joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428a80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x3c], 0x58
mov dword [ebp - 0x28], 0x45
mov dword [ebp - 0x44], 0x57
mov dword [ebp - 0x48], 0x52
mov dword [ebp - 0x18], 0x50
mov dword [ebp - 0x4c], 0x52
mov dword [ebp - 0x38], 0x30
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x24], 0x59
mov dword [ebp - 0x54], 0xc
mov dword [ebp - 8], 0x16
mov dword [ebp - 0x34], 0x57
mov dword [ebp - 0x58], 0x63
mov dword [ebp - 0x30], 0x37
mov dword [ebp - 4], 0x40
mov dword [ebp - 0x2c], 0xd
mov dword [ebp - 0x40], 0x36
mov dword [ebp - 0x10], 0x1b
mov dword [ebp - 0x1c], 0xa
mov dword [ebp - 0xc], 0x4d
mov dword [ebp - 0x5c], 0x5a
mov dword [ebp - 0x60], 0x34
mov dword [ebp - 0x64], 0x23
mov dword [ebp - 0x20], 0x1d
cmp dword [ebp - 8], 0x17
jge 0x428b57
mov eax, dword [ebp - 0x20]
add eax, 0x3a
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x24], 0x55
jle 0x428b55
mov edx, dword [ebp - 0xc]
add edx, 0x48
mov dword [ebp - 0xc], edx
jmp 0x428b2e
cmp dword [ebp - 0x30], 2
je 0x428bae
cmp dword [ebp - 0x18], 0x4d
je 0x428bae
cmp dword [ebp - 0xc], 0x1b
je 0x428bae
cmp dword [ebp - 0x34], 1
jle 0x428bae
cmp dword [ebp - 0x10], 0xd
jle 0x428bae
cmp dword [ebp - 0x38], 0x11
jne 0x428bae
cmp dword [ebp - 0x24], 0x12
jne 0x428bae
cmp dword [ebp - 0x3c], 9
je 0x428bae
cmp dword [ebp - 0x28], 0x64
je 0x428bae
cmp dword [ebp - 0x40], 0x3b
je 0x428bae
cmp dword [ebp - 0x44], 9
jge 0x428bae
cmp dword [ebp - 0x2c], 0x56
jne 0x428bae
cmp dword [ebp + 8], 0x64
jne 0x428bae
mov eax, dword [ebp - 0x10]
xor eax, 0x2c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
jmp 0x428bc0
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x44
cmp dword [ebp - 0x14], edx
jge 0x428bdc
cmp dword [ebp - 8], 0x48
je 0x428bda
mov eax, dword [ebp - 4]
add eax, 0xc
mov dword [ebp - 4], eax
jmp 0x428bb7
cmp dword [ebp - 4], 0x4d
jge 0x428c0b
mov ecx, dword [ebp - 0x18]
sub ecx, 0x2e
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 0x1c], 0x30
jne 0x428c09
cmp dword [ebp - 0x2c], 8
je 0x428c09
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x428bdc
mov esp, ebp
pop ebp
ret
Function at 0x428da0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0xc], 0x48
mov dword [ebp - 0x2c], 0x27
mov dword [ebp - 0x10], 0xb
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x3c], 0x32
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x40], 0x1b
mov dword [ebp - 0x44], 0x19
mov dword [ebp - 4], 0x35
mov dword [ebp - 0x48], 0xc
mov dword [ebp - 0x1c], 0x4e
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x20], 0x52
mov dword [ebp - 0x50], 0x56
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x58], 0x5b
mov dword [ebp - 0x14], 0x4f
mov dword [ebp - 0x5c], 0x5b
cmp dword [ebp - 0x18], 0x61
jne 0x428e5b
cmp dword [ebp - 0x14], 0x27
je 0x428e55
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x1c], 8
jle 0x428e73
mov edx, dword [ebp - 0x10]
or edx, 0x14
mov dword [ebp - 0x10], edx
cmp dword [ebp - 4], 0x36
jl 0x428e40
mov dword [ebp - 8], 0
jmp 0x428e8b
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x51
cmp dword [ebp - 8], ecx
jge 0x428edd
cmp dword [ebp - 0x24], 0x50
jge 0x428edb
cmp dword [ebp - 0x28], 0x19
jge 0x428edb
cmp dword [ebp - 0x2c], 0x54
jge 0x428edb
cmp dword [ebp - 0x14], 0x42
jne 0x428edb
call dword [sym.imp.USER32.dll_EnableMenuItem]
cmp dword [ebp + 8], 0x19
jne 0x428edb
cmp dword [ebp + 0x18], 0x39
jne 0x428ed5
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [ebp + 8], 0x36
jle 0x428ed5
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x428e82
mov esp, ebp
pop ebp
ret
Function at 0x42c790
Capabilities:
Parse credit card information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 4], 0x41
mov dword [ebp - 0x34], 0x1e
mov dword [ebp - 0x58], 0x52
mov dword [ebp - 0x5c], 0x3f
mov dword [ebp - 0x50], 0x4d
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x20], 0x2f
mov dword [ebp - 8], 0x14
mov dword [ebp - 0x10], 0x46
mov dword [ebp - 0x24], 0x19
mov dword [ebp - 0x28], 0x4e
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x3c], 0x30
mov dword [ebp - 0x18], 0xd
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x14], 0x31
mov dword [ebp - 0x40], 0x23
mov dword [ebp - 0x44], 0x2b
mov dword [ebp - 0x1c], 0x24
mov dword [ebp - 0x54], 0x3a
mov dword [ebp - 0xc], 0x43
mov dword [ebp - 0x30], 0x1f
cmp dword [ebp - 4], 0x42
jge 0x42c88b
cmp dword [ebp - 0xc], 0x18
jne 0x42c85f
cmp dword [ebp - 0x44], 0xd
jne 0x42c85f
cmp dword [ebp - 0x14], 0x3d
jle 0x42c85f
mov dword [0x4f8794], 0x1d
mov eax, dword [0x4f8794]
and eax, 0x16
mov dword [0x4f8794], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 0xa
jge 0x42c889
cmp dword [ebp - 8], 0xd
jle 0x42c889
cmp dword [ebp - 0x10], 0x5f
je 0x42c889
cmp dword [ebp - 0x48], 0x38
je 0x42c889
mov edx, dword [ebp - 0x1c]
sub edx, 0x43
mov dword [ebp - 0x1c], edx
jmp 0x42c830
mov dword [0x4f8790], 0x4f
cmp dword [0x4f8790], 0x50
jge 0x42c8d3
cmp dword [ebp - 4], 0x37
jne 0x42c8ad
mov eax, dword [ebp - 0x2c]
and eax, 0x16
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x4f8790]
add ecx, 1
mov dword [0x4f8790], ecx
cmp dword [ebp - 0x24], 0x4a
jge 0x42c8d1
cmp dword [ebp - 0x18], 0x40
jle 0x42c8d1
mov edx, dword [ebp - 0x14]
and edx, 0x1a
mov dword [ebp - 0x14], edx
jmp 0x42c895
cmp dword [ebp - 8], 0x26
jne 0x42c90d
mov dword [0x4f8790], 0x64
cmp dword [0x4f8790], 0x4b
je 0x42c90d
cmp dword [ebp - 0x18], 0x53
jge 0x42c90d
cmp dword [ebp - 8], 0x25
jle 0x42c90d
cmp dword [ebp - 0x2c], 0x3d
jge 0x42c90d
cmp dword [ebp - 0x3c], 0x45
jge 0x42c90d
mov eax, dword [ebp - 0x18]
xor eax, 0x57
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0x20], 0x30
jl 0x42c8d3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x433001
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x77795cd5
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7af64f03
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x6472320
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x4a597193
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x403560
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
cmp dword [esi + 0x100ac], ebx
je 0x403620
cmp dword [esi + 0x7c], ebx
jbe 0x403620
mov eax, 0xffffff5c
sub eax, esi
lea edi, [esi + 0xa4]
mov dword [ebp - 4], eax
jmp 0x4035a0
movzx ecx, byte [edi]
mov eax, dword [esi + 0x100d0]
mov ebx, dword [esi + 0x100dc]
xor ecx, eax
mov edx, dword [esi + 0x100d8]
shr eax, 8
and ecx, 0xff
mov ecx, dword [ebx + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0x100d4]
mov dword [esi + 0x100d0], ecx
mov ecx, dword [esi + 0x100d8]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x100d4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [ebx + eax*4]
and edx, 0xfffd
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
mov dword [esi + 0x100d8], ecx
mov ecx, dword [ebp - 4]
shr eax, 8
xor byte [edi], al
inc edi
add ecx, edi
cmp ecx, dword [esi + 0x7c]
jb 0x4035a0
xor ebx, ebx
mov edi, dword [esi + 0x7c]
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x1c]
push edi
lea eax, [esi + 0xa4]
push eax
mov eax, dword [esi + 8]
push ecx
push edx
call eax
add esp, 0x10
cmp eax, edi
je 0x403644
or eax, 0xffffffff
jmp 0x403647
mov eax, dword [ebp - 8]
add dword [esi + 0x100c0], edi
mov ecx, dword [esi + 0x48]
pop edi
adc dword [esi + 0x100c4], ebx
add dword [esi + 0x100c8], ecx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x7c], ebx
adc dword [esi + 0x100cc], ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404d80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x404d8b
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.00404da0
Function at 0x4053d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x502ae0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
test ebx, ebx
jle 0x405560
mov edx, 1
mov dword [ebp - 0x84], 0xedb88320
mov ecx, edx
mov dword [ebp + ecx*4 - 0x84], edx
inc ecx
add edx, edx
cmp ecx, 0x20
jl 0x405402
push esi
push edi
xor edi, edi
jmp 0x405420
mov ecx, dword [ebp + edi - 0x84]
xor esi, esi
lea edx, [ebp - 0x84]
test ecx, ecx
je 0x405441
test cl, 1
je 0x40543a
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x405433
mov dword [ebp + edi - 0x104], esi
add edi, 4
cmp edi, 0x80
jl 0x405420
xor edi, edi
jmp 0x405460
mov ecx, dword [ebp + edi - 0x104]
xor esi, esi
lea edx, [ebp - 0x104]
test ecx, ecx
je 0x405481
test cl, 1
je 0x40547a
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x405473
mov dword [ebp + edi - 0x84], esi
add edi, 4
cmp edi, 0x80
jl 0x405460
xor edi, edi
jmp 0x4054a0
mov ecx, dword [ebp + edi - 0x84]
xor esi, esi
lea edx, [ebp - 0x84]
test ecx, ecx
je 0x4054c1
test cl, 1
je 0x4054ba
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x4054b3
mov dword [ebp + edi - 0x104], esi
add edi, 4
cmp edi, 0x80
jl 0x4054a0
test bl, 1
je 0x4054f3
xor edx, edx
lea ecx, [ebp - 0x104]
test eax, eax
je 0x4054f1
test al, 1
je 0x4054ea
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x4054e4
mov eax, edx
sar ebx, 1
je 0x40555b
xor edi, edi
lea esp, [esp]
mov ecx, dword [ebp + edi - 0x104]
xor esi, esi
lea edx, [ebp - 0x104]
test ecx, ecx
je 0x405521
test cl, 1
je 0x40551a
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x405513
mov dword [ebp + edi - 0x84], esi
add edi, 4
cmp edi, 0x80
jl 0x405500
test bl, 1
je 0x405553
xor edx, edx
lea ecx, [ebp - 0x84]
test eax, eax
je 0x405551
test al, 1
je 0x40554a
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x405544
mov eax, edx
sar ebx, 1
jne 0x405493
xor eax, dword [ebp + 0xc]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0044d74d
mov esp, ebp
pop ebp
ret
Function at 0x406920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x406933
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x4069ad
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.0044cad0
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x406981
sub eax, edi
jmp 0x406983
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x406972
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x4069a0
sub eax, edi
jmp 0x4069a2
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x406991
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x406ad9
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jbe 0x4069d3
mov ebx, ecx
test ebx, ebx
je 0x406a26
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4069f5
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.004094d0
jmp 0x406a0e
cmp eax, 2
jne 0x406a14
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x406a07
xor eax, eax
jmp 0x406a11
mov edx, ebx
call fcn.00404da0
mov edx, dword [ebp - 8]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.0044cad0
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x406a4e
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x406a62
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x406930
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x406ad9
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x406aa8
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x406a89
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.0044d1b0
add esp, 0xc
add ebx, edi
pop edi
mov dword [esi + 0x16c0], ebx
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x406ad9
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x406ac2
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call fcn.0044d1b0
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4098a0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi]
mov edx, ecx
xor edx, eax
shr ecx, 8
and edx, 0xff
mov edx, dword [edi + edx*4]
xor edx, ecx
movzx ecx, dl
add ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [edi + ecx*4]
mov dword [esi + 8], edx
ret

Function at 0x4098e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, 0x34567890
mov dword [ecx], 0x12345678
mov dword [ecx + 4], 0x23456789
mov dword [ecx + 8], edi
mov dl, byte [eax]
test dl, dl
je 0x409950
push esi
mov esi, dword [ecx + 4]
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
and edx, 0xff
mov edx, dword [ebx + edx*4]
shr eax, 8
xor edx, eax
movzx eax, dl
add esi, eax
mov eax, dword [ebp + 8]
imul esi, esi, 0x8088405
mov dword [ecx], edx
inc esi
mov edx, esi
shr edx, 0x18
xor edx, edi
and edx, 0xff
shr edi, 8
mov dword [ecx + 4], esi
xor edi, dword [ebx + edx*4]
inc eax
mov dword [ecx + 8], edi
mov dl, byte [eax]
mov dword [ebp + 8], eax
test dl, dl
jne 0x409906
pop esi
pop edi
pop ebp
ret
Function at 0x4108de
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x10]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 4]
or ecx, 1
push ecx
xor edi, edi
push edi
push eax
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esi], eax
cmp eax, edi
je 0x41091b
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040f083
mov eax, edi
pop edi
pop esi
leave
ret 4
push edi
push edi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov dword [esi], eax
cmp eax, edi
jne 0x410949
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 8]
jmp 0x410908
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410908

Function at 0x412518
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x818
mov eax, 0x4c65e6
call fcn.0044d7c5
mov esi, dword [ebp + 8]
and dword [ebp - 0x81c], 0
mov ebx, ecx
xor eax, eax
mov word [ebp - 0x810], ax
mov eax, dword [ebp + 0xc]
push ecx
xor edi, edi
inc edi
mov dword [ebp - 0x818], esp
add eax, 0xfffffff0
mov dword [ebp - 0x818], esp
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x820], edi
mov dword [ebp - 0x81c], 0x400
mov dword [ebp - 0x814], edi
call fcn.0040f61d
pop ecx
mov ecx, dword [ebp - 0x818]
add eax, 0x10
mov dword [ecx], eax
mov ecx, ebx
call fcn.004108de
mov dword [ebp - 0x820], eax
cmp eax, edi
je 0x4125ac
cmp eax, 2
je 0x4125ac
cmp eax, 7
je 0x4125ac
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.0040f61d
add eax, 0x10
pop ecx
mov dword [esi], eax
jmp 0x412626
mov eax, dword [ebx + 0x10]
lea ecx, [ebp - 0x824]
push ecx
mov ecx, dword [ebx + 4]
or ecx, 0x20019
push ecx
xor edi, edi
push edi
push eax
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebx], eax
cmp eax, edi
jne 0x412598
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x820]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebx], eax
cmp eax, edi
je 0x412604
mov dword [ebp - 0x814], edi
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x814], edi
je 0x412598
lea eax, [ebp - 0x810]
push eax
mov ecx, esi
call fcn.0041217e
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040f083
mov eax, esi
call fcn.0044d848
ret 0xc
Function at 0x412941
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0x18
mov eax, 0x4c66cb
call fcn.0044d75c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebp + 8]
xor eax, eax
inc eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], eax
mov byte [esi], bl
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, ebx
je 0x412a2c
push 4
lea eax, [ebp - 0x20]
push eax
push 2
push edi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push ebx
push 0x102
push ebx
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x412a23
mov esi, 0x100000
push esi
mov dword [ebp - 0x14], ebx
call fcn.0044a6f2
push esi
push ebx
push eax
mov dword [ebp - 0x10], eax
call fcn.0044d1b0
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0x10
jmp 0x4129f8
cmp dword [ebp - 0x14], ebx
jbe 0x412a09
push dword [ebp - 0x10]
call fcn.0044ca40
pop ecx
mov ecx, dword [ebp + 8]
push eax
push dword [ebp - 0x10]
call fcn.00411794
push esi
push ebx
push dword [ebp - 0x10]
call fcn.0044d1b0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x4129d1
cmp dword [ebp - 0x10], ebx
je 0x412a17
push dword [ebp - 0x10]
call fcn.0044d8a0
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, dword [ebp + 8]
push dword [ebp - 0x24]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040f083
mov eax, esi
call fcn.0044d834
ret
Function at 0x414c81
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x414ca7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x414ca7
test al, 0x10
jne 0x414ca7
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x414d14
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x414d70
cmp dword [ebp + 8], 0
je 0x414d70
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x414d70
push edi
lea edi, [esi + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [esi + 0x28]
push 0
push dword [esi + 8]
push dword [esi + 4]
call fcn.0044e558
push dword [esi + 4]
push 1
push ebx
push dword [ebp + 8]
call fcn.0044e454
add dword [esi + 8], ebx
add esp, 0x1c
dec dword [esi + 0x28]
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
pop edi
jmp 0x414d73
or eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret 8

Function at 0x414d79
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x414dcd
cmp dword [ebp + 8], ebx
je 0x414dcd
cmp dword [ebp + 0xc], ebx
jbe 0x414dcd
push edi
lea edi, [esi + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [esi + 0x28]
push ebx
push ebx
push dword [esi + 4]
call fcn.0044e558
push dword [esi + 4]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.0044e83b
add esp, 0x1c
dec dword [esi + 0x28]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
pop edi
jmp 0x414dd0
or eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret 8

Function at 0x414e0b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
xor edx, edx
pop esi
pop ebp
ret