joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001800
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0xffffffff
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 8]
lock xadd dword [ebx + 4], esi
sub esi, 1
jne 0x10001845
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x10001850
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret 4
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov dword [ebx + 8], 0
sub esp, 4
jmp 0x10001821

Function at 0x100018e0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
mov dword [esp + 8], 0x18
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x1000197f
mov dword [eax], sym._HGLOBALLockBytesImpl_QueryInterface_12
mov ebx, eax
mov dword [eax + 4], 1
mov dword [eax + 8], esi
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
test esi, esi
je 0x10001960
mov dword [ebx + 0x14], 0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GlobalSize]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x10]
sub esp, 4
mov dword [eax], ebx
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0xc
mov dword [esp + 4], 0
mov dword [esp], 0x22
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebx + 8], eax
sub esp, 8
mov esi, eax
jmp 0x10001933
mov eax, 0x8007000e
jmp 0x10001950
Function at 0x10002bb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x28
mov ebx, dword [ebp + 8]
test byte [0x10004038], 8
jne 0x10002cc0
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 7
mov dword [esp + 4], 0x80000000
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x10002dcd
lea eax, [ebp - 0x14]
lea esi, [ebp - 0x10]
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 8
mov dword [esp + 4], esi
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x10002c70
test byte [0x10004038], 4
jne 0x10002d50
mov dword [esp], ebx
mov ebx, 1
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
cmp dword [ebp - 0x14], 8
je 0x10002cf8
mov ebx, 1
test byte [0x10004038], 8
je 0x10002c5b
mov dword [esp + 0xc], str._too_short_n
mov dword [esp + 8], 0x10006340
mov dword [esp + 4], 0x10004038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x10002c5b
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0xc], 0x100062c8
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x10006340
mov dword [esp + 4], 0x10004038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x10002bc8
mov eax, dword [0x10006394]
cmp dword [esi], eax
je 0x10002db8
mov ebx, 1
movzx eax, byte [0x10004038]
and eax, 8
test ebx, ebx
je 0x10002d80
mov ebx, 1
test al, al
je 0x10002c5b
mov dword [esp + 0xc], str.____Invalid_header._n
mov dword [esp + 8], 0x10006340
mov dword [esp + 4], 0x10004038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x10002c5b
mov dword [esp + 0xc], str._unable_to_read_file_n
mov dword [esp + 8], 0x10006340
mov dword [esp + 4], 0x10004038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x10002c4a
test al, al
je 0x10002c5b
mov dword [esp + 0xc], str.____YES_n
mov dword [esp + 8], 0x10006340
mov dword [esp + 4], 0x10004038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x10002c5b
mov eax, dword [0x10006398]
xor ebx, ebx
cmp dword [esi + 4], eax
jne 0x10002d05
jmp 0x10002d0a
mov ebx, 0x80030002
jmp 0x10002c5b

Function at 0x10002ec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10002f18
cmp byte [esi + ebx - 1], 0xa
je 0x10002eec
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10010084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10003540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10003718
mov edi, dword [0x10010084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10003627
test byte [0x10004050], 8
jne 0x100036c0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10004060], 8
jne 0x10003680
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100035c9
cmp esi, 3
jbe 0x10003638
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x100035da
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x1000ccdc]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x100035c9
mov dword [esp], 0x10004060
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100035a0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x100035a0
mov dword [esp], 0x10004050
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000358b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10003593
mov eax, 0xffffffff
jmp 0x10003627
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5d1e2e32
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x311215c2
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4073d4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x438aa8]
jne 0x4073de
repz ret
jmp fcn.0040882e

Function at 0x4078b0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x438aa8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405f1d
and dword [ebp - 0x14], 0
cmp dword [0x44fd18], 0
mov dword [ebp - 0x18], eax
jne 0x407963
push 0x402198
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407a0b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40218c
push ebx
call edi
test eax, eax
je 0x407a0b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40217c
push ebx
mov dword [0x44fd18], eax
call edi
push eax
call esi
push 0x402168
push ebx
mov dword [0x44fd1c], eax
call edi
push eax
call esi
push 0x40214c
push ebx
mov dword [0x44fd20], eax
call edi
push eax
call esi
mov dword [0x44fd28], eax
test eax, eax
je 0x407963
push 0x402134
push ebx
call edi
push eax
call esi
mov dword [0x44fd24], eax
mov eax, dword [0x44fd24]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4079bc
cmp dword [0x44fd28], ecx
je 0x4079bc
push eax
call esi
push dword [0x44fd28]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4079bc
test ebx, ebx
je 0x4079bc
call edi
test eax, eax
je 0x4079b3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4079b3
test byte [ebp - 8], 1
jne 0x4079bc
or dword [ebp + 0x10], 0x200000
jmp 0x4079ef
mov eax, dword [0x44fd1c]
cmp eax, dword [ebp - 0x18]
je 0x4079ef
push eax
call esi
test eax, eax
je 0x4079ef
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4079ef
mov eax, dword [0x44fd20]
cmp eax, dword [ebp - 0x18]
je 0x4079ef
push eax
call esi
test eax, eax
je 0x4079ef
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44fd18]
call esi
test eax, eax
je 0x407a0b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407a0d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004073d4
leave
ret
Function at 0x4271a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4271f9
test eax, edx
je 0x4271fc
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4271b7
movzx eax, word [eax]
sub eax, ecx
jmp 0x4271de
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [eax + ecx]
xor ebx, dword [edx + ecx]
jne 0x4271df
add ecx, 4
js 0x4271cf
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4271dc
movzx eax, word [eax + ecx]
movzx edx, word [edx + ecx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4271de
xor eax, eax
ret
test eax, eax
je 0x427208
test edx, edx
jne 0x4271a8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4327c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040b2d4
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0041141c
mov edi, eax
cmp edi, 0x104
jbe 0x432773
mov eax, edi
add eax, eax
call fcn.00406eb4
mov esi, eax
jmp 0x432775
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0041141c
push esi
call fcn.00417628
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4327ae
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x432798
mov eax, esp
cmp esi, eax
je 0x4327bb
mov eax, esi
call fcn.00406ed0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4327f4
cmp bl, 0
je 0x4327f0
cmp bl, 0x41
jl 0x4327eb
cmp bl, 0x5a
jg 0x4327eb
or bl, 0x20
xor al, bl
inc esi
jmp 0x4327cf
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x432734
Function at 0x4359f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x435a16
mov eax, dword [eax - 4]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x435a2e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x435a29
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
jmp 0x435a33
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x435aa1
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x435aea
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x435a5f
inc dword [ebp - 0xc]
jmp 0x435a77
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x435a77
cmp dword [ebp - 0xc], 0
jle 0x435a77
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x435a99
xor eax, eax
jmp 0x435a95
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x435a94
mov eax, esi
jmp 0x435aed
inc eax
cmp eax, ecx
jle 0x435a81
inc esi
cmp esi, dword [ebp - 8]
jl 0x435a4b
jmp 0x435aea
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x435aea
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x435ac2
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x435ae4
xor eax, eax
jmp 0x435ae0
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x435adf
mov eax, esi
jmp 0x435aed
inc eax
cmp eax, ecx
jle 0x435acc
inc esi
cmp esi, dword [ebp - 8]
jl 0x435aaa
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x435cfc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x435d19
mov eax, dword [eax - 4]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x435d27
mov eax, dword [eax - 4]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x435e49
test ebx, ebx
jl 0x435e49
test esi, esi
jle 0x435e49
mov eax, dword [ebp - 8]
call fcn.0040b8c4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040b8c4
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x435de6
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x435e49
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x435dcb
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x435d9a
inc dword [ebp - 0x14]
jmp 0x435daa
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x435daa
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x435db5
or eax, 0xffffffff
jmp 0x435dcb
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x435dc8
inc eax
jmp 0x435dcb
or eax, 0xffffffff
test eax, eax
jl 0x435dd3
cmp esi, eax
jg 0x435d88
cmp esi, eax
jg 0x435dde
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x435e4c
inc edx
dec dword [ebp - 0x1c]
jne 0x435d84
jmp 0x435e49
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x435e49
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x435e30
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x435e0f
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x435e1a
or eax, 0xffffffff
jmp 0x435e30
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x435e2d
inc eax
jmp 0x435e30
or eax, 0xffffffff
test eax, eax
jl 0x435e38
cmp esi, eax
jg 0x435df8
cmp esi, eax
jg 0x435e43
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x435e4c
inc edx
dec dword [ebp - 0x1c]
jne 0x435df4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x446988
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x446990
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4e6bfc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x4e6c13
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x4e6c03
mov eax, ecx
pop ebx
ret
Function at 0x511fcc
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x51218b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040b224
mov eax, dword [ebp - 4]
call fcn.005118ac
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x51201e
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040bce4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00512f50
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x5120ff
xor eax, eax
push ebp
push 0x5120f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00511bb8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.005121c0
test al, al
je 0x5120d4
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040af84
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x5120d4
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040b8c4
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00416c90
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00511b18
test al, al
je 0x5120ce
mov eax, dword [ebp - 8]
call fcn.0040b8c4
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040b924
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00511fcc
dec ebx
cmp ebx, 0xffffffff
jne 0x51207d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5120ff
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00511bb8
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00416c40
pop eax
jmp eax
cmp byte [0x702920], 0
je 0x51213f
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040b8c4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00511ba4
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00511b18
mov ebx, eax
jmp 0x512166
mov eax, dword [ebp - 4]
call fcn.0040b8c4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00511ba4
push eax
call fcn.00416c80
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00511b18
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512192
lea eax, [ebp - 0x3c]
call fcn.0040adec
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ae4c
pop eax
jmp eax

Function at 0x5205ac
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x5205b2
ret
Function at 0x540a24
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
and eax, 0xff
shr ecx, 8
inc edx
xor ecx, dword [eax*4 + 0x6f02cc]
cmp edx, 4
mov eax, ecx
jl 0x540a2c
pop ebp
ret

Function at 0x540a48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
inc edx
shr eax, 0x18
and eax, 0xff
shl ecx, 8
xor ecx, dword [eax*4 + 0x6f06cc]
cmp edx, 4
mov eax, ecx
jl 0x540a50
pop ebp
ret
Function at 0x618b14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x703050], 0
jne 0x618b2b
call fcn.00618ad0
mov eax, edi
dec eax
test eax, eax
jl 0x618b53
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x702c50]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x618b35
mov eax, ebx
pop edi
pop esi
pop ebx
ret