joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push edx
push ecx
mov esi, dword [ebp + 0xc]
sub eax, eax
test esi, esi
je 0x401821
call fcn.00401866
mov edi, eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
not eax
test ecx, ecx
je 0x40181f
test esi, 3
je 0x4017a3
xor al, byte [esi]
inc esi
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40178c
mov edx, ecx
shr ecx, 3
je 0x401805
lea ebx, [ebx]
xor eax, dword [esi]
add esi, 4
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4017b0
mov ecx, edx
and ecx, 7
je 0x40181f
lea esp, [esp]
xor al, byte [esi]
inc esi
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x401810
not eax
pop ecx
pop edx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403375
Capabilities:
Terminate process

Disassembly:
push edi
xor edi, edi
cmp dword [0x426928], edi
jne 0x403394
cmp dword [0x41a140], edi
jg 0x403399
dec dword [0x41a140]
mov dword [0x426874], edi
or eax, 0xffffffff
pop edi
ret
cmp dword [0x426874], edi
push esi
jg 0x40340f
mov esi, 0x2000
push esi
push dword [0x42686c]
push dword [0x426890]
call fcn.0041068d
add esp, 0xc
cmp eax, edi
mov dword [0x426874], eax
jne 0x4033d0
mov dword [0x426874], edi
or eax, 0xffffffff
jmp 0x403425
jge 0x4033fa
push 0x401
mov esi, str.error:__zipfile_read_error_n
push esi
call fcn.00409230
pop ecx
push eax
push esi
push 0x41a0a0
call dword [fcn.00426aa0]
add esp, 0x10
push 3
call fcn.0040977a
mov eax, dword [0x42686c]
add dword [0x426898], esi
mov dword [0x426870], eax
call fcn.0040327a
mov eax, dword [0x426870]
dec dword [0x426874]
mov al, byte [eax]
inc dword [0x426870]
movzx eax, al
pop esi
pop edi
ret
Function at 0x406d88
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x24
push esi
push dword [0x426950]
call fcn.0040a5ea
xor esi, esi
cmp dword [0x41a0b0], esi
pop ecx
jne 0x406f75
push ebx
push ebp
push edi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
call fcn.00406c77
pop ecx
pop ecx
push esi
push 0x80
push 3
push esi
push 2
push 0x40000000
mov ebp, 0x426968
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x10], eax
mov eax, dword [0x41a860]
mov eax, dword [eax + 0x14]
test al, 0x5f
mov esi, 0x41a864
mov edi, 0x41a0a0
je 0x406e28
and eax, 0x7f
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x406e28
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nwarning___d_:_could_not_set_file_attributes_n
push esi
call fcn.00408233
add esp, 0xc
push eax
push esi
push edi
call dword [fcn.00426aa0]
add esp, 0x10
mov ecx, dword [0x4268a0]
test ecx, ecx
je 0x406edc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
movzx eax, word [0x4268c0]
call fcn.00406bee
test eax, eax
pop ecx
pop ecx
je 0x406edc
mov eax, dword [0x41a860]
push dword [eax + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push ebp
call fcn.0040627f
cmp eax, 0x4f
pop ecx
pop ecx
jne 0x406edc
cmp dword [0x41a0d4], 0
je 0x406eb2
push 1
push 0x41e864
push ebp
call fcn.00401aa5
push eax
push 0x414b84
push esi
call fcn.00408233
add esp, 0x14
push eax
push esi
push edi
call dword [fcn.00426aa0]
add esp, 0x10
cmp dword [0x41a0d4], 0
mov eax, 0x414b78
jne 0x406eb7
mov eax, 0x4144c7
push 1
push eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff5
push eax
push str._compressed_WinNT_security_data_missing___d_bytes__s
push esi
call fcn.00408233
add esp, 0x10
push eax
push esi
push edi
call dword [fcn.00426aa0]
add esp, 0x10
cmp dword [esp + 0x10], 0xffffffff
jne 0x406f08
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nCreateFile___error__d_when_trying_set_file_time_n
push esi
call fcn.00408233
add esp, 0xc
push eax
push esi
push edi
call dword [fcn.00426aa0]
add esp, 0x10
jmp 0x406f72
test ebx, ebx
je 0x406f68
mov eax, ebx
and al, 1
neg al
lea ecx, [esp + 0x1c]
sbb eax, eax
and eax, ecx
push eax
mov eax, ebx
and al, 2
neg al
lea ecx, [esp + 0x28]
sbb eax, eax
and eax, ecx
and bl, 4
neg bl
push eax
lea eax, [esp + 0x34]
sbb ebx, ebx
and ebx, eax
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x406f68
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nSetFileTime_failed:__d_n
push esi
call fcn.00408233
add esp, 0xc
push eax
push esi
push edi
call dword [fcn.00426aa0]
add esp, 0x10
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x24
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x12dd50d7
nop
nop
nop
nop
nop
test eax, eax
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x5a09247a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401030
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41aee9
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x42400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x68], 0
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov al, byte [0x420508]
mov dword [ebp - 0x6c], edi
movups xmmword [ebp - 0x54], xmm0
mov byte [ebp - 0x14], al
movups xmm0, xmmword [0x4204d8]
movups xmmword [ebp - 0x44], xmm0
movups xmm0, xmmword [0x4204e8]
movups xmmword [ebp - 0x34], xmm0
movups xmm0, xmmword [0x4204f8]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
movups xmmword [ebp - 0x24], xmm0
mov dword [edi + 0x10], 0
jb 0x4010c4
mov eax, dword [edi]
jmp 0x4010c6
mov eax, edi
mov byte [eax], 0
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x68], 1
test ebx, ebx
je 0x401216
mov al, byte [edx]
dec ebx
mov byte [ebp + esi - 0x58], al
inc edx
mov ah, byte [ebp - 0x56]
inc esi
mov ch, byte [ebp - 0x57]
mov cl, byte [ebp - 0x58]
mov dword [ebp - 0x64], edx
mov byte [ebp - 0x5f], ah
mov byte [ebp - 0x5d], ch
mov byte [ebp - 0x5e], cl
cmp esi, 3
jne 0x401164
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x5c], al
mov al, ch
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x5b], cl
mov cl, ch
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 0x5a], cl
mov byte [ebp - 0x59], al
xor esi, esi
nop word [eax + eax]
movzx eax, byte [ebp + esi - 0x5c]
movzx eax, byte [ebp + eax - 0x54]
push eax
push ecx
mov ecx, edi
call fcn.00401c40
inc esi
cmp esi, 4
jl 0x401140
mov edx, dword [ebp - 0x64]
xor esi, esi
mov ch, byte [ebp - 0x5d]
mov cl, byte [ebp - 0x5e]
test ebx, ebx
jne 0x4010e4
mov dword [ebp - 0x64], esi
test esi, esi
je 0x401216
mov eax, esi
cmp esi, 3
jge 0x40119e
cmp eax, 3
jae 0x401199
mov byte [ebp + eax - 0x58], 0
inc eax
cmp eax, 3
jl 0x401181
mov dl, byte [ebp - 0x56]
mov ch, byte [ebp - 0x57]
mov cl, byte [ebp - 0x58]
jmp 0x4011a1
call fcn.00409e3f
mov dl, byte [ebp - 0x5f]
mov al, cl
xor ebx, ebx
shr al, 2
and cl, 3
mov byte [ebp - 0x5c], al
mov al, ch
shr al, 4
and ch, 0xf
shl cl, 4
add cl, al
shl ch, 2
mov al, dl
mov byte [ebp - 0x5b], cl
shr al, 6
and dl, 0x3f
add ch, al
mov byte [ebp - 0x59], dl
lea eax, [esi + 1]
mov byte [ebp - 0x5a], ch
mov dword [ebp - 0x58], eax
test eax, eax
jle 0x4011fb
mov esi, eax
nop dword [eax]
movzx eax, byte [ebp + ebx - 0x5c]
movzx eax, byte [ebp + eax - 0x54]
push eax
push ecx
mov ecx, edi
call fcn.00401c40
inc ebx
cmp ebx, esi
jl 0x4011e0
mov esi, dword [ebp - 0x64]
cmp esi, 3
jge 0x401216
mov ebx, 3
sub ebx, esi
push 0x3d
push ecx
mov ecx, edi
call fcn.00401c40
sub ebx, 1
jne 0x401207
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409cd3
mov esp, ebp
pop ebp
ret
Function at 0x401240
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x42400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor bl, bl
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
push 0xf0000000
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x14]
push 0x18
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
push 0
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x3c]
push 0
push eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4013f7
mov eax, dword [ebp - 0x38]
mov ecx, 0x20
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0x208
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
mov eax, dword [eax]
cmp eax, ecx
movups xmmword [ebp - 0x24], xmm0
cmovb ecx, eax
lea eax, [ebp - 0x24]
push ecx
push esi
push eax
movups xmmword [ebp - 0x14], xmm0
call fcn.0041a6e0
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push 1
push 0
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x4013e7
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 1
push eax
push 4
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x4013d9
push 0
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x38], 0
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x4c], 4
push eax
push 8
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
je 0x4013d9
mov eax, dword [ebp - 0x38]
shr eax, 3
push eax
push 0
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4013d9
push dword [ebp - 0x38]
push 0
push esi
call fcn.0040c5f0
add esp, 0xc
push 0
push esi
push 1
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push esi
test eax, eax
jne 0x401386
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4013d9
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x50]
mov ecx, esi
mov eax, dword [edi]
cmp eax, dword [esi]
cmovb ecx, edi
mov eax, dword [ecx]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x40]
call fcn.0041a6e0
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push dword [edi]
push eax
push dword [ebp - 0x40]
push 0
push 0
push 0
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x4013d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4013d9
mov eax, dword [ebp - 0x44]
mov bl, 1
mov dword [edi], eax
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4013e7
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4013f7
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409cd3
mov esp, ebp
pop ebp
ret 0x18
Function at 0x402120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402139
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402176
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402172
nop word [eax + eax]
cmp esi, edx
jae 0x402176
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x402160
cmp esi, edx
jb 0x40217d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402291
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x40226d
cmp eax, 2
jne 0x40227f
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x40228d
test eax, eax
je 0x40228a
cmp byte [eax + esi - 1], 0
je 0x40228d
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x404810
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b350
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x42400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
call fcn.00402fe0
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
lea eax, [ebp + 8]
mov dword [ebp - 0x14], ecx
push eax
call fcn.00406650
push ecx
mov byte [ebp - 4], 1
lea eax, [esi + 0x34]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x18], ecx
call fcn.00406650
push ecx
mov ecx, esp
mov byte [ebp - 4], 2
lea eax, [esi + 0x30]
mov dword [ebp - 0x18], ecx
push eax
call fcn.00406650
mov ecx, esi
mov byte [ebp - 4], 0
call fcn.00405b50
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
lea eax, [esi + 0x48]
mov dword [ebp - 0x14], ecx
push eax
call fcn.00406650
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
lea eax, [esi + 0x44]
mov dword [ebp - 0x14], ecx
push eax
call fcn.00406650
mov ecx, esi
mov byte [ebp - 4], 0
call fcn.00405c80
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4048de
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4048f0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b3a0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
call fcn.00402fe0
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
lea eax, [ebp + 8]
mov dword [ebp - 0x24], 0x776f6853
push eax
mov dword [ebp - 0x19], 0x656d6f63
mov byte [ebp - 0x15], 0
mov word [ebp - 0x1e], 0x7362
mov word [ebp - 0x1b], 0x6c65
mov word [ebp - 0x20], 0x6154
mov byte [ebp - 0x1c], 0x57
mov dword [ebp - 0x28], ecx
call fcn.00406650
push ecx
mov byte [ebp - 4], 1
lea eax, [edi + 0x34]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
mov dword [ebp - 0x2c], ecx
call fcn.00406650
push ecx
mov ecx, esp
mov byte [ebp - 4], 2
lea eax, [edi + 0x30]
mov dword [ebp - 0x2c], ecx
push eax
call fcn.00406650
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00405b50
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea eax, [edi + 0x3c]
mov dword [ebp - 0x28], ecx
push eax
call fcn.00406650
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
lea esi, [edi + 0x38]
mov dword [ebp - 0x28], ecx
push esi
call fcn.00406650
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00405c80
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea eax, [edi + 0x40]
mov dword [ebp - 0x28], ecx
push eax
call fcn.00406650
push ecx
mov ecx, esp
mov byte [ebp - 4], 4
push esi
mov dword [ebp - 0x28], ecx
call fcn.00406650
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00405c80
push 0
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], esp
mov ecx, esp
push eax
call fcn.004063a0
push ecx
mov ecx, esp
mov byte [ebp - 4], 5
push esi
mov dword [ebp - 0x28], ecx
call fcn.00406650
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00405c80
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404a45
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409cd3
mov esp, ebp
pop ebp
ret 4
Function at 0x4056f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x42400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x105
lea eax, [ebp - 0x150]
push 0
push eax
call fcn.0040c5f0
add esp, 0xc
mov dword [ebp - 0x158], 0x104
lea eax, [ebp - 0x154]
mov word [ebp - 0x24], 0x4d5c
xor esi, esi
mov dword [ebp - 0x11], 0x70784520
mov dword [ebp - 0x160], esi
push eax
push 1
push esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x15c], esi
push eax
push 0x80000002
mov dword [ebp - 0x21], 0x736f7263
mov dword [ebp - 0x2c], 0x54464f53
mov dword [ebp - 0xc], 0x7265726f
mov dword [ebp - 0x1b], 0x6e495c74
mov byte [ebp - 8], 0
mov dword [ebp - 0x15], 0x74656e72
mov word [ebp - 0x27], 0x5241
mov word [ebp - 0x17], 0x6574
mov byte [ebp - 0x28], 0x57
mov word [ebp - 0x1d], 0x666f
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0xd], 0x6c
mov dword [ebp - 0x154], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x405846
mov esi, dword [ebp - 0x154]
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x164], esi
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x160], 0
push eax
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x35], 0x6e6f69
mov dword [ebp - 0x3c], 0x56637673
mov word [ebp - 0x38], 0x7265
mov byte [ebp - 0x36], 0x73
call fcn.00402230
test eax, eax
je 0x40583d
lea eax, [ebp - 0x158]
mov word [ebp - 0x48], 0x6556
push eax
lea eax, [ebp - 0x150]
mov word [ebp - 0x45], 0x6973
push eax
lea eax, [ebp - 0x48]
mov word [ebp - 0x42], 0x6e
push eax
lea ecx, [ebp - 0x164]
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x43], 0x6f
call fcn.00402230
test esi, esi
je 0x405846
push esi
call ebx
xor esi, esi
push 0x421814
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov edi, eax
test edi, edi
je 0x405909
xor eax, eax
mov byte [ebp - 0x154], 0
mov word [ebp - 0x153], ax
mov ecx, edi
mov byte [ebp - 0x151], al
lea eax, [ebp - 0x150]
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.0041a6e0
lea eax, [ebp - 0x154]
push eax
call fcn.0040f24e
add esp, 0x10
mov dword [ebp - 0x158], eax
inc edi
mov dword [ebp - 0x154], 0
push 0x421814
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x4058df
sub eax, edi
push eax
lea eax, [ebp - 0x154]
push edi
push eax
call fcn.0041a6e0
lea eax, [ebp - 0x154]
push eax
call fcn.0040f24e
add esp, 0x10
xor ebx, ebx
cmp dword [ebp - 0x158], 0xb
setl bl
test esi, esi
je 0x4058f6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409cd3
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x405910
push esi
call ebx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409cd3
mov esp, ebp
pop ebp
ret
Function at 0x405930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b60d
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
mov eax, dword [0x42400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x160], edi
mov dword [ebp - 4], 0
push 0x421818
mov dword [ebp - 0x178], edi
mov dword [ebp - 0x174], 0
call fcn.004063a0
push 0x105
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x174], 1
push 0
push eax
call fcn.0040c5f0
xor esi, esi
mov dword [ebp - 0x160], 0x104
add esp, 0xc
mov dword [ebp - 0x170], esi
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x168], esi
mov dword [ebp - 4], 1
lea eax, [ebp - 0x164]
push eax
push 1
push esi
lea eax, [ebp - 0x38]
mov word [ebp - 0x21], 0x6e72
push eax
push 0x80000002
mov word [ebp - 0x2d], 0x7263
mov word [ebp - 0x38], 0x4f53
mov dword [ebp - 0x35], 0x52415754
mov dword [ebp - 0x26], 0x746e495c
mov dword [ebp - 0x1e], 0x78452074
mov word [ebp - 0x30], 0x4d5c
mov dword [ebp - 0x17], 0x726572
mov word [ebp - 0x28], 0x7466
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x2e], 0x69
mov word [ebp - 0x2b], 0x736f
mov word [ebp - 0x1a], 0x6c70
mov byte [ebp - 0x31], 0x45
mov byte [ebp - 0x36], 0x46
mov byte [ebp - 0x29], 0x6f
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x1f], 0x65
mov dword [ebp - 0x164], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405af4
mov esi, dword [ebp - 0x164]
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x16c], eax
mov byte [ebp - 0x3e], al
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x170], esi
push eax
lea eax, [ebp - 0x48]
mov word [ebp - 0x47], 0x6376
push eax
mov dword [ebp - 0x44], 0x69737265
mov byte [ebp - 0x45], 0x56
mov byte [ebp - 0x48], 0x73
mov word [ebp - 0x40], 0x6e6f
call fcn.00402230
test eax, eax
je 0x405ad7
lea eax, [ebp - 0x160]
mov dword [ebp - 0x53], 0x69737265
push eax
lea eax, [ebp - 0x15c]
mov word [ebp - 0x4e], 0x6e
push eax
lea eax, [ebp - 0x54]
mov byte [ebp - 0x54], 0x56
push eax
lea ecx, [ebp - 0x170]
mov byte [ebp - 0x4f], 0x6f
call fcn.00402230
test esi, esi
je 0x405aea
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x170], esi
mov dword [ebp - 0x16c], 0
push 0x421814
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x405b1f
lea eax, [ebp - 0x15c]
push eax
push 0x421810
push edi
call fcn.00406a00
add esp, 0xc
test esi, esi
je 0x405b2a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409cd3
mov esp, ebp
pop ebp
ret