joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a650
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x540a44]
xor edx, edx
cmp eax, edx
jne 0x48a676
xor eax, eax
mov byte [eax + 0x540944], al
inc eax
cmp eax, 0x100
jl 0x48a65e
mov dword [0x540a44], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x540944
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x48a707
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x48a6da
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x48a6a8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x48a780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x48a7d3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x48a7ba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x491160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4becae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00491a80
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4e562c
call fcn.004af5d1
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4911f3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004af5d1
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4911ec
push 0
mov ecx, eax
call fcn.00488280
mov dword [esi + 0xc], eax
jmp 0x4911f5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4911f5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x425434
Capabilities:
Encode data using xor

Disassembly:
imul edx, dword [edx + 0x20], 0
inc esi
cmp ch, byte [eax + 0x53235ec8]
mov dl, byte [0xa830ca32]
retf 0x29cc
pushal
and byte [edx + 0x41469426], bl
scasb al, byte es:[edi]
pushal
push ss
or al, 0x38
sbb eax, dword [eax + 0x2eb62eed]
adc dword [eax + ebx*4], eax
sub dword [edi + eax + 0x74], eax
adc eax, 0x2fdefbac
sti
fisubr word [edi]
das
pop ecx
adc byte [edi + edx*8], al
add al, 0xd7
jle 0x4253fe
in eax, dx
neg byte [ebx]
or al, 0xc6
jo 0x425443
jns 0x425472
add eax, edx
movsd dword es:[edi], dword [esi]
daa
add byte [esi - 0x17e9a825], al
out 0xda, al
jno 0x42544a
dec edx
sbb eax, dword [edx]
loope 0x425428
rcr byte [esi], 0x7b
in eax, dx
push ds
jnp 0x425458
jno 0x425491
inc ecx
js 0x4254e1
fidivr word [edx]
ljmp 0x7b05:0xf6c0f507
daa
jbe 0x425448
xchg ecx, eax
xor byte [eax - 0xf4ed7d8], 0x7b
sbb eax, dword [eax]
dec esp
fucompi st(3)
test al, 0x4d
mov dl, 0x3e
xchg edi, eax
pop ebx
mov esi, 0xef2eb8fa
loope 0x425495
pop esi
ja 0x425445
aaa
adc al, 0x16
xchg ebx, eax
imul ebx, esi, 0xe0921d50
lodsb al, byte [esi]
popfd
push 0x614f561
sub ecx, dword [ebx - 0x73a28055]
test eax, 0x8e874563
adc eax, 0x8a027463
push ss
or dword [edx + ebx*2 - 0x7a8a0b97], edi
mov dl, 0xea
jae 0x425467
xor eax, 0x4af4b55d
jne 0x425547
hlt
or eax, 0x1f87dabc
cmp ch, bl
push es
mov edx, 0xfefc1161
invalid
retf 0x4338
Function at 0x449710
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x49f988], eax
mov edx, 1
mov eax, 0x49f988
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4a0344
jl 0x449724
mov dword [0x49d318], 1
mov dword [0x4a2504], 1
pop edi
ret

Function at 0x449760
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a2504], 0
push esi
mov esi, 0x49f988
jne 0x44977e
call dword [fcn.0048d2e4]
push eax
call fcn.00449710
add esp, 4
mov dword [0x49d318], 0x270
mov dword [0x49f984], esi
mov ecx, 0xe3
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi + 0x634]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x449793
mov ecx, 0x18c
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi - 0x38c]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x4497c8
mov ecx, dword [esi]
mov eax, dword [0x49f988]
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, dword [esi]
and al, 1
movzx edx, al
shr ecx, 1
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor ecx, edx
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
ret
Function at 0x452640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, byte [0x49d350]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], al
mov dword [esp + 0xe], 0x3e3c0928
mov dword [esp + 0x12], 0x2d2b3d3a
mov dword [esp + 0x16], 0x7e212f2a
mov dword [esp + 0x1a], 0x5b5e7c26
mov word [esp + 0x1e], 0x3f2e
mov byte [esp + 0x20], 0
mov edi, ebp
test ebp, ebp
je 0x4526ab
mov dl, byte [ebp]
test dl, dl
je 0x4526ab
lea ecx, [esp + 0xc]
mov al, 0x20
cmp dl, al
je 0x4526fe
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x452697
mov dl, byte [edi + 1]
inc edi
test dl, dl
jne 0x452691
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4526b0
sub eax, edx
lea edi, [eax + ebp - 1]
cmp edi, ebp
jbe 0x4526d0
mov al, byte [edi]
cmp al, 0x20
je 0x4526cb
cmp al, 9
jne 0x4526d0
dec edi
cmp edi, ebp
ja 0x4526c1
mov esi, edi
sub esi, ebp
inc esi
cmp esi, 0xfd
jbe 0x452705
cmp byte [esp + 0x30], 0
je 0x4526f3
mov ecx, dword [esp + 0x28]
push ebp
push 0x492298
call fcn.00461900
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
cmp edi, ebp
jbe 0x4526d0
dec edi
jmp 0x4526bd
push esi
push ebp
push ebx
call 0x4b28e0
add esp, 0xc
mov eax, edi
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x4889f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1fc
mov eax, dword [0x49d3c8]
mov ecx, dword [eax + 0x4c]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea edx, [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 8]
push edx
lea eax, [esp + 0x28]
call fcn.00487d30
mov dword [esp + 0x18], eax
test eax, eax
je 0x489836
mov eax, dword [esp + 0x24]
cmp eax, 0x62
ja 0x489836
mov ebx, dword [eax*4 + 0x4a11b8]
mov dword [esp + 0x20], ebx
test ebx, ebx
je 0x489836
mov eax, dword [ebp + 0xc]
call fcn.00490dd0
push 1
push 0
mov dword [esp + 0x2c], eax
push 0xffffffffffffffff
cmp eax, dword [ebx + 0xc]
jae 0x48983c
mov ecx, dword [ebx + 0x14]
lea eax, [eax + eax*4]
lea edi, [ecx + eax*4]
mov ecx, dword [0x4a13a4]
push 0x4900b0
mov dword [esp + 0x24], edi
call 0x49e8b0
mov eax, dword [0x4a2b54]
mov edx, dword [0x4a2b50]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x48], eax
xor eax, eax
mov dword [0x4a2b50], eax
mov dword [0x4a2b54], eax
mov byte [esp + 0x13], al
lea eax, [ecx - 1]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x2c], 1
cmp eax, 0xc
ja case.default.0x488abe
jmp dword [eax*4 + 0x451858]
mov bl, byte [edi + 6]
mov ecx, dword [esp + 0x20]
call fcn.00493600
test eax, eax
je 0x488f99
mov edx, dword [edi]
push edx
call dword [fcn.0048d558]
test eax, eax
je 0x488f99
mov ecx, dword [edi]
lea eax, [esp + 0x30]
push eax
push ecx
call dword [fcn.0048d454]
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
push 2
lea edx, [esp + 0x34]
push edx
push eax
push 0
call dword [fcn.0048d3e4]
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x34]
push ecx
push edx
call dword [fcn.0048d5a8]
mov esi, dword [esp + 0x4c]
test esi, esi
je 0x488fd4
mov eax, dword [0x4a2b50]
test eax, eax
je 0x488fc5
push eax
call 0x4b05bf
add esp, 4
cmp dword [0x4a2b54], 0x400000
jbe 0x488fc5
dec dword [0x4a2b58]
mov eax, dword [esp + 0x48]
mov dword [0x4a2b50], esi
mov dword [0x4a2b54], eax
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 1
push 0
push 0xffffffffffffffff
mov ecx, dword [0x4a13a4]
push 0x4916f4
call 0x49e8b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403280
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404a84
test esi, esi
jne 0x4032b6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404b74
jmp 0x4032d4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403124
mov edi, eax
test esi, esi
je 0x4032d4
cmp dword [ebx], 0
je 0x4032d4
dec esi
jmp 0x4032bd
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4039a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x429020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a3c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a1c
xor eax, eax
push ebp
push 0x403a15
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a58
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a1c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x429020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x429020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404904
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x42a04c], 0
je 0x404965
cmp word [0x42a220], 0xd7b2
jne 0x40492d
cmp dword [0x42a228], 0
jbe 0x40492d
mov eax, 0x42a21c
call dword [0x42a238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40498c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x42902c], 0
jne 0x404981
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x408144
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x408196
test eax, edx
je 0x408199
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x408159
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40817f
add ecx, 4
js 0x40816f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x40817c
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x4081a5
test edx, edx
jne 0x40814c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x408960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00404f14
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40897e
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x40899f
cmp ebx, 3
je 0x40899f
cmp ebx, 0x7b
je 0x40899f
mov eax, esi
call fcn.00408920
test al, al
jne 0x4089a3
xor eax, eax
jmp 0x4089a5
mov al, 1
pop esi
pop ebx
ret

Function at 0x40b460
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b499
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404b74
jmp 0x40b4a2
mov eax, ebx
mov edx, esi
call fcn.00404ad8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b4ac
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b4ce
movzx eax, byte [esp]
jmp 0x40b4d0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bb60
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b9d8
mov eax, dword [0x429e54]
cmp byte [eax], 0
je 0x40bbdc
mov eax, dword [0x429d18]
call fcn.00403374
call fcn.00402f90
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408d24
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bc24
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bc12
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x429cdc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x42c7f8]
call fcn.00406034
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x41cea4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x42e9e8
cmp dword [edi], 0
jne 0x41cf20
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x42e9e4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x429b4c
mov ecx, 2
call fcn.00403024
mov edx, 0x41ce7c
lea eax, [esi + 5]
call fcn.0041ce9c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041ce9c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41cef5
mov dword [0x42e9e4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f458
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x41f4f0
push 0
mov eax, ebx
call fcn.00404f14
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x41f4cb
mov ebx, esi
test ebx, ebx
je 0x41f4a1
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, esi
call fcn.00404f14
push eax
push 1
push 0
mov eax, edi
call fcn.00404f14
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x41f4e6
mov ecx, dword [0x429d30]
mov dl, 1
mov eax, dword [0x41d9f8]
call fcn.0040bce4
call fcn.004044cc
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x423e78
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
xor eax, eax
push ebp
push 0x423f67
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f14
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x423f51
mov eax, esi
call fcn.00402e34
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x423f4a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push esi
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x423f7c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp - 8]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423f51
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00402e50
mov bl, 1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423f6e
lea eax, [ebp - 4]
call fcn.00404a84
ret

Function at 0x424930
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call sub.kernel32.dll_GetTickCount
mov esi, eax
jmp 0x424978
push 1
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x42496a
push esp
call sub.user32.dll_TranslateMessage
push esp
call sub.user32.dll_DispatchMessageA
push 1
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount
mov ebx, eax
sub ebx, esi
cmp edi, ebx
jg 0x424948
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x425014
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004066a4
xor eax, eax
push ebp
push 0x42514e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.0041f3c0
xor eax, eax
push ebp
push 0x42511e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
movzx ebx, word [eax + 0x30]
dec ebx
test ebx, ebx
jl 0x425103
inc ebx
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.0041f3c0
mov eax, dword [ebp - 0x1c]
and eax, 2
cmp eax, 2
jne 0x4250fb
mov eax, dword [ebp - 0x1c]
and eax, 1
dec eax
jne 0x4250fb
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.0041f3c0
lea eax, [ebp - 8]
call fcn.00406630
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
call fcn.0041f3c0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.0041f3c0
lea eax, [edi + 4]
mov edx, dword [ebp - 8]
call fcn.00406648
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00424f7c
inc esi
dec ebx
jne 0x425076
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425125
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x4c]
ret

Function at 0x425958
Capabilities:
Encrypt data using rc6

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
lea edx, [esp + 4]
mov eax, dword [0x42eb00]
mov ecx, 0x40
call fcn.00403024
mov dword [0x42ea4c], 0xb7e15163
mov ebx, 0x2b
mov eax, 0x42ea4c
mov edx, dword [eax]
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
dec ebx
jne 0x425986
xor ebx, ebx
xor edi, edi
xor esi, esi
xor ebp, ebp
mov dword [esp], 0x84
mov eax, dword [ebx*4 + 0x42ea4c]
add eax, esi
add eax, ebp
mov edx, 3
call fcn.00425838
mov esi, eax
mov dword [ebx*4 + 0x42ea4c], esi
lea edx, [ebp + esi]
mov eax, dword [esp + edi*4 + 4]
add eax, esi
add eax, ebp
call fcn.00425838
mov ebp, eax
mov dword [esp + edi*4 + 4], ebp
lea eax, [ebx + 1]
mov ecx, 0x2c
cdq
idiv ecx
mov ebx, edx
inc edi
and edi, 0x8000000f
jns 0x4259f6
dec edi
or edi, 0xfffffff0
inc edi
dec dword [esp]
jne 0x4259a6
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x425a80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov eax, dword [0x42eaf8]
sub dword [ebx + 8], eax
mov eax, dword [0x42eaf4]
sub dword [ebx], eax
mov esi, 0x14
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
mov dword [ebx + 0xc], edx
mov edx, dword [ebx + 4]
mov dword [ebx + 8], edx
mov edx, dword [ebx]
mov dword [ebx + 4], edx
mov dword [ebx], eax
mov eax, dword [ebx + 0xc]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00425838
mov ebp, eax
mov eax, dword [ebx + 4]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00425838
mov edi, eax
mov eax, dword [ebx + 8]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x42ea50]
mov edx, edi
call fcn.00425840
xor eax, ebp
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x42ea4c]
mov edx, ebp
call fcn.00425840
xor edi, eax
mov dword [ebx], edi
dec esi
test esi, esi
jne 0x425a9a
mov eax, dword [0x42ea50]
sub dword [ebx + 0xc], eax
mov eax, dword [0x42ea4c]
sub dword [ebx + 4], eax
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x426ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x100c], ecx
mov dword [ebp - 0x1008], ecx
mov dword [ebp - 0x1004], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x426f9e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1000]
mov ecx, 0x20
mov edx, 0x1000
call fcn.004034cc
sub ebx, 1
jb 0x426ef9
je 0x426f2f
dec ebx
je 0x426f66
jmp 0x426f80
lea eax, [ebp - 0x1000]
push eax
push 0x1000
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x1004]
lea edx, [ebp - 0x1000]
mov ecx, 0x1000
call fcn.00404b74
mov eax, dword [ebp - 0x1004]
mov edx, esi
call fcn.004082e8
jmp 0x426f80
push 0
push 0x1c
lea eax, [ebp - 0x1000]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
lea eax, [ebp - 0x1008]
lea edx, [ebp - 0x1000]
mov ecx, 0x1000
call fcn.00404b74
mov eax, dword [ebp - 0x1008]
mov edx, esi
call fcn.004082e8
jmp 0x426f80
lea edx, [ebp - 0x100c]
xor eax, eax
call fcn.00403280
mov eax, dword [ebp - 0x100c]
mov edx, esi
call fcn.00408ac4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426fa5
lea eax, [ebp - 0x100c]
mov edx, 3
call fcn.00404aa8
ret