joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416188
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
les eax, [ecx + eax*4]
out dx, eax
dec esp
inc byte [eax]
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [edi + 0x32], cl
dec edi
inc esp
dec ebx
xor al, 0x39
inc esp
dec ebp
add esp, 4
pop edi
push esi
add esi, 0x106f4
jmp 0x4160f8
sub esi, 0xef37
pop esi
push ebx
add ebx, 0x57ec
pop ebx
push edi
push ecx
add esp, 4
sub edi, 0x1070f
or edi, 0xfa35
add edi, 0xc40d
xor edi, 0x13958
pop edi
push eax
push edx
add esp, 4
sub eax, 0x97df
pop eax
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push eax
push ebx
add esp, 4
sub eax, 0x14b14
add eax, 0x62a2
pop eax
push edi
add edi, 0x327c
call 0x416188
add byte [ecx + 0x42], al
dec edx
inc ebp
dec edx
inc esp
cmp eax, dword [ebx + 0x575f04c4]
or edi, 0x12c9
pop edi
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x20
mov byte [ebp - 0xbe1], 0x20
mov byte [ebp - 0xbe0], 0x20
mov byte [ebp - 0xbdf], 0x20
mov byte [ebp - 0xbde], 0x5a
push eax
sub eax, 0x154bc
pop eax
push ebx
call 0x4161de
add byte [eax + edx*2 + 0x3d], al
cmp eax, 0x3c483945
inc edx
add esp, 4
pop ebx
push ebx
push ebx
add esp, 4
jmp 0x4161f0
and ebx, 0xcd5f
pop ebx
mov dword [ebp - 0x2084], 0xe
push ebx
sub ebx, 0xb9da
sub ebx, 0xf852
xor ebx, 0xa433
pop ebx
push edx
push ebx
add esp, 4
sub edx, 0x12305

Function at 0x4161de
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
les eax, [ecx + eax*4]
out dx, eax
dec esp
inc byte [eax]
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [edi + 0x32], cl
dec edi
inc esp
dec ebx
xor al, 0x39
inc esp
dec ebp
add esp, 4
pop edi
push esi
add esi, 0x106f4
jmp 0x4160f8
sub esi, 0xef37
pop esi
push ebx
add ebx, 0x57ec
pop ebx
push edi
push ecx
add esp, 4
sub edi, 0x1070f
or edi, 0xfa35
add edi, 0xc40d
xor edi, 0x13958
pop edi
push eax
push edx
add esp, 4
sub eax, 0x97df
pop eax
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push eax
push ebx
add esp, 4
sub eax, 0x14b14
add eax, 0x62a2
pop eax
push edi
add edi, 0x327c
call 0x416188
add byte [ecx + 0x42], al
dec edx
inc ebp
dec edx
inc esp
cmp eax, dword [ebx + 0x575f04c4]
or edi, 0x12c9
pop edi
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x20
mov byte [ebp - 0xbe1], 0x20
mov byte [ebp - 0xbe0], 0x20
mov byte [ebp - 0xbdf], 0x20
mov byte [ebp - 0xbde], 0x5a
push eax
sub eax, 0x154bc
pop eax
push ebx
call 0x4161de
add byte [eax + edx*2 + 0x3d], al
cmp eax, 0x3c483945
inc edx
add esp, 4
pop ebx
push ebx
push ebx
add esp, 4
jmp 0x4161f0
and ebx, 0xcd5f
pop ebx
mov dword [ebp - 0x2084], 0xe
push ebx
sub ebx, 0xb9da
sub ebx, 0xf852
xor ebx, 0xa433
pop ebx
push edx
push ebx
add esp, 4
sub edx, 0x12305
Function at 0x416ad0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
invalid
insb byte es:[edi], dx
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
loopne 0x416ac1
invalid

Function at 0x416ae0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x171e], ax
xor ecx, ecx
mov word [ebp - 0x171c], cx
push ebx
push ecx
add esp, 4
add ebx, 0x18cb
pop ebx
push edi
push edi
add esp, 4
or edi, 0xc88
or edi, 0x112a4
or edi, 0x5c98
pop edi
push ebx
and ebx, 0x22a0
xor ebx, 0x15f70
pop ebx
push edx
jmp 0x416b2a
and edx, 0xa2a8
Function at 0x416e42
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0xc872
pop edx
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x416e78
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x416c2e
mov dword [ebp - 0x318], 0
Function at 0x417220
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x41711f
invalid
Function at 0x4172d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
and ebx, 0x26bf
xor ebx, 0xfcf6
pop ebx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x41730a
mov edx, dword [ebp - 0x508]

Function at 0x417300
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [edx + 0x30], 0
jne 0x4170c0
mov dword [ebp - 0x750], 0
Function at 0x418354
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x314], ecx
jmp 0x4183ce
Function at 0x418480
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test dword [esi - 0x46000018], eax
insb byte es:[edi], dx
add byte [eax], al
add byte [esi - 0x77], ah
lea ecx, [eax - 0x45000018]
insb byte es:[edi], dx
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
mov ch, al
invalid
Function at 0x4187d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp edi, dword [ebx + eax*4]
les eax, [esi + ebx*2]
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x41884c
push edi
add edi, 0xc557
sub edi, 0x1636f
xor edi, 0x16abb
or edi, 0x14f89
pop edi
push esi
push edi
add esp, 4
or esi, 0x706a
sub esi, 0xc338
sub esi, 0xba4
pop esi
cmp dword [ebp - 0x774], 0
jne 0x4188c8
push ebx
push edx
add esp, 4
call 0x418899
add byte [edi], bh
dec esp
cmp edi, dword [ebx]
inc edi
xor edi, dword [eax]
add esp, 4
and ebx, 0xe1ab
or ebx, 0x2a11
jmp 0x4188b0
pop ebx
push edi
xor edi, 0xdd49
pop edi
mov dword [ebp - 0xab0], 0
jmp 0x4193f0
push esi
call 0x4188d8
add byte [esi], dh
inc ecx
inc esi
dec ebp
cmp eax, 0x323f493e
add esp, 4
or esi, 0x1da4
sub esi, 0xf431
pop esi
push eax
push ebx
add esp, 4
add eax, 0x12abd
or eax, 0x12341
pop eax
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x1664], eax
cmp dword [ebp - 0x1664], 0
jne 0x418939
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], ecx
jmp 0x418c2a
mov edx, dword [ebp - 0x1664]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1668], eax
jne 0x418961
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], ecx
jmp 0x418c2a
invalid
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1668]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x166c], edx
cmp dword [ebp - 0x166c], 0
jne 0x418993
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], eax
jmp 0x418c2a
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x166c]
mov dword [ebp - 0x778], ecx
jne 0x4189b8
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], edx
jmp 0x418c2a
mov eax, dword [ebp - 0x778]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x199c], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19a0], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19a4], edx
mov dword [ebp - 0x77c], 0
jmp 0x418a12
Function at 0x4187d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp edi, dword [ebx + eax*4]
les eax, [esi + ebx*2]
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x41884c
push edi
add edi, 0xc557
sub edi, 0x1636f
xor edi, 0x16abb
or edi, 0x14f89
pop edi
push esi
push edi
add esp, 4
or esi, 0x706a
sub esi, 0xc338
sub esi, 0xba4
pop esi
cmp dword [ebp - 0x774], 0
jne 0x4188c8
push ebx
push edx
add esp, 4
call 0x418899
add byte [edi], bh
dec esp
cmp edi, dword [ebx]
inc edi
xor edi, dword [eax]
add esp, 4
and ebx, 0xe1ab
or ebx, 0x2a11
jmp 0x4188b0
pop ebx
push edi
xor edi, 0xdd49
pop edi
mov dword [ebp - 0xab0], 0
jmp 0x4193f0
push esi
call 0x4188d8
add byte [esi], dh
inc ecx
inc esi
dec ebp
cmp eax, 0x323f493e
add esp, 4
or esi, 0x1da4
sub esi, 0xf431
pop esi
push eax
push ebx
add esp, 4
add eax, 0x12abd
or eax, 0x12341
pop eax
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x1664], eax
cmp dword [ebp - 0x1664], 0
jne 0x418939
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], ecx
jmp 0x418c2a
mov edx, dword [ebp - 0x1664]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1668], eax
jne 0x418961
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], ecx
jmp 0x418c2a
invalid
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1668]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x166c], edx
cmp dword [ebp - 0x166c], 0
jne 0x418993
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], eax
jmp 0x418c2a
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x166c]
mov dword [ebp - 0x778], ecx
jne 0x4189b8
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], edx
jmp 0x418c2a
mov eax, dword [ebp - 0x778]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x199c], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19a0], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19a4], edx
mov dword [ebp - 0x77c], 0
jmp 0x418a12
Function at 0x4188d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp edi, dword [ebx + eax*4]
les eax, [esi + ebx*2]
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x41884c
push edi
add edi, 0xc557
sub edi, 0x1636f
xor edi, 0x16abb
or edi, 0x14f89
pop edi
push esi
push edi
add esp, 4
or esi, 0x706a
sub esi, 0xc338
sub esi, 0xba4
pop esi
cmp dword [ebp - 0x774], 0
jne 0x4188c8
push ebx
push edx
add esp, 4
call 0x418899
add byte [edi], bh
dec esp
cmp edi, dword [ebx]
inc edi
xor edi, dword [eax]
add esp, 4
and ebx, 0xe1ab
or ebx, 0x2a11
jmp 0x4188b0
pop ebx
push edi
xor edi, 0xdd49
pop edi
mov dword [ebp - 0xab0], 0
jmp 0x4193f0
push esi
call 0x4188d8
add byte [esi], dh
inc ecx
inc esi
dec ebp
cmp eax, 0x323f493e
add esp, 4
or esi, 0x1da4
sub esi, 0xf431
pop esi
push eax
push ebx
add esp, 4
add eax, 0x12abd
or eax, 0x12341
pop eax
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x1664], eax
cmp dword [ebp - 0x1664], 0
jne 0x418939
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], ecx
jmp 0x418c2a
mov edx, dword [ebp - 0x1664]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1668], eax
jne 0x418961
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], ecx
jmp 0x418c2a
invalid
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1668]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x166c], edx
cmp dword [ebp - 0x166c], 0
jne 0x418993
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], eax
jmp 0x418c2a
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x166c]
mov dword [ebp - 0x778], ecx
jne 0x4189b8
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], edx
jmp 0x418c2a
mov eax, dword [ebp - 0x778]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x199c], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19a0], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19a4], edx
mov dword [ebp - 0x77c], 0
jmp 0x418a12
Function at 0x418b62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x77c]
add eax, 1
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x77c]
cmp edx, dword [ecx + 0x18]
jae 0x418c1e
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x199c]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x780], edx
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a0]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19a4]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19a8], ecx
mov dword [ebp - 0x1a4], 0
jmp 0x418a82
mov edx, dword [ebp - 0x1a4]
add edx, 1
mov dword [ebp - 0x1a4], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x418b34
mov edx, dword [ebp - 0x1a4]
movsx eax, byte [ebp + edx - 0x8a4]
test eax, eax
je 0x418b34
push eax
and eax, 0x109b4
and eax, 0x4f94
pop eax
push edi
push edx
add esp, 4
or edi, 0x15da3
xor edi, 0x8b38
or edi, 0x5232
pop edi
push edi
push eax
add esp, 4
or edi, 0x6e84
pop edi
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a4]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a4]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x418b26
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a4]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a4]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x418b2d
jmp 0x418a73
jmp 0x418b34
push ecx
and ecx, 0xac31
or ecx, 0xcfbd
pop ecx
push ebx
and ebx, 0x15b4e
sub ebx, 0x7cc3
and ebx, 0x184d
call 0x418b62
add byte [edi], bh
cmp dword [edx + 0x38], eax
cmp byte [edi + 0x4d], cl
add esp, 4
pop ebx
mov eax, dword [ebp - 0x780]
invalid
invalid
pop esp
invalid

Function at 0x418fd6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x314], edx
jmp 0x419050
Function at 0x41f8f0
Capabilities:
Encode data using xor

Disassembly:
add al, byte [edx]
add ch, byte [eax - 0x75]
xchg dword [eax - 0x10], esp
add dword [ecx], eax
mov ebx, 0x2020266
push 0xf0628f8b
add dword [ecx], eax
mov esp, 0x202026e
push 0xf064978b
add dword [ecx], eax
mov edx, 0x202026e
push 0xf066878b
add dword [ecx], eax
mov ebx, 0x2020230
push 0xf0688f8b
add dword [ecx], eax
mov esp, 0x2020266
push 0xf06a978b
add dword [ecx], eax
mov edx, 0x202026e
push 0xf06c878b
add dword [ecx], eax
mov ebx, 0x202026e
add al, byte [edx]
push 0xf06e8f8b
add dword [ecx], eax
xor eax, 0x978b68d4
jo 0x41f945
add dword [ecx], eax
push ebx
sub ebx, 0x49
add al, byte [ebx]
add bl, byte [ebx + 0x58]
in eax, dx
or dword [ecx + 0x44], edx
aaa
xor al, 0x48
inc edx
dec edx
xor eax, 0xffffff8d
and byte [edx], al
add ch, dl
or al, byte [edx]
add al, byte [edx]
add bh, byte [eax + eax*2]
cmp al, 0x40
cmp ecx, dword [ecx + 0x4a]
dec esp
cmp eax, 0x6006c685
pop ecx
in eax, dx
pop es
xor eax, 0x3439514f
popal
enter 0xffffffffffffc687, 0xfffffffffffffff6
add dword [ecx], eax
push esp
enter 0xffffffffffffc787, 0xfffffffffffffff6
add dword [ecx], eax
jbe 0x41f960
xchg eax, ecx
test byte [ecx], 1
outsb dx, byte [esi]
enter 0xffffffffffffc987, 0xfffffffffffffff6
add dword [ecx], eax
dec ebx
enter 0xffffffffffffca87, 0xfffffffffffffff6
add dword [ecx], eax
jo 0x41f975
xchg ebx, ecx
test byte [ecx], 1
imul ecx, eax, 0xffffff87
int3

Function at 0x42f9d0
Capabilities:
Encode data using xor

Disassembly:
pop es
add al, byte [edx]
add esp, 0x7c
inc ebp
add eax, dword [edx]
add esp, 0xffffffbc
and al, 3
add bl, byte [edx + edx*2 + 0x55]
test esi, eax
push es
add edx, 0xffffffcf
inc ebx
add al, byte [edx]
pop edx
push ebp
or ebp, 2
xchg esi, eax
add al, byte [edx]
sub ebp, 0xfffffff0
cmp eax, dword [edx]
add bl, byte [ebp - 0x73]
xchg edi, eax
sub dh, dl
add dword [ecx], eax
push 0x8b68048d
xchg dword [eax - 0x72fefe0b], esp
invalid
Function at 0x43a400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push ebx
push eax
push dword [0x52afe8]
xor bl, bl
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43a466
push esi
mov esi, dword [ebp - 8]
push edi
mov edi, dword [ebp + 0x18]
mov eax, dword [edi]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
mov dword [edi], 0
push eax
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
test eax, eax
jne 0x43a45d
mov eax, dword [ebp - 4]
mov dword [edi], eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f612d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x52de04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x14]
xor bl, bl
mov eax, edi
cmp dword [edi + 0x14], 0x10
jb 0x43a4a7
mov eax, dword [edi]
lea ecx, [edi + 0x10]
mov dword [ecx], 0
mov byte [eax], bl
lea eax, [ebp - 0x18]
push eax
push dword [0x52afe8]
mov dword [ebp + 0x14], ecx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43a591
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, eax
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x43a507
cmp eax, 2
jne 0x43a58a
test ecx, ecx
jne 0x43a58a
push ecx
push dword [ebp - 0x10]
mov ecx, edi
call fcn.00441720
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x43a520
mov eax, dword [edi]
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43a58a
cmp dword [edi + 0x14], 0x10
lea ecx, [eax + 1]
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
mov eax, ebx
jb 0x43a556
mov edx, dword [edi]
dec edx
add edx, ebx
sub edx, dword [edi]
mov edi, dword [edi]
jmp 0x43a55d
lea edx, [edi - 1]
add edx, ebx
sub edx, edi
sub eax, edx
cmp eax, 1
cmovb ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [edi + edx]
mov edi, dword [ebp - 0x1c]
sub ebx, edi
mov eax, ebx
sub eax, edx
inc eax
push eax
lea eax, [ecx + edi]
push eax
push ecx
call fcn.004b8680
mov eax, dword [ebp + 0x14]
add esp, 0xc
mov dword [eax], ebx
mov bl, 1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a610
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
push str.Common_AppData
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043a470
add esp, 0x10
cmp dword [esi + 0x10], 0
je 0x43a65f
push 0x13
push str._boost_interprocess
mov ecx, esi
call fcn.00402c50
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
push eax
lea ecx, [ebp - 0x38]
call fcn.0043c440
push 0
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x30]
call fcn.0043c620
push 0x521ce8
lea eax, [ebp - 0x30]
push eax
call fcn.004b8c76
int3

Function at 0x43aa30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 1
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x43aa76
push 0
push 0
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x43aa76
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x43aab3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x5020c8
cmp eax, dword [ecx]
je 0x43aaa7
add ecx, 8
cmp ecx, str.WasatchSoftRIP_
jne 0x43aa92
xor al, al
mov esp, ebp
pop ebp
ret
cmp dword [ecx + 4], 9
je 0x43aab3
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x43e8b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6830
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x52de04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0049c406
mov edi, eax
add esp, 4
test edi, edi
je 0x43e95b
push 1
mov dword [ebp - 4], 0
call fcn.004b5213
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43f160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x24], 0x310030
mov dword [ebp - 0x20], 0x330032
mov dword [ebp - 0x1c], 0x350034
mov dword [ebp - 0x18], 0x370036
mov dword [ebp - 0x14], 0x390038
mov dword [ebp - 0x10], 0x420041
mov dword [ebp - 0xc], 0x440043
mov dword [ebp - 8], 0x460045
test edi, edi
je 0x43f1e9
push esi
mov esi, dword [ebp + 8]
nop dword [eax]
movzx ecx, byte [edx + esi]
lea eax, [eax + 4]
shr ecx, 4
movzx ecx, word [ebp + ecx*2 - 0x24]
mov word [eax - 4], cx
movsx ecx, byte [edx + esi]
inc edx
and ecx, 0xf
movzx ecx, word [ebp + ecx*2 - 0x24]
mov word [eax - 2], cx
cmp edx, edi
jne 0x43f1c0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004b3f28
mov esp, ebp
pop ebp
ret