joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4398fb
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 4], 0
push edi
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x24], 0
pop edi
jne 0x439928
mov dword [ebp - 0x24], 0x1000
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea ecx, [eax + ecx - 1]
jmp 0x439939
mov dl, byte [eax]
add eax, dword [ebp - 0x24]
cmp eax, ecx
jb 0x439934
mov al, byte [ecx]
leave
ret

Function at 0x439941
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14], edi
call fcn.004160c0
cmp eax, 1
jle 0x439a2a
push edi
push 0x8000000
push 3
push edi
push 7
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.0040af40
cmp dword [ebp - 4], edi
je 0x43998d
cmp dword [ebp - 4], 0xffffffff
jne 0x43999c
lea ecx, [ebp - 4]
call fcn.0040adc0
xor al, al
jmp 0x439a97
mov ecx, dword [ebp + 0x10]
mov eax, 0x100000
mov dword [ebp - 0x14], eax
cmp ecx, eax
mov dword [ebp - 8], ecx
lea eax, [ebp - 0x14]
jb 0x4399b4
lea eax, [ebp - 8]
mov ebx, dword [eax]
push 4
push 0x1000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x43998d
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea ecx, [ebp - 0xc]
push ecx
push ebx
mov dword [ebp - 8], edi
push eax
jmp 0x439a08
mov ecx, dword [ebp - 0xc]
cmp ecx, edi
jbe 0x439a11
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x4399f5
cmp dword [ebp - 8], eax
sbb eax, eax
neg eax
jmp 0x4399f8
xor eax, eax
inc eax
cmp eax, edi
je 0x439a11
add dword [ebp - 8], ecx
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp - 0x14]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4399de
push 0x8000
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea ecx, [ebp - 4]
call fcn.0040adc0
jmp 0x439a95
push 9
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, edi
je 0x439995
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x5985e8
mov dword [ebp - 0xc], esi
call fcn.004263b0
test al, al
jne 0x439a5b
call fcn.00415ae0
lea ecx, [ebp - 0x10]
call fcn.00426090
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x14], eax
cmp ecx, edi
je 0x439a75
mov dword [ebp - 8], ecx
jmp 0x439a79
or dword [ebp - 8], 0xffffffff
cmp eax, dword [ebp - 8]
lea eax, [ebp - 0x14]
jb 0x439a84
lea eax, [ebp - 8]
push dword [eax]
push esi
call fcn.004398fb
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43b174
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
mov edi, 0x823
push edi
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x827]
push 0
push eax
mov byte [ebp - 0x828], 0
call fcn.0049d850
add esp, 0xc
cmp dword [ebp + 0x18], 0
push ebx
je 0x43b2b0
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s___filename__s__r_nContent_Type:_application_octet_stream_r_n_r_n
push edi
push eax
call fcn.004a2910
lea eax, [ebp - 0x828]
add esp, 0x18
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b1fb
sub eax, edi
push 0x598330
push ebx
mov edi, eax
call fcn.0049fc3e
mov ebx, eax
pop ecx
pop ecx
mov dword [ebp - 0x82c], ebx
test ebx, ebx
je 0x43b302
push 2
push 0
push ebx
call fcn.004a2894
push ebx
call fcn.004a15b6
push 0
push 0
push ebx
mov dword [ebp - 0x834], eax
call fcn.004a2894
mov eax, dword [ebp - 0x834]
lea ebx, [eax + edi + 2]
add esp, 0x1c
cmp ebx, dword [esi]
jae 0x43b29f
push edi
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x830]
call fcn.0049d0d0
push dword [ebp - 0x82c]
mov eax, dword [ebp - 0x830]
push 1
push dword [ebp - 0x834]
add eax, edi
push eax
call fcn.004a1199
mov eax, dword [ebp - 0x830]
add esp, 0x1c
add eax, dword [ebp - 0x834]
mov ecx, 0xa0d
mov word [eax + edi], cx
mov dword [esi], ebx
jmp 0x43b2a2
and dword [esi], 0
push dword [ebp - 0x82c]
call fcn.004a1688
pop ecx
jmp 0x43b305
push dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s__r_n_r_n_s_r_n
push edi
push eax
call fcn.004a2910
lea eax, [ebp - 0x828]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43b2d9
sub eax, ecx
mov edi, eax
cmp edi, dword [esi]
jae 0x43b302
push edi
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x830]
call fcn.0049d0d0
add esp, 0xc
mov dword [esi], edi
jmp 0x43b305
and dword [esi], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d4b1
leave
ret
Function at 0x43b314
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004a2a90
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
push 0x3ffe
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
push eax
call fcn.0049d850
add esp, 0xc
lea eax, [ebp - 0x400c]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x43b3d7
cmp eax, 0x3fff
ja 0x43b3d7
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43b3d7
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x4008]
push eax
push 0x597558
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43b3d7
mov eax, dword [ebp - 0x4008]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
push edi
push esi
call fcn.004a29bc
xor eax, eax
add esp, 0x1c
mov word [esi + edi*2 - 2], ax
inc eax
jmp 0x43b3d9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d4b1
leave
ret

Function at 0x43b3e8
Capabilities:
Get common file path
Get program files directory

Disassembly:
xor eax, eax
push ebx
mov ebx, 0x607cf0
cmp ax, word [0x607cf0]
jne 0x43b421
push esi
push edi
push eax
push 0x26
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x43b409
push 0x10
pop ecx
mov esi, str.internet_exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x43b425
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push esi
call fcn.0043b3e8
push eax
call fcn.0043b314
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x43b475
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43b475
cmp ax, word [esi]
je 0x43b475
inc edi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x4b82bc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004a7aa6
and dword [ebp - 0x14], 0
cmp dword [0x61b91c], 0
mov dword [ebp - 0x18], eax
jne 0x4b836f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4b8417
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x523980
push ebx
call edi
test eax, eax
je 0x4b8417
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x61b91c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x61b920], eax
call edi
push eax
call esi
push 0x523940
push ebx
mov dword [0x61b924], eax
call edi
push eax
call esi
mov dword [0x61b92c], eax
test eax, eax
je 0x4b836f
push 0x523928
push ebx
call edi
push eax
call esi
mov dword [0x61b928], eax
mov eax, dword [0x61b928]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4b83c8
cmp dword [0x61b92c], ecx
je 0x4b83c8
push eax
call esi
push dword [0x61b92c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4b83c8
test ebx, ebx
je 0x4b83c8
call edi
test eax, eax
je 0x4b83bf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4b83bf
test byte [ebp - 8], 1
jne 0x4b83c8
or dword [ebp + 0x10], 0x200000
jmp 0x4b83fb
mov eax, dword [0x61b920]
cmp eax, dword [ebp - 0x18]
je 0x4b83fb
push eax
call esi
test eax, eax
je 0x4b83fb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4b83fb
mov eax, dword [0x61b924]
cmp eax, dword [ebp - 0x18]
je 0x4b83fb
push eax
call esi
test eax, eax
je 0x4b83fb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x61b91c]
call esi
test eax, eax
je 0x4b8417
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4b8419
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d4b1
leave
ret
Function at 0x4be07b
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ecx + 0x61858]
mov dword [ebp - 8], ecx
push edi
xor ecx, ecx
xor edi, edi
xor edx, edx
cmp cx, word [eax]
je 0x4be0a4
mov edx, eax
push 0x10000000
push edi
push edi
push edi
push edx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [esi + 0x14], eax
cmp eax, edi
je 0x4be21f
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 0x20]
lea edx, [edi + 0x2348]
mov ecx, edx
mov dword [ebp - 0x18], 3
lea eax, [ecx + 2]
mov bx, word [ecx]
add ecx, 2
test bx, bx
jne 0x4be0df
sub ecx, eax
sar ecx, 1
je 0x4be0f3
mov dword [ebp - 0xc], edx
lea edx, [edi + 0x2048]
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4be0fe
sub ecx, ebx
sar ecx, 1
je 0x4be112
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
mov ebx, dword [ebp - 8]
jne 0x4be13e
lea edx, [ebx + 0x60610]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4be129
sub ecx, dword [ebp - 8]
sar ecx, 1
je 0x4be13e
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0x14], 0
jne 0x4be167
lea edx, [ebx + 0x60710]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4be152
sub ecx, dword [ebp - 8]
sar ecx, 1
je 0x4be167
mov dword [ebp - 0x14], edx
xor eax, eax
inc eax
cmp dword [edi + 4], eax
jne 0x4be172
mov dword [ebp - 0x18], eax
push 0x4bdc68
push dword [ebp - 0x1c]
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov eax, dword [esi + 0x20]
movzx ecx, word [eax]
push esi
push dword [ebx + 0x26d8]
add eax, 0x2148
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push ecx
push eax
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 0x18], eax
test eax, eax
je 0x4be21f
add ebx, 0x60810
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4be1b8
sub eax, edx
sar eax, 1
je 0x4be21a
mov dword [ebp - 0x28], 3
test ebx, ebx
je 0x4be1e3
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4be1e9
and dword [ebp - 0x24], 0
jmp 0x4be202
lea edi, [eax + eax]
mov eax, edi
call fcn.004a2ac0
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.0042b560
mov dword [ebp - 0x24], eax
push 0xc
lea eax, [ebp - 0x28]
push eax
push 0x26
push dword [esi + 0x14]
mov dword [ebp - 0x20], 0x5974b2
call dword [sym.imp.WININET.dll_InternetSetOptionA]
xor eax, eax
inc eax
jmp 0x4be221
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049d4b1
leave
ret 4
Function at 0x4bea55
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.004a2a90
mov eax, dword [0x59ece0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x1010], edi
mov dword [ebp - 0x100c], 0x583588
cmp dword [edi + 0x2480], ebx
je 0x4bea98
mov dword [ebp - 0x100c], str.POST
xor eax, eax
push 0xffe
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push ebx
push eax
mov dword [ebp - 0x1008], ebx
mov dword [ebp - 0x101c], 0x583574
mov dword [ebp - 0x1018], ebx
call fcn.0049d850
mov eax, dword [esi + 0x20]
lea ecx, [eax + 0x1048]
push ecx
add eax, 0x48
push eax
push str._s_s
lea eax, [ebp - 0x1004]
push 0x7ff
push eax
call fcn.004bdbab
add esp, 0x20
mov eax, 0x8400c300
cmp dword [edi + 0x62cbc], ebx
je 0x4beb02
mov eax, 0x8408c300
mov ecx, dword [esi + 0x20]
cmp dword [ecx + 4], 4
jne 0x4beb10
or eax, 0x803000
push esi
push eax
lea eax, [ebp - 0x101c]
push eax
push ebx
push str.HTTP_1.1
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x100c]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [esi + 0x1c], eax
cmp eax, ebx
je 0x4bec21
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea ecx, [ebp - 0x100c]
push ecx
push 2
push eax
mov dword [ebp - 0x100c], 0x3a98
call edi
push 4
lea eax, [ebp - 0x1014]
push eax
push 0x41
push dword [esi + 0x1c]
mov dword [ebp - 0x1014], 1
call edi
push 0xa
mov dword [ebp - 0x1008], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x1044]
rep stosd dword es:[edi], eax
xor ecx, ecx
push 2
pop edx
mov eax, 0x5168
mul edx
seto cl
mov dword [ebp - 0x1044], 0x28
neg ecx
or ecx, eax
push ecx
call fcn.0049ca06
mov edi, eax
pop ecx
cmp edi, ebx
je 0x4bebfc
push 0xa2d0
push ebx
push edi
call fcn.0049d850
mov ecx, dword [ebp - 0x1010]
add esp, 0xc
push dword [ebp - 0x1008]
push 0x5167
push edi
push esi
call fcn.004be235
mov eax, edi
mov dword [ebp - 0x103c], edi
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x4bebe7
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x1038], eax
push esi
push 1
push ebx
lea eax, [ebp - 0x1044]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov dword [ebp - 0x1008], eax
cmp edi, ebx
je 0x4bec21
push edi
call fcn.0049d97d
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1008]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d4b1
leave
ret 4
Function at 0x4013b0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4023f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
push edi
mov dword [esp + 0x10], 0
lea ecx, [esp + 8]
mov dword [esp + 0x120], 1
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x120], 2
call sub.MFC42.DLL_CString::CString_1
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x4042a8
lea eax, [esp + 0xc]
push str._sLanSource.ini
push eax
mov byte [esp + 0x12c], 3
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
push str.INSTALL
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x12c]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 0x104
push edx
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [esp + 0x128]
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x120], 2
call fcn.00402036
lea ecx, [esp + 8]
mov byte [esp + 0x120], 1
call fcn.00402036
lea ecx, [esp + 0x12c]
mov byte [esp + 0x120], 0
call fcn.00402036
mov ecx, dword [esp + 0x118]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x401d10
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4034a8
push 0x4021a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x24]
push eax
push 0x20019
push ebx
push str.SystemWPAPnP
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401d6e
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x28], 4
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x2c]
push edx
push ebx
push ebx
push str.seed
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401db1
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x24]
push edx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
mov dword [ebp - 4], ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x401ec9
lea ecx, [ebp - 0x20]
push ecx
push ebx
push ebx
push 0x8003
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x401ec9
mov byte [ebp - 0x30], bl
mov al, byte [ebp + 8]
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x2e], bl
mov byte [ebp - 0x2d], bl
push ebx
push 4
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov esi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
call esi
test eax, eax
je 0x401ec9
push ebx
push 4
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call esi
test eax, eax
je 0x401ec9
mov dword [ebp - 0x28], 0x10
push ebx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x40]
push eax
push 2
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x401ec9
lea edx, [ebp - 0x24]
push edx
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionSetup
push 0x80000002
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call esi
test eax, eax
jne 0x401e91
push 0x10
lea eax, [ebp - 0x40]
push eax
push 3
push ebx
push str.PrivateHash
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x24]
push edx
call edi
lea eax, [ebp - 0x24]
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftDriver_Signing
push 0x80000001
call esi
test eax, eax
jne 0x401ec9
push 1
lea ecx, [ebp + 8]
push ecx
push 3
push ebx
push str.Policy
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x24]
push eax
call edi
mov dword [ebp - 4], 0xffffffff
call fcn.00401eef
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x162ca7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
pushfd
jmp 0x162c259

Function at 0x16369a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.01636a10
not eax
lea eax, reloc.kernel32.dll_GetProcAddress
mov ah, byte [esp]
mov ax, 0x2a69
lea eax, [ebp*4]
push edx
jmp 0x16369eb
xchg dh, al
mov ax, word [esp]
mov bp, bx
lea eax, [edx + ebp]
mov edx, ebx
rdtsc
push ebp
xchg dl, ah
bswap ebp
jmp 0x16369d5

Function at 0x1636a10
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov word [esp], sp
mov dword [esp + 3], eax
mov eax, dword [esp]
mov eax, esp
jmp 0x16369a6

Function at 0x16c85a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, esi
not dh
lea ecx, [eax*4]
sub esp, 0x14
jmp 0x16c85bf
Function at 0x16c89ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, eax
mov edx, edi
jmp 0x16c89f6
shr eax, 8
bswap ebp
xchg dword [esp + 0xb], ebp
sub ecx, 0xf1e125cc
jmp 0x16c8a49
bsf bx, si
xchg si, bp
lea edx, reloc.kernel32.dll_GetProcAddress
inc ebp
mov esi, 0x7ce5a1cd
mov ah, byte [esp + 0xb]
jmp 0x16c89e0
lea edx, [esi + ebp]
add esp, 0x26
cpuid
rdtsc
not ebp
pop bx
jmp 0x16c8afe
rcl ch, cl
mov dl, byte [esp + 0x36]
rcl di, cl
rcl dl, cl
pop eax
mov dword [esp + 0xe], ebp
jmp 0x16c8a33
bswap ebp
add cl, ah
inc edx
add esp, 2
clc
dec dh
jmp 0x16c8ac8
lea ecx, [edi*4]
mov edx, 0x33ec56ab
mov byte [esp], bh
jmp 0x16c8aad
not dx
lea eax, [eax + 0xfd]
mov dh, byte [esp]
lea eax, reloc.kernel32.dll_GetProcAddress
rcl cx, cl
sub ecx, edx
jmp 0x16c8a5b
mov dh, byte [esp + 4]
add esp, 3
lea ebx, [esp + edi]
xchg bx, si
jmp 0x16c8ad9
xchg dword [esp], edi
neg dh
push word [esp]
mov edx, 0x5ebfa576
mov word [esp + 1], bp
xchg edx, eax
jmp 0x16c8a97
ror ah, 7
sub esp, 6
mov word [esp + 2], cx
inc eax
mov bh, 0xf2
xchg esi, eax
jmp 0x16c8a68
push word [esp + 1]
mov ecx, esp
pop dword [esp]
bswap ebp
rdtsc
not esi
jmp 0x16c8b80
add esp, 2
clc
lea esp, [esp + 9]
push esp
mov dx, 0xac58
add esp, 3
jmp 0x16c8a7e
sete bl
call fcn.016c8b29
bt dx, cx
setge ch
mov ah, 0x3a
push dword [esp + 5]
dec cl
pop edx
jmp 0x16c8b6a
mov ebx, 0x5b43dc1b
lea ebx, [ecx + edx]
setg dl
mov dh, 0x5e
jmp 0x16c8d76
bsf ax, sp
bswap eax
lea ebx, [esp + ebx]
sub esp, 5
mov esi, dword [esp + 8]
mov dword [esp + 4], esp
jmp 0x16c8b4c
xchg byte [esp], bh
shr ah, cl
mov edx, 0xa2d511c6
mov di, 0xaa55
jmp 0x16c8bbe
mov bl, byte [esp]
mov bx, word [esp]
lea ecx, [ebx - 0x5f]
setp ah
mov ebx, edx
inc ecx
jmp 0x16c8b96
lea esi, [eax*4]
bswap edx
lea esp, [esp]
sub esp, 0x12
bsr dx, ax
mov word [esp + 4], bp
jmp 0x16c8d0b
xchg byte [esp], dh
not ecx
lea esp, [esp + 3]
lea esp, [esp]
mov byte [esp], dh
mov ch, bh
jmp 0x16c8bac
sub esp, 0xc
lea esp, [esp + 0x4a]
call fcn.016c8c29
mov edx, dword [edi]
xchg edx, esp
adc dword [eax + reloc.kernel32.dll_GetProcAddress], ebp
mov byte [ecx], ah
mov edi, 0x2fdcb525
lcall 0xa497, 0xb8d7b2d4
mov edx, 0x2276becb
mov eax, dword [reloc.kernel32.dll_GetProcAddress]
mov dl, 0xd7
mov eax, 0xcbbaa497
mov esi, 0xc0a12276
cmc
not eax
push word [esp + 1]
jmp 0x16c8bf4
cld
pop dword [esp + 0x25]
mov ah, byte [esp + 0xb]
bsf dx, bp
dec edx
mov word [esp + 0x2a], dx
jmp 0x16c8c13
clc
sub esp, 0x19
cld
rdtsc
mov ebp, dword [esp + 9]
sub esp, 0x16
jmp 0x16c8c41
rcl ebx, 7
mov bx, dx
xchg dh, bl
pop word [esp + 0xe]
cpuid
lea edx, [ebp + 0xf4]
jmp 0x16c8ca3
mov byte [esp + 5], ch
xchg word [esp + 6], bx
add esp, 8
lea esi, reloc.kernel32.dll_GetProcAddress
push word [esp]
lea ecx, [ecx + edx]
jmp 0x16c8be1

Function at 0x16cb00d
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 3]
mov dword [esp], esp
call fcn.016cb087
pushfd
adc al, 0x8a
in eax, dx
sbb al, 0xc8
add eax, eax
cmp dword [edx], reloc.kernel32.dll_GetProcAddress
jmp 0x16caff7
mov dword [esp + 0xc], edi
jmp 0x16caff7
Function at 0x16cb087
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x16c90a1
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x16cb067
push eax
jmp 0x16cb029
call 0x16cb02e
jmp 0x16cb051
pushfd
push esp
push word [esp + 4]
push word [esp + 5]
push dword [esp + 5]
mov dword [esp + 0x10], esi
jmp 0x16cb00f
pop eax
jmp 0x16cb071
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x16cb022
sub eax, 0x12cb02e
jmp 0x16cb0c1
push word [esp + 3]
pushfd
lea esp, [esp + 2]
mov dword [esp + 4], ebp
jmp 0x16cb03b
push eax
jmp 0x16c8503