joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf52d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xf52d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xf52d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xf52d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xf52d94
push eax
push esi
call fcn.00f5520b
add esp, 8
pop esi
ret 0x10

Function at 0xf52da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xf52e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xf52e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xf6b320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00f54dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xf52dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xf52e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xf52ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xf52eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xf6b320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00f54dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xf52eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xf52e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xf53000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xf53131
push esi
call fcn.00f56145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00f45080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xf53131
push 0
push ebp
call fcn.00f453a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00f45260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xf5308b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00f452f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xf53121
push 0xf6b918
push edi
call fcn.00f543f0
push eax
push ebx
push esi
call fcn.00f52f60
push 0xf6b8f8
push edi
call fcn.00f543f0
push eax
push ebx
push esi
call fcn.00f52f60
push 0xf6b8d8
push edi
call fcn.00f543f0
push eax
push ebx
push esi
call fcn.00f52f60
push 0xf6b8c0
push edi
call fcn.00f543f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00f52f60
push 0xf6b8a0
push edi
call fcn.00f543f0
push eax
push ebx
push esi
call fcn.00f52f60
push 0xf6b888
push edi
call fcn.00f543f0
push eax
push ebx
push esi
call fcn.00f52f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xf541b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00f54140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00f54140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00f54140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00f54140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xf54bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf54c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xf6687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf54c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xf54c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x41bd00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x424c80], ecx
inc edx
cmp edx, 0x100
jb 0x41bd02
cmp edx, 0x800
jae 0x41bdd9
lea esp, [esp]
mov eax, dword [edx*4 + 0x424880]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x424c80]
inc edx
mov dword [edx*4 + 0x424c7c], eax
cmp edx, 0x800
jb 0x41bdb0
mov eax, 0x41c5e0
mov dword [0x424c7c], eax
mov dword [0x426c80], eax
mov dword [0x424c78], 0x41c500
call fcn.0041c010
test eax, eax
jne 0x41be05
mov dword [0x426c80], 0x41c500
ret

Function at 0x433080
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x433098
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x433176
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004339e0
add esp, 8
sar eax, 0xc
cmp eax, 3
jne 0x433171
mov dword [ebp - 0x10], 0xfff
mov dword [ebp - 0xc], 0x9922c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004339e0
add esp, 8
and eax, dword [ebp - 0x10]
add eax, 0x8702
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
cmp dword [ebp - 4], 0
jne 0x43314a
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x43314a
xor eax, eax
jmp 0x433176
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx - 0x8702]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx - 0x8702], eax
jmp 0x43308f
mov esp, ebp
pop ebp
ret

Function at 0x4339e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x240be8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x240be8
push 0x15b9
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x433a15
xor eax, eax
jmp 0x433a1f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx eax, word [eax + edx*2]
mov esp, ebp
pop ebp
ret
Function at 0x100013e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push esi
sub eax, 1
je 0x10001409
sub eax, 5
je 0x100013fe
mov eax, 1
pop esi
pop ebp
ret 0xc
test ecx, ecx
je 0x10001409
mov eax, dword [0x1001a2d0]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov edx, ecx
mov dword [0x1001a2d0], eax
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10001416
sub edx, esi
je 0x1000142f
call fcn.10001050
mov ecx, eax
call fcn.100010b0
jmp 0x1000143c
push str.Error__No_Paramter__n
call fcn.10001010
add esp, 4
push 1
call fcn.10003738
push eax
call fcn.10003aaf
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x5205c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5205ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5205ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40ad60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42dd70
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x43b698]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
push eax
call dword [0x431378]
xor ebx, ebx
lea ecx, [esi + 0x24]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.ExProgramer.0
call dword [0x43137c]
mov ecx, dword [0x43125c]
mov dword [esi + 0x37], ecx
mov eax, 0x90000000
push 0x43168c
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
call dword [0x431380]
mov dword [esi + 0x28], 0x90000000
mov dword [esi + 0x2c], 0x9fffffff
mov word [esi + 0x30], bx
mov byte [esi + 0x32], bl
mov dword [esi + 0x33], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4214d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fe83
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x43b698]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x43b758
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], ebx
mov dword [ecx], 0x43b758
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x43168c
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.00420980
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401ff5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f110]
jne 0x401fff
repz ret
jmp fcn.00402f26

Function at 0x40ffc0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404ec6
and dword [ebp - 4], 0
cmp dword [0x43161c], 0
mov ebx, eax
jne 0x410071
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410122
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x410122
push eax
call fcn.00404e54
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43161c], eax
call esi
push eax
call fcn.00404e54
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x431620], eax
call esi
push eax
call fcn.00404e54
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431624], eax
call esi
push eax
call fcn.00404e54
pop ecx
mov dword [0x43162c], eax
test eax, eax
je 0x410071
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404e54
pop ecx
mov dword [0x431628], eax
mov eax, dword [0x431628]
cmp eax, ebx
je 0x4100c9
cmp dword [0x43162c], ebx
je 0x4100c9
push eax
call fcn.00404ecf
push dword [0x43162c]
mov esi, eax
call fcn.00404ecf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4100c9
test edi, edi
je 0x4100c9
call esi
test eax, eax
je 0x4100c0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4100c0
test byte [ebp - 0xc], 1
jne 0x4100c9
or dword [ebp + 0x10], 0x200000
jmp 0x410102
mov eax, dword [0x431620]
cmp eax, ebx
je 0x410102
push eax
call fcn.00404ecf
pop ecx
test eax, eax
je 0x410102
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410102
mov eax, dword [0x431624]
cmp eax, ebx
je 0x410102
push eax
call fcn.00404ecf
pop ecx
test eax, eax
je 0x410102
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43161c]
call fcn.00404ecf
pop ecx
test eax, eax
je 0x410122
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410124
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x429190
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x42f110]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
push edi
mov dword [esp + 0xc], eax
jle 0x42926b
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp + 0xc], 0x2d
jne 0x4291f8
push 0
push str.fikojini_zujokobixexezonakeweguneleg_lejoyuxalanetexitevelanebubu_satoretik_tajufejefavohiyelirixago
call edi
push str.fepekoniguvisenevuwuki_jin
push str.pocudinapefiwuwuracuyehopasa
push str.giciyojozabuxos_joguzi_zunibizece
push str.cerowitalapotovonemadudukadoga_wumivuxikeyiwezayopoyevocirah_fuhehoguh_nivipapeniloxaceyobogetamixari_fufozimepofezawipogobonemetibe
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
call fcn.004290e0
mov ecx, dword [esp + 0xc]
xor byte [ecx + esi], al
cmp dword [ebp + 0xc], 0xf
jne 0x429261
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
push eax
lea edx, [esp + 0x24]
push edx
push 0x42c950
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
mov word [esp + 0x28], cx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push str.kalagekovidayacizocopexutovumofi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x4291cb
cmp dword [ebp + 0xc], 0x2d
jne 0x429285
mov dword [0x4327b8], 0xa62e7790
mov dword [0x4327bc], 0xffffffff
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401ff5
mov esp, ebp
pop ebp
ret
Function at 0x429690
Capabilities:
Access the windows event log
Manipulate console buffer
Set file attributes

Disassembly:
sub esp, 0x14
mov eax, dword [0x43242c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push esi
mov dword [esp + 0x10], 0x1540b5
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xcc1
jne 0x4296ca
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov eax, dword [0x43242c]
mov dword [0x432420], 0x8e468c60
cmp eax, 0x3dc
jne 0x429735
push 0
push 0x42cb98
call ebx
xor ecx, ecx
xor eax, eax
lea edx, [esp + 0x18]
push edx
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov eax, dword [esp + 0x14]
push eax
push ecx
push ecx
push ecx
call ebp
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
push 0
push 0
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AccessCheckByTypeResultList]
push str.rugenalef
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
mov eax, dword [0x43242c]
sub dword [esp + 0x14], 1
jne 0x4296b8
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
xor esi, esi
mov ebp, 0xec58acac
or ebx, 0xffffffff
cmp eax, 0x997
jne 0x429762
push 0
push 0
call edi
mov eax, dword [0x43242c]
cmp esi, 0x846373
jne 0x429779
mov eax, dword [0x430bc4]
add eax, 0xa231
mov dword [0x43242c], eax
cmp eax, 0x141
jne 0x42978c
mov dword [0x431c00], ebp
mov dword [0x431c04], ebx
inc esi
cmp esi, 0x123c962
jl 0x429750
call fcn.004292f0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x40114c
Capabilities:
Allocate thread local storage

Disassembly:
mov ecx, 0x864
or ecx, ecx
je 0x401151
cmp dword [0x66509f], 0
jae 0x401117
mov eax, 0xfe
call fcn.004010ee
mov ecx, 0x864
push ecx
push 8
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapAlloc
or eax, eax
jne 0x401138
mov eax, 0xfd
call fcn.004010ee
push eax
push eax
push dword [0x66509f]
call fcn.006627a0
push dword [0x66509f]
call fcn.006627c0
jo 0x401164
invalid
invalid
pop edi
jo 0x401164
add byte es:[edi - 0x3d], bl
mov ecx, 0x864
or ecx, ecx
je 0x401174
ret
call fcn.00662770
mov dword [0x66509f], eax
cmp eax, 0
jae 0x4010fb
add byte [ebx - 0x6e8cff08], al
mov eax, 0xfc
call fcn.004010ee
ret

Function at 0x49709a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.004a00a9
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4970e0
xor eax, eax
jmp 0x4970e3
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.004a06de
lea eax, [edi + 0x7c]
test eax, eax
je 0x4970fe
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.004a0a43
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x49713c
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.004a0a43
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0049fdc3
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004a075f
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f1817
Capabilities:
Encode data using xor

Disassembly:
retf 0xab6b
ja 0x4f176b
lcall 0x31d4, 0x885b9156
outsd dx, dword [esi]
xor al, 0x74
test eax, 0x6d5b59e2
repne cmpsd dword [esi], dword es:[edi]
stc
jp 0x4f17ca
daa
mov ebp, 0xb2c3ed6e
test edx, edi
fisubr dword [esi + ebx*8 - 0x2a]
salc
sbb eax, 0x4ad1e90d
fsub qword [esi + edx*4 - 0x5e]
mov edx, 0xb5ee3d70
bound eax, qword [ebx + 0x5cbb82ad]
lodsd eax, dword [esi]
cmp byte [ebx - 0x144856a4], 0xc1
test dword [ecx], edx
ret 0x2e8e
pop ds
dec ebx
leave
jne 0x4f17c8
dec ebp
mov edx, 0xcc5735d
mov ebx, 0xf5e5f48a
cmc
cmc
nop
dec ebx
in al, 0x25
stosb byte es:[edi], al
cmp ecx, dword [eax + 0x425b4a79]
mov cs, word [edx]
mov ebx, 0x8ac5392b
xchg edi, eax
push esp
jmp 0x4f17e9

Function at 0x53a754
Capabilities:
Encode data using xor

Disassembly:
push ds
push 7
and dl, byte cs:[0x559b1ca0]
add eax, esi
daa
cmp eax, 0x38fd8d76
xchg esp, eax
xor eax, 0xd15318a8
invalid
sbb edx, dword gs:[ebx - 0x10c6e205]
mov ah, cl
pushal
fxch st(4)
and edi, dword [ecx + 0xc]
test ch, bh
jge 0x53a6ff
sbb dword [edi], esp
daa
das
add byte [ecx - 0x78086f99], bh
pop ebx
jne 0x53a6e7
jne 0x53a769
insd dword es:[edi], dx
push ss
dec ebp
daa
inc esi
pop ss
mov word [edi], cs
fldenv [esi + 0x5a]
ja 0x53a6e5
in eax, 0xd4
invalid
aam 0xc5
out 0x10, eax
xchg esi, eax
sbb dword [eax + ebx*8 - 0x35], 0x35
jo 0x53a6aa
rol al, 1
jo 0x53a6f1
push 0xf90c78ce
pushfd
pop es
jle 0x53a6d3
push ebp
and ch, byte [esi - 0x5d00dfed]
imul ecx, ebp, 0xffffffb5
fnsave dword [esi - 0x63f3023b]
xor dword [eax], ecx
rcl byte [edi + 0x262ec46d]
movsd dword es:[edi], dword [esi]
inc edi
or dword [ebx + 0x15aa7c5], edx
mov cl, 0x16
push ss
xchg edx, eax
mov dl, byte [esi - 0x14]
cvtpi2ps xmm6, qword [ecx - 0x5ee7c2ce]
sub eax, 0x65e003ee
mov eax, 0x2ae61e93
mov eax, 0x2ae61e93
mov ebp, ebx
enter 0xffffffffffff8cdb, 0x20
fisttp dword [eax + 0x4af96f83]
in eax, dx
stc
das
sbb eax, 0x3c6f9fbc
and ah, cl
scasd eax, dword es:[edi]
insd dword es:[edi], dx
mov edx, 0x14e8e5fc
aas
cld
in eax, 0xe8
adc al, 0x3f
jbe 0x53a705
xchg ecx, eax
out 0xa4, eax
mov byte [0xcd89fcfe], al
mov ebx, 0x68ed52e1
sbb eax, 0xadfdf833
mov edi, 0xc2139def

Function at 0x53eb67
Capabilities:
Encode data using xor

Disassembly:
and dword [eax], ecx
add byte [ebp - 0x67ff8686], bl
inc ebx
aad 0xc
xchg dword [ecx + 0x77b43a81], eax
pop edx
cmp dword [edx], 0x5a2677b4
or bh, dl
shr dword [edi - 0x2cca95d2], 0xd9
xlatb
and dword [esi], ecx
or ecx, dword [esi]
sbb eax, 0x6f40dfc9
push es
xor byte [esi - 0x1173e804], bl
jns 0x53eb75
mov ebp, 0x43b6ac3a
test byte [ecx], bh
ljmp 0x7690