joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419150
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
push 1
push 0
push 0x46b0ac
push 0x80000002
mov dword [esp + 0x2c], esi
call dword [0x458020]
test eax, eax
jne 0x4191c3
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edi
push eax
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
call dword [0x45801c]
test eax, eax
je 0x4191b0
push esi
mov esi, dword [esp + 0x18]
push esi
push edi
call dword [0x4582c0]
push esi
call dword [0x458284]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 8]
push ecx
call dword [0x458018]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ecx
ret
mov edx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
push esi
push edx
call dword [0x4582c0]
push esi
call dword [0x458284]
pop esi
pop ecx
ret

Function at 0x4191e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x1c]
push eax
push 1
push 0
push ecx
push edx
mov dword [esp + 0x30], esi
call dword [0x458020]
test eax, eax
jne 0x419253
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push edi
push 0
push 0
push ecx
push edx
call dword [0x45801c]
test eax, eax
je 0x419241
push esi
mov esi, dword [esp + 0x1c]
push esi
push edi
call dword [0x4582c0]
push esi
call dword [0x458284]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
push eax
call dword [0x458018]
mov eax, dword [esp + 0x20]
pop edi
pop esi
ret
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
push esi
push ecx
call dword [0x4582c0]
push esi
call dword [0x458284]
pop esi
ret

Function at 0x419270
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push 1
push 0
push ecx
push edx
call dword [0x458020]
test eax, eax
jne 0x4192bc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
push eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push 0
push edx
push eax
call dword [0x45801c]
mov ecx, dword [esp + 0xc]
mov esi, eax
push ecx
call dword [0x458018]
mov eax, esi
pop esi
ret
Function at 0x419340
Capabilities:
Set registry value

Disassembly:
sub esp, 0x118
mov eax, dword [esp + 0x120]
push ebx
push ebp
mov ebp, dword [0x4582e4]
push esi
push edi
lea ecx, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x18], 0
call ebp
mov ebx, dword [0x458284]
lea edx, [esp + 0x24]
push edx
call ebx
mov cl, byte [esp + eax + 0x24]
lea eax, [esp + eax + 0x24]
cmp cl, 0x5c
je 0x41939c
mov esi, dword [0x458420]
lea ecx, [esp + 0x24]
cmp eax, ecx
je 0x4193a6
lea edx, [esp + 0x24]
push eax
push edx
call esi
cmp byte [eax], 0x5c
jne 0x419387
lea ecx, [eax + 1]
mov byte [eax], 0
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x134]
push 0x45df20
push edi
call dword [0x45828c]
test eax, eax
jne 0x4193c5
push 0x4683b4
push edi
call ebp
mov ebp, dword [esp + 0x138]
test ebp, ebp
jbe 0x4193fb
cmp ebp, 2
jbe 0x4193f3
cmp ebp, 4
jne 0x4193fb
push edi
mov dword [esp + 0x14], 1
call fcn.00446a39
add esp, 4
mov dword [esp + 0x18], eax
mov esi, ebp
jmp 0x419420
push edi
call ebx
mov esi, eax
inc esi
jmp 0x419420
mov al, byte [edi]
mov esi, ebp
neg esi
cmp al, 0x23
mov ebp, 3
jne 0x419420
inc edi
push edi
call fcn.00446a39
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 1
lea edx, [esp + 0x20]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x130]
push eax
push 0
push 0xf003f
push 0
push 0
lea ecx, [esp + 0x3c]
push 0
push ecx
push edx
call dword [0x458008]
mov ebx, eax
test ebx, ebx
jne 0x419490
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41945c
lea edi, [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
push edi
push ebp
push 0
push 0x45df20
push esi
call dword [0x45828c]
neg eax
sbb eax, eax
and eax, esi
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [section..rdata]
mov ecx, dword [esp + 0x14]
mov ebx, eax
push ecx
call dword [0x458018]
xor eax, eax
pop edi
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 0x118
ret

Function at 0x419520
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x114
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
lea eax, [esp]
mov dword [esp + 4], 0x104
push eax
push 0x20019
push 0
push ecx
push edx
call dword [0x458020]
test eax, eax
je 0x41955d
xor eax, eax
add esp, 0x114
ret
lea eax, [esp + 8]
push esi
mov esi, dword [0x458024]
push eax
mov eax, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x14]
push 0
lea edx, [esp + 0x24]
push ecx
push edx
push 0
push eax
call esi
cmp eax, 0x103
je 0x4195dc
push edi
mov edi, dword [0x45800c]
mov edx, dword [esp + 8]
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.00419520
mov ecx, dword [esp + 0x10]
add esp, 8
lea eax, [esp + 0x18]
push eax
push ecx
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push edx
mov dword [esp + 0x2c], 0x104
call esi
cmp eax, 0x103
jne 0x419590
pop edi
mov eax, dword [esp + 4]
push eax
call dword [0x458018]
mov eax, 1
pop esi
add esp, 0x114
ret
Function at 0x419600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe8
push ebx
push ebp
push esi
lea eax, [esp + 0xcc]
push edi
push eax
mov dword [esp + 0x34], 0x60000000
mov dword [esp + 0x38], 0x40091eb8
mov dword [esp + 0x3c], 0xe0000000
mov dword [esp + 0x40], 0x400170a3
mov dword [esp + 0x44], 0x60000000
mov dword [esp + 0x48], 0x402a428f
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0xa0000000
mov dword [esp + 0x58], 0x3ff19999
mov dword [esp + 0x5c], 0xc0000000
mov dword [esp + 0x60], 0x4000cccc
mov dword [esp + 0x64], 0xc0000000
mov dword [esp + 0x68], 0x4008cccc
mov dword [esp + 0x6c], 0x60000000
mov dword [esp + 0x70], 0x40106666
mov dword [esp + 0x74], 0x40000000
mov dword [esp + 0x78], 0x3ff33333
mov dword [esp + 0x7c], 0xa0000000
mov dword [esp + 0x80], 0x40019999
mov dword [esp + 0x84], 0xa0000000
mov dword [esp + 0x88], 0x40099999
mov dword [esp + 0x8c], 0xc0000000
mov dword [esp + 0x90], 0x4010cccc
mov dword [esp + 0x94], 0xc0000000
mov dword [esp + 0x98], 0x3ff4cccc
mov dword [esp + 0x9c], 0x60000000
mov dword [esp + 0xa0], 0x40026666
mov dword [esp + 0xa4], 0x60000000
mov dword [esp + 0xa8], 0x400a6666
mov dword [esp + 0xac], 0x40000000
mov dword [esp + 0xb0], 0x40113333
mov dword [esp + 0xb4], 0x60000000
mov dword [esp + 0xb8], 0x3ff66666
mov dword [esp + 0xbc], 0x40000000
mov dword [esp + 0xc0], 0x40033333
mov dword [esp + 0xc4], 0x40000000
mov dword [esp + 0xc8], 0x400b3333
mov dword [esp + 0xcc], 0xa0000000
mov dword [esp + 0xd0], 0x40119999
call dword [0x458194]
mov ebx, dword [0x4580fc]
call ebx
push eax
call dword [0x458190]
push 0x100
mov dword [esp + 0x28], eax
call ebx
push eax
call dword [0x458174]
mov ebp, dword [0x458178]
mov dword [esp + 0x20], eax
call ebp
push eax
call dword [0x45818c]
mov edi, eax
cmp edi, 0x7fffffff
je 0x4197e6
push 0xf
call ebp
push eax
call dword [0x45817c]
lea ecx, [esp + 0x14]
push ecx
call dword [0x458188]
mov dword [esp + 0x1c], 0xf4240
lea edx, [esp + 0x58]
xor ecx, ecx
fld qword [edx - 8]
fmul qword [esp + ecx + 0x30]
mov eax, edx
mov esi, 3
fstp qword [esp + ecx + 0xd8]
fld qword [esp + ecx + 0xd8]
fld qword [eax]
fmul qword [esp + ecx + 0x30]
add eax, 8
dec esi
faddp st(1)
jne 0x41981b
fstp qword [esp + ecx + 0xd8]
add ecx, 8
add edx, 0x20
cmp ecx, 0x20
jl 0x4197ff
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x1c], eax
jne 0x4197f9
lea edx, [esp + 0x28]
push edx
call dword [0x458188]
cmp edi, 0x7fffffff
je 0x419863
push edi
call ebp
push eax
call dword [0x45817c]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x419879
mov eax, dword [esp + 0x24]
push eax
call ebx
push eax
call dword [0x458174]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
sub ecx, edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
sbb edx, eax
pop edi
mov dword [esp + 0x14], edx
pop esi
fild qword [esp + 0xc]
fild qword [esp + 0xc8]
fdivp st(1)
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ae40
Capabilities:
Set registry value

Disassembly:
sub esp, 0x208
mov ax, word [0x45d5b8]
push ebx
push esi
mov edx, dword [esp + 0x218]
push edi
mov word [esp + 0x10], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x12]
mov ebx, dword [esp + 0x218]
rep stosd dword es:[edi], eax
xor ecx, ecx
test edx, edx
stosw word es:[edi], ax
lea edx, [esp + 0x10]
lea eax, [esp + 0x110]
push edx
push eax
setne cl
or word [0x46b9cc], cx
push ebx
call fcn.0041a890
add esp, 0xc
test eax, eax
jne 0x41aea8
pop edi
pop esi
mov eax, 0x2716
pop ebx
add esp, 0x208
ret
mov al, byte [0x46bee0]
test al, al
mov eax, 0x46bee0
jne 0x41aeb8
mov eax, ebx
push eax
call fcn.0040a630
add esp, 4
push eax
call dword [0x458468]
mov edi, dword [0x4582e4]
mov esi, eax
mov al, byte [esp + 0x10]
mov byte [0x46bee0], 0
cmp al, 0x20
jne 0x41aee7
lea ecx, [esp + 0x10]
push esi
push ecx
call edi
test byte [0x46a6e0], 0xc
je 0x41aeff
lea edx, [esp + 0x110]
push str.SoftwareMicrosoftWindows_NTCurrentVersionFonts
push edx
jmp 0x41af0c
lea eax, [esp + 0x110]
push str.SoftwareMicrosoftWindowsCurrentVersionFonts
push eax
call edi
lea ecx, [esp + 0xc]
lea edx, [esp + 0x110]
push ecx
push 2
push 0
push edx
push 0x80000002
call dword [0x458020]
test eax, eax
je 0x41af3d
pop edi
pop esi
mov eax, 0x2716
pop ebx
add esp, 0x208
ret
push ebx
call dword [0x4580ac]
lea eax, [esp + 0x10]
push str.__TrueType_
push eax
call dword [0x458270]
push esi
call dword [0x458284]
mov edx, dword [esp + 0xc]
inc eax
push eax
push esi
push 1
lea ecx, [esp + 0x1c]
push 0
push ecx
push edx
call dword [section..rdata]
mov eax, dword [esp + 0xc]
push eax
call dword [0x458018]
push 0
push 0
push 0x1d
push 0xffff
call dword [0x4584a8]
pop edi
pop esi
mov eax, 0x2710
pop ebx
add esp, 0x208
ret

Function at 0x41bec0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x12c
push ebx
mov ebx, dword [esp + 0x138]
push ebp
mov ebp, dword [esp + 0x138]
lea eax, [esp + 8]
push esi
xor esi, esi
push eax
push 0x2001f
push esi
push ebx
push ebp
mov dword [esp + 0x20], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], esi
call dword [0x458020]
cmp eax, esi
jne 0x41bf91
lea ecx, [esp + 0x30]
push edi
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x28]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x48]
push esi
lea ecx, [esp + 0x60]
push eax
push ecx
push edx
call dword [0x458034]
mov edi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [0x458018]
cmp edi, esi
pop edi
jne 0x41bf91
cmp dword [esp + 0x10], esi
jne 0x41bf91
cmp dword [esp + 0x14], esi
je 0x41bf7a
cmp dword [esp + 0x144], esi
je 0x41bf91
push ebx
push ebp
call dword [0x45800c]
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x12c
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12c
ret
Function at 0x41bfa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x41bfab
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x41c0ae
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4589c4]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4589c4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4589c4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4589c4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4589c4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4589c4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4589c4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4589c4]
xor eax, edx
inc ecx
dec edi
jne 0x41bfc6
pop edi
test esi, esi
je 0x41c0d0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4589c4]
xor eax, edx
inc ecx
dec esi
jne 0x41c0b2
pop esi
pop ebx
not eax
ret
Function at 0x41d290
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x214
push ebx
push esi
push edi
push 0
call dword [0x4584e8]
mov edi, dword [esp + 0x224]
push edi
call fcn.0040d9e0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x41d2cb
lea eax, [esp + 0xc]
push eax
push 0x45af68
push 1
push ebx
push 0x45af98
jmp 0x41d2de
lea ecx, [esp + 0x10]
push ecx
push 0x45af88
push 1
push 0
push 0x45af78
call dword [0x4584e0]
mov esi, eax
test esi, esi
jl 0x41d411
test ebx, ebx
je 0x41d32c
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push 0x45af68
mov edx, dword [eax]
push eax
call dword [edx]
mov esi, eax
mov eax, dword [esp + 0x10]
test esi, esi
jge 0x41d321
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x214
ret
mov ecx, dword [eax]
push 1
push edi
push eax
call dword [ecx + 0xc]
jmp 0x41d36d
mov eax, dword [esp + 0xc]
push edi
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x230]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x234]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x22c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, dword [esp + 0x238]
push 0x45df20
push esi
call dword [0x4582f8]
test eax, eax
je 0x41d388
mov eax, esi
jmp 0x41d392
mov eax, ebx
neg eax
sbb eax, eax
not eax
and eax, edi
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x23c]
push esi
push eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0x44]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0x45afa8
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x41d3f9
mov ecx, dword [esp + 0x228]
lea eax, [esp + 0x18]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [0x4580cc]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test ebx, ebx
je 0x41d411
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [0x4584ec]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x214
ret
Function at 0x41d730
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x46a6e0]
sub esp, 0x108
and al, 3
lea ecx, [esp]
push esi
xor esi, esi
neg al
sbb eax, eax
push ecx
and al, 0xeb
add eax, 0x17
push eax
push esi
call dword [0x458318]
test eax, eax
jne 0x41d7fa
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
call dword [0x45831c]
test eax, eax
je 0x41d7fa
mov esi, dword [0x458270]
push edi
lea ecx, [esp + 0xc]
push 0x45da58
push ecx
call esi
mov edx, dword [esp + 0x114]
lea eax, [esp + 0xc]
push edx
push eax
call esi
mov edi, dword [esp + 0x118]
push edi
call fcn.0040d9e0
add esp, 4
test eax, eax
mov eax, str..url
jne 0x41d7b6
mov eax, str..lnk
lea ecx, [esp + 0xc]
push eax
push ecx
call esi
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x124]
push edx
mov edx, dword [esp + 0x124]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push 0x4683b4
push eax
push edi
call fcn.0041d290
add esp, 0x1c
pop edi
pop esi
add esp, 0x108
ret
mov eax, esi
pop esi
add esp, 0x108
ret

Function at 0x41d810
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x46a6e0]
sub esp, 0x108
and al, 3
lea ecx, [esp]
push esi
xor esi, esi
neg al
sbb eax, eax
push ecx
and al, 0xe7
add eax, 0x19
push eax
push esi
call dword [0x458318]
test eax, eax
jne 0x41d8da
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
call dword [0x45831c]
test eax, eax
je 0x41d8da
mov esi, dword [0x458270]
push edi
lea ecx, [esp + 0xc]
push 0x45da58
push ecx
call esi
mov edx, dword [esp + 0x114]
lea eax, [esp + 0xc]
push edx
push eax
call esi
mov edi, dword [esp + 0x118]
push edi
call fcn.0040d9e0
add esp, 4
test eax, eax
mov eax, str..url
jne 0x41d896
mov eax, str..lnk
lea ecx, [esp + 0xc]
push eax
push ecx
call esi
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x124]
push edx
mov edx, dword [esp + 0x124]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push 0x4683b4
push eax
push edi
call fcn.0041d290
add esp, 0x1c
pop edi
pop esi
add esp, 0x108
ret
mov eax, esi
pop esi
add esp, 0x108
ret

Function at 0x427efc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x427f43
cmp edx, 0x10
jl 0x427f2f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x427f1c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x427f43
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x427f3b
and edx, 3
cmp edx, 3
jne 0x427f57
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x427f5c
cmp edx, 2
jne 0x427f68
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x427f6d
cmp edx, 1
jne 0x427f73
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x42ffe0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0x54], 1
mov eax, dword [0x46df44]
push eax
call dword [0x4583cc]
test eax, eax
push 1
jne 0x430039
mov ecx, dword [esi + 0x74]
mov edi, dword [0x458480]
push ecx
call edi
mov edx, dword [0x46df44]
push 1
push edx
call edi
mov eax, dword [0x46df44]
push eax
call dword [0x45845c]
mov ecx, dword [0x46df44]
push 0
push 0
push 0x806b
push ecx
call dword [0x458488]
jmp 0x430043
mov edx, dword [esi + 0x74]
push edx
call dword [0x458480]
mov ecx, dword [esi + 0x8c]
test ecx, ecx
jne 0x430057
mov ecx, dword [esi + 0x94]
test ecx, ecx
je 0x43005c
call fcn.00438fc0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ebx, dword [esi + 0xd4]
push ebx
call dword [0x4581b0]
mov edi, dword [ebx + 0x18]
test edi, edi
je 0x43008f
mov ecx, dword [edi + 8]
mov eax, dword [ecx + 0x68]
test eax, eax
jne 0x430088
mov edx, dword [ecx]
push 0
call dword [edx + 0x1c]
mov edi, dword [edi + 4]
test edi, edi
jne 0x430077
push ebx
call dword [0x4581ac]
mov dword [esi + 0x64], 1
pop edi
pop esi
pop ebx
ret

Function at 0x4300b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 0xd4]
push ebx
call dword [0x4581b0]
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x4300df
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x6c]
test eax, eax
jne 0x4300d8
mov eax, dword [ecx]
call dword [eax + 0x20]
mov esi, dword [esi + 4]
test esi, esi
jne 0x4300c9
push ebx
call dword [0x4581ac]
mov esi, dword [0x458480]
mov dword [edi + 0x64], 0
mov eax, dword [0x46df44]
test eax, eax
je 0x43011b
push eax
call dword [0x4583cc]
test eax, eax
je 0x43011b
call fcn.0043e4c0
cmp eax, edi
jne 0x43011b
mov ecx, dword [0x46df44]
push 0
push ecx
call esi
mov edx, dword [edi + 0x74]
push 0
push edx
call esi
mov dword [edi + 0x54], 0
pop edi
pop esi
pop ebx
ret
Function at 0x436c90
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x46df34]
test eax, eax
jne 0x436cc5
mov eax, dword [esp + 4]
push 0x46df38
and eax, 0xffff
push 0
push eax
push 0x436ec0
push 0
push 0
call fcn.00447baf
add esp, 0x18
mov dword [0x46df34], eax
test eax, eax
jne 0x436cc5
ret
mov eax, 1
ret

Function at 0x436d10
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 1
push 0
call dword [0x4580c0]
push 0x46df40
push 0
push 0
push 0x4372c0
push 0
push 0
mov dword [0x46df2c], eax
call fcn.00447baf
add esp, 0x18
mov dword [0x46df30], eax
ret

Function at 0x43ca10
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x108]
test eax, eax
jne 0x43ca3d
push str.DDMonitorEvent
push 0
push 1
push 0
call dword [0x4580c0]
mov dword [esi + 0x108], eax
mov eax, dword [esi + 0x104]
test eax, eax
je 0x43ca5e
mov eax, dword [esi + 0x108]
push eax
call dword [0x4582e8]
mov dword [esi + 0x104], 0
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x43ca90
push 0
push 0
call fcn.00447baf
add esp, 0x18
mov dword [esi + 0x104], eax
pop esi
pop ecx
ret

Function at 0x443a70
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x60
push ebx
push esi
mov ebx, ecx
lea eax, [esp + 0x6c]
push edi
push eax
lea ecx, [esp + 0x10]
call fcn.00437450
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x10]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0x63
call fcn.00437960
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], ecx
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x38]
mov edx, dword [esp + 0x74]
lea esi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 0xa
lea edi, [esp + 0x40]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
lea eax, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x74]
push eax
push 0
push 0x1100
push ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], 0xffff0003
call dword [0x458488]
mov esi, eax
mov eax, dword [ebx + 0x80]
test eax, eax
jne 0x443b15
mov dword [ebx + 0x80], esi
lea ecx, [esp + 0xc]
call fcn.004375e0
lea ecx, [esp + 0x70]
call fcn.004375e0
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x60
ret 0xc

Function at 0x446210
Capabilities:
Hide graphical window

Disassembly:
mov dword [ecx + 0x2c], 0
mov ecx, dword [ecx + 0x70]
test ecx, ecx
je 0x446227
push 0
push ecx
call dword [0x458480]
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x215f3ee3
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..pdata_1
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4671be1
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219