joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100021d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.100012ab
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
inc dword [eax]
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
cmp dh, al
test dword [ecx + 0x11fffffc], esp
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
test dword [ebx + 0x27fffffc], esp
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
invalid
invalid

Function at 0x1001ac3
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push esi
push edi
lea edx, [eax + 2]
xor edi, edi
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1001ad4
push dword [ebp + 8]
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.01001967
test eax, eax
je 0x1001b04
push edi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1001b48
push ebx
lea ebx, [esi + esi]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1001b47
push edi
push edi
push ebx
push eax
push esi
push dword [ebp + 0xc]
push edi
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, edi
je 0x1001b3e
push edi
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x1002216
Capabilities:
Unload minifilter driver

Disassembly:
push 0x18
push 0x1003b88
call fcn.010035a8
mov dword [ebp - 0x24], 8
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], esi
cmp dword [ebp + 8], 3
je 0x100224a
mov dword [ebp - 0x24], 2
jmp 0x100226e
push 0xa
call fcn.01001905
cmp eax, esi
je 0x1002265
mov eax, dword [ebp + 0xc]
push dword [eax + 8]
call sub.FLTLIB.DLL_FilterUnload
mov dword [ebp - 0x20], eax
jmp 0x100226e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.01002284
mov eax, ecx
call fcn.010035ed
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x426a7090
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x4111008b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x222367f3
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x16bd6377
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40109a
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov dword [esp], 0x510a00
mov ecx, esi
call fcn.00402504
sub esp, 4
mov dword [esp], str.EBWebViewx86EmbeddedBrowserWebView.dll
mov ecx, esi
call fcn.00402504
sub esp, 4
mov ecx, esi
call fcn.00402610
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x40114f
mov ecx, esi
call fcn.00402610
mov esi, eax
movaps xmm0, xmmword [0x5106d0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x401125
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov al, 1
jmp 0x401151
mov dword [esp], str.WebView2:_skipped_inaccessible
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call edi
sub esp, 4
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
sub esp, 4
mov dword [esp], 0x510a66
call edi
sub esp, 4
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebp
ret
Function at 0x4011fd
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov eax, dword [0x54c154]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
push 0x104
call fcn.004023b6
mov ecx, esi
push dword [ebp + 8]
call fcn.0040243a
mov ecx, esi
call fcn.00402610
mov edi, eax
mov ecx, esi
call fcn.004025c8
cmp eax, 3
jb 0x401273
movzx eax, word [edi + 2]
cmp ax, 0x3a
jne 0x401263
cmp word [edi + 4], 0x5c
jne 0x401273
movzx eax, word [edi]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x401273
jmp 0x4012fb
cmp ax, 0x5c
jne 0x401273
cmp word [edi], 0x5c
je 0x4012fb
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.00402344
push edi
push 0
call fcn.00401158
add esp, 8
test eax, eax
js 0x401333
mov ecx, edi
call fcn.004025c8
mov ebx, eax
mov ecx, edi
call fcn.00402610
mov ecx, esi
push ebx
push eax
call fcn.00402464
mov ecx, edi
call fcn.00402610
push 0x5c
push eax
call fcn.004d739e
add esp, 8
test eax, eax
je 0x401342
mov ebx, eax
mov ecx, edi
call fcn.00402610
sub ebx, eax
add ebx, 2
sar ebx, 1
mov ecx, edi
call fcn.00402610
mov ecx, esi
push ebx
push eax
call fcn.00402464
mov ecx, esi
push dword [ebp + 8]
call fcn.00402504
mov ecx, edi
call fcn.00402356
xor edi, edi
push esi
call fcn.0040109a
add esp, 4
test al, al
jne 0x40134f
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
call edi
mov ecx, esi
call fcn.00402610
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x510a66
call edi
mov edi, 0x80070002
jmp 0x40134f
mov edi, eax
push str.WebView2:_Failed_to_find_the_app_exe_path._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x401347
mov edi, 0x80004005
lea ecx, [ebp - 0x1c]
call fcn.00402356
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a44cd
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401fa4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov dword [ebp - 0x234], edx
mov esi, ecx
mov bl, byte [ebp + 8]
mov eax, dword [0x54c154]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, 0x208
lea eax, [ebp - 0x218]
push edi
push 0xff
push eax
call fcn.004d78d0
add esp, 0xc
mov dword [ebp - 0x22c], edi
lea eax, [ebp - 0x230]
mov dword [eax], 0xffffffff
movzx ecx, bl
mov edx, reloc.OLEAUT32.dll_SysReAllocString
sub edx, ecx
push eax
push 0x20219
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
je 0x402028
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a44cd
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, str.location
mov ecx, str.EBWebView
mov edx, dword [ebp - 0x234]
mov esi, edx
test dl, dl
cmovne ecx, eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push ecx
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x4020d1
cmp dword [ebp - 0x22c], 3
lea ebx, [ebp - 0x218]
jb 0x4020d1
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.0040243a
xor edi, edi
mov eax, esi
test al, al
je 0x4020d1
mov dword [ebp - 0x22c], 0x208
xor eax, eax
lea ecx, [ebp - 0x22c]
push ecx
push ebx
push eax
push eax
push 0x510cde
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x4020d1
cmp dword [ebp - 0x22c], 3
jb 0x4020d1
mov esi, dword [ebp + 0x10]
mov ecx, esi
push 0x510a00
call fcn.00402504
mov ecx, esi
push ebx
call fcn.00402504
xor edi, edi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test edi, edi
jne 0x402011
cmp dword [ebp - 0x22c], 3
jb 0x402011
mov ecx, dword [ebp + 0x10]
call fcn.00402610
push 0x5c
push eax
call fcn.004d739e
add esp, 8
test eax, eax
je 0x40214b
mov edi, eax
add edi, 2
pcmpeqd xmm0, xmm0
lea edx, [ebp - 0x228]
movdqu xmmword [edx], xmm0
mov ecx, edi
call fcn.00401efe
test al, al
je 0x40214b
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x402136
push edi
call fcn.0040243a
lea ecx, [ebp - 0x228]
mov edx, dword [ebp + 0x10]
call fcn.00402152
mov ebx, eax
jmp 0x402011
xor ebx, ebx
jmp 0x402011

Function at 0x402152
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
xor eax, eax
mov edx, dword [eax + 0x510ce4]
cmp dword [ecx + eax], edx
ja 0x402170
jb 0x40217b
add eax, 4
cmp eax, 0x10
jne 0x40215b
push esi
call fcn.0040109a
add esp, 4
jmp 0x40219f
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WebView2:_skipped_an_incompatible_version
call edi
mov ecx, esi
call fcn.00402610
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x510a66
call edi
xor eax, eax
pop esi
pop edi
pop ebp
ret
Function at 0x402d64
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x54c154]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x402dc6
push ebx
push esi
call fcn.00402e74
add esp, 8
test al, al
je 0x402e22
mov ecx, ebx
call fcn.004025d0
test al, al
jne 0x402e22
mov edx, dword [esi]
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x1c]
call fcn.00402aa9
add esp, 4
mov bl, 1
jmp 0x402e24
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x402e38
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push ecx
push eax
push 0x10
push ebx
push eax
mov edi, dword [ebp - 0x1c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x402e53
mov ecx, edi
mov edx, ebx
push dword [ebp - 0x20]
push esi
call fcn.00402e74
add esp, 8
test al, al
je 0x402e22
mov eax, dword [esi]
test eax, eax
je 0x402e70
push eax
call fcn.004e5942
add esp, 4
cmp eax, 1
jmp 0x402e57
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a44cd
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a44cd
mov ecx, dword [ebp - 0x1c]
mov edx, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00402e74
cmp dword [ebp - 0x14], 1
sete al
movzx eax, al
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov bl, 1
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x402e24
mov byte [esi], 1
jmp 0x402e24
xor eax, eax
jmp 0x402e5a

Function at 0x402e74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], ecx
mov eax, dword [0x54c154]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, 0x208
xor ebx, ebx
lea edi, [ebp - 0x218]
push esi
push ebx
push edi
call fcn.004d78d0
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], esi
push eax
push edi
push ebx
push 2
push dword [ebp - 0x220]
push ebx
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x402ef1
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.0040243a
mov ecx, edi
call fcn.00402610
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a44cd
mov eax, ebx
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402f9f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x54c154]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x402ffa
mov edi, eax
push str.CreateWebViewEnvironmentWithOptionsInternal
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40306c
mov ecx, eax
mov esi, dword [ebp + 0x1c]
mov bl, byte [ebp + 0xc]
call dword [0x510530]
movzx eax, bl
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call ecx
mov esi, eax
jmp 0x4030d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea ebx, [ebp - 0x14]
mov dword [ebx], esi
xor eax, eax
dec eax
lea edi, [ebp - 0x20]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.00402344
push edi
push 1
push 4
push ebx
call fcn.00402f10
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
call ebx
mov ecx, edi
call fcn.00402610
push eax
call ebx
push str._path
call ebx
push dword [ebp + 8]
call ebx
push 0x511202
call ebx
mov ecx, edi
call fcn.00402356
jmp 0x4030ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], esi
xor eax, eax
dec eax
lea ebx, [ebp - 0x20]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, ebx
call fcn.00402344
push ebx
push 1
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.00402f10
add esp, 0x10
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.00402610
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x511202
call eax
mov ecx, ebx
call fcn.00402356
push str.DllCanUnloadNow
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4030ee
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a44cd
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409f20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fddcd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x38
mov eax, dword [0x54c154]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], edx
mov esi, ecx
mov dword [ebp - 0x20], esi
mov edx, dword [ebx + 0xc]
lea eax, [ebp - 0x20]
mov ecx, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
push eax
mov eax, dword [ebp - 0x3c]
push 0
push 0
push 2
push edx
push ecx
push dword [eax]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x4c], edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x409faa
mov dword [edi], eax
xor ecx, ecx
mov dword [edi + 4], 0x54dd80
mov eax, dword [edi + 4]
jmp 0x409fbf
mov ecx, dword [ebp - 0x20]
mov eax, 0x54dd00
mov dword [edi], 0
mov dword [edi + 4], 0x54dd00
mov eax, dword [eax + 4]
cmp eax, dword [0x54dd04]
jne 0x40a12f
cmp dword [edi], 0
jne 0x40a12f
xor eax, eax
test ecx, ecx
je 0x40a131
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
shr ecx, 1
push eax
push ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0040ed70
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x38]
mov eax, dword [ebp - 0x28]
cmovae ecx, dword [ebp - 0x38]
add eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x3c]
push ecx
push 0
push 2
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x40a046
mov dword [edi], eax
xor ecx, ecx
mov dword [edi + 4], 0x54dd80
mov eax, dword [edi + 4]
jmp 0x40a05b
mov ecx, dword [ebp - 0x20]
mov eax, 0x54dd00
mov dword [edi], 0
mov dword [edi + 4], 0x54dd00
mov eax, dword [eax + 4]
cmp eax, dword [0x54dd04]
jne 0x40a0c7
cmp dword [edi], 0
jne 0x40a0c7
shr ecx, 1
dec ecx
push 0
push ecx
lea ecx, [ebp - 0x38]
call fcn.0040ed70
lea ecx, [ebp - 0x38]
call fcn.0040ef40
movups xmm0, xmmword [ebp - 0x38]
mov dword [esi], 0
lea ecx, [ebp - 0x38]
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov word [ebp - 0x38], ax
movq xmm0, qword [ebp - 0x28]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
call fcn.004161c0
jmp 0x40a148
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x38]
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.004161c0
jmp 0x40a148
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004a44cd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x40a170
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
push esi
push 0x520bc0
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov eax, dword [esi]
test eax, eax
jne 0x40a27b
push 0x512598
push 0xfffe
call fcn.004a4656
push 0xfffe
mov edi, eax
push 0
push edi
call fcn.004d78d0
add esp, 0x14
push 0x7fff
push edi
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40a268
push 0x5c
push edi
call fcn.004d739e
add esp, 8
test eax, eax
je 0x40a268
mov edx, eax
mov ecx, 0x7fff
sub edx, edi
sar edx, 1
push str.log.dll
sub ecx, edx
push ecx
push eax
call fcn.004dab23
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
push edi
call fcn.004a450c
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x40a366
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LogInit
push eax
call edi
test eax, eax
je 0x40a28f
call eax
push str.LogApplySettings
push dword [esi]
call edi
push str.LogSetSettingsFile
push dword [esi]
mov dword [esi + 4], eax
call edi
push str.LogEnable
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.LogSetLevel
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.LogSetPath
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push str.LogSetType
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.LogSetMode
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.LogSetMaxSize
push dword [esi]
mov dword [esi + 0x1c], eax
call edi
push str.LogSetDepth
push dword [esi]
mov dword [esi + 0x20], eax
call edi
push str.LogWrite
push dword [esi]
mov dword [esi + 0x24], eax
call edi
push str.LogIsEnabled
push dword [esi]
mov dword [esi + 0x28], eax
call edi
push str.LogMonitorSettings
push dword [esi]
mov dword [esi + 0x2c], eax
call edi
push str.LogGetLevel
push dword [esi]
mov dword [esi + 0x30], eax
call edi
push str.LogUninitDeskMetrics
push dword [esi]
mov dword [esi + 0x44], eax
call edi
push str.LogTrackEvent
push dword [esi]
mov dword [esi + 0x34], eax
call edi
push str.LogTrackEventData
push dword [esi]
mov dword [esi + 0x38], eax
call edi
push str.LogRemoveModule
push dword [esi]
mov dword [esi + 0x3c], eax
call edi
cmp dword [esi + 0x28], 0
mov dword [esi + 0x40], eax
mov eax, esi
je 0x40a368
pop edi
pop esi
ret
mov eax, esi
pop edi
mov dword [esi + 0x28], 0x40a3b0
pop esi
ret
Function at 0x40c686
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe0
push ebx
push ebp
push esi
push edi
push 0x72
pop ecx
push 0x74
pop eax
push 0x6b
mov byte [esp + 0x35], al
xor ebx, ebx
pop eax
push 0x65
mov word [esp + 0x5c], ax
pop eax
push 0x6e
pop esi
push 0x6c
pop edi
push 0x33
mov word [esp + 0x5e], ax
mov word [esp + 0x64], ax
pop eax
push 0x32
mov word [esp + 0x68], ax
pop eax
push 0x2e
pop edx
push 0x64
mov byte [esp + 0x28], cl
mov word [esp + 0x60], cx
pop ecx
mov word [esp + 0x66], ax
xor eax, eax
mov word [esp + 0x70], ax
push 0x74
pop eax
mov word [esp + 0x46], ax
xor eax, eax
mov word [esp + 0x6a], cx
mov word [esp + 0x48], cx
mov word [esp + 0x50], cx
mov ecx, 0x3d090c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 0x676d6a29
mov dword [esp + 0x20], 0x71383858
mov dword [esp + 0x25], 0x5729265f
mov dword [esp + 0x29], 0x44256971
mov dword [esp + 0x2d], 0x3c567378
mov byte [esp + 0x32], bl
mov dword [esp + 0x34], 0x16ae00
mov word [esp + 0x5e], si
mov word [esp + 0x62], di
mov word [esp + 0x68], dx
mov word [esp + 0x6c], di
mov word [esp + 0x6e], di
mov word [esp + 0x44], si
mov word [esp + 0x4a], di
mov word [esp + 0x4c], di
mov word [esp + 0x4e], dx
mov word [esp + 0x52], di
mov word [esp + 0x54], di
mov word [esp + 0x56], ax
mov eax, ebx
mov byte [esp + eax + 0x84], al
inc eax
cmp eax, 0x6a
jb 0x40c771
dec ecx
jne 0x40c76f
cmp byte [esp + 0xcf], 0x4b
jne 0x40c7a3
lea ecx, [esp + 0x58]
call fcn.0040cab3
lea ecx, [esp + 0x44]
mov edi, eax
call fcn.0040cab3
mov esi, eax
jmp 0x40c7ab
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x38]
mov edx, 0xd5786
mov ecx, edi
call fcn.0040cae5
mov edx, 0x348bfa
mov dword [esp + 0x78], eax
mov ecx, edi
call fcn.0040cae5
mov edx, 0x6de540
mov dword [esp + 0x3c], eax
mov ecx, esi
call fcn.0040cae5
mov edx, 0x3758440
mov ecx, esi
mov ebp, eax
call fcn.0040cae5
mov edx, 0x6d92a5e2
mov ecx, esi
mov edi, eax
call fcn.0040cae5
push 4
push 0x3000
lea ecx, [esp + 0x3c]
push ecx
push ebx
lea ecx, [esp + 0x28]
push ecx
push 0xffffffffffffffff
call eax
test eax, eax
jns 0x40c814
xor eax, eax
jmp 0x40ca02
mov esi, ebx
cmp dword [esp + 0x34], ebx
jbe 0x40c83d
xor edx, edx
mov eax, esi
push 0x17
pop ecx
div ecx
mov eax, dword [esp + 0x18]
mov cl, byte [esp + edx + 0x1c]
xor cl, byte [esi + section._w4dJCb]
mov byte [esi + eax], cl
inc esi
cmp esi, dword [esp + 0x34]
jb 0x40c81c
mov eax, dword [esp + 0x18]
push ebx
push 0x8000000
push 0x40
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [esp + 0x44], esi
and al, 0x44