joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438cc0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x44f788
push edi
mov edx, esi
call fcn.00408230
mov eax, dword [0x44f894]
xor ecx, ecx
test eax, eax
je 0x438d10
mov edx, dword [esi + 0xc]
nop
cmp dword [ecx*4 + 0x44f794], edx
je 0x438cf0
inc ecx
cmp ecx, eax
jb 0x438ce0
jmp 0x438d10
inc ecx
sub eax, ecx
shl eax, 2
push eax
lea eax, [ecx*4 + 0x44f794]
push eax
lea eax, [ecx*4 + 0x44f790]
push eax
call dword [sym.imp.VCRUNTIME140.dll_memmove]
add esp, 0xc
mov dword [esi + 0x10], 1
dec dword [0x44f894]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x438d62
call edi
test eax, eax
je 0x438d3e
call edi
test eax, eax
je 0x438d62
jmp 0x438d43
mov eax, 0xffffe5d4
push eax
push str.SetEvent__
push 0x1f0
push str.PollRemoveWorker
push str._s:_d____s_failed:__d_n
push 0
call fcn.0041dc40
add esp, 0x18
push 0x1388
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x438da8
call edi
test eax, eax
je 0x438d82
call edi
test eax, eax
je 0x438daf
jmp 0x438d87
mov eax, 0xffffe5d4
push eax
push str.WaitForSingleObject__
push 0x1f4
push str.PollRemoveWorker
push str._s:_d____s_failed:__d_n
push 0
call fcn.0041dc40
add esp, 0x18
jmp 0x438daf
cmp eax, 0x102
jne 0x438def
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x438def
call edi
test eax, eax
je 0x438dcb
call edi
test eax, eax
je 0x438def
jmp 0x438dd0
mov eax, 0xffffe5d4
push eax
push str.TerminateThread__
push 0x1fa
push str.PollRemoveWorker
push str._s:_d____s_failed:__d_n
push 0
call fcn.0041dc40
add esp, 0x18
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [esi + 8]
mov dword [esi], 0
test eax, eax
je 0x438e10
push eax
call edi
mov dword [esi + 8], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x438e21
push eax
call edi
mov dword [esi + 0xc], 0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
pop esi
ret

Function at 0x439810
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi], 0xffffffff
je 0x439896
mov eax, dword [ebp + 8]
test eax, eax
je 0x439896
push esi
mov esi, dword [ebp + 0xc]
push 0x10
mov dword [edi + 8], eax
lea eax, [ebp - 0x10]
push ebx
push eax
mov word [edi + 0xc], si
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 8]
call sub.WS2_32.dll_htonl
push esi
mov dword [ebp - 0xc], eax
call sub.WS2_32.dll_htons
push 2
mov word [ebp - 0xe], ax
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [edi]
call sub.WS2_32.dll_connect
pop esi
test eax, eax
je 0x43988a
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x439896
push dword [ebp + 0x10]
mov ecx, edi
call fcn.00439dd4
test eax, eax
je 0x43988f
xor ebx, ebx
inc ebx
jmp 0x439896
mov ecx, edi
call fcn.00439b51
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x439916
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 8], edi
cmp dword [edi], 0xffffffff
je 0x43998c
push ebx
xor eax, eax
xor ebx, ebx
inc eax
cmp dword [ebp + 0x10], ebx
cmovge ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
jle 0x43998b
test ebx, ebx
je 0x43995c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp + 0x10]
sub ecx, eax
mov edi, dword [ebp - 8]
js 0x43998b
jmp 0x43995f
or ecx, 0xffffffff
push ecx
mov ecx, edi
call fcn.00439dae
test eax, eax
je 0x43998b
mov eax, dword [ebp + 0xc]
push 0
sub eax, esi
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
push dword [edi]
call sub.WS2_32.dll_recv
test eax, eax
jle 0x43998b
add esi, eax
cmp esi, dword [ebp + 0xc]
jl 0x439943
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x439996
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x439a08
cmp byte [esi], 0
je 0x439a08
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push str._d._d._d._d
push esi
call fcn.00439e26
add esp, 0x18
cmp eax, 4
jne 0x4399e8
mov eax, 0xff
cmp dword [ebp + 8], eax
ja 0x4399e8
cmp dword [ebp - 4], eax
ja 0x4399e8
cmp dword [ebp - 8], eax
ja 0x4399e8
cmp dword [ebp - 0xc], eax
ja 0x4399e8
push esi
jmp 0x439a0d
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x439a03
mov eax, dword [eax + 0xc]
test eax, eax
je 0x439a03
mov eax, dword [eax]
test eax, eax
je 0x439a03
push dword [eax]
jmp 0x439a13
or eax, 0xffffffff
jmp 0x439a18
push str.127.0.0.1
call sub.WS2_32.dll_inet_addr
push eax
call sub.WS2_32.dll_ntohl
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x439a1f
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 8], edi
cmp dword [edi], 0xffffffff
je 0x439a95
push ebx
xor eax, eax
xor ebx, ebx
inc eax
cmp dword [ebp + 0x10], ebx
cmovge ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
jle 0x439a94
test ebx, ebx
je 0x439a65
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp + 0x10]
sub ecx, eax
mov edi, dword [ebp - 8]
js 0x439a94
jmp 0x439a68
or ecx, 0xffffffff
push ecx
mov ecx, edi
call fcn.00439dd4
test eax, eax
je 0x439a94
mov eax, dword [ebp + 0xc]
push 0
sub eax, esi
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
push dword [edi]
call sub.WS2_32.dll_send
test eax, eax
jle 0x439a94
add esi, eax
cmp esi, dword [ebp + 0xc]
jl 0x439a4c
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x1248781c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x2250530e
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x41111b]
shl eax, 2
mov dword [0x41111f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00406990
pop edx
call fcn.00405d2c
call fcn.00406994
push 0
call fcn.00407640
pop ecx
push 0x4110c4
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x411123], eax
push 0
jmp fcn.0040e224

Function at 0x40583b
Capabilities:
Encode data using base64

Disassembly:
mov al, 0x3e
loopne 0x4057e9
popal
dec edi
shl dword [edx], 0xe7
fst dword [ebx + 0x5b9778c1]
invalid
mov al, 0xec
rcr cl, cl
or eax, 0x6cf66eed
and al, 3
call 0xc251ca0b
in al, 1
inc eax
xchg edi, eax
xlatb
daa
pop es
lodsd eax, dword [si]
in al, 0x3d
invalid
int 0xab
sti
wait
salc
add edi, dword [esi + 0x5d]
sub byte [eax + 0x779ba520], cl
push edi
add dword [ebx], 0x83b4dfdc
inc ebx
or dword [ebp + ecx + 0x37ff25e9], 0xfcc56006
jmp 0x405869
loop 0x40580a
movsb byte es:[edi], byte [esi]
shr dword [ebx + 0x6b], cl
mov byte [0x4be3d73c], al
lea eax, [ecx]
pop ss
mov ch, 0xd9
pop edi
jns 0x4057d7
out 0x3f, al
sub cl, byte [ecx]
outsb dx, byte [esi]
jno 0x405835
fbld tbyte [eax + 2]
or byte [esi + 0x70f9b511], cl
push ss
mov esp, 0x8cb04cce
mov byte [0x227c9777], al
leave
add al, 0xd9
stosd dword es:[edi], eax
push eax
das
in eax, 0x75
retf

Function at 0x406684
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
pop eax
xor byte [edx + 0x2d8401f6], ch
sar byte [ebp - 0x2a6cce44], 1
push es
add eax, 0xda9af39
test dword cs:[edi + edx*2 + 0x4a932b17], eax
sal dword [0xd16bf32e], 1
invalid
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x31aa3ddd
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x42f314
nop
nop
mov ecx, 0x7fad35b5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x43338e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x459744]
jne 0x433398
repz ret
jmp fcn.00437ec8

Function at 0x441447
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004387bf
xor ebx, ebx
cmp dword [0x45ebdc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x44151c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x441487
xor eax, eax
jmp 0x4415e0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x441480
push eax
call fcn.0043875c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45ebdc], eax
call esi
push eax
call fcn.0043875c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45ebe0], eax
call esi
push eax
call fcn.0043875c
mov dword [0x45ebe4], eax
lea eax, [ebp - 8]
push eax
call fcn.0043981d
test eax, eax
pop ecx
pop ecx
je 0x4414ea
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004337ad
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x44151c
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043875c
cmp eax, ebx
pop ecx
mov dword [0x45ebec], eax
je 0x44151c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043875c
pop ecx
mov dword [0x45ebe8], eax
mov eax, dword [0x45ebe8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x441595
cmp dword [0x45ebec], esi
je 0x441595
push eax
call fcn.004387c8
pop ecx
call eax
cmp eax, ebx
je 0x441562
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x45ebec]
call fcn.004387c8
pop ecx
call eax
test eax, eax
je 0x441562
test byte [ebp - 0x18], 1
jne 0x441595
lea eax, [ebp - 0xc]
push eax
call fcn.00439854
test eax, eax
pop ecx
je 0x44157d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004337ad
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x44158c
or dword [ebp + 0x10], 0x200000
jmp 0x4415c6
or dword [ebp + 0x10], 0x40000
jmp 0x4415c6
mov eax, dword [0x45ebe0]
cmp eax, esi
je 0x4415c6
push eax
call fcn.004387c8
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4415c6
mov eax, dword [0x45ebe4]
cmp eax, esi
je 0x4415c6
push dword [ebp - 4]
push eax
call fcn.004387c8
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x45ebdc]
call fcn.004387c8
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x46ec4653
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x24e64316
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x6ebb7f2b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x29736c
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4098b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x417004]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
lea ecx, [ebp - 0x6c]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push ecx
push 0x20019
push ebx
movzx eax, al
push 0x406e10
sub eax, 0x7fffffff
mov dword [ebp - 0x6c], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x409918
push 0x406dcc
mov ecx, esi
call fcn.00409db3
cmp dword [ebp - 0x6c], ebx
je 0x4099c0
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4099c0
push edi
push 0x64
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], ebx
push ebx
push eax
call fcn.0040cf80
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x406db8
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4099a5
mov edi, dword [ebp - 0x74]
test edi, edi
je 0x4099a5
cmp dword [ebp - 0x70], 1
jne 0x4099a5
shr edi, 1
cmp edi, 0x32
jae 0x4099a5
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x406db8
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [edi + edi]
mov edx, eax
cmp word [ebp + ecx - 0x6a], bx
je 0x409996
lea eax, [edi + 1]
cmp eax, 0x32
jae 0x409996
cmp ecx, 0x64
jae 0x4099d2
xor eax, eax
mov word [ebp + ecx - 0x68], ax
lea eax, [ebp - 0x68]
test edx, edx
je 0x4099a2
mov eax, 0x406dcc
push eax
jmp 0x4099aa
push 0x406dcc
mov ecx, esi
call fcn.00409db3
cmp dword [ebp - 0x6c], ebx
je 0x4099bf
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b2a3
leave
ret 8
call fcn.0040b3d3
int3
Function at 0x40c860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040c489
push eax
push esi
push dword [ebp + 8]
call fcn.0040c43e
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040c489
push eax
push esi
push dword [ebp + 8]
call fcn.0040c43e
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040c479
aas
test al, 0x39
cmc
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0040c479
ret 0x4a39

Function at 0x40d36f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
Function at 0x40d38e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040c457
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040c489
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040c43e
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040c479
js 0x40d45b
les edx, [edx + 0x68]
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.0040c479
jns 0x40d451
cli
lahf
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
invalid
inc ebp
invalid

Function at 0x40e2eb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7c5], 0x81
mov byte [ebp - 0x7c4], 0x90
mov byte [ebp - 0x7c3], 0xac
invalid
test dword [esi], edi

Function at 0x416590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4165bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4165bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret