joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467f41
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push edi
push 1
push ebx
mov edi, ecx
call fcn.00474a93
mov eax, dword [esp + 0x1c]
pop ecx
pop ecx
push dword [eax + 0x10]
push dword [eax + 0x18]
push ebx
call dword [sym.imp.WS2_32.dll_connect]
xor ebp, ebp
test eax, eax
jns 0x467fad
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x467f88
mov eax, dword [edi + 4]
mov dword [eax], 2
xor al, al
jmp 0x468034
mov eax, dword [edi + 0xc]
push dword [eax + 4]
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 4]
push dword [eax]
push ebx
call fcn.00475204
mov ecx, dword [edi + 4]
add esp, 0x14
mov dword [ecx], eax
mov eax, dword [edi + 4]
cmp dword [eax], ebp
jne 0x467f81
push ebp
push ebx
call fcn.00474a93
mov eax, dword [edi + 0x14]
pop ecx
pop ecx
push ebp
push 0x3e8
push dword [eax + 4]
push dword [eax]
call fcn.00492e20
mov ecx, eax
mov ebp, 0xffff
mov eax, dword [edi + 0x10]
push 4
imul eax, dword [eax], 0x3e8
add ecx, eax
lea eax, [esp + 0x14]
push eax
push 0x1006
push ebp
push ebx
mov dword [esp + 0x24], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [edi + 0x1c]
push 0
push 0x3e8
push dword [eax + 4]
push dword [eax]
call fcn.00492e20
mov ecx, eax
mov eax, dword [edi + 0x18]
push 4
imul eax, dword [eax], 0x3e8
add ecx, eax
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
push 0x1005
push ebp
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [edi + 4]
mov al, 1
and dword [ecx], 0
pop edi
pop ebp
pop ebx
ret 8

Function at 0x46803a
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [ecx + 0xc]
push dword [eax]
mov eax, dword [ecx + 8]
push dword [eax]
mov eax, dword [ecx + 4]
push dword [eax]
mov eax, dword [ecx]
push dword [eax]
call dword [sym.imp.WS2_32.dll_recv]
ret

Function at 0x468114
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [ecx + 0xc]
push dword [eax]
mov eax, dword [ecx + 8]
push dword [eax]
mov eax, dword [ecx + 4]
push dword [eax]
mov eax, dword [ecx]
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
ret

Function at 0x46812e
Capabilities:
Get socket status

Disassembly:
push dword [ecx + 0x10]
mov eax, dword [ecx]
push dword [ecx + 0xc]
push dword [ecx + 8]
mov eax, dword [eax]
push dword [ecx + 4]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
ret
Function at 0x470c62
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x408
mov eax, dword [0x4b7080]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
mov ebx, dword [esp + 0x418]
push esi
mov esi, dword [esp + 0x414]
push edi
mov edi, dword [esp + 0x424]
push 2
movzx eax, word [esi]
pop ecx
cmp ax, cx
je 0x470c9e
cmp eax, 0x17
jne 0x470d03
movzx eax, word [esi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
push ebp
movzx eax, ax
mov ebp, 0x401
mov dword [edi], eax
xor edi, edi
push ebp
lea eax, [esp + 0x14]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push 2
push edi
push edi
push ebp
push eax
push dword [esp + 0x434]
push esi
call dword [sym.imp.WS2_32.dll_getnameinfo]
pop ebp
test eax, eax
jne 0x470d03
lea edx, [esp + 0xc]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x470ce9
sub edx, esi
lea eax, [esp + 0xc]
push edx
push eax
mov ecx, ebx
call fcn.004599c0
mov al, 1
jmp 0x470d05
xor al, al
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00492363
add esp, 0x408
ret

Function at 0x470d36
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x88
mov eax, dword [0x4b7080]
xor eax, ebp
mov dword [ebp + 0x68], eax
push esi
mov esi, dword [ebp + 0x78]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0x7c]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 0x80
push eax
push dword [ebp + 0x74]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x470d80
push edi
push esi
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
call fcn.00470c62
add esp, 0x10
mov ecx, dword [ebp + 0x68]
pop edi
xor ecx, ebp
pop esi
call fcn.00492363
add ebp, 0x6c
leave
ret
Function at 0x487446
Capabilities:
Hash data using sha256

Disassembly:
push 0x20
push 0x49f040
push dword [esp + 0xc]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
ret
Function at 0x48a1b3
Capabilities:
Hash data using sha1

Disassembly:
call fcn.004872cd
test al, al
je 0x48a1d1
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.004912cd
add esp, 0x10
ret
jmp fcn.0048745a

Function at 0x48a1d6
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
call fcn.004872cd
test al, al
je 0x48a1f4
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00491564
add esp, 0x10
ret
jmp fcn.004884fb

Function at 0x48bd26
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor edx, edx
push esi
mov dword [esp + 0x18], edx
push edi
movzx edi, byte [edx + 0x4a0878]
mov dword [esp + 0x10], edi
mov eax, edi
shr eax, 5
mov esi, edi
mov edx, eax
shr esi, 6
mov ebx, eax
lea ecx, [edi + edi]
xor ecx, edi
and eax, 1
mov dword [esp + 0x14], eax
and ebx, 2
shr edi, 7
and edx, 4
imul eax, edi, 0x1b000000
lea ebp, [ecx + ecx]
mov dword [esp + 0x18], edx
xor ebp, dword [esp + 0x10]
mov edx, esi
shl ebp, 0x19
and esi, 1
shl ecx, 2
and edx, 2
xor ebp, eax
xor ecx, dword [esp + 0x10]
imul eax, dword [esp + 0x14], 0x1b000000
shl ecx, 8
xor ebp, eax
imul eax, ebx, 0x1b000000
xor ebp, eax
imul eax, esi, 0x1b000000
xor ebp, eax
imul eax, edx, 0x1b000000
xor ebp, eax
imul eax, dword [esp + 0x18], 0x1b000000
xor ebp, eax
imul eax, dword [esp + 0x14], 0x11b00
xor ecx, eax
imul eax, ebx, 0x11b00
xor ecx, eax
imul eax, esi, 0x11b00
mov esi, dword [esp + 0x18]
xor ecx, eax
imul eax, edx, 0x11b00
mov edx, dword [esp + 0x10]
xor ecx, eax
imul eax, esi, 0x11b00
xor ecx, eax
imul eax, dword [esp + 0x14], 0x11b0000
or ebp, ecx
mov ecx, dword [esp + 0x10]
shl ecx, 3
xor ecx, dword [esp + 0x10]
shl ecx, 0x10
xor ecx, eax
imul eax, ebx, 0x11b0000
xor ecx, eax
imul eax, esi, 0x11b0000
xor ecx, eax
imul eax, edi, 0x11b
or ebp, ecx
mov ecx, dword [esp + 0x10]
shl ecx, 2
xor ecx, dword [esp + 0x10]
add ecx, ecx
xor ecx, eax
imul eax, dword [esp + 0x14], 0x11b
xor ecx, eax
imul eax, ebx, 0x11b
xor ecx, eax
imul eax, esi, 0x11b
xor ecx, eax
xor eax, eax
xor ecx, edx
or edx, ebp
or ecx, ebp
or eax, edx
mov edx, dword [esp + 0x1c]
mov dword [edx*8 + 0x4bdaf0], eax
mov dword [edx*8 + 0x4bdaf4], ecx
inc edx
mov dword [esp + 0x1c], edx
cmp edx, 0x100
jl 0x48bd33
pop edi
pop esi
pop ebp
pop ebx
mov byte [0x4be2f1], 1
add esp, 0x10
ret

Function at 0x48be7e
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push esi
push edi
xor edi, edi
movzx edx, byte [edi + str.cw]
mov ecx, edx
mov eax, edx
shr ecx, 7
imul esi, ecx, 0x1b000000
shl eax, 0x19
imul ecx, ecx, 0x11b
xor esi, eax
mov eax, edx
shl eax, 8
or eax, edx
shl eax, 8
or esi, eax
lea eax, [edx + edx]
xor ecx, eax
xor eax, eax
xor ecx, edx
or eax, esi
or ecx, esi
mov dword [edi*8 + 0x4bd2e0], eax
mov dword [edi*8 + 0x4bd2e4], ecx
inc edi
cmp edi, 0x100
jl 0x48be82
xorps xmm0, xmm0
pop edi
movlpd qword [0x4bdae8], xmm0
movlpd qword [0x4bdae0], xmm0
pop esi
mov byte [0x4be2f0], 1
ret
Function at 0x48d9cf
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x44
mov eax, 0x498948
call fcn.00492c55
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4be700]
mov esi, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4be2f8]
cmp eax, dword [ecx + 4]
jg 0x48da17
push 0
push dword [ebp + 0xc]
push esi
push dword [0x4be2f4]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x48da52
call fcn.00492c13
ret 8
mov edi, 0x4be2f8
push edi
call fcn.004923ed
cmp dword [0x4be2f8], 0xffffffff
pop ecx
jne 0x48d9fa
and dword [ebp - 4], 0
mov ecx, 0x4be2f4
call fcn.0048d816
push 0x4990f1
call fcn.004926bd
or dword [ebp - 4], 0xffffffff
push edi
call fcn.0049239c
pop ecx
pop ecx
jmp 0x48d9fa
push eax
call fcn.0048da8f
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x49f538
lea ecx, [ebp - 0x28]
call fcn.00403710
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x50]
call fcn.0048d8c0
push 0x4b3658
lea eax, [ebp - 0x50]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x48e826
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], ecx
cmp edi, 4
jb 0x48e886
push ebp
mov ebp, edi
shr ebp, 2
push 4
lea eax, [esp + 0x18]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
push 4
lea eax, [esp + 0x34]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x3c]
add esp, 0x18
xor eax, dword [esp + 0x14]
add ebx, 4
mov ecx, dword [esp + 0x10]
add esi, 4
or ecx, eax
sub edi, 4
mov dword [esp + 0x10], ecx
sub ebp, 1
jne 0x48e848
pop ebp
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test edi, edi
je 0x48e8b9
sub ebx, esi
movzx ecx, byte [ebx + esi]
movzx eax, byte [esi]
xor ecx, eax
or edx, ecx
inc esi
sub edi, 1
jne 0x48e8a8
pop edi
test edx, edx
pop esi
sete al
pop ebx
pop ecx
pop ecx
ret

Function at 0x48e8c4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x48e94f
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x28]
cmp edi, 4
jb 0x48e936
mov eax, edi
shr eax, 2
mov dword [esp + 0x2c], eax
push 4
lea eax, [esp + 0x18]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
push 4
lea eax, [esp + 0x20]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x28]
xor eax, dword [esp + 0x2c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push 4
push eax
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
add ebp, 4
add ebx, 4
add esi, 4
sub edi, 4
sub dword [esp + 0x2c], 1
jne 0x48e8ed
test edi, edi
je 0x48e94c
sub ebx, esi
sub ebp, esi
mov al, byte [ebx + esi]
xor al, byte [esi]
mov byte [esi + ebp], al
inc esi
sub edi, 1
jne 0x48e93e
pop esi
pop ebp
pop ebx
pop edi
add esp, 0xc
ret
Function at 0x48e954
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x48e9cc
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
cmp edi, 4
jb 0x48e9b9
push ebp
mov ebp, edi
shr ebp, 2
push 4
lea eax, [esp + 0x14]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
push 4
lea eax, [esp + 0x34]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x3c]
xor eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
add esi, 4
add ebx, 4
sub edi, 4
sub ebp, 1
jne 0x48e974
pop ebp
test edi, edi
je 0x48e9ca
sub ebx, esi
mov al, byte [ebx + esi]
xor byte [esi], al
inc esi
sub edi, 1
jne 0x48e9bf
pop esi
pop ebx
pop edi
pop ecx
pop ecx
ret

Function at 0x491cff
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
mov edx, dword [esp + 4]
add eax, eax
push 4
lea ecx, [ecx*4 - 4]
movups xmm0, xmmword [edx + eax*8]
movups xmm1, xmmword [edx]
movups xmmword [edx], xmm0
movups xmmword [edx + eax*8], xmm1
pop eax
cmp ecx, eax
jbe 0x491d45
aesimc xmm0, xmmword [edx + ecx*4]
aesimc xmm1, xmmword [edx + eax*4]
movups xmmword [edx + eax*4], xmm0
add eax, 4
movups xmmword [edx + ecx*4], xmm1
sub ecx, 4
cmp eax, ecx
jb 0x491d27
aesimc xmm0, xmmword [edx + eax*4]
movups xmmword [edx + eax*4], xmm0
ret
Function at 0x491d50
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push edi
push eax
push esi
movups xmm0, xmmword [eax + edi - 0x10]
movaps xmmword [esp + 0x2c], xmm0
call sub.VCRUNTIME140.dll_memcpy
movaps xmm1, xmmword [esp + 0x2c]
mov eax, edi
shr eax, 2
add esp, 0xc
mov edx, eax
mov dword [esp + 0x14], eax
aeskeygenassist xmm0, xmm1, 0
shl edx, 2
lea ecx, [eax + 7]
mov dword [esp + 0x18], 0x4a0734
shl ecx, 4
add ecx, esi
mov dword [esp + 0x1c], ecx
pextrd ecx, xmm0, 3
xor ecx, dword [esi]
xor ecx, 1
mov dword [edx + esi], ecx
mov eax, dword [esi + 4]
xor eax, ecx
mov dword [edx + esi + 4], eax
mov ecx, dword [esi + 8]
xor ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esi + eax*4 + 8], ecx
mov eax, dword [esi + 0xc]
xor eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + ecx*4 + 0xc], eax
lea eax, [esi + 0x10]
add eax, edx
jmp 0x491e8c
cmp edi, 0x18
jne 0x491dff
mov eax, dword [esi + 0x24]
xor eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor ecx, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
pinsrd xmm1, ecx, 3
jmp 0x491e44
cmp edi, 0x20
jne 0x491e3d
pinsrd xmm1, dword [esi + 0x2c], 3
mov eax, dword [esi + 0x14]
aeskeygenassist xmm0, xmm1, 0
pextrd ecx, xmm0, 2
xor ecx, dword [esi + 0x10]
xor eax, ecx
mov dword [esi + 0x30], ecx
mov ecx, dword [esi + 0x18]
xor ecx, eax
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x1c]
xor eax, ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
pinsrd xmm1, eax, 3
jmp 0x491e44
pinsrd xmm1, dword [esi + 0x1c], 3
mov eax, dword [esp + 0x18]
add esi, edx
aeskeygenassist xmm0, xmm1, 0
pextrd ecx, xmm0, 3
xor ecx, dword [eax]
add eax, 4
xor ecx, dword [esi]
mov dword [edx + esi], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 4]
xor eax, ecx
mov dword [edx + esi + 4], eax
mov ecx, dword [esi + 8]
xor ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esi + eax*4 + 8], ecx
mov eax, dword [esi + 0xc]
xor eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + ecx*4 + 0xc], eax
lea eax, [edx + 0x10]
add eax, esi
cmp eax, dword [esp + 0x1c]
jne 0x491de1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x493667
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4936a6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4936a6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4936a6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4936a6
cmp dword [ecx + 0x74], 0xe
jbe 0x4936a6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401743
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401782
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401782
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401782
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401782
cmp dword [ecx + 0x74], 0xe
jbe 0x401782
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bfe0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40c00d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c00d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x44a210
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, 0x190
push edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a2e2
lea ecx, [esp + 0x20]
push ebp
mov ebp, 4
push ecx
push edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a290
mov ebx, dword [esp + 0x1c]
xor esi, esi
test edi, edi
mov dword [esp + 0x14], ebp
je 0x44a2a9
mov eax, dword [0x65bb1c]
push 0x65b838
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Browse_For_Folder_Height
push ecx
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop ebp
jne 0x44a2d7
or esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov edx, ebx
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x4f937c
Capabilities:
Authenticate hmac

Disassembly:
in eax, 0x16
jns 0x4f939b
aad 0x88
wait
dec esi
sub eax, 0x8057c991
xchg esi, eax
mov eax, dword [0xa9c2a959]
out 0xc7, al
xchg esp, eax
push ebp
add al, 0x70
or esi, dword [eax + 0x2a]
pop ds
jg 0x4f93c3
and eax, 0x17184533
and eax, 0xad1bc9ca
push ecx
sub dword [edx + 0x2a859882], edx
salc
invalid

Function at 0x52d766
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
mov esp, ebp
stc
or eax, 0xc0bddebf
and al, 0x90
push ebx
mov dh, 0x65
and dl, ch
mov edx, 0x300f435e
sbb byte [ebp + ecx*2 - 0x3f], cl
out dx, al
jne 0x52d756
shr esi, 0x75
in al, 0x89
cld
mov esp, edi
test al, 0xa2
lodsd eax, dword [esi]
xor al, byte ss:[edx + 0x384cb848]
cmc
mov dword [eax], 0x1fd135c
push ds
sub byte [eax - 0x7fd4d1de], al
das
sbb byte [edi - 0x5aee0851], ah
mov byte [0x9ad04f95], al
mov gs, word [edx + 5]
sti
rcl dword [esi + 0x4f], 0xc9
xor al, 0xbf
jle 0x52d76e
xchg esi, eax
sahf
aad 0xad
invalid

Function at 0x533b43
Capabilities:
Encode data using xor

Disassembly:
arpl word [eax - 0x37], cx
test byte [ebp + 0x74], al
cmp al, 0xa6
push eax
enter 0x50b2, 0xffffffffffffff93
shr byte [eax - 0x30f99885], 1
pop ebx
cli
dec ebx
shr dword [ebx + 0xc2cb27a], 0x27
imul esp, dword [ebx], 0x4a
mov byte ds:[0xc4348d9c], al
cmc
invalid
Function at 0x553816
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x1785f11e
dec eax
or eax, 0x75f2c7ce
das
movsb byte es:[edi], byte [esi]
mov bh, 0xf
inc ebp
cmp dword [edi], esp
jbe 0x55389e
cwde
in al, dx
scasb al, byte es:[edi]
mov ch, 0x33
mov ah, 0x5e
mov bh, 0xe3
add esi, edi
clc
push ecx
cmp al, 0x4b
pop eax
mov es, word [edx - 0x40242a35]
dec edx
aas
js 0x5538b3
cmp dh, ah
pop ebp
sub byte [ebx - 0x22], al
adc byte cs:[esi], dl
movsd dword es:[edi], dword [esi]
sbb al, 0xef
aam 0x74
mov esi, 0x9b9fc1cf
aaa
invalid
push es
imul ebp, ebx, 0xc4743519
invalid
shl dword [ebp - 0x303f7eb2], cl
wait
mov dh, 0xe6
dec esi
add eax, 0xe6b69bcf
or byte [edi - 0x13c6e0c5], cl
xor eax, 0x1abfaa56
pop ebx
out 0x2a, eax
jle 0x5538b5
xchg edi, eax
push cs
xchg esp, eax
int1
clc
push es
in al, 0xf1
dec eax
into
test byte [ecx - 9], bl
mov esi, 0x8955bf79
xchg ebp, eax
push cs
aad 0x61
enter 0x4b08, 0x4e
add ecx, edx
xor eax, 0xb7ef398c
cmp ah, al
pop edx
jmp 0xc5757b25

Function at 0x64e06d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x658408
cmp edx, dword [eax]
je 0x64e08f
add eax, 8
inc ecx
cmp eax, 0x658498
jl 0x64e080
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x658408]
jne 0x64e1bd
mov eax, dword [0xa5bd60]
cmp eax, 1
je 0x64e197
test eax, eax
jne 0x64e0c0
cmp dword [0x658334], 1
je 0x64e197
cmp edx, 0xfc
je 0x64e1bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64e0f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064ea50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064eee0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64e13a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064eee0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x653e34
push edi
call fcn.00650db0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064ea50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064ea60
lea eax, [ebp - 0xa0]
push 0x653e14
push eax
call fcn.0064ea60
push dword [esi + 0x65840c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064ea60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650d24
add esp, 0x2c
pop edi
jmp 0x64e1bd
lea eax, [ebp + 8]
lea esi, [esi + 0x65840c]
push 0
push eax
push dword [esi]
call fcn.0064eee0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40288e
pop dword [ebp - 0xc]
mov eax, 0x40288e
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x51fccadb
sub dword [ebp - 0x1c], 0x3aa8590
mov dword [ebp - 0x18], 0xef0b9eb3
add dword [ebp - 0x18], 0x4327ad92
mov dword [ebp - 0x14], 0xad6a75ac
sub dword [ebp - 0x14], 0x611e317e
mov dword [ebp - 0x10], 0xf1a80c4
sub dword [ebp - 0x10], 0xf1a80c4
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x4ccf6254
add eax, 0xb3710e10
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xb8749e71
add dword [ebp - 0x1c], 0xbbfdcae5
mov dword [ebp - 0x18], 0xea079225
add dword [ebp - 0x18], 0x5764cf50
mov dword [ebp - 0x14], 0x39dbd0b9
add dword [ebp - 0x14], 0x29939bb3
mov dword [ebp - 0x10], 0xf63ef310
add dword [ebp - 0x10], 0x9c10cf0
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x33b5e
push 0
call eax
mov ecx, 0xcc076b7e
add ecx, 0x33f8d0f7
mov ebx, eax
mov esi, 0xac85170f
sub esi, 0xac44170f
add esi, dword [ebp - 0xc]
mov edx, 0x52944171
add edx, 0x5a9a05d4
xor dword [ebp - 8], ebx
mov edi, dword [esi]
mov dword [ebp - 8], 0x8488fdb9
xor edi, edx
xor dword [ebp - 8], ecx
mov dword [ebx], edi
xor dword [ebp - 8], esi
add ebx, 0x1d9262fa
add ebx, 0xe26d9d0a
add esi, 0x829a24d3
sub esi, 0x829a24cf
loop 0x4029a6
add eax, 0xee348054
add eax, 0x11cc6453
mov ebx, eax
add eax, 0x6b02cdc6
add eax, 0x94fd323f
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x40a785
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edx
push ss
jnp 0x40a790
push es
push ecx
mov ah, byte [edx]
mov esi, 0xe989b80f
mov ecx, ebp
rcr dword [esi - 0x483cc20f], 0x30
dec eax
dec edx
pop ecx
test eax, edx
sbb al, 0x3c
stc
xor eax, 0x425134c0
neg dl
mov ecx, esp
loope 0x40a789
xor al, 0x5d
inc esp
push cs
rcl ebp, 0x48
pop ecx
and bh, byte [eax - 0xc127f40]
je 0x40a7ee
jecxz 0x40a788
aas
push ss
aam 0x97
mov bl, ch
and esp, 0x307b10a7
pop ebp
add al, 3
invalid
out dx, eax
loopne 0x40a7ad
jne 0x40a868
ret
lea ecx, [ebx + 0x7bf46fa]
mov ebx, dword [ecx]
in ax, 0x7a
add al, 0x4c
insb byte es:[edi], dx
push es
mov ebx, 0xbda74516
or al, 0x78
cmpsd dword [esi], dword es:[edi]
salc
add edi, dword [ebp - 0x2a51ee6]
movsd dword es:[edi], dword [esi]
cld
or byte [ecx + 0x53], al
pop edi
jmp 0x8e04bfb9