joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6306dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x630836
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebx], eax
xor eax, eax
mov dword [esi], eax
push 0x20019
lea eax, [ebp - 0x10]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00630484
test eax, eax
jne 0x630813
xor eax, eax
push ebp
push 0x63080c
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0
push ebx
push 0
mov eax, dword [ebp - 8]
call fcn.004082fc
mov edi, eax
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x6307f5
mov eax, dword [ebx]
cmp eax, 0xf
ja 0x63077d
bt word [ebp + 0x18], ax
jb 0x63078e
mov ecx, dword [ebx]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.006305e8
jmp 0x6307f5
mov eax, dword [esi]
cmp eax, dword [ebp + 0x14]
jbe 0x6307dc
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [esi]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x34]
mov ecx, 3
mov eax, 0x630858
call fcn.0041e194
mov eax, dword [ebp - 0x14]
call fcn.006354a8
jmp 0x6307f5
push esi
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630813
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63083d
lea eax, [ebp - 0x14]
call fcn.00407494
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret
Function at 0x6308fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x630926
xor edx, edx
mov dword [eax], edx
xor eax, eax
push ebp
push 0x630a57
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x20019
lea eax, [ebp - 0x10]
push eax
movzx eax, byte [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00630484
test eax, eax
jne 0x630a3c
xor edx, edx
push ebp
push 0x630a35
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004082fc
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x630a1e
movzx eax, word [0x630a6c]
cmp byte [ebp + 0x10], 0
je 0x6309ae
movzx eax, word [0x630a70]
mov edx, dword [ebp - 0x14]
cmp edx, 0xf
ja 0x6309b9
bt eax, edx
jb 0x6309d9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.006305e8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
call fcn.00406c50
jmp 0x630a3c
mov edx, dword [ebp - 0x18]
shr edx, 1
inc edx
mov eax, dword [ebp + 0xc]
call fcn.00408490
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x630a16
mov edx, dword [ebp - 0x18]
shr edx, 1
mov eax, dword [ebp + 0xc]
call fcn.00408490
mov byte [ebp - 9], 1
jmp 0x630a1e
mov eax, dword [ebp + 0xc]
call fcn.00407494
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630a3c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630a5e
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret

Function at 0x630ae8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x630b76
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x20019
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00630484
test eax, eax
jne 0x630b5b
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004082fc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630b7d
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret
Function at 0x630d08
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x630da1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [esi], eax
push 0x20019
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00630484
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x630d86
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 8]
call fcn.004082fc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x630da8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret

Function at 0x630fc4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x63111d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00630a74
test al, al
jne 0x63101b
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.006303d8
push 0x20006
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00630484
test eax, eax
je 0x631060
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x63113c
call fcn.0041e194
mov eax, dword [ebp - 0x10]
call fcn.006354a8
jmp 0x6310f2
xor eax, eax
push ebp
push 0x6310eb
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x631077
xor eax, eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
push eax
push esi
movzx eax, bl
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004082fc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x6310d4
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
movzx eax, bl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x34]
mov ecx, 2
mov eax, 0x6311a8
call fcn.0041e194
mov eax, dword [ebp - 0x1c]
call fcn.006354a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6310f2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x631124
lea eax, [ebp - 0x1c]
call fcn.00407494
lea eax, [ebp - 0x10]
call fcn.00407494
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret
Function at 0x631390
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x631402
push dword fs:[eax]
mov dword fs:[eax], esp
inc ecx
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408490
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
push esi
push ebx
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.004082fc
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.00408364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x631409
lea eax, [ebp - 4]
call fcn.00407494
ret

Function at 0x6316a0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x631723
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 2
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00630484
test eax, eax
jne 0x631708
mov eax, dword [ebp - 8]
call fcn.004082fc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63172a
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret

Function at 0x631bcc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x631cc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407494
cmp dword [ebp - 4], 0
je 0x631c25
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x631c25
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00408720
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x631ca6
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004082fc
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x631c9d
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00408490
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.004082fc
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, dword [ebx]
call fcn.004082fc
mov edx, eax
mov eax, ebx
call fcn.00408364
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x631cc8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret
Function at 0x631cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x631da7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x631d23
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x631d23
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00408720
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x631d8c
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004082fc
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x631d83
cmp dword [ebp - 0x14], 4
jne 0x631d83
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x631dae
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret

Function at 0x631db8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00407578
xor eax, eax
push ebp
push 0x631e9e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407494
cmp dword [ebp - 4], 0
je 0x631e09
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x631e09
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00408720
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x631e88
mov eax, ebx
mov edx, 0x400
call fcn.00408490
mov eax, dword [ebx]
test eax, eax
je 0x631e3e
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.004082fc
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x631e78
mov eax, dword [ebx]
call fcn.004082fc
mov edx, eax
mov eax, ebx
call fcn.00408364
jmp 0x631e7f
mov eax, ebx
call fcn.00407494
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x631ea5
lea eax, [ebp - 4]
call fcn.00407494
ret

Function at 0x63508c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
mov esi, edx
imul ebx, dword [eax], 0x8088405
inc ebx
mov dword [eax], ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, esi
xor edx, edx
call fcn.00409348
mov eax, edx
xor edx, edx
pop esi
pop ebx
ret
Function at 0x6356e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x635769
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00408490
mov eax, dword [ebx]
mov esi, eax
test esi, esi
je 0x63571a
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebx]
call fcn.004082fc
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, dword [ebx]
call fcn.004082fc
mov edx, eax
lea eax, [ebp - 8]
call fcn.00408364
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00424cf0
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00407874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x635770
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret

Function at 0x635778
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x6357f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00408490
mov eax, dword [ebx]
mov esi, eax
test esi, esi
je 0x6357aa
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
call fcn.004082fc
push eax
push esi
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebx]
call fcn.004082fc
mov edx, eax
lea eax, [ebp - 8]
call fcn.00408364
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00424cf0
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00407874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x635800
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret

Function at 0x635808
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x63588d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00408490
mov eax, dword [ebx]
call fcn.004082fc
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004082fc
push eax
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, dword [ebx]
call fcn.004082fc
mov edx, eax
mov eax, ebx
call fcn.00408364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x635894
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074f4
ret
Function at 0x636a2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00407588
xor eax, eax
push ebp
push 0x636ab6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, 1
jl 0x636aa0
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00636950
mov ebx, esi
dec ebx
test ebx, ebx
jl 0x636a76
inc ebx
lea eax, [ebp - 0x18]
call fcn.00631bb8
dec ebx
jne 0x636a6b
mov ebx, esi
dec ebx
test ebx, ebx
jl 0x636aa0
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
movzx edi, byte [eax + esi]
lea eax, [ebp - 0x18]
call fcn.00631bb8
movzx eax, al
xor edi, eax
mov eax, edi
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
dec ebx
jne 0x636a80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x636abd
lea eax, [ebp - 4]
call fcn.004074b8
ret

Function at 0x636fa4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407578
xor eax, eax
push ebp
push 0x6370e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x637100
call fcn.00408568
mov eax, dword [ebp - 8]
call fcn.006354a8
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x637118
call fcn.004088e8
dec eax
jne 0x637049
movzx eax, byte [0x637128]
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x637138
mov edx, 0x63714c
mov eax, dword [ebp - 4]
call fcn.00424f78
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004078bc
movzx eax, byte [0x637150]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x637160
mov edx, 0x637180
mov eax, dword [ebp - 4]
call fcn.00424f78
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.004078bc
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004082fc
mov ebx, eax
push ebx
push 0x637194
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x1f
ja 0x6370ca
push 5
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x6371ac
call fcn.0041e194
mov eax, dword [ebp - 0x14]
call fcn.004082fc
push eax
push 0x6371ec
push 0x637194
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x1f
ja 0x6370ca
call fcn.0063a570
test al, al
je 0x6370ca
push 5
push 0
push ebx
push 0x637208
push 0x637194
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6370ec
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004074f4
ret
Function at 0x637724
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
xor esi, esi
cmp ebx, 0xffffffff
je 0x6377ba
mov eax, esp
xor ecx, ecx
mov edx, 3
call fcn.004053b0
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [esp + 8]
push eax
push 3
lea eax, [esp + 0xc]
push eax
push ebx
call sub.kernel32.dll_ReadFile
cmp byte [esp], 0xff
jne 0x637778
cmp byte [esp + 1], 0xfe
jne 0x637778
mov esi, 1
jmp 0x6377a5
cmp byte [esp], 0xfe
jne 0x63778c
cmp byte [esp + 1], 0xff
jne 0x63778c
mov esi, 2
jmp 0x6377a5
cmp byte [esp], 0xef
jne 0x6377a5
cmp byte [esp + 1], 0xbb
jne 0x6377a5
cmp byte [esp + 2], 0xbf
jne 0x6377a5
mov esi, 3
mov edx, esi
mov eax, ebx
call fcn.006377c4
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov eax, esi
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x637a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407578
mov eax, dword [ebp - 8]
call fcn.00407578
xor eax, eax
push ebp
push 0x637b72
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x637ac8
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0040b388
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 0x637b90
call fcn.00407d10
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00637ba4
mov ebx, eax
jmp 0x637b47
xor ebx, ebx
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
call sub.kernel32.dll_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
je 0x637b47
lea eax, [ebp - 0xc]
mov edx, 0x637ba0
call fcn.004078bc
push 0
lea eax, [ebp - 0x14]
push eax
push 2
mov eax, dword [ebp - 0xc]
call fcn.004082fc
push eax
push edi
call sub.kernel32.dll_WriteFile_1
mov esi, dword [ebp - 8]
test esi, esi
je 0x637b21
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.004082fc
push eax
push edi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push edi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x637b79
lea eax, [ebp - 0x18]
call fcn.004074b8
lea eax, [ebp - 0x10]
call fcn.004074b8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004074f4
ret

Function at 0x637ba4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
mov eax, ebx
call fcn.004082fc
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x637c02
mov esi, edi
test esi, esi
je 0x637bde
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [esp + 4]
push eax
push esi
mov eax, edi
call fcn.00407edc
push eax
push ebp
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push ebp
call sub.kernel32.dll_CloseHandle_1
jmp 0x637c04
xor ebx, ebx
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x637c0c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
mov ebx, edi
mov eax, ebx
test eax, eax
je 0x637c22
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x637c29
mov bl, 1
jmp 0x637c8c
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
mov eax, esi
call fcn.004082fc
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x637c8a
push 2
push 0
push 0
push ebp
call sub.kernel32.dll_SetFilePointer
mov esi, ebx
test esi, esi
je 0x637c66
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [esp + 4]
push eax
push esi
mov eax, edi
call fcn.00407edc
push eax
push ebp
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push ebp
call sub.kernel32.dll_CloseHandle_1
jmp 0x637c8c
xor ebx, ebx
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret