joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57ddf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x57de7b
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x57de3d
cmp eax, 2
jne 0x57de59
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x57de75
test ecx, ecx
je 0x57de70
test cl, 1
jne 0x57de59
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x57de75
pop edi
mov eax, 0xd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 0xc

Function at 0x57de90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x57decb
cmp dword [edi], 2
jae 0x57decb
pop edi
mov eax, 0x7a
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x57df3d
cmp dword [ebp - 8], 7
jne 0x57df38
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x57df20
test cl, 1
jne 0x57df38
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x57df38
cmp word [esi + eax*2 - 2], 0
jne 0x57df38
cmp eax, 1
jbe 0x57df20
cmp word [esi + eax*2 - 4], 0
jne 0x57df38
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xd
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x57eb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push esi
mov esi, ecx
mov dword [esp + 4], esi
push edi
cmp edx, 0x80000001
jne 0x57ebc5
mov dword [esp + 0xc], 0x11
xor ecx, ecx
mov dword [esp + 0x10], 0xe100e1
mov dword [esp + 0x14], 0xf500ee
mov dword [esp + 0x18], 0xed00f2
mov dword [esp + 0x1c], 0xe200fa
mov dword [esp + 0x20], 0xf700e3
mov dword [esp + 0x24], 0xe000fd
mov dword [esp + 0x28], 0xe300ea
mov dword [esp + 0x2c], 0xfd00e4
mov dword [esp + 0x30], 0xba00eb
nop
lea eax, [ecx + 0xa9]
xor word [esp + ecx*2 + 0x10], ax
inc ecx
mov eax, dword [esp + 0xc]
cmp ecx, eax
jb 0x57eb70
xor ecx, ecx
mov word [esp + eax*2 + 0x10], cx
xor eax, eax
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57eba1
sub ecx, edx
lea eax, [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004044f0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp edx, reloc.WS2_32.dll_closesocket
jne 0x57ec51
mov eax, 0xa
mov dword [esp + 0x10], 0xe100e1
mov dword [esp + 0xc], eax
xor ecx, ecx
mov dword [esp + 0x14], 0xf500ee
mov dword [esp + 0x18], 0xfb00f2
mov dword [esp + 0x1c], 0xf500fc
mov dword [esp + 0x20], 0xe100e3
mov dword [esp + 0x24], 0xb3
nop dword [eax]
lea eax, [ecx + 0xa9]
xor word [esp + ecx*2 + 0x10], ax
inc ecx
mov eax, dword [esp + 0xc]
cmp ecx, eax
jb 0x57ec10
xor ecx, ecx
mov word [esp + eax*2 + 0x10], cx
xor eax, eax
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57ec41
jmp 0x57ebac
cmp edx, reloc.OLEAUT32.dll_SysReAllocString
jne 0x57ecca
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x12
mov dword [esp + 0x10], 0xe100e1
mov dword [esp + 0x14], 0xf500ee
mov dword [esp + 0x18], 0xe200f2
mov dword [esp + 0x1c], 0xf300e0
mov dword [esp + 0x20], 0xfe00f0
mov dword [esp + 0x24], 0xf900ec
mov dword [esp + 0x28], 0xf500f4
mov dword [esp + 0x2c], 0xf100ff
mov dword [esp + 0x30], 0xff00f7
mov dword [esp + 0x34], 0xbb
call fcn.00403e20
push eax
mov ecx, esi
call fcn.004040b0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp edx, 0x80000000
jne 0x57ed3b
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x11
mov dword [esp + 0x10], 0xe100e1
mov dword [esp + 0x14], 0xf500ee
mov dword [esp + 0x18], 0xed00f2
mov dword [esp + 0x1c], 0xf100e3
mov dword [esp + 0x20], 0xe100e2
mov dword [esp + 0x24], 0xe700f6
mov dword [esp + 0x28], 0xe400ea
mov dword [esp + 0x2c], 0xf700f8
mov dword [esp + 0x30], 0xba00ed
call fcn.00403e20
push eax
mov ecx, esi
call fcn.004040b0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x7cf388
call fcn.004040b0
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x57f630
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x28], 0
je 0x57f692
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x14], 8
jb 0x57f648
mov edx, dword [edx]
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x57f653
mov esi, dword [esi]
test edx, edx
je 0x57f692
mov ecx, edx
push ebx
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57f660
sub ecx, ebx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebx
test eax, eax
jne 0x57f692
pop edi
mov al, 1
pop esi
pop ebp
ret 8
pop edi
xor al, al
pop esi
pop ebp
ret 8

Function at 0x57f920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ecx + 0x28], 0
mov eax, dword [ebp + 8]
je 0x57f973
cmp dword [eax + 0x14], 8
mov dword [ebp - 8], 0
jb 0x57f948
mov eax, dword [eax]
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push edx
lea edx, [ebp - 8]
push edx
lea edx, [ebp - 0x10]
push edx
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x57f973
cmp dword [ebp - 0x10], 4
mov eax, dword [ebp - 8]
je 0x57f976
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 8

Function at 0x57f990
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ecx + 0x28], 0
mov edx, dword [ebp + 8]
je 0x57f9e0
cmp dword [edx + 0x14], 8
jb 0x57f9b1
mov edx, dword [edx]
mov eax, dword [ebp + 0xc]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x57f9e0
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 8
Function at 0x57fa00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 8], eax
cmp byte [edi + 0x28], 0
je 0x57fa94
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x57fa31
mov eax, dword [esi]
push ebx
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x57fa94
cmp dword [ebp - 0xc], 3
jne 0x57fa94
push dword [ebx]
call fcn.007906ca
mov ecx, dword [ebp - 8]
add esp, 4
mov dword [ecx], eax
cmp dword [esi + 0x14], 8
jb 0x57fa64
mov esi, dword [esi]
push ebx
push eax
lea eax, [ebp - 8]
push eax
push 0
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x57fa94
cmp dword [ebp - 8], 3
jne 0x57fa94
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x580380
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a4176
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x30d80
call fcn.00790c80
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30d6c], ecx
mov edi, dword [ebx + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x30d68], edi
movq qword [ebp - 0x30d64], xmm0
mov dword [ebp - 0x30d5c], 0
mov dword [ebp - 0x30d74], edi
mov dword [ebp - 0x30d64], 0
mov dword [ebp - 0x30d60], 0
mov dword [ebp - 0x30d5c], 0
mov dword [ebp - 4], 0
cmp byte [ecx + 0x28], 0
jne 0x580433
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
jmp 0x580572
mov edi, dword [ebp - 0x30d6c]
xor esi, esi
lea eax, [ebp - 0x30d70]
mov dword [ebp - 0x30d68], 0x186a0
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x30d68]
push eax
lea eax, [ebp - 0x30d58]
push eax
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x580552
test eax, eax
jne 0x58054c
mov dword [ebp - 0x30d7c], eax
mov word [ebp - 0x30d8c], ax
lea eax, [ebp - 0x30d58]
mov dword [ebp - 0x30d78], 7
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5804a0
sub eax, edx
lea ecx, [ebp - 0x30d8c]
sar eax, 1
push eax
lea eax, [ebp - 0x30d58]
push eax
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x30d60]
cmp dword [ebp - 0x30d5c], eax
je 0x58052a
movups xmm0, xmmword [ebp - 0x30d8c]
mov dword [eax + 0x10], 0
lea ecx, [ebp - 0x30d8c]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x30d7c]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x30d60], 0x18
mov dword [ebp - 0x30d7c], 0
mov dword [ebp - 0x30d78], 7
mov word [ebp - 0x30d8c], ax
mov byte [ebp - 4], al
call fcn.00404490
inc esi
jmp 0x58043b
lea ecx, [ebp - 0x30d8c]
push ecx
push eax
lea ecx, [ebp - 0x30d64]
call fcn.004081e0
lea ecx, [ebp - 0x30d8c]
mov byte [ebp - 4], 0
call fcn.00404490
inc esi
jmp 0x58043b
mov edi, dword [ebp - 0x30d74]
mov eax, dword [ebp - 0x30d64]
mov dword [edi], eax
mov eax, dword [ebp - 0x30d60]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x30d5c]
mov dword [edi + 8], eax
lea ecx, [ebp - 0x30d64]
mov dword [ebp - 0x30d64], 0
mov dword [ebp - 0x30d60], 0
mov dword [ebp - 0x30d5c], 0
call fcn.00404220
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x5805c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a41b6
mov eax, dword fs:[0]
push eax
mov eax, 0x30d74
call fcn.00790c80
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x30d64], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x30d60], esi
movq qword [ebp - 0x30d5c], xmm0
mov dword [ebp - 0x30d54], 0
mov dword [ebp - 0x30d68], esi
mov dword [ebp - 0x30d5c], 0
mov dword [ebp - 0x30d58], 0
mov dword [ebp - 0x30d54], 0
mov dword [ebp - 4], 0
cmp byte [eax + 0x28], 0
jne 0x580661
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
jmp 0x5807bf
xor edi, edi
mov dword [ebp - 0x30d60], 0x186a0
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x30d60]
push ecx
lea ecx, [ebp - 0x30d50]
push ecx
push edi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x5807a5
mov esi, dword [ebp - 0x30d64]
nop dword [eax]
test eax, eax
jne 0x58076a
mov dword [ebp - 0x30d70], eax
mov word [ebp - 0x30d80], ax
lea eax, [ebp - 0x30d50]
mov dword [ebp - 0x30d6c], 7
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5806d0
sub eax, edx
lea ecx, [ebp - 0x30d80]
sar eax, 1
push eax
lea eax, [ebp - 0x30d50]
push eax
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x30d58]
cmp dword [ebp - 0x30d54], eax
je 0x580748
movups xmm0, xmmword [ebp - 0x30d80]
mov dword [eax + 0x10], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x30d70]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x30d58], 0x18
mov dword [ebp - 0x30d70], 0
mov dword [ebp - 0x30d6c], 7
mov word [ebp - 0x30d80], ax
jmp 0x58075b
lea ecx, [ebp - 0x30d80]
push ecx
push eax
lea ecx, [ebp - 0x30d5c]
call fcn.004081e0
lea ecx, [ebp - 0x30d80]
mov byte [ebp - 4], 0
call fcn.00404490
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x30d60]
mov dword [ebp - 0x30d60], 0x186a0
push eax
lea eax, [ebp - 0x30d50]
inc edi
push eax
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x5806a0
mov esi, dword [ebp - 0x30d68]
mov eax, dword [ebp - 0x30d5c]
mov dword [esi], eax
mov eax, dword [ebp - 0x30d58]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x30d54]
mov dword [esi + 8], eax
lea ecx, [ebp - 0x30d5c]
mov dword [ebp - 0x30d5c], 0
mov dword [ebp - 0x30d58], 0
mov dword [ebp - 0x30d54], 0
call fcn.00404220
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 4
Function at 0x584480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a4839
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x28], 0
mov esi, dword [ebp + 8]
jne 0x5844c0
xor al, al
jmp 0x584689
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.00403b80
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 2
push eax
call fcn.00418540
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
mov bl, al
call fcn.00404220
lea ecx, [ebp - 0x4c]
call fcn.00404490
test bl, bl
je 0x584550
push esi
lea ecx, [ebp - 0x4c]
call fcn.00403150
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 3
push eax
call fcn.00418800
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00404220
lea ecx, [ebp - 0x4c]
call fcn.00404490
mov dword [ebp - 0x58], 3
xor eax, eax
mov dword [ebp - 0x54], 0x8a008b
mov dword [ebp - 0x50], 0xac0089
nop word [eax + eax]
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x54], cx
inc eax
mov ecx, dword [ebp - 0x58]
cmp eax, ecx
jb 0x584570
xor eax, eax
lea edx, [edi + 0xc]
mov word [ebp + ecx*2 - 0x54], ax
lea ecx, [ebp - 0xb8]
push 1
call fcn.00582710
add esp, 4
mov edi, eax
mov dword [ebp - 4], 4
mov edx, 0xc
mov dword [ebp - 0x48], edx
xor ecx, ecx
mov dword [ebp - 0x44], 0xcf00db
mov dword [ebp - 0x40], 0x8c00cc
mov dword [ebp - 0x3c], 0xd600c8
mov dword [ebp - 0x38], 0xdf00df
mov dword [ebp - 0x34], 0xc600c3
mov dword [ebp - 0x30], 0x960093
mov dword [ebp - 0x2c], 0xb5
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x44], ax
inc ecx
mov edx, dword [ebp - 0x48]
cmp ecx, edx
jb 0x5845e1
xor eax, eax
mov word [ebp + edx*2 - 0x44], ax
lea eax, [ebp - 0x44]
push edi
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00413810
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 5
push ecx
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00408060
push esi
mov edx, eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x70]
call fcn.00413520
push 0x7d7290
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
call fcn.00408060
add esp, 0x28
lea ecx, [ebp - 0x70]
call fcn.00404490
lea ecx, [ebp - 0x88]
call fcn.00404490
lea ecx, [ebp - 0xa0]
call fcn.00404490
lea ecx, [ebp - 0xb8]
call fcn.00404490
push ecx
push 0
lea ecx, [ebp - 0x28]
call fcn.004130e0
add esp, 8
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.00404490
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 8
Function at 0x5846b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a4886
mov eax, dword fs:[0]
push eax
mov eax, 0x204c
call fcn.00790c80
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2028], ecx
cmp byte [ebp + 0x10], 0
mov esi, dword [ebp + 0xc]
mov eax, esi
mov edi, dword [ebp + 8]
je 0x58470e
cmp dword [esi + 0x14], 8
jb 0x5846fd
mov eax, dword [esi]
push 0
push 0x100
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
jmp 0x58471e
cmp dword [esi + 0x14], 8
jb 0x584716
mov eax, dword [esi]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x5848ce
mov eax, dword [ebp + 0x10]
movzx ecx, al
mov eax, esi
shl ecx, 8
add ecx, 0xf003f
mov dword [ebp - 0x2020], 0
cmp dword [esi + 0x14], 8
jb 0x584749
mov eax, dword [esi]
lea edx, [ebp - 0x2020]
push edx
push ecx
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5848ce
lea eax, [ebp - 0x201c]
mov dword [ebp - 0x2014], 0x1000
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x2014]
push eax
lea eax, [ebp - 0x2010]
push eax
push 0
push dword [ebp - 0x2020]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x5848b2
nop
push 0x7cf384
lea eax, [ebp - 0x2058]
push esi
push eax
call fcn.00421b40
add esp, 0xc
mov edx, eax
lea ecx, [ebp - 0x2010]
mov dword [ebp - 4], 0
lea eax, [ecx + 2]
mov dword [ebp - 0x2024], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5847d0
sub ecx, dword [ebp - 0x2024]
lea eax, [ebp - 0x2010]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.00407c50
mov dword [ebp - 0x2030], 0
xor ecx, ecx
mov dword [ebp - 0x202c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2040], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2030], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x2028]
lea eax, [ebp - 0x2040]
push eax
push edi
mov byte [ebp - 4], 1
call fcn.005846b0
lea ecx, [ebp - 0x2040]
mov dword [ebp - 0x2024], eax
call fcn.00404490
lea ecx, [ebp - 0x2058]
mov dword [ebp - 4], 0xffffffff
call fcn.00404490
mov eax, dword [ebp - 0x2024]
test eax, eax
jne 0x5848ce
lea eax, [ebp - 0x201c]
mov dword [ebp - 0x2014], 0x1000
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x2014]
push eax
lea eax, [ebp - 0x2010]
push eax
push 0
push dword [ebp - 0x2020]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x5847a0
push dword [ebp - 0x2020]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 0x14], 8
jb 0x5848c6
mov esi, dword [esi]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x584c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a48d8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x48], edi
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 4
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0xc9dbd3dd
mov byte [ebp - 0x38], 0xad
mov word [ebp - 0x37], cx
mov byte [ebp - 0x35], cl
lea eax, [ecx - 0x57]
xor byte [ebp + ecx - 0x3c], al
inc ecx
mov eax, dword [ebp - 0x40]
cmp ecx, eax
jb 0x584ca1
mov byte [ebp + eax - 0x3c], 0
mov ecx, edx
lea eax, [ebp - 0x3c]
push eax
call fcn.00772c10
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.007737d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x14]
cmp esi, 8
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmovae eax, ecx
cmp edx, 2
jne 0x584d0a
push edx
push 0x7da1ac
push eax
call fcn.004090d0
add esp, 0xc
test eax, eax
jne 0x584d04
mov dword [edi], 1
jmp 0x584d31
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmp esi, 8
lea eax, [ebp - 0x28]
cmovae eax, ecx
cmp edx, 2
jne 0x584d31
push edx
push 0x7da1b4
push eax
call fcn.004090d0
add esp, 0xc
test eax, eax
jne 0x584d31
mov dword [edi], 2
xor ecx, ecx
mov dword [ebp - 0x30], 0xc9c6cbc7
mov eax, 4
mov byte [ebp - 0x2c], 0xad
mov dword [ebp - 0x34], eax
mov word [ebp - 0x2b], cx
mov byte [ebp - 0x29], cl
nop dword [eax]
lea eax, [ecx - 0x57]
xor byte [ebp + ecx - 0x30], al
inc ecx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
jb 0x584d50
mov ecx, dword [ebp - 0x44]
mov byte [ebp + eax - 0x30], 0
lea eax, [ebp - 0x30]
push eax
call fcn.00772c10
lea ecx, [ebp - 0x60]
push ecx
mov ecx, eax
call fcn.007737d0
mov esi, eax
add edi, 4
cmp edi, esi
je 0x584dae
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x60]
call fcn.00404490
xor ecx, ecx
mov dword [ebp - 0x30], 0xc4dfcbd9
mov eax, 4
mov byte [ebp - 0x2c], 0xad
mov dword [ebp - 0x34], eax
xor edx, edx
mov word [ebp - 0x2b], cx
mov byte [ebp - 0x29], cl
lea eax, [edx - 0x57]
xor byte [ebp + edx - 0x30], al
inc edx
mov eax, dword [ebp - 0x34]
cmp edx, eax
jb 0x584dd4
mov byte [ebp + eax - 0x30], cl
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x44]
push eax
call fcn.00772c10
lea ecx, [ebp - 0x60]
push ecx
mov ecx, eax
call fcn.007737d0
mov edi, dword [ebp - 0x48]
mov esi, eax
add edi, 0x1c
cmp edi, esi
je 0x584e34
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x60]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 4