joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4181a0
Capabilities:
Access peb ldr_data
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x454a28
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x46a630]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x46a630]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
lea esi, [esp + 8]
mov dword [esp + 0x30], 0
call fcn.00417e60
cmp dword [esp + 0x20], 0x10
mov ecx, dword [esp + 0xc]
jae 0x418204
lea ecx, [esp + 0xc]
call fcn.00417b80
push 0xc
push str.settings.dat
lea eax, [esp + 0x10]
call fcn.00418a00
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x418228
lea eax, [esp + 0xc]
push 0x45ec58
push eax
call fcn.004378a6
mov esi, eax
add esp, 8
test esi, esi
je 0x41827b
push 0x46ff98
mov dword [0x46ff98], 0x46434557
mov dword [0x46ffa0], 0x354
call fcn.004177b0
push esi
push 1
push 0x354
push 0x46ff98
mov word [0x46ffa4], ax
call fcn.00437599
push esi
call fcn.00437766
add esp, 0x14
cmp dword [esp + 0x20], 0x10
jb 0x41828f
mov eax, dword [esp + 0xc]
push eax
call fcn.0041902f
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004362fd
add esp, 0x2c
ret

Function at 0x41ec9b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x41ecde
call fcn.004225cb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41ecde
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41ecf9
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0041e855
test ebx, ebx
mov esi, eax
je 0x41ecf7
test edi, edi
je 0x41ecf7
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x41ff56
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x452f89
call fcn.0043979a
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.004225cb
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x41ffa1
call fcn.004225cb
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x41ffb2
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x41ffbf
or eax, 0xffffffff
jmp 0x42011b
mov ecx, esi
call fcn.0041fa86
mov dword [ebp - 0x14], eax
call fcn.0041bf73
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x42003d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x42003d
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x42003d
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.0041aa78
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x42003d
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x42003d
mov ecx, ebx
call fcn.0041eeff
test eax, eax
je 0x42003d
push 0
mov ecx, ebx
call fcn.0041ef1a
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0041db18
push dword [ebp - 0x14]
call fcn.0041becb
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0041fd5e
xor edi, edi
cmp eax, edi
je 0x42009a
test byte [esi + 0x3c], 0x10
je 0x420084
push 4
pop edi
mov ecx, esi
call fcn.0041ede6
test ax, 0x100
je 0x42007a
push 5
pop edi
push edi
mov ecx, esi
call fcn.0041b9f8
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x42009a
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041f0e9
or dword [ebp - 4], 0xffffffff
jmp 0x4200c5
cmp dword [ebp - 0x28], edi
je 0x4200d3
push 1
mov ecx, ebx
call fcn.0041ef1a
cmp dword [ebp - 0x2c], edi
je 0x4200e3
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x4200fc
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x4200fc
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0041fac0
cmp dword [esi + 0x58], edi
je 0x420118
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.0043983f
ret
Function at 0x4214aa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4214c0
mov edi, dword [esi + 0xc]
jmp 0x421500
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4214d9
call fcn.004227af
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4214ee
call fcn.004227af
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x421500
call fcn.004227af
call fcn.004225cb
cmp dword [eax + 0x3c], 0
je 0x421515
push edi
mov ecx, ebx
call fcn.00420486
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004213c4
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x421533
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x42153f
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x423c78
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x46a630]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0xc]
jne 0x423cb5
push 0x458460
push 4
push eax
call fcn.00439f04
push eax
call fcn.00419659
add esp, 0x10
jmp 0x423cc7
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x423d32
push edi
call fcn.00439b58
mov edi, dword [eax]
call fcn.00439b58
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00439afe
add esp, 0x18
mov ebx, eax
call fcn.00439b58
cmp dword [eax], 0
je 0x423d12
call fcn.00439b58
push dword [eax]
call fcn.00419680
pop ecx
jmp 0x423d19
call fcn.00439b58
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x423d32
cmp ebx, esi
jae 0x423d32
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x423d34
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004362fd
leave
ret
Function at 0x424d9f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x424de5
call fcn.004225cb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x424de5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x424e28
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x424e11
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x424e11
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x424e25
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x426924
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x426952
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x426970
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042688e
jmp 0x426970
mov eax, dword [esi + 0x14]
test eax, eax
je 0x426970
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0042688e
test edi, edi
mov eax, edi
jne 0x42695a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x46eb40]
test ecx, ecx
je 0x426a33
jmp 0x426923
ret 8

Function at 0x4362fd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46a630]
jne 0x436307
repz ret
jmp fcn.0043c7f8
Function at 0x4378b9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4378f6
cmp dword [ebp + 0x14], edi
je 0x4378f6
cmp ecx, edi
jne 0x4378fd
call fcn.00439b58
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004366b3
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x437911
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x437932
cmp ebx, 0xffffffff
je 0x437921
push ebx
push edi
push ecx
call fcn.00439310
add esp, 0xc
cmp esi, edi
je 0x4378de
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4378de
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x43794e
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x437955
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x437a46
test word [esi + 0xc], 0x10c
je 0x4379a9
mov eax, dword [esi + 4]
test eax, eax
je 0x4379a9
jl 0x437aa7
cmp ebx, eax
mov edi, ebx
jb 0x43797a
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x437a4e
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00436371
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x437a3e
cmp ebx, dword [ebp - 0xc]
jb 0x437a16
cmp dword [ebp - 0xc], 0
je 0x4379d3
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x4379c8
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4379cf
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4379de
mov eax, SysReAllocString
cmp ebx, eax
ja 0x4379de
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x437a7a
push eax
push dword [ebp - 8]
push esi
call fcn.004418cc
pop ecx
push eax
call fcn.004433e8
add esp, 0xc
test eax, eax
je 0x437ab9
cmp eax, 0xffffffff
je 0x437aa7
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x437a3e
push esi
call fcn.00442d07
cmp eax, 0xffffffff
pop ecx
je 0x437aab
cmp dword [ebp - 4], 0
je 0x437a7a
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x43795d
mov eax, dword [ebp + 0x14]
jmp 0x4378f8
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x437a65
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00439310
add esp, 0xc
call fcn.00439b58
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4378ee
cmp dword [ebp + 0xc], 0xffffffff
je 0x437a90
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00439310
add esp, 0xc
call fcn.00439b58
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4378ee
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4378f8
or dword [esi + 0xc], 0x10
jmp 0x437aab
Function at 0x43b517
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x46a7c0]
je 0x43b532
inc edi
cmp edi, 0x17
jb 0x43b523
cmp edi, 0x17
jae 0x43b6b2
push ebp
push 3
call fcn.00447153
cmp eax, 1
pop ecx
je 0x43b67e
push 3
call fcn.00447153
test eax, eax
pop ecx
jne 0x43b566
cmp dword [0x46a5c8], 1
je 0x43b67e
cmp ebx, 0xfc
je 0x43b6b1
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x46ec58
push ebp
call fcn.0043cc65
add esp, 0xc
test eax, eax
je 0x43b59c
push esi
push esi
push esi
push esi
push esi
call fcn.004365b7
add esp, 0x14
push 0x104
mov esi, 0x46ec71
push esi
push 0
mov byte [0x46ed75], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43b5e0
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0043cc65
add esp, 0xc
test eax, eax
je 0x43b5e0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004365b7
add esp, 0x14
push esi
call fcn.0043ccd0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x43b625
push esi
call fcn.0043ccd0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x46ef6c
push 0x45a4bc
sub ecx, eax
push ecx
push eax
call fcn.004470a0
add esp, 0x14
test eax, eax
je 0x43b625
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004365b7
add esp, 0x14
jmp 0x43b627
xor esi, esi
push 0x45a4b8
push ebx
push ebp
call fcn.0044702f
add esp, 0xc
test eax, eax
je 0x43b647
push esi
push esi
push esi
push esi
push esi
call fcn.004365b7
add esp, 0x14
push dword [edi*8 + 0x46a7c4]
push ebx
push ebp
call fcn.0044702f
add esp, 0xc
test eax, eax
je 0x43b669
push esi
push esi
push esi
push esi
push esi
call fcn.004365b7
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00446e72
add esp, 0xc
jmp 0x43b6b1
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x43b6b1
cmp ebp, 0xffffffff
je 0x43b6b1
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x46a7c4]
push dword [esi]
call fcn.0043ccd0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x446e72
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043c0c8
xor ebx, ebx
cmp dword [0x46f758], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x446f48
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x447028
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x447028
push eax
call fcn.0043c05a
mov dword [esp], 0x45a81c
push edi
mov dword [0x46f758], eax
call esi
push eax
call fcn.0043c05a
mov dword [esp], 0x45a808
push edi
mov dword [0x46f75c], eax
call esi
push eax
call fcn.0043c05a
mov dword [0x46f760], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043a019
test eax, eax
pop ecx
pop ecx
je 0x446f16
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004365b7
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x446f48
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043c05a
cmp eax, ebx
pop ecx
mov dword [0x46f768], eax
je 0x446f48
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043c05a
pop ecx
mov dword [0x46f764], eax
mov eax, dword [0x46f764]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x446fcd
cmp dword [0x46f768], ecx
je 0x446fcd
push eax
call fcn.0043c0d1
push dword [0x46f768]
mov esi, eax
call fcn.0043c0d1
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x446fcd
cmp edi, ebx
je 0x446fcd
call esi
cmp eax, ebx
je 0x446f9a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x446f9a
test byte [ebp - 0x18], 1
jne 0x446fcd
lea eax, [ebp - 0x10]
push eax
call fcn.0043a050
test eax, eax
pop ecx
je 0x446fb5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004365b7
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x446fc4
or dword [ebp + 0x10], 0x200000
jmp 0x447008
or dword [ebp + 0x10], 0x40000
jmp 0x447008
mov eax, dword [0x46f75c]
cmp eax, dword [ebp - 8]
je 0x447008
push eax
call fcn.0043c0d1
cmp eax, ebx
pop ecx
je 0x447008
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x447008
mov eax, dword [0x46f760]
cmp eax, dword [ebp - 8]
je 0x447008
push eax
call fcn.0043c0d1
cmp eax, ebx
pop ecx
je 0x447008
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46f758]
call fcn.0043c0d1
cmp eax, ebx
pop ecx
je 0x447028
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44702a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x450716
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45076e
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x45ec20
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x450761
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x450770
xor eax, eax
pop esi
leave
ret 4

Function at 0x452514
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x46a630]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004524a9
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00439310
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x452563
cmp dword [ebp - 0x1c], 5
jb 0x45257b
jmp 0x452577
cmp dword [ebp - 0x10], 1
jne 0x45257b
cmp dword [ebp - 0x1c], 4
ja 0x452577
jne 0x45257b
cmp dword [ebp - 0x18], 0
jbe 0x45257b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x45d07c
call fcn.0045239a
test eax, eax
jge 0x45259c
mov byte [0x46fa90], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004362fd
add ebp, 0x78
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x20ba2424
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x498b1825
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4052a1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
push 0x40
push 0
push esi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
jne 0x4052bf
xor eax, eax
inc eax
jmp 0x40534a
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x405347
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x405347
push dword [ebp + 0xc]
lea edi, [esi + 0x40]
push 0xf8
push eax
push edi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
je 0x4052b7
cmp dword [edi], 0x4550
jne 0x405347
mov eax, 0x10b
cmp word [esi + 0x58], ax
jne 0x405347
movzx eax, word [esi + 0x46]
test ax, ax
je 0x405347
mov edi, eax
imul edi, edi, 0x28
push edi
mov dword [esi + 0x140], edi
call fcn.004255bb
pop ecx
mov dword [esi + 0x138], eax
test eax, eax
jne 0x405323
push 3
jmp 0x405349
movzx ecx, word [esi + 0x54]
push dword [ebp + 0xc]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
push edi
push ecx
push eax
mov dword [esi + 0x13c], ecx
call dword [ebp + 8]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
jmp 0x40534a
push 2
pop eax
pop edi
pop ebp
ret

Function at 0x406dd5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x406de3
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x406e9e
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
add edx, 8
sub edi, 8
dec esi
jne 0x406e01
pop ebx
test edi, edi
je 0x406eb7
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x43f820]
inc edx
dec edi
jne 0x406ea2
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x406ebd
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
movsx edx, byte [ebp + 0xc]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x43f820]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x43f820]
pop esi
mov dword [ecx + 8], eax
pop ebp
ret