joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50a900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50aaed
sub esp, 0x54
mov eax, dword [esp + 0x58]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x50], ecx
mov edx, dword [esp + 0x4c]
test edx, edx
je 0x50aae4
lea ebx, [0x69aa00]
mov dword [esp + 0x40], edx
mov dword [esp + 0x3c], ebx
mov eax, dword [ebx + 0x80]
mov dword [esp], edx
call eax
mov eax, dword [esp + 8]
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x3c]
mov ebx, dword [edx + 0x60]
mov ebp, dword [esp + 0x40]
mov dword [esp], ebp
call ebx
mov eax, dword [esp + 8]
test eax, eax
je 0x50aaaf
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x3c]
mov ebx, dword [edx + 0x60]
mov ebp, dword [esp + 0x40]
mov dword [esp], ebp
call ebx
mov eax, dword [esp + 8]
test eax, eax
jne 0x50a9c6
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
call fcn.0050a430
add esp, 0x54
ret
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x78]
mov edx, dword [esp + 0x40]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 8]
test eax, eax
jne 0x50aa24
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 0x60]
mov ecx, dword [esp + 0x40]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
mov edx, dword [esp + 0x38]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.00437f50
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
jmp 0x50a9a6
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x78]
mov edx, dword [esp + 0x40]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 4]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x3c]
mov edx, dword [edx + 0x60]
mov ebx, dword [esp + 0x40]
mov dword [esp], ebx
call edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
mov edx, dword [esp + 0x38]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x10], edx
lea edx, [0x5f029d]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call fcn.00438010
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
jmp 0x50a9a6
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x50]
mov edx, dword [esp + 0x40]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 4]
cmp eax, 0x16
jne 0x50aade
lea eax, [0x5f0299]
mov ecx, 1
mov edx, eax
mov eax, ecx
mov ecx, edx
jmp 0x50a97e
xor eax, eax
xor ecx, ecx
jmp 0x50aad3
xor edx, edx
xor ebx, ebx
jmp 0x50a93b
call fcn.00446b60
jmp fcn.0050a900
Function at 0x535a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x535af7
sub esp, 0x5c
lea edi, [esp + 0x64]
xor eax, eax
call fcn.004485cb
lea edi, [esp + 0x34]
call fcn.004485c7
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x60]
mov ecx, dword [ecx + 8]
mov dword [esp], ecx
mov dword [esp + 4], 0
lea ecx, [esp + 0x34]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x24
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], ecx
call fcn.004ce5b0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
test edx, edx
je 0x535ab3
mov dword [esp + 0x58], ecx
lea edi, [esp + 0x64]
lea esi, [0x699900]
call fcn.00448aae
mov dword [esp + 0x78], edx
mov eax, dword [esp + 0x58]
mov dword [esp + 0x7c], eax
add esp, 0x5c
ret
lea edi, [esp + 0x20]
xor eax, eax
call fcn.004485cb
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x64]
lea esi, [esp + 0x20]
call fcn.00448aae
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x5c
ret
call fcn.00446b60
jmp fcn.00535a20

Function at 0x535e40
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x535f79
sub esp, 0x54
lea eax, [0x5dd000]
mov dword [esp], eax
call fcn.0040d050
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
lea ecx, [0x69a2a0]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [0x78d5e0]
mov ecx, dword [0x78d5e4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.004b0170
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], edx
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
test ebp, ebp
je 0x535f5d
je 0x535f29
mov ebp, dword [ebp + 4]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebx
lea eax, [esp + 0x4c]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 1
call fcn.004cb970
mov eax, dword [esp + 0x48]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x70], eax
add esp, 0x54
ret
call fcn.00446b60
jmp fcn.00535e40
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x58fe4f9d
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..rdata
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2e74303
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
mov ebx, 0x408f6c
mov ecx, 0x2cfe2ba1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data_1
mov ebx, 0x42e3d0
nop
mov ecx, 0xbc631f9
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x402b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add dword [0x4564cc], 0x2c293031
movzx eax, word [0x4a572a]
mov edx, dword [ebp + 8]
xor eax, 0x4149201
push esi
mov esi, dword [ebp + 0xc]
mov word [0x4a572a], ax
mov al, byte [esi]
movzx ecx, byte [edx]
push edi
movzx edi, al
sub ecx, edi
jne 0x402bb7
test al, al
je 0x402bb7
mov al, byte [esi + 1]
movzx ecx, byte [edx + 1]
inc esi
inc edx
movzx edi, al
sub ecx, edi
je 0x402ba3
fld qword [0x48cab0]
pop edi
fsub qword [0x478250]
pop esi
fld dword [0x4a7a88]
fadd qword [0x47e860]
fadd dword [0x4bc38c]
fld qword [0x478250]
fld1
fsub st(1), st(0)
fxch st(1)
fstp qword [0x478250]
fld qword [0x48cab0]
fadd st(1)
fstp qword [0x48cab0]
fxch st(2)
fcompi st(1)
fstp st(0)
jb 0x402c09
xor dword [0x44e820], 0xefaa3d9b
test ecx, ecx
jge 0x402c97
mov ecx, dword [0x443c3c]
cmp ecx, 0x773b5a03
je 0x402c5f
mov edx, dword [0x453088]
mov ecx, dword [0x442990]
mov eax, 0x68c281c4
sub eax, edx
and ecx, 0xed6e0c0a
cmp ecx, eax
je 0x402c5f
mov edx, dword [0x44af50]
movzx ecx, word [0x4a4bea]
mov eax, 0x628e18ca
sub eax, edx
or ecx, eax
mov word [0x4a4bea], cx
inc dword [0x44af50]
mov edx, dword [0x441fd4]
mov eax, dword [0x440828]
or edx, eax
or ecx, 0xffffffff
add dword [0x440828], ecx
or edx, 0x98c80c67
cmp edx, 0xbfede0f2
jne 0x402ccb
mov edx, dword [0x44b3d4]
imul edx, edx, 0x73f045df
mov dword [0x44b3d4], edx
jmp 0x402ccb
jle 0x402ccb
mov ax, word [0x4a2c30]
mov ecx, dword [0x455948]
cwde
add eax, 0x504cfc2
imul ecx, eax
mov dword [0x455948], ecx
mov ecx, 1
fld dword [0x4af384]
fmul qword [0x47edb8]
fstp qword [0x47edb8]
fld dword [0x4a7e40]
fld qword [0x45de68]
fld dword [0x4ab490]
fmulp st(2)
fld dword [0x4a7e40]
faddp st(3)
fxch st(2)
fstp dword [0x4a7e40]
fxch st(1)
fucompi st(1)
fstp st(0)
lahf
test ah, 0x44
jnp 0x402d1f
mov dx, word [0x4a04dc]
movsx eax, dx
or eax, 0x770811f3
cmp eax, 0x658e1016
mov eax, ecx
jne 0x402d21
add dword [0x4517a4], 0xe2d69dc1
pop ebp
ret
mov eax, ecx
pop ebp
ret
Function at 0x402e10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x452760]
mov ecx, dword [0x442858]
imul eax, ecx
push ebx
mov ebx, 1
add dword [0x452760], ebx
cmp eax, 0xd080a0b1
push esi
push edi
jl 0x402e4a
mov edx, dword [0x4413a0]
imul edx, edx, 0x62c0b2dd
mov dword [0x4413a0], edx
jmp 0x402e5c
movzx eax, word [0x49f590]
add eax, 0x1faeeb48
mov word [0x49f590], ax
add dword [0x444b20], 0x6baff2ba
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x402f56
fld dword [0x4b7034]
fadd qword [0x492bc0]
fadd qword [0x490938]
fmul dword [0x4bada4]
fstp dword [0x4bada4]
fld qword [0x492bc0]
fadd qword [0x43af78]
fstp qword [0x492bc0]
test esi, esi
je 0x402f0b
call fcn.00430b80
movzx eax, al
cdq
mov ecx, 0xa
idiv ecx
test edx, edx
jne 0x402f0b
and dword [0x449ba4], 0x7f1520b3
call fcn.00430b80
movzx eax, al
cdq
mov ecx, 0xa
idiv ecx
add dl, 0x30
mov byte [esi + edi], dl
mov edx, dword [0x44968c]
mov eax, dword [0x443b80]
add dword [0x443b80], ebx
and edx, eax
and edx, 0x1e711d3c
cmp edx, 0x6e434a24
jne 0x402f35
mov ecx, 0x5623
mov word [0x4a5212], cx
jmp 0x402f35
add dword [0x43d13c], 0xa023395c
call fcn.00430b80
movzx eax, al
cdq
mov ecx, 0x1a
idiv ecx
add dl, 0x61
mov byte [esi + edi], dl
add dword [0x45152c], 0x11100032
mov eax, dword [0x444608]
xor eax, 0x1257d08a
or dword [0x448ad4], eax
add dword [0x444608], ebx
add esi, ebx
cmp esi, dword [ebp + 0xc]
jne 0x402e74
add dword [0x455e94], ebx
mov eax, dword [0x455e94]
mov edx, dword [0x43eb5c]
xor eax, 0x57c38bd0
imul edx, eax
mov dword [0x43eb5c], edx
mov byte [esi + edi], 0
movzx eax, word [0x49f122]
pop edi
and eax, 0x8ea07246
pop esi
mov word [0x49f122], ax
pop ebx
pop ebp
ret

Function at 0x4037d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
fld dword [0x4c2670]
push esi
fadd qword [0x48c418]
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
fsub dword [0x4b4874]
fstp qword [0x471c48]
call fcn.00404700
mov ecx, edi
mov esi, eax
call fcn.0041f510
cmp esi, eax
je 0x403843
movzx eax, word [0x49bd04]
and eax, 0x7ebaff7f
mov word [0x49bd04], ax
mov byte [esi], 0
mov eax, dword [0x44e20c]
mov ecx, dword [0x44112c]
and eax, 0xbed29fb
xor ecx, eax
sub dword [0x459e20], ecx
inc dword [0x44112c]
mov ecx, edi
inc esi
call fcn.0041f510
cmp esi, eax
jne 0x403804
mov ecx, dword [0x452a2c]
or ecx, 0x7b6708d6
pop edi
mov dword [0x44e43c], ecx
pop esi
pop ebp
ret
Function at 0x40dee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x45a928]
mov cx, word [0x4a4324]
push ebx
movsx edx, cx
or eax, 0x8056ecab
push esi
or ebx, 0xffffffff
push edi
cmp edx, eax
je 0x40df1d
mov eax, dword [0x43df64]
movzx ecx, word [0x4980ba]
or eax, 0x59df5957
sub ecx, eax
mov word [0x4980ba], cx
jmp 0x40df2f
mov edx, dword [0x451690]
mov dword [0x45a0a4], edx
add dword [0x451690], ebx
fld qword [0x485d48]
mov edi, dword [ebp + 8]
fmul qword [0x460608]
xor eax, eax
fmul dword [0x4b2100]
fadd dword [0x4c2908]
fstp dword [0x4c2908]
xor dword [0x43f9e8], 0x18b9772
movsx esi, byte [edi]
test esi, esi
je 0x40e0c8
fld1
movzx ecx, word [0x498fe8]
movsx edx, cx
movzx ecx, word [0x4a0eca]
shl edx, 7
movsx ecx, cx
sub ecx, edx
mov edx, dword [0x449ff0]
imul edx, edx, 0x6509ed35
or ecx, 0x83576610
add edx, 0x419ab58a
inc edi
cmp ecx, edx
jle 0x40dfc5
fld dword [0x4abf98]
fadd dword [0x4c1c20]
fadd dword [0x4bf73c]
fstp dword [0x4bf73c]
fld dword [0x4c1c20]
fadd st(1)
fstp dword [0x4c1c20]
lea ecx, [esi - 0x30]
cmp ecx, 9
ja 0x40e082
add dword [0x4440d8], ebx
mov dx, word [0x4a5a0c]
mov ecx, dword [0x4440d8]
movsx edx, dx
sub ecx, edx
or ecx, 0x58fdf81d
add dword [0x43d39c], ecx
mov edx, 0x6d57d014
fld dword [0x4ac2e0]
lea eax, [eax + eax*4]
fsub dword [0x4c28cc]
lea eax, [esi + eax*2 - 0x30]
fstp dword [0x4ac2e0]
fld dword [0x4b3e0c]
fadd dword [0x4b7234]
fsub dword [0x4bf3c4]
fadd dword [0x4c46a8]
fstp dword [0x4c46a8]
fld dword [0x4bf3c4]
fsub st(1)
fstp dword [0x4bf3c4]
mov ecx, dword [0x45808c]
shl ecx, 7
sub edx, ecx
cmp edx, 0xedba57fd
jne 0x40e073
mov cx, word [0x49d58c]
movzx edx, word [0x4a31c2]
movsx ecx, cx
and edx, ecx
mov word [0x49d58c], dx
add word [0x4a31c2], bx
movsx esi, byte [edi]
test esi, esi
jne 0x40df69
fstp st(0)
jmp 0x40e0c8
mov cx, word [0x4a53b8]
fstp st(0)
movsx edx, cx
imul edx, edx, 0x5cc917c0
cmp edx, 0xb884a0f
je 0x40e0b0
mov ecx, dword [0x4555cc]
imul ecx, ecx, 0x60055201
mov dword [0x4555cc], ecx
jmp 0x40e0c8
fld qword [0x48d2b8]
fmul qword [0x48a5d8]
fsub dword [0x4b4e60]
fstp qword [0x4950d0]
mov edx, dword [0x448e28]
mov ecx, dword [0x43ca50]
imul edx, ecx
imul edx, edx, 0x4dca108b
pop edi
pop esi
mov dword [0x448e28], edx
pop ebx
pop ebp
ret
Function at 0x416580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
fld dword [0x4aa458]
fmul dword [0x4abbc0]
fld dword [0x4ad8ac]
fmul qword [0x47b268]
fadd dword [0x4b7e68]
fxch st(1)
fcompi st(1)
fstp st(0)
jbe 0x4165b9
mov eax, dword [0x453440]
imul eax, eax, 0x8a273fb
mov dword [0x453440], eax
fld dword [0x4ac598]
fmul qword [0x47f7e0]
fld qword [0x494d90]
fsub qword [0x4946b8]
fadd dword [0x4b7bcc]
fcompi st(1)
fstp st(0)
jb 0x416600
mov eax, dword [0x4441dc]
movzx ecx, word [0x4a5bf0]
shl eax, 8
sub eax, 0x1d8d75e7
or eax, 0x54c6758a
imul ecx, eax
mov word [0x4a5bf0], cx
add dword [0x442514], 0x5952aef6
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00413da0
mov ecx, dword [0x449870]
mov edx, dword [0x44b1a4]
dec dword [0x44b1a4]
shl ecx, 5
or edx, ecx
or edx, 0x734b56dd
add esp, 4
cmp edx, 0x2c4c3c4d
jg 0x4166a2
mov ecx, dword [0x45387c]
mov edx, dword [0x4501c4]
inc dword [0x4501c4]
imul ecx, edx
cmp ecx, 0x302c4611
jl 0x41667f
fld dword [0x4b143c]
fmul qword [0x462ae0]
fstp dword [0x4b07e8]
fld dword [0x4b143c]
fadd qword [0x43af78]
fstp dword [0x4b143c]
jmp 0x4166a2
mov cx, word [0x4a299c]
movsx ecx, cx
add ecx, 0x3628ba3a
and ecx, 0x5e178eaa
or dword [0x443aec], ecx
inc word [0x4a299c]
mov edx, dword [0x44c624]
mov ecx, dword [0x454fe4]
imul edx, ecx
imul edx, edx, 0x4c091d5
dec eax
mov dword [0x44c624], edx
cmp byte [eax + esi], 0x22
jne 0x416778
movzx edx, word [0x4a10b0]
or edx, 0x7ffffaff
mov word [0x4a10b0], dx
mov byte [esi], 0x22
add dword [0x450d18], 0x5a405d45
mov byte [eax + esi], 0
mov ecx, dword [0x440ba0]
mov edx, dword [0x43c720]
sar ecx, 0xa
and ecx, 0x2ce9efbf
imul edx, ecx
mov dword [0x43c720], edx
mov edx, 0xdeb1b9d7
push ebx
or dword [0x44c850], edx
mov cx, word [0x4a5d38]
movzx ebx, word [0x4a2f72]
movsx ecx, cx
add ecx, 0xbdd86857
or ebx, ecx
or ebx, 0x4386a2c0
dec eax
mov word [0x4a2f72], bx
cmp byte [eax + esi], 0x22
jne 0x416711
mov ecx, dword [0x44702c]
sar ecx, 9
add dword [0x445808], ecx
mov dx, word [0x4a1c80]
movsx ecx, dx
mov edx, dword [0x446970]
sub ecx, edx
add ecx, 0x757df1df
mov word [0x4a1c80], cx
pop ebx
jmp 0x416806
movzx ecx, word [0x4a1230]
sub ecx, 0x56f4495b
mov word [0x4a1230], cx
mov byte [esi], 0x20
movzx edx, word [0x4a476e]
xor edx, 0x20643300
mov word [0x4a476e], dx
mov ecx, dword [0x44bb48]
xor ecx, 0x338fbf33
sub dword [0x4468d0], ecx
mov ecx, dword [0x45961c]
movzx edx, word [0x4a5f7e]
imul ecx, ecx, 0x602936da
movsx edx, dx
add ecx, edx
movzx edx, word [0x498d98]
add edx, ecx
dec eax
mov word [0x4a5f7e], dx
cmp byte [eax + esi], 0x20
jne 0x4167a3
mov ecx, dword [0x44bec8]
not ecx
add dword [0x44a310], ecx
movzx ecx, word [0x4a71ac]
imul ecx, ecx, 0x649ff9f5
mov word [0x4a71ac], cx
dec dword [0x43fe28]
mov ecx, dword [0x44ad84]
mov edx, dword [0x43fe28]
sub ecx, 0x2261bd32
and ecx, 0x58d476f4
or edx, 0xf40546dd
cmp ecx, edx
lea eax, [eax + esi + 1]
pop esi
jg 0x41684d
mov ecx, dword [0x452adc]
xor ecx, 0x25444200
or ecx, 0x2b9a88e
sar ecx, 1
add dword [0x441e58], ecx
pop ebp
ret
Function at 0x41f400
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [0x453154]
mov edx, dword [0x449e7c]
xor eax, 0x82123a5d
cmp edx, eax
jne 0x41f41e
add dword [0x4411d8], 0xc15f8fc1
mov dword [ecx], 0
or dword [0x442f88], 0xf255a096
mov dword [ecx + 4], 0
mov edx, 1
add dword [0x440090], edx
mov eax, dword [0x44ac14]
push esi
mov esi, dword [0x440090]
or eax, esi
xor dword [0x43f654], eax
mov dword [ecx + 8], 0x67452301
mov ax, word [0x498228]
cwde
or eax, 0x1011dac
mov dword [0x44b888], eax
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x443134]
imul eax, eax, 0x9bb698dc
and dword [0x44cdbc], eax
add dword [0x443134], edx
mov dword [ecx + 0x10], 0x98badcfe
pop esi
fld dword [0x4c0094]
fmul qword [0x48dcc0]
fld dword [0x4b5870]
fld dword [0x4b5870]
fld1
fsub st(1), st(0)
fxch st(1)
fstp dword [0x4b5870]
fadd dword [0x4c0094]
fstp dword [0x4c0094]
fxch st(1)
fucompi st(1)
fstp st(0)
lahf
test ah, 0x44
jp 0x41f4ed
mov dx, word [0x49b3e2]
mov eax, dword [0x4531a0]
movsx edx, dx
and eax, edx
mov edx, dword [0x454408]
and edx, eax
mov dword [0x4531a0], edx
mov dword [ecx + 0x14], 0x10325476
movzx eax, word [0x49a3ec]
xor eax, 0xc38554a3
mov word [0x49a3ec], ax
ret
Function at 0x40e600
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x579615
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x240
push esi
push edi
push 0x27
mov edi, ecx
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.Z1hT8ODQ35NUwQ5OSFdXOwgQweRcoDAEwILKjY
lea ecx, [ebp - 0x30]
movups xmmword [ebp - 0x30], xmm0
call fcn.0042d590
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push str.SUdNnUxkEdDCM5nFDk8cOyI
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x34], 0
call fcn.0042d590
push 0x104
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
sub esp, 0x18
lea eax, [ebp - 0x30]
mov ecx, esp
push eax
call fcn.0042e950
lea ecx, [ebp - 0x14]
call fcn.00445000
add esp, 0x18
push dword [eax]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x14]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40e6eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x40e71c
mov esi, dword [ebx + 8]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0
push 0x59245c
push dword [ebp - 0x18]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
mov dword [edi + 0x110], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x34]
cmp ecx, 8
jb 0x40e752
mov edx, dword [ebp - 0x48]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e748
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79d
push ecx
push edx
call fcn.0054f7f4
add esp, 8
mov ecx, dword [ebp - 0x1c]
cmp ecx, 8
jb 0x40e788
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e77e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79d
push ecx
push edx
call fcn.0054f7f4
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.005546cf
int3
Function at 0x41eea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b2a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
push esi
push edi
push 0x27
mov dword [ebp - 0x28], ecx
xorps xmm0, xmm0
push str.cVFuUeCIwCAwGXMBwdELQEtaOQEhqPQwefIws
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x44], 0
call fcn.0042d590
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push str.Z0M3cRRQ3QVjESHMA
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
call fcn.0042d590
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push 0xf003f
push 0
sub esp, 0x18
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x24], 4
mov ecx, esp
mov esi, 3
push eax
call fcn.0042e950
lea ecx, [ebp - 0x1c]
call fcn.00445000
add esp, 0x18
push dword [eax]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x1c]
or edi, 0xffffffff
mov dword [ebp - 0x20], eax
add edx, 0xfffffff0
mov ecx, edi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x41ef8e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x41efef
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.0042e950
lea ecx, [ebp - 0x20]
call fcn.00445000
add esp, 0x18
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push dword [eax]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x41efe0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x18]
test eax, eax
cmove esi, dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 0x110], esi
cmp ecx, 8
jb 0x41f02e
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41f024
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f079
push ecx
push edx
call fcn.0054f7f4
add esp, 8
mov ecx, dword [ebp - 0x44]
cmp ecx, 8
jb 0x41f064
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41f05a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f079
push ecx
push edx
call fcn.0054f7f4
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.005546cf
int3