joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4112b4
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d0c
call fcn.0042a2f0
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x5ec]
push ebx
push str..PhysicalDrive_d
push eax
mov edi, ebx
call fcn.0040a161
add esp, 0xc
lea eax, [ebp - 0x5ec]
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4114e7
push 0xc
lea eax, [ebp - 0x2d08]
mov dword [ebp - 0x2d0c], ebx
push ebx
push eax
call fcn.004434f0
push 0x2710
lea eax, [ebp - 0x2cfc]
mov dword [ebp - 0x2d08], ebx
push ebx
push eax
mov dword [ebp - 0x2d04], ebx
call fcn.004434f0
add esp, 0x18
lea eax, [ebp - 0x2d0c]
push ebx
push eax
push 0x2710
lea eax, [ebp - 0x2cfc]
push eax
push 0xc
lea eax, [ebp - 0x2d08]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x411430
push 0x3e8
lea eax, [ebp - 0x3ec]
push edi
push eax
call fcn.004434f0
mov edx, dword [ebp - 0x2cf0]
lea ecx, [ebp - 0x2cfc]
push 0x4fa050
push edi
call fcn.0041114a
mov edx, dword [ebp - 0x2cec]
lea ecx, [ebp - 0x2cfc]
push 0x4fa450
push edi
call fcn.0041114a
mov edx, dword [ebp - 0x2ce4]
lea eax, [ebp - 0x3ec]
push eax
push 1
lea ecx, [ebp - 0x2cfc]
call fcn.0041114a
push 0x4fa450
push 0x4fa850
call fcn.00450850
add esp, 0x2c
cmp byte [0x4f9a40], 0
jne 0x411422
movzx eax, byte [ebp - 0x3ec]
push eax
call fcn.00451862
pop ecx
test eax, eax
jne 0x41140d
movzx eax, byte [ebp - 0x3d9]
push eax
call fcn.00451862
pop ecx
test eax, eax
je 0x411422
lea eax, [ebp - 0x3ec]
push eax
push 0x4f9a40
call fcn.00450850
pop ecx
pop ecx
jmp 0x411432
cmp byte [0x4fa850], 0
je 0x411432
xor edi, edi
inc edi
jmp 0x411432
call ebx
push 0x2710
lea eax, [ebp - 0x2cfc]
push 0
push eax
call fcn.004434f0
add esp, 0xc
lea eax, [ebp - 0x2d0c]
xor ecx, ecx
push ecx
push eax
push 0x2710
lea eax, [ebp - 0x2cfc]
push eax
push ecx
push ecx
push 0x2d0c10
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4114de
push 0x3e8
lea eax, [ebp - 0x3ec]
push 0
push eax
call fcn.004434f0
lea eax, [ebp - 0x2cec]
push eax
lea eax, [ebp - 0x3ec]
push eax
call fcn.00450850
add esp, 0x14
cmp byte [0x4f9a40], 0
jne 0x4114e0
movsx eax, byte [ebp - 0x3ec]
push eax
call fcn.00451862
pop ecx
test eax, eax
jne 0x4114c6
movsx eax, byte [ebp - 0x3d9]
push eax
call fcn.00451862
pop ecx
test eax, eax
je 0x4114e0
lea eax, [ebp - 0x3ec]
push eax
push 0x4f9a40
call fcn.00450850
pop ecx
xor edi, edi
pop ecx
inc edi
jmp 0x4114e0
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428f9c
mov esp, ebp
pop ebp
ret
Function at 0x411f04
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0042a2f0
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.00411d5d
push 0x800
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.004434f0
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x1008], ebx
push ebx
push eax
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
call fcn.004434f0
add esp, 0x18
lea eax, [ebp - 0x804]
mov ecx, 0x400
push ecx
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1008]
push eax
push ecx
lea eax, [ebp - 0x1004]
push eax
push 0x4bb56c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1008]
mov edx, esi
push edi
call fcn.00411e57
pop ecx
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428f9c
mov esp, ebp
pop ebp
ret

Function at 0x411fb9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0042a2f0
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00411d5d
mov edi, 0x800
mov esi, eax
push edi
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.004434f0
xor eax, eax
push edi
push eax
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x101c], eax
mov dword [ebp - 0x1018], eax
lea eax, [ebp - 0x810]
push eax
call fcn.004434f0
add esp, 0x18
lea eax, [ebp - 0x810]
mov ecx, 0x400
push ecx
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x1014]
push eax
push ecx
lea eax, [ebp - 0x1010]
push eax
push 0x4bb56c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1014]
lea edi, [ebp - 0xf]
xor eax, eax
mov byte [ebp - 0x10], 0
stosd dword es:[edi], eax
mov edx, esi
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
push eax
call fcn.00411e57
push ebx
lea ecx, [ebp - 0x10]
call fcn.00410385
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428f9c
mov esp, ebp
pop ebp
ret
Function at 0x414098
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
mov ebx, ecx
push edi
push eax
call fcn.004434f0
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x218]
push eax
push edi
push 0x44b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x244], eax
xor eax, eax
push 7
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], edi
lea edi, [ebp - 0x234]
pop ecx
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x238], 5
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebx + 0x3c]
call dword [sym.imp.USER32.dll_HideCaret]
mov eax, dword [ebx + 0xb0]
cmp eax, dword [ebx + 0xb4]
je 0x414176
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428f9c
mov esp, ebp
pop ebp
ret 4

Function at 0x417e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c067
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4cf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 1
mov dword [ebp - 0x14], esi
call fcn.004668a0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 2
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 9
call fcn.00469420
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xa
call fcn.00469420
mov byte [esi + 0x5c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41bc20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c67e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4cf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x10]
mov dword [edi + 0xc], 0
call fcn.00469420
mov dword [ebp - 4], 0
mov eax, dword [edi + 8]
mov dword [edi], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.0
mov dword [edi + 4], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 8], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.2.0
mov eax, dword [edi + 8]
mov eax, dword [eax + 4]
mov dword [eax + edi + 4], 0
mov dword [edi + 0x24], vtable.CryptoPP::ModExpPrecomputation.0
mov dword [edi + 0x28], 0
lea esi, [edi + 0x2c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer_.0
call fcn.00469420
mov byte [ebp - 4], 2
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], 0
call fcn.00469420
mov dword [esi + 0x30], 0
mov eax, edi
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x421582
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 0xc], edx
cmp dword [edi + 0x6c], eax
jb 0x421621
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.00441740
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x4215d6
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x4215fd
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x4216dc
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x42164e
xor eax, eax
jmp 0x42169f
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x42166b
mov edx, dword [esi]
push ecx
mov ecx, dword [esi + 0x30]
call fcn.00421f29
jmp 0x421683
cmp eax, 2
jne 0x421687
mov edx, dword [esi]
test edx, edx
jne 0x42167a
xor eax, eax
jmp 0x421684
push ecx
mov ecx, dword [esi + 0x30]
call fcn.0041f134
pop ecx
mov dword [esi + 0x30], eax
push dword [ebp - 8]
push dword [esi]
push dword [ebp - 0xc]
call fcn.00441740
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x4216c7
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x4216dc
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x421593
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4252d5
Capabilities:
Write file on windows

Disassembly:
push 0x38
mov eax, 0x49ccb2
call fcn.00429ae7
mov ebx, ecx
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x4252f1
cmp word [eax], si
jne 0x4252fc
lea eax, [ebx + 0x1c]
cmp dword [eax + 0x14], 8
jb 0x4252fc
mov eax, dword [eax]
push 0x4baed8
push eax
call fcn.0044fcc6
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x425324
push 0x4caedc
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 3
push eax
call fcn.004439cc
mov esi, dword [ebx + 0x4c]
xor eax, eax
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x40], al
mov dword [ebp - 4], eax
cmp esi, dword [ebx + 0x50]
je 0x425361
mov ecx, dword [esi]
cmp dword [ebx + 0x44], eax
jne 0x42534d
push edi
call fcn.0042472d
jmp 0x425356
lea eax, [ebp - 0x40]
push eax
call fcn.00424773
add esi, 4
push 0
pop eax
cmp esi, dword [ebx + 0x50]
jne 0x42533e
cmp dword [ebx + 0x44], eax
je 0x4253bd
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.0040b40e
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.004255be
test eax, eax
je 0x4253ae
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push eax
call fcn.0044f920
add esp, 0x10
xor esi, esi
lea ecx, [ebp - 0x28]
push esi
push 1
call fcn.00408c24
jmp 0x4253bf
xor esi, esi
push edi
call fcn.0044f588
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.00408c90
call fcn.00429a91
ret 4
Function at 0x425e1b
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], esi
test edi, edi
je 0x425e8d
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x425e41
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
cmp eax, 0x3fffffff
jg 0x425e8d
add eax, eax
call fcn.00429a50
mov esi, esp
test esi, esi
je 0x425e8a
mov ecx, dword [ebp - 0x1c]
push ebx
push ebx
mov byte [esi], bl
lea eax, [ecx + ecx]
push eax
push esi
push 0xffffffffffffffff
push edi
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, esi
mov esi, dword [ebp - 0x18]
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push 0x7b
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_htons]
push ebx
mov word [ebp - 0x12], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x425ecd
push ebx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x425ef6
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
inc eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428f9c
mov esp, ebp
pop ebp
ret 8
xor eax, eax
jmp 0x425ee0

Function at 0x425efa
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4cf094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push esi
push edi
mov edi, 0x3e8
mov esi, dword [ebp + 8]
div edi
xor edi, edi
mov dword [ebp - 0x110], eax
inc edi
mov eax, dword [ecx]
xor ecx, ecx
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x110]
push eax
push ecx
push ecx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], edx
push eax
push ecx
mov dword [ebp - 0x108], edi
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
jne 0x425f5d
xor eax, eax
jmp 0x425f68
xor ecx, ecx
test eax, eax
mov eax, edi
setne cl
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428f9c
mov esp, ebp
pop ebp
ret 8
Function at 0x42620d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x49cd64
call fcn.00429b1e
mov ebx, edx
push 0x801
call fcn.00429486
xor edi, edi
mov esi, eax
mov dword [ebp - 4], edi
mov dword [esp], 0x801
push edi
push esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0x800
call fcn.004434f0
add esp, 0xc
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push edi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x14], edi
je 0x42629f
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x18], 1
jne 0x426296
push esi
call fcn.0040676d
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push esi
call fcn.004066f4
inc edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4262aa
push esi
call fcn.00429256
pop ecx
mov eax, edi
call fcn.00429a7c
ret

Function at 0x42ad25
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4501cf
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045006a

Function at 0x45c77e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045c5fd

Function at 0x460181
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045faef

Function at 0x46018c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045fd2a

Function at 0x468110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e068
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4cf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x24]
mov esi, eax
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push esi
call dword [eax + 0x28]
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0x30]
call eax
mov edx, dword [esi]
mov ecx, esi
push 1
mov bl, al
call dword [edx]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x483d40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x20]
mov ecx, esi
shr ecx, 2
push edi
test ecx, ecx
je 0x483e05
mov edi, dword [esp + 0x20]
cmp ecx, 8
jb 0x483de0
mov ebx, ecx
lea eax, [edi + 0x10]
mov esi, ebp
and ebx, 0xfffffff8
sub esi, edi
xorps xmm3, xmm3
mov dword [esp + 0x10], esi
movaps xmm2, xmm3
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebp + edx*4]
add edx, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edi + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edx, ebx
jb 0x483d90
mov edi, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edx, ecx
jae 0x483e05
mov esi, ebp
lea edi, [edi + edx*4]
sub esi, dword [esp + 0x20]
sub ecx, edx
add edx, ecx
mov eax, dword [edi + esi]
lea edi, [edi + 4]
xor eax, dword [edi - 4]
or ebx, eax
sub ecx, 1
jne 0x483df1
mov esi, dword [esp + 0x24]
shl edx, 2
sub esi, edx
jne 0x483e1b
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x20]
add ebp, edx
add ecx, edx
mov eax, ebx
shr eax, 0x10
mov edx, ebx
shr edx, 0x18
xor edi, edi
or dl, al
mov dword [esp + 0x20], ecx
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
mov dword [esp + 0x10], edx
test esi, esi
je 0x483ef5
cmp esi, 0x20
jb 0x483ed9
mov ebx, esi
mov edx, ebp
and ebx, 0xffffffe0
xorps xmm3, xmm3
sub edx, ecx
mov eax, ecx
mov dword [esp + 0x14], edx
movaps xmm2, xmm3
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ecx - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [edi + ebp + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ebx
jb 0x483e70
por xmm2, xmm3
mov ecx, dword [esp + 0x20]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
cmp edi, esi
jae 0x483ef5
sub ebp, dword [esp + 0x20]
add ecx, edi
sub esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
sub esi, 1
jne 0x483ee5
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x483f10
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, edx
shr edi, 2
test edi, edi
je 0x483fb7
cmp edi, 8
jb 0x483f90
lea eax, [esi - 4]
lea eax, [eax + edi*4]
lea ecx, [ebp - 4]
lea ecx, [ecx + edi*4]
cmp ebp, eax
ja 0x483f49
cmp ecx, esi
jae 0x483f90
mov ecx, edi
lea eax, [ebp + 0x10]
mov edx, esi
and ecx, 0xfffffff8
sub edx, ebp
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + ebx*4]
add ebx, 8
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, ecx
jb 0x483f61
mov ebp, dword [esp + 0x18]
cmp ebx, edi
jae 0x483fb7
lea ecx, [ebx*4]
mov edx, esi
sub edi, ebx
add ecx, ebp
sub edx, ebp
add ebx, edi
mov eax, dword [ecx + edx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edi, 1
jne 0x483fa5
mov edx, dword [esp + 0x20]
shl ebx, 2
sub edx, ebx
je 0x484034
add ebp, ebx
add esi, ebx
xor edi, edi
test edx, edx
je 0x484034
cmp edx, 0x20
jb 0x48401b
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, edx
add ecx, edx
cmp ebp, eax
ja 0x483fdf
cmp ecx, esi
jae 0x48401b
mov ecx, edx
mov ebx, esi
and ecx, 0xffffffe0
mov eax, ebp
sub ebx, ebp
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [esi + edi + 0x10]
add edi, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x483ff0
cmp edi, edx
jae 0x484034
sub esi, ebp
lea ecx, [edi + ebp]
sub edx, edi
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x484026
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret