joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x88]
cmp edi, dword [0x404018]
jne 0x401290
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
cmp edi, 2
ja 0x40146e
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
mov dword [esp + 0x50], 0xf400
mov dword [esp + 0x54], 0x15c
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x68], 0xff00
mov dword [esp + 0x6c], 0x95
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x14], 0xa
jmp 0x401327
mov edi, dword [esp + 0x88]
sub dword [esp + 0x14], 1
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push 0x403154
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40135f
push 0x12c
mov edi, 1
call ebp
jmp 0x401439
cmp dword [esp + 0x8c], ebx
je 0x4013d2
cmp dword [0x40451c], ebx
jne 0x4013d2
movzx eax, word [0x404520]
shl eax, 0x10
xor ecx, ecx
cmp edi, 2
sete cl
add ecx, 1
or eax, ecx
mov dword [esp + 0x58], eax
xor eax, eax
cmp esi, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
je 0x401422
push ebx
lea edx, [esp + 0x1c]
push edx
push 0x18
lea eax, [esp + 0x2c]
push eax
push 0x18
lea ecx, [esp + 0x64]
push ecx
push 0x222880
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
setne al
cmp al, bl
je 0x401422
cmp edi, 2
je 0x401452
xor eax, eax
cmp esi, ebx
mov dword [esp + 0x70], edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
je 0x401422
push ebx
lea edx, [esp + 0x20]
push edx
push 0x18
lea eax, [esp + 0x44]
push eax
push 0x18
lea ecx, [esp + 0x7c]
push ecx
push 0x222880
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
setne al
cmp al, bl
jne 0x401452
push 0x12c
mov edi, 3
call ebp
cmp esi, ebx
je 0x401439
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], ebx
jne 0x401320
xor eax, eax
cmp edi, ebx
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
xor edi, edi
cmp esi, ebx
je 0x40145f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp edi, ebx
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x74
ret
Function at 0x401770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push esi
call fcn.00401480
call entry0
lea eax, [esp + 4]
push eax
push str.SoftwareToshibaFlashCardsKBB
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40180c
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.StoredMode
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40180c
mov eax, dword [esp + 0xc]
movzx ecx, ax
shr eax, 0x10
cmp dword [0x404510], 0
mov esi, eax
je 0x4017f7
cmp ecx, 2
ja 0x4017f7
push 0
push ecx
call fcn.00401270
add esp, 8
cmp dword [0x404514], 0
je 0x401815
cmp esi, 1
ja 0x40180c
mov eax, esi
call fcn.004015c0
cmp dword [0x404514], 0
jne 0x401825
cmp dword [0x404510], 0
jne 0x401825
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401b70
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push esi
call fcn.00401480
call entry0
push 0
call fcn.00401af0
push eax
mov eax, dword [0x40453c]
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
push 0
push 0
push str.SoftwareToshibaFlashCardsKBB
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [esp + 8]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x401bcc
push eax
call esi
lea eax, [esp + 8]
push eax
push str.SoftwareToshibaFlashCardsKBB
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x401c33
cmp dword [0x404510], eax
mov dword [esp + 4], eax
je 0x401bfb
mov ecx, dword [0x404018]
mov dword [esp + 4], ecx
cmp dword [0x404514], 0
je 0x401c11
mov edx, dword [0x40401c]
shl edx, 0x10
or dword [esp + 4], edx
mov ecx, dword [esp + 8]
push 4
lea eax, [esp + 8]
push eax
push 4
push 0
push str.StoredMode
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
call esi
pop esi
add esp, 0xc
ret
Function at 0x401231
Capabilities:
Enumerate files on windows
Get common file path
Get graphical window text

Disassembly:
push ecx
push edx
jmp 0x40134b
mov dword [esp + 0x490], 8
lea eax, [esp + 0x49c]
mov dword [esp + 0x494], eax
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0x4c4]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [esp + 0x4ac], eax
mov dword [esp + 0x458], edx
mov dword [esp + 0x464], 6
mov dword [esp + 0x46c], edx
mov dword [esp + 0x468], edx
xor edi, edi
mov dword [esp + 0x498], edi
push 0x100
lea eax, [esp + 0x34c]
push eax
mov eax, dword [esp + 0x4b8]
push eax
call dword [sym.imp.USER32.DLL_GetWindowTextW]
call dword [sym.imp.USER32.DLL_GetDesktopWindow]
mov dword [esp + 0x4b4], eax
lea eax, [esp + 0x208]
push eax
mov eax, dword [esp + 0x4b0]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
push 5
mov eax, dword [esp + 0x4b8]
push eax
call dword [sym.imp.USER32.DLL_GetWindow]
push 0x7f00
push ecx
call dword [sym.imp.USER32.DLL_LoadCursorW]
mov dword [esp + 0x460], eax
lea eax, [esp + 0x480]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov eax, dword [esp + 0x4ac]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
push 0x7f00
push 0
call dword [sym.imp.USER32.DLL_LoadIconW]
mov dword [esp + 0x45c], eax
lea eax, [esp + 0x4a8]
push eax
mov eax, dword [esp + 0x4b4]
push eax
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
lea eax, [esp + 0x448]
push eax
jmp 0x4013d2
push edi
sub esp, 0x4c4
xor eax, eax
mov dword [esp + 0x4b0], eax
mov edx, dword [esp + 0x4b0]
lea eax, [esp + 0x470]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov eax, dword [esp + 0x4b0]
mov word [esp + 0x480], ax
mov dword [esp + 0x448], edx
xor ecx, ecx
mov dword [esp + 0x44c], ecx
mov eax, dword [esp + 0x4b0]
mov dword [esp + 0x49c], eax
mov eax, dword [esp + 0x4b0]
mov dword [esp + 0x4a0], eax
mov al, byte [esp + 0x4b0]
mov byte [esp + 0x4c0], al
jmp 0x401238
call dword [sym.imp.USER32.DLL_RegisterClassW]
push edi
push edi
push 3
lea eax, [esp + 0x49c]
push eax
push edi
push 0x80000000
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esp + 0x4b8], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp + 0x4bc], eax
mov eax, dword [esp + 0x4b8]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x4bc]
sub eax, 0x519
mov dword [esp + 0x4a4], eax
mov eax, dword [esp + 0x4a4]
add esp, 0x4c4
pop edi
pop edx
pop ecx
ret
Function at 0x401666
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov eax, dword [0x404050]
or al, 1
imul eax, esi
mov edx, dword [0x404050]
mov ebx, esi
sub edx, eax
mov eax, 0x404054
call fcn.004015d7
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x403111
push eax
sub edi, fcn.004028ab
push edi
push fcn.004028ab
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40172c
mov eax, fcn.004028ab
mov ebx, esi
jmp 0x401714
mov edx, edi
call fcn.004015d7
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.00402644
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 0
call fcn.00402354
lea eax, [esi + 0x1c000]
mov ebx, 0x404054
mov cl, al
mov edi, esi
or bl, 1
shl edi, cl
xor edx, edx
add edi, eax
mov eax, esi
div ebx
lea ebx, [ebp - 2]
add eax, 0x404054
mov edx, edi
call fcn.004028ab
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x41ecdc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00415fe2
and dword [ebp - 0x14], 0
cmp dword [0x46c070], 0
mov dword [ebp - 0x18], eax
jne 0x41ed8f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41ee37
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41ee37
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46c070], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46c074], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46c078], eax
call edi
push eax
call esi
mov dword [0x46c080], eax
test eax, eax
je 0x41ed8f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46c07c], eax
mov eax, dword [0x46c07c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ede8
cmp dword [0x46c080], ecx
je 0x41ede8
push eax
call esi
push dword [0x46c080]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ede8
test ebx, ebx
je 0x41ede8
call edi
test eax, eax
je 0x41eddf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41eddf
test byte [ebp - 8], 1
jne 0x41ede8
or dword [ebp + 0x10], 0x200000
jmp 0x41ee1b
mov eax, dword [0x46c074]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41ee1b
mov eax, dword [0x46c078]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46c070]
call esi
test eax, eax
je 0x41ee37
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41ee39
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041071c
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp + 8]
mov dword [0x4054bc], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov eax, dword [0x4054bc]
mov esi, dword [sym.imp.USER32.dll_LoadImageW]
push 0x8040
push 0
push 0
push 1
push 0x65
push eax
mov dword [esp + 0x48], 0x30
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0x401020
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0x1e
mov dword [esp + 0x5c], eax
call esi
push 0x8000
push 0
push 0
push 2
push 0x7f00
push 0
mov dword [esp + 0x60], eax
call esi
push 0
push 0x10
push 0x10
push 1
push 0x65
push dword [0x4054bc]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], 0x10
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], str.Win32_Dialog_Application
call esi
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x401d47
push 0x10
push str.Error
push str.Error_registering_main_window_class.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push 0
push 0x68
push dword [0x4054bc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov ebx, eax
push 0x3e8
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push 0
push 0
push 0x402
push edi
call esi
push 0x500000
push 0
push 0x401
push edi
call esi
test ebx, ebx
jne 0x401dae
push 0x10
push str.Error
push str.Error_creating_main_window.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x14]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x401e13
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
nop dword [eax]
lea eax, [esp + 0x14]
push eax
push ebx
call edi
test eax, eax
jne 0x401e02
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jg 0x401de0
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4027e0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40281f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40281f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40281f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40281f
cmp dword [ecx + 0x74], 0xe
jbe 0x40281f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x494400
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
xor eax, eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push esi
mov esi, dword [esp + 0x18]
push edi
lea edi, [esi + 8]
mov ecx, eax
inc eax
push ecx
mov dword [esp + 0x10], eax
call ebx
mov dword [edi], eax
mov eax, dword [esp + 0xc]
add edi, 4
cmp eax, 0x1f
jl 0x494415
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea eax, [esi + 0x84]
push 0
push eax
push 0x18
push 0x32
mov dword [eax], 0x18
call edi
lea eax, [esi + 0x9c]
push 0
push eax
push 0x1c
push 0x36
mov dword [eax], 0x1c
call edi
lea eax, [esi + 0xb8]
push 0
push eax
push 8
push 0x3a
mov dword [eax], 8
call edi
lea eax, [esi + 0xc0]
push 0
push eax
push 8
push 0x34
mov dword [eax], 8
call edi
lea eax, [esi + 0xc8]
push 0
push eax
push 0x30
push 0x40
mov dword [eax], 0x30
call edi
lea eax, [esi + 0xf8]
push 0
push eax
push 0xc
push 0x3c
mov dword [eax], 0xc
call edi
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x46
call ebx
mov dword [esi + 0x104], eax
lea eax, [esi + 0x108]
push 0
push eax
push 0
push 0x44
call edi
push 0x17
call ebx
lea ecx, [esi + 0x110]
push 0
push ecx
push 0
push 0x5e
mov dword [esi + 0x10c], eax
call edi
lea edx, [esi + 0x114]
push 0
push edx
push 0
push 0x70
call edi
lea eax, [esi + 0x178]
push 0
push eax
push 0
push 0x2006
call edi
lea ecx, [esp + 0x10]
mov dword [esi + 0x11c], 0
push ecx
push 0x20019
push 0
push str.Control_PanelAppearanceNew_Schemes
push 0x80000001
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call ebx
test eax, eax
jne 0x4945e6
lea edx, [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edi, [esi + 0x1188]
push edx
push edi
push eax
mov word [edi], ax
push eax
mov eax, dword [esp + 0x24]
push str.SelectedStyle
push eax
mov dword [esp + 0x28], 0x28
call ebp
test eax, eax
jne 0x4945da
cmp dword [esp + 0x10], 2
jbe 0x4945da
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
push edi
push edx
call ebx
test eax, eax
jne 0x4945da
mov edx, dword [esp + 0x18]
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push 0
push str.SelectedSize
push edx
mov dword [esp + 0x28], 0x28
call ebp
cmp word [esp + 0x20], 0
je 0x4945c6
cmp dword [esp + 0x10], 2
jbe 0x4945c6
mov eax, 0xfffffffe
jmp 0x4945c9
or eax, 0xffffffff
mov dword [esi + 0x11b0], eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4e8054
Capabilities:
Encode data using xor

Disassembly:
dec edi
xchg dword [esi + 0xd8afd02], edi
sal byte [eax], cl
test al, 0x3e
sub ch, dh
xorps xmm7, xmmword [esi]
out dx, eax
dec esp
mov ebx, 0xe874ce4e
dec esi
mov dword [0xb74f7396], eax
repe cmpsd dword [esi], dword es:[edi]
jg 0x4e80e5
aad 0x98
and al, byte [esi]
cld
adc dword [edx + 0x2e], ebp
aaa
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
mov edx, 0xf21be23a
mov al, dh
scasd eax, dword es:[edi]
mov al, 0x2f
xchg esi, eax
inc byte [eax]
das
pop ebx
cdq
lds ebp, [ebp - 0x166e3fce]
salc
add eax, 0x47d63143
inc edi
xor eax, 0x2ee92bf1
lds edx, [esi + 0xa1ee29e]
push cs
dec esp
jno 0x4e80ff
mov bl, 0x5b
das
or byte [esi], ch
jbe 0x4e809c
dec edx
xchg edx, eax
invalid
in eax, 0x5e
mov al, byte [0x9580d56d]
mov cl, 0xd6
fisub word [ecx + 0x2f12295a]
cdq
ret
push esi
sub byte [esi - 0x4b8dbea7], dh
xchg dword [ebx], edi
or byte [esi + 0xc], al
lds ecx, [esi + edx*4 + 0x15a8034a]
retf

Function at 0x44305f
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0x2bd46
push section.packerBY
push 0x4434e3
call fcn.004434a8
cld
mov esi, 0x414000
mov ecx, 4
sub ecx, esi
cmp esi, 0x440290
ja 0x4430a7
lodsb al, byte [esi]
add al, 0x18
sub al, 2
jb 0x44309d
cmp al, 0x25
jne 0x443081
mov al, byte [esi]
and al, 0xf0
cmp al, 0x80
jne 0x443081
inc esi
lea edi, [esi + ecx]
sub dword [esi], edi
add esi, 4
jmp 0x443081
mov edx, 0x400000
lea esi, [edx + 0x4120c]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x44310a
add eax, edx
mov edi, dword [esi + 0x10]
mov ebx, dword [esi]
test ebx, ebx
jne 0x4430c6
mov ebx, edi
add ebx, edx
add edi, edx
push edx
push edi
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
pop edi
pop edx
test eax, eax
je 0x443108
mov ecx, eax
mov eax, dword [ebx]
test eax, eax
je 0x443103
btr eax, 0x1f
jb 0x4430eb
lea eax, [eax + edx + 2]
push ecx
push edx
push edi
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
pop edi
pop edx
pop ecx
test eax, eax
je 0x443108
stosd dword es:[edi], eax
add ebx, 4
jmp 0x4430db
add esi, 0x14
jmp 0x4430b2
popal
ret
popal
jmp 0x440130

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x7e7021
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x35d6254e
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x411277
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x488090], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x4876c0
jne 0x411297
push 0
call 0x451931
pop ecx
call fcn.00411238
mov dword [0x475c94], 0x270
mov dword [0x4876bc], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x4112b6
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x4112ec
mov edx, dword [0x4876c0]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x411346
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x475c94]
jne 0x411353
call fcn.00411277
mov eax, dword [0x4876bc]
mov ecx, dword [eax]
add dword [0x4876bc], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x41138a
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x475c94]
jne 0x411398
call fcn.00411277
mov eax, dword [0x4876bc]
mov eax, dword [eax]
add dword [0x4876bc], 4
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
test ecx, ecx
mov dword [esp], ecx
fild dword [esp]
jge 0x4113de
fadd qword [0x470318]
fmul qword [0x470310]
pop ecx
ret