joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b1c0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x50c430
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x42b24c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x42b24c
cmp ebx, 0x15f90
jl 0x42b243
cmp ebx, 0x1d4c0
jge 0x42b220
mov eax, 0x32
jmp 0x42b245
cmp ebx, 0x2bf20
jge 0x42b22f
mov eax, 0x64
jmp 0x42b245
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x42b245
mov eax, 0xfa
jmp 0x42b245
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x42b260
inc ebx
cmp ebx, 0x57e40
jl 0x42b1d8
mov eax, dword [ebp - 4]
test eax, eax
je 0x42b27a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.00448ba0
add esp, 4
mov eax, dword [0x50c434]
test eax, eax
jne 0x42b2b0
cmp dword [0x509380], 1
je 0x42b334
xor ebx, ebx
xor esi, esi
cmp dword [0x50c42c], 0
je 0x42b2f4
mov dword [0x50c434], 1
cmp dword [0x509380], 1
je 0x42b2df
mov dword [0x50c430], 0
push dword [0x50c428]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42b352
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.0047ff60
push ebx
push 0x16
call fcn.0047ff60
add esp, 0x10
jmp 0x42b2b0
mov dword [0x50c42c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x50c428], eax
cmp eax, 0xffffffff
jne 0x42b318
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x42b29d
push 0x42b150
call fcn.00480980
push 0x42b110
call fcn.00480980
add esp, 8
jmp 0x42b29d
push 1
push 2
call fcn.0047ff60
mov esi, eax
push 1
push 0x16
call fcn.0047ff60
add esp, 0x10
mov ebx, eax
jmp 0x42b294
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.0042a770
add esp, 0xc
test eax, eax
je 0x42b37c
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x5092dc]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x5092d8]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x5092d4]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x5092d0]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x42b384
push dword [ebp - 0x10]
push dword [0x50c428]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x10]
jmp 0x42b2ce
Function at 0x42b3d0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x50c430
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x42b45c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x42b45c
cmp ebx, 0x15f90
jl 0x42b453
cmp ebx, 0x1d4c0
jge 0x42b430
mov eax, 0x32
jmp 0x42b455
cmp ebx, 0x2bf20
jge 0x42b43f
mov eax, 0x64
jmp 0x42b455
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x42b455
mov eax, 0xfa
jmp 0x42b455
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x42b470
inc ebx
cmp ebx, 0x57e40
jl 0x42b3e8
mov eax, dword [ebp - 4]
test eax, eax
je 0x42b48a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.00448ba0
add esp, 4
mov eax, dword [0x50c434]
test eax, eax
jne 0x42b4c0
cmp dword [0x509380], 1
je 0x42b559
xor ebx, ebx
xor esi, esi
cmp dword [0x50c42c], 0
je 0x42b516
mov dword [0x50c434], 1
cmp dword [0x509380], 1
je 0x42b501
mov dword [0x50c430], 0
push dword [0x50c428]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x42b597
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp dword [0x509380], 1
je 0x42b577
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.0047ff60
push ebx
push 0x16
call fcn.0047ff60
add esp, 0x10
jmp 0x42b4c0
mov dword [0x50c42c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x50c428], eax
cmp eax, 0xffffffff
jne 0x42b53d
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x42b4ad
push 0x42b150
call fcn.00480980
push 0x42b110
call fcn.00480980
add esp, 8
jmp 0x42b4ad
push 1
push 2
call fcn.0047ff60
mov esi, eax
push 1
push 0x16
call fcn.0047ff60
add esp, 0x10
mov ebx, eax
jmp 0x42b4a4
push 1
push 2
call fcn.0047ff60
push 1
push 0x16
mov dword [ebx + 0x64], eax
call fcn.0047ff60
add esp, 0x10
mov dword [ebx + 0x68], eax
jmp 0x42b4f5
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.0042a770
add esp, 0xc
test eax, eax
je 0x42b5be
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x5092dc]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x5092d8]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x5092d4]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x5092d0]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x42b5c6
push dword [ebp - 0x10]
push dword [0x50c428]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp - 0x10]
jmp 0x42b4e3
Function at 0x4353e0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x436250
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp eax, 0xfffffffa
mov dword [ebp - 0x10], ebx
mov ebx, ecx
lea ecx, [eax + 5]
jg 0x436265
mov ecx, eax
mov dword [ebp - 4], eax
mov eax, 0xfb93e673
mov dword [ebp - 8], esi
mov esi, edx
mul ecx
shr edx, 9
mov dword [ebp - 0xc], edi
imul edi, edx, 0x209
sub ecx, edi
mov edi, dword [0x509380]
cmp edi, 2
lea eax, [ecx + 0x69]
mov dword [esi], eax
jge 0x4362c1
lea ecx, [ecx*4 + 0x1a4]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [edx + 0x50c464]
test ecx, ecx
jne 0x43634a
mov dword [edx + 0x50c464], 1
mov eax, dword [esi]
jmp 0x43634a
lea eax, [ecx*4 + 0x1a4]
lea edx, [eax*8]
sub edx, eax
lea ecx, [edx + 0x50c464]
push ecx
call fcn.0042b660
add esp, 4
test eax, eax
jne 0x436342
mov edx, dword [esi]
lea eax, [edx*4]
shl edx, 5
sub edx, eax
cmp dword [edx + 0x50c460], 0
je 0x4363ba
mov dword [edx + 0x50c464], 0
mov edx, dword [esi]
push 0xffffffffffffffff
lea eax, [edx*4]
shl edx, 5
sub edx, eax
push dword [edx + 0x50c460]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi]
lea eax, [edx*4]
shl edx, 5
sub edx, eax
lea ecx, [edx + 0x50c464]
push ecx
call fcn.0042b660
add esp, 4
mov edi, dword [0x509380]
mov eax, dword [esi]
cmp edi, 1
je 0x43639b
mov edx, dword [ebp + 0x14]
lea ecx, [eax*4]
shl eax, 5
sub eax, ecx
mov ecx, dword [eax + 0x50c478]
xor eax, eax
mov dword [ebx], ecx
test ecx, ecx
je 0x436393
mov esi, dword [ebp - 4]
cmp esi, dword [ecx + 0x100]
jbe 0x436382
mov eax, ecx
mov ecx, dword [ecx + 0x28]
test ecx, ecx
mov dword [ebx], ecx
jne 0x43636f
mov dword [edx], eax
xor eax, eax
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
mov dword [edx], 0
jmp 0x436384
lea edx, [eax*4]
shl eax, 5
sub eax, edx
lea eax, [eax + 0x50c470]
push eax
call fcn.0042b610
add esp, 4
mov eax, dword [esi]
jmp 0x43634f
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [esi]
lea edx, [ecx*4]
shl ecx, 5
sub ecx, edx
mov dword [ecx + 0x50c460], eax
mov dword [ecx + 0x50c464], 0
jmp 0x436309
Function at 0x437910
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x445ba0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]

Function at 0x445bac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ecx], 0
cmp dword [0x516200], 0
je 0x445c81
cmp dword [ebp + 0x20], 2
je 0x445be3
cmp dword [ebp + 0x20], 1
jne 0x445bf2
mov eax, 0xffffffff
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x445c02
cmp dword [ebp + 0x20], 0xfffffffa
je 0x445d46
cmp dword [ebp + 0x20], 0
je 0x445d52
xor ecx, ecx
cmp dword [ebp + 0x18], 0
je 0x445c35
cmp dword [ebp + 0x1c], 0
je 0x445c35
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.004cdc00
push edi
call fcn.004cdd70
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x445c81
push edi
push esi
push ebx
call fcn.004cdca0
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [eax], esi
je 0x445d76
push 0
push edi
push 2
push 0x4ea250
call fcn.004cdc60
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, 1
mov byte [esi + ebx], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc dword [edx]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov edx, dword [ebp - 0x10]
mov dword [edi], 0
je 0x445ca9
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x445cae
mov edi, 0x20000
cmp esi, edi
jbe 0x445d22
cmp dword [ebp + 0x20], 0
je 0x445d22
test ecx, ecx
je 0x445cc6
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x445ccb
mov edi, 0x20000
mov dword [ebp - 0x10], edx
push 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x445d10
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
add ebx, edx
sub esi, edx
add dword [ecx], edx
cmp dword [ebp + 0x24], 0
je 0x445d05
mov edx, dword [ebp + 0x24]
mov edx, dword [edx + 0x13c]
test edx, edx
jne 0x445d0a
mov edx, 0x20000
cmp esi, edx
ja 0x445d10
mov edi, esi
test esi, esi
je 0x445d39
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x445d39
test eax, eax
jne 0x445cce
jmp 0x445d39
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, edx
mov ecx, 1
jmp 0x445c14
mov dword [ebp - 0x10], edx
call fcn.004cde90
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x516200], 0
je 0x445c39
mov ecx, 1
jmp 0x445c0e
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4489d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x7c]
test esi, esi
mov dword [ebp - 0xc], edi
je 0x448b8c
mov edx, dword [0x509380]
mov edi, dword [esi + 0x14]
lea eax, [edi*4]
shl edi, 5
sub edi, eax
cmp edx, 2
lea ebx, [edi + 0x5109a8]
jge 0x448a1f
mov eax, dword [ebx]
test eax, eax
jne 0x448a60
mov dword [edi + 0x5109a8], 1
jmp 0x448a60
push ebx
call fcn.0042b660
add esp, 4
test eax, eax
jne 0x448a5a
cmp dword [edi + 0x5109a4], 0
je 0x448b6c
mov dword [edi + 0x5109a8], 0
push 0xffffffffffffffff
push dword [edi + 0x5109a4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.0042b660
add esp, 4
mov edx, dword [0x509380]
cmp edx, 1
je 0x448b58
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x448acf
mov eax, dword [0x509380]
cmp eax, 1
je 0x448ab4
cmp eax, 2
jge 0x448a8f
mov dword [edi + 0x5109a8], 0
jmp 0x448aa5
mov dword [edi + 0x5109a8], 0
push dword [edi + 0x5109a4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push dword [edi + 0x5109b8]
push dword [edi + 0x5109b4]
call fcn.0042b640
add esp, 8
mov eax, dword [0x509380]
jmp 0x448a7e
mov edx, dword [esi]
test edx, edx
je 0x448adb
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x448ae6
mov dword [eax], edx
jmp 0x448aec
mov dword [edi + 0x5109a0], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x7c], 0
mov eax, dword [0x509380]
cmp eax, 1
je 0x448b3d
cmp eax, 2
jge 0x448b11
mov dword [edi + 0x5109a8], 0
jmp 0x448b27
mov dword [edi + 0x5109a8], 0
push dword [edi + 0x5109a4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.0042a830
push esi
call fcn.0042a830
add esp, 8
jmp 0x448aa5
push dword [edi + 0x5109b8]
push dword [edi + 0x5109b4]
call fcn.0042b640
add esp, 8
mov eax, dword [0x509380]
jmp 0x448b00
lea eax, [edi + 0x5109b4]
push eax
call fcn.0042b610
add esp, 4
jmp 0x448a69
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x5109a4], eax
mov dword [edi + 0x5109a8], 0
jmp 0x448a43
xor eax, eax
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x448ba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.0043bfc0
mov ebx, dword [ebp + 8]
cmp dword [0x516200], 0
jne 0x448bc7
test ebx, ebx
je 0x448bbc
mov eax, dword [ebx]
jmp 0x448bbe
xor eax, eax
push eax
call fcn.0047ab40
add esp, 4
test ebx, ebx
je 0x448bcf
mov eax, dword [ebx]
jmp 0x448bd1
xor eax, eax
push eax
call fcn.004cde50
add esp, 4
jmp 0x448bb4
Function at 0x496420
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x509ac0]
jne 0x49642a
repz ret
jmp fcn.004a88e0
Function at 0x414673
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov dword [ebp - 0x314], 0x100
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x318], 8
cmp dword [0x450c90], 1
jne 0x41475d
mov dword [0x450c90], 0
lea ecx, [ebp - 0x30c]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x304]
push eax
mov ecx, dword [0x457dac]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x414758
mov eax, dword [0x457dac]
add eax, 1
mov dword [0x457dac], eax
push 0x457da8
push 0x20019
push 0
lea ecx, [ebp - 0x304]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x414758
lea eax, [ebp - 0x304]
push eax
call fcn.00414d5e
add esp, 4
lea ecx, [ebp - 0x304]
push ecx
push 0x450cb8
mov edx, dword [ebp + 0x10]
push edx
call fcn.004173b0
add esp, 0xc
mov dword [ebp - 0x318], 0
jmp 0x4148cb
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x100]
push ecx
push 0
push 0
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [0x457db0]
push ecx
mov edx, dword [0x457da8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x4147db
mov eax, dword [0x457db0]
add eax, 1
mov dword [0x457db0], eax
lea ecx, [ebp - 0x100]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0x450cc0
mov eax, dword [ebp + 0x10]
push eax
call fcn.004173b0
add esp, 0x10
mov dword [ebp - 0x318], 0
jmp 0x4148cb
cmp dword [ebp - 0x104], 0x103
jne 0x4148cb
mov dword [0x457db0], 0
mov dword [ebp - 0x310], 0x100
mov ecx, dword [0x457da8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x30c]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x304]
push ecx
mov edx, dword [0x457dac]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x4148b5
mov ecx, dword [0x457dac]
add ecx, 1
mov dword [0x457dac], ecx
push 0x457da8
push 0x20019
push 0
lea edx, [ebp - 0x304]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x4148b3
lea ecx, [ebp - 0x304]
push ecx
call fcn.00414d5e
add esp, 4
lea edx, [ebp - 0x304]
push edx
push str.__s_
mov eax, dword [ebp + 0x10]
push eax
call fcn.004173b0
add esp, 0xc
mov dword [ebp - 0x318], 0
jmp 0x4148cb
cmp dword [ebp - 0x104], 0x103
jne 0x4148cb
mov dword [ebp - 0x318], 1
cmp dword [ebp - 0x318], 0
je 0x4148f4
mov dword [0x450c90], 1
mov dword [0x457db0], 0
mov ecx, dword [0x457db0]
mov dword [0x457dac], ecx
mov eax, dword [ebp - 0x318]
mov esp, ebp
pop ebp
ret
Function at 0x420b59
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xfffffc
je 0x420b77
cmp dword [ebp - 0x398], 0
je 0x420d41
cmp dword [ebp + 0xc], 1
je 0x420d41
cmp dword [ebp + 0xc], 8
jne 0x420d09
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
call fcn.0041fe83
insd dword es:[edi], dx
pop ecx
and dword [ecx - 0x80], esp
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.0041fe83
cmc
test al, 0x20
pop ss
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041fe61
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0041fe93
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041fe48
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0041fe83
inc ebx
jmp 0x4aa9396

Function at 0x420b96
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
Function at 0x423586
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], fcn.0040efe0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 4
mov eax, dword [0x459430]
mov dword [ebp - 0x18], eax
push 1
mov ecx, dword [0x459430]
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x28], 0x202b
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x451534
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_RegisterClassA]
and eax, 0xffff
test eax, eax
jne 0x4235f5
xor eax, eax
jmp 0x423626
mov dword [ebp - 0x28], 0x2b
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x451558
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
and eax, 0xffff
test eax, eax
jne 0x423621
xor eax, eax
jmp 0x423626
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x42362a
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], fcn.0040efe0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 4
mov eax, dword [0x459430]
mov dword [ebp - 0x18], eax
push 1
mov ecx, dword [0x459430]
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x28], 0x202b
mov dword [ebp - 8], 0
mov dword [ebp - 4], str.EQNWINCLASS
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_RegisterClassW]
and eax, 0xffff
test eax, eax
jne 0x423699
xor eax, eax
jmp 0x4236ca
mov dword [ebp - 0x28], 0x2b
mov dword [ebp - 8], 0
mov dword [ebp - 4], str.EQNINSITUCLASS
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
and eax, 0xffff
test eax, eax
jne 0x4236c5
xor eax, eax
jmp 0x4236ca
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x423a8d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push esi
push edi
push 0xc8
lea eax, [ebp - 0xc8]
push eax
mov ecx, dword [0x459210]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x423af3
mov edi, 0x4593c6
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
lea eax, [ebp + ecx - 0xc5]
mov edi, eax
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x423af9
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 8], 0
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp + 0x14]
mov dx, word [ebp + 0x10]
mov word [ecx + 0xc], dx
mov eax, dword [ebp + 0xc]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 8], eax
mov edx, dword [ebp + 0x14]
cmp dword [edx + 8], 0
jne 0x424fda
xor eax, eax
jmp 0x425003
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x14]
cmp dword [edx + 4], 0
jne 0x424ffe
xor eax, eax
jmp 0x425003
mov eax, 1
pop ebp
ret

Function at 0x4250e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov word [ebp - 4], ax
movsx ecx, word [ebp - 4]
push ecx
call fcn.00416f5f
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42518d
mov edx, dword [ebp - 0xc]
push edx
call fcn.00417038
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x425181
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x425175
mov dx, word [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00417300
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00417047
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x42518f
mov edx, dword [ebp - 0xc]
push edx
call fcn.00417047
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.0041700c
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret