joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8e11b8
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e11be
pop ebp
sub ebp, 6
sub ebp, 0x4e11b8
jmp 0x8e121c
jmp 0x8e1225
mov eax, 0x4e11b8
add eax, ebp
add eax, 0x93
mov ecx, 0x627
mov edx, 0xac14fd3b
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e123c
jmp 0x8e124f
push ecx
jnp 0x8e12a5
cmp ebp, dword [ebx]
cmp edi, dword [ebx]
push ebx
cmp esi, edi
pop ss
cmp ecx, dword [eax]
sti
imul eax, esp, 0xffffffae
pop es
push 0x7f
cmp ebp, dword [ebx - 0x50]
div byte [eax + 0x3b3b07b2]
cmp edi, dword [edx + 0x3b3bc3fa]
cmp edi, dword [eax]
test byte [ebx + 0x3b3b3b3d], 0x81
adc edi, dword [ebx]
cmp edi, dword [ebx]
int3
cmp edi, dword [ebx]
cmp ebp, dword [esi - 0x4a]
push edi
pop ds
cmp esi, dword [eax + 0x3b3b33be]
cmp esi, dword [eax + 0x3b3b37ae]
cmp esi, dword [eax + 0x3b3b2bb6]
cmp edi, edx
sar byte [ecx], cl
or bh, byte [ecx]
mov eax, 0x34723ff9
mov esi, 0xc4c4c4cf
stc
aaa
cmp esi, dword [eax + 0x3b3f1fb7]
cmp edi, dword [ebx]
push ebx
jns 0x8e12e8
xor bh, byte [ebx]
push ebx
dec esi
loope 0x8e1361
cmp edi, dword [edx]
pop ss
pop ds
push 0xffffffffffffffd3
cmp edi, dword ds:[ebx]
cmp edx, edx
jp 0x8e1328
cmp edi, dword [ebx]
outsb dx, byte [esi]
mov dh, 0x57
pop ds
cmp eax, esp
dec esi
aaa
les ecx, [esi + 0x33]
ror dword [ecx + 0x3b], cl
cmp edi, dword [ebx]
mov al, 0x86
xor edi, dword [ebx]
cmp edi, dword [ebx]
mov edx, 0x2d936cca
scasd eax, dword es:[edi]
mov edx, 0x2d936cca
scasd eax, dword es:[edi]
or dl, dh
or cl, ch
mov eax, 0x34733ed3
mov edi, 0x3b3b3b75
xor al, 0xb3
jae 0x8e1360
cmp edi, dword [ebx]
pop ebp
mov al, 0x27
add bh, byte [ebx - 0x40cb2c40]
and dword [ebx], edi
cmp edi, dword [ebx]
mov ebx, 0xbf34d2c0
sub bh, byte [ebx]
cmp edi, dword [ebx]
pop ebp
mov edx, 0x341ec4c0
mov edi, 0x3b3b3b2e
jp 0x8e131c
test esp, 0x7712c4c4
add bh, byte [edx]
mov eax, 0xd3b83efa
aas
rol byte [esi + 0x12c4c4c4], cl
outsd dx, dword [esi]
add bh, byte [ecx]
cmp dword [eax - 0x2e47c206], edi
mov eax, 0xd1b83dfa
aas
mov eax, 0x90d23ed3
invalid
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub ebx, 0xc
imul edx
not ebx
not ebx
neg eax
add eax, 0xca
rcl eax, 0x86
not edx
sub esi, 0x62
bswap esi
sbb esi, 0xc9
add edi, 0xf4
ror esi, 0xb2
rcl edx, 0xea
add eax, 0xc
imul edx
dec edi
rcl edi, 0x51
mov edx, 0x18
inc eax
ror edi, 0x1b
rcr ebx, 0xea
sub ebx, 0xd6
not ebx
sub edi, 0x41
not ebx
not edi
neg ebx
inc edx
bswap edx
imul ebx
inc esi
or edi, 0x7f
neg esi
add ebx, 0x8b
rol edx, 0x66
or edi, 0x2e
neg esi
ror ebx, 0xc1
sbb esi, 0x9a
neg edi
inc esi
sub ebx, 0x45
not ebx
neg edi
mov esi, 0x54
add esi, 0xe2
neg edi
rcr ebx, 0x49
inc eax
xor ecx, ecx
xor edi, edi
inc ebx
bswap edx
ror edx, 0xd9
neg edi
rcr edx, 0x18
rol esi, 0xf
add edi, 0x51
bswap ebx
not ebx
imul ebx
not edi
not esi
ror eax, 0xd9
rcl edx, 0x2d
ror esi, 0x6d
mov esi, 0x93
ror ebx, 0x8e
sub ebx, 0xd5
and eax, 0x83
imul esi
not ebx
sbb edx, 0xe
rcl esi, 0xba
not edi
sub esi, 0xbe
add eax, 0x58
rcr esi, 0x3e
inc esi
sbb esi, 0x83
bswap edi
sub esi, 0x5a
imul edx
rcr eax, 0x43
not eax
or eax, 0x81
or ebx, 0xf4
imul esi
add esi, 0xde
sbb esi, 0xd1
inc edx
dec ebx
rcr eax, 0x25
neg esi
sub edx, 0xac
neg edx
rcr eax, 0x12
and ebx, 0xcc
add edx, 0x15
imul edi
sub edx, 0x64
mov ecx, dword [ebp + 0xc]
sub esi, 0x97
neg eax
rol eax, 0x94
add edi, 0x32
dec edi
ror esi, 0x4a
sub edi, 0xc
sub esi, 0x6c
ror edx, 0xfe
imul edi
or esi, 0x20
sub esi, 0x82
sbb edx, 0xff
ror edx, 0x46
neg eax
dec edi
dec edx
ror ebx, 0xed
imul edi
dec eax
imul edx
inc esi
inc edx
rcl esi, 0x1a
rol ebx, 0x17
inc eax
add edi, 0xa5
inc edi
rcl edx, 0xf7
bswap ebx
neg eax
or edi, 0xf8
neg ebx
imul edx
and eax, 0xa9
imul edx
not edx
inc ebx
rcr ebx, 0x64
rol eax, 0x35
not eax
inc edx
rol esi, 0xcc
neg edx
ror edi, 9
not eax
sbb esi, 0x5a
rcr esi, 0xe9
bswap ebx
imul edx
mov edi, dword [ebp + 8]
mov ebx, esi
mov ebx, ebx
xor ebx, esi
xor eax, esi
xor ebx, eax
xor ebx, esi
xor esi, esi
mov esi, eax
xor esi, eax
xor ebx, ebx
mov eax, esi
xor eax, esi
not byte [edi]
xor esi, esi
mov esi, eax
xor ebx, ebx
xor esi, eax
xor eax, ebx
xor esi, eax
xor eax, eax
xor eax, eax
xor ebx, ebx
sub byte [edi], 0x89
mov ebx, ebx
xor esi, eax
xor ebx, ebx
mov ebx, eax
xor eax, ebx
mov ebx, eax
mov ebx, ebx
xor esi, esi
xor ebx, eax
add byte [edi], 0x43
xor ebx, ebx
xor ebx, ebx
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov ebx, eax
xor ebx, eax
xor eax, eax
xor eax, eax
imul byte [edi]
inc edi
loop 0x4011c3
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403343
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402239
and dword [ebp - 4], 0
cmp dword [0x458488], 0
mov ebx, eax
jne 0x4033f4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4034a5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4034a5
push eax
call fcn.004021c7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x458488], eax
call esi
push eax
call fcn.004021c7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45848c], eax
call esi
push eax
call fcn.004021c7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x458490], eax
call esi
push eax
call fcn.004021c7
pop ecx
mov dword [0x458498], eax
test eax, eax
je 0x4033f4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004021c7
pop ecx
mov dword [0x458494], eax
mov eax, dword [0x458494]
cmp eax, ebx
je 0x40344c
cmp dword [0x458498], ebx
je 0x40344c
push eax
call fcn.00402242
push dword [0x458498]
mov esi, eax
call fcn.00402242
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40344c
test edi, edi
je 0x40344c
call esi
test eax, eax
je 0x403443
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403443
test byte [ebp - 0xc], 1
jne 0x40344c
or dword [ebp + 0x10], 0x200000
jmp 0x403485
mov eax, dword [0x45848c]
cmp eax, ebx
je 0x403485
push eax
call fcn.00402242
pop ecx
test eax, eax
je 0x403485
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403485
mov eax, dword [0x458490]
cmp eax, ebx
je 0x403485
push eax
call fcn.00402242
pop ecx
test eax, eax
je 0x403485
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x458488]
call fcn.00402242
pop ecx
test eax, eax
je 0x4034a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4034a7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4051ae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x457bf8]
jne 0x4051b8
repz ret
jmp fcn.004068d5
Function at 0x40894b
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop edi
call fcn.0040896b
and ecx, ecx
xor dword [edx], edi
mov ecx, eax
inc edx
mov ecx, ecx
cmp edx, esi
jne fcn.0040894b
add eax, ecx
mov eax, 0x6d9985db
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push 0x5040d1
push 0x504088
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.USER32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x805e3c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805e42
pop ebp
sub ebp, 6
sub ebp, 0x405e3c
jmp 0x805ea0
jmp 0x805ea9
mov eax, 0x405e3c
add eax, ebp
add eax, 0x93
mov ecx, 0x61f
mov edx, 0x8a9369bb
xor byte [eax], dl
inc eax
dec ecx
jne 0x805ec0
jmp 0x805ed3
add byte [eax], al
add eax, 0xd16298d9
sti
sar ebx, 1
sar dword [ebx - 0x2c444455], cl
mov ebx, 0x88bb9777
jnp 0x805ecd
inc esp
mov ebx, 0xebbb8d6a
mov ebx, 0xebbb8d6a
xor byte [esi + 0x30], dh
xor al, byte [edi + 0x3abbbbbb]
jp 0x805f37
mov ebx, 0x76b8bbbb
add edi, dword [ebp + 0x1bbbbbb]
xchg ebx, eax
mov ebx, 0x594cbbbb
mov eax, 0xb73a3073
mov ebx, 0x7eb8bbbb
jmp 0x805ee4
xor byte [esi], ch
mov bh, 0xbb
mov ebx, 0xab3630bb
mov ebx, 0x527abbbb
mov ecx, 0x7938b98a
mov edi, 0x4f3eb4f2
inc esp
inc esp
inc esp
out 0x79, al
mov bh, 0xbb
xor byte [edi], dh
lahf
mov edi, 0xd3bbbbbb
xor dword [ebp + 0xbd3bbb2], ecx
pushfd
invalid
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
or edx, 0xa9
rcr ebx, 0xab
rcl ebx, 0xc4
mov edi, 0x9f
not edx
neg eax
or esi, 0x6e
inc esi
bswap edi
inc ebx
inc edi
and ebx, 0xeb
rcl edx, 0xda
bswap edi
neg ebx
neg esi
ror edx, 0xee
inc edx
neg edi
sbb edx, 0xd3
rol edi, 0x2f
dec ebx
imul eax
mov edi, 0xb0
imul edx
inc edi
not esi
neg esi
inc edx
and edi, 0x7f
dec edi
add eax, 0xab
rol eax, 0x1d
dec eax
bswap esi
not ebx
sub ebx, 0x81
inc ebx
dec esi
mov esi, 0x14
sbb edx, 0x6b
inc esi
sub edi, 0xd1
rol eax, 0x25
dec edx
rcr edx, 0xe8
neg edi
and edi, 0x30
and edi, 0xda
and esi, 0xe3
xor ecx, ecx
xor edi, edi
dec edx
add esi, 0xa7
rcr edx, 0xfc
not edx
or ebx, 0xb5
imul edx
rcr eax, 0x1d
inc eax
sub edx, 0x21
imul eax
rcr esi, 0x34
inc eax
ror edi, 0xbe
dec ebx
bswap eax
add edx, 0x51
inc edi
not edx
dec edi
ror esi, 0x1b
rcl edx, 0x67
ror edi, 0x34
imul eax
sub eax, 0xa4
dec ebx
not ebx
add ebx, 0x55
add ebx, 0xa8
ror esi, 0x88
dec edx
add esi, 0xe
add eax, 0xd4
rcl edx, 0x28
or esi, 9
and ebx, 0
not esi
neg edi
mov edx, 0xb6
rcl ebx, 0x96
sbb esi, 0x8f
dec esi
add ebx, 0x53
add edx, 0x9b
inc esi
dec esi
inc ebx
dec edi
imul edx
add ebx, 0
mov esi, 0x82
mov ecx, dword [ebp + 0xc]
neg eax
not edx
imul edi
dec ebx
ror esi, 0x7f
sbb ebx, 0xdb
sub eax, 0xa4
dec edx
rol eax, 0x81
sub esi, 0x92
sbb edi, 0xc6
neg eax
rol edx, 0x31
sbb ebx, 0xf2
imul eax
or ebx, 0x9d
ror edx, 0x3a
or esi, 0xcd
not esi
or edi, 0xd0
and esi, 0xe1
not edi
or esi, 0xfb
imul edx
neg ebx
bswap eax
dec edi
dec eax
sbb esi, 0xe4
rcl ebx, 0xc1
add ebx, 0x7b
sbb edx, 0x97
sub ebx, 0xb6
neg ebx
rcl esi, 0xb4
mov edi, 0xc5
sbb ebx, 0xa2
sbb eax, 0xe2
inc edi
ror edi, 0xfd
rcr edi, 0x61
or esi, 0x5e
rol esi, 0x9a
bswap esi
dec esi
rol edx, 0xe5
dec edi
and ebx, 0x70
rcl edx, 0x74
inc edi
mov edi, dword [ebp + 8]
mov esi, esi
mov eax, eax
xor eax, ebx
mov eax, ebx
mov ebx, esi
xor esi, ebx
mov esi, ebx
xor ebx, ebx
xor eax, eax
mov esi, eax
xor eax, eax
mov ebx, ebx
not byte [edi]
mov ebx, esi
xor ebx, esi
xor eax, eax
xor eax, ebx
mov ebx, esi
mov esi, eax
mov esi, eax
mov ebx, esi
mov eax, ebx
sub byte [edi], 0x89
mov esi, esi
mov ebx, ebx
xor eax, esi
mov ebx, esi
xor esi, ebx
mov esi, ebx
mov ebx, eax
mov esi, eax
xor eax, ebx
add byte [edi], 0x43
mov ebx, eax
mov ebx, eax
xor ebx, ebx
mov ebx, eax
xor esi, ebx
mov esi, eax
xor ebx, esi
mov eax, eax
mov ebx, eax
imul byte [edi]
inc edi
loop 0x4011d1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403353
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402249
and dword [ebp - 4], 0
cmp dword [0x460688], 0
mov ebx, eax
jne 0x403404
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4034b5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4034b5
push eax
call fcn.004021d7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x460688], eax
call esi
push eax
call fcn.004021d7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46068c], eax
call esi
push eax
call fcn.004021d7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x460690], eax
call esi
push eax
call fcn.004021d7
pop ecx
mov dword [0x460698], eax
test eax, eax
je 0x403404
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004021d7
pop ecx
mov dword [0x460694], eax
mov eax, dword [0x460694]
cmp eax, ebx
je 0x40345c
cmp dword [0x460698], ebx
je 0x40345c
push eax
call fcn.00402252
push dword [0x460698]
mov esi, eax
call fcn.00402252
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40345c
test edi, edi
je 0x40345c
call esi
test eax, eax
je 0x403453
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403453
test byte [ebp - 0xc], 1
jne 0x40345c
or dword [ebp + 0x10], 0x200000
jmp 0x403495
mov eax, dword [0x46068c]
cmp eax, ebx
je 0x403495
push eax
call fcn.00402252
pop ecx
test eax, eax
je 0x403495
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403495
mov eax, dword [0x460690]
cmp eax, ebx
je 0x403495
push eax
call fcn.00402252
pop ecx
test eax, eax
je 0x403495
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x460688]
call fcn.00402252
pop ecx
test eax, eax
je 0x4034b5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4034b7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4051be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45fdf8]
jne 0x4051c8
repz ret
jmp fcn.004068e5
Function at 0x4033e5
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movsx eax, byte [ebp + 8]
push esi
push edi
push eax
lea eax, [ebp - 0xc]
push str.._c:
push eax
xor esi, esi
call fcn.004052af
add esp, 0xc
lea eax, [ebp - 0xc]
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x403451
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x18]
push 0xc
push eax
push esi
push esi
push 0x2d1080
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40344a
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
push 1
mov dword [eax], ecx
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, si
pop edi
pop esi
leave
ret

Function at 0x403711
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, 2
jb 0x403740
cmp byte [ebp - 0x103], 0x3a
mov al, byte [ebp - 0x104]
je 0x403742
mov al, 0x43
leave
ret

Function at 0x403c30
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x403bd8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x403c4a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x4101b8
push 0x410300
push str.SOFTWARE_sLicenses_s
lea eax, [ebp - 0x16c]
xor ebx, ebx
push 0x100
push eax
mov dword [esi], ebx
mov dword [ebp + 8], ebx
call fcn.00405220
add esp, 0x14
lea eax, [ebp + 8]
push eax
push 0x20019
lea eax, [ebp - 0x16c]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403d2f
push edi
push 0x60
pop edi
lea eax, [ebp - 0x6c]
push edi
push ebx
push eax
call fcn.00404f80
add esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 3
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x4135a0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
pop edi
jne 0x403d2f
cmp dword [ebp - 8], 3
jne 0x403d2f
cmp dword [ebp - 0xc], 8
jb 0x403d2f
cmp esi, ebx
je 0x403d29
lea eax, [ebp - 0x6c]
push 4
push eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call fcn.00404b90
lea eax, [ebp - 0x68]
push 4
push eax
push esi
call fcn.00404b90
push esi
call fcn.00403bb2
mov eax, dword [ebp - 4]
add esp, 0x1c
sub dword [esi], eax
mov ax, 1
jmp 0x403d32
xor ax, ax
pop esi
pop ebx
leave
ret

Function at 0x403e51
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4139c0
call esi
push 0x4139d8
call esi
xor eax, eax
push eax
push eax
push eax
push 0x403e98
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x40a181
Capabilities:
Contain obfuscated stackstrings

Disassembly:
les edx, [eax]
mov dword [ebp - 0x88], eax
call fcn.00409e2b
leave
sub bh, byte [esi - 0x17ba72ab]
mov byte [ebp - 0x18], bl

Function at 0x40a198
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
inc ebp
rol esi, cl
inc ebp
stc

Function at 0x40a1bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00409e3b
push eax
push esi
push dword [ebp + 8]
call fcn.00409df0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00409e3b
push eax
push esi
push dword [ebp + 8]
call fcn.00409df0
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
loope 0x40a2d9
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00409e3b
push eax
push esi
push dword [ebp + 8]
call fcn.00409df0
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00409e2b
push es
or dword [edi + 0x7c9d88ce], esp
invalid
Function at 0x40aa23
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00409df0
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.00409e2b
cmp al, 0x23
jl 0x40aa7e
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.00409e3b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00409df0
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.00409e2b
jns 0x40ab53
invalid
mov byte [0x1046811], al
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x40ab1f
cmp dword [ebp - 0x398], 0
je 0x40ace9
cmp dword [ebp + 0xc], 1
je 0x40ace9
cmp dword [ebp + 0xc], 8
jne 0x40acb1
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
call fcn.00409e2b
jae 0x40aca9
rol ecx, 0x80
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.00409e2b
mov ebp, 0x809279bd
movsd dword es:[edi], dword [esi]
sar ch, 1
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00409e09
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
and esi, eax
test dword [edi + 0x30fffffc], ebx
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a