joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403150
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 0
push 0x4036c0
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x403182
push 6
call fcn.0044be12
add esp, 4
mov eax, dword [0x48f643]
push eax
mov ebx, eax
call fcn.00401279
pop eax
sub ebx, eax
push ecx
push ebx
push eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.0044be00
add esp, 4
pop esi
mov edi, eax
pop ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
test ecx, ecx
je 0x40321e
push eax
lodsd eax, dword [esi]
push esi
push edi
push ecx
push eax
push 0x14
call fcn.0044be00
add esp, 4
pop esi
mov edi, eax
push eax
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x4031ef
push eax
mov ebx, eax
call fcn.00401f4d
inc eax
push eax
call fcn.0044be00
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x40320e
push eax
mov ebx, eax
call fcn.00401f4d
inc eax
push eax
call fcn.0044be00
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
pop eax
pop ecx
pop edi
pop esi
stosd dword es:[edi], eax
dec ecx
jne 0x4031b6
pop eax
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x40323f
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x40323b
imul eax, dword [ebx]
jmp 0x403230
mov ecx, eax
test ecx, ecx
je 0x403282
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
add ebx, 0xc
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x40325d
push ebx
call fcn.0044be0c
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x403271
push ebx
call fcn.0044be0c
add esp, 4
pop ebx
call fcn.0044be0c
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x403245
call fcn.0044be0c
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x48f643]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4032b1
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4032ad
imul eax, dword [ebx]
jmp 0x4032a2
mov ecx, eax
test ecx, ecx
je 0x4032f4
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
add ebx, 0xc
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x4032cf
push ebx
call fcn.0044be0c
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x4032e3
push ebx
call fcn.0044be0c
add esp, 4
pop ebx
call fcn.0044be0c
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4032b7
call fcn.0044be0c
add esp, 4
mov eax, 0x473431
mov dword [0x48f643], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.00402412
jmp 0x403315
mov esp, ebp
pop ebp
ret 8
Function at 0x403568
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0044c650
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4035ad
push ebx
call fcn.0044be0c
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4035db
push 6
call fcn.0044be12
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x4035f7
push eax
mov ebx, eax
call fcn.00401f4d
inc eax
push eax
call fcn.0044be00
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4035fc
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40360d
push ebx
call fcn.0044be0c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x412aee
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x412b29
push 6
call fcn.0044be12
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004513a0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x412b8c
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004513c0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x412bb0
push 6
call fcn.0044be12
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004513a0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x412c13
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004513c0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x412c37
push 6
call fcn.0044be12
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004513a0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x412c9a
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004513c0
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x412ca2
mov esp, ebp
pop ebp
ret
Function at 0x417178
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4171be
push 6
call fcn.0044be12
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x473527]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.004010bf
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.0044c650
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x417211
push ebx
call fcn.0044be0c
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41724a
push 6
call fcn.0044be12
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x417266
push eax
mov ebx, eax
call fcn.00401f4d
inc eax
push eax
call fcn.0044be00
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41726b
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41727c
push ebx
call fcn.0044be0c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x428228
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push reloc.OLEAUT32.dll_SysStringLen
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x164
call fcn.004512b0
add esp, 0x10
push 0x80000601
push edx
push eax
push 1
mov ebx, 0x168
call fcn.0044e130
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x80000301
push 0
push dword [ebp + 0xc]
push 1
mov ebx, 0x168
call fcn.0044e130
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x474b6d
mov ebx, dword [ebp + 0x2c]
push dword [ebx]
push 0x474b6d
mov ebx, dword [ebp + 0x24]
push dword [ebx]
push 0x474b6d
mov ebx, dword [ebp + 0x1c]
push dword [ebx]
push 0x474b6d
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0x474b6d
push dword [ebp - 0x18]
push 0x474b6d
push dword [ebp - 0x14]
mov ecx, 0xc
call fcn.0040205f
add esp, 0x30
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4282ee
push ebx
call fcn.0044be0c
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4282fe
push ebx
call fcn.0044be0c
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x428312
push ebx
call fcn.0044be0c
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.004283a2
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp + 0x34]
push 0
push dword [ebp - 0xc]
push 0x4286fd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42835b
push 6
call fcn.0044be12
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x428382
push 6
call fcn.0044be12
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x42838a
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x42839b
push ebx
call fcn.0044be0c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x34
Function at 0x428a41
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
jne 0x428a69
mov dword [ebp + 0xc], 0xffffffff
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x4bf
push dword [ebp + 0xc]
push 0
lea eax, [ebp + 8]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x428ab3
push 6
call fcn.0044be12
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0xffffffff
je 0x428b0e
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fild dword [ebp - 4]
fstp qword [ebp - 0x1c]
fsub qword [ebp - 0x1c]
fstp qword [ebp - 0x24]
fild dword [ebp + 0xc]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x24]
fsub qword [ebp - 0x2c]
fcomp qword [0x474a2b]
fnstsw ax
test ah, 1
jne 0x428b0e
mov dword [ebp - 8], 0x102
push 0
mov ebx, 0x350
call fcn.0044e500
add esp, 4
cmp dword [ebp - 8], 0
je 0x428b3e
cmp dword [ebp - 8], 0x102
je 0x428b3e
mov eax, 1
jmp 0x428b43
mov eax, 0
test eax, eax
jne 0x428a7e
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x428b5c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x435bc7
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x435c7b
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00435b57
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x435c54
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x435c87
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x435ca2
test ebp, ebp
je 0x435ca2
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x435caa
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x435cea
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x435d46
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x435d41
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x435d2c
test dl, dl
je 0x435d28
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x435d2c
add ecx, 2
add eax, 2
test dl, dl
jne 0x435d0c
xor eax, eax
jmp 0x435d31
sbb eax, eax
or eax, 1
test eax, eax
je 0x435d50
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x435cf9
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x435d67
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.00435bc7
test eax, eax
jne 0x435d7f
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.00435c87
mov esi, eax
test esi, esi
jne 0x435db5
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x435dcf
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x435ec7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.00435bc7
mov esi, eax
test esi, esi
jne 0x435ee5
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.00435c87
mov dword [esp + 0x18], eax
test eax, eax
je 0x435edd
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.00435c87
mov dword [esp + 0x34], eax
test eax, eax
je 0x435edd
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.00435c87
mov dword [esp + 0x28], eax
test eax, eax
je 0x435edd
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.00435c87
mov dword [esp + 0x30], eax
test eax, eax
je 0x435edd
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x4360ac
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x4360ac
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x43600f
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x436090
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x436032
movzx esi, ax
jmp 0x436037
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x436056
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x436065
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x4360b9
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x436027
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x435fec
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x4360e2
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x4360e2
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x4360c7
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x4360f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.00435bc7
mov esi, eax
test esi, esi
je 0x4361b3
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.00435c87
mov ebp, eax
test ebp, ebp
je 0x4361b2
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.00435c87
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x4361b2
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x4361b2
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4361b1
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x436197
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x436430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x436453
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x436453
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43645d
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43649f
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x436501
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4364fc
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4364e7
test dl, dl
je 0x4364e3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4364e7
add ecx, 2
add eax, 2
test dl, dl
jne 0x4364c7
xor eax, eax
jmp 0x4364ec
sbb eax, eax
or eax, 1
test eax, eax
je 0x43650d
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4364b4
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x44c690
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
push edi
ja 0x44c710
je 0x44c701
cmp eax, 0x80000101
ja 0x44c6fa
je 0x44c701
cmp eax, 0x80000004
je 0x44c6dd
cmp eax, 0x80000005
jne 0x44c725
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], 3
test eax, eax
je 0x44c76b
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x44c76b
mov ebp, dword [esp + 0x44]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 1
mov ebx, ecx
inc ebx
jmp 0x44c76b
cmp eax, 0x80000201
jne 0x44c725
mov ebx, 4
lea ebp, [esp + 0x44]
mov dword [esp + 0xc], ebx
jmp 0x44c76b
cmp eax, 0x80000401
je 0x44c756
cmp eax, 0x80000501
je 0x44c742
cmp eax, 0x80000601
je 0x44c72e
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call fcn.00459698
jmp 0x44c763
fld dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call fcn.00459698
jmp 0x44c763
mov eax, dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
lea ebp, [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00453060
mov edi, dword [esp + 0x3c]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x20], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], 0
test edx, edx
je 0x44c846
test ecx, ecx
je 0x44c846
inc ecx
push esi
push ecx
call fcn.00464cb8
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00459670
mov esi, eax
add esp, 0xc
test esi, esi
je 0x44c7e8
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44c83c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x44c831
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00464ce1
add esp, 4
pop esi
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
add esp, 0x18
ret