joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407da0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x554d31
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5973cc]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ecx
mov dword [esp + 0x14], esi
mov byte [esi + 4], cl
mov dword [esp + 0x3c], ecx
mov edi, dword [eax]
xor eax, eax
mov word [esp + 0x1c], ax
mov eax, edi
mov dword [esp + 0x10], 1
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ecx
lea ebx, [eax + 2]
jmp 0x407e10
mov dx, word [eax]
add eax, 2
cmp dx, cx
jne 0x407e10
sub eax, ebx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x20]
call fcn.00404690
lea ecx, [esp + 0x18]
push esi
push ecx
mov dword [esp + 0x44], 1
call fcn.00407c30
add esp, 8
cmp dword [esp + 0x30], 8
jb 0x407e54
mov edx, dword [esp + 0x1c]
push edx
call fcn.00505cfe
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x4088b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x5973cc]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push 0x208
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.00506190
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x208
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x408954
mov eax, dword [esp + 8]
shr eax, 1
dec eax
cmp eax, 0x104
jae 0x408954
cmp word [esp + eax*2 + 0xc], 0x5c
je 0x40894e
cmp eax, 0x103
jae 0x408954
mov ecx, 0x5c
xor edx, edx
mov word [esp + eax*2 + 0xc], cx
mov word [esp + eax*2 + 0xe], dx
lea eax, [esp + 0xc]
jmp 0x408959
mov eax, 0x571cec
push eax
mov ecx, esi
call fcn.004073f0
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.005060ef
add esp, 0x214
ret
Function at 0x408980
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5555bb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5973cc]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push edi
mov eax, dword [0x5973cc]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebx
cmp edi, 0x23
je 0x4089dc
cmp edi, 0x1a
je 0x4089dc
push 0x571cec
mov ecx, esi
call fcn.00402ac0
jmp 0x408ae9
push 0x206
lea ecx, [esp + 0x32]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x38], ax
call fcn.00506190
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x408a2b
push ebx
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0x571cec
mov ecx, esi
mov word [esi + 4], ax
call fcn.00404690
jmp 0x408ae9
mov edi, 7
xor ecx, ecx
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x408a46
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x18]
call fcn.00404690
push 0x11
push str.360TotalSecurity
lea ecx, [esp + 0x18]
mov dword [esp + 0x248], ebx
call fcn.00406ae0
cmp byte [esp + 0x248], bl
jne 0x408ab5
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
mov ecx, esi
mov word [esi + 4], ax
call fcn.004057f0
cmp dword [esp + 0x28], 8
jb 0x408ae9
mov edx, dword [esp + 0x14]
push edx
call fcn.00505cfe
add esp, 4
jmp 0x408ae9
lea eax, [esp + 0x10]
push eax
call fcn.0041d7f0
add esp, 4
test al, al
je 0x408ad4
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00404640
jmp 0x408ae0
push 0x571cec
mov ecx, esi
call fcn.00402ac0
lea ecx, [esp + 0x10]
call fcn.00402b00
mov eax, esi
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.005060ef
add esp, 0x238
ret
Function at 0x408cc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x555592
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x5973cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push 0x571d60
xor ebx, ebx
push eax
mov dword [esp + 0x28], ebx
push esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebx
call fcn.00406130
add esp, 0xc
mov dword [esp + 0x20], ebx
mov dword [esp + 0xc], 1
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
lea eax, [esp + 0x10]
push eax
call 0x412110
add esp, 4
mov dword [esp + 0x20], 1
mov ecx, dword [eax]
mov eax, ecx
mov dword [esp + 0xc], 3
lea edi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x408d40
sub eax, edi
sar eax, 1
push eax
push ecx
mov ecx, esi
call fcn.00406ae0
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0xc], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408d84
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esi + 0x14], ebx
je 0x408daf
cmp dword [esi + 0x18], 8
jb 0x408d94
mov edi, dword [esi + 4]
jmp 0x408d97
lea edi, [esi + 4]
cmp edi, ebx
je 0x408daf
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408daf
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x18
ret

Function at 0x40bc70
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x5547bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5973cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 1
mov dword [esi], eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
push eax
call fcn.004077a0
add eax, 0x10
mov dword [esi + 4], eax
mov byte [esp + 0x18], 2
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
push eax
call fcn.004077a0
add eax, 0x10
add esp, 8
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 5
jne 0x40bce3
xor eax, eax
jmp 0x40bcf5
mov eax, dword [esp + 0x28]
neg eax
sbb eax, eax
and eax, 0xffffff00
add eax, 0x200
mov dword [esi + 0xc], eax
mov byte [esp + 0x14], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bd1d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bd45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x40bd60
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
lea ecx, [esp + 4]
push ecx
or edx, 1
push edx
push 0
push eax
mov eax, dword [esi]
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bdc4
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, dword [esi + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x40feec
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add ch, bh
add byte [eax], al
push ecx
push ecx
add esp, 4
or ecx, 0x4a72
sub ecx, 0x11cf4
pop ecx
push edx
sub edx, 0xc921
or edx, 0xb072
pop edx
push edi
push edi
add esp, 4
jmp 0x40feac
jmp 0x40feb3
pop edi
mov dword [ebp - 0xab8], 0
push edx
push eax
add esp, 4
xor edx, 0x1af2
sub edx, 0xa1ca
sub edx, 0xe3da
pop edx
push edi
or edi, 0x63cf
call 0x40feec
add byte [0x483b4950], dh
dec esp
dec ecx
cmp eax, 0x4c48333
pop edi
mov byte [ebp - 0x878], 0x45
mov byte [ebp - 0x877], 0x78
mov byte [ebp - 0x876], 0x69
mov byte [ebp - 0x875], 0x74
mov byte [ebp - 0x874], 0x50
mov byte [ebp - 0x873], 0x72
mov byte [ebp - 0x872], 0x6f
mov byte [ebp - 0x871], 0x63
mov byte [ebp - 0x870], 0x65
mov byte [ebp - 0x86f], 0x73
mov byte [ebp - 0x86e], 0x73
mov byte [ebp - 0x86d], 0
push ebx
and ebx, 0x7beb
add ebx, 0xae5a
xor ebx, 0x11847
or ebx, 0xfc00
pop ebx
push eax
push eax
add esp, 4
or eax, 0x8c2e
or eax, 0x159c7
and eax, 0x10793
pop eax
mov ecx, 0x6b
mov word [ebp - 0x1738], cx
mov edx, 0x65
mov word [ebp - 0x1736], dx
mov eax, 0x72
mov word [ebp - 0x1734], ax
mov ecx, 0x6e
mov word [ebp - 0x1732], cx
mov edx, 0x65
mov word [ebp - 0x1730], dx
mov eax, 0x6c
mov word [ebp - 0x172e], ax
mov ecx, 0x33
mov word [ebp - 0x172c], cx
mov edx, 0x32
mov word [ebp - 0x172a], dx
mov eax, 0x2e
mov word [ebp - 0x1728], ax
mov ecx, 0x64
mov word [ebp - 0x1726], cx
mov edx, 0x6c
mov word [ebp - 0x1724], dx
mov eax, 0x6c
mov word [ebp - 0x1722], ax
xor ecx, ecx
mov word [ebp - 0x1720], cx
push esi
push edx
add esp, 4
jmp 0x41001a
pop esi
push eax
push ecx
add esp, 4
xor eax, 0x2e0b
pop eax
push ecx
add ecx, 0x172c9
xor ecx, 0xa53c
and ecx, 0xf921
or ecx, 0xb397
pop ecx
push edx
add edx, 0x3353
or edx, 0x1355
and edx, 0xcbde
sub edx, 0xa14c
pop edx
push eax
push esi
add esp, 4
xor eax, 0xaf53
pop eax
push esi
push esi
add esp, 4
add esi, 0x14509
pop esi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1954], edx
mov eax, dword [ebp - 0x1954]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1958], ecx
mov edx, dword [ebp - 0x1958]
mov dword [ebp - 0x15d8], edx
push ecx
or ecx, 0x9c95
or ecx, 0xae11
pop ecx
push edi
and edi, 0x1437
call 0x4100bd
add byte [eax + 0x39], cl
xor al, 0x4b
inc edi
dec esi
dec ecx
add esp, 4
or edi, 0x10fbc
jmp 0x4100cc
pop edi
cmp dword [ebp - 0x15d8], 0
jne 0x4100e5
mov dword [ebp - 0x31c], 0
jmp 0x4103a1
mov eax, dword [ebp - 0x15d8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc98], edx
push edi
push ecx
add esp, 4
add edi, 0x15ede
or edi, 0xa44e
pop edi
push ecx
sub ecx, 0x1ea2
and ecx, 0x150fb
call 0x410125
add byte [ecx + 0x36], al
dec ebx
dec esi
dec ebx
inc ebx
push eax
dec edx
inc esi
add esp, 4
pop ecx
cmp dword [ebp - 0xc98], 0
jne 0x410141
mov dword [ebp - 0x31c], 0
jmp 0x4103a1
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x504], eax
Function at 0x4100bd
Capabilities:
Get number of processors

Disassembly:
add ch, bh
add byte [eax], al
push ecx
push ecx
add esp, 4
or ecx, 0x4a72
sub ecx, 0x11cf4
pop ecx
push edx
sub edx, 0xc921
or edx, 0xb072
pop edx
push edi
push edi
add esp, 4
jmp 0x40feac
jmp 0x40feb3
pop edi
mov dword [ebp - 0xab8], 0
push edx
push eax
add esp, 4
xor edx, 0x1af2
sub edx, 0xa1ca
sub edx, 0xe3da
pop edx
push edi
or edi, 0x63cf
call 0x40feec
add byte [0x483b4950], dh
dec esp
dec ecx
cmp eax, 0x4c48333
pop edi
mov byte [ebp - 0x878], 0x45
mov byte [ebp - 0x877], 0x78
mov byte [ebp - 0x876], 0x69
mov byte [ebp - 0x875], 0x74
mov byte [ebp - 0x874], 0x50
mov byte [ebp - 0x873], 0x72
mov byte [ebp - 0x872], 0x6f
mov byte [ebp - 0x871], 0x63
mov byte [ebp - 0x870], 0x65
mov byte [ebp - 0x86f], 0x73
mov byte [ebp - 0x86e], 0x73
mov byte [ebp - 0x86d], 0
push ebx
and ebx, 0x7beb
add ebx, 0xae5a
xor ebx, 0x11847
or ebx, 0xfc00
pop ebx
push eax
push eax
add esp, 4
or eax, 0x8c2e
or eax, 0x159c7
and eax, 0x10793
pop eax
mov ecx, 0x6b
mov word [ebp - 0x1738], cx
mov edx, 0x65
mov word [ebp - 0x1736], dx
mov eax, 0x72
mov word [ebp - 0x1734], ax
mov ecx, 0x6e
mov word [ebp - 0x1732], cx
mov edx, 0x65
mov word [ebp - 0x1730], dx
mov eax, 0x6c
mov word [ebp - 0x172e], ax
mov ecx, 0x33
mov word [ebp - 0x172c], cx
mov edx, 0x32
mov word [ebp - 0x172a], dx
mov eax, 0x2e
mov word [ebp - 0x1728], ax
mov ecx, 0x64
mov word [ebp - 0x1726], cx
mov edx, 0x6c
mov word [ebp - 0x1724], dx
mov eax, 0x6c
mov word [ebp - 0x1722], ax
xor ecx, ecx
mov word [ebp - 0x1720], cx
push esi
push edx
add esp, 4
jmp 0x41001a
pop esi
push eax
push ecx
add esp, 4
xor eax, 0x2e0b
pop eax
push ecx
add ecx, 0x172c9
xor ecx, 0xa53c
and ecx, 0xf921
or ecx, 0xb397
pop ecx
push edx
add edx, 0x3353
or edx, 0x1355
and edx, 0xcbde
sub edx, 0xa14c
pop edx
push eax
push esi
add esp, 4
xor eax, 0xaf53
pop eax
push esi
push esi
add esp, 4
add esi, 0x14509
pop esi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1954], edx
mov eax, dword [ebp - 0x1954]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1958], ecx
mov edx, dword [ebp - 0x1958]
mov dword [ebp - 0x15d8], edx
push ecx
or ecx, 0x9c95
or ecx, 0xae11
pop ecx
push edi
and edi, 0x1437
call 0x4100bd
add byte [eax + 0x39], cl
xor al, 0x4b
inc edi
dec esi
dec ecx
add esp, 4
or edi, 0x10fbc
jmp 0x4100cc
pop edi
cmp dword [ebp - 0x15d8], 0
jne 0x4100e5
mov dword [ebp - 0x31c], 0
jmp 0x4103a1
mov eax, dword [ebp - 0x15d8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc98], edx
push edi
push ecx
add esp, 4
add edi, 0x15ede
or edi, 0xa44e
pop edi
push ecx
sub ecx, 0x1ea2
and ecx, 0x150fb
call 0x410125
add byte [ecx + 0x36], al
dec ebx
dec esi
dec ebx
inc ebx
push eax
dec edx
inc esi
add esp, 4
pop ecx
cmp dword [ebp - 0xc98], 0
jne 0x410141
mov dword [ebp - 0x31c], 0
jmp 0x4103a1
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x504], eax
Function at 0x410125
Capabilities:
Get number of processors

Disassembly:
add ch, bh
add byte [eax], al
push ecx
push ecx
add esp, 4
or ecx, 0x4a72
sub ecx, 0x11cf4
pop ecx
push edx
sub edx, 0xc921
or edx, 0xb072
pop edx
push edi
push edi
add esp, 4
jmp 0x40feac
jmp 0x40feb3
pop edi
mov dword [ebp - 0xab8], 0
push edx
push eax
add esp, 4
xor edx, 0x1af2
sub edx, 0xa1ca
sub edx, 0xe3da
pop edx
push edi
or edi, 0x63cf
call 0x40feec
add byte [0x483b4950], dh
dec esp
dec ecx
cmp eax, 0x4c48333
pop edi
mov byte [ebp - 0x878], 0x45
mov byte [ebp - 0x877], 0x78
mov byte [ebp - 0x876], 0x69
mov byte [ebp - 0x875], 0x74
mov byte [ebp - 0x874], 0x50
mov byte [ebp - 0x873], 0x72
mov byte [ebp - 0x872], 0x6f
mov byte [ebp - 0x871], 0x63
mov byte [ebp - 0x870], 0x65
mov byte [ebp - 0x86f], 0x73
mov byte [ebp - 0x86e], 0x73
mov byte [ebp - 0x86d], 0
push ebx
and ebx, 0x7beb
add ebx, 0xae5a
xor ebx, 0x11847
or ebx, 0xfc00
pop ebx
push eax
push eax
add esp, 4
or eax, 0x8c2e
or eax, 0x159c7
and eax, 0x10793
pop eax
mov ecx, 0x6b
mov word [ebp - 0x1738], cx
mov edx, 0x65
mov word [ebp - 0x1736], dx
mov eax, 0x72
mov word [ebp - 0x1734], ax
mov ecx, 0x6e
mov word [ebp - 0x1732], cx
mov edx, 0x65
mov word [ebp - 0x1730], dx
mov eax, 0x6c
mov word [ebp - 0x172e], ax
mov ecx, 0x33
mov word [ebp - 0x172c], cx
mov edx, 0x32
mov word [ebp - 0x172a], dx
mov eax, 0x2e
mov word [ebp - 0x1728], ax
mov ecx, 0x64
mov word [ebp - 0x1726], cx
mov edx, 0x6c
mov word [ebp - 0x1724], dx
mov eax, 0x6c
mov word [ebp - 0x1722], ax
xor ecx, ecx
mov word [ebp - 0x1720], cx
push esi
push edx
add esp, 4
jmp 0x41001a
pop esi
push eax
push ecx
add esp, 4
xor eax, 0x2e0b
pop eax
push ecx
add ecx, 0x172c9
xor ecx, 0xa53c
and ecx, 0xf921
or ecx, 0xb397
pop ecx
push edx
add edx, 0x3353
or edx, 0x1355
and edx, 0xcbde
sub edx, 0xa14c
pop edx
push eax
push esi
add esp, 4
xor eax, 0xaf53
pop eax
push esi
push esi
add esp, 4
add esi, 0x14509
pop esi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1954], edx
mov eax, dword [ebp - 0x1954]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1958], ecx
mov edx, dword [ebp - 0x1958]
mov dword [ebp - 0x15d8], edx
push ecx
or ecx, 0x9c95
or ecx, 0xae11
pop ecx
push edi
and edi, 0x1437
call 0x4100bd
add byte [eax + 0x39], cl
xor al, 0x4b
inc edi
dec esi
dec ecx
add esp, 4
or edi, 0x10fbc
jmp 0x4100cc
pop edi
cmp dword [ebp - 0x15d8], 0
jne 0x4100e5
mov dword [ebp - 0x31c], 0
jmp 0x4103a1
mov eax, dword [ebp - 0x15d8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc98], edx
push edi
push ecx
add esp, 4
add edi, 0x15ede
or edi, 0xa44e
pop edi
push ecx
sub ecx, 0x1ea2
and ecx, 0x150fb
call 0x410125
add byte [ecx + 0x36], al
dec ebx
dec esi
dec ebx
inc ebx
push eax
dec edx
inc esi
add esp, 4
pop ecx
cmp dword [ebp - 0xc98], 0
jne 0x410141
mov dword [ebp - 0x31c], 0
jmp 0x4103a1
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x504], eax
Function at 0x410670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
invalid
invalid
pushal
Function at 0x41152e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x79c], eax
push ecx
push ebx
add esp, 4
and ecx, 0xecba
pop ecx
push edx
push esi
add esp, 4
add edx, 0xaa61
or edx, 0x27ad
add edx, 0xb4f1
xor edx, 0x1191
pop edx
push esi
xor esi, 0x177f7
pop esi
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push esi
push edx
add esp, 4
and esi, 0x14a4b
add esi, 0xb634
add esi, 0x50d4
pop esi
push ecx
xor ecx, 0x74bc
jmp 0x41143c
and ecx, 0x210a
add ecx, 0xa3ce
pop ecx
cmp dword [ebp - 0x3e8], 0
je 0x41145b
cmp dword [ebp - 0xab8], 0
jne 0x4114a1
push edi
push ecx
add esp, 4
jmp 0x411468
and edi, 0xb0e
pop edi
push eax
push eax
add esp, 4
add eax, 0x392c
jmp 0x411480
pop eax
push ecx
push ebx
add esp, 4
or ecx, 0x2d5b
pop ecx
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edx
add edx, 0x6c47
add byte [eax], al
xor edx, 0x371
pop edx
push ecx
push edi
add esp, 4
xor ecx, 0x1725d
call 0x4114d1
add byte [edi + esi], dh
cmp eax, 0x3442403b
add esp, 4
pop ecx
push eax
add eax, 0x8cb0
pop eax
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ebx
push esi
add esp, 4
and ebx, 0xdcb5
and ebx, 0x2723
add ebx, 0x181b3
call 0x41152e
add byte [esi + 0x4f], cl
aaa
inc esi
inc ebp
dec eax
cmp al, 0x45
inc esp
add esp, 4
pop ebx
push edi
xor edi, 0x7343
pop edi
mov byte [ebp - 0x9d4], 0x56
push esi
Function at 0x435ff0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x435ff9
xor ecx, ecx
jne 0x435ff9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x43601a
mov eax, 0xd
jmp 0x436075
xor eax, eax
jne 0x436001
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x43602b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x439fa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
push ecx
call fcn.00451270
add esp, 4
push 9
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
push edx
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esp, ebp
pop ebp
ret
Function at 0x443e60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x544d9f
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5973cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x443e92
xor al, al
jmp 0x443f17
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x443e30
push 0
push 0
call fcn.00509bd6
add esp, 0x18
push eax
lea ecx, [ebp - 0x14]
call fcn.00412690
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004126d0
movzx edx, al
test edx, edx
jne 0x443eeb
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004126a0
mov al, byte [ebp - 0x19]
jmp 0x443f17
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041b240
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x1a], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004126a0
mov al, byte [ebp - 0x1a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x444590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x544f25
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5973cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4c
call fcn.00404670
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0x1c]
push edx
push 0x444790
push 0
push 0
call fcn.00509bd6
add esp, 0x18
push eax
lea ecx, [ebp - 0x14]
call fcn.00412690
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004126d0
movzx eax, al
test eax, eax
jne 0x44462a
push 1
mov ecx, dword [ebp - 0x1c]
call fcn.00445900
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004126a0
mov al, byte [ebp - 0x15]
jmp 0x44465f
mov ecx, dword [ebp - 0x1c]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x14]
call fcn.004458d0
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 8
call fcn.00445920
mov byte [ebp - 0x16], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004126a0
mov al, byte [ebp - 0x16]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x444b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0x55a374
push 0x55a398
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0xc], 1
jne 0x444b84
cmp dword [ebp - 4], 4
jne 0x444b84
mov dword [ebp - 0x14], 1
jmp 0x444b8b
mov dword [ebp - 0x14], 0
mov al, byte [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x445210
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x21
call fcn.00445250
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x445235
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x445242
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4