joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417e9a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
dec esp
add byte [ebp - 0x767af040], al
add byte [eax], al
add byte [eax], al
push ebx
push ebp
mov ebp, 4
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
invalid
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [0x4c9bcc], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
dec esp
and al, 0x18
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
cwde
pushal
dec esp
add byte [edx - 1], dl
invalid
test eax, eax
invalid
jne 0x417e93
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
insb byte es:[edi], dx
and al, 0x14
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
and byte [eax - 0x75], dl
inc esp
and al, 0x1c
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.Browse_For_Folder_Height
pushal
dec esp
add byte [eax - 1], dl
rcr dword [ebp + 0x5b], cl

Function at 0x466bb2
Capabilities:
Encode data using xor

Disassembly:
sti
add cl, al
dec ecx
pop ds
aam 0x1b
cmp ebx, ebx
or bh, bl
or byte [edx + 0x7d49ca34], ah
or ch, byte [edi]
or ebx, dword [edx]
xor byte [edx + 9], cl
dec edx
jl 0x466bb7
invalid

Function at 0x48c042
Capabilities:
Check for software breakpoints

Disassembly:
xchg edi, eax
fild word [edi]
adc dh, byte [eax + 0x2f8ff28c]
das
push ecx
cmp al, 0xcc
mov bh, 0xd2
adc al, 0x32

Function at 0x48c04a
Capabilities:
Check for software breakpoints

Disassembly:
xchg edi, eax
fild word [edi]
adc dh, byte [eax + 0x2f8ff28c]
das
push ecx
cmp al, 0xcc
mov bh, 0xd2
adc al, 0x32

Function at 0x4ac23e
Capabilities:
Encode data using xor

Disassembly:
cmp byte [edi - 0x5d4ff57a], al
popal
loop 0x4ac243
push dword [ebx]
mov esp, 0x29a61f94
pop ss
invalid
leave
jo 0x4ac1d4
inc eax
sub dl, bl
invalid
cmp dword [ebx], 0xdf07d311
jg 0x4ac20f
fistp qword [edi - 0x37]
push esp
fcom st(4)
invalid
Function at 0x401fa9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x402054
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402054
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x14]
and dword [edi], 0
push edi
push 0x42b59c
push 1
push 0
push 0x42b58c
call fcn.00403ff3
test eax, eax
js 0x402059
mov ecx, dword [edi]
lea eax, [ebx + 0x10]
push eax
push 0x42c0b8
push ecx
mov edx, dword [ecx]
call dword [edx]
test eax, eax
js 0x402059
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x194]
cmp eax, 1
jne 0x402018
mov eax, 0x80004005
jmp 0x402059
test eax, eax
js 0x402059
mov eax, dword [edi]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xb8]
cmp eax, 1
jne 0x402038
lea eax, [ebx - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
jmp 0x402011
test eax, eax
js 0x402059
mov ecx, dword [0x435d00]
test ecx, ecx
je 0x402050
push esi
lea eax, [ebx - 4]
push eax
call fcn.00401614
xor eax, eax
jmp 0x402059
mov eax, 0x80070057
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40367e
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x421c
call fcn.00404a94
mov eax, dword [0x42b9a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor bh, bh
mov byte [ebp - 0x4215], 0
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x4036d7
push 0xb
push 0x42b8b8
push esi
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x4036d3
push 0xb
push str._Embedding
push esi
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4036d7
mov bl, 1
jmp 0x4036d9
xor bl, bl
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x4037f1
mov bh, 1
test bl, bl
je 0x4036fc
call fcn.0040697b
test eax, eax
js 0x403820
push 0
call fcn.0040bb70
pop ecx
mov byte [ebp - 0x4215], 1
call fcn.00424364
mov dword [0x435d3c], edi
test bl, bl
je 0x403724
call fcn.00402e82
jmp 0x4037f1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0xa
push 0x104
movzx esi, ax
lea ecx, [ebp - 0x20c]
mov eax, esi
push ecx
push eax
mov dword [ebp - 0x421c], eax
call fcn.004034dc
mov eax, 0x409
cmp si, ax
je 0x40376f
push 0xffffffffffffffff
push str._1033
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
push str.vviewres.dll
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00402f53
mov edi, eax
test edi, edi
je 0x4037dd
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x2210]
push 0x1001
push eax
push 0x8062
push edi
call esi
push 0x1001
lea eax, [ebp - 0x4214]
push eax
push 0x8063
push edi
call esi
push dword [ebp - 0x421c]
call fcn.00402bae
xor ecx, ecx
mov edx, 0x180000
test eax, eax
lea eax, [ebp - 0x2210]
cmovne ecx, edx
push ecx
push eax
lea eax, [ebp - 0x4214]
push eax
jmp 0x4037e9
push 0
push str.Microsoft_Office
push str.This_program_can_only_run_from_within_another_program.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.0040162b
call fcn.00402068
test eax, eax
je 0x403808
push 1
mov ecx, eax
call fcn.0040281f
cmp byte [ebp - 0x4215], 0
je 0x403816
call fcn.0040bc32
test bh, bh
je 0x403820
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004038ea
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4038f7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x42b9a4], eax
je 0x403919
cmp dword [0x42b9a4], ebx
jne 0x4039ad
push edi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edi, dword [ebp - 8]
xor edi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor edi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x42b9a4
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
test edi, edi
push eax
push dword [ebp - 4]
cmovne ebx, edi
mov edi, 0x42b9a4
push 4
push edi
mov dword [0x42b9a4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push edi
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov eax, dword [0x42b9a4]
not eax
mov dword [0x4350c0], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403a62
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x435d80], 0
je 0x403a7a
mov eax, dword [0x435d84]
jmp 0x403b4a
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403ac9
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x435d84
push esi
push esi
push dword [0x4350c4]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403ac9
cmp dword [ebp - 8], 4
je 0x403b23
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
test eax, eax
je 0x403ada
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403b2b
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x435d84
push esi
push esi
push dword [0x4350c4]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403b2b
cmp dword [ebp - 8], 4
jne 0x403b2b
mov esi, dword [0x435d84]
jmp 0x403b31
mov dword [0x435d84], esi
cmp dword [ebp - 4], 0
mov byte [0x435d80], 1
je 0x403b47
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403b4e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x42b9bc
push 0x80000000
mov dword [ebp - 8], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x403be0
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x20019
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call edi
test eax, eax
jne 0x403bd6
push 4
pop edi
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push str.InsecureQI
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403bd6
cmp dword [ebp + 8], edi
jne 0x403bd6
mov edi, dword [ebp - 0xc]
cmp edi, 3
ja 0x403bd6
cmp dword [ebp - 4], ebx
je 0x403be2
push dword [ebp - 4]
call esi
jmp 0x403be2
cmp dword [ebp - 4], ebx
je 0x403be0
push dword [ebp - 4]
call esi
mov edi, ebx
cmp dword [ebp - 8], ebx
je 0x403bec
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404396
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x430a68
call fcn.004043a0
push 1
call fcn.0040461b
pop ecx
test al, al
jne 0x40423f
push 7
call fcn.00404d26
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004045e6
mov byte [ebp - 0x24], al
mov eax, dword [0x435d88]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x404238
test eax, eax
jne 0x4042a9
mov dword [0x435d88], ecx
push 0x42b448
push 0x42b430
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40428c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x404390
push 0x42b42c
push 0x42b3b8
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x435d88], 2
jmp 0x4042ae
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00404778
pop ecx
call fcn.00404d1a
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4042de
push esi
call fcn.004046eb
pop ecx
test al, al
je 0x4042de
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00404f55
call esi
call fcn.00404d20
mov esi, eax
cmp dword [esi], edi
je 0x4042fc
push esi
call fcn.004046eb
pop ecx
test al, al
je 0x4042fc
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00404e3b
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00404e6e
test al, al
jne 0x404335
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x40433e
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00404795
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x404390
call fcn.004043e6
ret
call fcn.004038f7
jmp 0x404220

Function at 0x407cbe
Capabilities:
Query environment variable

Disassembly:
push 0x218
mov eax, 0x429a53
call fcn.00404545
mov esi, 0x104
lea eax, [ebp - 0x21c]
push esi
push eax
push str.LORI_099F5E083DF84BC98E90139DFB45C0B9
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x407cf0
mov al, 1
jmp 0x407d87
cmp eax, esi
jae 0x407d85
xor esi, esi
mov dword [ebp - 0x220], esi
push 1
mov dword [ebp - 4], esi
push 8
mov byte [ebp - 4], 1
call fcn.004078b9
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x407d27
mov ecx, eax
call fcn.00407460
mov esi, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], esi
test esi, esi
jne 0x407d43
xor ecx, ecx
mov dword [0], 1
int 0x29
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, esi
call fcn.00407bdc
mov dword [0x436118], esi
jmp 0x407ce9
xor al, al
call fcn.00404496
ret
Function at 0x408d1b
Capabilities:
Read file on windows

Disassembly:
push 4
mov eax, 0x429b5a
call fcn.004044a3
mov ebx, ecx
cmp byte [ebx + 0x21], 0
jne 0x408dcf
cmp dword [ebp + 8], 0x10
jne 0x408e44
mov eax, dword [ebx + 0x80]
cmp eax, 0x10
jb 0x408e44
lea esi, [ebx + 0x24]
push eax
mov ecx, esi
call fcn.00424faa
cmp dword [esi], 0
jne 0x408d61
call fcn.004270b7
push dword [ebp + 8]
lea eax, [ebx + 0x74]
push eax
push dword [ebx + 0x80]
push dword [esi]
call fcn.0040b883
mov edx, dword [ebx + 0x80]
add esp, 0x10
cmp edx, dword [ebp + 8]
je 0x408dcf
push 5
pop ecx
lea eax, [ebx + 0x28]
mov esi, 0x42c014
push eax
mov edi, eax
lea eax, [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x24]
push eax
lea eax, [edx - 0x10]
mov word [ebx + 0x20], 0x101
push eax
lea eax, [ecx + 0x10]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408e44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x408e44
mov byte [ebx + 0x20], 0
call fcn.00427091
lea edi, [ebx + 0x24]
mov ecx, edi
call fcn.0040884b
test dword [eax + 4], 0x2000000
je 0x408e4c
mov ecx, edi
call fcn.0040884b
push 1
mov eax, dword [eax + 0xc]
push eax
call fcn.004078b9
mov edi, dword [edi]
lea ecx, [ebx + 0x24]
mov esi, eax
mov dword [ebp - 0x10], esi
call fcn.0040884b
push dword [eax + 0xc]
push edi
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.00408ebf
cmp dword [ebp - 0x10], 0
je 0x408e2a
push dword [ebp - 0x10]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
lea edi, [ebx + 0x24]
mov eax, dword [edi]
test eax, eax
je 0x408e3d
and dword [edi], 0
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
mov ecx, ebx
call fcn.00408ee8
call fcn.00404474
ret 4
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x7c]
mov ecx, ebx
call fcn.00408a3f
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x408ea7
mov ecx, edi
call fcn.0040884b
test byte [eax + 7], 1
je 0x408e8a
mov ecx, edi
call fcn.0040884b
mov ecx, dword [eax]
test ecx, ecx
js 0x408e9f
mov ecx, 0x8007000d
jmp 0x408e9f
mov ecx, dword [esi + 8]
push edi
mov eax, dword [ecx]
call dword [eax + 0xc]
xor ecx, ecx
mov edx, 0x8007000d
test al, al
cmove ecx, edx
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xc]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x408e2d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x408e2d
Function at 0x408f3c
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x429b7d
call fcn.004044a3
mov ebx, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push 1
mov eax, dword [esi + 8]
mov edi, dword [eax + 8]
lea eax, [ebx + 0x58]
push eax
mov dword [ebp + 8], edi
call fcn.00408696
mov eax, dword [ebx + 0x70]
lea ecx, [ebx + 0x3c]
and dword [ebp - 4], 0
mov dword [edi + 8], eax
inc dword [ebx + 0x70]
push dword [edi + 8]
call fcn.0042769a
push esi
mov ecx, eax
call fcn.0040862f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004087bd
push 5
pop ecx
lea eax, [esi + 0xc]
mov esi, 0x42c014
push eax
mov edi, eax
mov eax, dword [ebp + 8]
push 0
rep movsd dword es:[edi], dword [esi]
push dword [eax + 0xc]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x408fc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x408fc8
call fcn.00427091
call fcn.00404474
ret 4

Function at 0x40a4dc
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x429ba0
call fcn.004044a3
mov esi, dword [ebp + 8]
test esi, esi
jne 0x40a4f6
xor al, al
jmp 0x40a5c7
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x40a507
xor ecx, ecx
cmp dword [0x436744], ecx
jmp 0x40a511
push esi
call fcn.0040a309
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x40a4ef
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.00409735
xor ecx, ecx
mov dword [ebp - 4], edi
push 2
test bl, bl
pop eax
cmovne ecx, eax
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 0x14], ecx
or eax, ecx
jmp 0x40a59b
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x40a551
mov eax, dword [ebx]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push edi
call fcn.0040a333
push ebx
test eax, eax
je 0x40a5b5
mov eax, dword [esi + 0xc]
xor edi, edi
mov ecx, 0x436430
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x435128], edi
call fcn.0040a200
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp + 8], edi
or eax, dword [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc]
call fcn.004097f9
mov edi, eax
test edi, edi
je 0x40a545
jmp 0x40a5ba
call fcn.0040ac6e
lea ecx, [ebp + 0xf]
call fcn.00409760
test edi, edi
sete al
call fcn.00404474
ret 8
Function at 0x40a7b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x40a7dc
cmp dword [0x436744], edi
je 0x40a8cd
push 2
pop esi
jmp 0x40a7f5
cmp edi, 1
jne 0x40a8cd
push ebx
call fcn.0040a309
test al, al
je 0x40a8cd
xor esi, esi
lea ecx, [ebp + 0xb]
mov dword [ebp - 0xc], esi
call fcn.00409735
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
push eax
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
or eax, esi
jmp 0x40a87c
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40a82a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push esi
call fcn.0040a333
push dword [ebp - 4]
test eax, eax
je 0x40a895
mov eax, dword [ebx + 0xc]
xor esi, esi
mov ecx, 0x436430
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x435128], esi
call fcn.0040a200
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 4], esi
or eax, dword [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0xc]
call fcn.004097f9
mov esi, eax
test esi, esi
je 0x40a816
jmp 0x40a8c5
call fcn.0040ac6e
test esi, esi
jne 0x40a8c5
movzx ecx, word [ebx + 0x10]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x10], eax
je 0x40a8e2
cmp dword [ebp - 0x10], 3
jne 0x40a8c2
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x40a8c2
and cl, 0xf
cmp cl, 4
je 0x40a8e2
push 2
pop esi
lea ecx, [ebp + 0xb]
call fcn.00409760
inc edi
cmp edi, 2
jl 0x40a7c4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp + 0xb]
mov dword [eax], 1
call fcn.00409760
xor eax, eax
jmp 0x40a8d9
Function at 0x40e272
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
test byte [0x436a80], 0x20
push esi
push edi
mov esi, ecx
je 0x40e2b3
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x42c9c8
push dword [0x436a8c]
push dword [0x436a88]
call fcn.0042089f
push 0x1c135e
call fcn.004092b0
lea eax, [esi + 8]
mov ecx, dword [eax]
mov esi, ecx
mov edi, dword [eax + 4]
mov edx, edi
mov dword [ebp - 4], eax
mov eax, ecx
shr eax, 0xc
dec eax
mov dword [ebp - 0x10], esi
shl eax, 0xc
xor eax, ecx
and eax, 0x7f000
xor ecx, eax
mov eax, esi
mov esi, dword [ebp - 4]
push ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x10]
jne 0x40e2fb
cmp ecx, edi
je 0x40e32b
mov esi, eax
mov dword [ebp - 0x10], ecx
shr esi, 0xc
mov edi, eax
dec esi
mov edx, ecx
shl esi, 0xc
xor esi, eax
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
mov esi, dword [ebp - 4]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, edi
jne 0x40e2fb
cmp ecx, dword [ebp - 0x10]
jne 0x40e2fb
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x40f833
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x20], ebx
jne 0x40f84e
mov eax, 0x80004005
jmp 0x40fa1e
cmp byte [esi + 0x180], bl
je 0x40f85d
xor eax, eax
jmp 0x40fa1e
mov ecx, dword [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
call fcn.00428f44
test al, al
jne 0x40f88a
mov eax, dword [esi]
push esi
call dword [eax + 0x30]
test eax, eax
je 0x40f88a
push 0x1c1417
call fcn.004092b0
push edi
call fcn.0040ce6e
test al, al
jne 0x40f90c
push 0x2710
lea ecx, [esi + 0x38]
call fcn.004115f3
test eax, eax
je 0x40f90c
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x40f8e7
sub eax, 1
je 0x40f902
sub eax, 1
je 0x40f8e7
sub eax, 1
je 0x40f8cf
push 0x1c1418
call fcn.004092b0
jmp 0x40f8dd
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x80004005
jmp 0x40fa1d
or ecx, 0xffffffff
mov eax, 0x4e20
cmp dword [ebp + 8], ebx
cmove eax, ecx
lea ecx, [esi + 0x38]
push eax
call fcn.004115f3
test eax, eax
je 0x40f90c
mov eax, 0x80004004
jmp 0x40fa1d
mov ecx, dword [esi + 0x24]
mov byte [esi + 0x180], 1
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edi, [esi + 0x124]
cmp dword [edi + 8], ebx
je 0x40f94e
cmp dword [edi], ebx
je 0x40f94e
jmp 0x40f93f
mov ecx, dword [ebp - 8]
push 1
mov eax, dword [ecx]
call dword [eax + 0x7c]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.00429021
test al, al
jne 0x40f92c
push 0x42cec8
lea eax, [esi + 0x10]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 4]
call fcn.0041c84e
test eax, eax
js 0x40f972
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40f982
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40f98e
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x40f99a
call fcn.00415ff9
lea edi, [esi + 0x7c]
cmp dword [edi + 8], ebx
je 0x40f9c9
cmp dword [edi], ebx
je 0x40f9c9
jmp 0x40f9ba
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.00429021
test al, al
jne 0x40f9a8
lea edi, [esi + 0xd0]
cmp dword [edi + 8], ebx
je 0x40f9f2
cmp dword [edi], ebx
je 0x40f9f2
jmp 0x40f9e3
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00429021
test al, al
jne 0x40f9da
cmp dword [esi + 0x17c], ebx
je 0x40fa1b
call fcn.00428f44
test al, al
je 0x40fa11
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [esi + 0x17c], ebx
jmp 0x40fa1b
push 0x1c141d
call fcn.004092b0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4