joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415c20
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x463064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [eax], SysReAllocStringLen
mov dword [eax + 4], 0
mov dword [ebp - 0x64], 0x40
push str.GlobalMemoryStatusEx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x415c93
lea ecx, [ebp - 0x64]
push ecx
call dword [ebp - 0x68]
test eax, eax
je 0x415c93
mov edx, dword [ebp - 0x58]
push edx
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
call fcn.00415b00
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
jmp 0x415cbd
mov dword [ebp - 0x24], 0x20
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00415ad0
xor edx, edx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00446b1d
mov esp, ebp
pop ebp
ret 4

Function at 0x42c180
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457368
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x463064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x98
call fcn.0042c280
mov ecx, dword [ebp - 0x14]
add ecx, 0x18
call fcn.0040d360
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call fcn.0040d3d0
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
call fcn.0040d3d0
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x14], 0
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 0x15], 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.0040dcf0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.0040df70
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.0040d1b0
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x60
call fcn.004137d0
movzx ecx, al
test ecx, ecx
jne 0x42c23c
mov dword [ebp - 0x18], 1
jmp 0x42c243
mov dword [ebp - 0x18], 0
mov dl, byte [ebp - 0x18]
mov byte [ebp - 0xd], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040d140
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x42c267
call fcn.00413d90
jmp 0x42c269
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x432ba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456460
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x463064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00430dc0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0042dcf0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.0040d140
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.0040d0b0
mov ecx, dword [ebp - 0x10]
call fcn.00432b10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x444ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x463064]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00448620
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
je 0x444f93
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.00445430
mov dword [ebp - 0x218], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.00446d7f
add esp, 4
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x214]
mov dword [ecx], edx
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00446b1d
mov esp, ebp
pop ebp
ret 8

Function at 0x445430
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x445462
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x445462
xor al, al
jmp 0x44547f
xor edx, edx
mov eax, dword [ebp - 4]
mov cl, 0x20
call fcn.00446b90
xor ecx, ecx
add eax, dword [ebp - 8]
adc edx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x44f6d9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45bb9c
push 0x45bb94
push str.FlsAlloc
push 0x1e
call fcn.0044f5b7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44f70d
push dword [ebp + 8]
mov ecx, esi
call dword [0x45825c]
call esi
jmp 0x44f713
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44f757
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45bbac
push 0x45bba4
push str.FlsGetValue
push 0x20
call fcn.0044f5b7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44f78e
push dword [ebp + 8]
mov ecx, esi
call dword [0x45825c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x450d68
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x450e05
push ebx
push esi
call fcn.00450d31
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0044f38a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x450db2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x450e04
push edi
push eax
call fcn.0044f077
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x450dd2
call fcn.0044f03d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x450e03
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0044f38a
add esp, 0x20
test eax, eax
jne 0x450df1
push edi
call fcn.0044f03d
jmp 0x450df9
push ebx
call fcn.0044f03d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x401040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, eax
xor ebx, ebx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ebx
mov ecx, dword [edx + 0x3c]
mov edi, dword [ecx + edx + 0x78]
mov ecx, dword [edi + edx + 0x20]
add edi, edx
add ecx, edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], ecx
mov eax, dword [edi + 0x1c]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x24]
add eax, edx
mov dword [ebp - 0x20], eax
cmp dword [edi + 0x14], ebx
jbe 0x4010f6
mov eax, edi
mov edi, dword [ecx + ebx*4]
add edi, edx
je 0x4010ed
push 0x32
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
add esp, 8
mov dword [ebp - 0x1c], eax
xor ecx, ecx
mov esi, 0x35
test eax, eax
je 0x4010e4
mov ebx, eax
nop word [eax + eax]
movsx edx, byte [edi + ecx]
inc ecx
imul eax, esi, 0x10f29f
add edx, eax
and edx, 0xffffff
add esi, edx
cmp ecx, ebx
jb 0x4010c0
mov ebx, dword [ebp - 0x18]
cmp esi, 0x544e304
je 0x401126
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, dword [eax + 0x14]
jb 0x401094
mov esi, dword [ebp - 8]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0
push 0
push 0
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040114c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
movzx eax, word [eax + ebx*2]
mov esi, dword [esi + eax*4]
add esi, dword [ebp - 0x10]
push esi
push 0x544e304
push edi
push str._s_:_0x_x_:__p_n
call fcn.00401010
add esp, 0x10
jmp 0x4010f9

Function at 0x4014ce
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x401503
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x401500
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x40150c
add edx, 0x28
cmp edx, esi
jne 0x4014ee
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x401509

Function at 0x40194b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40198a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40198a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40198a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40198a
cmp dword [ecx + 0x74], 0xe
jbe 0x40198a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x407ec0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp - 0x1e]
inc esi
or eax, dword [esi - 1]
pop ebx
cmp al, 0x2e
jne 0x417bb3
mov eax, dword [ebp + 0x18]
test dword [esi - 0x75], ebx
ret 0x8577
test eax, eax
sub dword [esi + edi*2 + 5], 0x6c230f5
xchg esp, eax
mov eax, ebx
mov ecx, 0x4b00000a
dec ebx
cdq
push ss
stc
test eax, eax
mov ecx, edx
jle 0x407ea9
inc ebp
into
and byte [esi - 9], 0xef
leave
mov al, 2
mov eax, edx
jle 0x407e88
pop ds
add edx, eax
sub al, 0x30
adc dword [esi], 0x30c18046
add cl, 0x30
mov byte [esi], cl
jmp 0x407e0c
push ebp
rcr ebp, 1
mov eax, dword [ebp + 0x1c]
sti
dec ebp
sbb byte [ebx - 0x7a0780ab], cl
jg 0x407ed8
push 0xffffffffffffff8e
push ecx
mov ecx, dword [ebp - 0x76]
scasd eax, dword es:[edi]
mov edx, dword [ebp + 0x50]
push ebp
push eax
push eax
pop esi
push edx
inc esp
push cs
test eax, 0xeb830000
rcr dword [ebp - 0x3d], cl
cmc
nop
mov dh, 0x90
nop
xchg esp, eax
nop
nop
not dword [ebp - 0x75]
loop 0x407e77
in al, dx
test dword [ebx + 0x7c4910c5], 0x1029c707
dec esi
add byte [eax], al
add byte [edi + 0x45], bh
or ah, bl
sbb eax, 0x40c230
mov ecx, dword [ebp + 0x18]
cmp ecx, dword [ebx + 0x3345205d]
not byte [edi - 0x21]
lds eax, [edi]
jne 0x407f18
inc edx
xor esi, esi
les eax, [0x40effb8b]
fld qword [ebp + 8]
fabs
fstp qword [ebp + 0x18]
mov dword [ecx], 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
pop ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
fstp qword [eax + 0x6c]
fld qword [ebp - 0x14]
fcomp qword [0xf265c230]
pop ss
xor dl, al
pop ss
les ecx, [edi + ebx*8]
loopne 0x407f4d
invalid
Function at 0x401258
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
call fcn.004011cc
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jne 0x401275
xor eax, eax
jmp 0x4012af
jmp loc.00415953
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4012b4
Capabilities:
Packed with generic packer

Disassembly:
add esp, 0xfffffff8
mov edx, dword [eax + 4]
mov dword [esp], edx
mov edx, dword [eax]
mov dword [esp + 4], edx
jmp loc.00413368

Function at 0x4012e8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, ecx
mov esi, eax
mov edi, esp
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [edx]
mov dword [ebx], eax
mov eax, dword [edx + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [esp + 4], eax
jmp loc.0041a027

Function at 0x401c40
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
mov ecx, esp
mov edx, dword [0x40c610]
mov dword [ecx], edx
jmp 0x401c66
jmp loc.00419180
mov edx, 0x40c610
cmp edx, dword [ecx]
jne 0x401c4e
mov dword [0x40c5b0], 3
xor eax, eax
mov dword [ecx], eax
mov eax, dword [ecx]
pop edx
pop ebx
ret

Function at 0x401ce4
Capabilities:
Packed with generic packer

Disassembly:
cmp edx, 0xc
jl 0x401cf7
jmp loc.00419b3d
cmp edx, 4
jl 0x401d06
mov ecx, edx
or ecx, 0x80000002
mov dword [eax], ecx
add eax, edx
and dword [eax], 0xfffffffe
ret

Function at 0x401f78
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [0x40c604], 0
jle 0x401fc1
cmp dword [0x40c604], 0xc
jge 0x401f96
mov dword [0x40c5b0], 7
jmp 0x401fc1
mov eax, dword [0x40c604]
or eax, 2
mov edx, dword [0x40c608]
mov dword [edx], eax
mov eax, dword [0x40c608]
add eax, 4
call fcn.00401cc0
xor eax, eax
mov dword [0x40c608], eax
xor eax, eax
jmp 0x415142
ret

Function at 0x40207c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
mov ecx, esp
lea edx, [esi + 4]
mov eax, ebx
jmp loc.0041afb4

Function at 0x4020b0
Capabilities:
Packed with generic packer

Disassembly:
push ecx
mov edx, esp
xor ecx, ecx
mov dword [edx], ecx
test eax, eax
jns 0x4020be
add eax, 3
sar eax, 2
jmp loc.0041a9c5

Function at 0x4020e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
lea esi, [esp + 8]
mov edi, 0x40c600
jmp loc.00414cbf

Function at 0x402884
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
mov ebx, eax
test ebx, ebx
jle 0x4028a6
mov eax, ebx
call dword [0x40b030]
mov dword [esp], eax
cmp dword [esp], 0
jne 0x4028ab
mov al, 1
call fcn.0040297c
jmp 0x4028ab
jmp 0x414d48
mov eax, dword [esp]
pop edx
pop ebx
ret

Function at 0x402b68
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004041ec
test esi, esi
jne 0x402b9f
jmp loc.00413041
jmp loc.00417e75
Function at 0x402ec8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x14c
call fcn.00403130
lea eax, [ebx + 0x14c]
mov dword [ebx + 0x14], eax
mov word [ebx + 4], 0xd7b0
xor eax, eax
mov al, byte [0x40b024]
mov word [ebx + 6], ax
mov dword [ebx + 8], 0x80
mov dword [ebx + 0x18], 0x402d1c
mov eax, esi
call fcn.00404464
push eax
mov eax, esi
call fcn.00404664
lea edx, [ebx + 0x48]
pop ecx
call fcn.004029c4
mov eax, esi
call fcn.00404464
jmp loc.0041a902

Function at 0x4030ac
Capabilities:
Packed with generic packer

Disassembly:
cmp word [eax + 4], 0xd7b1
jne 0x4030d1
mov edx, dword [eax + 0xc]
cmp edx, dword [eax + 0x10]
jae 0x4030d1
add edx, dword [eax + 0x14]
test word [eax + 6], 1
je 0x4030e0
jmp loc.0041876e
mov al, 1
ret
push eax
call fcn.004031a8
pop edx
cmp ah, 0x1a
je 0x4030ce
dec dword [edx + 0xc]
xor eax, eax
ret

Function at 0x4030e4
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov ebx, eax
or esi, 0xffffffff
mov ax, word [ebx + 4]
cmp ax, 0xd7b0
jbe 0x40311e
cmp ax, 0xd7b3
ja 0x40311e
push 0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
jne 0x403113
jmp loc.004148da
mov eax, esi
xor edx, edx
div dword [ebx + 8]
mov esi, eax
jmp fcn.00403128
mov eax, 0x67
jmp loc.0041438b

Function at 0x403150
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40b008], 0x8088405
inc edx
mov dword [ebx + 0x40b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4032a0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, edx
call fcn.004041ec
sub esp, 0x100
mov eax, ebx
mov edx, esp
mov ecx, 0xff
call fcn.00403294
mov eax, esi
mov edx, esp
call fcn.00404440
cmp byte [esp], 0xff
jne 0x403301
mov eax, ebx
mov edx, esp
mov ecx, 0xff
call fcn.00403294
mov edx, esp
push 0
mov eax, esp
jmp loc.00419ac5
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x403444
Capabilities:
Packed with generic packer

Disassembly:
mov cl, byte [0x40b00c]
and cl, 3
cmp cl, 2
jbe 0x403454
mov cl, 2
jmp loc.00416d13

Function at 0x4036b4
Capabilities:
Packed with generic packer

Disassembly:
cmp word [eax + 4], 0xd7b2
je 0x4036df
push eax
push edx
call fcn.004035a0
test al, al
pop edx
pop eax
jne 0x4036df
ret
push eax
push edx
call dword [eax + 0x1c]
test eax, eax
jne 0x4036d7
pop edx
pop eax
jmp 0x4036df
jmp loc.0041567b
mov ecx, dword [eax + 0xc]
cmp ecx, dword [eax + 8]
jge 0x4036ca
add ecx, dword [eax + 0x14]
mov byte [ecx], dl
inc dword [eax + 0xc]
ret

Function at 0x403728
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40b014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4037c0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4037a0
xor eax, eax
push ebp
push 0x403799
push dword fs:[eax]
mov dword fs:[eax], esp
jmp loc.00418384
mov ax, word [0x40b014]
jmp loc.0041a082
Function at 0x4037a0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40b014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4037c0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4037a0
xor eax, eax
push ebp
push 0x403799
push dword fs:[eax]
mov dword fs:[eax], esp
jmp loc.00418384
mov ax, word [0x40b014]
jmp loc.0041a082

Function at 0x403860
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je fcn.0040386b
mov dl, 1
jmp loc.0041843a

Function at 0x4039c8
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [0x40b018], 1
jbe fcn.004039e2
push 0
push 0
push 0
push 0xeedfadf
jmp loc.00414c38

Function at 0x403a20
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [0x40b018], 1
jbe 0x403a30
push eax
push ebx
jmp loc.00418b40
ret

Function at 0x403a98
Capabilities:
Packed with generic packer

Disassembly:
push eax
push edx
cmp byte [0x40b018], 1
jbe fcn.00403ab3
push esp
push 2
push 0
push 0xeedfae3
jmp loc.00418012

Function at 0x403eb0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0x40c620
mov eax, dword [edi + 8]
test eax, eax
je 0x403f19
mov esi, dword [eax]
xor ebx, ebx
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x403f05
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, ebx
jle 0x403efb
jmp loc.00415873
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x403f19
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x403fbc
Capabilities:
Packed with generic packer

Disassembly:
xor eax, eax
xchg dword [section.DATA], eax
neg eax
sbb eax, eax
inc eax
mov edi, 0x40c620
jmp loc.00416046

Function at 0x403fec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40c034], 0
je 0x40404d
cmp word [0x40c208], 0xd7b2
jne fcn.00404015
cmp dword [0x40c210], 0
jbe fcn.00404015
mov eax, 0x40c204
jmp loc.00414139
cmp byte [0x40b020], 0
jne fcn.00404069
push 0
push 0x40b078
push 0x40b080
push 0
jmp loc.00416b11

Function at 0x404164
Capabilities:
Packed with generic packer

Disassembly:
pop dword [0x40b004]
jmp loc.00414758

Function at 0x4041a8
Capabilities:
Create thread
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402884
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
jmp loc.00413e88

Function at 0x404284
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x404292
mov ecx, dword [edx - 8]
inc ecx
jle 0x404292
lock inc dword [edx - 8]
xchg dword [eax], edx
test edx, edx
je 0x4042ac
mov ecx, dword [edx - 8]
dec ecx
jl 0x4042ac
lock dec dword [edx - 8]
jne 0x4042ac
lea eax, [edx - 8]
jmp 0x4168f0
ret

Function at 0x4042b0
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
jle 0x4042d8
push eax
add eax, 0xa
and eax, 0xfffffffe
push eax
call fcn.00402884
pop edx
jmp loc.00413efa
xor eax, eax
ret
Function at 0x4042dc
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
mov eax, edi
jmp loc.00416636

Function at 0x40430c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push edx
push eax
mov eax, dword [ebp + 8]
push eax
push ecx
push 0
mov eax, dword [0x40c5a8]
push eax
jmp loc.00416167

Function at 0x404404
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
test edx, edx
je 0x404437
push edx
cmp cx, word [edx]
je 0x404430
cmp cx, word [edx + 2]
je 0x40442d
cmp cx, word [edx + 4]
je 0x40442a
cmp cx, word [edx + 6]
je 0x404427
add edx, 8
jmp 0x40440b
add edx, 2
add edx, 2
add edx, 2
mov ecx, edx
pop edx
sub ecx, edx
shr ecx, 1
jmp 0x4146bf

Function at 0x404664
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je 0x40466a
ret
jmp loc.0041909a

Function at 0x404704
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
call fcn.004046b4
mov edx, dword [ebx]
test edx, edx
je fcn.00404748
mov ecx, dword [edx - 4]
dec esi
jl fcn.00404748
cmp esi, ecx
jge fcn.00404748
test edi, edi
jle fcn.00404748
sub ecx, esi
cmp edi, ecx
jle 0x40472e
mov edi, ecx
sub ecx, edi
add edx, esi
lea eax, [edi + edx]
call fcn.004029c4
mov edx, dword [ebx]
mov eax, ebx
mov edx, dword [edx - 4]
sub edx, edi
jmp loc.00414ae2

Function at 0x40474c
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je 0x4047a6
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov edx, dword [edx]
push edx
test edx, edx
je 0x404764
mov edx, dword [edx - 4]
dec edi
jge 0x404769
xor edi, edi
cmp edi, edx
jle 0x40476f
mov edi, edx
mov ebp, dword [ebx - 4]
mov eax, esi
add edx, ebp
call fcn.004047f0
pop eax
cmp eax, ebx
jne 0x404782
mov ebx, dword [esi]
jmp 0x4157e8
ret

Function at 0x4047f0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
xor edi, edi
test edx, edx
jle 0x404845
mov eax, dword [ebx]
test eax, eax
je 0x404826
cmp dword [eax - 8], 1
jne 0x404826
sub eax, 8
add edx, 9
push eax
mov eax, esp
call fcn.004028d4
pop eax
add eax, 8
mov dword [ebx], eax
mov dword [eax - 4], esi
mov byte [esi + eax], 0
jmp 0x40484e
mov eax, edx
call fcn.004042b0
mov edi, eax
mov eax, dword [ebx]
test eax, eax
je 0x404845
mov edx, edi
mov ecx, dword [eax - 4]
cmp ecx, esi
jl 0x404840
mov ecx, esi
jmp 0x4189f5
mov eax, ebx
call fcn.004041ec
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret

Function at 0x4048cc
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
push ebx
mov cl, byte [edx + 1]
push esi
push edi
mov ebx, eax
lea esi, [ecx + edx + 0xa]
mov edi, dword [ecx + edx + 6]
jmp loc.0041753f