joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420600
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.004544b9
test al, al
je 0x420629
pop esi
push ebx
pop edi
push ecx
pop ebx
push edi
pop ebp
push ecx
push ebx
push ebx
push esi
pop edx
push eax
push ecx
pop edi
push edx
push edi
pop ebx
pop esp
pop esi
push edx
pop ebp
push eax
call fcn.004543ea
test al, al
je 0x420649
pop esi
pop ecx
push ecx
pop ebp
push ebp
push ebp
push ebx
push edi
pop ebp
push esp
push ecx
pop edi
push eax
push eax
push ebx
push ebp
pop edx
pop edx
push esi
pop ebp
pop edi
pop ecx
push ecx
call fcn.0045494e
test al, al
je 0x42066b
push esp
push edi
push edi
push esp
pop esi
pop ecx
push ecx
pop edi
push ecx
pop esp
push ebp
push esi
pop edx
push edx
pop ebx
push esp
pop eax
pop esi
pop eax
pop edx
push ecx
pop esp
push eax
pop edi
push ecx
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420785
call fcn.0045487f
test al, al
je 0x4206b5
pop ebx
push ecx
pop esi
push ebp
pop edi
pop ebx
push esi
pop esi
push esi
pop esi
pop esp
pop esp
pop ecx
push eax
pop esp
push ebx
pop eax
pop ebx
pop edi
pop esi
pop esp
push esp
pop ecx
pop edi
pop ebp
pop edx
pop eax
pop edx
pop edi
pop edx
call fcn.00454a62
test al, al
je 0x4206d8
pop ebp
push esp
push ebp
pop esp
push esp
push edi
push edi
pop esp
push eax
push ebx
pop eax
pop edx
pop edi
pop ebp
push esp
pop esp
push esi
push esp
pop edi
pop esi
push edx
pop eax
push esp
pop esi
push edi
push edi
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.AiDoo
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42070f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0045469c
test al, al
je 0x420737
push eax
push esp
push ebx
pop esp
push esp
push eax
pop ebp
push edi
pop ebp
push ecx
pop ebp
push ecx
push eax
push esi
push edi
push edi
pop ecx
pop ebx
pop ebp
pop eax
push ebp
push eax
push edi
pop esp
pop ebx
push esp
push ebx
push ecx
push ebp
push edi
pop esp
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
call fcn.0045431b
test al, al
je 0x420785
pop edi
pop ecx
push eax
pop ecx
pop ebx
push ebp
push eax
push esp
pop edx
pop eax
pop eax
pop ebp
pop ebx
pop esp
pop ecx
push esi
pop ecx
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x430240
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x66f33c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], 0
push 0
push eax
call fcn.0047be90
add esp, 0xc
mov dword [ebp - 0x810], 0x800
mov dword [ebp - 0x814], 1
call fcn.00454360
test al, al
je 0x4302b3
push ebx
push ebx
pop ebp
push esi
pop edx
pop esp
push edi
push ebx
pop edx
push edi
push edi
push ebp
pop eax
pop edi
push esp
pop edi
push ebx
push ebx
push ebx
push ebp
pop ecx
pop ebx
pop esi
push esi
push esi
push esp
pop esp
push esi
pop edi
push ecx
push esp
pop ebx
call fcn.0045442f
test al, al
je 0x4302cf
pop eax
pop eax
push ebx
pop edx
pop ecx
push edi
pop esp
pop ebp
push eax
pop edi
pop edi
pop eax
push esi
push esp
push eax
push eax
push esp
pop eax
pop ebp
call fcn.004544fe
test al, al
je 0x4302ec
pop edi
pop ebx
push ebp
push eax
pop edx
pop ecx
push ecx
push esi
pop edi
push esp
push ebp
push esp
pop edi
push edi
pop esp
push esi
pop esp
push edx
push edx
push ecx
lea eax, [ebp - 0x808]
push eax
push 0xf013f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x80c], eax
call fcn.004544b9
test al, al
je 0x43032a
push eax
push edx
pop ecx
pop esp
pop ecx
pop ebx
push ecx
push esi
push edi
push edi
pop esi
pop ebx
pop ebx
pop edi
pop ebp
push ecx
pop esp
cmp dword [ebp - 0x80c], 0
jne 0x43039e
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push str.ED262B91_1251_40D8_AA54_414196DABA43
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, str.WindowsReset_Master_Shell_Extension
lea eax, [ebp - 0x804]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43038c
test dx, dx
je 0x430388
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43038c
add eax, 4
add ecx, 4
test dx, dx
jne 0x430366
xor eax, eax
jmp 0x430391
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43039a
lea esi, [eax + 1]
jmp 0x4303a0
xor esi, esi
jmp 0x4303ba
xor esi, esi
call fcn.004543ea
test al, al
je 0x4303ba
pop esp
pop ebx
push ebx
pop ebp
pop eax
pop ebp
push edi
push esi
push edi
pop edx
push edx
push ebp
push esp
push ebp
pop eax
push esi
push edx
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.0045132d
mov esp, ebp
pop ebp
ret
Function at 0x433c30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dbbab
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x66f33c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0045469c
test al, al
je 0x433c82
pop esp
push esp
pop esi
pop esi
pop edx
push ebx
push esi
pop esi
push esp
pop eax
pop edx
pop esi
push ebx
pop ecx
pop ecx
pop edx
push eax
pop ebp
push edx
pop eax
pop edx
pop eax
push ecx
pop edx
pop ecx
pop edi
pop ecx
xor eax, eax
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
call fcn.0047be90
add esp, 0xc
lea ecx, [ebp - 0x248]
push 0x43
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
call fcn.00403000
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x24c]
push ecx
push 0xf013f
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x250], eax
call fcn.004544b9
test al, al
je 0x433d2d
pop esi
push ebx
pop edi
push esi
pop edx
pop ecx
pop ebp
push eax
push ebx
pop ecx
pop ecx
pop edx
pop edx
pop esp
push ebx
push ebx
push esp
pop eax
pop ebp
push esi
pop eax
pop edx
pop edi
push eax
pop ebx
push ebp
push eax
pop esi
push eax
cmp dword [ebp - 0x250], 0
jne 0x433df9
push 0x23
xor eax, eax
mov dword [ebp - 0x21c], 7
push str.WindowsReset_Master_Shell_Extension
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00403000
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x433d83
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433da0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.ED262B91_1251_40D8_AA54_414196DABA43
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x433df9
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00403100
call fcn.0045469c
test al, al
je 0x433e1d
pop esp
push esp
pop esi
pop esi
pop edx
push ebx
push esi
pop esi
push esp
pop eax
pop edx
pop esi
push ebx
pop ecx
pop ecx
pop edx
push eax
pop ebp
push edx
pop eax
pop edx
pop eax
push ecx
pop edx
pop ecx
pop edi
pop ecx
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x433e3b
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00403100
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045132d
mov esp, ebp
pop ebp
ret
Function at 0x437e00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x66f33c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.0047be90
push esi
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.00407930
add esp, 0x18
call fcn.00454543
test al, al
je 0x437e67
pop ebp
push ebx
push edx
pop esp
push edi
push eax
pop edx
pop edi
pop edi
push edi
pop esp
pop ebp
pop ebp
push edx
push edi
pop eax
pop eax
push ebp
push ebp
pop edi
push esp
pop ebp
pop esi
pop eax
pop eax
push ebp
pop ebx
push ebx
pop ebp
call fcn.0045483a
test al, al
je 0x437e84
pop ebp
push ecx
pop eax
push ebp
push ecx
push edx
push esp
pop ebx
push ebp
push ebx
pop esp
push ebp
pop eax
push esi
pop ebp
push ebx
push edi
pop ebx
pop eax
pop edi
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x437ebd
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045132d
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x214], 0
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], 4
push eax
push 0
push 0
push str.Start
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004546e1
test al, al
je 0x437f26
push ecx
push esi
pop eax
pop eax
pop esi
pop ecx
push eax
push edx
pop edx
push ebp
pop esp
push ebx
pop edi
push ebx
pop ebp
push edi
push ecx
pop eax
push eax
pop ebx
push edx
push ebp
push edi
push ecx
pop edi
push ecx
push esp
pop eax
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x214], 2
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.0045132d
mov esp, ebp
pop ebp
ret 4
Function at 0x437f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x66f33c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.0047be90
push esi
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.00407930
add esp, 0x18
call fcn.00454a62
test al, al
je 0x437fad
push edx
push ecx
pop ecx
pop ecx
push ecx
push esp
push esi
pop ebp
pop ebp
push ebp
pop ecx
pop eax
push ecx
push eax
push edi
push eax
pop ebx
pop ebx
push esp
lea eax, [ebp - 0x418]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4380fc
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0047be90
add esp, 0xc
mov dword [ebp - 0x41c], 0x208
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push str.ImagePath
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00454543
test al, al
je 0x438043
pop ecx
pop eax
pop edx
pop esi
pop ebx
push edi
push esi
push esi
pop edx
pop eax
pop esp
push ebx
pop ecx
pop ebx
pop ebp
pop edx
push ebx
pop eax
pop eax
pop ebp
push eax
pop ebp
push esi
call fcn.004544b9
test al, al
je 0x43805d
pop esi
push edx
push edx
pop edi
pop esi
pop eax
pop esi
push edi
push esi
pop edx
pop edi
push ebx
pop esp
push edi
pop ecx
push eax
pop edx
call fcn.0045483a
test al, al
je 0x438080
push edx
pop edi
push esp
push eax
push eax
pop esp
pop ebp
pop edi
pop eax
push edx
pop edx
push esi
push ecx
push eax
push edx
push ebp
pop edi
push ebx
pop edi
pop eax
push esi
pop edx
pop edx
pop esp
pop ebp
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.00488add
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4380b8
test dx, dx
je 0x4380b4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4380b8
add eax, 4
add ecx, 4
test dx, dx
jne 0x438092
xor eax, eax
jmp 0x4380bd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4380d9
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045132d
mov esp, ebp
pop ebp
ret 8
call fcn.004549d8
test al, al
je 0x4380fc
push eax
push edi
pop edi
push ecx
pop ebx
push edi
pop edi
pop eax
pop esp
pop eax
pop edx
push eax
pop ebp
pop esp
pop ecx
push esi
pop edx
pop ebx
push edi
pop ebx
push eax
pop ecx
push ebx
pop edi
push esi
push eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045132d
mov esp, ebp
pop ebp
ret 8
Function at 0x438120
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x66f33c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4381c2
call fcn.00454a62
test al, al
je 0x43815a
push edx
push ecx
pop ecx
pop ecx
push ecx
push esp
push esi
pop ebp
pop ebp
push ebp
pop ecx
pop eax
push ecx
push eax
push edi
push eax
pop ebx
pop ebx
push esp
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438160
sub ecx, edx
sar ecx, 1
je 0x4381c2
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x24], esi
call fcn.00454a62
test al, al
je 0x4381a1
push edx
push ecx
pop ecx
pop ecx
push ecx
push esp
push esi
pop ebp
pop ebp
push ebp
pop ecx
pop eax
push ecx
push eax
push edi
push eax
pop ebx
pop ebx
push esp
test esi, esi
je 0x4381c2
push 0x10020
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0x28], ebx
test ebx, ebx
jne 0x4381d7
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045132d
mov esp, ebp
pop ebp
ret 4
call fcn.00454a62
test al, al
je 0x4381f6
push esi
push edx
push eax
pop ebp
pop edx
pop edx
push edx
pop ebx
push ebp
pop eax
pop ebp
push eax
push esi
pop eax
pop esp
pop ecx
pop ecx
pop ebx
push ebp
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
push ebx
call esi
push dword [ebp - 0x24]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.0045132d
mov esp, ebp
pop ebp
ret 4
Function at 0x4476a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd923
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x66f33c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x674424
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x674424
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x5e270d
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0044b2d0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44def0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x678ca0], ecx
inc eax
cmp eax, 0x100
jb 0x44def2
cmp eax, 0x800
jae 0x44dfc3
nop
mov edx, dword [eax*4 + 0x6788a0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x678ca0]
mov dword [eax*4 + 0x678ca0], edx
inc eax
cmp eax, 0x800
jb 0x44dfa0
mov dword [0x674430], 0x44ed60
call fcn.0044eb90
mov ecx, dword [0x674430]
test eax, eax
mov edx, 0x44ee00
cmove ecx, edx
mov dword [0x674430], ecx
ret
Function at 0x44f0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x44f100
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x44f132
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x44f12f
inc esi
cmp esi, edx
jb 0x44f120
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x44f25c
cmp ecx, 3
jbe 0x44f172
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x44f1b0
cmp cl, 0xff
je 0x44f1b0
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x44f114
dec ecx
shl eax, cl
and eax, 7
je 0x44f14a
movzx ecx, byte [eax + 0x5e7724]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x5e771c], 0
mov cl, byte [edx + 4]
je 0x44f19a
test cl, cl
je 0x44f19a
cmp cl, 0xff
jne 0x44f14a
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x44f114
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x44f1de
lea edx, [edi + ebx]
add edx, esi
jmp 0x44f1e4
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x44f222
movzx edi, byte [eax + 0x5e7724]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x44f20e
cmp cl, 0xff
jne 0x44f222
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x44f1d1
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x44f114
pop edi
pop esi
cmp ecx, 3
jbe 0x44f271
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452210
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, dword [edi + 8]
mov ecx, dword [esi + 8]
call fcn.004535b0
push dword [ebp + 0xc]
mov ecx, dword [esi + 8]
call fcn.00453560
push dword [ebp + 0x10]
mov ecx, dword [esi + 8]
call fcn.00453600
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x45224c
mov ecx, dword [edi + 8]
mov dword [ecx + 0xc], eax
mov esi, dword [edi + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x4522a0
push 0
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x452290
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x452290
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x452510
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dddf6
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x66f33c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x638], esi
lea eax, [esi + 8]
mov dword [esi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], esi
jb 0x45256a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ecx
cmp dword [esi + 0x34], 8
mov dword [ebp - 4], ecx
jb 0x452587
mov eax, dword [esi + 0x20]
jmp 0x45258a
lea eax, [esi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4525a4
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4525be
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x68]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4525d8
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push ecx
mov byte [ebp - 4], 4
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
call fcn.0047f82c
push eax
call fcn.0048ca63
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.0047be90
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x452697
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.0047be90
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x452688
test eax, eax
je 0x452688
add eax, eax
cmp eax, 0x412
jae 0x452683
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x45268e
call fcn.00451c7e
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0x20]
call fcn.004039d0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4526c3
cmp dword [esi + 0x34], 8
jb 0x4526a9
mov ecx, dword [esi + 0x20]
jmp 0x4526ac
lea ecx, [esi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x4526c3
push 1
push 0x5e283c
lea ecx, [esi + 0x20]
call fcn.00405290
cmp dword [esi + 0x30], 0
jne 0x4526d8
push 3
push 0x5e785c
lea ecx, [esi + 0x20]
call fcn.00403000
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045132d
mov esp, ebp
pop ebp
ret