joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413ec8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x413f72
mov dword [esp], esi
call fcn.00412ad4
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jle 0x41402c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [esp], eax
call fcn.00475fd0
mov edi, eax
mov byte [eax], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_fread
dec eax
je 0x413fa4
mov dword [esp], edi
call fcn.00475fac
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], esi
call fcn.004106ac
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp - 0x1c]
lea ebx, [edi + eax]
mov byte [ebx], 0
mov cl, byte [edi]
mov edx, edi
mov eax, edi
test cl, cl
je 0x413fdf
nop
cmp eax, ebx
jae 0x41407a
cmp ebx, edx
jb 0x414096
cmp eax, edx
jb 0x41405e
cmp cl, 0xd
je 0x41401c
mov byte [edx], cl
inc eax
mov cl, byte [eax]
inc edx
test cl, cl
jne 0x413fb8
cmp ebx, edx
jb 0x4140b2
mov byte [edx], 0
mov eax, dword [esi]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [eax + 0xc]
mov dword [esp], edi
call fcn.00475fac
mov al, byte [esi + 0x2c]
xor eax, 1
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov byte [edx], 0xa
inc eax
mov cl, byte [eax]
cmp cl, 0xa
je 0x413fd7
inc edx
jmp 0x413fdb
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], esi
call fcn.004106ac
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], 0x3f8
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.q___p
call sub.msvcrt.dll__assert
mov dword [esp + 8], 0x3f6
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.p____buflength_
call sub.msvcrt.dll__assert
mov dword [esp + 8], 0x3f7
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.q____buflength_
call sub.msvcrt.dll__assert
mov dword [esp + 8], 0x405
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.q____buflength_
call sub.msvcrt.dll__assert
nop

Function at 0x418f20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
leave
ret
Function at 0x419844
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x74
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
test esi, esi
je 0x4198ca
xor ebx, ebx
lea edi, [ebp - 0x64]
lea esi, [esi]
mov eax, dword [ecx + ebx*4]
mov dword [esp + 8], eax
mov eax, dword [edx + ebx*4]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x74], ecx
call fcn.00419744
inc ebx
cmp esi, ebx
mov edx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x74]
ja 0x41988c
mov dword [esp + 4], edi
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call fcn.004196c4
add esp, 0x74
pop ebx
pop esi
pop edi
leave
ret
lea edi, [ebp - 0x64]
jmp 0x4198b3
Function at 0x4198d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xa0
cmp dword [ebp + 0x10], 5
ja 0x419a0f
cmp dword [ebp + 0xc], 0x40
ja 0x419a1a
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x98], ecx
mov ecx, 0x40
xor eax, eax
mov edi, dword [ebp - 0x98]
rep stosb byte es:[edi], al
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x98]
rep movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x8c]
lea edx, [ebp - 0x4c]
mov eax, ebx
xor byte [eax], 0x36
inc eax
cmp eax, edx
jne 0x419924
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 0x40
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419a4a
xor eax, eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x9c], ebx
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
nop
inc eax
mov ecx, dword [esi + eax*4 - 4]
mov ebx, dword [ebp - 0x90]
mov dword [ebx + eax*4], ecx
mov ecx, dword [edi + eax*4 - 4]
mov dword [edx + eax*4], ecx
cmp eax, dword [ebp + 0x10]
jne 0x419960
mov ebx, dword [ebp - 0x9c]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov ecx, dword [ebp - 0x90]
mov dword [esp + 4], ecx
mov eax, dword [ebp + 0x10]
inc eax
mov dword [esp], eax
mov dword [ebp - 0x94], edx
call fcn.00419844
mov ecx, 0x40
xor eax, eax
mov edi, dword [ebp - 0x98]
rep stosb byte es:[edi], al
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x98]
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x94]
nop
xor byte [ebx], 0x5c
inc ebx
cmp edx, ebx
jne 0x4199cc
lea ebx, [ebp - 0x8c]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x4c], 0x40
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov ecx, dword [ebp - 0x90]
mov dword [esp + 4], ecx
mov dword [esp], 2
call fcn.00419844
add esp, 0xa0
pop ebx
pop esi
pop edi
leave
ret
lea ebx, [ebp - 0x1c]
mov dword [esp + 0xc], ebx
lea eax, [ebp + 0xc]
mov dword [esp + 8], eax
lea eax, [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.00419844
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], 0x10
jmp 0x4198f0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x90], ecx
jmp 0x419980
Function at 0x419a9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
cmp dword [esi], 2
je 0x419ac4
mov eax, 0xffffffff
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
test al, 7
jne 0x419ab6
shr eax, 3
mov dword [ebp - 0x44], eax
je 0x419b44
lea eax, [esi + 4]
mov dword [ebp - 0x48], eax
lea edx, [esi + 0x304]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x38]
lea esi, [esi]
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [ebp - 0x4c], ecx
call fcn.00419f34
xor eax, eax
mov ecx, dword [ebp - 0x4c]
lea esi, [esi]
mov dl, byte [esi + eax + 0x304]
xor byte [ebx + eax], dl
inc eax
cmp eax, 8
jne 0x419b14
mov eax, dword [ecx]
mov edx, dword [ebp - 0x40]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x44], eax
jbe 0x419b44
add ebx, 8
add edi, 8
jmp 0x419aec
xor eax, eax
jmp 0x419abb

Function at 0x419b4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
cmp dword [ebx], 2
je 0x419b74
mov eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
test al, 7
jne 0x419b66
shr eax, 3
mov dword [ebp - 0x20], eax
je 0x419be8
lea eax, [ebx + 4]
mov dword [ebp - 0x24], eax
lea ecx, [ebx + 0x304]
mov dword [ebp - 0x1c], 0
mov eax, edi
mov edi, ecx
mov ecx, eax
lea esi, [esi]
xor eax, eax
nop
mov dl, byte [esi + eax]
xor byte [ebx + eax + 0x304], dl
inc eax
cmp eax, 8
jne 0x419ba0
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [ebp - 0x28], ecx
call fcn.00419e74
mov eax, dword [edi]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], eax
jbe 0x419be8
add esi, 8
add ecx, 8
jmp 0x419b9c
xor eax, eax
jmp 0x419b6b
Function at 0x419c70
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [eax]
mov esi, dword [eax + 4]
mov eax, ebx
shr eax, 4
xor eax, esi
and eax, 0xf0f0f0f
xor esi, eax
mov ecx, eax
shl ecx, 4
xor ecx, ebx
mov eax, ecx
shr eax, 0x10
xor eax, esi
and eax, 0xffff
xor esi, eax
shl eax, 0x10
xor eax, ecx
mov ecx, esi
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
lea ebx, [ecx*4]
xor ebx, esi
mov ecx, ebx
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor ecx, ebx
ror ecx, 0x1f
mov ebx, ecx
xor ebx, eax
and ebx, 0xaaaaaaaa
xor eax, ebx
xor ecx, ebx
ror eax, 0x1f
xor ebx, ebx
nop
mov esi, ecx
ror esi, 4
xor esi, dword [edx + ebx]
mov edi, dword [edx + ebx + 4]
xor edi, ecx
mov dword [ebp - 0x10], edi
and edi, 0x3f
xor eax, dword [edi*4 + 0x486c00]
mov edi, esi
and edi, 0x3f
xor eax, dword [edi*4 + 0x486800]
mov edi, dword [ebp - 0x10]
shr edi, 8
and edi, 0x3f
xor eax, dword [edi*4 + 0x486d00]
mov edi, dword [ebp - 0x10]
shr edi, 0x10
and edi, 0x3f
xor eax, dword [edi*4 + 0x486e00]
mov edi, dword [ebp - 0x10]
shr edi, 0x18
and edi, 0x3f
xor eax, dword [edi*4 + 0x486f00]
mov edi, esi
shr edi, 8
and edi, 0x3f
xor eax, dword [edi*4 + 0x486900]
mov edi, esi
shr edi, 0x10
and edi, 0x3f
xor eax, dword [edi*4 + 0x486a00]
shr esi, 0x18
and esi, 0x3f
xor eax, dword [esi*4 + 0x486b00]
mov esi, eax
ror esi, 4
xor esi, dword [edx + ebx + 8]
mov edi, dword [edx + ebx + 0xc]
xor edi, eax
mov dword [ebp - 0x10], edi
and edi, 0x3f
xor ecx, dword [edi*4 + 0x486c00]
mov edi, esi
and edi, 0x3f
xor ecx, dword [edi*4 + 0x486800]
mov edi, dword [ebp - 0x10]
shr edi, 8
and edi, 0x3f
xor ecx, dword [edi*4 + 0x486d00]
mov edi, dword [ebp - 0x10]
shr edi, 0x10
and edi, 0x3f
xor ecx, dword [edi*4 + 0x486e00]
mov edi, dword [ebp - 0x10]
shr edi, 0x18
and edi, 0x3f
xor ecx, dword [edi*4 + 0x486f00]
mov edi, esi
shr edi, 8
and edi, 0x3f
xor ecx, dword [edi*4 + 0x486900]
mov edi, esi
shr edi, 0x10
and edi, 0x3f
xor ecx, dword [edi*4 + 0x486a00]
shr esi, 0x18
and esi, 0x3f
xor ecx, dword [esi*4 + 0x486b00]
add ebx, 0x10
cmp ebx, 0x80
jne 0x419cec
ror ecx, 1
mov edx, ecx
xor edx, eax
and edx, 0xaaaaaaaa
xor eax, edx
xor ecx, edx
ror eax, 1
mov edx, eax
shr edx, 8
xor edx, ecx
and edx, 0xff00ff
xor ecx, edx
shl edx, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, ecx
and eax, 0x33333333
xor ecx, eax
shl eax, 2
xor eax, edx
mov edx, ecx
shr edx, 0x10
xor edx, eax
and edx, 0xffff
mov ebx, edx
xor ebx, eax
shl edx, 0x10
xor edx, ecx
mov eax, edx
shr eax, 4
xor eax, ebx
and eax, 0xf0f0f0f
mov ecx, eax
shl ecx, 4
xor ecx, edx
mov edx, dword [ebp - 0x14]
mov dword [edx], ecx
xor eax, ebx
mov dword [edx + 4], eax
add esp, 8
pop ebx
pop esi
pop edi
leave
ret
Function at 0x41a218
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
xor edx, edx
mov eax, esi
call fcn.00419ff8
lea edi, [esi + 8]
lea ecx, [ebx + 0x80]
mov edx, 1
mov eax, edi
call fcn.00419ff8
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
lea ecx, [ebx + 0x100]
xor edx, edx
call fcn.00419ff8
lea eax, [ebx + 0x180]
mov dword [ebp - 0x14], eax
lea ecx, [ebx + 0x280]
mov edx, 1
mov eax, esi
call fcn.00419ff8
lea ecx, [ebx + 0x200]
xor edx, edx
mov eax, edi
call fcn.00419ff8
mov ecx, dword [ebp - 0x14]
mov edx, 1
mov eax, dword [ebp - 0x10]
add esp, 8
pop ebx
pop esi
pop edi
leave
jmp fcn.00419ff8

Function at 0x41e740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
mov dword [esp], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x10]
test ebx, ebx
mov dword [esp + 8], edi
sete al
cmp esi, ecx
sete dl
or eax, edx
xor edi, edi
test al, 1
jne 0x41e7a0
test esi, esi
setne al
test ecx, ecx
setne dl
xor eax, edx
test al, 1
jne 0x41e7b1
test ebx, ebx
je 0x41e794
movzx eax, word [esi]
movzx edx, word [ecx]
cmp ax, dx
jne 0x41e7cd
add esi, 2
add ecx, 2
dec ebx
jne 0x41e780
xor edi, edi
lea esi, [esi]
lea edi, [edi]
mov eax, edi
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
ret
cmp ecx, 1
mov ebx, dword [esp]
sbb eax, eax
and eax, 2
mov esi, dword [esp + 4]
lea edi, [eax - 1]
mov eax, edi
mov edi, dword [esp + 8]
add esp, 0xc
ret
movzx edi, ax
movzx eax, dx
sub edi, eax
jmp 0x41e7a0
Function at 0x45369c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebx, eax
cmp eax, 0xffffffff
je 0x4536d4
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x4536ab
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x10003a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10003b47
push esi
push dword [ebp - 8]
call fcn.100833d6
push dword [ebp - 8]
mov esi, eax
push 0
push esi
call fcn.10080190
add esp, 0x10
mov dword [ebp - 0xc], 1
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test esi, esi
je 0x10003b3c
mov ecx, dword [ebp + 0x14]
mov eax, esi
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10003b16
test dx, dx
je 0x10003b12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10003b16
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003af0
xor eax, eax
jmp 0x10003b1b
sbb eax, eax
or eax, 1
movzx ebx, byte [ebp - 1]
test eax, eax
mov ecx, 1
push esi
cmove ebx, ecx
call fcn.100833d1
add esp, 4
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10003f00
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x101d9154]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str.SOFTWARERegisteredApplications]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
movups xmmword [ebp - 0xcc], xmm0
push esi
movups xmm0, xmmword [0x101735c0]
push 0x88
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x8c]
movups xmmword [ebp - 0xbc], xmm0
push 0
movups xmm0, xmmword [0x101735d0]
push eax
movups xmmword [ebp - 0xac], xmm0
movups xmm0, xmmword [0x101735e0]
movups xmmword [ebp - 0x9c], xmm0
call fcn.10080190
push 0xc8
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.10080190
add esp, 0x18
xor ecx, ecx
movzx eax, word [ebp + ecx - 0xcc]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x196], ax
test ax, ax
jne 0x10003f84
push edi
lea edi, [ebp - 0x194]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10003fa6
mov eax, dword [0x101734d4]
mov edx, ebx
mov dword [edi], eax
mov esi, edx
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10003fc0
lea edi, [ebp - 0x194]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10003fd6
mov ecx, edx
lea eax, [ebp - 0xcc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp dword [ebp + 0x10], 0
je 0x10004042
mov esi, dword [ebp - 0x198]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004015
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push ebx
lea eax, [ebp - 0xcc]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10062ee4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004300
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x101d9154]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x324]
push esi
mov esi, dword [ebp + 8]
push 0x190
push 0
push eax
call fcn.10080190
push 0xc8
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.10080190
push 0xc8
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.10080190
push ebx
push esi
lea eax, [ebp - 0x194]
push 0x10173548
push eax
call fcn.10006d80
push esi
lea eax, [ebp - 0x324]
push str.SOFTWARE_sCapabilitiesFileAssociations
push eax
call fcn.10006d80
add esp, 0x40
xor eax, eax
nop
movzx ecx, word [ebp + eax - 0x324]
lea eax, [eax + 2]
mov word [ebp + eax - 0xce], cx
test cx, cx
jne 0x10004380
push edi
lea edi, [ebp - 0xcc]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x100043a2
mov eax, dword [0x101734d4]
mov edx, ebx
mov dword [edi], eax
mov esi, edx
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100043c0
lea edi, [ebp - 0xcc]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100043d6
mov ecx, edx
lea eax, [ebp - 0xcc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x194]
lea edx, [ecx + 2]
pop edi
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004410
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push 1
push ebx
lea eax, [ebp - 0x324]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10062ee4
mov esp, ebp
pop ebp
ret 8
Function at 0x100046e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016f400
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x101d9154]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x100048cc
push eax
lea ecx, [ebp - 0x40]
call fcn.10003560
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.100643de
push 0x22c
lea eax, [ebp - 0x284]
push 0
push eax
call fcn.10080190
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x100048b3
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x100048ac
nop dword [eax]
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x100047c5
lea eax, [ebp - 0x260]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100047b6
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.10006830
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.100643de
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push dword [ebp - 0x18]
push eax
call fcn.10006400
add esp, 0x14
test eax, eax
je 0x10004851
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.10068534
mov ecx, eax
add esp, 8
or ebx, 1
cmp dword [ecx + 0x14], 8
lea edx, [ecx + 0x10]
jb 0x1000482c
mov ecx, dword [ecx]
push dword [edx]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
push dword [ebp - 0x30]
push eax
call fcn.10006400
add esp, 0x10
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x10004858
mov byte [ebp - 0x285], 1
test bl, 1
je 0x10004875
mov eax, dword [ebp - 0x44]
and ebx, 0xfffffffe
cmp eax, 8
jb 0x10004875
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.10006930
cmp byte [ebp - 0x285], 0
jne 0x100048e7
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x10004897
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10006930
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10004790
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x100048ca
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.10006930
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10062ee4
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
call fcn.10003860
jmp 0x100048b5
Function at 0x10007060
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100071be
lea ecx, [esi*8]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esi*8]
lea eax, [ecx + ecx*2]
add eax, eax
sub edx, eax
sub edx, 2
je 0x100070a4
sub edx, 2
jne 0x100070a7
add ecx, 2
jmp 0x100070a7
add ecx, 3
mov eax, dword [ebp + 0x14]
inc ecx
cmp dword [eax], ecx
jge 0x100070bb
mov dword [eax], ecx
mov eax, 0xfffffff0
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x55555556
imul esi
push ebx
mov ebx, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [eax + eax*2]
xor eax, eax
test ecx, ecx
jle 0x10007154
dec ecx
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp - 4], eax
lea eax, [eax + eax*2]
mov dword [ebp - 8], eax
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
movzx eax, byte [eax + 0x101745e8]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
movzx eax, byte [eax + 0x101745e8]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
movzx eax, byte [eax + 0x101745e8]
mov byte [edi + 2], al
movzx eax, byte [esi + 0x101745e8]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x100070f0
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
cmp eax, esi
jge 0x100071af
movzx edx, byte [ebx]
inc eax
mov dword [ebp + 0xc], eax
cmp eax, esi
jge 0x10007169
movzx ecx, byte [ebx + 1]
jmp 0x1000716b
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
movzx eax, byte [eax + 0x101745e8]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
movzx eax, byte [eax + 0x101745e8]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], esi
jge 0x100071a4
and ecx, 0xf
mov al, byte [ecx*4 + 0x101745e8]
mov byte [edi + 2], al
jmp 0x100071a8
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov ecx, dword [ebp + 0x14]
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [ecx], eax
mov byte [edi], 0
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret