joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da25b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x51cbc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x234], esi
cmp edi, 0x23
je 0x4094b8
cmp edi, 0x1a
je 0x4094b8
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
mov ecx, esi
push 0x4ef6f8
mov word [esi], ax
call fcn.00417870
jmp 0x409592
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x409493
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409510
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00417870
push 0x11
push 0x4f0408
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0
call fcn.004175a0
cmp byte [ebp + 0x10], 0
lea eax, [ebp - 0x230]
push eax
jne 0x409561
mov ecx, esi
call fcn.00406080
jmp 0x409587
call fcn.0041fe10
add esp, 4
mov ecx, esi
test al, al
je 0x40957d
lea eax, [ebp - 0x230]
push eax
call fcn.00406080
jmp 0x409587
push 0x4ef6f8
call fcn.004062c0
lea ecx, [ebp - 0x230]
call fcn.00406fe0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d55dc
mov esp, ebp
pop ebp
ret
Function at 0x409a80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push edi
test ecx, ecx
je 0x409c0a
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x409c0a
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x409c0a
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x409c0a
push esi
xor esi, esi
cmp edi, 2
jbe 0x409b5a
mov dword [ebp - 8], 4
mov dh, byte [ecx]
sub edi, 3
mov dl, byte [ecx + 1]
mov bl, dh
mov ah, byte [ecx + 2]
mov al, dl
and bl, 3
shr al, 4
shl bl, 4
and dl, 0xf
add bl, al
shl dl, 2
mov al, ah
mov byte [ebp - 1], ah
shr al, 6
add ecx, 3
add dl, al
mov dword [ebp + 8], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
ja 0x409bf1
mov ecx, dword [ebp + 0x10]
movzx eax, dh
shr eax, 2
mov al, byte [eax + 0x4f0080]
mov byte [esi + ecx], al
movzx eax, bl
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov al, byte [eax + 0x4f0080]
mov byte [esi + ebx + 1], al
movzx eax, dl
mov al, byte [eax + 0x4f0080]
mov byte [esi + ebx + 2], al
movzx eax, byte [ebp - 1]
and eax, 0x3f
mov al, byte [eax + 0x4f0080]
mov byte [esi + ebx + 3], al
add esi, 4
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
cmp edi, 2
ja 0x409ac7
test edi, edi
je 0x409bec
xor dh, dh
mov word [ebp + 9], 0
xor ah, ah
mov byte [ebp + 8], dh
xor dl, dl
test edi, edi
je 0x409b8c
push edi
push ecx
lea eax, [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
mov ah, byte [ebp + 0xa]
add esp, 0xc
mov dl, byte [ebp + 9]
mov dh, byte [ebp + 8]
mov al, dl
shr ah, 6
mov cl, dh
shr al, 4
and dh, 3
shr cl, 2
and dl, 0xf
shl dh, 4
shl dl, 2
add dh, al
add dl, ah
lea eax, [esi + 4]
cmp eax, dword [ebp + 0x14]
ja 0x409bf1
movzx eax, cl
mov al, byte [eax + 0x4f0080]
mov byte [esi + ebx], al
movzx eax, dh
mov al, byte [eax + 0x4f0080]
mov byte [esi + ebx + 1], al
add esi, 2
lea ecx, [esi + ebx]
cmp edi, 1
jne 0x409bd9
mov al, 0x3d
jmp 0x409be2
movzx eax, dl
mov al, byte [eax + 0x4f0080]
mov byte [ecx], al
mov byte [esi + ebx + 1], 0x3d
add esi, 2
cmp esi, dword [ebp + 0x14]
jb 0x409bfd
pop esi
pop edi
mov eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + ebx], 0
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a260
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da35b
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x51cbc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 4], 0
mov edi, dword [ebp + 0xc]
je 0x40a3ae
cmp dword [ebp + 8], 0
je 0x40a3ae
test edi, edi
je 0x40a3ae
push 0x118
lea eax, [ebp - 0x128]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a343
cmp dword [ebp - 0x128], 6
ja 0x40a343
jne 0x40a2f3
cmp dword [ebp - 0x124], 1
jae 0x40a343
mov eax, 0x17
mov dword [ebp - 0x138], 0xb
mov word [ebp - 0x140], ax
lea edx, [ebp - 0x140]
mov eax, dword [esi + 8]
push edx
push 3
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, 0xb
lea edx, [ebp - 0x150]
mov word [ebp - 0x150], ax
or eax, 0xffffffff
mov word [ebp - 0x148], ax
mov eax, dword [esi + 8]
push edx
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov dword [ebp - 0x130], 0
mov eax, dword [esi + 8]
lea edx, [ebp - 0x130]
push 0
push edx
push eax
mov ecx, dword [eax]
mov dword [ebp - 4], 0
call dword [ecx + 0x58]
test eax, eax
js 0x40a391
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x40a397
push dword [ebp + 0x10]
mov ecx, dword [eax]
push edi
push 3
push eax
call dword [ecx + 0x18]
test eax, eax
je 0x40a391
mov eax, dword [ebp - 0x130]
mov esi, 1
jmp 0x40a399
mov eax, dword [ebp - 0x130]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x40a3aa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x40a3b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d55dc
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40af20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x51cbc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
mov dword [ebp - 0x214], esi
push 0
push eax
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x214], 0x104
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
test eax, eax
je 0x40afb1
xor eax, eax
mov word [esi], ax
push 0
push 0x4ef6f8
jmp 0x40afe7
xor eax, eax
cmp dword [ebp - 0x210], 1
mov word [esi], ax
jne 0x40afa8
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
jmp 0x40afd0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40afd0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00417870
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d55dc
mov esp, ebp
pop ebp
ret
Function at 0x410c76
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov word [ebp - 0x1790], ax
mov ecx, 0x65
mov word [ebp - 0x178e], cx
mov edx, 0x72
mov word [ebp - 0x178c], dx
mov eax, 0x6e
mov word [ebp - 0x178a], ax
mov ecx, 0x65
mov word [ebp - 0x1788], cx
mov edx, 0x6c
mov word [ebp - 0x1786], dx
mov eax, 0x33
mov word [ebp - 0x1784], ax
mov ecx, 0x32
mov word [ebp - 0x1782], cx
mov edx, 0x2e
mov word [ebp - 0x1780], dx
mov eax, 0x64
mov word [ebp - 0x177e], ax
mov ecx, 0x6c
mov word [ebp - 0x177c], cx
mov edx, 0x6c
mov word [ebp - 0x177a], dx
xor eax, eax
mov word [ebp - 0x1778], ax
push eax
xor eax, 0x139b7
sub eax, 0x2082
pop eax
push eax
push eax
add esp, 4
call 0x410c76
add byte [ebx + 0x3a], cl
inc edi
cmp eax, 0x473c3a4c
inc edx
add esp, 4
and eax, 0x1558a
and eax, 0x164b2
pop eax
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x6f
mov byte [ebp - 0x8a2], 0x61
mov byte [ebp - 0x8a1], 0x64
mov byte [ebp - 0x8a0], 0x4c
mov byte [ebp - 0x89f], 0x69
mov byte [ebp - 0x89e], 0x62
mov byte [ebp - 0x89d], 0x72
mov byte [ebp - 0x89c], 0x61
mov byte [ebp - 0x89b], 0x72
mov byte [ebp - 0x89a], 0x79
mov byte [ebp - 0x899], 0x57
mov byte [ebp - 0x898], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x199c], ecx
mov edx, dword [ebp - 0x199c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19a0], eax
mov ecx, dword [ebp - 0x19a0]
mov dword [ebp - 0x1620], ecx
push esi
push edi
add esp, 4
call 0x410d1a
add byte [edx + 0x3c], al
inc esi
dec edi
dec edx
cmp al, byte [ebx - 0x317efb3c]
hlt
Function at 0x411867
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x233
sub edi, 0x2f9c
pop edi
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push esi
push edi
add esp, 4
xor esi, 0x51b1
call 0x411856
add byte [ecx + 0x3a], cl
inc edx
cmp eax, 0xc483373b
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x49], al
dec eax
cmp byte [eax + 0x46], al
cmp al, 0x3b
add esp, 4
add esi, 0xf568
pop esi
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x4118a1
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x411b92
mov edx, dword [ebp - 0x1688]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x168c], eax
jne 0x4118c9
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x411b92
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x168c]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1690], edx
cmp dword [ebp - 0x1690], 0
jne 0x4118fb
mov eax, dword [ebp - 0x794]
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x1690]
mov dword [ebp - 0x788], ecx
jne 0x411920
mov edx, dword [ebp - 0x794]
mov dword [ebp - 0x520], edx
jmp 0x411b92
mov eax, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19c4], ecx
mov edx, dword [ebp - 0x788]
invalid
test eax, ecx
cld
invalid

Function at 0x420c20
Capabilities:
Encode data using xor

Disassembly:
add al, byte [edx]
add ch, byte [eax - 0x75]
xchg dword [ecx + ebp*8 + 1], ebp
add dword [ebx + 0x202026e], edi
push 0xe96e8f8b
add dword [ecx], eax
mov esp, 0x202026e
push 0xe970978b
jmp 0xc2770d46
push 0xe972878b
outsb dx, byte [esi]
jmp 0x6efe0d3a
add dword [ecx], eax
push ebx
push ebx
test esi, eax
push es
and ebx, 0x6a
rol dword [edx], 2
add al, byte [edx]
pop ebx
pop eax
xor eax, 0xffffffab
dec esi
add eax, dword [edx]
pushal
push esp
push edx
test esi, eax
push es
add esp, 0xffffffdb
in eax, dx
add al, byte [edx]
sub esp, 0x48
aas
add eax, dword [edx]
add esp, 0xffffff88
add eax, dword fs:[edx]
or esp, 0xfffffffe
rol byte [edx], cl
add bl, byte [eax + ecx*8 - 0x79]
mov esi, 0x4e0101f8
enter 0xffffffffffffbf87, 0xfffffffffffffff8
add dword [ecx], eax
jno 0x420c55
xchg eax, eax
clc
add dword [ecx], eax
arpl ax, cx
xchg ecx, eax
clc
add dword [ecx], eax
enter 0xffffffffffffc287, 0xfffffffffffffff8
add dword [ecx], eax
dec esi
enter 0xffffffffffffc387, 0xfffffffffffffff8
add dword [ecx], eax
imul ecx, eax, 0xffffff87
invalid
Function at 0x436960
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dca9b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x51cbc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
lea ecx, [edi + 0x18]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [esi + 0x18]
push eax
call fcn.004060d0
lea eax, [esi + 0x30]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x30]
call fcn.004060d0
movzx eax, byte [esi + 0x48]
mov byte [edi + 0x48], al
movzx eax, byte [esi + 0x49]
mov byte [edi + 0x49], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x438870
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcf19
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x51cbc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CSiteHelper.0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046f000
mov dword [esi], eax
lea esi, [edi + 0x18]
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046f000
mov dword [esi], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
push 0x43cd30
push 0x438840
push 2
push 8
lea eax, [edi + 0x40]
mov byte [ebp - 4], 5
push eax
call fcn.004a97f0
push fcn.0043bbe0
push 0x437c70
push 2
push 0xc
lea eax, [edi + 0x50]
mov byte [ebp - 4], 6
push eax
call fcn.004a97f0
lea esi, [edi + 0x68]
mov byte [ebp - 4], 7
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046ef60
mov dword [esi], eax
lea esi, [edi + 0x70]
mov byte [ebp - 4], 8
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046ef60
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x438fc0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd013
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51cbc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00405e90
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x18]
call fcn.00405e90
mov eax, dword [esi + 0x30]
lea ecx, [edi + 0x40]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov al, byte [esi + 0x3c]
mov byte [edi + 0x3c], al
lea eax, [esi + 0x40]
push eax
mov byte [ebp - 4], 1
call fcn.00405e90
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x441370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd840
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x51cbc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 0x58]
push esi
mov dword [ebp - 0x30], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x50]
mov edx, dword [ebx + 0x30]
mov dword [ebp - 4], 0
mov eax, dword [ecx + 4]
cmp byte [eax + 0xd], 0
jne 0x44147a
cmp dword [eax + 0x10], edx
jae 0x4413d1
mov eax, dword [eax + 8]
jmp 0x4413d5
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x4413c7
cmp ecx, dword [edi + 0x50]
je 0x44147a
cmp edx, dword [ecx + 0x10]
jb 0x44147a
mov eax, dword [ebx + 0x38]
cmp eax, 6
je 0x4414a3
cmp eax, 7
je 0x4414a3
cmp eax, 0x23
je 0x4414a3
test eax, eax
jne 0x44146e
cmp dword [edi + 0x80], 0xffffffff
je 0x44146e
cmp dword [edi + 0x84], eax
je 0x44146e
mov ecx, dword [edi + 0x78]
mov eax, 0x6bca1af3
sub ecx, dword [edi + 0x74]
imul ecx
mov ecx, dword [edi + 0x80]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jge 0x44146e
mov eax, dword [edi + 0x84]
imul ecx, ecx, 0x4c
cmp eax, 1
mov dword [edi + 0x100], eax
mov eax, dword [edi + 0x74]
jne 0x44145d
add eax, 0x1c
jmp 0x441460
add eax, 0x34
add eax, ecx
lea ecx, [edi + 0xe8]
push eax
call fcn.0043e8e0
push 0
push dword [ebx + 0x30]
mov ecx, edi
call fcn.00464830
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d55dc
mov esp, ebp
pop ebp
ret 4
lea ecx, [edi + 0x90]
cmp ecx, ebx
je 0x4414c6
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
jb 0x4414b7
mov eax, dword [ebx]
push dword [ebx + 0x10]
push eax
call fcn.00417770
lea ecx, [edi + 0x90]
lea edx, [ecx + 0x18]
lea eax, [ebx + 0x18]
mov dword [ebp - 0x2c], edx
cmp edx, eax
je 0x4414ef
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x4414dd
mov edx, dword [eax]
push dword [eax + 0x10]
mov ecx, dword [ebp - 0x2c]
push edx
call fcn.00417770
lea ecx, [edi + 0x90]
mov eax, dword [ebx + 0x30]
mov dword [ecx + 0x30], eax
mov eax, dword [ebx + 0x34]
mov dword [ecx + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [ecx + 0x38], eax
mov al, byte [ebx + 0x3c]
mov byte [ecx + 0x3c], al
lea eax, [ebx + 0x40]
add ecx, 0x40
cmp ecx, eax
je 0x441524
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x44151b
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00417770
lea eax, [edi + 0xd0]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405e90
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push dword [ebx + 0x30]
mov ecx, edi
call fcn.00444ad0
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.00406f90
jmp 0x44147c
Function at 0x4428c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd9d8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x51cbc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 8], 0
mov esi, str.Lic2
jne 0x4428f3
mov esi, 0x4f7750
lea ecx, [ebp + 8]
call fcn.00405a60
push str.UserProfile
push str.software360TotalSecurity
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push str._s_s
push eax
call fcn.00448a40
add esp, 0x10
push esi
mov esi, dword [ebp + 8]
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44294c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x444ad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dddb0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x51cbc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
xor bh, bh
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bh
mov dword [ebp - 0x14], 0
push edi
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
call fcn.0044eb00
test al, al
jne 0x444b5c
cmp dword [esi + 0x84], 1
jne 0x444c8a
push edi
lea eax, [ebp - 0x2c]
mov dword [esi + 0x84], 2
push eax
mov ecx, esi
mov dword [esi + 0x80], 0
call fcn.0044eb00
cmp al, 1
jne 0x444c8a
cmp dword [ebp - 0x14], 2
jne 0x444b7f
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.004478f0
mov bh, al
jmp 0x444c8a
mov eax, dword [esi + 0x80]
push dword [esi + 4]
mov dword [ebp - 0x34], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x444c8a
cmp dword [ebp - 0x1c], 0
je 0x444c8a
cmp byte [esi + 0x88], 0
jne 0x444c8a
push 0x521aa4
push 0x20
call fcn.004a9520
mov edi, eax
add esp, 8
test edi, edi
je 0x444bd8
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
jmp 0x444bda
xor edi, edi
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 1
test edi, edi
jne 0x444bf2
lea ecx, [ebp - 0x30]
call fcn.0043b180
jmp 0x444c8a
push 0x64
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebp - 0x2c]
cmp edi, eax
je 0x444c18
cmp dword [ebp - 0x18], 0x10
jb 0x444c0d
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.00417770
mov eax, dword [ebp - 0x34]
xor bl, bl
push 0
push 0
push edi
mov dword [edi + 0x18], eax
mov eax, dword [esi + 4]
push 0x464900
push 0
mov dword [edi + 0x1c], eax
push 0
mov byte [esi + 0x88], 1
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
test eax, eax
je 0x444c6b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4e20
push 0x64
push dword [esi + 4]
mov dword [ebp - 0x30], 0
call dword [sym.imp.USER32.dll_SetTimer]
mov bl, 1
jmp 0x444c72
mov byte [esi + 0x88], 0
lea ecx, [ebp - 0x30]
call fcn.0043b180
cmp bl, 1
jne 0x444c8a
mov eax, dword [ebp + 8]
mov bh, bl
mov dword [esi + 0x8c], eax
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x444cba
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x444cb0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444cda
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
mov al, bh
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d55dc
mov esp, ebp
pop ebp
ret 8
call fcn.004c98d0
int3
Function at 0x447030
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push edi
test ecx, ecx
je 0x4471ba
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4471ba
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4471ba
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4471ba
push esi
xor esi, esi
cmp edi, 2
jbe 0x44710a
mov dword [ebp - 8], 4
mov dh, byte [ecx]
sub edi, 3
mov dl, byte [ecx + 1]
mov bl, dh
mov ah, byte [ecx + 2]
mov al, dl
and bl, 3
shr al, 4
shl bl, 4
and dl, 0xf
add bl, al
shl dl, 2
mov al, ah
mov byte [ebp - 1], ah
shr al, 6
add ecx, 3
add dl, al
mov dword [ebp + 8], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
ja 0x4471a1
mov ecx, dword [ebp + 0x10]
movzx eax, dh
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx], al
movzx eax, bl
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx + 1], al
movzx eax, dl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx + 2], al
movzx eax, byte [ebp - 1]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx + 3], al
add esi, 4
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
cmp edi, 2
ja 0x447077
test edi, edi
je 0x44719c
xor dh, dh
mov word [ebp + 9], 0
xor ah, ah
mov byte [ebp + 8], dh
xor dl, dl
test edi, edi
je 0x44713c
push edi
push ecx
lea eax, [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
mov ah, byte [ebp + 0xa]
add esp, 0xc
mov dl, byte [ebp + 9]
mov dh, byte [ebp + 8]
mov al, dl
shr ah, 6
mov cl, dh
shr al, 4
and dh, 3
shr cl, 2
and dl, 0xf
shl dh, 4
shl dl, 2
add dh, al
add dl, ah
lea eax, [esi + 4]
cmp eax, dword [ebp + 0x14]
ja 0x4471a1
movzx eax, cl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx], al
movzx eax, dh
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx + 1], al
add esi, 2
lea ecx, [esi + ebx]
cmp edi, 1
jne 0x447189
mov al, 0x3d
jmp 0x447192
movzx eax, dl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov byte [esi + ebx + 1], 0x3d
add esi, 2
cmp esi, dword [ebp + 0x14]
jb 0x4471ad
pop esi
pop edi
mov eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + ebx], 0
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret