joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421fa0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00576f50
push 0x619710
lea eax, [ebp - 0x210]
push str.C:log_s.log
push eax
call fcn.00408f60
add esp, 0x18
call fcn.00436160
test al, al
je 0x421ffa
jb 0x422049
aam 0x32
xlatb
ror dword [edi - 0x3f], 0x7a
sub edx, dword [ecx - 0x20f9318c]
mov cs, word [ebp - 0x20f7b]
call dword [eax - 1]
adc eax, sym.imp.SHLWAPI.dll_PathFileExistsW
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
mov dword [0], eax
xor eax, eax
mov dword [ebp - 0x818], 7
mov dword [ebp - 0x81c], 0
mov word [ebp - 0x82c], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x82c]
mov ecx, dword [ebp + 8]
call fcn.00421b20
test al, al
je 0x4221cc
push 0x800
lea eax, [ebp - 0x814]
push 0
push eax
call fcn.00576f50
add esp, 0xc
call fcn.00435f30
test al, al
je 0x4220b4
lds ecx, [ecx + 0x59bf210b]
insd dword es:[edi], dx
sbb eax, 0x3689812e
pop ebp
mov ecx, 0xe8a1a215
xchg edi, eax
inc esp
add dword [eax], eax
call fcn.00436550
test al, al
je 0x4220dc
and dword [esi + ecx*8], edi
xor bh, byte [esi - 0x125ad8db]
cmpsd dword [esi], dword es:[edi]
inc ebx
mov ecx, eax
pushaw
xchg ebx, eax
xor dword [eax + 1], edx
jp 0x4220bb
mov cl, 0x4b
push edi
add eax, 0x725bce33
scasd eax, dword es:[edi]
call fcn.004362b0
test al, al
je 0x4220fb
fidivr word fs:[esi + 0x6ff39caa]
and al, 0x67
invalid
cmp dword [ebp - 0x818], 8
lea ecx, [ebp + 0xc]
push ecx
push ecx
lea eax, [ebp - 0x82c]
mov edx, 0x400
cmovae eax, dword [ebp - 0x82c]
lea ecx, [ebp - 0x814]
push eax
push 0x3ff
call fcn.00421ae0
add esp, 0x10
call fcn.004360f0
test al, al
je 0x422149
cmp al, 0xb0
mov eax, dword [0x1c58b6f]
jb 0x4220c0
inc ebx
invalid
call fcn.00436010
test al, al
je 0x42216d
retf
call fcn.00435fa0
test al, al
je 0x42218f
sahf
mov al, 0x4b
sbb edx, dword [ecx]
inc esp
pop edx
adc eax, dword [eax + 0x8a59e3e]
dec edi
or byte [ecx], al
sub bh, byte [eax + edx*4]
inc ebp
and ah, byte [eax]
lahf
xchg ecx, eax
or byte [ebx], dh
shl byte [esi - 0x77], 0x45
ljmp 0x8400
xor eax, eax
mov word [ebp - 0x16], ax
call fcn.00436010
test al, al
je 0x4221ae
mov ebp, 0xe3ec1590
dec eax
sti
xchg ecx, eax
cmova ebx, dword [esi]
push es
jmp 0x83b678d9
cmp dword [0x62d54c], 8
lea edx, [ebp - 0x814]
mov ecx, 0x62d538
cmovae ecx, dword [0x62d538]
call fcn.00422610
mov eax, dword [ebp - 0x818]
cmp eax, 8
jb 0x4221ea
inc eax
lea ecx, [ebp - 0x82c]
push eax
push dword [ebp - 0x82c]
call fcn.00404090
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x422610
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2228
call fcn.00571b70
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
mov dword [ebp - 0x2214], ecx
mov edi, edx
push 0
push eax
mov dword [ebp - 0x2218], edi
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x619710
push str.C:log_s.log
push eax
call fcn.00408f60
add esp, 0xc
call fcn.00436160
test al, al
je 0x422686
je 0x4226af
mov dword [0x74cdc62], eax
dec edx
sbb edi, dword [eax + ebx]
invalid
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x210]
push eax
call ebx
test eax, eax
je 0x422811
push 0
call fcn.0057e959
add esp, 4
mov dword [ebp - 0x2228], eax
lea eax, [ebp - 0x2228]
mov dword [ebp - 0x2224], edx
push eax
call fcn.00585006
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x2210]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.004228b0
add esp, 0x28
call fcn.00436710
test al, al
je 0x422714
fcomp st(5)
invalid
jg 0x422705
lcall 0xfe23, 0x6ae09d97
xchg edi, eax
popfd
loopne 0x422773
and edi, esi
dec ebp
jl 0x422768
cmpsb byte [esi], byte es:[edi]
sub dword [edi], edi
loop 0x42275f
test al, 0xff
mov ch, 0xec
invalid
push dword [ebp - 0x2214]
xor edi, edi
call ebx
test eax, eax
mov ecx, 1
cmovne edi, ecx
call fcn.00436010
test al, al
je 0x422741
mov dl, 0xa8
cli
jge 0x42277c
invalid
push 0x61bd30
push dword [ebp - 0x2214]
call fcn.0057d560
mov ebx, eax
add esp, 8
mov dword [ebp - 0x221c], ebx
test ebx, ebx
je 0x422811
test byte [ebp - 0x7b000000], ch
push dword [ebp + 0x1e]
test edi, edi
jne 0x422786
push ebx
push 2
lea eax, [ebp - 0x2218]
mov dword [ebp - 0x2218], 0xfeff
push 1
call 0x422755
inc byte [eax]
add byte [edx + 1], ch
add dword [eax - 0x18], edx
cmp dword [ecx - 0x3b7cffeb], esi
adc al, ch
xor eax, 0x84000137
sal byte [eax + ebx + 1], 0xe1
push eax
call fcn.0057d8bc
add esp, 0x10
call fcn.00435ec0
test al, al
je 0x4227a7
add ecx, esp
push 0x4d4deb36
inc esi
invalid
lea ecx, [ebp - 0x2210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4227b0
sub ecx, edx
sar ecx, 1
push ebx
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x2210]
push 1
push eax
call fcn.0057d8bc
push ebx
push 2
lea eax, [ebp - 0x2214]
mov dword [ebp - 0x2214], 0xd
push 1
push eax
call fcn.0057d8bc
push ebx
push 2
lea eax, [ebp - 0x2214]
mov dword [ebp - 0x2214], 0xa
push 1
push eax
call fcn.0057d8bc
push ebx
call fcn.0057d604
add esp, 0x34
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x422755
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2228
call fcn.00571b70
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
mov dword [ebp - 0x2214], ecx
mov edi, edx
push 0
push eax
mov dword [ebp - 0x2218], edi
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x619710
push str.C:log_s.log
push eax
call fcn.00408f60
add esp, 0xc
call fcn.00436160
test al, al
je 0x422686
je 0x4226af
mov dword [0x74cdc62], eax
dec edx
sbb edi, dword [eax + ebx]
invalid
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x210]
push eax
call ebx
test eax, eax
je 0x422811
push 0
call fcn.0057e959
add esp, 4
mov dword [ebp - 0x2228], eax
lea eax, [ebp - 0x2228]
mov dword [ebp - 0x2224], edx
push eax
call fcn.00585006
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x2210]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.004228b0
add esp, 0x28
call fcn.00436710
test al, al
je 0x422714
fcomp st(5)
invalid
jg 0x422705
lcall 0xfe23, 0x6ae09d97
xchg edi, eax
popfd
loopne 0x422773
and edi, esi
dec ebp
jl 0x422768
cmpsb byte [esi], byte es:[edi]
sub dword [edi], edi
loop 0x42275f
test al, 0xff
mov ch, 0xec
invalid
push dword [ebp - 0x2214]
xor edi, edi
call ebx
test eax, eax
mov ecx, 1
cmovne edi, ecx
call fcn.00436010
test al, al
je 0x422741
mov dl, 0xa8
cli
jge 0x42277c
invalid
push 0x61bd30
push dword [ebp - 0x2214]
call fcn.0057d560
mov ebx, eax
add esp, 8
mov dword [ebp - 0x221c], ebx
test ebx, ebx
je 0x422811
test byte [ebp - 0x7b000000], ch
push dword [ebp + 0x1e]
test edi, edi
jne 0x422786
push ebx
push 2
lea eax, [ebp - 0x2218]
mov dword [ebp - 0x2218], 0xfeff
push 1
call 0x422755
inc byte [eax]
add byte [edx + 1], ch
add dword [eax - 0x18], edx
cmp dword [ecx - 0x3b7cffeb], esi
adc al, ch
xor eax, 0x84000137
sal byte [eax + ebx + 1], 0xe1
push eax
call fcn.0057d8bc
add esp, 0x10
call fcn.00435ec0
test al, al
je 0x4227a7
add ecx, esp
push 0x4d4deb36
inc esi
invalid
lea ecx, [ebp - 0x2210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4227b0
sub ecx, edx
sar ecx, 1
push ebx
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x2210]
push 1
push eax
call fcn.0057d8bc
push ebx
push 2
lea eax, [ebp - 0x2214]
mov dword [ebp - 0x2214], 0xd
push 1
push eax
call fcn.0057d8bc
push ebx
push 2
lea eax, [ebp - 0x2214]
mov dword [ebp - 0x2214], 0xa
push 1
push eax
call fcn.0057d8bc
push ebx
call fcn.0057d604
add esp, 0x34
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x423110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ee38
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x423167
xor ecx, ecx
jmp 0x42317f
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x423170
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00403d10
mov dword [ebp - 4], 0
call fcn.004366a0
test al, al
je 0x4231ad
inc ebx
dec edi
out dx, eax
int3
call fcn.00436400
test al, al
je 0x4231d4
dec esi
xor al, byte [ecx]
add byte [eax + eax*8 - 0x647ae18c], al
aad 0xb
adc eax, ebp
test dword [ebx - 0x3aecf42b], ebx
dec esi
add al, 0x84
jge 0x4231ae
dec ecx
retf
call fcn.004364e0
test al, al
je 0x4231fc
xor eax, 0xa985a16e
pop eax
fisubr dword [ebp + 0x70d5196d]
add bl, dh
inc edi
xor eax, 0x608cddb0
movsd dword es:[edi], dword [esi]
xchg byte [eax - 0x1c], cl
mov eax, dword [0x7a4c45f1]
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x2e
push eax
lea ecx, [ebp - 0x28]
call fcn.00421410
cmp eax, 0xffffffff
je 0x423240
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push eax
push 0
push esi
call fcn.00403880
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x42323c
add byte [esi - 0x18], dl
pop ecx
push es
invalid
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00404090
mov eax, esi
jmp 0x423291
call fcn.00436160
test al, al
je 0x423259
jbe 0x423220
pop esi
mov byte [ebx - 0x19ad6ee0], bh
and dword [edi], ebp
mov ch, 0x53
fidivr dword [eax]
sub byte [ebx - 0x3fcc2ba3], cl
mov ebx, dword [ebp - 0x2c]
xor eax, eax
mov ecx, ebx
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.00403f30
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42328f
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00404090
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x4240c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x62d77b], 0
push ebx
push esi
push edi
je 0x424148
call fcn.00436470
test al, al
je 0x4240fc
add esp, edi
cmp dh, byte [edi - 0x67]
insb byte es:[edi], dx
inc esp
adc eax, 0xc7755f4f
or dword [edi - 0x42], edx
and eax, 0x8431e679
call fcn.00436860
test al, al
je 0x424121
cmp byte [edx], 0x51
adc dword [edx - 0x6790d9c3], ebp
sub esi, edx
test al, 0xbe
mov ecx, 0xc1a45c2e
mov dword [0x1dad6ee4], eax
out dx, al
inc ecx
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
call fcn.004360f0
test al, al
je 0x42423f
adc dword [ecx], eax
add byte [eax], al
into
out 0x5f, al
pop eax
lea edi, [eax]
mov bl, 0x17
jae 0x42412a
and byte [ecx], bl
dec esp
retf
call fcn.004360f0
test al, al
je 0x42416c
dec eax
test al, 0x8c
movsd dword es:[edi], dword [esi]
sal cl, cl
in al, 0x6a
ffreep st(1)
dec edx
mov dword [0xac1e5140], eax
or eax, 0x2f31f144
push es
xchg edi, eax
insb byte es:[edi], dx
inc edi
sbb eax, 0x20868a6
add byte [eax], al
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4241dc
lea eax, [ebp - 0x210]
push eax
call fcn.00583ca6
lea eax, [ebp - 0x210]
push 0x61b944
push eax
call fcn.0057612d
add esp, 0xc
test eax, eax
jne 0x4241d5
invalid
lea eax, [ebp - 0x210]
push str.documents_and_settingslocalservice
push eax
call fcn.0057612d
add esp, 8
test eax, eax
je 0x4241dc
mov byte [0x62d77b], 1
call fcn.004368d0
test al, al
je 0x4241f7
inc ebx
cmpsd dword [esi], dword es:[edi]
push 0x11
invalid
call fcn.00436470
test al, al
je 0x42421b
push edi
cld
mov eax, 0x462c45a0
loopne 0x424284
stc
cmp dword [ebx], ecx
leave
cli
loop 0x424270
scasd eax, dword es:[edi]
dec ebp
jbe 0x4241a7
fbstp tbyte [ecx - 0x487ae6f6]
call fcn.00436470
test al, al
je 0x42423f
pop es
imul ebp, dword [ebx - 0x64], 0xffffff80
push es
stosd dword es:[edi], eax
mov bl, 0x87
ret 0x8d4c
mov ecx, dword [ebp - 4]
mov al, byte [0x62d77b]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
test byte [esi - 0x18000000], al
push edx
sbb eax, dword [ecx]
add byte [eax + eax*8 - 0x71eeb8c], al
Function at 0x424260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x28], edi
call fcn.004240c0
test al, al
je 0x42430f
call fcn.00435de0
add dword [eax], eax
test al, al
je 0x4242a6
loope 0x42428c
pop es
movsb byte es:[edi], byte [esi]
pop esp
adc al, 1
cmp byte [0x57ea5e6c], dl
adc dh, dl
inc edx
mov edi, dword [ebp - 0x28]
call fcn.00436400
test al, al
je 0x4242c5
std
mov edx, 0x832e5c9c
sbb edx, esp
xor byte [edx - 0x1c70095e], bl
call 0xcf01c134
invalid
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
call fcn.00424400
test al, al
je 0x42430f
push edi
push 1
push dword [ebp - 0x24]
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, dword [ebp - 0x20]
test eax, eax
mov eax, 1
movzx ebx, bl
cmove ebx, eax
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x42435a
call fcn.00436550
test al, al
je 0x424337
inc eax
and ecx, dword [0x43ce1f44]
pop ebp
mov ebx, 0x44eb838a
scasb al, byte es:[edi]
sbb dword [ebx - 0x6dcebddd], ecx
sal dword [0xe54b5840], cl
leave
or dh, byte [edx + 0x6ad6e0]
push 0
push dword [ebp + 8]
push dword [ebp - 0x28]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp - 0x20]
test eax, eax
movzx ebx, dl
mov eax, 1
cmovne ebx, eax
mov dword [ebp - 0x20], ebx
push 0x20
push str.cae04bc49778d3ec4522cef1584bb459
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
jbe 0x4243ca
mov ecx, dword [ebp - 8]
cmp ecx, 0x10
jb 0x424399
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00407760
push cs
xchg esi, eax
mov ecx, 0xc321af31
ret 0x925c
mov eax, dword [ebp - 8]
cmp eax, 0x10
jb 0x4243df
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x425340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ef4b
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, byte [0x62d77c]
test al, al
jne 0x4254c8
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x118]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4254c3
push 0x14
push str.config_systemprofile
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x134], 0xf
mov dword [ebp - 0x138], 0
mov byte [ebp - 0x148], 0
call fcn.00407270
mov dword [ebp - 4], 0
cmp byte [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
jne 0x425405
xor ecx, ecx
jmp 0x425419
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x425410
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x130]
call fcn.00407270
push dword [ebp - 0x138]
cmp dword [ebp - 0x134], 0x10
lea eax, [ebp - 0x148]
push 0
cmovae eax, dword [ebp - 0x148]
lea ecx, [ebp - 0x130]
push eax
call fcn.0040d2a0
movzx ecx, byte [0x62d77c]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x11c]
mov edx, 1
cmovne ecx, edx
mov byte [0x62d77c], cl
cmp eax, 0x10
jb 0x42548a
inc eax
lea ecx, [ebp - 0x130]
push eax
push dword [ebp - 0x130]
call fcn.00407760
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
cmp eax, 0x10
jb 0x4254c3
inc eax
lea ecx, [ebp - 0x148]
push eax
push dword [ebp - 0x148]
call fcn.00407760
mov al, byte [0x62d77c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x427be0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f176
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x627a40]
in al, dx
inc esp
add al, byte [eax]
add byte [ecx + 0x627a40], ah
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x250], edx
mov ebx, ecx
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x24c], 0
push 0
push eax
call fcn.00576f50
add esp, 0xc
call fcn.00436710
test al, al
je 0x427c51
int1
jnp 0x427bf2
adc dword [esi], 0xf87702be
add dh, byte [edi - 8]
push ss
jl 0x427ca6
jg 0x427c45
ja 0x427be3
add byte [ebx + 0x5a103c3d], cl
add byte [ebp - 0x2177b], cl
jmp [eax + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea eax, [ebp - 0x218]
push 0x104
push eax
xor esi, esi
push esi
push ebx
call edi
test eax, eax
jne 0x427e11
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x427df8
call fcn.00436860
test al, al
je 0x427ca7
push edi
sbb bh, al
fdivr dword [edx + 0x5e]
push 0x97b3c7d4
sal byte [esi + 0x33807046], cl
rol bh, 0x85
in al, 0xfd
invalid
xor byte [ebx], 0xc0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x427ce5
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427cd6
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403d10
lea edx, [ebp - 0x230]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.004280d0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x427d6d
mov ecx, dword [ebp - 0x230]
inc eax
cmp eax, 0x7fffffff
ja 0x427e2d
add eax, eax
cmp eax, 0x1000
jb 0x427d64
test cl, 0x1f
jne 0x427e2d
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x427e2d
sub ecx, eax
cmp ecx, 4
jb 0x427e2d
cmp ecx, 0x23
ja 0x427e2d
mov ecx, eax
push ecx
call fcn.00570ea4
add esp, 4
mov ecx, dword [ebp - 0x250]
lea edx, [ebp - 0x248]
xor eax, eax
mov dword [ebp - 0x21c], 7
cmp dword [ebp - 0x234], 0x10
mov dword [ebp - 0x220], 0
cmovae edx, dword [ebp - 0x248]
mov word [ebp - 0x230], ax
call fcn.00425f30
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x234]
cmp eax, 0x10
jb 0x427df8
mov ecx, dword [ebp - 0x248]
inc eax
cmp eax, 0x1000
jb 0x427def
test cl, 0x1f
jne 0x427e2d
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x427e2d
sub ecx, eax
cmp ecx, 4
jb 0x427e2d
cmp ecx, 0x23
ja 0x427e2d
mov ecx, eax
push ecx
call fcn.00570ea4
add esp, 4
push 0x104
lea eax, [ebp - 0x218]
inc esi
push eax
push esi
push ebx
call edi
test eax, eax
je 0x427c71
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
call fcn.0057d383
int3
Function at 0x42a320
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f3d0
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xc0], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xb4]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x2b], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xb4], 0x67452301
mov dword [ebp - 0xb0], 0xefcdab89
mov dword [ebp - 0xac], 0x98badcfe
mov dword [ebp - 0xa8], 0x10325476
call fcn.004062c0
call fcn.00435ec0
test al, al
je 0x42a3e8
invalid
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb4]
call fcn.00406d70
mov edx, eax
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.00427e50
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x42a419
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407760
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x42a440
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00407760
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x42a460
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f408
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa8], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xa0]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x17], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0xa0], 0x67452301
mov dword [ebp - 0x9c], 0xefcdab89
mov dword [ebp - 0x98], 0x98badcfe
mov dword [ebp - 0x94], 0x10325476
call fcn.004062c0
call fcn.00436860
test al, al
je 0x42a525
invalid
sal byte [ebx + ebx + 0x62], 0xf2
xchg edx, eax
les esi, [edx]
imul edi, dword [ecx], 0xe27e9e80
js 0x42a4e0
invalid
or ecx, ecx
or eax, dword [ebp + 0x6767ef5c]
test al, 6
invalid
call fcn.004365c0
test al, al
je 0x42a543
jnp 0x42a570
sub eax, 0x18630685
mov ch, 0x66
push edi
aad 0xd0
or esi, edi
jae 0x42a507
push ss
sar dword [eax + ecx*4], cl
cdq
call fcn.004367f0
test al, al
je 0x42a55e
and eax, 0x8be8b879
adc dword [eax], ecx
imul edi, dword [bx + di - 0x424a], 0xffffffbe
xor ah, al
movsd dword es:[edi], dword [esi]
cdq
or dl, byte [ebx - 0x73]
lea esp, [eax - 1]
invalid
push ebx
lea ecx, [ebp - 0xa0]
call fcn.00406d70
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x42a57f
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00407760
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret