joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
push esi
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], dl
mov byte [esp + 8], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
push str.SETUP2K.INI
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x110]
push eax
call edi
lea ecx, [esp + 0x10c]
push ecx
call fcn.00401630
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x10c]
lea eax, [esp + 8]
push edx
push 0x104
push eax
push 0x42aa9c
push 0x42620c
push str.Run.Svc
call esi
lea ecx, [esp + 0x10c]
push ecx
push 0x104
push 0x42a788
push str.winlogon.exe
push 0x426200
push str.Role
call esi
lea edx, [esp + 8]
push 0x5c
push edx
call fcn.0041281c
add esp, 8
test eax, eax
jne 0x40176b
lea eax, [esp + 8]
push eax
call fcn.00401630
add esp, 4
jmp 0x401783
lea ecx, [esp + 8]
push 0x5c
push ecx
call fcn.0041281c
add esp, 8
inc eax
lea edx, [esp + 8]
push eax
push edx
call edi
mov ecx, dword [esp + 0x214]
lea eax, [esp + 8]
push eax
push ecx
call edi
pop edi
pop esi
add esp, 0x208
ret
Function at 0x401e20
Capabilities:
Read .ini file

Disassembly:
push 0xff
push str.SvcInitstart
call fcn.004019a0
add esp, 8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.KMConfig.ini
push 0x42a88c
mov dword [0x42a578], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x42a88c
call fcn.00401630
add esp, 4
push 0x42a88c
push 0x104
push 0x42a990
push str.PELDAEMON
push str.ClassName
push str.Daemon
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [0x42a578]
push 0
test eax, eax
push 0
jne 0x401e9e
push 1
call fcn.00401ef0
add esp, 0xc
ret
push 4
call fcn.00401ef0
push 0x42a684
call fcn.004016a0
push 0xff
push str.Before_Wait
call fcn.004019a0
mov eax, dword [0x42a578]
add esp, 0x18
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 1
call fcn.00401ef0
push 0xff
push str.SvcInit_End
call fcn.004019a0
add esp, 0x14
ret

Function at 0x401f90
Capabilities:
Check os version
Print debug messages

Disassembly:
sub esp, 0x9c
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 8]
pop edi
cmp eax, 6
jb 0x401fd8
push str.true
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add esp, 0x9c
ret
push str.FALSE
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 0x9c
ret

Function at 0x41375e
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4219d8
push 0x418f74
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call sym.imp.KERNEL32.dll_GetVersion
nop
xor edx, edx
mov dl, ah
mov dword [0x42b064], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x42b060], ecx
shl ecx, 8
add ecx, edx
mov dword [0x42b05c], ecx
shr eax, 0x10
mov dword [0x42b058], eax
push 0
call fcn.00418f0e
pop ecx
test eax, eax
jne 0x4137c9
push 0x1c
call fcn.00413862
pop ecx
and dword [ebp - 4], 0
call fcn.00418bee
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x42ca64], eax
call fcn.00418abc
mov dword [0x42b030], eax
call fcn.0041886f
call fcn.004187b6
call fcn.00414d4d
mov eax, dword [0x42b074]
mov dword [0x42b078], eax
push eax
push dword [0x42b06c]
push dword [0x42b068]
call fcn.00401080
add esp, 0xc
mov dword [ebp - 0x1c], eax
push eax
call fcn.00414d7a
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call fcn.00418632
pop ecx
pop ecx
ret

Function at 0x41f2cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a540]
jne 0x41f2dd
test ecx, 0xffff0000
jne 0x41f2dd
ret
jmp fcn.0041f2e2
Function at 0x8d0729
Capabilities:
Encode data using xor

Disassembly:
push word [esp + 3]
jmp 0x8d0734
lea esp, [esp + 5]
bswap ebx
mov ebx, dword [esp]
xchg bl, bh
bswap ebx
not bx
jmp 0x8d07b2
push edi
lea edi, [eax*4]
mov edi, 0xa07c3760
push edx
mov edi, ebx
xchg dword [esp], edi
jmp 0x8d07d4
mov bx, word [esp]
lea ebx, [eax + 0xe1]
mov bl, bh
lea ebx, [ebp*4]
mov ebx, 0xa446508
lea esp, [esp + 1]
jmp 0x8d0798
xchg dword [esp], edi
mov word [esp], dx
mov dword [esp], eax
mov al, byte [esp]
setl al
jmp 0x8d0868
pop word [esp]
push word [esp + 1]
pop bx
mov bx, word [esp]
pushal
push dword [esp + 0x20]
jmp 0x8d0948
pop edi
push esp
mov ebx, 0x8431a8e4
mov word [esp], bx
mov ebx, 0xd4a5ba2c
jmp 0x8d07ec
pop eax
mov di, word [esp]
bswap edi
mov bl, byte [esp]
setne bl
mov bl, 0xc
jmp 0x8d080d
setae bh
mov al, 0x84
mov di, bx
mov eax, ecx
mov ax, word [esp]
xchg al, ah
jmp 0x8d0825
mov di, sp
setg al
xchg ah, bl
mov bx, bp
mov di, word [esp]
mov al, byte [esp]
jmp 0x8d083e
xchg byte [esp + 0xe], bl
lea ebx, reloc.WINMM.dll_midiStreamOut
push word [esp + 1]
jmp 0x8d096a
mov ebx, dword [esp + 0x28]
lea esp, [esp + 0x50]
jmp 0x8d0b2f
lea esp, [esp + 2]
and al, 2
cmp ebx, edi
push esp
mov word [esp], bx
call fcn.008d0afb
sal ebp, 1
lea eax, [edx + ebx*4]
std
or al, 0xbc
xor dword [eax], esi
in al, dx
jbe 0x8d0b13
xor edi, edi
sub esp, 0xa
mov word [esp + 2], dx
mov dword [esp + 5], ebp
mov word [esp + 6], sp
jmp 0x8d0b12

Function at 0x9eb4db
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ecx, edi
pop esi
pushal
mov ecx, 0x4d8e5f68
add esp, 0x1d
mov al, 0x86
jmp 0x9eb4f7
rcr ah, 1
not ah
jmp 0x9eb4c0
mov si, word [esp + 0xc]
xchg bx, ax
xchg word [esp + 5], ax
jmp 0x9eb555
sub esp, 0xa
xchg bh, cl
mov word [esp + 4], di
rdtsc
mov ah, byte [esp + 8]
jmp 0x9eb4e1
sub bx, 0xca90
mov byte [esp + 0xb], ah
mov ebp, dword [esp + 3]
shr bh, 3
bsr bp, bp
jmp 0x9eb56a
mov byte [esp + 7], dh
shr ah, 1
not edi
rdtsc
bsf dx, si
jmp 0x9eb523
push word [esp + 0xb]
rdtsc
mov ah, byte [esp + 8]
setns bh
mov edx, ebp
btr ebx, edx
jmp 0x9eb53d
xchg byte [esp + 0xc], bl
xchg word [esp + 1], cx
xchg bx, si
mov dword [esp + 8], eax
mov ch, byte [esp + 0xb]
jmp 0x9eb5ed
mov si, word [esp + 9]
mov dword [esp + 9], ebp
mov byte [esp + 0xb], ch
sub ebx, eax
push esp
call fcn.009eb5c0
mov edi, 0x9f33aa5c
bswap edx
lea edi, reloc.WINMM.dll_midiStreamOut
lea ebp, [ebp*4]
jmp 0x9eb8b6
and ax, 0xbbba
lea ecx, reloc.WINMM.dll_midiStreamOut
sub esp, 0xe
push dword [esp + 1]
jmp 0x9eb6d8
rcr ecx, 0x1f
mov ebx, 0xe16fe8e
cpuid
mov cx, word [esp]
lea esp, [esp]
jmp 0x9eb66c
mov si, 0x8511
lea esi, [esp + esi]
setns ch
sub bl, ah
inc ax
mov bh, byte [esp]
jmp 0x9eb683
mov al, 0x46
mov ax, 0x36a7
ror dh, 7
call 0x9eb6bd
dec edi
mov edi, esi
mov bp, di
not di
jmp 0x9eb74c
mov dword [esp + 4], ecx
xchg word [esp + 9], cx
pop word [esp + 0xa]
lea esp, [esp + 0xe]
mov word [esp], di
cpuid
jmp 0x9eb6ae
mov ax, word [esp + 6]
call fcn.009eb70f
xchg ebp, edx
bsf di, ax
neg bh
inc ecx
rdtsc
lea ecx, [esi + 0x3d]
jmp 0x9eb69b
Function at 0x9ebc9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x41]
bswap eax
sub esp, 0xc
jmp 0x9ebcea
mov byte [esp + 8], dh
mov si, bx
xchg dword [esp + 6], edi
lea edi, [ecx + 0xa3]
cpuid
jmp 0x9ebcc6
Function at 0x9efd3b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
mov dh, 0xc2
pop esi
mov dword [esp], ecx
jmp 0x9efc56
pop word [esp + 9]
mov esi, dword [esp + 4]
xchg edx, eax
mov word [esp + 2], bx
inc eax
jmp 0x9efd15
xchg dh, dl
mov dh, byte [esp + 0x12]
pop word [esp + 0x1a]
mov dh, byte [esp + 0xc]
lea esi, [edi*4]
jmp 0x9efcf0
lea edx, [esi*4]
pushal
cld
mov dx, 0xdd6f
bsf ax, si
inc ax
jmp 0x9efcbe
lea esp, [esp + 2]
pop edx
bswap edx
mov byte [esp + 1], dh
and dh, bh
lea esi, [ebx + esi]
jmp 0x9efd6f
mov byte [esp + 0x11], dh
pop esi
mov esi, dword [esp + 0x14]
pop dword [esp + 2]
bt esi, edx
xchg word [esp + 0x16], dx
jmp 0x9efcdb
pop esi
cld
push dword [esp + 0xd]
mov dh, 0xb2
cld
call 0x9efd3b
and dword [esi - 9], esp
salc
jmp 0x9efd98
mov dh, ch
bsf ax, si
mov si, sp
mov ax, 0xede1
pop dword [esp + 0x1a]
ror dh, 7
jmp 0x9efd2c
rdtsc
clc
lea eax, [eax*4]
lea edx, [esp + ebx]
xchg dx, ax
xchg dx, ax
jmp 0x9efd55
lea esp, [esp + 0x51]
mov si, di
mov si, 0xfcf3
inc dl
jmp 0x9efdaa
rdtsc
sub esp, 6
inc esi
lea edx, [edi + ebp]
xchg byte [esp + 0xa], al
sub esp, 0x1a
jmp 0x9efd82
mov esi, 0xaafe5ab8
bsf si, ax
not si
stc
bswap eax
jmp 0x9efe62
rol dh, 3
rdtsc
lea esp, [esp + 0xb]
xchg dh, dl
bsf si, ax
bsf si, si
jmp 0x9efe30
rdtsc
push esp
btc edx, edi
lea edx, [eax*4]
mov edx, esi
push dword [esp + 2]
jmp 0x9efdd5
pop dx
sub esp, 0x1c
mov dl, 0xe4
mov dx, 0xf49
mov dx, di
lea edx, [edi*4]
jmp 0x9efe45
not dh
mov byte [esp + 1], bh
lea eax, [eax - 0x41]
xchg dword [esp], eax
xchg dword [esp], edx
pop word [esp]
jmp 0x9efe14
add esp, 5
lea esp, [esp + 0x11]
xchg dword [esp], eax
xchg si, ax
pop dx
xchg dx, si
jmp 0x9efeb9
mov al, 0x66
mov dx, bx
sub dh, ah
inc dl
sub esp, 8
inc esi
jmp 0x9efdff
lea esp, [esp + 6]
xchg byte [esp], al
bswap eax
lea esp, [esp]
lea esp, [esp]
jmp 0x9efe9a
push word [esp]
mov si, word [esp + 5]
mov dword [esp], ebp
push edx
pop eax
not dx
jmp 0x9efe71
bsr dx, bp
mov ax, 0x3101
mov edx, dword [esp]
xchg si, dx
mov eax, ebp
lea edx, [edx + ebx]
jmp 0x9efee6
btr esi, esp
lea esp, [esp + 2]
mov word [esp], dx
neg esi
lea eax, [ebx + edi]
push word [esp + 1]
jmp 0x9efe87
fimul word [ebp - 0x99c4fc]
je 0x9efef1
add ebx, ebp
mov bh, 0x8d
mov al, 0xa9
add byte [eax], al
add byte [edx + 0x4862434], cl
and al, 0xe9
popfd
add byte [eax], al
add bl, ch
add bh, byte [ebp - 0x6a72e074]
push ecx
invalid
lea esi, [eax + 0xa9]
mov dh, byte [esp]
xchg byte [esp], al
jmp 0x9eff7e
lea edx, [ebp - 0xaf]
mov byte [esp], bh
mov al, 0xc6
xchg byte [esp], dh
lea edx, [edx*4]
bswap edx
jmp 0x9efed0
sub esp, 0x1e
rdtsc
pop word [esp + 0x20]
pop esi
jmp 0x9eff2e
lea eax, reloc.WINMM.dll_midiStreamOut
inc eax
pop dword [esp + 5]
btc edx, edi
mov esi, dword [esp + 0xa]
and si, 0xed56
jmp 0x9efeff
mov eax, 0x983931d8
call fcn.009eff5d
or al, 0x88
push ds
jns 0x9efec5
mov byte [0x2fdcb525], al
invalid
mov al, 0x16
lea eax, [eax - 0xe9]
push edx
mov dh, ch
pop dx
mov edx, esi
jmp 0x9eff15
lea esi, [ecx*4]
lea esi, [eax - 0xe1]
xchg edx, eax
sub esp, 0x10
bswap esi
pop esi
jmp 0x9eff4c
Function at 0x9f0161
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr ax, cl
setns ah
btr eax, ebx
mov byte [esp + 0x11], dh
mov esi, ecx
jmp 0x9f0185
lea eax, [eax*4]
mov si, ax
xchg word [esp + 0x19], si
setbe dh
shl si, cl
rdtsc
jmp 0x9f01b6
mov edx, ebx
xchg byte [esp + 1], dl
lea eax, [edx*4]
sub esp, 0x10
pop dword [esp + 0x22]
mov byte [esp], ch
jmp 0x9f01fa
pop dx
lea esp, [esp + 0x15]
sub esp, 0x1e
sub esp, 8
setnp dh
cmc
jmp 0x9f01dd

Function at 0x9f0490
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dh
mov si, word [esp + 0xa]
add esp, 7
push word [esp + 1]
xchg esi, eax
xchg si, ax
lea eax, [edx + edi]
mov eax, dword [esp + 3]
cmc
rdtsc
jmp 0x9f03ed
not ax
ror edx, 0x19
lea edx, [ecx*4]
xchg dh, al
mov dx, word [esp + 7]
mov word [esp + 2], bx
jmp 0x9f041a
xchg edx, eax
lea esp, [esp + 0x20]
mov word [esp + 2], sp
dec edx
jmp 0x9f0437

Function at 0x9f05a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
and dh, bh
rdtsc
neg dx
setle dh
jmp 0x9f065e
sub dh, ah
mov eax, 0x16013960
xchg dh, al
mov eax, edi
xchg si, ax
not dx
jmp 0x9f0670
mov edx, dword [esp + 8]
shr si, cl
mov dh, byte [esp]
pushal
bt esi, edx
rdtsc
jmp 0x9f0645
bsf si, ax
mov al, ah
xchg byte [esp + 8], al
pop dword [esp + 5]
push esp
jmp 0x9f0c36
lea esp, [esp + 0x25]
mov eax, dword [esp + 0x10]
inc dh
setne dh
sub esp, 0xa
jmp 0x9f06e3
mov word [esp + 0x16], sp
sub esp, 0x1e
mov dh, byte [esp + 0x2b]
sub esp, 6
mov dword [esp + 0x23], eax
jmp 0x9f069c
add ax, 0x31b6
lea edx, [ebp*4]
mov si, 0x8371
pushal
mov byte [esp + 0x13], ah
pop edx
jmp 0x9f06b3
bswap eax
push dword [esp + 0x22]
mov dh, byte [esp + 0x1b]
btc eax, ebx
push word [esp + 0x22]
add si, 0x7c26
jmp 0x9f08be
neg esi
mov dh, byte [esp]
mov dh, byte [esp]
adc dx, 0x6114
mov edx, dword [esp]
mov dh, byte [esp]
jmp 0x9f06cc
xchg dh, al
xchg dword [esp + 0x14], edx
mov word [esp + 0x21], di
pushal
lea esp, [esp + 0x47]
lea esi, [ebp*4]
jmp 0x9f070b
mov ax, word [esp + 0x24]
xchg si, dx
push dword [esp + 0x28]
mov byte [esp + 9], ch
not si
bsr ax, bp
call fcn.009f0819
popfd
lea esp, [esp + 4]
jmp 0x9f0a58
pushal
mov byte [esp + 7], bh
call fcn.009f09b2
push word [esp + 5]
lea esp, [esp + 3]
mov dword [esp + 0x18], ebx
call fcn.009f0b08
test dword [edi], esi
dec esi
push word [esp + 1]
mov dword [esp + 1], ebp
mov word [esp + 5], bx
mov dword [esp + 2], ecx
jmp 0x9f0a62
push word [esp + 8]
xchg si, dx
xchg word [esp + 0x19], si
pop edx
mov dh, 0xa0
xchg byte [esp + 0xa], dh
jmp 0x9f0732

Function at 0x9f0bd6
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x9f0b97
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
jmp 0x9f0bb0
Function at 0x40ea90
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5743f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x240
push esi
push edi
push 0x27
mov edi, ecx
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.VWlVZQwYGUMzci2CCcmICTkWsAiUZ9Bjc6RGzA
lea ecx, [ebp - 0x30]
movups xmmword [ebp - 0x30], xmm0
call fcn.0042db40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push str.andw9dTo03MQUaDJAQapGBI
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x34], 0
call fcn.0042db40
push 0x104
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
sub esp, 0x18
lea eax, [ebp - 0x30]
mov ecx, esp
push eax
call fcn.0042ef00
lea ecx, [ebp - 0x14]
call fcn.00445650
add esp, 0x18
push dword [eax]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x14]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40eb7b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x40ebac
mov esi, dword [ebx + 8]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0
push 0x58cfdc
push dword [ebp - 0x18]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
mov dword [edi + 0x110], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x34]
cmp ecx, 8
jb 0x40ebe2
mov edx, dword [ebp - 0x48]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ebd8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ec2d
push ecx
push edx
call fcn.00549ad4
add esp, 8
mov ecx, dword [ebp - 0x1c]
cmp ecx, 8
jb 0x40ec18
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ec0e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ec2d
push ecx
push edx
call fcn.00549ad4
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.0054e9bf
int3
Function at 0x41f290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576075
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
push esi
push edi
push 0x27
mov dword [ebp - 0x28], ecx
xorps xmm0, xmm0
push str.UjFqWVgFeHDCIlvUBgz1DmEp8FyJBWOSI9SQw8
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x44], 0
call fcn.0042db40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push str.OTlEcT0pNmJTtMkSg
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
call fcn.0042db40
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push 0xf003f
push 0
sub esp, 0x18
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x24], 4
mov ecx, esp
mov esi, 3
push eax
call fcn.0042ef00
lea ecx, [ebp - 0x1c]
call fcn.00445650
add esp, 0x18
push dword [eax]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x1c]
or edi, 0xffffffff
mov dword [ebp - 0x20], eax
add edx, 0xfffffff0
mov ecx, edi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x41f37e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x41f3df
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.0042ef00
lea ecx, [ebp - 0x20]
call fcn.00445650
add esp, 0x18
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push dword [eax]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x41f3d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x18]
test eax, eax
cmove esi, dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 0x110], esi
cmp ecx, 8
jb 0x41f41e
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41f414
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f469
push ecx
push edx
call fcn.00549ad4
add esp, 8
mov ecx, dword [ebp - 0x44]
cmp ecx, 8
jb 0x41f454
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41f44a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f469
push ecx
push edx
call fcn.00549ad4
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0054e9bf
int3
Function at 0x425c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5766d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx]
sub ecx, 0x10
call fcn.0042ee10
add eax, 0x10
mov dword [esi + 8], eax
lea edi, [esi + 0x10]
mov dword [edi + 0x24], 0
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0x38]
test ecx, ecx
je 0x425c9d
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.0042ee10
add eax, 0x10
mov dword [esi + 0x38], eax
lea edi, [esi + 4]
mov byte [ebp - 4], 4
push edi
push 0xf003f
push 0
push dword [ebx]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
setne bl
test eax, eax
jne 0x425d50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [esi + 0x38]
push dword [edi]
call ebx
test eax, eax
jne 0x425d23
mov eax, dword [ebp + 0x10]
cmp eax, 3
je 0x425d0b
cmp eax, 4
je 0x425d0b
cmp eax, 0xb
jne 0x425d23
cmp dword [ebp + 0xc], 4
jne 0x425d23
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [esi + 0x38]
push dword [edi]
call ebx
mov ecx, dword [ebp + 0x38]
test ecx, ecx
je 0x425d3b
mov edx, dword [ecx]
lea eax, [ebp + 0x14]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x34
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.emQyRTAgBfVSUJpEEA1BWhNT7P1oKaXThaBC0IpqFAFW
lea ecx, [ebp - 0x38]
call fcn.0042f2a0
push ebx
sub esp, 0x18
mov byte [ebp - 4], 5
lea eax, [ebp - 0x38]
mov ecx, esp
push eax
call fcn.0042ef00
lea ecx, [ebp + 0xc]
call fcn.00445650
add esp, 0x18
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.00405be0
push 0x5bb660
lea eax, [ebp - 0x20]
push eax
call fcn.0054b9da
int3

Function at 0x429f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576a0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.00533197
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x429fab
push eax
push esi
call fcn.00532fd9
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.00532879
int3
Function at 0x435c80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5767a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00549aa4
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00532edc
add esp, 8
mov dword [esi + 4], eax
mov ecx, ebx
mov dword [ebx + 0x34], esi
call fcn.0042ac20
mov eax, ebx
lea esi, [eax + 8]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea edx, [eax + 0x24]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x2c], edx
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x5cde84]
mov dword [eax], 0
mov eax, dword [0x5cde80]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x38], 0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret