joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401140
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], ecx
xor edi, edi
xor esi, esi
test edx, edx
jle 0x401234
mov cl, byte [esi + ecx]
movzx ebx, cl
cmp cl, 0x3d
jne 0x40116e
inc edi
cmp edi, 2
jg 0x40123b
cmp cl, 0x7f
ja 0x40123b
mov cl, byte [ebx + 0x4363a0]
cmp cl, 0x7f
je 0x40123b
cmp cl, 0x40
jae 0x401193
test edi, edi
jne 0x40123b
mov ecx, dword [ebp - 4]
inc eax
inc esi
cmp esi, edx
jl 0x401159
test eax, eax
je 0x401234
mov edi, dword [ebp + 0xc]
imul eax, eax, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x4011bd
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x40123d
mov edx, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 8], eax
test esi, esi
jle 0x40122f
push 3
pop edi
mov eax, ecx
movzx eax, byte [eax]
mov cl, byte [eax + 0x4363a0]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub edi, eax
movzx eax, cl
mov ecx, dword [ebp - 8]
and eax, 0x3f
or ebx, eax
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 4
jne 0x401220
xor eax, eax
mov dword [ebp - 8], eax
test edi, edi
jle 0x40120b
mov eax, ebx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp edi, 1
jle 0x401218
mov eax, ebx
shr eax, 8
mov byte [edx], al
inc edx
cmp edi, 2
jle 0x401220
mov byte [edx], bl
inc edx
mov eax, dword [ebp - 4]
dec esi
inc eax
mov dword [ebp - 4], eax
test esi, esi
jg 0x4011d0
mov edi, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
mov dword [edi], edx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 0xffffffffffffffee
pop eax
jmp 0x401236

Function at 0x401269
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x402f94
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x429804
call fcn.0041132d
mov edi, ecx
mov ebx, dword [ebp + 0xc]
lea eax, [edi + 0x88]
cmp dword [eax + 0x14], 8
jb 0x402fb6
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ebx
push str.AppSetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x40309d
xor eax, eax
mov dword [ebp - 0x818], 7
xor esi, esi
mov word [ebp - 0x82c], ax
push 0x4368c0
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x81c], esi
call fcn.004025b1
push 0x800
lea eax, [ebp - 0x814]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.00412480
add esp, 0xc
lea eax, [ebp - 0x814]
push dword [ebp + 0x10]
push 0x4368b8
push eax
call fcn.00402469
add esp, 0xc
lea eax, [ebp - 0x814]
cmp byte [edi + 5], 0
push eax
push ebx
push ecx
je 0x40304a
lea eax, [ebp - 0x844]
mov ecx, edi
push eax
call fcn.00403131
jmp 0x40305e
lea ecx, [ebp - 0x844]
call fcn.00406a53
add esp, 0xc
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x82c]
call fcn.00402238
lea ecx, [ebp - 0x844]
call fcn.004025fd
cmp dword [ebp - 0x818], 8
lea eax, [ebp - 0x82c]
cmovae eax, dword [ebp - 0x82c]
push eax
call fcn.00418fd0
pop ecx
lea ecx, [ebp - 0x82c]
mov esi, eax
call fcn.004025fd
mov eax, esi
call fcn.004112d7
ret 0xc
Function at 0x405e49
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00411ac0
mov eax, dword [0x43d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov ebx, ecx
push edi
push eax
mov edi, edx
mov dword [ebp - 0x1010], eax
call fcn.004190a3
mov dword [ebp - 0x1018], eax
lea eax, [ebp - 0x1018]
push eax
mov dword [ebp - 0x1014], edx
call fcn.004198f1
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x1004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00405f8e
add esp, 0x28
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
mov edi, ecx
inc ecx
test eax, eax
push 0x436d18
push ebx
cmovne edi, ecx
call fcn.004191a6
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x405f7f
push 2
pop ebx
test edi, edi
jne 0x405f14
push esi
push ebx
inc edi
mov dword [ebp - 0x100c], 0xfeff
lea eax, [ebp - 0x100c]
push edi
push eax
call fcn.00415d31
add esp, 0x10
jmp 0x405f17
xor edi, edi
inc edi
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, word [ebp - 0x1010]
jne 0x405f20
sub ecx, edx
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x1004]
push edi
push eax
call fcn.00415d31
push esi
push ebx
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xd
push edi
push eax
call fcn.00415d31
push esi
push ebx
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xa
push edi
push eax
call fcn.00415d31
push esi
call fcn.00415f4b
add esp, 0x34
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004108e9
leave
ret

Function at 0x40601a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [0x43eb34]
test bl, bl
jne 0x4060b1
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00412480
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4060ab
lea eax, [ebp - 0x20c]
push eax
call fcn.00419346
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.00412130
pop ecx
pop ecx
test eax, eax
jne 0x4060a3
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.00412130
pop ecx
pop ecx
test eax, eax
je 0x4060ab
mov byte [0x43eb34], bl
jmp 0x4060b1
mov bl, byte [0x43eb34]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004108e9
leave
ret
Function at 0x4060c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
xor bl, bl
call fcn.0040601a
xor edi, edi
inc edi
test al, al
je 0x406111
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
call fcn.0040612d
test al, al
je 0x406111
push esi
push edi
push dword [ebp - 4]
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, edi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x406126
push 0
push 0x26
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
movzx ebx, bl
cmovne ebx, edi
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x4061c8
Capabilities:
Create process on windows

Disassembly:
push 0x98
mov eax, 0x429d54
call fcn.0041132d
mov dword [ebp - 0x48], edx
mov ebx, ecx
push 0x44
pop edi
xor esi, esi
lea eax, [ebp - 0xa4]
push edi
push esi
push eax
mov dword [ebp - 0x4c], esi
call fcn.00412480
mov dword [ebp - 0xa4], edi
xor eax, eax
lea edi, [ebp - 0x5c]
mov dword [ebp - 0x1c], esi
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 7
pop ecx
mov dword [ebp - 0x18], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x44], ax
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 1
test eax, eax
je 0x40626a
push eax
lea ecx, [ebp - 0x44]
call fcn.004025b1
cmp dword [ebp - 0x34], esi
je 0x40626a
push 0x436e58
lea ecx, [ebp - 0x2c]
call fcn.004025b1
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00403421
push 0x436e5c
lea ecx, [ebp - 0x2c]
call fcn.00403421
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040226f
jmp 0x406273
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004025b1
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x67
call fcn.00405d56
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
pop ecx
cmovae eax, dword [ebp - 0x2c]
pop ecx
lea ecx, [ebp - 0x5c]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
push esi
push esi
push esi
push 1
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4062c4
push dword [ebp - 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x58]
call esi
xor esi, esi
inc esi
lea ecx, [ebp - 0x44]
call fcn.004025fd
lea ecx, [ebp - 0x2c]
call fcn.004025fd
mov eax, esi
call fcn.004112d7
ret
Function at 0x4062dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2078
call fcn.00411ac0
mov eax, dword [0x43d06c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, edx
push 0x2000
push eax
mov dword [ebp - 0x2018], eax
mov esi, ecx
mov dword [ebp - 0x2010], eax
lea eax, [ebp - 0x200c]
push eax
call fcn.00412480
add esp, 0xc
lea eax, [ebp - 0x200c]
push edi
push esi
push str.__s___s
push eax
call fcn.00402469
add esp, 0x10
mov ecx, str.EXPLORER.EXE
call fcn.004064d1
push eax
xor edi, edi
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x40648f
lea eax, [ebp - 0x2018]
mov esi, 0xf01ff
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40648f
lea eax, [ebp - 0x2010]
push eax
push 1
push 1
push edi
push esi
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x40648f
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4063e2
push str.WTSGetActiveConsoleSessionId
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4063db
call eax
push 4
mov dword [ebp - 0x201c], eax
lea eax, [ebp - 0x201c]
push eax
push 0xc
push dword [ebp - 0x2010]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x40648f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x2074]
push edi
push eax
call fcn.00412480
xor eax, eax
mov dword [ebp - 0x2074], esi
lea edi, [ebp - 0x202c]
mov dword [ebp - 0x206c], str.WinSta0Default
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x2048], 1
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
xor edi, edi
mov word [ebp - 0x2044], ax
push edi
push dword [ebp - 0x2010]
lea eax, [ebp - 0x2014]
mov dword [ebp - 0x2014], edi
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x40648f
lea eax, [ebp - 0x202c]
push eax
lea eax, [ebp - 0x2074]
push eax
push edi
push dword [ebp - 0x2014]
lea eax, [ebp - 0x200c]
push 0x430
push edi
push edi
push edi
push eax
push edi
push dword [ebp - 0x2010]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x40648f
cmp dword [ebp - 0x2014], edi
je 0x40648f
push dword [ebp - 0x2014]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [ebp - 0x2010]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4064a7
cmp eax, 0xffffffff
je 0x4064a7
push eax
call esi
mov eax, dword [ebp - 0x2018]
test eax, eax
je 0x4064b9
cmp eax, 0xffffffff
je 0x4064b9
push eax
call esi
test ebx, ebx
jne 0x4064c0
push edi
call esi
mov ecx, dword [ebp - 8]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004108e9
leave
ret
Function at 0x4064d1
Capabilities:
Enumerate processes

Disassembly:
push 0x264
mov eax, 0x429d8c
call fcn.0041132d
test ecx, ecx
jne 0x4064eb
xor eax, eax
jmp 0x4065a5
push ecx
lea ecx, [ebp - 0x40]
call fcn.004025d8
xor ebx, ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.00407044
mov edi, 0x22c
lea eax, [ebp - 0x270]
push edi
push ebx
push eax
call fcn.00412480
add esp, 0xc
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40659b
lea eax, [ebp - 0x270]
mov dword [ebp - 0x270], edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x406590
xor eax, eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x14], 7
push eax
call fcn.004025b1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00407044
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00403486
test al, al
jne 0x4065ab
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.004025fd
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40653d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.004025fd
mov eax, ebx
call fcn.004112d7
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x268]
lea ecx, [ebp - 0x28]
call fcn.004025fd
jmp 0x40659b

Function at 0x406875
Capabilities:
Enumerate processes

Disassembly:
push 0x264
mov eax, 0x429d8c
call fcn.0041132d
mov esi, ecx
mov edi, 0x22c
lea eax, [ebp - 0x270]
push edi
xor ebx, ebx
push ebx
push eax
call fcn.00412480
add esp, 0xc
lea ecx, [ebp - 0x40]
push esi
call fcn.004025d8
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.00407044
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x406940
lea eax, [ebp - 0x270]
mov dword [ebp - 0x270], edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x40692b
xor eax, eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x14], 7
push eax
call fcn.004025b1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00407044
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00403486
lea ecx, [ebp - 0x28]
test al, al
jne 0x406931
mov byte [ebp - 4], bl
call fcn.004025fd
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4068d8
jmp 0x406939
xor ebx, ebx
inc ebx
call fcn.004025fd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.004025fd
mov eax, ebx
call fcn.004112d7
ret
Function at 0x406982
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov ebx, 0xf013f
mov dword [ebp - 0xc], edi
push ebx
push edi
push 0x436980
push 0x80000001
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406a4f
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 8]
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push 0x4368c8
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x4069e2
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406a4e
push edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push edi
push edi
push edi
push str.AppSetting
push dword [ebp - 8]
call esi
test eax, eax
je 0x406a0a
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x406a4c
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x406a10
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x406a53
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x830
mov eax, 0x429def
call fcn.0041132d
mov edi, ecx
mov dword [ebp - 0x83c], edi
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x82c]
mov ebx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x83c], edi
call fcn.004025d8
lea eax, [ebp - 0x838]
xor esi, esi
push eax
push 0xf013f
push esi
mov dword [ebp - 4], esi
push 0x436980
push 0x80000001
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x830], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406acd
mov ecx, edi
lea eax, [ebp - 0x82c]
push eax
call fcn.00402481
jmp 0x406bcc
push esi
lea eax, [ebp - 0x834]
push eax
push esi
push 0xf013f
push esi
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0x4368c8
push dword [ebp - 0x838]
call esi
test eax, eax
je 0x406b03
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406aba
xor ecx, ecx
lea eax, [ebp - 0x830]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push str.AppSetting
push dword [ebp - 0x834]
call esi
test eax, eax
je 0x406b42
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
jmp 0x406aba
push 0x800
xor esi, esi
lea eax, [ebp - 0x814]
push esi
push eax
call fcn.00412480
add esp, 0xc
mov dword [ebp - 0x83c], 0x400
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x814]
push eax
push esi
push esi
push ebx
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x834]
call esi
push dword [ebp - 0x838]
call esi
lea ecx, [ebp - 0x814]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x406ba9
sub ecx, edx
sar ecx, 1
mov ecx, edi
je 0x406abc
lea eax, [ebp - 0x814]
push eax
call fcn.004025d8
lea ecx, [ebp - 0x82c]
call fcn.004025fd
mov eax, edi
call fcn.004112d7
ret
Function at 0x406bdf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x834
mov eax, 0x429e22
call fcn.0041132d
mov edi, ecx
mov dword [ebp - 0x840], edi
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x82c]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x840], edi
call fcn.004025d8
xor ecx, ecx
lea eax, [ebp - 0x830]
push eax
push 0x20119
push ecx
mov dword [ebp - 4], ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x80000003
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x834], ecx
call esi
test eax, eax
je 0x406c60
mov ecx, edi
lea eax, [ebp - 0x82c]
push eax
call fcn.00402481
jmp 0x406d8e
lea eax, [ebp - 0x83c]
push eax
push 0x20119
xor eax, eax
push eax
push 0x436980
push dword [ebp - 0x830]
call esi
test eax, eax
je 0x406c8e
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406c4d
lea eax, [ebp - 0x838]
push eax
push 0x20119
xor eax, eax
push eax
push 0x4368c8
push dword [ebp - 0x83c]
call esi
test eax, eax
je 0x406cc6
push dword [ebp - 0x83c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
jmp 0x406c4d
lea eax, [ebp - 0x834]
push eax
push 0x20119
xor eax, eax
push eax
push str.AppSetting
push dword [ebp - 0x838]
call esi
test eax, eax
je 0x406cfc
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
jmp 0x406cba
push 0x800
xor esi, esi
lea eax, [ebp - 0x814]
push esi
push eax
call fcn.00412480
add esp, 0xc
mov dword [ebp - 0x840], 0x400
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x814]
push eax
push esi
push esi
push ebx
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
call esi
push dword [ebp - 0x83c]
call esi
push dword [ebp - 0x830]
call esi
lea ecx, [ebp - 0x814]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x406d6b
sub ecx, edx
sar ecx, 1
mov ecx, edi
je 0x406c4f
lea eax, [ebp - 0x814]
push eax
call fcn.004025d8
lea ecx, [ebp - 0x82c]
call fcn.004025fd
mov eax, edi
call fcn.004112d7
ret
Function at 0x406da1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push edi
push eax
xor edi, edi
mov ebx, 0xf013f
push ebx
push edi
push edx
push 0x80000003
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x406e8a
lea eax, [ebp - 8]
push eax
push ebx
push edi
push 0x436980
push dword [ebp - 4]
call esi
test eax, eax
je 0x406dfb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406e8a
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0xc]
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push 0x4368c8
push dword [ebp - 8]
call esi
test eax, eax
je 0x406e21
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406e80
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push edi
push edi
push edi
push str.AppSetting
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x406e41
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406e7b
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x406e47
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xc]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407bc9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
push edi
test dl, 3
je 0x407bf2
test esi, esi
je 0x407bf2
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x436478]
inc edx
dec esi
jmp 0x407bd3
mov edi, esi
and edi, 0xfffffff0
add edi, edx
jmp 0x407cdc
xor ecx, dword [edx]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
xor ecx, dword [edx + 4]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
xor ecx, dword [edx + 8]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
xor ecx, dword [edx + 0xc]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x436478]
add edx, 0x10
cmp edx, edi
jb 0x407bfe
and esi, 0xf
xor edi, edi
push ebx
xor ebx, ebx
lea eax, [esi + edx]
cmp edx, eax
cmova esi, ebx
pop ebx
test esi, esi
je 0x407d11
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x436478]
inc edx
inc edi
cmp edi, esi
jb 0x407cf9
not ecx
pop edi
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x407d19
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
ret
Function at 0x409284
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x43d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x3c
xor edi, edi
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.00412480
push 0x20a
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.00412480
add esp, 0x18
lea eax, [ebp - 0x210]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x24c], 0x3c
mov dword [ebp - 0x248], 0x40
mov dword [ebp - 0x240], str.open
mov dword [ebp - 0x23c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x230], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop edi
call fcn.004108e9
leave
ret