joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421dbe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea edx, [ebp - 0x1628]
push edx
call dword [ebp - 0x18b4]
test eax, eax
jne 0x421e10
push eax
push ebx
add esp, 4
sub eax, 0x715
sub eax, 0x108d1
pop eax
push esi
sub esi, 0x61e9
pop esi
push ebx
push edi
add esp, 4
and ebx, 0x18426
and ebx, 0x1623f
xor ebx, 0x142a
pop ebx
mov dword [ebp - 0x738], 0
jmp 0x4224fa

Function at 0x421e8d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
add edi, 0x18688
xor edi, 0x151e
pop edi
cmp dword [ebp - 0x14f4], 0
jne 0x421eb3
mov dword [ebp - 0x2e0], 0
jmp 0x42215a
mov ecx, dword [ebp - 0x14f4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc3c], eax
push esi
push eax
add esp, 4
jmp 0x421ed2
pop esi
push edi
push edx
push eax
sub eax, 0xcc06
xor eax, 0x8910
pop eax
push ecx
add ecx, 0x6562
pop ecx
push ecx
or ecx, 0x15198
or ecx, 0x133ed
sub ecx, 0x105aa
pop ecx
push edx
jmp 0x42218b
pop edx
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2fc], ecx
push ebx
push ecx
add esp, 4
and ebx, 0x12308
pop ebx
push edx
push edi
add esp, 4
or edx, 0x169b2
xor edx, 0x107a9
and edx, 0x11750
pop edx
push ecx
xor ecx, 0x8e6c
and ecx, 0x798e
pop ecx
mov dword [ebp - 0x70c], 0
mov edx, dword [ebp - 0x2fc]
mov dword [ebp - 0x1500], edx
cmp dword [ebp - 0x1500], 0
jne 0x4221fd
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x4224ee
mov ecx, dword [ebp - 0x1500]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1504], edx
jne 0x422225
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x4224ee
add al, byte [eax]
invalid
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1504]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1508], ecx
cmp dword [ebp - 0x1508], 0
jne 0x422257
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
jmp 0x4224ee
invalid
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x1508]
mov dword [ebp - 0x700], eax
jne 0x42227c
mov ecx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], ecx
jmp 0x4224ee
mov edx, dword [ebp - 0x700]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18c0], eax
mov ecx, dword [ebp - 0x700]
add cl, bh
invalid
dec dword [ebx - 0x2fb6b]
inc dword [ebx]
push ecx
and al, 0x89
xchg ebp, eax
cmp al, 0xe7
invalid
dec dword [ebx - 0x6ff7b]
dec dword [ebx - 0x2fb73]
inc dword [ebx]
dec eax
sbb al, 0x89
lea edi, [eax]
out 0xff, eax
inc edi
test esp, edi
clc
invalid
inc dword [eax]
add byte [eax], al
add bl, ch
invalid
mov eax, dword [ebp - 0x4e0]

Function at 0x421ed5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edi, 0x9aaf
sub edi, 0x293a
xor edi, 0xc7dc
pop edi
push ecx
push eax
add esp, 4
xor ecx, 0x13ac8
pop ecx
cmp dword [ebp - 0xc3c], 0
jne 0x421f0f
mov dword [ebp - 0x2e0], 0
jmp 0x42215a
mov ecx, dword [ebp - 0xc3c]
mov dword [ebp - 0x4dc], ecx
push ecx
Function at 0x42212a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x422150
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x421f1b
mov dword [ebp - 0x2e0], 0

Function at 0x42265a
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add esp, 4
pop edx
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push esi
push esi
add esp, 4
xor esi, 0xa44b
sub esi, 0xe60d
sub esi, 0xa9e1
or esi, 0xff83
pop esi
push edi
and edi, 0x11d4f
pop edi
push eax
push edi
add esp, 4
or eax, 0xdf04
pop eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push ecx
push edi
add esp, 4
add ecx, 0x70a6
or ecx, 0x2470
and ecx, 0x11949
and ecx, 0x433b
pop ecx
push eax
add eax, 0xde17
add byte [eax], al
xor eax, 0x10a5f
xor eax, 0x72e5
pop eax
cmp dword [ebp - 0x150c], 0
jne 0x42276a
mov dword [ebp - 0x2a8], 0
jmp 0x422a11
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push edx
and edx, 0x11c3d
jmp 0x42278c
sub edx, 0x648f
xor edx, 0x89c1
pop edx
push ecx
push ebx
add esp, 4
jmp 0x4227a7
add ecx, 0x142cf
pop ecx
cmp dword [ebp - 0xc4c], 0
mov ebp, 0xfffff3b4
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2a8], 0
jmp 0x422a11
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
Function at 0x4228d9
Capabilities:
Get number of processors

Disassembly:
push edi
push esi
add esp, 4
jmp 0x4227df
add edi, 0x168be
pop edi
push edx
push edx
add esp, 4
sub edx, 0x11909
sub edx, 0x8353
or edx, 0xde47
and edx, 0x143ca
pop edx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edx
add esp, 4
or edi, 0x14bd2
pop edi
push edx
push edi
add esp, 4
add edx, 0x15fe5
xor edx, 0x64ab
xor edx, 0x4645
xor edx, 0xaf14
pop edx
push edx
xor edx, 0xf0ec
pop edx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
rol dword [edx], 0x89
lea edi, [eax + 0x66fffff3]
mov edx, dword [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push edx
or edx, 0x13ffa
or edx, 0xeb94
pop edx
push edx
push edx
add esp, 4
call 0x4228d9
add byte [ebx + 0x41], al
dec edx
xor eax, 0x44363f39
add esp, 4
pop edx
push esi
push edi
add esp, 4
sub esi, 0x5e5e
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x422906
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x422960
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x42282e
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x42282e
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x42294a
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x422954
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x4229a9
push eax
and eax, 0x410d
xor eax, 0xc33d
pop eax
push edx
call 0x422984
add byte [ebp + 0x4c], al
cmp byte [edi], dh
inc esp
dec ecx
add esp, 4
and edx, 0x15ea0
pop edx
push ecx
and ecx, 0x7665
jmp 0x42299a
pop ecx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x422a11
push edi
push ebx
add esp, 4
or edi, 0xffc7
or edi, 0x141e3
xor edi, 0x77e
pop edi
push ebx
or ebx, 0x8000
or ebx, 0x1be9
xor ebx, 0xbce8
xor ebx, 0x5f75
pop ebx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x422a07
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4227d2
mov dword [ebp - 0x2a8], 0
push eax
xor eax, 0x7e08
jmp 0x422a1e
invalid
Function at 0x422984
Capabilities:
Get number of processors

Disassembly:
push edi
push esi
add esp, 4
jmp 0x4227df
add edi, 0x168be
pop edi
push edx
push edx
add esp, 4
sub edx, 0x11909
sub edx, 0x8353
or edx, 0xde47
and edx, 0x143ca
pop edx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edx
add esp, 4
or edi, 0x14bd2
pop edi
push edx
push edi
add esp, 4
add edx, 0x15fe5
xor edx, 0x64ab
xor edx, 0x4645
xor edx, 0xaf14
pop edx
push edx
xor edx, 0xf0ec
pop edx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
rol dword [edx], 0x89
lea edi, [eax + 0x66fffff3]
mov edx, dword [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push edx
or edx, 0x13ffa
or edx, 0xeb94
pop edx
push edx
push edx
add esp, 4
call 0x4228d9
add byte [ebx + 0x41], al
dec edx
xor eax, 0x44363f39
add esp, 4
pop edx
push esi
push edi
add esp, 4
sub esi, 0x5e5e
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x422906
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x422960
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x42282e
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x42282e
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x42294a
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x422954
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x4229a9
push eax
and eax, 0x410d
xor eax, 0xc33d
pop eax
push edx
call 0x422984
add byte [ebp + 0x4c], al
cmp byte [edi], dh
inc esp
dec ecx
add esp, 4
and edx, 0x15ea0
pop edx
push ecx
and ecx, 0x7665
jmp 0x42299a
pop ecx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x422a11
push edi
push ebx
add esp, 4
or edi, 0xffc7
or edi, 0x141e3
xor edi, 0x77e
pop edi
push ebx
or ebx, 0x8000
or ebx, 0x1be9
xor ebx, 0xbce8
xor ebx, 0x5f75
pop ebx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x422a07
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4227d2
mov dword [ebp - 0x2a8], 0
push eax
xor eax, 0x7e08
jmp 0x422a1e
invalid

Function at 0x422b01
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov word [ebp - 0x16da], cx
mov edx, 0x2e
mov word [ebp - 0x16d8], dx
mov eax, 0x64
mov word [ebp - 0x16d6], ax
mov ecx, 0x6c
mov word [ebp - 0x16d4], cx
mov edx, 0x6c
mov word [ebp - 0x16d2], dx
xor eax, eax
mov word [ebp - 0x16d0], ax
push ebx
push eax
add esp, 4
jmp 0x422af6
xor cl, ch
invalid
call 0x422b05
add byte [esi], dh
dec ecx
cmp eax, 0x464b394e
dec ebx
inc esi
inc ebp
cmp eax, 0x8104c483
jmp 0x422ae5
Function at 0x422b05
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov word [ebp - 0x16da], cx
mov edx, 0x2e
mov word [ebp - 0x16d8], dx
mov eax, 0x64
mov word [ebp - 0x16d6], ax
mov ecx, 0x6c
mov word [ebp - 0x16d4], cx
mov edx, 0x6c
mov word [ebp - 0x16d2], dx
xor eax, eax
mov word [ebp - 0x16d0], ax
push ebx
push eax
add esp, 4
jmp 0x422af6
xor cl, ch
invalid
call 0x422b05
add byte [esi], dh
dec ecx
cmp eax, 0x464b394e
dec ebx
inc esi
inc ebp
cmp eax, 0x8104c483
jmp 0x422ae5

Function at 0x422eb2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
pop eax
push edi
push esi
add esp, 4
or edi, 0xe8f6
pop edi
cmp dword [ebp - 0x710], 0
jne 0x422f0b
push esi
push ecx
add esp, 4
or esi, 0x4117
or esi, 0x76f4
add esi, 0x11ae2
pop esi
push ecx
push edi
add esp, 4
add ecx, 0x41ad
add ecx, 0x523c
pop ecx
push edi
sub edi, 0x12090
pop edi
mov dword [ebp - 0xa58], 0
jmp 0x423a33
push eax
push eax
add esp, 4
and eax, 0x13e0c
sub eax, 0x6616
jmp 0x422f23
jmp 0x422f28
pop eax
push ebx
sub ebx, 0x12c4e
pop ebx
push ebx
push ecx
invalid
invalid
Function at 0x423619
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
add esp, 4
or esi, 0x8a9c
and esi, 0xeae
pop esi
push edx
push ecx
add esp, 4
call 0x42347a
add byte [eax], bh
xor edi, dword [0x414e4b39]
dec eax
dec ebx
add esp, 4
pop edx
push edi
add edi, 0x14d2f
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
sub edx, 0x1f9c
call 0x4234c4
add byte [edx + 0x39], cl
inc esp
dec edx
inc esi
inc edx
inc edx
add esp, 4
add edx, 0x111a0
and edx, 0x11b7b
pop edx
push eax
jmp 0x4234db
and eax, 0xc2c9
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
rcl byte [edx + 0x53], 0x83
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [edx], bh
xor al, 0x4e
xor al, 0x49
aaa
dec edx
dec esp
inc ebx
cmp eax, 0x5a04c483
push ecx
push edx
add esp, 4
jmp 0x42355e
or ecx, 0x12af4
jmp 0x42356a
pop ecx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x423588
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp fcn.004235e2
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4234b0
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4234b0
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4235cc
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x4235d6
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x42362b
push ebx
push edx
add esp, 4
jmp 0x4235f9
add ebx, 0x137be
sub ebx, 0x6475
pop ebx
push ecx
add ecx, 0xdbad
call 0x423619
add byte [esi + 0x44], cl
push eax
inc ebx
cmp ecx, dword [edx - 0x7d]
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp fcn.00423693
push edx
push edi
add esp, 4
sub edx, 0x9444
call 0x423642
add byte [ecx + 0x33], al
inc eax
inc eax
cmp eax, 0x4c48336
pop edx
push edi
jmp 0x42364d
call 0x423659
add byte [edx], bh
dec edx
inc ebp
dec edi
dec edx
inc ebp
add esp, 4
pop edi
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x423689
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x423454
mov dword [ebp - 0x2a8], 0
Function at 0x423659
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
add esp, 4
or esi, 0x8a9c
and esi, 0xeae
pop esi
push edx
push ecx
add esp, 4
call 0x42347a
add byte [eax], bh
xor edi, dword [0x414e4b39]
dec eax
dec ebx
add esp, 4
pop edx
push edi
add edi, 0x14d2f
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
sub edx, 0x1f9c
call 0x4234c4
add byte [edx + 0x39], cl
inc esp
dec edx
inc esi
inc edx
inc edx
add esp, 4
add edx, 0x111a0
and edx, 0x11b7b
pop edx
push eax
jmp 0x4234db
and eax, 0xc2c9
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
rcl byte [edx + 0x53], 0x83
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [edx], bh
xor al, 0x4e
xor al, 0x49
aaa
dec edx
dec esp
inc ebx
cmp eax, 0x5a04c483
push ecx
push edx
add esp, 4
jmp 0x42355e
or ecx, 0x12af4
jmp 0x42356a
pop ecx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x423588
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp fcn.004235e2
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4234b0
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4234b0
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4235cc
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x4235d6
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x42362b
push ebx
push edx
add esp, 4
jmp 0x4235f9
add ebx, 0x137be
sub ebx, 0x6475
pop ebx
push ecx
add ecx, 0xdbad
call 0x423619
add byte [esi + 0x44], cl
push eax
inc ebx
cmp ecx, dword [edx - 0x7d]
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp fcn.00423693
push edx
push edi
add esp, 4
sub edx, 0x9444
call 0x423642
add byte [ecx + 0x33], al
inc eax
inc eax
cmp eax, 0x4c48336
pop edx
push edi
jmp 0x42364d
call 0x423659
add byte [edx], bh
dec edx
inc ebp
dec edi
dec edx
inc ebp
add esp, 4
pop edi
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x423689
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x423454
mov dword [ebp - 0x2a8], 0
Function at 0x42369f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edx
add esp, 4
sub esi, 0x177cb
add esi, 0x12340
mov byte [eax + 0x23], 1
add byte [ecx + 0xcaa3ee], al
add byte [esi + 0x50], bl
jmp 0x4236b2
or eax, 0x98b9
or eax, 0xcb90
xor eax, 0x1afa
pop eax
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push ebx
add ebx, 0x99e0
jmp 0x4236e3
sub ebx, 0x9530
pop ebx
push ecx
sub ecx, 0x76f3
or ecx, 0xd282
or ecx, 0x5238
pop ecx
push ebx
add ebx, 0x1184c
pop ebx
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x423736
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x423a27
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x42375e
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x423a27
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x423790
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x423a27
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
jne 0x4237b5
mov edx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], edx
jmp 0x423a27
mov eax, dword [ebp - 0x724]
mov ecx, dword [ebp - 0x304]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x1900], ecx
mov edx, dword [ebp - 0x724]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1904], eax
mov ecx, dword [ebp - 0x724]
invalid
xchg ebp, eax
cld
cld
invalid
Function at 0x425758
Capabilities:
Encode data using xor

Disassembly:
int1
pop ss
outsd dx, dword [esi]
or dword [eax], ecx
popal
pop edi
pop eax
mov ecx, esp
or al, 0x89
xlatb
jae 0x425794
or byte [eax], cl
push cs
inc ebp
push ecx
cmp dl, byte [edi + 0x50]
push ebp
mov edi, ebp
in al, dx
mov word [eax], cs
or byte [ecx + 0x930f4d7], cl
or byte [edi - 0xf], ah
or al, 0x51
or dword [eax], ecx
pop ebx
pop edi
mov ecx, esp
or al, 0x89
retf
arpl word [edx - 0x10], bx
adc cl, byte [eax]
or byte [eax], cl
or byte [esi], bh
push edi
inc edx
dec edx
push esi
aas
pop eax
inc edx
inc esp
mov ecx, esp
or al, 0x62
mov eax, ebp
xor al, 4
pop es
pop es
or byte [ebp + 0x16], bh
xchg ebp, eax
popfd
mov cl, dh
pop es
pop es
xchg ecx, eax
popfd
in al, 2
pop es
pop es
jge 0x42574c
lds esi, [esp + eax]
pop es
pop es
or dword [ebp + 0x16], edi
xchg ebp, eax
lea ebx, [eax - 0xf]
pop es
pop es
xchg ecx, eax
lea esi, [eax]
pop es
pop es
pop edx
mov eax, ebp
xor al, 4
pop es
pop es
or bh, byte [ebp + 0x16]
xchg ebp, eax
xchg ebp, eax
js 0x4257d5
pop es
pop es
xchg ecx, eax
xchg ebp, eax
xor al, 0xf2
pop es
pop es
aaa
mov eax, ebp
xor al, 4
pop es
pop es
or edi, dword [ebp + 0x16]
xchg ebp, eax
popfd
push 0x910707f1
popfd
cmp dl, dh
pop es
pop es
adc al, 0x95
lea ebx, [eax - 0x6ef8f80f]
lea edi, [eax]
pop es
pop es
xchg ebx, eax
xchg ebp, eax
cmp dl, dh
pop es
pop es
xchg ecx, eax
xchg ebp, eax
xor al, 0xf2
pop es
pop es
xchg ebx, eax
popfd
xor al, 0xf2
pop es
pop es
xchg ecx, eax
popfd
xor dl, dh
pop es
pop es
xchg ebx, eax
lea esi, [eax]
pop es
pop es
xchg ecx, eax
invalid

Function at 0x442df0
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x58a710]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.0040fd40
mov ebx, eax
cmp ebx, esi
je 0x442e5d
lea ecx, [ebp - 0x20c]
call fcn.0040fda0
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050e14c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x442e7b
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x20c]
call fcn.00442df0
cmp eax, esi
jne 0x442ec2
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], 0x100
call ebx
test eax, eax
je 0x442e65
lea ecx, [ebp - 0x20c]
call fcn.0040fda0
push dword [ebp - 0x214]
mov ecx, edi
call fcn.004428b3
lea ecx, [ebp - 0x20c]
mov esi, eax
call fcn.0040fda0
mov eax, esi
jmp 0x442e4c
Function at 0x45a38a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
xor edi, edi
push str.UxTheme.dll
mov dword [esi], vtable.CMFCBaseVisualManager.0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
call fcn.0042605b
pop ecx
mov dword [esi + 0x48], eax
cmp eax, edi
je 0x45a443
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenThemeData
push eax
call edi
push str.CloseThemeData
push dword [esi + 0x48]
mov dword [esi + 0x4c], eax
call edi
push str.DrawThemeBackground
push dword [esi + 0x48]
mov dword [esi + 0x50], eax
call edi
push str.GetThemeColor
push dword [esi + 0x48]
mov dword [esi + 0x54], eax
call edi
push str.GetThemeSysColor
push dword [esi + 0x48]
mov dword [esi + 0x58], eax
call edi
push str.GetCurrentThemeName
push dword [esi + 0x48]
mov dword [esi + 0x5c], eax
call edi
push str.GetWindowTheme
push dword [esi + 0x48]
mov dword [esi + 0x60], eax
call edi
mov ecx, esi
mov dword [esi + 0x64], eax
call fcn.00459f19
jmp 0x45a458
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
pop edi
mov eax, esi
pop esi
ret