joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a790
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
push 4
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x24], eax
push 1
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 0
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45a86e
push 0
push 0
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x45a86e
cmp dword [ebp - 0x1c], 0x10
jne 0x45a83a
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax + 4]
jne 0x45a83a
mov edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
push 1
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
lea edx, [ebp - 0x20]
push edx
call sym.Setup.exe_public:_static_bool___cdecl_DuiLib::CPaintManagerUI::TranslateMessage_struct_tagMSG__const_
add esp, 4
movzx eax, al
test eax, eax
jne 0x45a861
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
jne 0x45a869
jmp 0x45a86e
jmp 0x45a7e8
push 1
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x1c], 0x12
jne 0x45a894
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x483e30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x483e40
xor eax, eax
jmp 0x483fdd
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x483f9e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4c23c8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4c23c8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4c23c8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4c23c8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4c23c8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4c23c8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4c23c8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4c23c8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x483e49
cmp dword [ebp + 0x10], 0
je 0x483fd7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4c23c8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x483fa4
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x484ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
movzx edx, byte [ecx]
test edx, edx
je 0x484f0f
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x484f05
mov edx, dword [ebp + 0x14]
mov byte [edx + 8], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp + 0xc]
jmp 0x484f69
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x18]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [edx + 0x14]
jbe 0x484f2f
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x14]
sub edx, dword [ecx + 0x18]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp + 0x14]
add edx, dword [eax + 0x18]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004268b0
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x18]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x18], ecx
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x486f20
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4f2500]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
je 0x486f43
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
test ecx, ecx
jne 0x486f48
jmp 0x487030
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
movzx edx, word [ecx]
test edx, edx
je 0x486f9a
mov eax, dword [ebp - 0x218]
movzx ecx, word [eax]
cmp ecx, 0x2f
je 0x486f80
mov edx, dword [ebp - 0x218]
movzx eax, word [edx]
cmp eax, 0x5c
jne 0x486f89
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x218]
add edx, 2
mov dword [ebp - 0x218], edx
jmp 0x486f57
mov eax, dword [ebp - 4]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
je 0x486ffb
mov edx, dword [ebp - 4]
sub edx, dword [ebp + 0xc]
sar edx, 1
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x420]
push ecx
call fcn.00425661
add esp, 0xc
mov edx, dword [ebp - 4]
sub edx, dword [ebp + 0xc]
sar edx, 1
xor eax, eax
mov word [ebp + edx*2 - 0x420], ax
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00486f20
add esp, 8
mov eax, dword [ebp - 0x214]
add eax, 2
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.004b14e0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.004b14af
add esp, 8
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042292e
mov esp, ebp
pop ebp
ret
Function at 0x48e500
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x664], 0
je 0x48e5b1
cmp dword [ebp + 8], 0x100
jne 0x48e57d
movzx ecx, word [ebp + 0xc]
cmp ecx, 0xd
jne 0x48e57d
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x66a]
test eax, eax
je 0x48e556
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x48e57d
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x66b]
test eax, eax
jne 0x48e57d
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x44], 0
je 0x48e579
push 0
push 0
push 0
push str.return
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x44]
call sym.Setup.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
jmp 0x48e5b6
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x664]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
call eax
jmp 0x48e5b6
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a4160
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4f2500]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x18]
test ecx, ecx
jne 0x4a4185
xor eax, eax
jmp 0x4a421d
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x10], 0
jne 0x4a4195
xor eax, eax
jmp 0x4a421d
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
shl eax, 1
call fcn.004320f0
mov dword [ebp - 0x14], esp
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x4a41c5
xor eax, eax
jmp 0x4a421d
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x10]
add ecx, 0x1c4
call fcn.00451b00
push 0
push 0
push 0
push str.textchanged
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x10]
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
call sym.Setup.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
lea esp, [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042292e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4af8e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4af8f0
mov ecx, dword [ebp + 8]
sub eax, edx
mov esi, eax
lea eax, [ebp + 0xc]
push eax
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4af93b
mov edx, dword [ebp + 0xc]
push esi
push edi
push 1
push eax
push 0x4cf818
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4b0660
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2ff8
call fcn.00437cf0
mov eax, dword [0x4f2500]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.ReadFirstPhysicalDriveInNTWithZeroRights_Enter._n
mov esi, ecx
call fcn.0042534f
add esp, 4
xor ebx, ebx
mov dword [ebp - 0x2ff4], ebx
mov eax, dword [ebp - 0x2ff4]
push eax
push str..PhysicalDrive_d
lea ecx, [ebp - 0x104]
push 0x100
push ecx
call fcn.00425331
add esp, 0x10
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4b0811
push 0x270f
lea eax, [ebp - 0x2fe3]
push ebx
push eax
mov byte [ebp - 0x2fe4], bl
call fcn.004276b0
add esp, 0xc
push ebx
lea ecx, [ebp - 0x2ff8]
push ecx
push 0x2710
xor eax, eax
lea edx, [ebp - 0x2fe4]
push edx
mov dword [ebp - 0x2ff0], eax
mov dword [ebp - 0x2fec], eax
push 0xc
mov dword [ebp - 0x2fe8], eax
lea eax, [ebp - 0x2ff0]
push eax
push 0x2d1400
push edi
mov dword [ebp - 0x2ff8], ebx
mov dword [ebp - 0x2ff0], ebx
mov dword [ebp - 0x2fec], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4b0808
push 0x3e7
lea ecx, [ebp - 0x4eb]
push ebx
push ecx
mov byte [ebp - 0x4ec], bl
call fcn.004276b0
push 0x3e7
lea edx, [ebp - 0x8d3]
push ebx
push edx
mov byte [ebp - 0x8d4], bl
call fcn.004276b0
mov eax, dword [ebp - 0x2fcc]
lea ecx, [ebp + eax - 0x2fe4]
add esp, 0x18
push ecx
mov ecx, esi
call fcn.004af970
push eax
lea edx, [ebp - 0x4ec]
push 0x3e8
push edx
call fcn.0042a9e5
mov eax, dword [ebp - 0x2fd4]
lea ecx, [ebp + eax - 0x2fe4]
add esp, 0xc
push ecx
mov ecx, esi
call fcn.004af970
push eax
lea edx, [ebp - 0x8d4]
push 0x3e8
push edx
call fcn.0042a9e5
lea eax, [ebp - 0x4ec]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4b07d3
sub eax, ecx
push eax
lea eax, [ebp - 0x4ec]
push eax
mov ecx, esi
call fcn.00402a10
push 1
push ebx
push 0x4cb7e0
mov ecx, esi
call fcn.004afaf0
push eax
push ebx
mov ecx, esi
call fcn.00402b10
cmp dword [esi + 0x10], ebx
jne 0x4b0850
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4b0827
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xffffffffffffffff
push str._hDevice___d__Error___d___n
call fcn.0042534f
add esp, 0xc
mov eax, dword [ebp - 0x2ff4]
inc eax
mov dword [ebp - 0x2ff4], eax
cmp eax, 0x10
jl 0x4b0691
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042292e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0042292e
mov esp, ebp
pop ebp
ret
Function at 0x4b0c80
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4f2500]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x220], ecx
xor edi, edi
mov dword [ebp - 0x210], ebx
mov byte [ebp - 0x108], bl
call fcn.004276b0
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 8
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4b0e24
mov eax, dword [ebp - 0x210]
cmp eax, ebx
je 0x4b0e24
push esi
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x108]
push ecx
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x21c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4b0e16
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x4b0d30
mov ecx, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 1
push ebx
lea eax, [ebp - 0x108]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4b0dcc
push 0x103
lea edx, [ebp - 0x20b]
push ebx
push edx
mov byte [ebp - 0x20c], bl
call fcn.004276b0
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebp - 0x214]
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x224]
push edx
push ebx
push str.ServiceName
push eax
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 0x224], 1
call edi
test eax, eax
jne 0x4b0dbf
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x220]
call fcn.004b0870
test eax, eax
jne 0x4b0df7
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x210]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x108]
push ecx
inc esi
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4b0d30
jmp 0x4b0e14
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x220]
mov edi, 1
cmp dword [ecx + 0x2c], ebx
jne 0x4b0e16
mov edi, ebx
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.0042292e
mov esp, ebp
pop ebp
ret
Function at 0x4b0e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b754c
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4f2500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x80], ebx
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x4cb35d
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x88], esi
mov byte [esi], bl
call fcn.00402a10
push 0x63
lea eax, [ebp - 0x73]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x80], 1
mov byte [ebp - 0x74], bl
call fcn.004276b0
add esp, 0xc
lea ecx, [ebp - 0x78]
push ecx
push 1
push ebx
push edi
push SysReAllocString
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x7c], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4b0f05
lea edx, [ebp - 0x7c]
push edx
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x84]
push ecx
push ebx
push 0x4cf818
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x74]
lea edx, [eax + 1]
jmp 0x4b0f10
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4b0f10
sub eax, edx
push eax
lea ecx, [ebp - 0x74]
push ecx
mov ecx, esi
call fcn.00402a10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042292e
mov esp, ebp
pop ebp
ret 8
Function at 0x401180
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x804e08]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x40132d
cmp dword [0x804e0c], 0
jne 0x401319
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00403260
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x4011d0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41c0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x4011e0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41c0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x401215
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00403260
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401274
sub edx, esi
sar edx, 1
je 0x40132d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x401290
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x40132d
xor eax, eax
push ebx
test edx, edx
je 0x4012c8
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x4012c8
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x4012b1
xor eax, eax
test edx, edx
je 0x4012e2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x4012e2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4012d0
xor eax, eax
test edx, edx
je 0x4012ff
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x4012ff
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4012f0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x804e08]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x401930
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x40198b
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401950
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x40196c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402b50
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4019ad
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x401a1f
mov esi, dword [ebx]
cmp esi, ebx
je 0x401a1f
test esi, esi
je 0x401a1f
cmp word [esi + 0x24], 2
jbe 0x401a19
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x401a19
cmp dword [esi + 0x18], 0
je 0x401a19
test ebp, ebp
je 0x4019d5
cmp ebp, eax
jne 0x401a19
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402b50
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x4019fa
cmp edx, dword [esi + 0x18]
jne 0x401a19
cmp dword [esp + 0x14], eax
je 0x401a2c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.004037e0
add esp, 8
test eax, eax
je 0x401a2c
mov esi, dword [esi]
cmp esi, ebx
jne 0x4019b3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret

Function at 0x401b30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x805f18]
sub esp, 0x11c
test eax, eax
jne 0x401c2e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00403260
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x401b80
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41c100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x401b90
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41c104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x401bc5
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00401930
pop edi
pop esi
pop ebx
test eax, eax
je 0x401c29
mov eax, dword [eax + 0x18]
test eax, eax
je 0x401c29
mov dword [0x805f18], eax
add esp, 0x11c
ret
mov eax, dword [0x805f18]
add esp, 0x11c
ret