joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aad4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b8
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x18e
push esi
mov word [ebp - 0x320], ax
xor edi, edi
lea eax, [ebp - 0x31e]
push edi
push eax
call fcn.0040e740
xor eax, eax
push esi
mov word [ebp - 0x4b0], ax
lea eax, [ebp - 0x4ae]
push edi
push eax
call fcn.0040e740
xor eax, eax
push esi
mov word [ebp - 0x190], ax
lea eax, [ebp - 0x18e]
push edi
push eax
call fcn.0040e740
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0x24
lea eax, [ebp - 0x320]
push dword [ebp + 8]
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x190]
push eax
call esi
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x320]
push eax
push 0x80000000
call fcn.00404bd2
mov ebx, 0x190
push ebx
lea eax, [ebp - 0x320]
push edi
push eax
call fcn.0040e740
add esp, 0xc
lea eax, [ebp - 0x320]
push dword [ebp + 0xc]
push eax
call esi
push str._shellopencommand
lea eax, [ebp - 0x320]
push eax
call esi
push ebx
lea eax, [ebp - 0x190]
push edi
push eax
call fcn.0040e740
add esp, 0xc
mov edi, 0x41b374
push edi
lea eax, [ebp - 0x190]
push eax
call esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x190]
push eax
call esi
push edi
lea eax, [ebp - 0x190]
push eax
call esi
push 0x41b378
lea eax, [ebp - 0x190]
push eax
call esi
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x320]
push eax
mov edi, 0x80000000
push edi
call fcn.00404bd2
push ebx
lea eax, [ebp - 0x320]
push 0
push eax
call fcn.0040e740
add esp, 0xc
lea eax, [ebp - 0x320]
push dword [ebp + 0xc]
push eax
call esi
push str.DefaultIcon
lea eax, [ebp - 0x320]
push eax
call esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x6b8], ax
lea eax, [ebp - 0x6b6]
push eax
call fcn.0040e740
add esp, 0xc
lea eax, [ebp - 0x6b8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str._shell32.dll
lea eax, [ebp - 0x6b8]
push eax
call esi
push ebx
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.0040e740
add esp, 0xc
lea eax, [ebp - 0x6b8]
push eax
lea eax, [ebp - 0x190]
push eax
call esi
push str.__154
lea eax, [ebp - 0x190]
push eax
call esi
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x320]
push eax
push edi
call fcn.00404bd2
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40b133
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
push 0xffffffffffffffeb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x40b16d
mov ecx, dword [eax + 0x1b4]
mov edi, dword [eax + 0x1b8]
test ecx, ecx
je 0x40b160
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
je 0x40b16d
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [esi], 0
jne 0x40b184
mov ecx, esi
call fcn.0040afa1
push 5
mov ecx, esi
call fcn.0040af41
jmp 0x40b191
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
pop edi
pop esi
pop ecx
ret
Function at 0x40e53a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41d880]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0040c71d
mov dword [ebp - 0x14], eax
cmp dword [0x41ea34], edi
jne 0x40e62b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40e5b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e70b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40e70b
push 0x415254
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e70b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x41ea34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x41ea38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x41ea3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41ea44], eax
test eax, eax
je 0x40e628
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41ea40], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40e650
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40e643
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40e665
push 4
pop eax
jmp 0x40e70d
cmp dword [ebp - 0x14], edi
je 0x40e665
push dword [0x41ea34]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40e64a
mov eax, dword [0x41ea40]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40e6c3
cmp dword [0x41ea44], esi
je 0x40e6c3
push eax
call ebx
push dword [0x41ea44]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e6c3
test eax, eax
je 0x40e6c3
call ecx
test eax, eax
je 0x40e6b8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e6b8
test byte [ebp - 8], 1
jne 0x40e6c3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40e6f3
mov eax, dword [0x41ea38]
cmp eax, esi
je 0x40e6f0
push eax
call ebx
test eax, eax
je 0x40e6f0
call eax
mov edi, eax
test edi, edi
je 0x40e6f0
mov eax, dword [0x41ea3c]
cmp eax, esi
je 0x40e6f0
push eax
call ebx
test eax, eax
je 0x40e6f0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x41ea34]
call ebx
test eax, eax
je 0x40e70b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40e70d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e71c
leave
ret
Function at 0x401280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403b55
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
call fcn.00402ad8
mov dword [ebp - 0x1c], eax
mov dword [eax], 0x401350
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x402a70
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40133f
mov dword [ebp - 4], 1
cmp dword [ebp - 0x14], 0
jne 0x4012f4
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
call dword [sym.imp.MSVCP140.dll__Thrd_id]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jne 0x401309
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 0
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.MSVCP140.dll__Thrd_join]
add esp, 0xc
test eax, eax
je 0x401324
push 2
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402aca
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x14], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x4014d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
push 0
mov dword [esp + 0xc], esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x40151f
push 0x402480
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, 0x404280
call fcn.00402260
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x40158f
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x401589
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x401589
push eax
lea ecx, [esp + 0x14]
call fcn.00401c60
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xorps xmm0, xmm0
mov eax, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [esp + 0x20]
movq qword [esi + 0x10], xmm0
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00402aca
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x404260
mov ecx, esi
call fcn.00401c60
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00402aca
mov esp, ebp
pop ebp
ret
Function at 0x40336c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4033ab
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4033ab
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4033ab
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4033ab
cmp dword [ecx + 0x74], 0xe
jbe 0x4033ab
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4075b0
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4075b6
mov ecx, dword [esp + 8]
push esi
push 0
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x407610
lea edx, [esi + esi + 2]
push edx
push edi
push 1
push eax
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret

Function at 0x40800a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433040]
jne 0x408014
repz ret
jmp fcn.0040a521

Function at 0x40d862
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x433870]
je 0x40d87d
inc edi
cmp edi, 0x17
jb 0x40d86e
cmp edi, 0x17
jae 0x40d9fd
push ebp
push 3
call fcn.00417a27
cmp eax, 1
pop ecx
je 0x40d9c9
push 3
call fcn.00417a27
test eax, eax
pop ecx
jne 0x40d8b1
cmp dword [0x433030], 1
je 0x40d9c9
cmp ebx, 0xfc
je 0x40d9fc
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x434a90
push ebp
call fcn.0040cb78
add esp, 0xc
test eax, eax
je 0x40d8e7
push esi
push esi
push esi
push esi
push esi
call fcn.00408794
add esp, 0x14
push 0x104
mov esi, 0x434aa9
push esi
push 0
mov byte [0x434bad], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40d92b
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040cb78
add esp, 0xc
test eax, eax
je 0x40d92b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00408794
add esp, 0x14
push esi
call fcn.00409e50
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40d970
push esi
call fcn.00409e50
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x434da4
push 0x42cc14
sub ecx, eax
push ecx
push eax
call fcn.00413bb6
add esp, 0x14
test eax, eax
je 0x40d970
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00408794
add esp, 0x14
jmp 0x40d972
xor esi, esi
push 0x42cc10
push ebx
push ebp
call fcn.00413af3
add esp, 0xc
test eax, eax
je 0x40d992
push esi
push esi
push esi
push esi
push esi
call fcn.00408794
add esp, 0x14
push dword [edi*8 + 0x433874]
push ebx
push ebp
call fcn.00413af3
add esp, 0xc
test eax, eax
je 0x40d9b4
push esi
push esi
push esi
push esi
push esi
call fcn.00408794
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0041786a
add esp, 0xc
jmp 0x40d9fc
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40d9fc
cmp ebp, 0xffffffff
je 0x40d9fc
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x433874]
push dword [esi]
call fcn.00409e50
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x41786a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040a6ff
xor ebx, ebx
cmp dword [0x4351a4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x417940
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x417a20
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x417a20
push eax
call fcn.0040a691
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4351a4], eax
call esi
push eax
call fcn.0040a691
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4351a8], eax
call esi
push eax
call fcn.0040a691
mov dword [0x4351ac], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004091ac
test eax, eax
pop ecx
pop ecx
je 0x41790e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408794
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x417940
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040a691
cmp eax, ebx
pop ecx
mov dword [0x4351b4], eax
je 0x417940
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a691
pop ecx
mov dword [0x4351b0], eax
mov eax, dword [0x4351b0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4179c5
cmp dword [0x4351b4], ecx
je 0x4179c5
push eax
call fcn.0040a708
push dword [0x4351b4]
mov esi, eax
call fcn.0040a708
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4179c5
cmp edi, ebx
je 0x4179c5
call esi
cmp eax, ebx
je 0x417992
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x417992
test byte [ebp - 0x18], 1
jne 0x4179c5
lea eax, [ebp - 0x10]
push eax
call fcn.004091e3
test eax, eax
pop ecx
je 0x4179ad
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408794
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4179bc
or dword [ebp + 0x10], 0x200000
jmp 0x417a00
or dword [ebp + 0x10], 0x40000
jmp 0x417a00
mov eax, dword [0x4351a8]
cmp eax, dword [ebp - 8]
je 0x417a00
push eax
call fcn.0040a708
cmp eax, ebx
pop ecx
je 0x417a00
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x417a00
mov eax, dword [0x4351ac]
cmp eax, dword [ebp - 8]
je 0x417a00
push eax
call fcn.0040a708
cmp eax, ebx
pop ecx
je 0x417a00
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4351a4]
call fcn.0040a708
cmp eax, ebx
pop ecx
je 0x417a20
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417a22
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41986c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rol esi, cl
inc ebp
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004195ea
mov dh, dh
invalid
Function at 0x419951
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004195ea
and dh, al
xchg edx, eax
push ss
lea eax, [ebp - 0x40]
push eax
call fcn.004195fa
push eax
push esi
push dword [ebp + 8]
call fcn.004195af
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.004195ea
mov eax, dword [0x8d327b88]
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004195fa
push eax
push esi
push dword [ebp + 8]
call fcn.004195af
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004195fa
push eax
push esi
push dword [ebp + 8]
call fcn.004195af
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
aam 0x88
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004195fa
push eax
push esi
push dword [ebp + 8]
call fcn.004195af
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004195ea
sbb edi, dword [edi - 0x6277b9a7]
jl 0x419a6f
invalid
invalid
Function at 0x419a13
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004195ea
and dh, al
xchg edx, eax
push ss
lea eax, [ebp - 0x40]
push eax
call fcn.004195fa
push eax
push esi
push dword [ebp + 8]
call fcn.004195af
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.004195ea
mov eax, dword [0x8d327b88]
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004195fa
push eax
push esi
push dword [ebp + 8]
call fcn.004195af
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004195fa
push eax
push esi
push dword [ebp + 8]
call fcn.004195af
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
aam 0x88
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004195fa
push eax
push esi
push dword [ebp + 8]
call fcn.004195af
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004195ea
sbb edi, dword [edi - 0x6277b9a7]
jl 0x419a6f
invalid
invalid
Function at 0x419cfd
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x419cc1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x419cdf
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x419d3d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x419d24
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x419d2d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x419d37
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x419d19
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x419ca3
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x419d8a
dec eax
je 0x419d81
sub eax, 3
je 0x419d78
mov dword [ebp - 4], 0x40
jmp 0x419da7
mov dword [ebp - 4], 4
jmp 0x419d8d
mov dword [ebp - 4], 0x20
jmp 0x419d8d
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x419dd9
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
invalid
invalid

Function at 0x41c080
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 1
push 0
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c0d2
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp]
push edx
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c0c8
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret

Function at 0x41c3f0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x210
mov eax, dword [0x433040]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push 0xffffffffffffffff
push eax
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004085b3
add esp, 0x10
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41c442
push 0x104
lea edx, [esp + 8]
push edx
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea ecx, [esp]
push ecx
push esi
push 0x104
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test edi, edi
je 0x41c46c
mov eax, dword [esp]
test eax, eax
je 0x41c46c
mov dword [edi], eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov eax, esi
call fcn.0040800a
add esp, 0x210
ret