joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9071f8
Capabilities:
Identify system language via api

Disassembly:
push 0x2c
mov eax, 0x91608c
call fcn.009039dd
lea ecx, [ebp - 0x34]
call fcn.00906c55
and dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
push 0
call fcn.0090758b
test eax, eax
jl 0x90722c
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.009072a7
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
mov eax, 0x409
mov edi, 0x907298
cmp ax, si
jne 0x90e4b4
and esi, 0x3ff
push esi
push edi
lea eax, [ebp - 0x30]
push 8
push eax
call fcn.00901451
add esp, 0x10
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0090758b
mov esi, eax
test esi, esi
jl 0x907280
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.009072a7
mov esi, eax
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
call fcn.0090760b
mov eax, esi
call fcn.00902b9f
ret

Function at 0x90791d
Capabilities:
Identify system language via api

Disassembly:
lea eax, [ebp - 0x30]
push eax
call esi
push 8
pop eax
push dword [ebp + 0x10]
mov word [ebp - 0x30], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x90dc4f
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 0x82
lea edx, [ebp - 0x30]
push edx
push 0x907900
push eax
call dword [ecx + 0x10]
mov esi, eax
lea eax, [ebp - 0x30]
push eax
call edi
cmp esi, ebx
jl 0x9079a8
push 1
lea ecx, [ebp - 0x20]
call fcn.009079e3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x20]
push edx
push 0x9078ec
push eax
call dword [ecx + 0x10]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call edi
push eax
call fcn.009071e0
cmp esi, ebx
jl 0x9079a8
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push 3
movzx eax, ax
pop ecx
mov word [ebp - 0x20], cx
mov dword [ebp - 0x18], eax
jmp 0x907992
push 0x24
mov eax, 0x915c85
call fcn.009026dd
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x20]
push eax
call esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
mov dword [ebp - 0x10], ebx
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp + 0xc], ebx
je 0x907854
push 1
lea ecx, [ebp - 0x20]
call fcn.009079e3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x20]
push edx
push 0x903984
push eax
call dword [ecx + 0x10]
cmp eax, ebx
jl 0x9079a6
push 3
pop eax
mov word [ebp - 0x20], ax
mov dword [ebp - 0x18], 0x409
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x20]
push edx
push 0x9079d0
push eax
call dword [ecx + 0x10]
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.00907455
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x20]
push eax
call edi
push eax
call fcn.009071e0
mov eax, esi
call fcn.00901390
ret 0xc
Function at 0x907b05
Capabilities:
Identify system language via api

Disassembly:
push 0x50
mov eax, 0x915fc0
call fcn.009039dd
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor esi, esi
push esi
mov dword [ebp - 0x5c], ecx
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x54], esi
call fcn.00907c2b
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x58]
mov ebx, eax
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x907b34
sub eax, ecx
sar eax, 1
mov edi, eax
je 0x907b63
movzx eax, word [ebx + esi*2]
push eax
call dword [sym.imp.msvcrt.dll_iswxdigit]
pop ecx
test eax, eax
je 0x907b5b
inc esi
cmp esi, edi
jb 0x907b46
cmp esi, edi
jb 0x907c0e
xor eax, eax
mov edx, ebx
test edi, edi
jbe 0x907c0e
cmp word [edx], 0x30
jne 0x907b7c
inc eax
inc edx
inc edx
cmp eax, edi
jb 0x907b6f
cmp eax, edi
jae 0x907c0e
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x907b89
sub eax, esi
sar eax, 1
cmp eax, 3
ja 0x907c0e
push 0x10
push 0
push edx
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
cmp cx, si
jne 0x907c03
movzx eax, ax
movzx eax, ax
push eax
push 0x907c18
lea eax, [ebp - 0x50]
push 0x20
push eax
call fcn.00901451
mov ecx, dword [ebp - 0x5c]
add esp, 0x10
lea eax, [ebp - 0x50]
push eax
call fcn.00906c60
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x58]
lea ecx, [ebp - 0x58]
call fcn.0090760b
mov eax, dword [ebp - 0x54]
call fcn.00902b9f
ret 8
or esi, 0x400
movzx eax, si
jmp 0x907bc6
mov dword [ebp - 0x54], 0x80041001
jmp 0x907be9
Function at 0x907f3e
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x916a7d
call fcn.00901350
mov dword [ebp - 0x1c], ecx
xor esi, esi
mov ebx, 0x8007000e
mov dword [ebp - 0x14], esi
cmp dword [ebp + 8], esi
je 0x908046
push 1
call fcn.0090227c
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x90803c
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call esi
push dword [ebp + 8]
mov edi, eax
call esi
lea esi, [eax + edi + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.009013e0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x907fcd
push dword [ebp - 0x18]
inc edi
push edi
push eax
call fcn.009021cb
mov ebx, eax
test ebx, ebx
jl 0x908024
push dword [ebp + 8]
push esi
push dword [ebp - 0x14]
call fcn.00902436
mov ebx, eax
test ebx, ebx
jl 0x908024
xor ebx, ebx
inc ebx
test ebx, ebx
jl 0x908024
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x907ff6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x90f33c
xor ebx, ebx
inc ebx
test ebx, ebx
jl 0x908024
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x44], eax
cmp eax, 0xffffffff
je 0x90f353
cmp dword [ebp - 0x14], 0
je 0x908033
push dword [ebp - 0x14]
call fcn.009013c0
pop ecx
push dword [ebp - 0x18]
call fcn.009013c0
pop ecx
mov eax, ebx
call fcn.00901390
ret 4
mov ebx, 0x80070057
jmp 0x90803c

Function at 0x9085f1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x91b004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
test eax, eax
je 0x908684
cmp eax, 0xffffffff
je 0x908684
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x908684
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
and dword [ebp - 0xc], 0
push ebx
call esi
push ebx
mov dword [ebp - 0x10], eax
call esi
lea esi, [eax + eax + 2]
mov eax, esi
call fcn.009085b5
mov eax, esp
push esi
push ebx
push eax
call fcn.00908692
mov esi, dword [ebp - 0x10]
mov edi, dword [edi + 0x44]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x90f2da
cmp esi, dword [ebp - 0xc]
jne 0x90f2f6
mov eax, dword [ebp - 8]
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009020d4
leave
ret 4
mov dword [ebp - 8], 0x80070057
jmp 0x90866d
Function at 0x9088ef
Capabilities:
Get geographical location

Disassembly:
push 0x210
mov eax, 0x916be9
call fcn.009020e6
xor eax, eax
push 0x1fe
mov word [ebp - 0x214], ax
xor ebx, ebx
lea eax, [ebp - 0x212]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
push 0x100
lea eax, [ebp - 0x214]
push eax
push 0x1001
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x214]
and esi, 0x3ff
push eax
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, 7
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.009013e0
mov edi, eax
pop ecx
cmp edi, ebx
je 0x908999
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x21c]
push 0x9089a4
push esi
push edi
call fcn.00901451
add esp, 0x14
mov eax, edi
call fcn.00902126
ret 4
Function at 0x910d7d
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [ecx + eax + 0x18]
test esi, esi
jbe 0x910dba
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x910db2
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x910dbc
inc edx
add eax, 0x28
cmp edx, esi
jb 0x910da2
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0
mov esi, 0xa40
xor eax, esi
push 0x6aa3a431
mov ebx, 0x6aa3a430
pop edx
xor ebx, edx
xor eax, ebx
push 0x1d675da5
mov esi, 0x3b1bb059
pop edx
xor esi, edx
mov ecx, 0x38c88acc
xor ecx, 0x1eb45720
xor ecx, esi
xor eax, ecx
mov edx, 4
sub esp, edx
mov ebx, 0
xor ebx, esp
mov ecx, ebx
mov edi, ecx
mov dword [edi], eax
xor ebx, ebx
add ebx, ebx
jmp 0x403ec4

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404de0
add esp, 0x104
pop ebx
ret
Function at 0x1003e21
Capabilities:
Encode data using xor

Disassembly:
push 0x68
inc esi
dec eax
push ebx
clc
xadd ecx, esi
bsr ebp, edi
mov ebx, 0xca53d051
pop esi
mov ah, dl
btc ebx, edx
mov al, dh
xor esi, 0xf59a6320
test eax, 0x661f8cbd
and eax, 0x61766f1c
mov al, 0x86
add esi, 0xf6ef9c0d
shl ecx, 0x3c
test ebx, eax
test dh, 0x7b
add esi, 0xbb58796e
shrd edx, ebp, 9
xchg bl, al
bsf edi, esi
add esi, 0x54258a13
bswap ebp
mov ebx, 0x9a6320e1
lea ebp, [0x74c5aab3]
xor esi, 0x11e69f0c
mov esi, 0x9eb70495
lea ecx, [0xb9ae0794]
xchg bl, al
add esi, 0x826bc8a9
not esi
imul ebp, edi
xor ebx, 0xa931091
add esi, 0x77c4557a
bt ebp, edi
imul ebx, edx, 0x452a3330
rcl esi, 0x15
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add eax, 0x53ee
mov esi, ebp
mov ah, 0x23
or dl, al
call 0x1003ef3
ja 0x1003e9a
push es
std
mov dword [0x27e1b612], eax
adc dword [eax - 0x307325f5], ebx
les edx, [edx - 0x29]
cmp byte [edi + esi*8 + 0x45], dl
push ds
pop eax
xor eax, 0xd28ef8c5
stosb byte es:[edi], al
dec edx
mov byte [0xfaac7364], al
xor ecx, ebp
shrd eax, ebx, cl
mov esi, 0xe69f0c3d
mov ecx, edi
pop ebx
add ebx, 0x29805bc
mov ecx, 0xb0b1063f
ror dl, cl
bsf ecx, eax
sub ebx, 0x296448b
lea edi, [0x21362fdc]
test ch, 0xf1
xadd dl, al
push ebx
add ebx, 0x3e4089a
test edx, ebx
imul edi, esi, 0x61766f1c
mov al, dh
sub ebx, 0x3e3f784
and ecx, 0x1960f3c
cmp al, dh
movzx ecx, di
push ebx
sub ebx, 0x5300b78
xadd eax, ecx
imul edi, esi, 0x41d64f
dec dl
add ebx, 0x52ffa62
bsf ecx, eax
bsf edi, esi
bsf edi, esi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop ebx
add eax, edx
adc esi, ebp
inc edi
adc esi, ebp
xor eax, edx
inc edi
rcl esi, 1
push ebx
xor edx, edx
xchg ecx, esi
not esi
add ecx, ebp
rcl esi, 0x9d
rcl esi, 0x6d
mov edx, edx
bsr esi, ecx
xadd ecx, esi
mov esi, 0xb1063f2c
ret

Function at 0x10040fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x10013b0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1004153
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x10013ec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1004146
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1004155
xor eax, eax
pop esi
leave
ret 4
Function at 0x4087b8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x4087e6
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x4087ee
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x40881d
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x408843
mov eax, section..data
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x40886c
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x40886c
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x40886c
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.004052ac
leave
ret
Function at 0x407fdf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42fd70]
jne 0x407fe9
repz ret
jmp fcn.0040c2c2

Function at 0x40a778
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404b97
and dword [ebp - 4], 0
cmp dword [0x4347f8], 0
mov ebx, eax
jne 0x40a829
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a8da
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a8da
push eax
call fcn.00404b25
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4347f8], eax
call esi
push eax
call fcn.00404b25
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4347fc], eax
call esi
push eax
call fcn.00404b25
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x434800], eax
call esi
push eax
call fcn.00404b25
pop ecx
mov dword [0x434808], eax
test eax, eax
je 0x40a829
push 0x42bf28
push edi
call esi
push eax
call fcn.00404b25
pop ecx
mov dword [0x434804], eax
mov eax, dword [0x434804]
cmp eax, ebx
je 0x40a881
cmp dword [0x434808], ebx
je 0x40a881
push eax
call fcn.00404ba0
push dword [0x434808]
mov esi, eax
call fcn.00404ba0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a881
test edi, edi
je 0x40a881
call esi
test eax, eax
je 0x40a878
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a878
test byte [ebp - 0xc], 1
jne 0x40a881
or dword [ebp + 0x10], 0x200000
jmp 0x40a8ba
mov eax, dword [0x4347fc]
cmp eax, ebx
je 0x40a8ba
push eax
call fcn.00404ba0
pop ecx
test eax, eax
je 0x40a8ba
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a8ba
mov eax, dword [0x434800]
cmp eax, ebx
je 0x40a8ba
push eax
call fcn.00404ba0
pop ecx
test eax, eax
je 0x40a8ba
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4347f8]
call fcn.00404ba0
pop ecx
test eax, eax
je 0x40a8da
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a8dc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414ddb
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], edx
add ebx, esi
sub esi, 1
add ecx, 4
or eax, eax
cmp ecx, edi
jne fcn.00414ddb
or eax, eax
sub esi, eax
ret

Function at 0x414de1
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi], ebx
add esi, 0xd9b22441
add edi, 4
and esi, eax
or edx, esi
cmp edi, ecx
jne fcn.00414de1
dec esi
mov edx, 0x1a7050d9
ret
Function at 0x10068b3
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x100b2d0]
and dword [ebp - 0xa8], 0
cmp dword [0x100b2dc], 0xfffffffe
mov dword [ebp - 4], eax
mov dword [ebp - 0xb0], 0xc
jne 0x10069d6
and dword [0x100b2dc], 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10069d6
cmp dword [ebp - 0x94], 1
jne 0x10069d6
cmp dword [ebp - 0xa0], 4
jne 0x10069d6
cmp dword [ebp - 0x9c], 0xa
jae 0x10069d6
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10069d6
lea eax, [ebp - 0xac]
push eax
push 0x20019
push 0
push 0x10014b8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10069d6
push edi
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0
push 0x1001271
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xac]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x10069d6
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0100678f
test eax, eax
je 0x10069d6
and dword [ebp - 0xa8], 0x3ff
cmp dword [ebp - 0xa8], 1
je 0x10069cc
cmp dword [ebp - 0xa8], 0xd
jne 0x10069d6
mov dword [0x100b2dc], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x100b2dc]
call fcn.010064de
leave
ret

Function at 0x10069ea
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
je 0x1006a22
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1006a26
xor eax, eax
jmp 0x1006a3c
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
leave
ret 4

Function at 0x1007d39
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [ebp + 0x10]
jle 0x1007d76
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1007d53
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1007d92
dec esi
je 0x1007d8b
dec esi
jne 0x1007d97
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x42c005
Capabilities:
Packed with generic packer

Disassembly:
jmp fcn.0042a8d0
jmp section.42vab535
Function at 0x413e1b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040ef01
xor ebx, ebx
cmp dword [0x41bbb8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x413ef1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x413fd1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4169bc
push edi
call esi
cmp eax, ebx
je 0x413fd1
push eax
call fcn.0040ee93
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41bbb8], eax
call esi
push eax
call fcn.0040ee93
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41bbbc], eax
call esi
push eax
call fcn.0040ee93
mov dword [0x41bbc0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040c8dd
test eax, eax
pop ecx
pop ecx
je 0x413ebf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ded0
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x413ef1
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040ee93
cmp eax, ebx
pop ecx
mov dword [0x41bbc8], eax
je 0x413ef1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ee93
pop ecx
mov dword [0x41bbc4], eax
mov eax, dword [0x41bbc4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x413f76
cmp dword [0x41bbc8], ecx
je 0x413f76
push eax
call fcn.0040ef0a
push dword [0x41bbc8]
mov esi, eax
call fcn.0040ef0a
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x413f76
cmp edi, ebx
je 0x413f76
call esi
cmp eax, ebx
je 0x413f43
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413f43
test byte [ebp - 0x18], 1
jne 0x413f76
lea eax, [ebp - 0x10]
push eax
call fcn.0040c914
test eax, eax
pop ecx
je 0x413f5e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ded0
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x413f6d
or dword [ebp + 0x10], 0x200000
jmp 0x413fb1
or dword [ebp + 0x10], 0x40000
jmp 0x413fb1
mov eax, dword [0x41bbbc]
cmp eax, dword [ebp - 8]
je 0x413fb1
push eax
call fcn.0040ef0a
cmp eax, ebx
pop ecx
je 0x413fb1
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x413fb1
mov eax, dword [0x41bbc0]
cmp eax, dword [ebp - 8]
je 0x413fb1
push eax
call fcn.0040ef0a
cmp eax, ebx
pop ecx
je 0x413fb1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41bbb8]
call fcn.0040ef0a
cmp eax, ebx
pop ecx
je 0x413fd1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413fd3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx