joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a810
Capabilities:
Get common file path

Disassembly:
sub esp, 0x23c
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 0x104
jbe 0x44a82f
xor eax, eax
mov ecx, dword [esp + 0x240]
lea edx, [esp + eax*2]
push ecx
push str._s.dll
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x23c
ret 4

Function at 0x51b56a
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x2f970eef
or dword [ebx + 0x24], esp
xchg dword [edx], edx
in al, 0x99
cdq
lodsb al, byte [esi]
imul dword [eax]
dec esi
jl 0x51b575
cmp eax, ebx
ficom word [edx + eax*4]
and edi, dword [ecx + 0x74]
jbe 0x51b5c0
add eax, 0x641949ea
invalid
xor al, 0xd1
nop
sbb eax, 0x55758aa6
xchg esi, eax
stc
cld
cmp edi, dword [ecx]
xor dword [ecx + 0x3b], ebp
push ebp
cmp al, 0xa9
sbb esi, dword [edx + 0x2c]
insd dword es:[edi], dx
dec ebx
xor esp, dword [eax - 0x39]
inc ebp
xchg ecx, eax
mov eax, dword [ecx + 8]
and bl, byte [edi - 0x68]
xchg dword [ebp - 0x7d], eax
cld
retf
inc ebp
cmp esp, 0xffffffcb
and ecx, dword [ebp + 0x3998dc37]
ja 0x51b59f
cwde
cmp dword [edi - 0x25], esi
fistp dword [eax - 0x36dd1f0]
cwde
adc byte [esi], ch
xchg edx, eax
cld
je 0x51b5b8
mov dl, 0x77
int 0x4e
mov dl, 0xdf
arpl word [ebp + 0x69], bx
inc edx
inc ebx
sahf
sub bh, dh
push ds
push cs
xchg ecx, eax
and al, 0x1b
push ds
cmp ebx, ebp
pop eax
fmulp st(6)
mov eax, dword [0xee0aa4e7]
popal
jo 0x51b612
jns 0x51b593
lodsb al, byte [esi]
outsb dx, byte [esi]
das
adc bh, ah
mov esp, ebx
invalid
jnp 0x51b5c3
xchg ecx, eax
enter 0x7d32, 2
insd dword es:[edi], dx
mov byte [0xd8b0e839], al
cmp eax, ebp
mov al, 0xd8
sbb dword [ecx], ebx
out 0x66, al
xor ah, 0x4c
das
sar dword [ebx - 0x5c], cl
adc bl, bl
nop
fmul qword [ecx + ecx]
jle 0x51b61b
mov ah, 0x65
pop es
mov ebx, dword [edx - 0x30]
add al, 0xa1
jg 0x51b619
and dword [edx], 0xffffffcc
invalid
Function at 0x57f9a8
Capabilities:
Authenticate hmac

Disassembly:
mov bl, 0xf5
sub byte [0x3caa7c8b], ah
ja 0x57f912
idiv dword [edi]
pop es
add dword [esi], edi
imul eax, dword [edi - 0x2dc21679], 0xffffffb1
pop edi
fstp dword [ebx + 0x27999c64]
xchg ebx, eax
xlatb
sbb dword [eax + 0x6a12c20c], 0xc2c306c5
rcr dword [ebx + 0x46], 1
invalid
loopne 0x57f8b9
xchg edx, eax
enter 0xffffffffffffcd32, 0x53
push eax
mov esi, 0x37a8f6c
xchg edx, eax
rol dword [edx], cl
mov dword [ebp + 0x28], eax
and ch, byte [ebx]
retf
rol byte [ecx], 1
cmp eax, 0x387873c0
into
lea ebx, [edx + 0x34575141]
dec ebx
xorps xmm7, xmmword [ebx - 0x77]
xchg ch, dh
loop 0x57f99e
xor edi, dword [0xbd34dc3d]
adc eax, 0xba01c074
jb 0x57f94a
xor eax, 0x3f90c092
cmpsb byte [esi], byte es:[edi]
ret 0x1de7
mov ebp, 0x2418f016
salc
ret
jae 0x57f8e9
xor dh, byte [eax - 0x4f]
xchg dword [ebp - 0x48], esp
mov ebp, 0x1b547125
imul ebx, ebx, 0x5c
jno 0x57f9b2
sbb ebp, dword [ebx - 0x25]
pop esp
lodsd eax, dword [esi]
push 0x2d1ffcd2
sahf
xor dword [0x4b28932a], ecx
and dword [esi - 0x2d], ebp
sub ebp, esi
mov esi, 0x1cef6a12
jne 0x57f9cc
mov byte [0x82adc77d], al
mov eax, 0xea7e6e7d
outsb dx, byte [esi]
jle 0x57f96f
sal esp, 0xc
and byte [esi], ah
or byte [esi], ah
dec esp
inc ebx
mov dword [eax - 0x1cb64c7e], ecx
sbb eax, 0x1eb12df1
sal bl, 1
and ah, byte [ecx - 0x50]
fisub dword [ecx + 0xf]
jbe 0x57f9e8
popal
mov al, 0xda
popal
pcmpeqd mm0, qword [ebx - 6]
cli
push 0x3585127c
popal
xchg byte [ecx - 0x25ca5e3], cl
jl 0x57f9bc
test dword [0x1d898661], esi
pop edx
mov dword [0x4771cefd], eax
std
into
jno 0x57f9fd
pushfd
sub al, 0x8d
mov byte [0xe21cc36c], al
sbb al, 0xe2
sub al, 0x29
push ebp
and dl, byte [edx + 0xc561c29]
jns 0x57f982
push ebx
test ah, bl
stosd dword es:[edi], eax
or al, 0x36
loopne 0x57f951
mov edx, 0xa6d39fd3
cmpsb byte [esi], byte es:[edi]
js 0x57f9b0
loop 0x57f95c
lcall 0x9182, 0x2cc42ce2
xchg esi, ebx
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
idiv ebx
sti
das
mov ebp, 0xac408980
inc ebx
cdq
add bh, al
push ds
aad 0x5b
jl 0x57f9d5
jno 0x57f994
dec bp
sbb eax, 0x53cd35f4
int 0x53
jb 0x57f9d6
and eax, 0xbe360e6f
pop ecx
imul ecx, dword [eax - 0x169c2420], 0x1f9e93e1
bound ebp, qword [ecx + 0x12]
std
das
dec ebp
loopne 0x57f9e6
arpl dx, bp
movsb byte es:[edi], byte [esi]
loope 0x57fa55
add bl, al
nop
jl 0x57f9ef
invalid
fsub st(6), st(0)
inc ebx
cmp al, 0xb0
mov esp, 0x8227ffb1
call 0xad398426
mov ah, 0x86
mov al, 0x95
mov al, 0xa5
or eax, 0xc82f6a79
lcall 0x5d52, 0x517c115b
adc ah, cl
nop
pop ds
mov bl, 6
dec edx
jg 0x57fa70
jmp 0x175b585a
Function at 0x401060
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x44500c]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x18], esi
cmp word [eax], si
je 0x401099
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, dword [esp + 0x18]
mov edi, eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push esi
mov edx, edi
mov ecx, 0x43d9ec
call section..text
add esp, 8
test al, al
je 0x4010c7
mov eax, dword [esp + 0x10]
inc eax
cmp eax, esi
ja 0x4010c7
mov bl, 1
jmp 0x4010c9
xor bl, bl
lea eax, [esp + 0x10]
mov edx, edi
push eax
push esi
mov ecx, 0x43d9f4
call section..text
mov ecx, dword [esp + 0x18]
add esp, 8
test al, al
je 0x40110d
lea eax, [ecx + 1]
cmp eax, esi
ja 0x40110d
mov bh, 1
mov eax, dword [edi + ecx*4 + 4]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x40112c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
jmp 0x401131
xor bh, bh
test bl, bl
jne 0x4010ef
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041f448
mov esp, ebp
pop ebp
ret 0x10
mov edi, 1
push ecx
xor edx, edx
mov dword [esp + 0x14], 0
lea ecx, [esp + 0x14]
call fcn.004025b0
add esp, 4
test eax, eax
je 0x401162
push ecx
mov edx, 0x2000
lea ecx, [esp + 0x14]
call fcn.004025b0
add esp, 4
test eax, eax
jne 0x401113
mov esi, dword [esp + 0x10]
test bl, bl
je 0x401178
mov edx, dword [esp + 0x14]
mov ecx, esi
push edi
call fcn.00402af0
jmp 0x401188
test bh, bh
je 0x40118b
mov edx, dword [esp + 0x14]
mov ecx, esi
push edi
call fcn.00402d20
add esp, 4
test esi, esi
je 0x4011a3
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
cmp eax, 0x404380
jne 0x4011b9
lea ecx, [esi + 0x18]
call fcn.00410990
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041f448
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
call eax
jmp 0x4011a3
Function at 0x401930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435cf0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004065e0
mov dword [ebp - 4], 0
lea esi, [ebx + 0xb0]
push ebx
push 0x43dcdc
mov ecx, ebx
mov dword [ebx], 0x43e37c
mov dword [ebx + 0xc], 0x43e954
mov dword [ebx + 0x10], 0x43dfe0
mov dword [esi], 0x43e1bc
call fcn.00408fd0
push esi
push 0x43e054
mov ecx, ebx
call fcn.00408fd0
mov dword [ebp - 4], 1
lea edi, [ebx + 0xb8]
mov dword [esi], 0x43e1e4
mov ecx, ebx
lea esi, [ebx + 0xb4]
mov dword [ebx], 0x43e728
push esi
push 0x43e210
mov dword [ebx + 0xc], 0x43e6bc
mov dword [ebx + 0x10], 0x43e8b8
mov dword [esi], 0x43e654
mov dword [edi], 0x43e11c
call fcn.00408fd0
push esi
push 0x43e878
mov ecx, ebx
call fcn.00408fd0
push edi
push 0x43ece0
mov ecx, ebx
call fcn.00408fd0
mov eax, dword [ebx + 0x30]
lea ecx, [ebx + 0x30]
call dword [eax + 0x20]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401a30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435d10
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x44500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x30]
lea ecx, [esi + 0x30]
mov dword [esi], 0x43e728
mov dword [esi + 0xc], 0x43e6bc
mov dword [esi + 0x10], 0x43e8b8
mov dword [esi + 0xb0], 0x43e1e4
mov dword [esi + 0xb4], 0x43e654
mov dword [esi + 0xb8], 0x43e11c
call dword [eax + 0x24]
mov ecx, esi
mov dword [esi], 0x43e37c
mov dword [esi + 0xc], 0x43e954
mov dword [esi + 0x10], 0x43dfe0
mov dword [esi + 0xb0], 0x43e1bc
call fcn.00404b80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
mov eax, dword [0x44500c]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x54]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x14], eax
push edi
mov ebx, edx
mov dword [esp + 0x10], esi
xor ebp, ebp
call fcn.00402220
mov edx, dword [eax]
cmp edx, 0x43dadc
jne 0x402acf
lea edx, [eax + 0xc]
mov eax, dword [edx]
xor ecx, ecx
mov dword [esp + 0x3c], eax
movzx eax, word [edx + 4]
mov word [esp + 0x40], ax
movzx eax, word [edx + 6]
mov word [esp + 0x42], ax
mov al, byte [edx + ecx + 8]
mov byte [esp + ecx + 0x44], al
inc ecx
cmp ecx, 8
jne 0x402954
call fcn.00402400
mov ecx, eax
xor edx, edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x4c], eax
movzx eax, word [ecx + 0x10]
mov word [esp + 0x50], ax
movzx eax, word [ecx + 0x12]
mov word [esp + 0x52], ax
mov al, byte [ecx + edx + 0x14]
mov byte [esp + edx + 0x54], al
inc edx
cmp edx, 8
jne 0x402984
mov eax, dword [esi]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, esi
call dword [eax + 0x40]
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x402a9b
nop dword [eax]
lea eax, [esp + 0x3c]
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], edi
push ecx
mov ecx, esi
mov dword [esp + 0x2c], 0
call dword [eax + 0x44]
mov ebp, eax
test ebp, ebp
jne 0x402a90
mov ecx, dword [esp + 0x34]
push 0x43dcdc
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x38]
push ecx
mov edx, dword [eax]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, eax
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x38], ebp
call dword [edx + 0x44]
mov ebp, eax
test ebp, ebp
jne 0x402a90
mov ecx, dword [esp + 0x38]
push 0x43dfec
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 0x44]
cmp eax, 0x405e40
jne 0x402adb
mov eax, dword [esi + 0x64]
test al, 2
jne 0x402a55
cmp byte [esi + 0x78], 0
jne 0x402a6b
test al, 1
je 0x402a6b
mov ecx, dword [esi + 0x60]
lea eax, [esi + 0x68]
push 0x10
push eax
mov edx, dword [ecx]
call dword [edx + 0x34]
test eax, eax
jne 0x402a6b
mov byte [esi + 0x78], 1
add esi, 0x68
mov ecx, dword [ebx]
cmp ecx, dword [esi]
jne 0x402a8c
mov ecx, dword [ebx + 4]
cmp ecx, dword [esi + 4]
jne 0x402a8c
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 8]
jne 0x402a8c
mov eax, dword [ebx + 0xc]
cmp eax, dword [esi + 0xc]
je 0x402ab0
mov esi, dword [esp + 0x10]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x4029b0
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.0041f448
add esp, 0x50
ret
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [esp + 0x54]
pop ebp
pop ebx
xor ecx, esp
call fcn.0041f448
add esp, 0x50
ret
mov ecx, eax
call dword [edx + 8]
mov edx, eax
jmp 0x40293a
mov ecx, esi
call eax
mov esi, eax
jmp 0x402a6e
Function at 0x403340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435f56
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], 0x43dc84
mov dword [esi + 0xc], 0x43e6dc
mov dword [esi + 0x10], 0x43e6fc
mov dword [esi + 0x18], 0x43e044
mov dword [esi + 0x30], 0x43e12c
mov dword [ebp - 4], 0
mov dword [esi + 0x5c], 0x43f090
mov ecx, dword [esi + 0x60]
mov dword [esi + 0x60], 0
test ecx, ecx
je 0x4033a9
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [esi + 0x30], 0x43dd98
lea ecx, [esi + 4]
mov dword [esi + 0x30], 0x43e404
mov dword [esi + 0x18], 0x43e940
mov dword [esi], 0x43e9f8
mov eax, dword [esi + 4]
push eax
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.00407da0
push dword [esi + 4]
call fcn.0041fb79
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4043e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435f56
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], 0x43e468
mov dword [esi + 0xc], 0x43ea50
mov dword [esi + 0x10], 0x43eb60
mov dword [esi + 0x18], 0x43e690
mov dword [esi + 0x30], 0x43ec00
mov dword [ebp - 4], 0
mov dword [esi + 0x5c], 0x43f090
mov ecx, dword [esi + 0x60]
mov dword [esi + 0x60], 0
test ecx, ecx
je 0x404449
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [esi + 0x30], 0x43dd98
lea ecx, [esi + 4]
mov dword [esi + 0x30], 0x43e404
mov dword [esi + 0x18], 0x43e940
mov dword [esi], 0x43dde4
mov eax, dword [esi + 4]
push eax
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.00407da0
push dword [esi + 4]
call fcn.0041fb79
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404740
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436060
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00407930
mov dword [ebp - 4], 0
mov ecx, ebx
push ebx
push 0x43ef9c
mov dword [ebx], 0x43e4c4
mov dword [ebx + 0xc], 0x43eae8
mov dword [ebx + 0x10], 0x43decc
call fcn.00408f40
mov dword [ebp - 4], 1
lea esi, [ebx + 0x78]
push ebx
push 0x43e33c
mov ecx, ebx
mov dword [ebx], 0x43f1e4
mov dword [ebx + 0xc], 0x43f234
mov dword [ebx + 0x10], 0x43f1d8
mov dword [esi], 0x43dfac
mov dword [ebx + 0x7c], edi
call fcn.00408f40
push esi
push 0x43e210
mov ecx, ebx
call fcn.00408f40
push esi
push 0x43ef8c
mov ecx, ebx
call fcn.00408f40
mov eax, dword [ebx + 0x30]
lea ecx, [ebx + 0x30]
call dword [eax + 0x20]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x405ac0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435f56
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], 0x43f0b4
mov dword [esi + 0xc], 0x43dafc
mov dword [esi + 0x10], 0x43f09c
mov dword [esi + 0x18], 0x43e828
mov dword [esi + 0x30], 0x43e888
mov dword [ebp - 4], 0
mov dword [esi + 0x5c], 0x43f090
mov ecx, dword [esi + 0x60]
mov dword [esi + 0x60], 0
test ecx, ecx
je 0x405b29
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [esi + 0x30], 0x43dd98
lea ecx, [esi + 4]
mov dword [esi + 0x30], 0x43e404
mov dword [esi + 0x18], 0x43e940
mov dword [esi], 0x43dde4
mov eax, dword [esi + 4]
push eax
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.00407da0
push dword [esi + 4]
call fcn.0041fb79
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436348
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00402330
push dword [ebp + 8]
mov ecx, esi
push eax
call fcn.00404740
mov dword [ebp - 4], 0
lea ecx, [esi + 0x30]
mov eax, dword [ecx]
mov dword [esi], 0x43e248
mov dword [esi + 0xc], 0x43e858
mov dword [esi + 0x10], 0x43e84c
mov dword [esi + 0x78], 0x43ea70
call dword [eax + 4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x8c]
mov dword [esi + 0x80], eax
mov eax, esi
mov dword [esi], 0x43e248
mov dword [esi + 0xc], 0x43e858
mov dword [esi + 0x10], 0x43e84c
mov dword [esi + 0x78], 0x43ea70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x408500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4363b0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00408680
mov dword [ebp - 4], 0
mov ecx, ebx
push ebx
push 0x43ef9c
mov dword [ebx], 0x43ded8
mov dword [ebx + 0xc], 0x43dc2c
mov dword [ebx + 0x10], 0x43e4b8
call fcn.00408f40
mov dword [ebp - 4], 1
lea esi, [ebx + 0x7c]
push ebx
push 0x43dfec
mov ecx, ebx
mov dword [ebx], 0x43e534
mov dword [ebx + 0xc], 0x43e708
mov dword [ebx + 0x10], 0x43ea8c
mov dword [esi], 0x43ecc4
mov dword [ebx + 0x80], edi
call fcn.00408f40
push esi
push 0x43e210
mov ecx, ebx
call fcn.00408f40
push esi
push 0x43ef8c
mov ecx, ebx
call fcn.00408f40
mov eax, dword [ebx + 0x30]
lea ecx, [ebx + 0x30]
call dword [eax + 0x20]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x408950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4364c0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00408a20
mov dword [ebp - 4], 0
mov ecx, ebx
push ebx
push 0x43ef9c
mov dword [ebx], 0x43eb08
mov dword [ebx + 0xc], 0x43deac
mov dword [ebx + 0x10], 0x43e1b0
call fcn.00408fd0
mov dword [ebp - 4], 1
lea esi, [ebx + 0x70]
push ebx
push 0x43e944
mov ecx, ebx
mov dword [ebx], 0x43ec30
mov dword [ebx + 0xc], 0x43f070
mov dword [ebx + 0x10], 0x43ecb8
mov dword [esi], 0x43dffc
mov dword [ebx + 0x74], edi
call fcn.00408fd0
push esi
push 0x43e210
mov ecx, ebx
call fcn.00408fd0
push esi
push 0x43ef8c
mov ecx, ebx
call fcn.00408fd0
mov eax, dword [ebx + 0x30]
lea ecx, [ebx + 0x30]
call dword [eax + 0x20]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40b800
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43690c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebx], 0x43f76c
mov dword [ebx + 4], 0
mov dword [ebx + 8], edi
mov eax, dword [edi]
push 0x43ece0
call dword [eax + 4]
mov dword [ebx + 0xc], eax
lea esi, [ebx + 0x18]
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x14], eax
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040afb0
mov dword [esi], eax
lea esi, [ebx + 0x20]
mov dword [ebp - 4], 0
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040ca60
mov dword [esi], eax
lea esi, [ebx + 0x28]
mov byte [ebp - 4], 1
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040ca60
mov dword [esi], eax
lea esi, [ebx + 0x30]
mov byte [ebp - 4], 2
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040ca60
mov dword [esi], eax
mov byte [ebp - 4], 3
mov ecx, edi
mov dword [ebx + 0x38], 0xffffffff
mov eax, dword [edi]
call dword [eax + 0x10]
mov edx, dword [eax]
cmp edx, 0x43edd8
jne 0x40b8f1
mov eax, dword [eax + 0x78]
jmp 0x40b8f9
mov ecx, eax
call dword [edx + 0x88]
shr eax, 1
not al
and al, 1
mov byte [ebx + 0x3c], al
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4128b0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x44500c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, edx
push esi
push edi
push dword [esp + 0x2c]
mov edi, ecx
mov dword [esp + 0x14], eax
push eax
push dword [esp + 0x2c]
push ebp
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov esi, eax
cmp esi, 0x3fd
jne 0x412935
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0x2001f
push 1
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
js 0x412935
push dword [esp + 0x2c]
push dword [esp + 0x14]
push dword [esp + 0x2c]
push 0
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
xor eax, eax
test esi, esi
pop edi
cmovns esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041f448
add esp, 0xc
ret

Function at 0x41b710
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov eax, dword [0x44500c]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
lea eax, [esp + 4]
push ebp
mov ebp, dword [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0x10
push eax
push ebp
push 0xffff
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, 0x490
je 0x41b827
cmp eax, 2
je 0x41b827
test eax, eax
je 0x41b76d
cmp eax, 0xea
jne 0x41b794
push esi
push edi
mov edi, dword [ebp]
call fcn.00419630
mov esi, eax
cmp dword [esi + 8], 0
je 0x41b78d
nop
cmp dword [esi], edi
je 0x41b7a7
add esi, 0x18
cmp dword [esi + 8], 0
jne 0x41b780
pop edi
mov eax, 0xf
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041f448
add esp, 0x18
ret 0xc
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x41b7e6
mov ecx, dword [esi + 8]
push 0x7d
push eax
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
test al, al
jne 0x41b7e6
mov eax, dword [esp + 0x30]
and eax, 0x260
cmp eax, 0x260
jne 0x41b7fd
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [ebp], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041f448
add esp, 0x18
ret 0xc
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041f448
add esp, 0x18
ret 0xc
test byte [esp + 0x28], 0xc0
jne 0x41b846
pop ebp
mov eax, 0xe
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041f448
add esp, 0x18
ret 0xc
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [ebp], 0
pop ebp
pop ebx
xor ecx, esp
call fcn.0041f448
add esp, 0x18
ret 0xc