joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010f4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
push 0x40ea74
lea eax, [ebp - 4]
xor edi, edi
push 0x411b68
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call fcn.00401b52
xor ecx, ecx
cmp eax, edi
sete cl
push str.Failed_to_open_executable
push ecx
call fcn.00401059
push 2
push edi
push dword [ebp - 4]
call fcn.00402a95
push dword [ebp - 4]
call fcn.004029a6
cdq
mov dword [ebp - 0x18], eax
add eax, 0xfffffefc
add esp, 0x24
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], eax
cmp eax, edi
jge 0x401155
mov dword [ebp - 8], edi
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00402a95
push dword [ebp - 4]
push 0x104
push 1
push ebx
call fcn.004026c2
push ebx
mov esi, eax
call fcn.004010b2
add esp, 0x20
cmp eax, edi
je 0x401197
mov esi, eax
sub eax, ebx
add eax, dword [ebp - 8]
push 5
cdq
pop ecx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], eax
mov esi, edx
jmp 0x401215
mov esi, 0x4100000
push esi
call fcn.0040212f
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
add eax, 0xfbf00000
pop ecx
mov dword [ebp - 8], eax
cmp eax, edi
jge 0x4011b8
mov dword [ebp - 8], edi
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00402a95
push dword [ebp - 4]
push esi
push 1
push dword [ebp - 0xc]
call fcn.004026c2
push dword [ebp - 0xc]
mov esi, eax
call fcn.004010b2
mov esi, eax
xor eax, eax
cmp esi, edi
setne al
push str.Unable_to_find_an_appended_archive.
mov dword [ebp - 0x14], esi
push eax
call fcn.00401059
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
push 5
add eax, dword [ebp - 8]
pop ecx
push dword [ebp - 0xc]
cdq
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], eax
mov esi, edx
call fcn.00401eab
add esp, 0x2c
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x20]
push 0
sub dword [ebp - 0x18], ecx
push dword [ebp - 0x18]
push dword [ebp - 4]
sbb esi, 0
call fcn.00402a95
push dword [ebp - 4]
mov edi, 0x104
push edi
push 1
push ebx
call fcn.004026c2
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
mov esi, str.Unable_to_read_from_file
neg eax
push esi
push eax
call fcn.00401059
mov cx, word [ebx]
mov eax, 0x40ead8
add esp, 0x24
cmp cx, word [eax]
jne 0x401268
mov dword [ebp - 0x10], ebx
jmp 0x4012bc
mov eax, dword [ebp - 0x18]
add eax, 0xfffffefc
jns 0x401274
xor eax, eax
push 0
push eax
push dword [ebp - 4]
call fcn.00402a95
push dword [ebp - 4]
push edi
push 1
push ebx
call fcn.004026c2
mov edi, eax
xor eax, eax
cmp eax, edi
sbb eax, eax
neg eax
push esi
push eax
call fcn.00401059
add esp, 0x24
lea eax, [edi + ebx - 1]
jmp 0x4012b3
mov dx, word [eax]
mov ecx, 0x40ead8
cmp dx, word [ecx]
je 0x4012b9
dec eax
cmp eax, ebx
jae 0x4012a5
jmp 0x4012bc
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call fcn.00402d53
mov eax, dword [ebp - 0x10]
pop ecx
pop edi
pop esi
leave
ret
Function at 0x42fce0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1e000]
push edi
or ebp, 0xffffffff
jmp 0x42fd02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42fd09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42fcf8
mov eax, 1
add ebx, ebx
jne 0x42fd1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42fd10
jne 0x42fd2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fd10
xor ecx, ecx
sub eax, 3
jb 0x42fd40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42fdb2
mov ebp, eax
add ebx, ebx
jne 0x42fd4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42fd58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42fd7c
inc ecx
add ebx, ebx
jne 0x42fd68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42fd5d
jne 0x42fd79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fd5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42fd9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42fd8d
jmp 0x42fcfe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42fd9c
add edi, ecx
jmp 0x42fcfe
pop esi
lea edi, [esi + 0x2d000]
mov eax, dword [edi]
or eax, eax
je 0x42fdfb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x34d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x34df0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42fdb9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x34df4]
or eax, eax
je 0x42fdf5
mov dword [ebx], eax
add ebx, 4
jmp 0x42fdd6
call dword [esi + 0x34e04]
mov ebp, dword [esi + 0x34df8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42fe2f
sub esp, 0xffffff80
jmp 0x404eb1

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402062
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x40210d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40210d
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x14]
and dword [edi], 0
push edi
push 0x42c588
push 1
push 0
push 0x42c5a8
call fcn.0040c1ae
test eax, eax
js 0x402112
mov ecx, dword [edi]
lea eax, [ebx + 0x10]
push eax
push 0x42ce68
push ecx
mov edx, dword [ecx]
call dword [edx]
test eax, eax
js 0x402112
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x194]
cmp eax, 1
jne 0x4020d1
mov eax, 0x80004005
jmp 0x402112
test eax, eax
js 0x402112
mov eax, dword [edi]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xb8]
cmp eax, 1
jne 0x4020f1
lea eax, [ebx - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
jmp 0x4020ca
test eax, eax
js 0x402112
mov ecx, dword [0x436d14]
test ecx, ecx
je 0x402109
push esi
lea eax, [ebx - 4]
push eax
call fcn.004016c8
xor eax, eax
jmp 0x402112
mov eax, 0x80070057
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x403741
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x421c
call fcn.00426153
mov eax, dword [0x4306e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor bh, bh
mov byte [ebp - 0x4215], 0
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x40379a
push 0xb
push 0x42c8c4
push esi
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x403796
push 0xb
push str._Embedding
push esi
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x40379a
mov bl, 1
jmp 0x40379c
xor bl, bl
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x4038b4
mov bh, 1
test bl, bl
je 0x4037bf
call fcn.00405134
test eax, eax
js 0x4038e3
push 0
call fcn.0040a680
pop ecx
mov byte [ebp - 0x4215], 1
call fcn.00423968
mov dword [0x436d4c], edi
test bl, bl
je 0x4037e7
call fcn.00402f45
jmp 0x4038b4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0xa
push 0x104
movzx esi, ax
lea ecx, [ebp - 0x20c]
mov eax, esi
push ecx
push eax
mov dword [ebp - 0x421c], eax
call fcn.0040359f
mov eax, 0x409
cmp si, ax
je 0x403832
push 0xffffffffffffffff
push str._1033
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
push str.vviewres.dll
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00403016
mov edi, eax
test edi, edi
je 0x4038a0
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x2210]
push 0x1001
push eax
push 0x8062
push edi
call esi
push 0x1001
lea eax, [ebp - 0x4214]
push eax
push 0x8063
push edi
call esi
push dword [ebp - 0x421c]
call fcn.00402c71
xor ecx, ecx
mov edx, 0x180000
test eax, eax
lea eax, [ebp - 0x2210]
cmovne ecx, edx
push ecx
push eax
lea eax, [ebp - 0x4214]
push eax
jmp 0x4038ac
push 0
push str.Microsoft_Office
push str.This_program_can_only_run_from_within_another_program.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.004016df
call fcn.00402121
test eax, eax
je 0x4038cb
push 1
mov ecx, eax
call fcn.004028e2
cmp byte [ebp - 0x4215], 0
je 0x4038d9
call fcn.0040a778
test bh, bh
je 0x4038e3
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425743
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406500
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a2b0
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4306e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, 0x104
lea eax, [ebp - 0x21c]
push esi
push eax
push str.LORI_099F5E083DF84BC98E90139DFB45C0B9
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x406554
mov al, 1
jmp 0x4065f0
cmp eax, esi
jae 0x4065ee
xor esi, esi
mov dword [ebp - 0x220], esi
push 1
mov dword [ebp - 4], esi
push 8
mov byte [ebp - 4], 1
call fcn.004060f8
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x40658b
mov ecx, eax
call fcn.00405c93
mov esi, eax
test esi, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], esi
sete al
test al, al
je 0x4065ac
xor ecx, ecx
mov dword [0], 1
int 0x29
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, esi
call fcn.0040641b
mov dword [0x436d98], esi
jmp 0x40654d
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00425743
mov esp, ebp
pop ebp
ret
Function at 0x40772d
Capabilities:
Read file on windows

Disassembly:
push 4
mov eax, 0x42a3b7
call fcn.00425b4e
mov ebx, ecx
cmp byte [ebx + 0x21], 0
jne 0x4077e1
cmp dword [ebp + 8], 0x10
jne 0x407856
mov eax, dword [ebx + 0x80]
cmp eax, 0x10
jb 0x407856
lea esi, [ebx + 0x24]
push eax
mov ecx, esi
call fcn.004071fe
cmp dword [esi], 0
jne 0x407773
call fcn.00427838
push dword [ebp + 8]
lea eax, [ebx + 0x74]
push eax
push dword [ebx + 0x80]
push dword [esi]
call fcn.00407aef
mov edx, dword [ebx + 0x80]
add esp, 0x10
cmp edx, dword [ebp + 8]
je 0x4077e1
push 5
pop ecx
lea eax, [ebx + 0x28]
mov esi, 0x42cdc4
push eax
mov edi, eax
lea eax, [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x24]
push eax
lea eax, [edx - 0x10]
mov word [ebx + 0x20], 0x101
push eax
lea eax, [ecx + 0x10]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407856
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x407856
mov byte [ebx + 0x20], 0
call fcn.00427812
lea edi, [ebx + 0x24]
mov ecx, edi
call fcn.00404042
test dword [eax + 4], 0x2000000
je 0x40785e
mov ecx, edi
call fcn.00404042
push 1
mov eax, dword [eax + 0xc]
push eax
call fcn.004060f8
mov edi, dword [edi]
lea ecx, [ebx + 0x24]
mov esi, eax
mov dword [ebp - 0x10], esi
call fcn.00404042
push dword [eax + 0xc]
push edi
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.004078e6
cmp dword [ebp - 0x10], 0
je 0x40783c
push dword [ebp - 0x10]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
lea edi, [ebx + 0x24]
mov eax, dword [edi]
test eax, eax
je 0x40784f
and dword [edi], 0
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
mov ecx, ebx
call fcn.0040790f
call fcn.00425b1f
ret 4
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x7c]
mov ecx, ebx
call fcn.00407423
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x4078b9
mov ecx, edi
call fcn.00404042
test byte [eax + 7], 1
je 0x40789c
mov ecx, edi
call fcn.00404042
mov ecx, dword [eax]
test ecx, ecx
js 0x4078b1
mov ecx, 0x8007000d
jmp 0x4078b1
mov ecx, dword [esi + 8]
push edi
mov eax, dword [ecx]
call dword [eax + 0xc]
xor ecx, ecx
mov edx, 0x8007000d
test al, al
cmove ecx, edx
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xc]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x40783f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x40783f
Function at 0x407963
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x42a3da
call fcn.00425b4e
mov ebx, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push 1
mov eax, dword [esi + 8]
mov edi, dword [eax + 8]
lea eax, [ebx + 0x58]
push eax
mov dword [ebp + 8], edi
call fcn.00406f44
mov eax, dword [ebx + 0x70]
lea ecx, [ebx + 0x3c]
and dword [ebp - 4], 0
mov dword [edi + 8], eax
inc dword [ebx + 0x70]
push dword [edi + 8]
call fcn.00427e17
push esi
mov ecx, eax
call fcn.00406edd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040708a
push 5
pop ecx
lea eax, [esi + 0xc]
mov esi, 0x42cdc4
push eax
mov edi, eax
mov eax, dword [ebp + 8]
push 0
rep movsd dword es:[edi], dword [esi]
push dword [eax + 0xc]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4079ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4079ef
call fcn.00427812
call fcn.00425b1f
ret 4

Function at 0x40905b
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x42a472
call fcn.00425b4e
mov esi, dword [ebp + 8]
test esi, esi
jne 0x409075
xor al, al
jmp 0x409146
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x409086
xor ecx, ecx
cmp dword [0x4373c4], ecx
jmp 0x409090
push esi
call fcn.00408e6e
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x40906e
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.004082af
xor ecx, ecx
mov dword [ebp - 4], edi
push 2
test bl, bl
pop eax
cmovne ecx, eax
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 0x14], ecx
or eax, ecx
jmp 0x40911a
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x4090d0
mov eax, dword [ebx]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push edi
call fcn.00408e98
push ebx
test eax, eax
je 0x409134
mov eax, dword [esi + 0xc]
xor edi, edi
mov ecx, 0x4370b0
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x4360e0], edi
call fcn.00408d65
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp + 8], edi
or eax, dword [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc]
call fcn.00408350
mov edi, eax
test edi, edi
je 0x4090c4
jmp 0x409139
call fcn.004097fd
lea ecx, [ebp + 0xf]
call fcn.004082da
test edi, edi
sete al
call fcn.00425b1f
ret 8
Function at 0x409345
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x40936b
cmp dword [0x4373c4], edi
je 0x40945c
push 2
pop esi
jmp 0x409384
cmp edi, 1
jne 0x40945c
push ebx
call fcn.00408e6e
test al, al
je 0x40945c
xor esi, esi
lea ecx, [ebp + 0xb]
mov dword [ebp - 0xc], esi
call fcn.004082af
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
push eax
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
or eax, esi
jmp 0x40940b
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4093b9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push esi
call fcn.00408e98
push dword [ebp - 4]
test eax, eax
je 0x409424
mov eax, dword [ebx + 0xc]
xor esi, esi
mov ecx, 0x4370b0
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x4360e0], esi
call fcn.00408d65
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 4], esi
or eax, dword [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0xc]
call fcn.00408350
mov esi, eax
test esi, esi
je 0x4093a5
jmp 0x409454
call fcn.004097fd
test esi, esi
jne 0x409454
movzx ecx, word [ebx + 0x10]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x10], eax
je 0x409471
cmp dword [ebp - 0x10], 3
jne 0x409451
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x409451
and cl, 0xf
cmp cl, 4
je 0x409471
push 2
pop esi
lea ecx, [ebp + 0xb]
call fcn.004082da
inc edi
cmp edi, 2
jl 0x409353
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp + 0xb]
mov dword [eax], 1
call fcn.004082da
xor eax, eax
jmp 0x409468
Function at 0x40bbb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x4376c4], 0
je 0x40bbcc
mov eax, dword [0x4376c8]
jmp 0x40bc9c
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bc1b
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x4376c8
push esi
push esi
push dword [0x4361d0]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40bc1b
cmp dword [ebp - 8], 4
je 0x40bc75
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
test eax, eax
je 0x40bc2c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bc7d
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x4376c8
push esi
push esi
push dword [0x4361d0]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40bc7d
cmp dword [ebp - 8], 4
jne 0x40bc7d
mov esi, dword [0x4376c8]
jmp 0x40bc83
mov dword [0x4376c8], esi
cmp dword [ebp - 4], 0
mov byte [0x4376c4], 1
je 0x40bc99
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40bca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x42d6c8
push Ordinal_1
mov dword [ebp - 8], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40bd32
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x20019
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40bd28
push 4
pop edi
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push str.InsecureQI
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40bd28
cmp dword [ebp + 8], edi
jne 0x40bd28
mov edi, dword [ebp - 0xc]
cmp edi, 3
ja 0x40bd28
cmp dword [ebp - 4], ebx
je 0x40bd34
push dword [ebp - 4]
call esi
jmp 0x40bd34
cmp dword [ebp - 4], ebx
je 0x40bd32
push dword [ebp - 4]
call esi
mov edi, ebx
cmp dword [ebp - 8], ebx
je 0x40bd3e
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d6e2
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
test byte [0x437700], 0x20
push esi
push edi
mov esi, ecx
je 0x40d723
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x42da68
push dword [0x43770c]
push dword [0x437708]
call fcn.00410429
push 0x1c135e
call fcn.00407d98
lea eax, [esi + 8]
mov ecx, dword [eax]
mov esi, ecx
mov edi, dword [eax + 4]
mov edx, edi
mov dword [ebp - 4], eax
mov eax, ecx
shr eax, 0xc
dec eax
mov dword [ebp - 0x10], esi
shl eax, 0xc
xor eax, ecx
and eax, 0x7f000
xor ecx, eax
mov eax, esi
mov esi, dword [ebp - 4]
push ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x10]
jne 0x40d76b
cmp ecx, edi
je 0x40d79b
mov esi, eax
mov dword [ebp - 0x10], ecx
shr esi, 0xc
mov edi, eax
dec esi
mov edx, ecx
shl esi, 0xc
xor esi, eax
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
mov esi, dword [ebp - 4]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, edi
jne 0x40d76b
cmp ecx, dword [ebp - 0x10]
jne 0x40d76b
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x40eccc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x20], ebx
jne 0x40ece7
mov eax, 0x80004005
jmp 0x40eeb7
cmp byte [esi + 0x180], bl
je 0x40ecf6
xor eax, eax
jmp 0x40eeb7
mov ecx, dword [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
call fcn.00429755
test al, al
jne 0x40ed23
mov eax, dword [esi]
push esi
call dword [eax + 0x30]
test eax, eax
je 0x40ed23
push 0x1c1417
call fcn.00407d98
push edi
call fcn.00423b3e
test al, al
jne 0x40eda5
push 0x2710
lea ecx, [esi + 0x38]
call fcn.00410a7f
test eax, eax
je 0x40eda5
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x40ed80
sub eax, 1
je 0x40ed9b
sub eax, 1
je 0x40ed80
sub eax, 1
je 0x40ed68
push 0x1c1418
call fcn.00407d98
jmp 0x40ed76
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x80004005
jmp 0x40eeb6
or ecx, 0xffffffff
mov eax, 0x4e20
cmp dword [ebp + 8], ebx
cmove eax, ecx
lea ecx, [esi + 0x38]
push eax
call fcn.00410a7f
test eax, eax
je 0x40eda5
mov eax, 0x80004004
jmp 0x40eeb6
mov ecx, dword [esi + 0x24]
mov byte [esi + 0x180], 1
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edi, [esi + 0x124]
cmp dword [edi + 8], ebx
je 0x40ede7
cmp dword [edi], ebx
je 0x40ede7
jmp 0x40edd8
mov ecx, dword [ebp - 8]
push 1
mov eax, dword [ecx]
call dword [eax + 0x7c]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.00429832
test al, al
jne 0x40edc5
push 0x42df68
lea eax, [esi + 0x10]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 4]
call fcn.0040cf1b
test eax, eax
js 0x40ee0b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40ee1b
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40ee27
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x40ee33
call fcn.004154a5
lea edi, [esi + 0x7c]
cmp dword [edi + 8], ebx
je 0x40ee62
cmp dword [edi], ebx
je 0x40ee62
jmp 0x40ee53
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.00429832
test al, al
jne 0x40ee41
lea edi, [esi + 0xd0]
cmp dword [edi + 8], ebx
je 0x40ee8b
cmp dword [edi], ebx
je 0x40ee8b
jmp 0x40ee7c
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00429832
test al, al
jne 0x40ee73
cmp dword [esi + 0x17c], ebx
je 0x40eeb4
call fcn.00429755
test al, al
je 0x40eeaa
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [esi + 0x17c], ebx
jmp 0x40eeb4
push 0x1c141d
call fcn.00407d98
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4