joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4065da
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x982c
call 0x40638a
add byte [edi], bh
dec ecx
xor bh, byte [edx]
xor esi, dword ss:[0x4c48336]
and edx, 0x46aa
pop edx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ecx
push edi
add esp, 4
or ecx, 0x144cb
or ecx, 0xa0d
pop ecx
push ebx
jmp 0x4063da
call 0x4063e7
add byte [ebp + 0x50], al
dec eax
xor al, 0x41
add esp, 4
xor ebx, 0x13fbb
pop ebx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push eax
push eax
add esp, 4
call 0x40646e
add byte [esi + eax*2 + 0x40], al
cmp bh, byte [0x333f4438]
add esp, 4
add al, 0x58
push edi
and edi, 0xdb9f
and edi, 0x159f
sub edi, 0x16619
out dx, eax
sbb dword [esi + 1], esp
add byte [ecx + 0x5cb8cf], al
add byte [edi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x19e4], eax
mov ecx, dword [ebp - 0x19e4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19e8], edx
mov eax, dword [ebp - 0x19e8]
mov dword [ebp - 0x1614], eax
push esi
push ebx
add esp, 4
sub esi, 0x65e4
and esi, 0x119f
pop esi
push edi
push esi
add esp, 4
and edi, 0x1031a
pop edi
push eax
sub eax, 0xc799
and eax, 0xe9b3
sub eax, 0x11631
pop eax
cmp dword [ebp - 0x1614], 0
jne 0x4064fd
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push eax
sub eax, 0x119d6
sub eax, 0x899b
and eax, 0x5b46
add eax, 0x4c64
pop eax
push esi
push esi
add esp, 4
sub esi, 0x9d1b
and esi, 0x1062
sub esi, 0x5210
pop esi
cmp dword [ebp - 0xcc4], 0
jne 0x406559
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
or edi, 0x55f8
pop edi
push edi
push edx
add esp, 4
xor edi, 0x14366
xor edi, 0x7228
jmp 0x406584
pop edi
push edx
push eax
add esp, 4
sub edx, 0x12875
or edx, 0xe932
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
add edi, 0x16e77
call 0x4065da
add byte [edi], bh
inc ecx
dec ebp
inc esi
dec eax
dec ebx
inc edx
xor al, byte [ebx - 0x107efb3c]
cmp ebx, dword [ebx]
add al, ch
pop es
add byte [eax], al
add byte [eax], al
cmp eax, 0x3a3d3b46
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
invalid
invalid
inc esp
invalid
Function at 0x4065ef
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x982c
call 0x40638a
add byte [edi], bh
dec ecx
xor bh, byte [edx]
xor esi, dword ss:[0x4c48336]
and edx, 0x46aa
pop edx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ecx
push edi
add esp, 4
or ecx, 0x144cb
or ecx, 0xa0d
pop ecx
push ebx
jmp 0x4063da
call 0x4063e7
add byte [ebp + 0x50], al
dec eax
xor al, 0x41
add esp, 4
xor ebx, 0x13fbb
pop ebx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push eax
push eax
add esp, 4
call 0x40646e
add byte [esi + eax*2 + 0x40], al
cmp bh, byte [0x333f4438]
add esp, 4
add al, 0x58
push edi
and edi, 0xdb9f
and edi, 0x159f
sub edi, 0x16619
out dx, eax
sbb dword [esi + 1], esp
add byte [ecx + 0x5cb8cf], al
add byte [edi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x19e4], eax
mov ecx, dword [ebp - 0x19e4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19e8], edx
mov eax, dword [ebp - 0x19e8]
mov dword [ebp - 0x1614], eax
push esi
push ebx
add esp, 4
sub esi, 0x65e4
and esi, 0x119f
pop esi
push edi
push esi
add esp, 4
and edi, 0x1031a
pop edi
push eax
sub eax, 0xc799
and eax, 0xe9b3
sub eax, 0x11631
pop eax
cmp dword [ebp - 0x1614], 0
jne 0x4064fd
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push eax
sub eax, 0x119d6
sub eax, 0x899b
and eax, 0x5b46
add eax, 0x4c64
pop eax
push esi
push esi
add esp, 4
sub esi, 0x9d1b
and esi, 0x1062
sub esi, 0x5210
pop esi
cmp dword [ebp - 0xcc4], 0
jne 0x406559
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
or edi, 0x55f8
pop edi
push edi
push edx
add esp, 4
xor edi, 0x14366
xor edi, 0x7228
jmp 0x406584
pop edi
push edx
push eax
add esp, 4
sub edx, 0x12875
or edx, 0xe932
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
add edi, 0x16e77
call 0x4065da
add byte [edi], bh
inc ecx
dec ebp
inc esi
dec eax
dec ebx
inc edx
xor al, byte [ebx - 0x107efb3c]
cmp ebx, dword [ebx]
add al, ch
pop es
add byte [eax], al
add byte [eax], al
cmp eax, 0x3a3d3b46
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
invalid
invalid
inc esp
invalid
Function at 0x406762
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x4c48341
pop esi
push edi
xor edi, 0x67db
pop edi
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x40679a
mov edx, dword [ebp - 0x514]

Function at 0x406790
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [edx + 0x30], 0
jne 0x406565
mov dword [ebp - 0x2fc], 0
push edi
push ebx
add esp, 4
and edi, 0xf05e
add edi, 0xc54f
sub edi, 0x854a
pop edi
push ebx
or ebx, 0x7554
jne 0x4067c2
add byte [ecx + 0x8759f3], al
add byte [ecx + 0x513e3], al
add byte [ecx + 0x165ebcb], al
add byte [ebx - 0x7d], bl
mov ebp, 0xfffffd04
add byte [edi], cl
test eax, edi
or byte [eax], al
invalid
mov eax, 0x6b
mov word [ebp - 0x1770], ax
mov ecx, 0x65
mov word [ebp - 0x176e], cx
mov edx, 0x72

Function at 0x4067c0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [edx + 0x30], 0
jne 0x406565
mov dword [ebp - 0x2fc], 0
push edi
push ebx
add esp, 4
and edi, 0xf05e
add edi, 0xc54f
sub edi, 0x854a
pop edi
push ebx
or ebx, 0x7554
jne 0x4067c2
add byte [ecx + 0x8759f3], al
add byte [ecx + 0x513e3], al
add byte [ecx + 0x165ebcb], al
add byte [ebx - 0x7d], bl
mov ebp, 0xfffffd04
add byte [edi], cl
test eax, edi
or byte [eax], al
invalid
mov eax, 0x6b
mov word [ebp - 0x1770], ax
mov ecx, 0x65
mov word [ebp - 0x176e], cx
mov edx, 0x72

Function at 0x406800
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x176c], dx
mov eax, 0x6e
mov word [ebp - 0x176a], ax
mov ecx, 0x65
mov word [ebp - 0x1768], cx
mov edx, 0x6c
insb byte es:[edi], dx
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
lcall 0x33, 0xb8ffffe8
add byte [eax], al
mov word [ebp - 0x1764], ax
mov ecx, 0x32
mov word [ebp - 0x1762], cx
mov edx, 0x2e
mov word [ebp - 0x1760], dx
mov eax, 0x64
mov word [ebp - 0x175e], ax
mov ecx, 0x6c
mov word [ebp - 0x175c], cx
mov edx, 0x6c
mov word [ebp - 0x175a], dx
xor eax, eax
mov word [ebp - 0x1758], ax
push ebx
xor ebx, 0x17aec
xor ebx, 0x12c4c
xor ebx, 0x118c8
and ebx, 0xeab1
pop ebx
push ebx
push edx
add esp, 4
invalid
jmp 0x40687c
invalid
invalid
Function at 0x406820
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x176c], dx
mov eax, 0x6e
mov word [ebp - 0x176a], ax
mov ecx, 0x65
mov word [ebp - 0x1768], cx
mov edx, 0x6c
insb byte es:[edi], dx
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
lcall 0x33, 0xb8ffffe8
add byte [eax], al
mov word [ebp - 0x1764], ax
mov ecx, 0x32
mov word [ebp - 0x1762], cx
mov edx, 0x2e
mov word [ebp - 0x1760], dx
mov eax, 0x64
mov word [ebp - 0x175e], ax
mov ecx, 0x6c
mov word [ebp - 0x175c], cx
mov edx, 0x6c
mov word [ebp - 0x175a], dx
xor eax, eax
mov word [ebp - 0x1758], ax
push ebx
xor ebx, 0x17aec
xor ebx, 0x12c4c
xor ebx, 0x118c8
and ebx, 0xeab1
pop ebx
push ebx
push edx
add esp, 4
invalid
jmp 0x40687c
invalid
invalid

Function at 0x406920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [eax], edx
out 0xff, al
dec dword [ebx - 0x19ef73]
dec dword [ecx - 0x161f73]
call dword [ecx + 0x52]
add esp, 4
call 0x406942
add byte [esi + 0x40], al
dec ebx
inc ebp
inc edx
aaa
add esp, 4
pop ecx
push eax
xor eax, 0xc59b
call 0x406959
add byte [eax], al

Function at 0x406942
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [eax], edx
out 0xff, al
dec dword [ebx - 0x19ef73]
dec dword [ecx - 0x161f73]
call dword [ecx + 0x52]
add esp, 4
call 0x406942
add byte [esi + 0x40], al
dec ebx
inc ebp
inc edx
aaa
add esp, 4
pop ecx
push eax
xor eax, 0xc59b
call 0x406959
add byte [eax], al

Function at 0x406950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [eax + 0x47], al
inc ecx
xor al, byte [edx + 0x40]
add esp, 4
jmp 0x406962

Function at 0x406959
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [eax + 0x47], al
inc ecx
xor al, byte [edx + 0x40]
add esp, 4
jmp 0x406962
Function at 0x423817
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ef261
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x18]
xor ebx, ebx
push ebx
mov ecx, edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x4fb8ac
call fcn.00430ea0
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
call fcn.0042be60
mov dword [esi + 0x74], 0xf
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov dword [esi + 4], ecx
mov ecx, edi
mov byte [esp + 0x18], 2
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.00430ef0
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x80], bl
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x14], ebx
pop edi
mov dword [esi + 0x78], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x442a30
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x52f2b0]
xor eax, dword [ebp + 4]
push str.IMAGEHLP.DLL
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x531fe4], eax
jne 0x442a69
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.004d9f7e
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SymInitialize
push eax
call esi
test eax, eax
mov dword [0x531fe8], eax
jne 0x442a93
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.004d9f7e
mov esp, ebp
pop ebp
ret
mov eax, dword [0x531fe4]
push str.SymSetOptions
push eax
call esi
test eax, eax
mov dword [0x531fec], eax
je 0x442a81
mov ecx, dword [0x531fe4]
push str.SymCleanup
push ecx
call esi
test eax, eax
mov dword [0x531ff4], eax
je 0x442a81
mov edx, dword [0x531fe4]
push str.UnDecorateSymbolName
push edx
call esi
test eax, eax
mov dword [0x531ff0], eax
je 0x442a81
mov eax, dword [0x531fe4]
push str.StackWalk
push eax
call esi
test eax, eax
mov dword [0x531ff8], eax
je 0x442a81
mov ecx, dword [0x531fe4]
push str.SymFunctionTableAccess
push ecx
call esi
test eax, eax
mov dword [0x531ffc], eax
je 0x442a81
mov edx, dword [0x531fe4]
push str.SymGetModuleBase
push edx
call esi
test eax, eax
mov dword [0x532000], eax
je 0x442a81
mov eax, dword [0x531fe4]
push str.SymGetSymFromAddr
push eax
call esi
test eax, eax
mov dword [0x532004], eax
je 0x442a81
push 4
call dword [0x531fec]
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x10c]
push 0x2f
push edx
call fcn.004d9f20
add esp, 8
test eax, eax
jne 0x442b83
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call fcn.004d9f20
add esp, 8
test eax, eax
je 0x442b86
mov byte [eax], 0
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x10c]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x442b95
sub eax, esi
mov dword [ebp - 8], eax
jne 0x442ba5
xor edx, edx
push 1
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x531fe8]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, dword [ebp + 4]
pop esi
call fcn.004d9f7e
mov esp, ebp
pop ebp
ret
Function at 0x442bf0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, dword [ebp + 8]
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x442c12
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp - 0x1c]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x442c73
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
lea ecx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
sub edi, esi
xor ebx, ebx
test eax, eax
mov dword [ebp - 4], eax
jbe 0x442c73
lea eax, [ecx + 0x10]
lea ebx, [ebx]
mov ecx, dword [eax]
mov edx, dword [eax - 8]
cmp ecx, edx
mov esi, dword [eax - 4]
ja 0x442c5e
mov ecx, edx
cmp edi, esi
jb 0x442c68
add ecx, esi
cmp edi, ecx
jbe 0x442c7c
mov ecx, dword [ebp - 4]
inc ebx
add eax, 0x28
cmp ebx, ecx
jb 0x442c50
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
inc ebx
sub edi, esi
pop esi
mov dword [edx], ebx
mov dword [eax], edi
pop ebx
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x442f00
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
mov esi, ecx
mov al, byte [esi + 0xf2]
xor ebx, ebx
cmp al, bl
jne 0x442fe6
lea ecx, [ecx]
cmp byte [ebp + 8], bl
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x210], ebx
je 0x442f47
mov eax, dword [esi + 8]
mov dword [ebp - 0x108], eax
mov eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x442f4c
mov eax, 1
cmp byte [ebp + 0xc], bl
je 0x442f60
mov ecx, dword [esi + 8]
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x210], eax
mov edx, dword [esi + 8]
mov dword [ebp - 0x314], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x314]
push ecx
mov dword [ebp - 0x310], edx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0x40
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0x186a0
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x442ff0
mov edx, dword [esi + 8]
lea ecx, [ebp - 0x314]
push ecx
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x442ff0
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x10c]
push eax
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x442fe6
mov eax, dword [esi + 8]
lea edx, [ebp - 0x210]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x442fe6
cmp byte [esi + 0xf2], bl
je 0x442f20
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push 6
mov ecx, esi
call fcn.00442ee0
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x443600
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [ecx + 0x9c0], 0x270
jl 0x442ea3
xor eax, eax
push esi
mov esi, dword [ecx + eax*4]
mov edx, dword [ecx + eax*4 + 4]
xor edx, esi
and edx, 0x7fffffff
xor edx, esi
mov esi, edx
and esi, 1
mov esi, dword [esi*4 + 0x52bf9c]
shr edx, 1
xor esi, edx
xor esi, dword [ecx + eax*4 + 0x634]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, 0xe3
jl 0x442df3
cmp eax, 0x26f
jge 0x442e63
lea ecx, [ecx]
mov esi, dword [ecx + eax*4]
mov edx, dword [ecx + eax*4 + 4]
xor edx, esi
and edx, 0x7fffffff
xor edx, esi
mov esi, edx
and esi, 1
mov esi, dword [esi*4 + 0x52bf9c]
shr edx, 1
xor esi, edx
xor esi, dword [ecx + eax*4 - 0x38c]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, 0x26f
jl 0x442e30
mov eax, dword [ecx + 0x9bc]
mov edx, dword [ecx]
mov esi, dword [ecx + 0x630]
xor eax, edx
mov edx, dword [ecx + 0x9bc]
and eax, 0x7fffffff
xor eax, edx
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x52bf9c]
xor edx, esi
shr eax, 1
xor edx, eax
mov dword [ecx + 0x9bc], edx
mov dword [ecx + 0x9c0], 0
pop esi
mov eax, dword [ecx + 0x9c0]
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ecx + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
and eax, 0x7fffffff
ret
jmp 0x442de0

Function at 0x443610
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, 0x532060
jmp fcn.00443600

Function at 0x4440c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov cl, byte [eax + 0x4ed]
test cl, cl
jne 0x444174
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0xf003f
push 0
push 0x4ffbe4
push 0
push str.SoftwarePopCapBeta
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x444174
cmp dword [esi + 0x15c], 0x10
mov ecx, dword [esi + 0x158]
jb 0x44411d
mov eax, dword [esi + 0x148]
jmp 0x444123
lea eax, [esi + 0x148]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ecx
push eax
mov eax, dword [ebp - 4]
push 1
push 0
push str.Name
push eax
call edi
cmp dword [esi + 0x178], 0x10
mov eax, dword [esi + 0x174]
jb 0x444152
mov esi, dword [esi + 0x164]
jmp 0x444158
add esi, 0x164
mov ecx, dword [ebp - 4]
push eax
push esi
push 1
push 0
push str.Password
push ecx
call edi
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44bcf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x52f2b0]
xor eax, dword [ebp + 4]
push esi
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
mov cl, byte [eax + 0x4ed]
test cl, cl
jne 0x44bde6
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
push str.SoftwarePopCapBeta
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44bde6
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push str.Name
push edx
mov dword [ebp - 0xc], pe_nt_image_headers32
call edi
test eax, eax
jne 0x44bd8e
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44bd72
sub eax, edx
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [esi + 0x144]
call fcn.004066c0
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.Password
push ecx
mov dword [ebp - 0xc], pe_nt_image_headers32
call edi
test eax, eax
pop edi
jne 0x44bddc
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44bdc0
sub eax, edx
push eax
lea edx, [ebp - 0x110]
push edx
lea ecx, [esi + 0x160]
call fcn.004066c0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.004d9f7e
mov esp, ebp
pop ebp
ret
Function at 0x465cb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x465d7a
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push str.Version
push eax
mov dword [ebp - 4], 2
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x78]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.MinVidMemory
push ecx
mov dword [ebp - 8], edx
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x7c]
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.RecVidMemory
push ecx
mov dword [ebp - 0xc], edx
call edi
mov eax, dword [esi + 0x1c]
push 0x10
lea edx, [esi + 0x20]
push edx
push 3
push 0
push str.DisplayGUID
push eax
call edi
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x58]
inc eax
cmp ecx, 0x10
jb 0x465d40
mov ecx, dword [esi + 0x44]
jmp 0x465d43
lea ecx, [esi + 0x44]
push eax
push ecx
mov ecx, dword [esi + 0x1c]
push 1
push 0
push str.FailureReason
push ecx
call edi
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
inc eax
cmp ecx, 0x10
jb 0x465d65
mov ecx, dword [esi + 0x60]
jmp 0x465d68
lea ecx, [esi + 0x60]
mov edx, dword [esi + 0x1c]
push eax
push ecx
push 1
push 0
push str.Warning
push edx
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret