joyce8/EMBER2024-capa huggingface dataset:
Function at 0x116331
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push ebp
push edi
push dword [esp + 0x40]
mov eax, 0x1001f4f0
mov ebp, ecx
push dword [esp + 0x40]
push eax
push dword [esp + 0x40]
push edx
push ebp
call fcn.00127212
push ebp
push eax
call fcn.00127212
mov dword [esp + 0x44], 0x5cefa3
xor edi, edi
mov dword [esp + 0x48], edi
xor edx, edx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x38], 0x7d9c
shl dword [esp + 0x38], 0xe
xor dword [esp + 0x38], 0x1f6778e3
mov dword [esp + 0x2c], 0x53b9
mov eax, dword [esp + 0x2c]
push 0x61
pop ecx
div ecx
xor edx, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
push 0x77
pop ecx
div ecx
xor edx, edx
mov dword [esp + 0x2c], eax
xor dword [esp + 0x2c], 0x50fb9346
xor dword [esp + 0x2c], 0x50fbacaf
mov dword [esp + 0x34], 0x7927
mov eax, dword [esp + 0x34]
push 0x7d
pop ecx
div ecx
mov dword [esp + 0x34], eax
xor dword [esp + 0x34], 0x4ef3
mov dword [esp + 0x30], 0x89b5
add dword [esp + 0x30], 0xffff0e32
xor dword [esp + 0x30], 0xffffb118
mov eax, dword [0x1001f4f0]
mov edx, dword [0x1001f4f4]
xor edx, eax
mov dword [esp + 0x3c], eax
mov eax, edx
mov dword [esp + 0x40], edx
and eax, 0xfffffffc
mov ecx, edx
add eax, 4
mov ebx, edx
and cl, 3
cmovne ebx, eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
add esp, 0x14
mov eax, dword [esp + 0x18]
mov edx, ebx
mov eax, dword [esp + 0x24]
call fcn.00127368
add esp, 0xc
mov dword [esp + 0x18], eax
test eax, eax
je 0x116485
shr ebx, 2
push esi
mov esi, 0x1001f4f8
lea ecx, [ebx*4 + 0x1001f4f8]
xor ebx, ebx
mov edx, ecx
sub edx, esi
add edx, 3
shr edx, 2
cmp ecx, esi
cmovb edx, ebx
test edx, edx
je 0x116479
mov ebx, dword [esp + 0x20]
mov ecx, eax
sub ecx, esi
mov eax, dword [esi]
xor eax, ebx
inc edi
mov dword [ecx + esi], eax
lea esi, [esi + 4]
cmp edi, edx
jb 0x116466
mov eax, dword [esp + 0x1c]
pop esi
test ebp, ebp
je 0x116485
mov ecx, dword [esp + 0x20]
mov dword [ebp], ecx
pop edi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x11672d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
push dword [esp + 0x28]
mov esi, edx
push esi
push ecx
call fcn.00127212
mov dword [esp + 0x18], 0xb0ed
lea edi, [esi + 4]
or dword [esp + 0x18], 0x5a3290f4
xor edx, edx
mov eax, dword [esp + 0x18]
push 0x7e
pop ecx
div ecx
mov dword [esp + 0x18], eax
shr dword [esp + 0x18], 8
xor dword [esp + 0x18], 0xe9a5
mov dword [esp + 0x24], 0x8b45
add dword [esp + 0x24], 0xffffcba7
xor dword [esp + 0x24], 0x18cc
mov dword [esp + 0x1c], 0x76d6
or dword [esp + 0x1c], 0x4f67e9bf
xor dword [esp + 0x1c], 0xc0638bc8
xor dword [esp + 0x1c], 0x8f046c56
mov dword [esp + 0x20], 0xbb60
add dword [esp + 0x20], 0xffff5ee5
xor dword [esp + 0x20], 0x7a56
mov ecx, dword [esi]
mov eax, dword [edi]
add edi, 4
xor eax, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
lea esi, [eax + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
lea edx, [esi + esi]
call fcn.00127368
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x116870
shr esi, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x116865
mov ebx, dword [esp + 0x20]
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
movzx eax, cl
mov word [edx], ax
mov eax, ecx
shr eax, 8
lea edx, [edx + 8]
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc ebp
mov word [edx - 4], ax
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, esi
jb 0x11682c
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
xor ecx, ecx
pop ebp
mov word [ebx + eax*2], cx
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x18
ret
Function at 0x11a474
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
push ecx
call fcn.00127212
add esp, 0x18
mov dword [ebp - 4], 0x6bf2
mov eax, dword [ebp - 4]
xor edx, edx
push 0x17
pop ecx
div ecx
mov dword [ebp - 4], eax
xor dword [ebp - 4], 0x5ba
cmp dword [ebp + 0xc], 0x40
jae 0x11a4b5
xor eax, eax
jmp 0x11a4da
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x11a4b1
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x11a4b1
movzx edx, word [eax + 0x18]
xor esi, esi
mov ecx, dword [ebp - 4]
cmp edx, ecx
cmovne eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x11c526
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edx
push ecx
call fcn.00127212
and dword [esp + 0x40], 0
lea edi, [edx + 4]
mov dword [esp + 0x34], 0x4d5289
mov dword [esp + 0x38], 0xb3472
mov dword [esp + 0x3c], 0x74fd0c
mov dword [esp + 0x28], 0x970c
or dword [esp + 0x28], 0x46aa7c01
xor dword [esp + 0x28], 0x46aafa45
mov dword [esp + 0x24], 0x7a0e
or dword [esp + 0x24], 0x1828b09d
xor dword [esp + 0x24], 0x1828cfe6
mov dword [esp + 0x20], 0x23fd
imul eax, dword [esp + 0x20], 0x55
mov dword [esp + 0x20], eax
xor dword [esp + 0x20], 0xbb90b
mov dword [esp + 0x1c], 0xd2d6
add dword [esp + 0x1c], 0x962a
shl dword [esp + 0x1c], 0xc
xor dword [esp + 0x1c], 0x16900a39
mov ecx, dword [edx]
mov eax, dword [edi]
add edi, 4
xor eax, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
lea esi, [eax + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
add esp, 4
mov eax, dword [esp + 0x20]
mov edx, esi
mov eax, dword [esp + 0x24]
call fcn.00127368
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x11c662
shr esi, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x11c659
mov ebx, dword [esp + 0x20]
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc ebp
mov byte [edx - 1], cl
cmp ebp, esi
jb 0x11c630
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
pop ebp
mov byte [ebx + eax], 0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x28
ret
Function at 0x11d350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push dword [ebp + 0xc]
mov ebx, ecx
push dword [ebp + 8]
push edx
push ebx
call fcn.00127212
mov dword [ebp - 8], 0x87fb
add esp, 0x10
or dword [ebp - 8], 0x220f5406
xor dword [ebp - 8], 0x220fd7ff
mov dword [ebp - 4], 0xbeeb
shr dword [ebp - 4], 0xb
shr dword [ebp - 4], 9
imul eax, dword [ebp - 4], 0x2e
mov dword [ebp - 4], eax
xor dword [ebp - 4], 6
mov dword [ebp - 4], 0x81aa
add dword [ebp - 4], 0xe086
xor dword [ebp - 4], 0xd2c0dd39
xor dword [ebp - 4], 0x4bcda799
xor dword [ebp - 4], 0x990c1880
cmp byte [ebx], 0
je 0x11d428
push esi
push edi
mov edi, dword [ebp - 8]
mov dword [ebp - 4], 0xbeeb
shr dword [ebp - 4], 0xb
shr dword [ebp - 4], 9
imul eax, dword [ebp - 4], 0x2e
mov dword [ebp - 4], eax
xor dword [ebp - 4], 6
mov cl, byte [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [ebp - 4], 0x81aa
add dword [ebp - 4], 0xe086
xor dword [ebp - 4], 0xd2c0dd39
xor dword [ebp - 4], 0x4bcda799
xor dword [ebp - 4], 0x990c1880
shl esi, cl
mov cl, byte [ebp - 4]
mov edx, dword [ebp - 8]
movsx eax, byte [ebx]
mov dword [ebp - 8], eax
add dword [ebp - 8], esi
shl edx, cl
add dword [ebp - 8], edx
sub dword [ebp - 8], edi
inc ebx
cmp byte [ebx], 0
jne 0x11d3c1
pop edi
pop esi
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x121b94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push dword [esp + 0x38]
mov ebx, edx
push dword [esp + 0x38]
push dword [esp + 0x38]
push ebx
push ecx
call fcn.00127212
mov dword [esp + 0x28], 0xaa4d
xor esi, esi
or dword [esp + 0x28], 0xd63cada4
add esp, 0x14
shl dword [esp + 0x14], 0xf
mov ebp, esi
shl dword [esp + 0x14], 2
xor dword [esp + 0x14], 0x5fda5f92
mov dword [esp + 0x10], 0x9877
add dword [esp + 0x10], 0x52c7
shr dword [esp + 0x10], 0xb
shr dword [esp + 0x10], 9
xor dword [esp + 0x10], 0x2f3d
mov dword [esp + 0x18], 0x1d09
add dword [esp + 0x18], 0xffff2e3f
imul eax, dword [esp + 0x18], 0x3b
mov dword [esp + 0x18], eax
xor dword [esp + 0x18], 0xffd66976
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0x28], eax
mov edi, dword [eax + ebx + 0x78]
add edi, ebx
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add eax, ebx
mov dword [esp + 0x24], eax
add ecx, ebx
mov eax, dword [edi + 0x24]
add eax, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
cmp dword [edi + 0x18], esi
jbe 0x121ca4
push dword [esp + 0x18]
mov ecx, dword [ecx + ebp*4]
push dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
add ecx, ebx
call fcn.0011d350
xor eax, 0x5a80eae
pop ecx
pop ecx
cmp eax, dword [esp + 0x34]
je 0x121c78
mov ecx, dword [esp + 0x1c]
inc ebp
cmp ebp, dword [edi + 0x18]
jb 0x121c49
jmp 0x121ca4
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
movzx eax, word [eax + ebp*2]
mov esi, dword [esi + eax*4]
add esi, ebx
cmp esi, edi
jb 0x121ca4
mov eax, dword [esp + 0x28]
mov eax, dword [eax + ebx + 0x7c]
add eax, edi
cmp esi, eax
jae 0x121ca4
mov ecx, esi
call fcn.00121125
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4131a3
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x4276d4]
push esi
push 0xf0000000
xor esi, esi
push 0x18
push esi
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x42c]
push eax
mov dword [ebp - 0x434], 0x20
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x428], esi
mov byte [ebp - 0x24], 0xcf
mov byte [ebp - 0x23], 0x91
mov byte [ebp - 0x22], 0x22
mov byte [ebp - 0x21], 0x67
mov byte [ebp - 0x20], 0xa8
mov byte [ebp - 0x1f], 0xd0
mov byte [ebp - 0x1e], 0xe2
mov byte [ebp - 0x1d], 0x27
mov byte [ebp - 0x1c], 0xab
mov byte [ebp - 0x1b], 0x2a
mov byte [ebp - 0x1a], 0x90
mov byte [ebp - 0x19], 0x80
mov byte [ebp - 0x18], 0xaa
mov byte [ebp - 0x17], 0xa5
mov byte [ebp - 0x16], 0xbe
mov byte [ebp - 0x15], 0x5b
mov byte [ebp - 0x14], 0xbc
mov byte [ebp - 0x13], 0xcc
mov byte [ebp - 0x12], 0x22
mov byte [ebp - 0x11], 0xf4
mov byte [ebp - 0x10], 0x90
mov byte [ebp - 0xf], 0xb7
mov byte [ebp - 0xe], 0xcd
mov byte [ebp - 0xd], 0x7d
mov byte [ebp - 0xc], 0xea
mov byte [ebp - 0xb], 0xdc
mov byte [ebp - 0xa], 0xfd
mov byte [ebp - 9], 0xf0
mov byte [ebp - 8], 0x8f
mov byte [ebp - 7], 0x52
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x41334e
push ebx
push edi
lea eax, [ebp - 0x428]
push eax
push esi
push esi
push 0x800c
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x41328a
xor edi, edi
jmp 0x41333d
mov edi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push esi
push 0x1e
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x428]
call edi
test eax, eax
jne 0x4132aa
xor edi, edi
jmp 0x413331
push 0x401c18
push dword [ebp + 8]
mov dword [ebp - 0x430], esi
call dword [sym.imp.msvcrt.dll__wfopen]
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
je 0x413311
push ebx
push 0x400
lea eax, [ebp - 0x424]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, esi
jbe 0x413309
add dword [ebp - 0x430], eax
push esi
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x428]
call edi
test eax, eax
je 0x41335b
cmp dword [ebp - 0x430], 0x3c00
jb 0x4132c6
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
push esi
lea eax, [ebp - 0x434]
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
xor edi, edi
test eax, eax
je 0x413331
inc edi
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.0041647d
leave
ret 8
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
xor eax, eax
jmp 0x41334c
Function at 0x413380
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4276d4]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
push 0xf0000000
push 0x18
push 0x401c20
xor ebx, ebx
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x30], cl
mov byte [ebp - 0x2f], 2
mov word [ebp - 0x2e], bx
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
lea edi, [ebp - 0x24]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x41346c
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
xor edi, edi
test eax, eax
je 0x413460
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea eax, [ebp - 0x34]
push eax
push 4
push dword [ebp + 0xc]
inc edi
mov dword [ebp - 0x34], edi
call esi
test eax, eax
jne 0x41340f
xor edi, edi
jmp 0x413457
push ebx
lea eax, [ebp - 0x34]
push eax
push 3
push dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
call esi
test eax, eax
je 0x41340b
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x413437
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp - 0x38]
push ecx
push eax
push ebx
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x41340b
push dword [ebp - 0x38]
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0041647d
leave
ret 8
Function at 0x41379b
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 8]
push eax
push 0x403d20
push 1
xor ebx, ebx
push ebx
push 0x403dc0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, ebx
jl 0x41384e
mov eax, dword [ebp - 8]
push ebx
lea edx, [ebp - 4]
push edx
push 0x40127c
mov dword [ebp - 4], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
jne 0x41384e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
mov esi, dword [ebp + 0xc]
jmp 0x413849
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
lea edx, [ebp + 0xc]
push edx
push 1
push eax
call dword [ecx + 0xc]
mov edi, eax
cmp edi, ebx
jne 0x41384d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push esi
push 0x403d10
push ebx
push ebx
push eax
call dword [ecx + 0x20]
mov edi, eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
jl 0x413849
push dword [ebp + 8]
push dword [esi]
call fcn.00413729
mov edi, eax
cmp edi, ebx
jge 0x41384d
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], ebx
cmp dword [esi], ebx
je 0x4137f9
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 8

Function at 0x414a63
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push edi
lea ebx, [ecx + eax + 0x18]
jbe 0x414b45
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x414ae0
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x414b30
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push edi
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x414b4f
mov edx, dword [ebx - 4]
add edx, dword [ebp - 4]
mov ecx, edi
mov dword [ebx - 8], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x414b30
mov ecx, dword [ebx + 4]
add ecx, eax
mov eax, dword [ebp + 0xc]
push ecx
call fcn.00414a4b
test eax, eax
je 0x414b4f
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push dword [ebx]
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x414b4f
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
add eax, dword [ebp - 4]
mov esi, dword [ebx + 4]
add esi, dword [ebp + 8]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov dword [ebx - 8], eax
mov eax, dword [esi]
movzx eax, word [eax + 6]
inc dword [ebp - 8]
add ebx, 0x28
cmp dword [ebp - 8], eax
jl 0x414a90
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x414b48
Function at 0x41647d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4276d4]
jne 0x416486
ret
jmp 0x41648b
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x4276d4]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x429964]
test eax, eax
je 0x4164af
call eax
cmp dword [0x429968], 0
je 0x4164f6
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x429968]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.0041647d
add ebp, 0x2a8
leave
ret
Function at 0x418944
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
push 5
pop ecx
mov esi, 0x405744
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 5
pop ecx
mov esi, 0x40572c
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x405718
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp + 8]
movsw word es:[edi], word [esi]
mov esi, 0x405704
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push ebx
push 0x4056e4
movsb byte es:[edi], byte [esi]
xor esi, esi
lea eax, [ebp - 0xc4]
push 0x64
push eax
mov dword [0x4298cc], esi
mov dword [0x4298d0], esi
mov dword [0x4298d4], esi
call fcn.004188ec
add esp, 0x10
test eax, eax
jl 0x418ae8
lea eax, [ebp + 8]
push eax
push 0x20019
push esi
lea eax, [ebp - 0xc4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x418af1
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push 0x4298cc
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 4
call edi
test eax, eax
je 0x418a12
mov dword [0x4298cc], esi
lea eax, [ebp - 4]
push eax
push 0x4298d0
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x418a33
mov dword [0x4298d0], esi
lea eax, [ebp - 4]
push eax
push 0x4298d4
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x418a54
mov dword [0x4298d4], esi
lea eax, [ebp - 4]
push eax
push 0x4298d8
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x418a79
mov dword [0x4298d8], 0xffff0000
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4298cc], esi
jne 0x418aa2
cmp dword [0x4298d0], esi
jne 0x418ab2
cmp dword [0x4298d4], esi
jne 0x418ab2
xor eax, eax
inc eax
jmp 0x418b26
cmp dword [0x4298d0], esi
jne 0x418ab2
cmp dword [0x4298d4], esi
je 0x418ad7
push ebx
push 0x4056e0
push 0x64
push 0x429868
call fcn.004188ec
add esp, 0x10
test eax, eax
jl 0x418ae8
push esi
push ebx
call sub.rtutils.dll_TraceRegisterExW
mov dword [0x427ee8], eax
cmp dword [0x4298cc], esi
jne 0x418aec
cmp dword [0x427ee8], 0xffffffff
jne 0x418aec
xor eax, eax
jmp 0x418b26
xor eax, eax
inc eax
jmp 0x418b21
push ebx
push 0x4056e0
push 0x64
push 0x429868
call fcn.004188ec
add esp, 0x10
test eax, eax
jl 0x418ae8
push esi
push ebx
call sub.rtutils.dll_TraceRegisterExW
mov ecx, eax
xor eax, eax
inc eax
cmp ecx, 0xffffffff
mov dword [0x427ee8], ecx
je 0x418b26
mov dword [0x4298dc], eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x418b2d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
xor esi, esi
cmp dword [0x4298cc], esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x201
jbe 0x418c54
test dword [0x4298d8], edi
je 0x418c54
cmp edi, 0x10002
je 0x418b99
cmp edi, 0x20002
je 0x418b96
cmp edi, 0x40002
je 0x418b92
cmp edi, 0x80002
je 0x418b8d
xor eax, eax
cmp edi, 0x100002
setne al
add eax, 4
mov esi, eax
jmp 0x418b99
push 3
pop esi
jmp 0x418b99
push 2
jmp 0x418b8f
xor esi, esi
inc esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [esi*4 + 0x427eec]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
push 0x429868
push 0x4057a4
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004188ec
add esp, 0x28
test eax, eax
jl 0x418cec
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.0041886c
test eax, eax
jl 0x418cec
mov eax, dword [ebp - 4]
cmp eax, ebx
jae 0x418cec
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
mov ecx, ebx
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x218]
push eax
call fcn.004188d1
test eax, eax
jge 0x418c35
cmp eax, 0x7a
jne 0x418cec
push 0x4057a0
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.00418913
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x427ee8], 0xffffffff
je 0x418cec
xor eax, eax
cmp dword [0x4298d0], eax
ja 0x418c73
cmp dword [0x4298d4], eax
jbe 0x418cec
cmp edi, 0x10002
je 0x418caf
cmp edi, 0x20002
je 0x418cac
cmp edi, 0x40002
je 0x418ca8
cmp edi, 0x80002
je 0x418ca3
xor eax, eax
cmp edi, 0x100002
setne al
add eax, 4
jmp 0x418caf
push 3
pop eax
jmp 0x418caf
push 2
jmp 0x418ca5
xor eax, eax
inc eax
push dword [ebp + 0xc]
push dword [eax*4 + 0x427eec]
lea eax, [ebp - 0x218]
push 0x405798
push ebx
push eax
call fcn.004188ec
add esp, 0x14
test eax, eax
jl 0x418cec
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
or edi, 4
push edi
push dword [0x427ee8]
call sub.rtutils.dll_TraceVprintfExA
pop edi
pop esi
pop ebx
leave
ret