joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406810
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x4069cc
cmp dword [edi + 0x18], 0
je 0x4069cc
cmp dword [edi + 0x7c], 0
je 0x406839
call fcn.00406cc0
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.004065a0
add esp, 8
test eax, eax
je 0x40685d
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.0040d08b
mov esi, eax
add esp, 4
test esi, esi
je 0x4068a0
push 0x4000
call fcn.0040d08b
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x4068ac
push esi
call fcn.0040d07b
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x406907
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.004055b0
test eax, eax
jne 0x406907
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x40692a
mov al, byte [edi + 0x39]
jmp 0x40692d
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x4069ad
nop dword [eax]
mov al, byte [ebx]
test al, al
je 0x4069ad
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x41f0c0]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x41f0c0]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x406960
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407420
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x423008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x407452
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407452
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x40753c
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x407471
cmp dx, 0x5c
jne 0x407473
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x407465
cmp edi, ebx
je 0x4074be
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.0040b150
add esp, 0xc
cmp edi, 0x208
jae 0x40754c
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.00407420
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x4074e3
lea ecx, [ebp - 0x20c]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4074d3
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x4074e5
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407500
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x40753c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00407dee
mov esp, ebp
pop ebp
ret
call fcn.00408229
int3
Function at 0x4078a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418b22
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x423008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x10], ecx
push 0x44c
call fcn.00407dff
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
push 0x44c
push 0
push esi
call fcn.00409800
add esp, 0xc
mov dword [esi], 0
lea edi, [esi + 0x244]
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x238], 0xffffffff
mov dword [esi + 0x23c], 0
push edi
push 0x104
mov dword [esi + 0x240], 0
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407940
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x407977
cmp eax, 0x2f
je 0x407977
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x407964
mov eax, dword [0x41ebac]
mov dword [edi], eax
push 0x20
call fcn.00407dff
mov ecx, dword [ebp - 0x10]
add esp, 4
mov dword [eax + 0x14], ecx
mov ecx, eax
mov word [eax], 0x100
mov byte [eax + 0x10], 0
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], 0
mov dword [eax + 0xc], 0
call fcn.00405ed0
mov dword [esi], eax
test eax, eax
jne 0x4079d4
push ecx
mov ecx, esi
mov dword [0x424414], 0x200
call fcn.00407a10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 8
mov dword [0x424414], 0
call fcn.00407dff
add esp, 4
mov dword [eax], 1
mov dword [eax + 4], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4140c0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
movzx edi, byte [ebp + 0x14]
shr ecx, 2
dec edi
mov dword [ebp - 4], ecx
or edi, 0xdfdfdfdf
lea ebx, [eax + ecx*4]
neg ecx
mov dword [ebp + 0x14], ebx
je 0x41417e
test bl, 3
jne 0x414129
jmp 0x414100
mov eax, dword [ebx + ecx*4]
and eax, edi
imul eax, eax, 0xcc9e2d51
ror eax, 0x11
imul eax, eax, 0x1b873593
xor edx, eax
ror edx, 0x13
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
add ecx, 1
jne 0x414100
jmp 0x41417e
lea esi, [ebx + 2]
mov ebx, dword [ebp - 4]
lea esi, [esi + ecx*4]
movzx ecx, byte [esi + 1]
lea esi, [esi + 4]
movzx eax, byte [esi - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl ecx, 8
or ecx, eax
and ecx, edi
imul eax, ecx, 0xcc9e2d51
ror eax, 0x11
imul eax, eax, 0x1b873593
xor edx, eax
ror edx, 0x13
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
sub ebx, 1
jne 0x414132
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov eax, esi
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x4141a4
sub eax, 1
je 0x41419b
sub eax, 1
jne 0x4141bc
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
movzx eax, byte [ebx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [ebx]
xor eax, ecx
and eax, edi
imul eax, eax, 0xcc9e2d51
ror eax, 0x11
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, esi
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x415126
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415165
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415165
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415165
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415165
cmp dword [ecx + 0x74], 0xe
jbe 0x415165
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x430770
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43079d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43079d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x64007272
Capabilities:
Contain obfuscated stackstrings

Disassembly:
idiv bh
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6400689c
add esp, 0xc
mov dword [ebp - 0x538], eax
inc dword [eax - 0x3eb5b]
inc dword [eax]
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
invalid
movsd dword es:[edi], dword [esi]

Function at 0x64007d75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
invalid
test edx, esp
clc
invalid

Function at 0x6400846d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
invalid
Function at 0x402440
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a24a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4e54fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov dword [esi], 0
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
lea eax, [edx + 2]
mov dword [ecx + 0x14], 0
mov dword [ebp - 0x18], eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4024a4
sub edx, dword [ebp - 0x18]
sar edx, 1
push edx
push edi
call fcn.00402a10
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
push eax
mov dword [ebp - 0x18], eax
call fcn.0047df9a
push dword [ebp - 0x18]
mov edi, eax
push 0
push edi
call fcn.0047f8f0
lea eax, [ebp - 0x24]
add esp, 0x10
cmp esi, eax
je 0x4024f5
mov eax, dword [esi]
mov dword [esi], edi
test eax, eax
je 0x4024fe
push eax
jmp 0x4024f6
push edi
call fcn.0047dfa3
add esp, 4
push dword [esi]
push dword [ebp - 0x18]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x402523
mov ecx, dword [esi]
mov dword [esi], eax
test ecx, ecx
je 0x402523
push ecx
call fcn.0047dfa3
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret 4

Function at 0x4069d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406a2b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406a2b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x406a1a
cmp esi, edx
jae 0x406a2b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x406a08
cmp esi, edx
jae 0x406a2b
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x406fd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4e54fc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4e6108], 0
jne 0x407028
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407007
sub eax, edx
mov ecx, 0x4e60f8
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00402740
mov ecx, dword [ebp - 4]
mov eax, 0x4e60f8
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret
Function at 0x407040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4e54fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4ff8c4]
cmp eax, dword [ecx + 0xc]
jg 0x40711e
cmp dword [0x4e5fa8], 0
jne 0x40710b
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4c5b28
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x4070bc
mov edx, dword [ebp - 8]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407096
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x4e5f98
call fcn.00402740
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x4070fb
call fcn.00406e40
cmp dword [eax + 0x14], 8
jb 0x4070c9
mov eax, dword [eax]
movzx eax, word [eax]
lea edx, [eax*2 + str.:programdata]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4070e0
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x4e5f98
call fcn.00402740
push str.MicrosoftWindows_Defender_
mov ecx, 0x4e5f98
call fcn.00405be0
pop esi
mov ecx, dword [ebp - 4]
mov eax, 0x4e5f98
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret
push 0x4ff8c4
call fcn.0047df05
add esp, 4
cmp dword [0x4ff8c4], 0xffffffff
jne 0x407069
push 0x4b2520
call fcn.0047de74
push 0x4ff8c4
call fcn.0047deb4
add esp, 8
jmp 0x407069

Function at 0x407160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4e54fc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4e60f0], 0
jne 0x4071e9
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4c5b38
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x4071d8
mov edx, dword [ebp - 8]
mov ecx, edx
push esi
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4071a0
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x4e60e0
call fcn.00402740
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop esi
mov eax, 0x4e60e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret
push 1
push 0x4c6054
mov ecx, 0x4e60e0
call fcn.00402740
mov ecx, dword [ebp - 4]
mov eax, 0x4e60e0
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret

Function at 0x407200
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4e54fc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4e60d8], 0
jne 0x407289
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4c5b18
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x407278
mov edx, dword [ebp - 8]
mov ecx, edx
push esi
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407240
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x4e60c8
call fcn.00402740
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop esi
mov eax, 0x4e60c8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret
push 1
push 0x4c6054
mov ecx, 0x4e60c8
call fcn.00402740
mov ecx, dword [ebp - 4]
mov eax, 0x4e60c8
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret
Function at 0x4097c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4e54fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x4097fb
cmp dword [edi], 2
jae 0x4097fb
pop edi
mov eax, 0x7a
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40986d
cmp dword [ebp - 8], 7
jne 0x409868
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x409850
test cl, 1
jne 0x409868
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x409868
cmp word [esi + eax*2 - 2], 0
jne 0x409868
cmp eax, 1
jbe 0x409850
cmp word [esi + eax*2 - 4], 0
jne 0x409868
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xd
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047df69
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40f8f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4e54fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f97b
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x40f93d
cmp eax, 2
jne 0x40f959
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x40f975
test ecx, ecx
je 0x40f970
test cl, 1
jne 0x40f959
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x40f975
pop edi
mov eax, 0xd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047df69
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4180e0
Capabilities:
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a43a5
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4e54fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], edx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x800000
push 0
push 0
push 0
push ecx
push str.POST
push dword [0x4fd900]
mov dword [ebp - 0x4c], eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edi, eax
test edi, edi
jne 0x418145
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x418299
lea eax, [ebp - 0x20]
mov dword [ebp - 0x38], 1
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], 3
push eax
push str.https:__www.virustotal.com
push dword [0x4fd904]
mov dword [ebp - 0x24], 1
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x418186
push 0xc
lea eax, [ebp - 0x20]
push eax
push 0x26
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [esi + 0x14], 8
mov ebx, dword [esi + 0x10]
jb 0x418191
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x14]
call fcn.00419710
push 0
push ebx
push ebx
push dword [eax]
push 0
push dword [ebp - 0x40]
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x4181c1
push 0
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov byte [ebp - 0x39], 0
test eax, eax
jne 0x4181c5
mov byte [ebp - 0x39], 1
mov edx, dword [ebp - 0x14]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4181e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x39], 0
je 0x4181f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x418290
mov dword [ebp - 4], 0
call fcn.00406d20
mov ecx, eax
test ecx, ecx
je 0x4182b5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 4], 1
mov ecx, edi
call fcn.004166b0
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x44]
push esi
mov dword [ebp - 0x40], eax
call fcn.00419690
mov byte [ebp - 4], 2
mov ecx, dword [eax]
mov edx, ecx
lea eax, [edx + 2]
mov dword [ebp - 0x48], eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x418244
sub edx, dword [ebp - 0x48]
sar edx, 1
push edx
push ecx
mov ecx, dword [ebp - 0x4c]
call fcn.00402740
mov edx, dword [ebp - 0x44]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418278
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41828d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x40]
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00406ac0
int3
Function at 0x41bc90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4e54fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x208], 0x100
push esi
push esi
lea eax, [ebp - 0x20c]
mov ebx, ecx
push eax
push esi
lea eax, [ebp - 0x208]
mov edi, edx
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x41bd69
test eax, eax
jne 0x41bd62
mov ecx, dword [edi + 0x24]
lea eax, [ebp - 0x204]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x210], eax
test ecx, ecx
je 0x41bd7c
mov eax, dword [ecx]
lea edx, [ebp - 0x214]
push edx
lea edx, [ebp - 0x210]
push edx
push ebx
call dword [eax + 8]
push 0
push 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x208], 0x100
push eax
push 0
lea eax, [ebp - 0x208]
inc esi
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x41bce2
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047df69
mov esp, ebp
pop ebp
ret
call fcn.0047c562
int3