joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430144
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
or eax, 0xffffffff
cmp dword [esp + 8], ecx
jbe 0x430174
push esi
mov edx, dword [esp + 8]
movzx edx, byte [ecx + edx]
mov esi, eax
and esi, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x472ac8]
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x430150
pop esi
not eax
ret

Function at 0x430c9a
Capabilities:
Get common file path

Disassembly:
push 0x58
mov eax, 0x46da95
call fcn.0045d4e7
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
call fcn.0042a635
and dword [ebp - 4], 0
mov esi, 0x104
push esi
mov ecx, edi
mov byte [ebp - 0x35], 1
mov byte [ebp - 4], 1
call fcn.00403a70
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
mov ecx, edi
mov ebx, eax
call fcn.0040a796
test ebx, ebx
je 0x430ce5
cmp ebx, esi
jbe 0x430d22
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x430d1e
test byte [eax + 0x1c], 1
je 0x430d1e
cmp byte [eax + 0x19], 2
jb 0x430d1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x497644]
push 0x472fb0
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042a72b
add esp, 0x14
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x5c]
call fcn.0042a5f3
test al, al
je 0x430d32
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x5c]
call fcn.0042a615
mov al, byte [ebp - 0x35]
call fcn.0045d543
ret
Function at 0x435932
Capabilities:
Write file on windows

Disassembly:
push 0x10
mov eax, 0x46dd34
call fcn.0045d47b
mov esi, ecx
mov eax, dword [esi + 0x34]
cmp eax, 0xffffffff
je 0x435953
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x34], 0xffffffff
push 0x497a28
lea ecx, [ebp - 0x14]
call fcn.004037fc
lea eax, [esi + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040382b
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.00409df5
push dword [esi + 8]
lea eax, [ebp - 0x14]
push 0x473220
push eax
call fcn.0042da2a
add esp, 0xc
cmp dword [esi + 0x18], edi
je 0x4359b0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x14]
push str._0x_04X
push eax
call fcn.0042da2a
add esp, 0xc
push str..log
lea ecx, [ebp - 0x14]
call fcn.0040c3d8
mov ebx, dword [ebp - 0x14]
push edi
push 0x80
push 4
push edi
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x34], eax
cmp eax, 0xffffffff
je 0x435a14
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x435a07
push edi
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x34]
mov dword [ebp - 0x1c], 0xfeff
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push edi
push edi
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
cmp dword [esi + 0x34], 0xffffffff
lea ecx, [ebx - 0x10]
setne al
mov esi, eax
call fcn.00403af7
mov eax, esi
jmp 0x435a3e
call fcn.0045d520
ret
Function at 0x436514
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1dc]
sub esp, 0x25c
mov eax, dword [0x4960a8]
xor eax, ebp
mov dword [ebp + 0x1d8], eax
push ebx
push esi
mov esi, dword [ebp + 0x1e4]
push edi
push 0x5c
push esi
call fcn.0045bfa2
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x43654c
mov edi, esi
jmp 0x43654e
inc edi
inc edi
push 0x47de90
push edi
call fcn.0045bc27
pop ecx
mov ebx, eax
pop ecx
neg ebx
sbb bl, bl
push 0x497a28
lea ecx, [ebp - 0x80]
inc bl
call fcn.004037fc
test bl, bl
jne 0x4365a9
push 0x2e
push edi
call fcn.0045bf7c
pop ecx
pop ecx
test eax, eax
jne 0x4365a9
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.0042df63
pop ecx
pop ecx
test al, al
je 0x4365e2
lea eax, [ebp - 0x80]
push 0x473238
push eax
call fcn.0042e209
pop ecx
pop ecx
test al, al
je 0x4365e2
mov esi, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4365f1
xor bl, bl
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.00403af7
mov al, bl
mov ecx, dword [ebp + 0x1d8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459871
add ebp, 0x1dc
leave
ret
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.00403af7
xor al, al
jmp 0x4365ca
mov byte [ebp - 0x79], 0
test byte [ebp - 0x78], 0x10
je 0x4365ff
test bl, bl
jmp 0x436606
test dword [ebp - 0x78], 0x69a3
jne 0x436619
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4365f5
jmp 0x43661d
mov byte [ebp - 0x79], 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [ebp - 0x79]
jmp 0x4365bd
Function at 0x4396b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push edi
mov edi, ecx
cmp ebx, eax
je 0x439701
cmp dword [esi], eax
jne 0x439701
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x4396f5
test byte [eax + 0x1c], 1
je 0x4396f5
cmp byte [eax + 0x19], 2
jb 0x4396f5
push 0x47334c
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
mov dword [edi + 8], 0x57
jmp 0x43979b
push esi
push ebx
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 8], eax
test eax, eax
jne 0x43979b
inc eax
cmp dword [ebp + 0xc], eax
je 0x439752
cmp dword [ebp + 0xc], 2
je 0x439752
cmp dword [ebp + 0xc], 7
je 0x439752
mov ecx, dword [0x497644]
cmp ecx, 0x497644
je 0x439794
test byte [ecx + 0x1c], al
je 0x439794
cmp byte [ecx + 0x19], 2
jb 0x439794
push 0x47334c
push 0x17
jmp 0x439786
mov ecx, dword [esi]
test al, cl
jne 0x439766
test ebx, ebx
je 0x43979d
shr ecx, 1
cmp word [ebx + ecx*2 - 2], 0
je 0x43979d
mov ecx, dword [0x497644]
cmp ecx, 0x497644
je 0x439794
test byte [ecx + 0x1c], al
je 0x439794
cmp byte [ecx + 0x19], 2
jb 0x439794
push 0x47334c
push 0x18
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0040d1fe
add esp, 0x10
mov dword [edi + 8], 0xd
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4397a4
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
cmp edi, 1
je 0x4397ec
cmp edi, 2
je 0x4397ec
cmp edi, 7
je 0x4397ec
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x4397e8
test byte [eax + 0x1c], 1
je 0x4397e8
cmp byte [eax + 0x19], 2
jb 0x4397e8
push 0x47334c
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
xor eax, eax
jmp 0x43981b
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x14]
push edi
push 0
push dword [esp + 0x1c]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 8], eax
mov eax, ecx
pop edi
pop esi
ret 0xc

Function at 0x439820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov esi, ecx
push dword [esi + 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 8], eax
test eax, eax
je 0x439857
xor eax, eax
jmp 0x439896
cmp dword [ebp - 4], 4
je 0x439893
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x43988a
test byte [eax + 0x1c], 1
je 0x43988a
cmp byte [eax + 0x19], 2
jb 0x43988a
push 0x47334c
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x439853
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x439dd9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x64
mov eax, 0x46e09a
call fcn.0045d4e7
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, ecx
lea ecx, [ebp - 0x38]
push ecx
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x3c]
push ecx
push eax
push ebx
push dword [esi + 4]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x439e1f
xor eax, eax
jmp 0x43a010
cmp dword [ebp - 0x3c], 1
je 0x439e61
cmp dword [ebp - 0x3c], 2
je 0x439e61
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x439e58
test byte [eax + 0x1c], 1
je 0x439e58
cmp byte [eax + 0x19], 2
jb 0x439e58
push 0x47334c
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x439e18
test byte [ebp - 0x38], 1
je 0x439e88
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x439e58
test byte [eax + 0x1c], 1
je 0x439e58
cmp byte [eax + 0x19], 2
jb 0x439e58
push 0x47334c
push 0x1a
jmp 0x439e4a
lea ecx, [ebp - 0x68]
call fcn.0042a635
mov eax, dword [ebp - 0x38]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
inc eax
inc eax
mov dword [ebp - 0x38], eax
shr eax, 1
push eax
mov byte [ebp - 4], 1
call fcn.0042d9e4
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push ebx
push dword [esi + 4]
call edi
mov ecx, dword [ebp - 0x40]
push 0xffffffffffffffff
mov dword [esi + 8], eax
call fcn.0040a796
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x439fe9
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x439f02
test byte [eax + 0x1c], 1
je 0x439f02
cmp byte [eax + 0x19], 2
jb 0x439f02
push ecx
push 0x47334c
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042a72b
add esp, 0x14
mov ecx, dword [ebp - 0x40]
call fcn.00403ac2
jmp 0x439fe9
lea ecx, [ebp - 0x68]
call fcn.0042a5f3
test al, al
je 0x439ffc
mov dword [esi + 8], 0xe
xor eax, eax
cmp dword [esi + 8], eax
lea ecx, [ebp - 0x68]
sete al
mov esi, eax
call fcn.0042a615
mov eax, esi
call fcn.0045d543
ret 8
Function at 0x43b50f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4960a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x62
push eax
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
mov esi, ecx
push eax
mov dword [ebp - 0x70], esi
call fcn.0045b990
add esp, 0xc
push 0x497a28
lea ecx, [ebp - 0x6c]
call fcn.004037fc
lea eax, [ebp - 0x6c]
push eax
push str._APPDATAEXTENSION_
call fcn.0043b446
pop ecx
pop ecx
cmp eax, 1
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
jne 0x43b566
push dword [ebp - 0x6c]
jmp 0x43b56b
push str.Symantec
push 0x32
push eax
call fcn.0045bb54
add esp, 0x10
push edi
push 0x105
mov ecx, esi
call fcn.00403a70
push 0
push dword [ebp + 8]
mov edi, eax
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x43b5ba
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x68]
push eax
push edi
call esi
test eax, eax
je 0x43b5ba
call fcn.0043ce83
push eax
push edi
call esi
test eax, eax
je 0x43b5ba
xor esi, esi
inc esi
jmp 0x43b5bc
xor esi, esi
mov ecx, dword [ebp - 0x70]
push 0xffffffffffffffff
call fcn.0040a796
pop edi
test esi, esi
jne 0x43b600
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x43b5f8
test byte [eax + 0x1c], 1
je 0x43b5f8
cmp byte [eax + 0x19], 2
jb 0x43b5f8
push 0x474240
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
mov ecx, dword [ebp - 0x70]
call fcn.00403ac2
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
call fcn.00403af7
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00459871
leave
ret
Function at 0x43b61a
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x228
lea ebp, [esp - 4]
mov eax, dword [0x4960a8]
xor eax, ebp
mov dword [ebp + 0x228], eax
push 0x38
mov eax, 0x46e18f
call fcn.0045d47b
mov eax, dword [ebp + 0x234]
xor ebx, ebx
push ebx
push 0x43a945
push 8
push 0x3c
push 0x474250
push eax
mov edi, ecx
call fcn.0045dd1c
add esp, 0x18
lea ecx, [ebp - 0x3c]
mov esi, eax
call fcn.0042a635
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x43b72b
mov esi, dword [esi + 4]
cmp esi, 0xf0000000
je 0x43b876
cmp esi, 0xf0000001
je 0x43b872
cmp esi, 0xf0000002
je 0x43b742
cmp esi, 0xf0000003
je 0x43b6fa
lea eax, [ebp]
push eax
push 1
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x43b6ea
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x43b72b
test byte [eax + 0x1c], 1
je 0x43b72b
cmp byte [eax + 0x19], 2
jb 0x43b72b
push 0x474240
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
jmp 0x43b72b
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.00405adb
jmp 0x43b783
push 0x497a28
lea ecx, [ebp - 0x14]
call fcn.004037fc
lea eax, [ebp - 0x14]
push eax
push dword [0x49602c]
mov byte [ebp - 4], 2
call fcn.0043a957
pop ecx
pop ecx
test eax, eax
jge 0x43b732
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00403af7
xor esi, esi
jmp 0x43b882
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.0040382b
mov ecx, dword [ebp - 0x14]
jmp 0x43b77b
push 0x497a28
lea ecx, [ebp - 0x18]
call fcn.004037fc
lea eax, [ebp - 0x18]
push eax
push dword [0x496028]
mov byte [ebp - 4], 3
call fcn.0043a957
pop ecx
pop ecx
test eax, eax
jge 0x43b76d
mov ecx, dword [ebp - 0x18]
jmp 0x43b723
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0040382b
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00403af7
xor esi, esi
inc esi
jmp 0x43b882
push 0x1c
jmp 0x43b878
push 0x23
mov ecx, edi
call fcn.0043b50f
mov esi, eax
pop ecx
lea ecx, [ebp - 0x3c]
call fcn.0042a615
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x228]
xor ecx, ebp
call fcn.00459871
add ebp, 0x22c
leave
ret
Function at 0x43ca48
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4960a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x43cbde
test esi, esi
je 0x43cbde
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x64
jb 0x43cbde
xor eax, eax
push 0x208
push eax
mov word [esi], ax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0045b990
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x43cac3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43cbe1
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x43cbc9
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCServerW]
test eax, eax
jne 0x43cbc9
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.0045c352
add esp, 0xc
test eax, eax
jne 0x43cbc2
push str.isolate.ini
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x43cbc2
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43cac3
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push str.SoftwareSymantecIsolation
push str.reghive
push str.isolation
call fcn.0043c74d
add esp, 0x18
dec ebx
cmp eax, ebx
jne 0x43cb65
push 0x7a
jmp 0x43cbe0
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43cb91
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43cbb4
cmp eax, 5
jne 0x43cba3
push str.CIsolation::GetRegistryHive__:_RegOpenKeyEx___returned_ERROR_ACCESS_DENIED
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x43cbb4
cmp eax, 2
jne 0x43cbaf
push 0x4744c8
jmp 0x43cb9b
xor eax, eax
mov word [esi], ax
xor eax, eax
cmp word [esi], ax
setne al
dec eax
and eax, 0xd
jmp 0x43cbe1
mov eax, 0x54f
jmp 0x43cbe1
push 0x1c
push str.SoftwareSymantecIsolation
push ebx
push esi
call fcn.0045bb54
add esp, 0x10
xor eax, eax
jmp 0x43cbe1
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459871
leave
ret
Function at 0x43cbf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4960a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x43cd2e
test esi, esi
je 0x43cd2e
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x26
jb 0x43cd2e
xor eax, eax
push 0x208
push eax
mov word [esi], ax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0045b990
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x43cc6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43cd31
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x43cd2a
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCServerW]
test eax, eax
jne 0x43cd2a
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.0045c352
add esp, 0xc
test eax, eax
jne 0x43cd23
push str.isolate.ini
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x43cd23
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43cc6b
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push 0x481518
push str.silo
push str.isolation
call fcn.0043c74d
add esp, 0x18
dec ebx
cmp eax, ebx
jne 0x43cd05
push 0x7a
jmp 0x43cd30
push esi
call fcn.0043bdf5
pop ecx
test al, al
jne 0x43cd15
xor eax, eax
mov word [esi], ax
xor eax, eax
cmp word [esi], ax
setne al
dec eax
and eax, 0xd
jmp 0x43cd31
mov eax, 0x54f
jmp 0x43cd31
push 2
jmp 0x43cd30
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459871
leave
ret
Function at 0x458e4d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x458eb6
cmp dword [ebp + 0x10], 1
je 0x458e8e
cmp dword [ebp + 0x10], 2
je 0x458e8e
push 0xd
pop eax
jmp 0x458eb6
mov eax, dword [ebp - 4]
test edi, edi
je 0x458eb0
test eax, eax
je 0x458eab
test al, 1
jne 0x458e89
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x458eb0
jmp 0x458e89
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x459871
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4960a8]
jne 0x45987b
repz ret
jmp fcn.0045e3a7

Function at 0x45d747
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x45d778
call fcn.0045db67
mov dword [eax], esi
call fcn.0045db54
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00459df9
add esp, 0x14
push 0x16
pop eax
jmp 0x45d7cd
test dword [ebp + 0xc], 0xfffffff9
jne 0x45d754
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45d7a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045db7a
pop ecx
call fcn.0045db54
mov eax, dword [eax]
jmp 0x45d7cd
test al, 0x10
jne 0x45d7cb
test al, 1
je 0x45d7cb
test byte [ebp + 0xc], 2
je 0x45d7cb
call fcn.0045db67
mov dword [eax], 5
call fcn.0045db54
mov dword [eax], 0xd
jmp 0x45d79c
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4679b5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045e51f
and dword [ebp - 4], 0
cmp dword [0x4988c4], 0
mov ebx, eax
jne 0x467a66
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x467b17
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x467b17
push eax
call fcn.0045e4ad
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4988c4], eax
call esi
push eax
call fcn.0045e4ad
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4988c8], eax
call esi
push eax
call fcn.0045e4ad
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4988cc], eax
call esi
push eax
call fcn.0045e4ad
pop ecx
mov dword [0x4988d4], eax
test eax, eax
je 0x467a66
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045e4ad
pop ecx
mov dword [0x4988d0], eax
mov eax, dword [0x4988d0]
cmp eax, ebx
je 0x467abe
cmp dword [0x4988d4], ebx
je 0x467abe
push eax
call fcn.0045e528
push dword [0x4988d4]
mov esi, eax
call fcn.0045e528
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x467abe
test edi, edi
je 0x467abe
call esi
test eax, eax
je 0x467ab5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x467ab5
test byte [ebp - 0xc], 1
jne 0x467abe
or dword [ebp + 0x10], 0x200000
jmp 0x467af7
mov eax, dword [0x4988c8]
cmp eax, ebx
je 0x467af7
push eax
call fcn.0045e528
pop ecx
test eax, eax
je 0x467af7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x467af7
mov eax, dword [0x4988cc]
cmp eax, ebx
je 0x467af7
push eax
call fcn.0045e528
pop ecx
test eax, eax
je 0x467af7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4988c4]
call fcn.0045e528
pop ecx
test eax, eax
je 0x467b17
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x467b19
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
out 0x45, eax
adc byte [ebx + 0x558b0c5b], cl
or byte [eax + 0x44], dl
inc esp
push edx
call 0x13c7948
xor eax, edx
sub byte [eax], al
nop
nop
nop
nop
xchg byte [eax - 0x74526f0d], dl
in al, dx
mov edx, dword [ebp + 0x10]
jg 0x40b3ed
test byte [ebx - 0x1b572aa], dh
not byte cs:[edi - 0x75]
jge 0x40b420
test ecx, ecx
jle 0x40b483
xor edx, edx
sti
fisttp dword [edx - 0x397cc896]
and eax, ecx
ljmp 0xc718
invalid
shr ebx, 6
rcl bl, 0x40
and edx, dword [edx + 0x40c74e]
mov byte [eax - 1], dl
mov dl, byte [edi + esi - 1]
cli
aas
push es
cmp esi, ecx
pushal
xchg edx, eax
sbb bh, al
inc eax
add byte [eax - 0x6783d7a4], cl
mov edx, dword [ebp + 0x10]
cmp esi, edx
jge 0x40b4e6
xor ecx, ecx
mov cl, byte [esi + edi]
je 0x40b477
add al, byte [eax + 0x4a]
mov dl, byte [eax + ebx - 0x39]
inc eax
add byte [ebx], bh
mov byte [eax + 0x3c], cl
mov dl, byte [esi + edi]
jne 0x40b45c
and edx, 3
shl edx, 4
inc eax
or dword [edx + 0x40c7cc], 0xf2ff4888
add byte [0x4c8d2beb], bh
add dword ds:[ebx], esi
fild dword [edi - 0x1e]
add ecx, dword [edx - 0x631d3e98]
shr ebx, 4
or edx, ebx
pop ss
mov dl, byte [edx + 0x40c718]
mov bl, 0x50
dec dword [edx + 0xfe18309]
mov dl, byte [ecx*4 + 0x40c718]
mov byte [ebx], dh
ja 0x40b49c
adc al, 0x8d
sbb bh, al
inc eax
add byte [eax - 0x214688cd], cl
cmp eax, 0x80a8ba7
fidivr word [0x80a8ba7]
mov ecx, dword [edx]
or bl, bl
xor dword [eax], eax
sub eax, edx
pop edi
pop esi
inc eax
pop ebx
pop ebp
mov byte [0x9090002b], al
nop
nop
nop
nop
pop edi
adc byte [eax + 0x583da790], 0x40
inc ecx
add bh, bh
jne 0x40b515
invalid
push dword [esp + 4]
call dword [0x58c0f8]
pop ecx
ret
push 0x414054
push 0x414058
push dword [esp + 5]
call 0x5440b920
add esp, 0xc
jo 0x40b52c
push dword [edx + ebp*4 + 4]
call 0x40b448
neg eax
sbb eax, eax
pop ecx
xor bl, al
dec eax
ret
je 0x40b4d9
add al, 0xe8
adc edi, edi
invalid