push dword [ebp + 0xc]
push ebx
call fcn.00da20e3
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
inc edi
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00da16b1
leave
ret 8

Function at 0xda7ec1
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0xdac050]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0xdac5f8], edi
jne 0xda7fdd
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0xda7f28
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0xdac5f8], edi
pop esi
je 0xda7fb0
dec eax
jne 0xda7fdd
cmp dword [ebp - 0x11c], 5
jne 0xda7f9d
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0xda7f91
dec eax
je 0xda7f7e
dec eax
je 0xda7f64
mov dword [0xdac5f8], 0x14
jmp 0xda7fdd
cmp word [ebp - 0xc], 1
jb 0xda7f75
mov dword [0xdac5f8], 0x10
or dword [0xdac5f8], 4
jmp 0xda7fdd
cmp word [ebp - 0xc], 2
jb 0xda7f75
mov dword [0xdac5f8], 8
jmp 0xda7f75
mov dword [0xdac5f8], 4
jmp 0xda7fdd
cmp dword [ebp - 0x11c], 4
ja 0xda7fef
mov dword [0xdac5f8], 2
cmp dword [ebp - 0x11c], 4
jne 0xda7fdd
cmp dword [ebp - 0x118], edi
je 0xda7fd3
cmp dword [ebp - 0x118], 0xa
je 0xda7fd3
cmp dword [ebp - 0x118], 0x5a
jne 0xda7fdd
mov dword [0xdac5f8], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0xdac5f8]
xor ecx, ebp
pop edi
call fcn.00da16b1
leave
ret
mov dword [0xdac5f8], 0x20
jmp 0xda7fdd
Function at 0xda8000
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0xdac050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0xda8054
push 3
lea eax, [ebp - 0x44]
push 0xda8064
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.00da16b1
leave
ret

Function at 0xda806f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0xdac050]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0xdac5fc]
jne 0xda810a
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0xda8200
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xda8109
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0xda82b8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0xda8109
push 3
push dword [esi*8 + 0xda8120]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0xda80fb
inc esi
cmp esi, 0x1c
jae 0xda8109
jmp 0xda80da
mov ax, word [esi*8 + 0xda8124]
mov word [0xdac5fc], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0xdac5fc]
xor ecx, ebp
call fcn.00da16b1
leave
ret
Function at 0xda929b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xda6bf4
push 0xda6ba0
push 0x80000001
mov dword [ebp - 8], 4
call sub.SHLWAPI.dll_SHGetValueW
test eax, eax
jne 0xda92ee
cmp dword [ebp - 0xc], 4
jne 0xda92ea
cmp dword [ebp - 4], 1
je 0xda92ee
cmp dword [ebp - 4], 2
je 0xda92ee
cmp dword [ebp - 4], 0xa
je 0xda92ee
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0xda9312
call fcn.00da9217
mov dword [ebp - 4], eax
test eax, eax
je 0xda9312
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0xda9312
push dword [ebp - 4]
call fcn.00da9120
mov eax, dword [ebp - 4]
leave
ret

Function at 0xda934a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov byte [ebp - 1], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xda93e7
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
push edi
push 4
pop edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x10
push dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
push ebx
push dword [ebp - 8]
call esi
test eax, eax
jne 0xda93a5
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x14], ebx
je 0xda93d3
cmp eax, ebx
je 0xda93d3
cmp eax, 1
je 0xda93d3
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x10
push 0xda6c14
push ebx
push dword [ebp - 8]
mov dword [ebp + 0xc], edi
call esi
test eax, eax
jne 0xda93dc
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x14], ebx
je 0xda93d3
cmp eax, ebx
je 0xda93d3
cmp eax, 1
jne 0xda93dc
mov ecx, dword [ebp + 0x18]
mov byte [ebp - 1], 1
mov dword [ecx], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret 0x14
Function at 0xda95e2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0xdac050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 4
call dword [sym.imp.iertutil.dll_Ordinal_74]
mov dword [ebp - 0x68], eax
test eax, eax
je 0xda96bf
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
lea eax, [ebp - 0x6c]
push eax
mov ebx, 0x20019
push ebx
push 0
mov edi, 0xda9710
push edi
push 0x80000001
call esi
test eax, eax
je 0xda9640
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0
push edi
push 0x80000002
call esi
test eax, eax
jne 0xda96be
xor esi, esi
xor ebx, ebx
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp - 0x6c]
mov dword [ebp - 0x74], 0x27
call sub.SHLWAPI.dll_SHEnumValueW
mov edi, eax
cmp edi, esi
jne 0xda96b0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_SHCLSIDFromString]
test eax, eax
jl 0xda96b0
lea eax, [ebp - 0x70]
push eax
push 0xda9778
push esi
push 1
push esi
lea eax, [ebp - 0x64]
push eax
call sub.urlmon.dll_Ordinal_104
test eax, eax
jl 0xda96b0
push dword [ebp - 0x70]
push 0x7fffffff
push dword [ebp - 0x68]
call dword [sym.imp.iertutil.dll_Ordinal_85]
cmp eax, 0xffffffff
jne 0xda96b0
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc ebx
cmp edi, esi
je 0xda9644
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov esi, 0xdac09c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [0xdac604], edi
jne 0xda96e0
mov eax, dword [ebp - 0x68]
mov dword [0xdac604], eax
mov dword [ebp - 0x68], edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x68], edi
je 0xda96fb
push edi
push 0xda93f4
push dword [ebp - 0x68]
call dword [sym.imp.iertutil.dll_Ordinal_79]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00da16b1
leave
ret
Function at 0x49c9d2
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x11
push 0xfffffffffffffffe
mov eax, 0xc7
mov edx, esp
int 0x2e
mov eax, 0xe5
mov edx, esp
int 0x2e
mov eax, 0xee
mov edx, esp
int 0x2e
mov eax, 0x136
mov edx, esp
int 0x2e
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x49ca25
Capabilities:
Check for trap flag exception

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
pushfd
or dword [esp], 0x100
popfd
clc
call fcn.0049ca4a
Function at 0x22b07590
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov edx, 1
xor ecx, ecx
mov eax, edx
mov byte [ecx + 0x22b1803c], dl
and eax, 0xff
mov esi, 0x101
mov byte [eax + 0x22b1813c], cl
lea eax, [edx + edx*4]
xor edx, edx
lea eax, [eax + eax*8]
div esi
inc ecx
cmp ecx, 0x100
jb 0x22b07598
pop esi
ret

Function at 0x22b075d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, 0xd
sub esp, 0x18
cmp ecx, eax
jbe 0x22b075e4
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x2c]
mov al, byte [esp + 0x24]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x28]
push edi
lea edi, [esp + 0x10]
mov byte [ecx], al
lea ebx, [esp + 0x1c]
inc ecx
sub edi, esi
sub ebp, esi
mov byte [esp + 0x18], 0
mov byte [esp + 0x24], 0
sub ebx, esi
mov dword [esp + 0x3c], 8
mov dl, byte [esi]
mov al, dl
shr al, 3
shl dl, 5
or al, dl
mov byte [edi + esi], al
mov dl, byte [esp + 0x18]
xor dl, al
mov al, byte [esi + ebp]
mov byte [esp + 0x18], dl
mov byte [ebx + esi], al
mov dl, byte [esp + 0x24]
mov byte [ecx], al
xor dl, al
mov eax, dword [esp + 0x3c]
inc ecx
inc esi
dec eax
mov byte [esp + 0x24], dl
mov dword [esp + 0x3c], eax
jne 0x22b0761b
mov eax, dword [esp + 0x34]
mov ebp, 1
cmp eax, ebp
jb 0x22b0772a
mov edi, 0x22b18058
xor esi, esi
mov al, byte [esp + esi + 0x10]
mov dl, al
shl dl, 6
shr al, 2
or dl, al
mov al, byte [esp + esi + 0x1c]
mov byte [esp + esi + 0x10], dl
mov dl, al
shl dl, 6
shr al, 2
or dl, al
mov byte [esp + esi + 0x1c], dl
inc esi
cmp esi, 9
jb 0x22b0766b
xor esi, esi
mov eax, dword [esp + 0x38]
test eax, eax
je 0x22b076be
lea eax, [esi + ebp*2 - 1]
xor edx, edx
mov ebx, 9
div ebx
xor eax, eax
mov al, byte [edi + esi - 9]
mov bl, byte [eax + 0x22b1803c]
mov dl, byte [esp + edx + 0x10]
jmp 0x22b076ce
mov bl, byte [esp + esi + 0x10]
xor eax, eax
mov al, byte [edi + esi - 9]
mov dl, byte [eax + 0x22b1803c]
add dl, bl
mov byte [ecx], dl
inc ecx
inc esi
cmp esi, 8
jb 0x22b07697
xor esi, esi
mov eax, dword [esp + 0x38]
test eax, eax
je 0x22b07700
lea eax, [esi + ebp*2]
xor edx, edx
mov ebx, 9
div ebx
xor eax, eax
mov al, byte [edi + esi]
mov bl, byte [eax + 0x22b1803c]
mov dl, byte [esp + edx + 0x1c]
jmp 0x22b0770f
mov bl, byte [esp + esi + 0x1c]
xor eax, eax
mov al, byte [edi + esi]
mov dl, byte [eax + 0x22b1803c]
add dl, bl
mov byte [ecx], dl
inc ecx
inc esi
cmp esi, 8
jb 0x22b076db
mov eax, dword [esp + 0x34]
inc ebp
add edi, 0x12
cmp ebp, eax
jbe 0x22b07669
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret