joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517e00
Capabilities:
Encode data using xor
Hash data using murmur3
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, 0x7b
push edi
test ebp, ebp
jl 0x517f14
mov ebx, dword [esp + 0x18]
jg 0x517e23
test ebx, ebx
je 0x517f14
mov edi, 0x10000
test ebp, ebp
jg 0x517e34
jl 0x517e32
cmp ebx, edi
jae 0x517e34
mov edi, ebx
mov eax, edi
cdq
push 0
sub ebx, eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x6d9e58
push dword [esp + 0x24]
sbb ebp, edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x18], edi
jb 0x517f1d
mov eax, edi
cdq
and edx, 3
lea ecx, [edx + eax]
sar ecx, 2
lea edx, [ecx*4 + 0x6d9e58]
neg ecx
je 0x517ea3
jmp 0x517e80
imul eax, dword [edx + ecx*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
add ecx, 1
jne 0x517e80
mov eax, edi
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x517ec9
sub eax, 1
je 0x517ec0
sub eax, 1
jne 0x517edf
movzx ecx, byte [edx + 2]
shl ecx, 0x10
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
xor esi, edi
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov esi, eax
shr esi, 0x10
xor esi, eax
test ebp, ebp
jg 0x517e23
jl 0x517f14
test ebx, ebx
jne 0x517e23
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc

Function at 0x517f30
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
mov dword [edi], 0
mov dword [edi + 4], 0
mov eax, dword [esi + 0x170]
cmp eax, 0xffffffff
jne 0x517f77
cmp dword [esp + 0x18], 0
jl 0x517f6d
jg 0x517f63
cmp dword [esp + 0x14], 0
jbe 0x517f6d
pop edi
mov al, 1
pop esi
add esp, 8
ret 0x10
pop edi
xor al, al
pop esi
add esp, 8
ret 0x10
push ebx
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov edi, dword [esp + 0x18]
mov dword [esp + 0xc], eax
cmp ebx, ecx
jl 0x517fa3
jg 0x517fdc
cmp edi, eax
ja 0x517fdc
push ebx
push edi
push dword [esi + 0x170]
call fcn.00517e00
cmp dword [esp + 0x20], eax
je 0x517fe7
push 0
push 0
push 0
push dword [esi + 0x170]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x140], 0
mov dword [esi + 0x144], 0
pop ebx
pop edi
xor al, al
pop esi
add esp, 8
ret 0x10
mov dword [esi + 0x144], ebx
mov al, 1
pop ebx
mov dword [esi + 0x140], edi
pop edi
pop esi
add esp, 8
ret 0x10
Function at 0x51f720
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
cdq
and edx, 3
push esi
push edi
lea esi, [edx + eax]
mov edx, dword [esp + 0x10]
sar esi, 2
lea edi, [ecx + esi*4]
neg esi
je 0x51f763
lea esp, [esp]
imul eax, dword [edi + esi*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
rol edx, 0xd
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
add esi, 1
jne 0x51f740
mov eax, ebx
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x51f789
sub eax, 1
je 0x51f780
sub eax, 1
jne 0x51f79f
movzx ecx, byte [edi + 2]
shl ecx, 0x10
movzx eax, byte [edi + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edi]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, ebx
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [esp + 8]
mov dword [eax], ecx
ret
Function at 0x527240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c72a9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x61f138]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [ebp - 4], 2
push 0x6d1f78
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [ebp - 0x14], 0x6d1f78
call fcn.0055d042
add esp, 4
test eax, eax
je 0x5272ea
push eax
call fcn.0055ca85
add esp, 4
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push eax
call fcn.00464060
cmp dword [eax], 0xbdf
setg al
mov byte [esi + 0x10], al
push 0x6d1f78
mov byte [ebp - 4], 4
call fcn.0055d067
add esp, 4
test eax, eax
je 0x527321
push eax
call fcn.0055ca85
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x52a420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c7498
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x61f138]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0052a3d0
mov esi, dword [ebp + 0x10]
mov ebx, eax
mov dword [ebp - 4], 0
lea ecx, [ebx + 8]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], ecx
mov byte [esi], 0
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x18]
mov dword [ecx + 0x18], eax
add ecx, 0x1c
mov eax, dword [esi + 0x1c]
lea edi, [ecx + 4]
push 0
mov dword [ebp + 0x10], ecx
mov dword [ecx], eax
push 0
mov dword [ebp + 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0052a3d0
mov dword [edi], eax
mov ecx, dword [esi + 0x20]
mov dword [edi], ecx
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x24]
mov ecx, dword [edi + 4]
mov dword [edi + 4], eax
mov dword [esi + 0x24], ecx
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x30], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x52a8f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c751b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x61f138]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0x20]
lea ecx, [esi + 0x14]
mov edi, dword [ebp + 0x14]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, edi
mov dword [esi], vtable.BaseControl.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
lea ebx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x52a950
sub eax, ebx
push eax
push edi
call fcn.004462c0
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
cmp byte [0x6d665c], 0
mov eax, dword [ecx]
mov dword [esi + 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x30], eax
mov eax, dword [ecx + 8]
mov dword [esi + 0x34], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x38], eax
jne 0x52a997
mov byte [0x6d665c], 1
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ecx, dword [0x6aafb0]
push 0
push dword [ebp + 0xc]
mov dword [esi + 0x10], ecx
push ecx
push dword [esi + 0xc]
lea eax, [ecx + 1]
push dword [esi + 0x38]
mov dword [0x6aafb0], eax
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [esi + 0x2c]
push dword [ebp + 0x18]
push 0x5e1af8
push dword [ebp + 0x10]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push edi
push eax
mov dword [esi + 8], eax
call fcn.0051e130
mov ecx, eax
call fcn.0051e250
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24

Function at 0x52acd0
Capabilities:
Get graphical window text

Disassembly:
push ecx
movzx edx, byte [esp + 0x18]
movzx eax, byte [esp + 0x1c]
push esi
sub esp, 8
shl edx, 0xd
shl eax, 0xb
mov esi, ecx
or edx, eax
mov dword [esp + 0xc], esi
or edx, 0x50010082
push dword [esp + 0x34]
push dword [esp + 0x30]
push edx
push dword [esp + 0x28]
push str.edit
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.0052a8f0
mov eax, dword [esp + 0x30]
push 1
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x2c]
push eax
push 0x30
push dword [esi + 8]
mov dword [esi], vtable.Edit.0
mov dword [esi + 0x40], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop esi
pop ecx
ret 0x2c

Function at 0x52ad40
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x208
mov eax, dword [0x61f138]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
mov esi, dword [esp + 0x210]
lea eax, [esp + 8]
push eax
push 0x100
push 0xd
push dword [ecx + 8]
mov dword [esp + 0x14], esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [esp + 8]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x52ad90
sub ecx, edx
lea eax, [esp + 8]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00445cb0
mov ecx, dword [esp + 0x208]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0056eeb4
add esp, 0x208
ret 4
Function at 0x52aed0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c75c1
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x61f138]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x90]
push eax
push 0x40
push 0xd
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [ebp - 0x98], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x52af36
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xa8]
call fcn.00445cb0
lea edx, [ebp - 0xa8]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xd8]
call fcn.004c65b0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x94]
cmp edx, 8
jb 0x52afb4
mov ecx, dword [ebp - 0xa8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x52afaa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52b0b2
push edx
push ecx
call fcn.0056eec5
add esp, 8
xor eax, eax
mov dword [ebp - 0x98], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
lea edx, [ecx + 2]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x52aff1
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xc0]
call fcn.00445cb0
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 3
call fcn.004c6810
mov edx, dword [ebp - 0xac]
mov esi, eax
cmp edx, 8
jb 0x52b060
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x52b056
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52b0b7
push edx
push ecx
call fcn.0056eec5
add esp, 8
mov edx, dword [ebp - 0xc4]
cmp edx, 0x10
jb 0x52b096
mov ecx, dword [ebp - 0xd8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x52b08c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52b0bc
push edx
push ecx
call fcn.0056eec5
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056eeb4
mov esp, ebp
pop ebp
ret
call fcn.00591dc6
call fcn.00591dc6
call fcn.00591dc6
int3
Function at 0x52ead0
Capabilities:
Hash data with crc32

Disassembly:
test edx, edx
jne 0x52ead7
xor eax, eax
ret
jmp fcn.0052eae0
Function at 0x52fb00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x2c]
mov ebp, dword [esi + 0x74]
lea ecx, [ecx]
mov eax, dword [esi + 0x2c]
mov ebx, dword [esi + 0x3c]
add eax, 0xfffffefa
sub ebx, dword [esi + 0x6c]
add eax, edi
sub ebx, ebp
cmp dword [esi + 0x6c], eax
jb 0x52fba7
mov ecx, dword [esi + 0x38]
push edi
lea eax, [ecx + edi]
push eax
push ecx
call fcn.00586300
mov ebp, dword [esi + 0x4c]
add esp, 0xc
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
sub dword [esi + 0x5c], edi
lea edx, [eax + ebp*2]
mov edi, edi
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [esp + 0x10], 0
sub eax, edi
cmp ecx, edi
movzx eax, ax
cmovb eax, dword [esp + 0x10]
mov word [edx], ax
sub ebp, 1
jne 0x52fb50
mov eax, dword [esi + 0x40]
mov ebp, edi
lea edx, [eax + edi*2]
lea ecx, [ecx]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [esp + 0x10], 0
sub eax, edi
cmp ecx, edi
movzx eax, ax
cmovb eax, dword [esp + 0x10]
mov word [edx], ax
sub ebp, 1
jne 0x52fb80
add ebx, edi
mov ebp, dword [esi]
mov eax, dword [ebp + 4]
test eax, eax
je 0x52fcd0
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x74]
add edx, ecx
add edx, dword [esi + 0x38]
cmp eax, ebx
mov dword [esp + 0x10], edx
cmovbe ebx, eax
test ebx, ebx
je 0x52fc22
sub eax, ebx
mov dword [ebp + 4], eax
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x52fbea
mov edx, dword [ebp]
mov ecx, dword [ebp + 0x30]
push ebx
call fcn.0052df30
jmp 0x52fc03
cmp eax, 2
jne 0x52fc09
mov edx, dword [ebp]
test edx, edx
jne 0x52fbfa
xor eax, eax
jmp 0x52fc06
mov ecx, dword [ebp + 0x30]
push ebx
call fcn.0052eae0
add esp, 4
mov dword [ebp + 0x30], eax
push ebx
push dword [ebp]
push dword [esp + 0x18]
call fcn.00586300
add dword [ebp], ebx
add esp, 0xc
add dword [ebp + 8], ebx
mov ecx, dword [esi + 0x74]
lea ebp, [ecx + ebx]
mov dword [esi + 0x74], ebp
cmp ebp, 3
jb 0x52fc4a
mov eax, dword [esi + 0x38]
add eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
movzx edx, byte [eax]
mov dword [esi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [esi + 0x54]
mov dword [esi + 0x48], edx
cmp ebp, 0x106
jae 0x52fc5e
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x52fb10
mov ecx, dword [esi + 0x16c0]
mov edi, dword [esi + 0x3c]
cmp ecx, edi
jae 0x52fcd0
mov ebx, dword [esi + 0x6c]
add ebx, ebp
cmp ecx, ebx
jae 0x52fca0
mov eax, 0x102
sub edi, ebx
cmp edi, eax
cmova edi, eax
mov eax, dword [esi + 0x38]
push edi
add eax, ebx
push 0
push eax
call fcn.00586880
add esp, 0xc
lea eax, [edi + ebx]
mov dword [esi + 0x16c0], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea eax, [ebx + 0x102]
cmp ecx, eax
jae 0x52fcd0
sub ebx, ecx
sub edi, ecx
lea eax, [ebx + 0x102]
cmp eax, edi
cmovbe edi, eax
mov eax, dword [esi + 0x38]
push edi
add eax, ecx
push 0
push eax
call fcn.00586880
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x571d99
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x5a5b08
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005a57cb

Function at 0x5a5b13
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005a594c

Function at 0x5ac261
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005abbcf

Function at 0x5ac26c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005abe0a
Function at 0x40e708
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x531ff8
call fcn.0050a8f0
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x40e818
cmp byte [esi + 0x41], 0
je 0x40e818
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x40e73e
xor al, al
jmp 0x40e81a
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004026d2
mov dword [ebp - 4], edi
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a931
mov ecx, eax
call fcn.0040a613
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a931
mov ecx, eax
call fcn.0040a613
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x40e7b2
dec eax
je 0x40e7b6
dec eax
dec eax
je 0x40e814
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004034b0
mov al, bl
jmp 0x40e81a
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a931
mov ecx, eax
call fcn.0040a613
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x40e7f6
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a931
mov ecx, eax
call fcn.0040a613
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0050b65e
add esp, 0x10
cmp edi, eax
jne 0x40e79c
cmp byte [esi + 0x41], 0
je 0x40e814
test edi, edi
jne 0x40e74c
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004032c9
jmp 0x40e74c
mov bl, 1
jmp 0x40e79e
mov al, 1
call fcn.0050a973
ret
Function at 0x4112bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x53265e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x10ec
call fcn.0050bf30
mov eax, dword [0x58c584]
xor eax, esp
mov dword [esp + 0x10e8], eax
push ebx
push esi
push edi
mov eax, dword [0x58c584]
xor eax, esp
push eax
lea eax, [esp + 0x1100]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
and dword [esp + 0x1c], 0
push 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10ec]
push 0
push eax
mov dword [esp + 0x2c], ecx
call fcn.0050aaf0
mov eax, dword [esi + 0x14]
add esp, 0xc
mov byte [esp + 0x10e8], 0x61
mov byte [esp + 0x10e9], 0x31
mov byte [esp + 0x10ea], 0x40
mov byte [esp + 0x10eb], 0x79
mov byte [esp + 0x10ec], 0x68
mov byte [esp + 0x10ed], 0x73
mov byte [esp + 0x10ee], 0x70
mov byte [esp + 0x10ef], 0x21
mov byte [esp + 0x10f0], 0x71
mov byte [esp + 0x10f1], 0x77
mov byte [esp + 0x10f2], 0x65
mov byte [esp + 0x10f3], 0x68
mov byte [esp + 0x10f4], 0x6a
mov byte [esp + 0x10f5], 0x6a
mov byte [esp + 0x10f6], 0x5f
mov byte [esp + 0x10f7], 0x32
test al, 7
jne 0x4113b4
xor ecx, ecx
jmp 0x4113be
mov edx, eax
push 8
and edx, 7
pop ecx
sub ecx, edx
lea edi, [eax + ecx]
push edi
call fcn.004f7ca0
push edi
mov dword [esp + 0x18], eax
call fcn.004f7ca0
push edi
push 0x20
push dword [esp + 0x20]
mov dword [esp + 0x28], eax
call fcn.0050aaf0
mov eax, dword [esi + 0x14]
add esp, 0x14
cmp dword [esi + 0x18], 0x10
jb 0x4113f2
mov esi, dword [esi + 4]
jmp 0x4113f5
add esi, 4
push eax
push esi
push dword [esp + 0x18]
call fcn.0050bbc0
add esp, 0xc
push 0x10
lea eax, [esp + 0x10ec]
push eax
lea ecx, [esp + 0x34]
call fcn.0041102f
push edi
push dword [esp + 0x14]
xor ebx, ebx
push dword [esp + 0x1c]
inc ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1114], ebx
call fcn.004d278f
lea ecx, [esp + 0x24]
call fcn.0046f700
push edi
push dword [esp + 0x18]
lea eax, [esp + 0x10d4]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x1114], 2
call fcn.0046f730
push dword [esp + 0x10]
mov byte [esp + 0x110c], 3
call fcn.0050ae44
push dword [esp + 0x18]
call fcn.0050ae44
pop ecx
pop ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10cc]
push eax
push dword [esp + 0x1c]
call fcn.00410400
push 0
push ebx
lea ecx, [esp + 0x10d4]
mov dword [esp + 0x24], ebx
mov byte [esp + 0x1110], 2
call fcn.004034b0
lea ecx, [esp + 0x24]
mov byte [esp + 0x1108], bl
call fcn.0046f710
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1108], 0
call fcn.00410b5a
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10e8]
xor ecx, esp
call fcn.0050a878
mov esp, ebp
pop ebp
ret 8
Function at 0x412a83
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x412a90
xor al, al
jmp 0x412b0f
push esi
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x412ae3
push str.RegDeleteKeyExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x412adc
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x18], 0x10
jb 0x412ac0
mov ecx, dword [ecx + 4]
jmp 0x412ac3
add ecx, 4
movzx edx, byte [ebp + 0x10]
neg edx
push 0
sbb edx, edx
and edx, 0x100
push edx
push ecx
push dword [ebp + 8]
call eax
jmp 0x412afe
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x10
jb 0x412af1
mov eax, dword [eax + 4]
jmp 0x412af4
add eax, 4
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x412b0b
cmp eax, 2
je 0x412b0b
xor eax, eax
jmp 0x412b0e
xor eax, eax
inc eax
pop esi
pop ebp
ret 0xc

Function at 0x412b69
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x412bff
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], ebx
je 0x412bff
push 2
pop ecx
cmp byte [ebp + 0x18], bl
je 0x412b8d
mov ecx, 0x102
cmp dword [eax + 0x18], 0x10
mov dword [ebp + 0x18], ebx
jb 0x412b9b
mov eax, dword [eax + 4]
jmp 0x412b9e
add eax, 4
push ebx
lea edx, [ebp + 0x18]
push edx
push ebx
push ecx
push ebx
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x412bff
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x18], 0x10
mov edx, dword [eax + 0x14]
jb 0x412bc7
mov eax, dword [eax + 4]
jmp 0x412bca
add eax, 4
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x18], 0x10
jb 0x412bd8
mov ecx, dword [ecx + 4]
jmp 0x412bdb
add ecx, 4
push edx
push eax
push 1
push ebx
push ecx
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x18]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x412c01
xor al, al
pop ebx
pop ebp
ret 0x14

Function at 0x412c06
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x412c88
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], ebx
je 0x412c88
push 2
pop ecx
cmp byte [ebp + 0x18], bl
je 0x412c26
mov ecx, 0x102
cmp dword [eax + 0x18], 0x10
mov dword [ebp + 0x18], ebx
jb 0x412c34
mov eax, dword [eax + 4]
jmp 0x412c37
add eax, 4
push ebx
lea edx, [ebp + 0x18]
push edx
push ebx
push ecx
push ebx
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x412c88
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x18], 0x10
jb 0x412c5d
mov eax, dword [eax + 4]
jmp 0x412c60
add eax, 4
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push ebx
push eax
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x18]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x412c8a
xor al, al
pop ebx
pop ebp
ret 0x14