joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52c640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
lea eax, [esp]
mov word [esp + 1], 0x5354
push eax
mov dword [esp + 0x11], 0x6f736e6f
mov dword [esp + 0xc], 0x65766974
mov dword [esp + 8], 0x63417465
mov dword [esp + 0x16], 0x73655365
mov dword [esp + 0x1b], 0x496e6f69
mov byte [esp + 0x10], 0x43
mov byte [esp + 0x15], 0x6c
mov byte [esp + 7], 0x47
mov word [esp + 0x1f], 0x64
mov byte [esp + 4], 0x57
mov byte [esp + 0x1a], 0x73
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52c6ac
call eax
add esp, 0x20
ret
or eax, 0xffffffff
add esp, 0x20
ret

Function at 0x52c770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.00518280
mov esi, eax
test esi, esi
je 0x52c7d8
lea eax, [esp + 8]
mov dword [esp + 0xb], 0x6d655268
push eax
push esi
mov dword [esp + 0x21], 0x416e6f
mov word [esp + 0x1b], 0x7478
mov word [esp + 0x1e], 0x736e
mov dword [esp + 0x17], 0x4565766f
mov word [esp + 0x10], 0x6150
mov byte [esp + 0x20], 0x69
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x1d], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52c7d1
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
add esp, 0x18
ret

Function at 0x52c870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 0xe
call fcn.0051dc70
mov edi, eax
test edi, edi
je 0x52c8d0
lea eax, [esp + 0x10]
mov dword [esp + 0x13], 0x536f5464
push eax
push edi
mov word [esp + 0x18], 0x7555
mov dword [esp + 0x1f], 0x6e697274
mov byte [esp + 0x1a], 0x69
mov word [esp + 0x24], 0x41
mov byte [esp + 0x23], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52c8c9
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x52c8e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0xe
call fcn.0051dc70
mov edi, eax
test edi, edi
je 0x52c941
lea eax, [esp + 0xc]
mov word [esp + 0x11], 0x6972
push eax
push edi
mov dword [esp + 0x1c], 0x65724667
mov word [esp + 0x21], 0x41
mov dword [esp + 0x15], 0x74536370
mov byte [esp + 0x14], 0x52
mov byte [esp + 0x20], 0x65
mov byte [esp + 0x1b], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52c93a
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x52e2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x52e314
lea eax, [esp + 0x10]
mov word [esp + 0x1a], 0x756c
push eax
push edi
mov dword [esp + 0x25], 0x417845
mov dword [esp + 0x19], 0x75516765
mov dword [esp + 0x1d], 0x56797265
mov byte [esp + 0x24], 0x65
mov byte [esp + 0x18], 0x52
mov byte [esp + 0x21], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52e30d
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x52e460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
xor esi, esi
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x52e4c4
lea eax, [esp + 8]
mov word [esp + 0x14], 0x4172
push eax
push edi
mov dword [esp + 0x12], 0x43536e65
mov word [esp + 0x19], 0x6761
mov word [esp + 0x16], 0x614d
mov byte [esp + 0x18], 0x6e
mov byte [esp + 0x1e], 0
mov word [esp + 0x10], 0x704f
mov byte [esp + 0x1b], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52e4bd
push 1
push esi
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x52e4d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x52e530
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x41656369
push eax
push edi
mov dword [esp + 0x1b], 0x7265536e
mov word [esp + 0x18], 0x704f
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52e529
push 0x60000
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x52e540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x52e5be
lea eax, [esp + 0xc]
mov dword [esp + 0x23], 0x41726568
push eax
push edi
mov dword [esp + 0x1a], 0x69767265
mov dword [esp + 0x27], 0x63746170
mov dword [esp + 0x22], 0x69446c72
mov word [esp + 0x1f], 0x4365
mov dword [esp + 0x15], 0x74726174
mov byte [esp + 0x19], 0x53
mov byte [esp + 0x2f], 0
mov byte [esp + 0x1e], 0x63
mov byte [esp + 0x26], 0x73
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x21], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52e5b7
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x52fc70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x52fcd4
lea eax, [esp + 0x10]
mov dword [esp + 0x15], 0x65636f72
push eax
push edi
mov dword [esp + 0x23], 0x656b6f54
mov dword [esp + 0x19], 0x506e6570
mov word [esp + 0x21], 0x7373
mov word [esp + 0x27], 0x6e
mov byte [esp + 0x18], 0x4f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52fccd
push dword [esp + 0x28]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x52fd80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, 1
call fcn.00518280
mov esi, eax
test esi, esi
je 0x52fdfd
lea eax, [esp + 8]
mov word [esp + 9], 0x7373
push eax
push esi
mov dword [esp + 0x14], 0x65755163
mov word [esp + 0x1d], 0x6e69
mov byte [esp + 0x10], 0x41
mov word [esp + 0x20], 0x41
mov byte [esp + 0x1f], 0x67
mov dword [esp + 0x18], 0x74537972
mov byte [esp + 0x1c], 0x72
mov byte [esp + 0x13], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52fdf6
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push 2
push 0
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
add esp, 0x14
ret

Function at 0x52fe10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x52fe82
lea eax, [esp + 0xc]
mov word [esp + 0x1b], 0x6c69
push eax
push edi
mov dword [esp + 0x18], 0x6f547473
mov dword [esp + 0x1c], 0x506e656b
mov dword [esp + 0x14], 0x756a6441
mov word [esp + 0x20], 0x6972
mov dword [esp + 0x26], 0x736567
mov byte [esp + 0x22], 0x76
mov byte [esp + 0x25], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52fe7b
push esi
push esi
push 0x10
push dword [esp + 0x34]
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x52fe90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e982
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xca0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xa8], edi
mov dword [ebp - 4], 0
push 0x548f0c
mov dword [ebp - 0xa4], 0
call fcn.004218c0
mov dword [ebp - 4], 0
mov eax, 0x43
mov word [ebp - 0x64], ax
mov esi, 0x6f
mov eax, 0x52
mov dword [ebp - 0xa4], 1
mov word [ebp - 0x94], ax
mov ecx, 0x72
mov eax, 0x4d
mov word [ebp - 0x5e], cx
mov word [ebp - 0x8e], ax
mov eax, 0x65
mov word [ebp - 0x54], ax
mov eax, 0x72
push 0x800
mov word [ebp - 0x30], ax
lea eax, [ebp - 0xca8]
mov word [ebp - 0x88], cx
lea ecx, [esi + 5]
push 0
push eax
mov dword [ebp - 0x62], 0x720075
mov dword [ebp - 0x7a], 0x690057
mov dword [ebp - 0x8c], 0x630069
mov dword [ebp - 0x98], 0x410057
mov dword [ebp - 0x92], 0x5c0045
mov dword [ebp - 0xa0], 0x4f0053
mov dword [ebp - 0x86], 0x73006f
mov dword [ebp - 0x82], 0x66006f
mov dword [ebp - 0x52], 0x730072
mov dword [ebp - 0x9c], 0x540046
mov dword [ebp - 0x6c], 0x4e0020
mov dword [ebp - 0x5c], 0x6e0065
mov dword [ebp - 0x4e], 0x6f0069
mov dword [ebp - 0x7e], 0x5c0074
mov dword [ebp - 0x68], 0x5c0054
mov dword [ebp - 0x58], 0x560074
mov dword [ebp - 0x70], 0x730077
mov dword [ebp - 0x76], 0x64006e
mov dword [ebp - 0x4a], 0x6e
mov word [ebp - 0x72], si
mov dword [ebp - 0x2e], 0x64006f
mov dword [ebp - 0x2a], 0x630075
mov dword [ebp - 0x34], 0x50006c
mov dword [ebp - 0x38], 0x610074
mov dword [ebp - 0x26], 0x490074
mov dword [ebp - 0x3c], 0x690067
mov dword [ebp - 0x22], 0x64
mov dword [ebp - 0x40], 0x690044
call fcn.00443110
add esp, 0xc
mov dword [ebp - 0x10], 0x800
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xa0]
push eax
push 0x101
push ecx
call fcn.0052a570
add esp, 0xc
test eax, eax
jne 0x5300f6
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xca8]
push eax
push 0
push ecx
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x40]
call fcn.00522b00
add esp, 0x10
test eax, eax
jne 0x5300ee
push 0x400
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.00443110
add esp, 0xc
lea edx, [ebp - 0x4a8]
lea ecx, [ebp - 0xca8]
push dword [ebp - 0x10]
call fcn.004020e0
mov eax, 0x25
mov dword [ebp - 0x1a], 0x73
mov word [ebp - 0x1c], ax
add esp, 4
lea eax, [ebp - 0x4a8]
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5300b0
sub eax, edx
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x5300c8
xor eax, eax
jmp 0x5300e0
lea eax, [esi + esi]
call fcn.00496e80
mov ecx, esp
lea edx, [ebp - 0x4a8]
push 3
push esi
call fcn.00422ea0
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00422d40
add esp, 0xc
mov ecx, dword [ebp - 0x14]
call fcn.00527fe0
mov eax, edi
lea esp, [ebp - 0xcb8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov esi, ebp
or byte [ebx + 0x40c0c80d], cl
add byte [ecx], ch
add cl, 0x82
jl 0x4017d6
invalid
daa
inc ecx
mov ah, 0x53

Function at 0x40b690
Capabilities:
Access peb ldr_data
Get process filename
Resolve function by parsing pe exports

Disassembly:
push edi
sbb al, 0x53
xor edi, edi
mov eax, dword [edi + eax*4 + 0x14]
xchg dword [ebx + ecx], edx
invalid
jge 0x40b5b1
mov dword [0x1024548b], eax
neg eax
neg edx
adc edx, 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
loop 0x40b5f7
and al, 0x26
or eax, eax
retf
int1
mov ebx, eax
mov eax, dword [esi + eax + 0x10]
div ecx
mov ebx, dword [edx - 0x2774be15]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, ebp
int3
shr ebx, 1
rcr ecx, 1
shr dword [eax - 0x2f], 1
scasd eax, dword es:[edi]
or ebx, ebx
jne 0x40b5f7
div ecx
mov esi, eax
div dword [esp - 0x743774e4]
inc esp
mov eax, dword [0xbde60f18]
rcl dword [ebx + 0xe]
cmp edx, dword [esp + 0x14]
ja 0x40b625
jb 0x40b5dc
cmp eax, dword [esp + 0x10]
jbe 0x40b626
dec esi
xor edx, edx
mov eax, esi
dec edi
jne 0x40b66c
neg edx
neg eax
sbb edx, 0
pop ebx
pop esi
aas
ret 0x10
mov eax, 0x57410087
push ecx
adc ah, byte [ebx - 0x5f]
int1
stosb byte es:[edi], al
lds edx, [eax + 0x200aeb90]
inc eax
pop eax
push ds
sub dword [esi + 0x1e], eax
adc dword [esi + 0x3e0aebca], edx
or dword [edx], ebx
or ebx, dword [edi - 0x692c401b]
xchg esi, eax
dec edi

Function at 0x40890d
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop edi
call fcn.00408935
xor dword [ecx], edi
inc ebx
dec eax
add ecx, 1
push 0x2efb78bf
pop ebx
cmp ecx, esi
jne fcn.0040890d
sub ebx, 1
ret
Function at 0x4047e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488930
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4b22c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x30]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404820
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
call fcn.004046b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405610
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488c76
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4b22c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
xor eax, eax
mov dword [ebp - 4], 0
cmp dword [ecx + 0x2c], eax
lea ecx, [ebp - 0x230]
push 0x2001f
setne al
push str.SoftwareMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call fcn.004093f0
mov edi, dword [ebp - 0x230]
test eax, eax
jne 0x4057a7
call fcn.00408700
mov ecx, eax
test ecx, ecx
je 0x4057d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
push dword [esi + 8]
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 1
push dword [esi]
push str.__s___s
push eax
call fcn.00408610
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00460e20
add esp, 0x1c
mov dword [ebp - 0x21c], 0x208
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405736
mov eax, dword [ebp - 0x224]
cmp eax, 1
je 0x405724
cmp eax, 2
jne 0x405736
cmp dword [ebp - 0x21c], 0
jne 0x405736
xor eax, eax
mov word [ebp - 0x218], ax
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00464796
add esp, 8
test eax, eax
je 0x405784
test esi, esi
je 0x405784
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405760
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4057a0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x4057a9
xor esi, esi
test edi, edi
je 0x4057b4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00446191
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00407d70
int3
Function at 0x407fc0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor eax, eax
mov dword [ebp - 0xc], 0
cmp dword [ecx + 0x2c], eax
lea ecx, [ebp - 0xc]
push edi
push 0x2001f
setne al
mov dword [ebp - 8], 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
mov dword [ebp - 4], 0
push eax
call fcn.004093f0
mov edi, dword [ebp - 0xc]
test eax, eax
jne 0x408015
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, 1
jmp 0x408017
xor esi, esi
test edi, edi
je 0x408022
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4087e0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489188
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4b22c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp word [0x4d95f8], 0
jne 0x408824
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x4d95f8
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.00408700
mov ecx, eax
test ecx, ecx
je 0x408890
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0x4d95f8
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00407d90
test al, al
jne 0x40887c
mov ecx, 0x4d95f8
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408860
sub ecx, edx
sar ecx, 1
push ecx
push 0x4d95f8
mov ecx, esi
call fcn.00409e30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407d70
int3

Function at 0x408c90
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4b22c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp dword [ecx + 0x2c], eax
lea ecx, [ebp - 0x220]
push edi
push 0x2001f
setne al
mov dword [ebp - 0x220], 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
mov dword [ebp - 0x21c], 0
push eax
mov dword [ebp - 0x218], 0
call fcn.004093f0
mov edi, dword [ebp - 0x220]
test eax, eax
jne 0x408d72
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00460e20
add esp, 0xc
mov dword [ebp - 0x210], 0x208
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408d72
mov eax, dword [ebp - 0x214]
cmp eax, 1
je 0x408d46
cmp eax, 2
jne 0x408d72
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x408d72
test al, 1
jne 0x408d72
shr eax, 1
cmp word [ebp + eax*2 - 0x20e], 0
jne 0x408d72
cmp word [ebp - 0x20c], 0
je 0x408d72
mov esi, 1
jmp 0x408d74
xor esi, esi
test edi, edi
je 0x408d7f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00446191
mov esp, ebp
pop ebp
ret 4
Function at 0x409130
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4892d1
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x4b22c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.YxhGametray
push dword [ebx]
call fcn.00464796
add esp, 8
test eax, eax
je 0x4091a1
push str.LeyouGametray
push dword [ebx]
call fcn.00464796
add esp, 8
test eax, eax
je 0x4091a1
push dword [ebx + 0x14]
push 0xffffffffffffffff
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
sbb eax, eax
inc eax
jmp 0x409310
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00460e20
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebx + 0x14]
push 0x104
push eax
push str.true
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.false
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebp - 0x24c], ecx
test eax, eax
je 0x40930e
call fcn.00444f70
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x409308
push 0x63
push str.d:jenkins.jenkinsworkspacelib_commoncommonhelpercommonhelper_autorunmanger_autorunmanager.cpp
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], al
call fcn.0040b710
push 3
push 0x490bcc
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.0040b710
mov byte [ebp - 4], 1
call fcn.00444f70
mov edi, eax
lea ecx, [ebp - 0x2e4]
push 0x33a
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.004039e0
mov esi, eax
push str.IsDisable_
push esi
mov byte [ebp - 4], 2
call fcn.00405030
mov ecx, dword [ebx + 0x14]
mov edx, 0x490b20
test ecx, ecx
cmovne edx, ecx
push edx
push esi
call fcn.00402900
push 0x491214
push esi
call fcn.00405030
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00402900
mov edx, dword [edi]
add esp, 0x20
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x2e4]
call fcn.00405160
lea ecx, [ebp - 0x230]
call fcn.00404410
lea ecx, [ebp - 0x248]
call fcn.00404410
mov ecx, dword [ebp - 0x24c]
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00446191
mov esp, ebp
pop ebp
ret
Function at 0x40a100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a159
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40a159
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40a14a
cmp esi, edx
jae 0x40a159
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40a138
cmp esi, edx
jae 0x40a159
cmp word [esi], 0
je 0x40a159
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40f3f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4b22c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.00460e20
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.00460e20
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40f453
cmp dword [ebp - 0x114], 6
mov eax, 0x30
jae 0x40f458
mov eax, 0x2c
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x40f476
push edi
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov ecx, edi
jmp 0x40f478
mov eax, edi
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
test eax, eax
je 0x40f48c
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x10], xmm0
mov ecx, dword [0x4d9af4]
mov eax, esi
mov dword [esi + 0x20], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00446191
mov esp, ebp
pop ebp
ret 0x18