joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412920
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x310
mov esi, esp
push eax
mov dword [esi + 4], esp
sub esp, 8
mov dword [esi + 0x28], esp
sub esp, 0x68
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
sub esp, 0x64
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x5c], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x58], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x54], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x50], eax
mov esp, eax
push eax
sub esp, 0xfc
mov dword [esi + 0x2c], esp
sub esp, 8
mov ecx, esp
sub esp, 8
mov edx, esp
sub esp, 0x20
mov dword [esi + 0x3c], esp
push eax
mov dword [esi + 0x34], esp
push eax
mov eax, esp
sub esp, 0x68
mov dword [esi + 0x30], esp
mov dword [esi + 0x38], edx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x78], eax
sub esp, 0xc
mov dword [esi + 0x74], esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x4c], eax
mov esp, eax
push eax
sub esp, 0xc
mov dword [esi + 0x6c], esp
sub esp, 0x800
mov dword [esi + 0x48], esp
sub esp, 0x80
mov dword [esi + 0x70], esp
sub esp, 0x44
mov dword [esi + 0x68], esp
sub esp, 0x10
mov dword [esi + 0x44], esp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44f8b0]
Function at 0x424810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x424830
cmp eax, 0xffffffdd
jge 0x424847
mov eax, 0xffffffff
jmp 0x42484a
add eax, 0x22
push eax
call fcn.0040cce0
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0xb92fbb68
mov dword [esp + 0x1c], 0xbd2fbf2c
mov dword [esp + 0x20], 0xb155b32a
mov dword [esp + 0x24], 0xb52db729
mov dword [esp + 0x28], 0xa94eab58
mov dword [esp + 0x2c], 0xad34af33
mov dword [esp + 0x30], 0xa129a34b
mov dword [esp + 0x34], 0xa532a73c
mov dword [esp + 0x38], 0x5ba4
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x23
ja 0x4248db
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.00425560
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x24
jb 0x4248b0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x424901
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4248f0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x424931
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424920
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x9fb0bff
mov dword [esp + 0x1c], 0x535078e
mov dword [esp + 0x20], 0x18a03ff
mov dword [esp + 0x24], 0x1de51f8c
mov dword [esp + 0x28], 0x19971bee
mov dword [esp + 0x2c], 0x15e717ef
mov dword [esp + 0x30], 0x112713e6
mov dword [esp + 0x34], 0x2d1b2f25
mov dword [esp + 0x38], 0x29c82b1a
mov dword [esp + 0x3c], 0x25ab27a3
mov dword [esp + 0x40], 0x21ac23df
mov dword [esp + 0x44], 0x3dcf3ffd
mov dword [esp + 0x48], 0x39b63bce
mov dword [esp + 0x4c], 0x35be37c3
mov dword [esp + 0x50], 0x31e533b8
mov dword [esp + 0x54], 0xcd0dcfcc
mov dword [esp + 0x58], 0xc9cacbfa
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x43
ja 0x424a16
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.004255a0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x44
jb 0x4249f0
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x424d40
push ecx
push esi
call fcn.00425a00
add esp, 0x10
jmp dword [0x4508c0]
Function at 0x42b830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84c
xor ebp, ebp
xor edi, edi
mov ebx, 0x20219
mov eax, 1
mov dword [esp + 0x20], 0
jmp dword [eax*4 + 0x451730]

Function at 0x42c510
Capabilities:
Contain obfuscated stackstrings
Copy file

Disassembly:
push dword [esp + 4]
call fcn.0042c530
add esp, 4
test al, al
je 0x42ccd0
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xac
xor edi, edi
mov esi, 0x20219
mov eax, 1
jmp dword [eax*4 + 0x451860]
Function at 0x430a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
cmp edi, 0x24
ja 0x430aba
cmp edi, 1
je 0x430aba
mov ebp, dword [esp + 0x38]
mov ebx, ebp
jmp 0x430a91
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x430a90
cmp ecx, 0x20
je 0x430a90
cmp ecx, 0x2b
mov edx, edi
je 0x430ab0
cmp ecx, 0x2d
jne 0x430acf
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x430ad4
xor edi, edi
test esi, esi
je 0x430ca9
mov dword [esi], 0x16
jmp 0x430ca9
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x430afd
cmp edx, 0x10
jne 0x430b15
cmp byte [ebx], 0x30
jne 0x430af6
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x430b17
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x430b17
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x18], ecx
sub eax, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
xor edx, edx
div edi
mov dword [esp + 0x1c], eax
xor ebp, ebp
mov dword [esp + 8], 0
mov edx, edi
mov dword [esp + 0x20], edi
inc ebx
jmp 0x430b71
mov ebp, ecx
mov dword [esp + 8], 0
mov esi, dword [esp + 0x44]
test esi, esi
je 0x430c40
mov dword [esi], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ecx, [eax - 0x30]
cmp ecx, 0xa
jae 0x430b90
and eax, 0xf
lea ebp, [eax + eax]
sub ebp, eax
cmp ebp, edx
jl 0x430bb1
jmp 0x430c74
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x1a
jae 0x430c74
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x430c74
mov eax, edi
mov ecx, dword [esp + 0xc]
xor eax, ecx
mov esi, dword [esp + 8]
or eax, esi
je 0x430b50
mov dword [esp + 0x14], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x1c], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x430bf0
xor edx, edx
mov esi, dword [esp + 0xc]
jmp 0x430bf9
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 0xc]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
mov dword [esp + 8], ecx
cmp edi, esi
mov ecx, dword [esp + 0xc]
sbb eax, edx
setae al
jae 0x430c25
mov dword [esp + 8], 0
mov ebp, ecx
and bl, al
mov esi, dword [esp + 0x44]
test esi, esi
mov edx, dword [esp + 0x20]
je 0x430c5b
test bl, bl
jne 0x430c5b
mov ebx, dword [esp + 0x14]
jmp 0x430b66
mov dword [esp + 0x10], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
mov dword [esp + 8], 0
jmp 0x430b4b
test bl, bl
jne 0x430c67
mov dword [esp + 0x10], 0x22
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], ebx
jmp 0x430b4b
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x430c82
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x44]
test ecx, ecx
mov eax, dword [esp + 0x10]
je 0x430c90
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x430ca0
mov edi, SysReAllocString
sub edi, dword [esp + 0x18]
jmp 0x430ca9
cmp byte [esp + 3], 0
jne 0x430ca9
neg edi
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438660
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4387bf
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x4386c1
jmp 0x4387b9
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0040ce10
mov ebp, eax
cmp ebp, 0
setne al
jmp 0x4386e1
jmp 0x4386e3
xor ebx, ebx
test al, 1
jne 0x4386ee
jmp 0x4387ad
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 0xd1
mov byte [esp + 0x19], 0x3f
mov byte [esp + 0x1a], 0x3d
mov byte [esp + 0x1b], 0x39
mov byte [esp + 0x1c], 0x36
mov byte [esp + 0x1d], 0x36
mov byte [esp + 0x1e], 0x39
mov byte [esp + 0x1f], 0xb
mov byte [esp + 0x20], 0x38
mov byte [esp + 0x21], 0xf1
mov byte [esp + 0x22], 0xe
mov byte [esp + 0x23], 9
mov byte [esp + 0x24], 0xc
mov byte [esp + 0x25], 0x9f
mov eax, 0xe
mov byte [esp + eax + 0x18], 0
add eax, 1
cmp eax, 0x13
jne 0x438741
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x13
jae 0x43878b
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043cd30
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x438756
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0040d960
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x4387ad
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f3f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43f410
mov dword [esp + 4], 0xd6d6c857
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x43f466
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.00443090
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x43f440
test ebx, ebx
je 0x43f4ce
sar ebx, 1
mov eax, dword [esp + 4]
lea ecx, [ebx - 1]
mov edx, ebx
and edx, 3
je 0x43f491
mov ebp, esi
nop
nop
nop
nop
dec ebx
movzx esi, word [edi]
add edi, 2
xor esi, ebp
imul esi, eax
mov ebp, esi
dec edx
jne 0x43f480
cmp ecx, 3
jb 0x43f4ce
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [edi + ecx*2]
xor edx, esi
imul edx, eax
movzx esi, word [edi + ecx*2 + 2]
xor esi, edx
imul esi, eax
movzx edx, word [edi + ecx*2 + 4]
xor edx, esi
imul edx, eax
movzx esi, word [edi + ecx*2 + 6]
xor esi, edx
imul esi, eax
add ecx, 4
cmp ebx, ecx
jne 0x43f4a0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4402c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4403c7
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x4402f8
mov ebp, ebx
mov esi, ebp
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x18]
jae 0x4403c9
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.004217c0
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.004217c0
add esp, 4
shl bh, 2
mov ah, al
shr ah, 4
and ah, 3
or ah, bh
mov ecx, esi
and ecx, 1
mov edx, esi
xor edx, 1
lea ebx, [edx + ecx*2]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], ah
cmp edi, ecx
jae 0x4402e0
mov byte [esp + 3], al
movzx eax, byte [ebp + edi]
push eax
call fcn.004217c0
add esp, 4
cmp al, 0x40
jne 0x440360
mov ebp, ebx
mov ecx, dword [esp + 0x1c]
jmp 0x4402e2
movzx edx, byte [esp + 3]
shl dl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, dl
lea ebp, [ebx + 1]
mov edx, dword [esp + 0x20]
mov byte [edx + ebx], cl
lea ecx, [edi + 1]
mov edx, dword [esp + 0x1c]
cmp ecx, edx
jae 0x4403c0
mov esi, ebx
mov ebx, eax
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.004217c0
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x4402e2
shl bl, 6
add al, bl
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 1], al
add esi, 2
mov ebp, esi
jmp 0x4402e2
mov ecx, edx
jmp 0x4402e2
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44873e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 8], 0x393a3bec
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x448726
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 8]
push dword [esp]
push eax
call fcn.0044a8e0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x448700
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x45412c]
mov esi, dword [eax + 0xc]
add esi, 0xc
mov dword [esp + 4], 0
mov edx, dword [case.0x446f65.46]
mov edi, dword [esi]
xor eax, eax
cmp edi, esi
setne al
mov dword [esp + 0xc], esi
jmp dword [eax*4 + 0x454134]
mov ebp, dword [edi + 0x30]
xor eax, eax
test ebp, ebp
setne al
mov dword [esp + 0x10], 1
jmp dword [eax*4 + 0x45413c]
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x448be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
movzx esi, word [edi]
mov dword [esp + 4], 0x1f1e4755
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x448c36
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0044ab40
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x448c10
xor ecx, ecx
cmp dword [esp + 4], esi
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x45422c]
jmp dword [0x454240]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402120
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00401ba0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401e10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40218b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x224]
jmp 0x40221c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4021f1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402120
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4021e8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x228]
jmp 0x40221c
mov dword [ebp - 4], 0x100
jmp 0x402192
lea ecx, [ebp - 0x14]
call fcn.00401d40
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00401c80
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret 4

Function at 0x406630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x406672
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x40661c
call fcn.0040521c
mov ebp, ecx
scasb al, byte es:[edi]
push es
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
fprem
invalid
call dword [esi + eax*8 - 0x7b]
invalid
clc
invalid
dec dword [edi - 0x3a]
test ebx, ebx
clc
invalid
dec dword [ecx - 0x3a]
test esp, ebx
clc
invalid
dec dword [eax - 0x3a]
test ebp, ebx
clc
invalid
call [esi + eax*8 - 0x7b]
fdivp st(0)
invalid
call dword [ecx - 0x3a]
test edi, ebx
clc
invalid
jmp [ebp - 0x3a]
test eax, esp
clc
invalid
dec dword [edi - 0x3a]
test ecx, esp
clc
invalid
call dword [edx - 0x3a]
test edx, esp
clc
invalid
dec dword [ecx - 0x3a]
test ebx, esp
clc
invalid
call [eax - 0x3a]
test esp, esp
clc
invalid
call [esi - 0x3a]
test ebp, esp
clc
invalid
dec dword [ecx - 0x3a]
test esi, esp
clc
invalid
invalid
cmp eax, 0xffeb17e8
push dword [ecx + 0x6b]
dec edx
mov cl, byte [ebp - 0x72b7b]
call dword [eax - 0x18]
pop ss
jmp 0x406713
invalid
mov ch, 0x58
cld
invalid
Function at 0x406f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.0040522c
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.0040518d
invalid
invalid

Function at 0x407668
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412018]
jne 0x407672
repz ret
jmp fcn.00407bfa

Function at 0x4081a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x430], ax
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x218], dx
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x438], 0
push 0x105
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x438]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x434]
push ecx
push 0x105
lea edx, [ebp - 0x430]
push edx
push 0x40d928
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x408266
push 0xa
push 0x104
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.MSVCR90.dll__itow_s]
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x408288
push str.thsnYaViMRAeBoda
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.004063f0
cmp dword [ebp + 0xc], 0
je 0x4082a0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.004063f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret
Function at 0x408620
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call fcn.00408570
add esp, 4
lea eax, [ebp - 0x210]
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4086c3
push 0x40df10
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004063a0
push str.Could_not_open_file_mapping_object.
push 0x104
mov edx, dword [ebp + 0xc]
add edx, 0x208
push edx
call fcn.004063a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x410], eax
xor eax, eax
jmp 0x4087be
push 0x1e78
push 0
push 0
push 4
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x408739
push 0x40df88
push 0x104
mov eax, dword [ebp + 0xc]
push eax
call fcn.004063a0
push str.Could_not_map_view_of_file.
push 0x104
mov ecx, dword [ebp + 0xc]
add ecx, 0x208
push ecx
call fcn.004063a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x410], eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4087be
mov dword [ebp - 4], 0xe3c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_memcpy_s]
add esp, 0x10
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ReadSharedMemory__:
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004063a0
lea edx, [ebp - 0x210]
push edx
push str.succeeded._mapping_obj_name:__s
push 0x104
mov eax, dword [ebp + 0xc]
add eax, 0x208
push eax
call dword [sym.imp.MSVCR90.dll_swprintf_s]
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x410], 0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret
Function at 0x4087d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call fcn.00408570
add esp, 4
lea eax, [ebp - 0x210]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x408868
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
je 0x408864
push 0
mov ecx, dword [ebp - 0x218]
push ecx
push str.Could_not_open_file_mapping_object
push str.ReleaseSharedMemory__
call fcn.004082b0
add esp, 0x10
xor eax, eax
jmp 0x40887a
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret

Function at 0x408a80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov byte [0x4127a4], 1
mov dword [0x41279c], 1
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x40e190
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x408afa
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.iLogLevel
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x408b10
cmp dword [ebp - 0xc], 1
jne 0x408b10
mov dword [0x41279c], 2
mov esp, ebp
pop ebp
ret