joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412b74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00412340
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004122f5
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00412340
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004122f5
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
test dword [ecx], esp
cld
invalid
jmp dword [esi - 0x3dd7a3a]
invalid
dec dword [edi - 0x3dc7a3a]
invalid
inc dword [eax - 0x3db7a3a]
invalid
dec dword [edx - 0x3da7a3a]
invalid
inc dword [edx - 0x3d97a3a]
invalid
dec dword [ebx - 0x3d87a3a]
invalid
jmp [edi - 0x3d77a3a]
invalid
invalid
out dx, al
lea eax, [ebp - 0x3ec]
push eax
call fcn.00412340
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004122f5
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00412330
movsb byte es:[edi], byte [esi]
jnp 0x412da4
mov dword [eax - 0x5335b], 0xa58000ff
int 0xfa
invalid
int3

Function at 0x416450
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41647d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41647d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x422e10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x422e3a
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x531570]
sub edx, 1
jne 0x422e20
pop esi
ret

Function at 0x422e40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, ecx
mov eax, 0x811c9dc5
mov cl, byte [edx]
test cl, cl
je 0x422e64
nop dword [eax]
imul eax, eax, 0x1000193
lea edx, [edx + 1]
movsx ecx, cl
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x422e50
ret
Function at 0x428ad0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x53d190]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov byte [ebp - 0x80c], 0
push eax
push ecx
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x80c]
call fcn.00428a20
add esp, 0x10
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x534518
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004bcc56
mov esp, ebp
pop ebp
ret
Function at 0x42a320
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x53d190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x400
xor edi, edi
lea eax, [ebp - 0x404]
push edi
push eax
call fcn.004beb60
mov eax, dword [0x584c84]
add esp, 0xc
mov dword [0x584c80], 0x1e
cmp eax, 0xffffffff
jne 0x42a37c
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
push str..K7Sentry
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x584c84], eax
mov dword [ebp - 0x40c], edi
mov dword [ebp - 0x408], edi
cmp eax, 0xffffffff
je 0x42a3af
push 0
lea ecx, [ebp - 0x408]
push ecx
push 4
lea ecx, [ebp - 0x40c]
push ecx
push 0
push 0
push 0x95002550
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea eax, [ebp - 0x404]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test esi, esi
je 0x42a41e
cmp esi, 0x200
ja 0x42a41e
call fcn.0042a620
mov esi, eax
test esi, esi
je 0x42a3e2
push esi
push str.ConfigIO_Init___:_Failed___0x_x
jmp 0x42a42a
push 0x5885d0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x42a3ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory___:_Failed___0x_x
jmp 0x42a42a
mov edi, 1
call fcn.004307b0
mov esi, eax
test esi, esi
je 0x42a417
push esi
push str.InitSystemInfo___:_Failed___0x_x
jmp 0x42a42a
call fcn.00429e60
jmp 0x42a432
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetCurrentDirectory___:_Failed___0x_x
call fcn.00428ad0
add esp, 8
mov eax, dword [0x589de8]
test eax, eax
je 0x42a44e
push eax
call fcn.004c4990
add esp, 4
mov dword [0x589dec], 0
test edi, edi
je 0x42a45f
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [0x584c84]
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x40c], 0
cmp eax, 0xffffffff
je 0x42a4ba
push 0
lea ecx, [ebp - 0x40c]
push ecx
push 4
lea ecx, [ebp - 0x408]
push ecx
push 0
push 0
push 0x95002554
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x584c84]
cmp eax, 0xffffffff
je 0x42a4ba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x584c84], 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004bcc56
mov esp, ebp
pop ebp
ret
Function at 0x42a4d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push str.GlobalK7TLMTRYMUTEX
push 1
push 0
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x42a58c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42a585
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 1
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityProductsAntiVirus
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42a54d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.AutoSubmitRisk1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x42a56e
push str.WinMain___:_Telemtry_Disabled_via_Setting
call fcn.00428ad0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret 0x10
call fcn.0042a320
test eax, eax
je 0x42a585
push eax
push str.WinMain___:_DoTelemetryTasks___:_Failed___0x_x
call fcn.00428ad0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42a620
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x53d190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.Buckets
push str.K7TLM
push str.K7TSecurity
push str.K7_Computing
push str._s_sCommonFiles_s_s
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.0042a5a0
add esp, 0x1c
lea eax, [ebp - 0x404]
push 0x587dd0
push eax
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
test eax, eax
je 0x42a6aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push esi
push str.ConfigIO_Init___:_SHGetFolderPathAndSubDir___Failed____u___x
call fcn.00428ad0
add esp, 0xc
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcc56
mov esp, ebp
pop ebp
ret
push str.Dispatch
push str.K7TLM
push str.K7TSecurity
push str.K7_Computing
push str._s_sCommonFiles_s_s
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.0042a5a0
add esp, 0x1c
lea eax, [ebp - 0x404]
push 0x5879d0
push eax
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
test eax, eax
jne 0x42a682
push str.Data
push str.K7TLM
push str.K7TSecurity
push str.K7_Computing
push str._s_sCommonFiles_s_s
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.0042a5a0
add esp, 0x1c
lea eax, [ebp - 0x404]
push 0x5881d0
push eax
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
test eax, eax
jne 0x42a682
push edi
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], 0x400
push eax
push 1
push 0
push str.SOFTWAREK7_ComputingCommonInfoAntiVirus
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x42a77a
mov edi, eax
jmp 0x42a7c3
lea eax, [ebp - 0x40c]
push eax
push 0x5885d0
lea eax, [ebp - 0x410]
push eax
push 0
push str.ProductDir
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x42a7b5
cmp dword [ebp - 0x410], 1
mov eax, 0xd
cmovne esi, eax
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, esi
test esi, esi
je 0x42a7e8
push esi
push esi
push str.ConfigIO_Init___:_RegReadValue___for_ProductDir_Failed____u___x
call fcn.00428ad0
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcc56
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004bcc56
mov esp, ebp
pop ebp
ret
Function at 0x42a880
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x42a8e9
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
lea ebx, [eax*2 + 2]
lea eax, [ebp - 4]
push eax
push 0
push 2
push 0
push 0
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityProductsK7TLMConfig
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jne 0x42a8e0
push ebx
push esi
push 1
push eax
push str.ServerToken
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x57
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42aec0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x460
mov eax, dword [0x53d190]
xor eax, esp
mov dword [esp + 0x45c], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x254]
push edi
push esi
push str._s
push 0x208
push eax
call fcn.0042a5a0
add esp, 0x10
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42af28
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42afb7
jmp 0x42afae
lea eax, [esp + 0x34]
push eax
push esi
push str._s_s
lea eax, [esp + 0x264]
push 0x208
push eax
call fcn.0042a5a0
add esp, 0x14
test byte [esp + 8], 0x10
je 0x42af89
push 0x534fc8
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x42af97
push 0x534fcc
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x42af97
lea eax, [esp + 0x258]
push eax
call fcn.0042aec0
add esp, 4
jmp 0x42af97
lea eax, [esp + 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42af28
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov ecx, dword [esp + 0x464]
pop edi
pop esi
xor ecx, esp
call fcn.004bcc56
mov esp, ebp
pop ebp
ret

Function at 0x42b1a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004bd3e0
mov eax, dword [0x53d190]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x100c], ax
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x100c]
call fcn.0042b160
add esp, 0x10
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x535050
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004bcc56
mov esp, ebp
pop ebp
ret
Function at 0x42b270
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0xffffffff
je 0x42b28c
mov eax, 0x10dd
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x42b2b1
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push edi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x42b2b3
xor bl, bl
mov dword [esi + 8], eax
mov byte [esi + 0x10], bl
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
jne 0x42b2e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push str._CreateFileMap__CreateFile__s__failed__error___u
call fcn.0042b1a0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x42b314
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push str._CreateFileMap__GetFileSize__s__failed__error___u
call fcn.0042b1a0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
test eax, eax
jne 0x42b338
push 0x570
push edi
push str._CreateFileMap__empty_file___s_____u
call fcn.0042b1a0
add esp, 0xc
mov eax, 0x570
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push 0
push 0
push 0
push 2
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x42b373
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push str._CreateFileMap__CreateFileMapping__s__failed__error___u
call fcn.0042b1a0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push dword [esi + 4]
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi], eax
test eax, eax
jne 0x42b3aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push str._CreateFileMap__MapViewOfFile__s__failed__error___u
call fcn.0042b1a0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x42c270
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
cmp edx, 0x40
jb 0x42c31a
mov eax, 0x5a4d
cmp ax, word [ecx]
jne 0x42c31a
mov edx, dword [ecx + 0x3c]
add edx, ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + 0x19]
cmp eax, ecx
jae 0x42c31a
cmp dword [edx], 0x4550
jne 0x42c31a
movzx eax, word [edx + 0x18]
lea esi, [edx + 0x18]
mov edi, 0x10b
cmp di, ax
jne 0x42c2cb
movzx edi, word [edx + 0x14]
lea eax, [edi + 0x5f]
add eax, esi
cmp eax, ecx
jae 0x42c31a
mov edx, dword [esi + 0x5c]
mov ecx, 0x80
jmp 0x42c2ea
mov edi, 0x20b
cmp di, ax
jne 0x42c31a
movzx edi, word [edx + 0x14]
lea eax, [edi + 0x6f]
add eax, esi
cmp eax, ecx
jae 0x42c31a
mov edx, dword [esi + 0x6c]
mov ecx, 0x90
mov eax, edi
lea edi, [esi + ecx]
test ax, ax
je 0x42c30c
lea ecx, [edx*8]
movzx eax, ax
cmp ecx, eax
ja 0x42c31a
cmp edx, 4
jbe 0x42c30c
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x40]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
pop ebp
ret
pop edi
mov eax, 0x570
pop esi
pop ebp
ret
Function at 0x433780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, edx
mov ebx, ecx
call fcn.00433990
mov esi, eax
test esi, esi
jne 0x4337a9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4337b9
push ebx
push str.AutoUpdate
push esi
call fcn.00433a10
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4337cc
push eax
push str.ProxyEnabled
push esi
call fcn.00433a10
test edi, edi
je 0x4337dc
push edi
push str.ConnectIdFirst
push esi
call fcn.00433a10
mov eax, dword [ebp + 8]
test eax, eax
je 0x4337ef
push eax
push str.ConnectIdSecond
push esi
call fcn.00433a10
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x433807
push 0x3e8
push eax
push str.UpdtLocalMachineName
push esi
call fcn.00433a60
cmp dword [ebp + 0x10], 0
jne 0x43381d
cmp dword [ebp + 0x14], 0
jne 0x43381d
cmp dword [ebp + 0x18], 0
je 0x43393e
push 0x1d0
call fcn.004bce62
push 0x1d0
mov edi, eax
push 0
push edi
call fcn.004beb60
add esp, 0x10
push 0x1d0
push edi
push str.ProxyInfo
push esi
call fcn.004339c0
cmp eax, 1
jne 0x433930
movd xmm0, dword [edi + 8]
lea ebx, [edi + 8]
lea eax, [edi + 0xc]
pshufd xmm1, xmm0, 0
movd xmm0, dword [edi + 4]
lea ecx, [edi + 4]
pshufd xmm2, xmm0, 0
lea edx, [eax + 0x1c0]
mov dword [ebp - 4], edx
cmp eax, ecx
ja 0x433884
xor edx, edx
cmp dword [ebp - 4], ecx
jae 0x4338eb
cmp eax, ebx
ja 0x433894
lea ecx, [eax + 0x1c0]
xor edx, edx
cmp ecx, ebx
jae 0x4338eb
mov ecx, 7
nop dword [eax]
movups xmm0, xmmword [eax]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax], xmm0
movups xmm0, xmmword [eax + 0x10]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
pxor xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x30], xmm0
add eax, 0x40
sub ecx, 1
jne 0x4338a0
mov edx, 0xffffff90
add edx, 0x71
nop
mov ecx, dword [ebx]
lea eax, [eax + 4]
xor dword [eax - 4], ecx
mov ecx, dword [edi + 4]
xor dword [eax - 4], ecx
sub edx, 1
jne 0x4338f0
lea eax, [edi + 0xc]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [edi + 0x110]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [edi + 0x190]
push eax
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1d0
push edi
call fcn.004bce92
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434710
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x434737
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x434726
pop edi
movzx eax, dl
pop esi
ret
Function at 0x434a20
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x10c
call fcn.004bd3e0
mov eax, dword [0x53d190]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x434abf
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x434abf
lea eax, [esp + 0x118]
push eax
push 0
push dword [esp + 0x11c]
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.0041b340
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004c4942
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
lea ecx, [esp + 4]
push 0
push ecx
test eax, eax
mov ecx, 0x100
cmovs eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004bcc56
add esp, 0x10c
ret
lea eax, [esp + 0x118]
push eax
push 0
push dword [esp + 0x11c]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.0041b340
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004c4942
add esp, 0x1c
mov byte [esp + 0x107], 0
call fcn.004348e0
test eax, eax
jle 0x434b53
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x434b67
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004bcc56
add esp, 0x10c
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
call fcn.004bcc56
add esp, 0x10c
ret
Function at 0x457b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x6c
call fcn.004bd3e0
mov eax, dword [0x53d190]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push ebx
mov dword [esp + 0xc], eax
xor ebx, ebx
mov eax, dword [esp + 0x7c]
push ebp
mov ebp, dword [esp + 0x78]
push esi
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [eax], ebx
lea eax, [esp + 0x1c]
push edi
mov edi, dword [esp + 0x8c]
push eax
call fcn.0043f9c0
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.0043f820
add esp, 0xc
test eax, eax
je 0x457c52
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0043f500
add esp, 0xc
test eax, eax
je 0x457c52
lea eax, [esp + 0x20]
push eax
call fcn.0043f760
mov esi, dword [ebp]
add esp, 4
test byte [esi + 0xc], 4
je 0x457c70
push edi
call fcn.00440d70
push ebx
push edi
mov dword [esp + 0x1c], eax
call fcn.004566e0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x457c52
push esi
call fcn.00459250
add esp, 4
test eax, eax
jle 0x457c52
push dword [ebp]
push ebx
push 1
push 0xf8
push 0xffffffffffffffff
push esi
call fcn.00456490
add esp, 0x18
test eax, eax
jle 0x457c52
push dword [esp + 0x1c]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24]
push esi
call fcn.00459170
add esp, 0x14
test eax, eax
jle 0x457c52
mov ecx, dword [esp + 0x14]
mov ebx, 1
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
push esi
call fcn.00456680
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.004bcc56
add esp, 0x6c
ret
xor eax, eax
lea ecx, [esi + 0x2c]
mov edx, dword [ecx]
test edx, edx
je 0x457c88
cmp dword [edi], edx
je 0x457cb2
inc eax
add ecx, 4
cmp eax, 4
jl 0x457c75
push 0x7b
push str..cryptoevpp_sign.c
push 0x6e
push 0x6b
push 6
call fcn.00438f10
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.004bcc56
add esp, 0x6c
ret
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x457ce6
push 0x80
push str..cryptoevpp_sign.c
push 0x68
push 0x6b
push 6
call fcn.00438f10
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.004bcc56
add esp, 0x6c
ret
push dword [edi + 0x14]
mov ecx, dword [esp + 0x18]
push ecx
push dword [esp + 0x20]
lea ecx, [esp + 0x44]
push dword [esp + 0x28]
push ecx
push dword [esi]
call eax
mov ecx, dword [esp + 0x90]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004bcc56
add esp, 0x6c
ret