joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48099f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004784ab
mov dword [ebp - 0x14], eax
cmp dword [0x4c464c], esi
jne 0x480a92
push 0x800
push esi
push 0x4afb98
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x480a1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x480b72
push esi
push esi
push 0x4afb98
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x480b72
push 0x4afbb0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x480b72
push eax
call ebx
push 0x4afbbc
push edi
mov dword [0x4c464c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4afbcc
push edi
mov dword [0x4c4650], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4afbe0
push edi
mov dword [0x4c4654], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c465c], eax
test eax, eax
je 0x480a8f
push 0x4afbfc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c4658], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x480ab7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x480aaa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x480acc
push 4
pop eax
jmp 0x480b74
cmp dword [ebp - 0x14], esi
je 0x480acc
push dword [0x4c464c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x480ab1
mov eax, dword [0x4c4658]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x480b2a
cmp dword [0x4c465c], edi
je 0x480b2a
push eax
call ebx
push dword [0x4c465c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x480b2a
test eax, eax
je 0x480b2a
call ecx
test eax, eax
je 0x480b1f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x480b1f
test byte [ebp - 8], 1
jne 0x480b2a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x480b5a
mov eax, dword [0x4c4650]
cmp eax, edi
je 0x480b57
push eax
call ebx
test eax, eax
je 0x480b57
call eax
mov esi, eax
test esi, esi
je 0x480b57
mov eax, dword [0x4c4654]
cmp eax, edi
je 0x480b57
push eax
call ebx
test eax, eax
je 0x480b57
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4c464c]
call ebx
test eax, eax
je 0x480b72
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x480b74
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046f8ce
mov esp, ebp
pop ebp
ret
Function at 0x48e853
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x48e891
mov esp, ebp
pop ebp
ret
Function at 0x40520b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [eax], al
inc esp
cmp esi, dword [esi]
xor esi, 0xc1cc
sub esi, 0x137cc
pop esi
push ebx
or ebx, 0x14f4c
sub ebx, 0x52ba
and ebx, 0x17202
add ebx, 0x1006e
pop ebx
push esi
push ecx
add esp, 4
add esi, 0x124ff
xor esi, 0x82d
or esi, 0x11251
pop esi
push edi
sub edi, 0xfb5e
pop edi
push edx
push ecx
add esp, 4
add edx, 0xec7e
and edx, 0x4f69
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1954], edx
mov eax, dword [ebp - 0x1954]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1958], ecx
mov edx, dword [ebp - 0x1958]
mov dword [ebp - 0x15d8], edx
push esi
push eax
add esp, 4
call 0x40520b
add byte [ecx + 0x4c], cl
aaa
cmp eax, 0x35364f3e
add esp, 4
call 0x40521a
add byte [edi + 0x46], al
cmp byte [ecx + 0x4f], cl
inc edi
add esp, 4
sub esi, 0x15ae9
or esi, 0x89ed
pop esi
cmp dword [ebp - 0x15d8], 0
jne 0x405242
mov dword [ebp - 0x31c], 0
jmp 0x4054fe
add byte [eax], al
mov eax, dword [ebp - 0x15d8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc98], edx
push edi
push eax
add esp, 4
sub edi, 0x7155
jmp 0x405267
or edi, 0x18085
add edi, 0x176b9
pop edi
push eax
push ebx
add esp, 4
xor eax, 0x12aa8
add eax, 0x16c51
pop eax
cmp dword [ebp - 0xc98], 0
jne 0x40529e
mov dword [ebp - 0x31c], 0
jmp 0x4054fe
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x504], eax
push eax
push ecx
add esp, 4
xor eax, 0x2367
add eax, 0x2608
xor eax, 0x1868f
or eax, 0x16071
pop eax
push edx
sub edx, 0xbf9f
sub edx, 0xca78
jmp 0x40552f
pop edx
cmp dword [ebp - 0x31c], 0
jne 0x405e49
mov edx, 0x6b
mov word [ebp - 0x1774], dx
mov eax, 0x65
mov word [ebp - 0x1772], ax
test dword [esi - 0x46000018], ecx
jb 0x405558
add byte [eax], al
Function at 0x40521a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [eax], al
inc esp
cmp esi, dword [esi]
xor esi, 0xc1cc
sub esi, 0x137cc
pop esi
push ebx
or ebx, 0x14f4c
sub ebx, 0x52ba
and ebx, 0x17202
add ebx, 0x1006e
pop ebx
push esi
push ecx
add esp, 4
add esi, 0x124ff
xor esi, 0x82d
or esi, 0x11251
pop esi
push edi
sub edi, 0xfb5e
pop edi
push edx
push ecx
add esp, 4
add edx, 0xec7e
and edx, 0x4f69
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1954], edx
mov eax, dword [ebp - 0x1954]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1958], ecx
mov edx, dword [ebp - 0x1958]
mov dword [ebp - 0x15d8], edx
push esi
push eax
add esp, 4
call 0x40520b
add byte [ecx + 0x4c], cl
aaa
cmp eax, 0x35364f3e
add esp, 4
call 0x40521a
add byte [edi + 0x46], al
cmp byte [ecx + 0x4f], cl
inc edi
add esp, 4
sub esi, 0x15ae9
or esi, 0x89ed
pop esi
cmp dword [ebp - 0x15d8], 0
jne 0x405242
mov dword [ebp - 0x31c], 0
jmp 0x4054fe
add byte [eax], al
mov eax, dword [ebp - 0x15d8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc98], edx
push edi
push eax
add esp, 4
sub edi, 0x7155
jmp 0x405267
or edi, 0x18085
add edi, 0x176b9
pop edi
push eax
push ebx
add esp, 4
xor eax, 0x12aa8
add eax, 0x16c51
pop eax
cmp dword [ebp - 0xc98], 0
jne 0x40529e
mov dword [ebp - 0x31c], 0
jmp 0x4054fe
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x504], eax
push eax
push ecx
add esp, 4
xor eax, 0x2367
add eax, 0x2608
xor eax, 0x1868f
or eax, 0x16071
pop eax
push edx
sub edx, 0xbf9f
sub edx, 0xca78
jmp 0x40552f
pop edx
cmp dword [ebp - 0x31c], 0
jne 0x405e49
mov edx, 0x6b
mov word [ebp - 0x1774], dx
mov eax, 0x65
mov word [ebp - 0x1772], ax
test dword [esi - 0x46000018], ecx
jb 0x405558
add byte [eax], al

Function at 0x40531d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push ecx
add esp, 4
sub esi, 0x1426a
sub esi, 0xdd6b
xor esi, 0x30e3
and esi, 0x958c
pop esi
push esi
or esi, 0x9dd7
and esi, 0x24cd
add esi, 0x6573
pop esi
lea ecx, [ebp - 0x1738]
mov dword [ebp - 0xc94], ecx
mov edx, dword [ebp - 0x504]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc90], eax
xor ecx, ecx
mov word [ebp - 0x210], cx
xor edx, edx
mov word [ebp - 0x10c], dx
push ebx
push edx
add esp, 4
call 0x40531d
add byte [ebx + esi + 0x3e], cl
dec esp
dec edx
cmp eax, 0x8338384b
les eax, [ecx + eax*4]
jmp 0x405321
add byte [ebx - 0x15db6b], cl
dec dword [ecx - 0x15df6b]
inc dword [ebx - 0x15df43]
inc dword [eax]
jne 0x405496
push edi
or edi, 0x43ff
or edi, 0xf832
call fcn.00405472
add byte [ebx + 0x36], al
dec eax
cmp byte [esi + 0x48], cl
cmp byte [ebx], bh
inc esp
push eax
push edx
add esp, 4
add eax, 0x6ba6
or eax, 0x2f59
xor eax, 0xe3f5
pop eax
push ebx
add ebx, 0xabf4
pop ebx
push edi
push edi
add esp, 4
invalid
iretd
xchg dword [edi + 1], edx

Function at 0x405472
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push eax
push edx
add esp, 4
and eax, 0x186a
or eax, 0x3724
pop eax
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x4054fe
Function at 0x405550
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test dword [esi - 0x46000018], ecx
jb 0x405558
add byte [eax], al
mov word [ebp - 0x1770], cx
mov edx, 0x6e
mov word [ebp - 0x176e], dx
mov eax, 0x65
mov word [ebp - 0x176c], ax
mov ecx, 0x6c
mov word [ebp - 0x176a], cx
mov edx, 0x33
mov word [ebp - 0x1768], dx
mov eax, 0x32
mov word [ebp - 0x1766], ax
mov ecx, 0x2e
mov word [ebp - 0x1764], cx
mov edx, 0x64
mov word [ebp - 0x1762], dx
mov eax, 0x6c
mov word [ebp - 0x1760], ax
mov ecx, 0x6c
mov word [ebp - 0x175e], cx
xor edx, edx
mov word [ebp - 0x175c], dx
push edx
xor edx, 0x17f70
call 0x4055ea
add byte [ecx + 0x50], al
inc eax
cmp al, 0x45
dec eax
dec edx
add esp, 4
pop edx
push ecx
add ecx, 0x927
add ecx, 0x1467e
pop ecx
push eax
push ecx
add esp, 4
add al, 0x81
call 0x408ebc
pop eax
mov byte [ebp - 0x894], 0x4c
mov byte [ebp - 0x893], 0x6f
mov byte [ebp - 0x892], 0x61
mov byte [ebp - 0x891], 0x64
mov byte [ebp - 0x890], 0x4c
mov byte [ebp - 0x88f], 0x69
jmp [ecx - 0x3a]
test dword [edx - 9], esi
invalid
jmp dword [edx - 0x3a]
test dword [ebx - 9], esi
invalid
push dword [edx - 0x3a]
test dword [edi + esi*8 - 1], esi
jmp dword [ecx - 0x3a]
test dword [ebp - 9], esi
invalid
push dword [edx - 0x3a]
test dword [esi - 9], esi
invalid
invalid
jns 0x40561c
test dword [edi - 9], esi
invalid
call dword [edi - 0x3a]
test dword [eax - 9], edi
invalid
inc dword [eax]
mov eax, dword fs:[0x18]
mov dword [ebp - 0x195c], eax
mov ecx, dword [ebp - 0x195c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1960], edx
mov eax, dword [ebp - 0x1960]
mov dword [ebp - 0x15e4], eax
push ebx
jmp 0x405691
Function at 0x4055ea
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test dword [esi - 0x46000018], ecx
jb 0x405558
add byte [eax], al
mov word [ebp - 0x1770], cx
mov edx, 0x6e
mov word [ebp - 0x176e], dx
mov eax, 0x65
mov word [ebp - 0x176c], ax
mov ecx, 0x6c
mov word [ebp - 0x176a], cx
mov edx, 0x33
mov word [ebp - 0x1768], dx
mov eax, 0x32
mov word [ebp - 0x1766], ax
mov ecx, 0x2e
mov word [ebp - 0x1764], cx
mov edx, 0x64
mov word [ebp - 0x1762], dx
mov eax, 0x6c
mov word [ebp - 0x1760], ax
mov ecx, 0x6c
mov word [ebp - 0x175e], cx
xor edx, edx
mov word [ebp - 0x175c], dx
push edx
xor edx, 0x17f70
call 0x4055ea
add byte [ecx + 0x50], al
inc eax
cmp al, 0x45
dec eax
dec edx
add esp, 4
pop edx
push ecx
add ecx, 0x927
add ecx, 0x1467e
pop ecx
push eax
push ecx
add esp, 4
add al, 0x81
call 0x408ebc
pop eax
mov byte [ebp - 0x894], 0x4c
mov byte [ebp - 0x893], 0x6f
mov byte [ebp - 0x892], 0x61
mov byte [ebp - 0x891], 0x64
mov byte [ebp - 0x890], 0x4c
mov byte [ebp - 0x88f], 0x69
jmp [ecx - 0x3a]
test dword [edx - 9], esi
invalid
jmp dword [edx - 0x3a]
test dword [ebx - 9], esi
invalid
push dword [edx - 0x3a]
test dword [edi + esi*8 - 1], esi
jmp dword [ecx - 0x3a]
test dword [ebp - 9], esi
invalid
push dword [edx - 0x3a]
test dword [esi - 9], esi
invalid
invalid
jns 0x40561c
test dword [edi - 9], esi
invalid
call dword [edi - 0x3a]
test dword [eax - 9], edi
invalid
inc dword [eax]
mov eax, dword fs:[0x18]
mov dword [ebp - 0x195c], eax
mov ecx, dword [ebp - 0x195c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1960], edx
mov eax, dword [ebp - 0x1960]
mov dword [ebp - 0x15e4], eax
push ebx
jmp 0x405691

Function at 0x405600
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
call 0x408ebc
pop ebx
push ebx
add ebx, 0x16d12
or ebx, 0xfe98
add ebx, 0x166d0
pop ebx
push ebx
jmp 0x4056af
xor ebx, 0x12423
and ebx, 0xccab
pop ebx
cmp dword [ebp - 0x15e4], 0
jne 0x4056d4
mov dword [ebp - 0x750], 0
jmp 0x405990
mov ecx, dword [ebp - 0x15e4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xca4], eax
push edi
add edi, 0x1838f
pop edi
push eax
push esi
add esp, 4
call 0x405702
add byte [edi + 0x36], al
inc edi
cmp cl, byte [edx + 0x36]
cmp byte [edx + edi], bh
add esp, 4
sub eax, 0xf8f9
pop eax
push eax
push ecx
add esp, 4
and eax, 0x5e69
pop eax
cmp dword [ebp - 0xca4], 0
jne 0x405730
mov dword [ebp - 0x750], 0
jmp 0x405990
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0x508], ecx
Function at 0x405702
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
call 0x408ebc
pop ebx
push ebx
add ebx, 0x16d12
or ebx, 0xfe98
add ebx, 0x166d0
pop ebx
push ebx
jmp 0x4056af
xor ebx, 0x12423
and ebx, 0xccab
pop ebx
cmp dword [ebp - 0x15e4], 0
jne 0x4056d4
mov dword [ebp - 0x750], 0
jmp 0x405990
mov ecx, dword [ebp - 0x15e4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xca4], eax
push edi
add edi, 0x1838f
pop edi
push eax
push esi
add esp, 4
call 0x405702
add byte [edi + 0x36], al
inc edi
cmp cl, byte [edx + 0x36]
cmp byte [edx + edi], bh
add esp, 4
sub eax, 0xf8f9
pop eax
push eax
push ecx
add esp, 4
and eax, 0x5e69
pop eax
cmp dword [ebp - 0xca4], 0
jne 0x405730
mov dword [ebp - 0x750], 0
jmp 0x405990
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0x508], ecx
Function at 0x405b20
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x1968], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x196c], ecx
mov dword [ebp - 0x758], 0
jmp 0x405b56
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x758]
cmp ecx, dword [eax + 0x18]
jae 0x405d62
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1964]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x75c], ecx
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1968]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x196c]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1970], eax
mov dword [ebp - 0x198], 0
jmp 0x405bc6
mov ecx, dword [ebp - 0x198]
add ecx, 1
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x198]
movsx eax, byte [edx]
test eax, eax
je 0x405c78
invalid
invalid
invalid

Function at 0x405e71
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jl 0x405deb
add dword [eax], eax
xor edx, 0xd6f9
pop edx
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x405e49
push esi
xor esi, 0xa4b9
xor esi, 0xc8b0
jmp 0x405e1e
pop esi
push ebx
push ebx
add esp, 4
jmp 0x405e2b
pop ebx
push edi
xor edi, 0x164ac
or edi, 0xb372
pop edi
mov dword [ebp - 0x79c], 0
jmp 0x406533
push edi
push ecx
add esp, 4
xor edi, 0x652
or edi, 0x17364
pop edi
push edx
or edx, 0x125b5
call 0x405e71
add byte [ebx + 0x47], al
inc eax
cmp byte [edi + 0x39], cl
inc ebx
dec ebp
xor eax, 0x8104c483
ljmp 0x645a
Function at 0x406260
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [ebx - 0x2f], ch
add byte [ebx - 0x160b7b], cl
dec dword [ebx - 0x7687efb4]
invalid

Function at 0x40654d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ebp, 0xfffff348
add byte [ebp + 0xe], dh
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x406527
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push ebx
sub ebx, 0x8e37
or ebx, 0x113f2
call 0x40654d
add byte [eax], bh
xor eax, 0x374f4e32
dec eax
add esp, 4
sub ebx, 0x11e61
pop ebx
push eax
or eax, 0x161c1
invalid
invalid

Function at 0x40731f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x19b8], edx
lea eax, [ebp - 0x1738]
push eax
call dword [ebp - 0x19b8]
test eax, eax
jne 0x407381
push ebx
push ebx
add esp, 4
sub ebx, 0x137a2
and ebx, 0x1a25
add ebx, 0xc15a
pop ebx
push esi
sub esi, 0x169a8
add esi, 0x6a10
add esi, 0x14ba8
and esi, 0x4868
pop esi
mov dword [ebp - 0xab4], 0
jmp 0x407a6c

Function at 0x41d660
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xe77d928e
add al, 4
mov ss, word [edx + 0x404e77d]
nop
lcall 0x4790, 0x404e77d
xor eax, 0xe7798a8e
add al, 4
nop
xchg edx, eax
jns 0x41d661
add al, 4
mov ss, word [edx + 0x404effd]
pop ebx
invalid
Function at 0x43b210
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4e24e0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0043ede0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0043ee80
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0044557a
add esp, 0x68
ret
Function at 0x43b380
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push 0x20119
xor edi, edi
push edi
push str.SOFTWARE360MachineSignature
push 0x80000002
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43b513
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x20]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x2c]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43b415
cmp dword [esp + 0x18], 1
jne 0x43b4fa
mov eax, dword [esp + 0x14]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x43b4fa
mov eax, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x43b45a
cmp dword [esp + 0x18], 1
jne 0x43b4fa
mov eax, dword [esp + 0x14]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x43b4fa
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x43b491
cmp dword [esp + 0x18], 1
jne 0x43b4fa
mov eax, dword [esp + 0x14]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x43b4fa
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x43b4fa
cmp dword [esp + 0x18], 3
jne 0x43b4fa
mov eax, dword [esp + 0x14]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x43b4fa
lea eax, [esi + 0xc]
call fcn.0043b280
test eax, eax
je 0x43b4fa
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x43e310
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x43e34a
cmp dword [esp + 0x34], esi
je 0x43e34a
push 0x200
call fcn.00445dc6
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x43e355
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e4b5
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
jne 0x43e44a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x43e3ad
mov eax, 0x80000002
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e423
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43e418
mov eax, edi
mov dword [edi], 0x5c2e5c5c
call fcn.0043e280
cmp edx, ebx
jb 0x43e418
ja 0x43e412
cmp eax, dword [esp + 0x24]
jbe 0x43e418
mov dword [esp + 0x24], eax
mov ebx, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
inc esi
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
je 0x43e3a0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
ja 0x43e460
cmp dword [esp + 0x24], 0
jbe 0x43e4b5
mov ecx, dword [esp + 0x24]
push ebx
push ecx
push str._012I64X
push 0x200
call fcn.0043c340
add esp, 0x10
test eax, eax
jne 0x43e499
push edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00445f81
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edi
push edx
push eax
push str.MAC:
call fcn.0043deb0
add esp, 0x10
mov dword [esp + 0x18], eax
push edi
call fcn.00445f81
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret