joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ce428
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
jmp 0x6cfb14
call dword [edx + 4]
lea esp, [esp + 0xc]
bts cx, ax
bsf edx, esi
lea ecx, [ebx + 0x20]
xor edx, esp
shr dh, cl
mov edx, 0xa
mov dword [ecx], eax
add ecx, 4
cmp ch, 0xc5
add eax, 0x80
jmp 0x7a4728
push esi
call dword [eax]
mov ebx, eax
sub ax, 0x65c5
bswap ax
inc al
mov eax, dword [esp + 0x24]
jmp 0x7a64d5
push eax
jmp 0x7cbe8e
ret
mov eax, dword [esi + 4]
jmp 0x6d5240
call dword [ebp + 0x14]
mov dword [ebx], eax
bts ax, di
and ch, 0x3d
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 0x20]
add esp, 0x18
inc eax
test ebx, edi
test cl, 0x8a
lea ebx, [ebx + 4]
add edi, 0x54
jmp 0x7c5e51
je 0x71ccdb
lea ecx, [ecx + ecx*2]
mov ebp, dword [esi + 4]
push ecx
cmovbe cx, ax
movzx ecx, sp
setae ch
mov ecx, dword [edi + 0x14]
jmp 0x7c7397
call fcn.006cce2d
mov edx, dword [edi - 4]
add esp, 8
jmp 0x7235e4
push eax
nop
bswap ax
mov eax, dword [edi + 0x10]
jmp 0x7c9e74
ret
mov dword [ebx], 0x10062510
mov dword [ebx + 8], 0x10062590
jmp 0x7a7d45
mov dword [ebx + 4], 0x10062840
mov ebp, eax
mov dword [ebx + 0xc], 0x100625e0
jmp 0x7da16f
mov dword [esp + 0x18], eax
jmp 0x7c9115
push esi
jmp 0x709a85
jne 0x6cfb2e
mov dword [ebx + 0x10], ebp
pop esi
mov bp, 0x5c61
jmp 0x783bdb
dec edx
jmp 0x79a6be
xor ebp, ebp
clc
add esp, 0xc
cmp ebp, 0x70a41dc5
mov dword [esi + 0x1a8], ebx
cmp eax, ebp
mov dword [esp + 0xc], ebx
jmp 0x72f311
mov dword [ebx + 0x70], ebp
je 0x7d4100
mov eax, dword [esi + 0x20]
test si, dx
cmc
push edi
bsf edi, ebx
cmp di, sp
bswap edi
mov edi, dword [esi + 0xd8]
cmp eax, ebp
jmp 0x7d872e
push ebp
movzx ax, cl
mov ah, 0x1d
bswap ax
push esi
movsx esi, cx
cwde
mov esi, dword [esp + 0x14]
mov eax, esi
nop
push 0x74
mov ax, si
setp al
not eax
push 1
lahf
jmp 0x705ac8
push 1
jmp 0x7966dc
cmp eax, ecx
jmp 0x788ba0
push eax
push ecx
jmp 0x71ffb5
jl 0x7e1d10
mov ebx, dword [esp + 0x10]
movsx ecx, dx
not cl
movzx ecx, sp
lea ecx, [ebx + 0x48]
not esi
movzx ebp, si
pop edi
bswap bp
pop esi
movzx ebp, di
mov dword [ebx + 4], 0x10062850
mov dword [ebx + 0xc], 0x10062a70
mov dword [ebx + 0x10], ecx
mov ebp, 0x5148114e
pop ebp
bswap ebx
movzx ecx, dx
pop ebx
movzx ecx, bp
mov cx, 0x78d0
pop ecx
jmp 0x6e26db
push edx
jmp 0x7eb0ea
push 1
jmp 0x7bc81c
push ecx
xchg al, al
push ebx
jmp 0x7b7874
mov edx, dword [esi + 4]
push 0x500
push 1
jmp 0x6b2d5f
mov dword [esp + 0x18], ebp
jmp 0x7e1d01
pop ebp
movzx ecx, bx
xchg bl, bh
pop ebx
pop ecx
jmp 0x724dc6
call fcn.006cce2d
add esp, 8
jmp 0x6dc29e
jle 0x7c9127
add edi, 0xc
rcr dx, cl
add ebx, 0x48
mov edx, dword [esi + 0xdc]
add cx, 0x7c1a
bt ecx, 0x9e
neg ch
mov eax, dword [edi]
test edx, edx
xchg cl, cl
mov cl, ah
mov ecx, eax
jmp 0x71ccd2
push eax
jmp 0x7db8dd
Function at 0x7d082a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec esi
push esi
jmp 0x7da9a8
je 0x6dfaf4
add eax, 4
inc esi
movsx esi, ax
pop esi
jmp 0x6bf3e3
leave
jmp 0x71bcb2
pop esi
xor eax, ebp
btr cx, dx
rol ah, 0x6b
pop ecx
sar ah, cl
adc eax, edi
jmp 0x7d17dd
ret 8
ret 8
je 0x7da9ae
mov eax, dword [ebx + 0x3c]
lea eax, [eax + ebx]
neg ch
xchg edi, esi
mov edx, dword [eax + 0x78]
or cx, di
add edx, ebx
cwde
and ch, al
stc
mov ecx, dword [edx + 0x18]
and si, si
rcl si, 0xe8
sbb eax, 0x5c0a2e36
mov eax, dword [edx + 0x20]
add edi, 0x4d0d4eb0
ror di, 0x44
push ecx
shl di, 0x86
ror esi, 0x78
push ecx
push eax
btr si, 0xb9
sub eax, eax
and di, bx
sar esi, 0xf6
or ecx, 0xffffffff
or di, 0x37bf
ror si, 0x74
mov edi, dword [ebp + 0xc]
or esi, edi
mov edi, dword [edi]
repne scasb al, byte es:[edi]
stc
not ecx
btc esi, 0x4b
pop eax
push ecx
cmp ebp, eax
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
cmp ax, sp
rcl esi, 0xa2
mov esi, dword [eax + ebx]
test dl, bl
add esi, ebx
clc
repe cmpsb byte [esi], byte es:[edi]
mov cl, 0xdd
movsx ecx, si
movzx ecx, cx
pop ecx
jmp 0x6cbf4b
cmp ebx, 0
jmp 0x787348
push ebp
mov ebp, esp
sal bh, 0x7d
mov ebx, dword [ebp + 8]
jmp 0x7bad45
sub ecx, esi
cbw
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
cmp ebp, 0x7b1f7d0f
shr cx, cl
movzx eax, word [eax + ebx]
rcl ecx, cl
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
test bp, dx
mov eax, dword [eax + ebx]
cmp bp, 0x7553
add eax, ebx
jmp 0x7dbc99
jne 0x7873b4
xor eax, eax
jmp 0x6ddd99
leave
jmp 0x71a676
Function at 0x7d6fbf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
jmp 0x7e882f
push 1
jmp 0x7802e3
push esi
call dword [eax]
add esp, 4
sets ch
movzx ecx, dx
mov ecx, dword [esi + 4]
push 3
jmp 0x79cf1b
jle 0x6c78bd
mov eax, dword [esi]
jmp 0x6c78b1
jne 0x7d76f1
mov eax, dword [esi + 0x70]
stc
shr dh, cl
mov edx, dword [esi + 4]
clc
cmp esi, ebx
add eax, ecx
cmp sp, di
test bl, dl
lea eax, [eax + eax*2]
test ebp, esp
shl eax, 1
jmp 0x7ed1e7
push esi
jmp 0x7d8f8c
jl 0x7d2c66
mov dword [edi + 0x1c], 1
inc ah
mov eax, dword [esi + 0x6c]
stc
cmp ebp, esi
jmp 0x702769
push esi
call dword [ecx]
add esp, 4
mov edx, dword [esi + 4]
jmp 0x6bbc9e
push 1
jmp 0x7bc8a1
test eax, eax
je 0x7c8d47
mov ebx, dword [esi + 0x60]
cmp eax, esi
cmp ebx, 8
jmp 0x794dc9
mov dword [ecx + ebx - 4], eax
jmp 0x6d9b26
call dword [eax + 4]
mov ecx, dword [edi + 0x18]
cmp ah, 8
stc
lea ebx, [ebx + 4]
jmp 0x70ea1e
lea esp, [esp + 0xc]
cmp ebx, 0x80
jmp 0x708da8
mov dword [edi + 0x20], eax
jmp 0x7d76e9
push esi
call dword [edx + 4]
push esi
jmp 0x731378
call dword [edx]
add esp, 4
clc
cmp ebx, 0x100
jmp 0x6cbfb3
push esi
jmp 0x7e1a9d
mov dword [edi + 0x10], eax
jmp 0x793147
mov dword [edi + 0x14], ebx
jmp 0x7c8d53
jge 0x781c51
mov edx, dword [esi]
push esi
jmp 0x781c4b
push ebx
jmp 0x702034
je 0x7a9f14
mov dword [esi + 0x58], ecx
clc
cmp dword [esi + 0x58], ecx
jmp 0x6d8ea5
push esi
call dword [ecx + 8]
add esp, 0x10
jmp 0x78f938
push 1
jmp 0x7889e6
mov dword [edi + 0x10], 0
xor eax, 0x7e777843
mov eax, dword [esi + 0x58]
movzx bx, ah
rol ebx, cl
btr cx, 0x36
mov ecx, 2
shr bl, 0xd7
rcr bx, cl
test eax, eax
not ebx
cmovb bx, dx
bswap bx
pop ebx
jmp 0x7a9f0a
je 0x6fe332
mov ecx, dword [esi]
jmp 0x6fe32c
mov eax, dword [esi + 4]
push 0x1000
push 1
push esi
jmp 0x70b3bd
push esi
movsx eax, bp
movzx eax, si
mov esi, dword [esp + 8]
push edi
movzx ax, dl
mov al, 0xb
push 0x2c
cmovs ax, ax
cwde
mov al, 0xb0
mov eax, dword [esi + 4]
push 1
jmp 0x6d9aa7
call fcn.00792579
add esp, 0x10
pop edi
movsx esi, bx
pop esi
ret
call dword [eax]
mov edi, eax
test edx, ebp
cmc
lea esp, [esp + 0xc]
clc
mov dword [esi + 0x1c8], edi
clc
mov dword [edi], 0x10066600
cmp bp, cx
test eax, ebp
mov dword [edi + 0xc], 0x10067810
test esi, 0x4f365fba
clc
stc
mov dword [edi + 0x20], 0
cmp sp, ax
mov dword [edi + 0x28], 0
test dl, 0xf0
stc
cmp dword [esi + 0x78], 3
jmp 0x7d2253
call dword [edx]
lea esp, [esp + 0xc]
stc
mov dword [edi + 0x18], eax
cbw
sar ax, 0x97
xor ebx, ebx
jmp 0x7d2c66
push 0x80
jmp 0x7c120d
push eax
jmp 0x6c0043
Function at 0x7db4e4
Capabilities:
Check for software breakpoints

Disassembly:
ret
jne 0x7aae83
mov eax, dword [esi + 0x1b0]
adc cl, 0x11
ror ecx, 0x98
cmp eax, ecx
mov ecx, dword [eax + 0x10]
cmp eax, esi
cmp esp, 0x494d0e1d
jmp 0x787a77
push esi
call fcn.007ae45e
add esp, 4
pop esi
ret
ret
je 0x7c5970
cmp eax, 2
jmp 0x7e4676
je 0x7a03bb
mov eax, dword [esi + 8]
test bh, 0xe
test eax, eax
je 0x7c9f8c
push esi
jmp 0x7c9f83
push esi
jmp 0x721653
call dword [ecx]
add esp, 4
jmp 0x6e98b4
je 0x7222c0
cmp eax, 1
jne 0x6f504b
mov eax, dword [ecx + 4]
movsx dx, bl
movzx edx, di
setbe dl
inc eax
dec dx
rcr dx, cl
mov dword [ecx + 4], eax
sar ah, cl
mov eax, dword [esi + 8]
movzx cx, ah
bt dx, 0x68
mov ecx, dword [eax + 8]
or dh, 0xf1
not dx
mov edx, dword [eax + 4]
test ch, 0x4c
cmp edx, ecx
jmp 0x7a044b
ret
je 0x6f504b
cmp eax, 3
jmp 0x7222b1
test ecx, ecx
jmp 0x6f5045
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
clc
cmp eax, 0xcb
jmp 0x6d6495
mov eax, dword [esi + 0x90]
push esi
jmp 0x7e6c4a
jl 0x6f504b
mov edx, dword [esi + 0x13c]
add edx, ecx
jmp 0x7bb95e
cmp eax, 0xcc
jmp 0x7dc09e
call fcn.007ae45e
add esp, 4
pop esi
jmp 0x6c1f47
mov dword [eax + 8], edx
jmp 0x6f504b
xor eax, eax
pop esi
jmp 0x6f47a1
call dword [ecx]
lea esp, [esp + 4]
test dh, 0x85
cmp cx, bp
test eax, eax
jmp 0x6f4893
call dword [eax]
add esp, 4
cmovs cx, ax
mov ecx, dword [esi + 0x1b0]
push esi
jmp 0x7c702b
cmp dword [esi + 0x10], 0xca
jne 0x796776
push esi
call fcn.00726f58
mov eax, dword [esi + 0x40]
cmp ebp, 0x8953543
test dx, sp
lea esp, [esp + 4]
test eax, eax
je 0x79676f
mov dword [esi + 0x10], 0xcf
movsx esi, bx
cbw
mov eax, 1
xchg si, si
movzx esi, sp
pop esi
jmp 0x734651
push esi
bt esi, ebp
inc esi
mov esi, dword [esp + 8]
jmp 0x7ca9b4
je 0x6e98b4
mov ecx, dword [esi]
jmp 0x6f5528
je 0x7a03bb
mov ecx, dword [esi + 8]
test ecx, ecx
jmp 0x785062
mov dword [esi + 0x98], eax
jmp 0x7b1454
Function at 0x68a6690
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x58dc000]
push edi
or ebp, 0xffffffff
jmp 0x68a66b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x68a66b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x68a66a8
mov eax, 1
add ebx, ebx
jne 0x68a66cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x68a66dc
jne 0x68a66fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x68a66fb
dec eax
add ebx, ebx
jne 0x68a66e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x68a66c0
add ebx, ebx
jne 0x68a66f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x68a674d
xor ecx, ecx
sub eax, 3
jb 0x68a6713
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x68a6782
sar eax, 1
mov ebp, eax
jmp 0x68a671e
add ebx, ebx
jne 0x68a671e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x68a66ec
inc ecx
add ebx, ebx
jne 0x68a672c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x68a66ec
add ebx, ebx
jne 0x68a6739
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x68a672e
jne 0x68a674a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x68a672e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x68a676c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x68a675e
jmp 0x68a66ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x68a676c
add edi, ecx
jmp 0x68a66ae
pop esi
mov edi, esi
mov ecx, 0x50c2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x68a678a
cmp byte [edi], 0x1e
jne 0x68a678a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x68a678f
lea edi, [esi + 0x64a3000]
mov eax, dword [edi]
or eax, eax
je 0x68a6807
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x64a6e1c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x64a6f48]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x68a67bc
mov ecx, edi
jns 0x68a67eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x64a6f4c]
or eax, eax
je 0x68a6801
mov dword [ebx], eax
add ebx, 4
jmp 0x68a67d9
call dword [esi + 0x64a6f54]
mov ebp, dword [esi + 0x64a6f50]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x68a683b
sub esp, 0xffffff80
jmp 0x4a0fc2
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
mov ecx, 0xd3e0db3
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x7b750228
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40142c
Capabilities:
Identify system language via api
Read .ini file

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x3c]
mov ecx, ebx
call fcn.00406c28
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push 0
mov ebp, 0x40a0ec
push 0x40a0e4
push ebp
call edi
test eax, eax
setne al
mov ecx, ebx
mov byte [esi + 6], al
call fcn.00406c28
push eax
push 1
push 0x40a0dc
push ebp
call edi
neg eax
sbb al, al
and byte [esp + 0x10], 0
inc al
lea edi, [esp + 0x11]
mov byte [esi + 5], al
xor eax, eax
mov ecx, ebx
stosw word es:[edi], ax
call fcn.00406c28
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
lea eax, [esp + 0x14]
push 3
push eax
push 0x40a620
push 0x40a0cc
push ebp
call edi
cmp eax, 1
jne 0x4014be
cmp byte [esp + 0x10], 0x79
je 0x4014ba
cmp byte [esp + 0x10], 0x59
jne 0x4014be
mov byte [esi + 8], 1
mov ecx, ebx
call fcn.00406c28
push eax
lea eax, [esi + 0x48]
push 0x1f4
push eax
push 0x40a620
push 0x40a0c4
push ebp
call edi
mov ecx, ebx
call fcn.00406c28
push eax
push 1
mov ebp, 0x40a0b8
push 0x40a0b0
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
and dword [esp + 0x14], 0
mov dword [esi + 0x244], eax
test eax, eax
jle 0x40156a
lea eax, [esi + 0x248]
mov dword [esp + 0x18], eax
push dword [esp + 0x14]
lea eax, [esp + 0x2c]
push 0x40a0a8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, ebx
call fcn.00406c28
push eax
lea eax, [esp + 0x20]
push 0xa
push eax
lea eax, [esp + 0x34]
push 0x40a0a0
push eax
push ebp
call edi
lea eax, [esp + 0x1e]
push eax
call fcn.00407141
inc dword [esp + 0x18]
pop ecx
mov ecx, dword [esp + 0x18]
add dword [esp + 0x18], 2
mov word [ecx], ax
mov eax, dword [esp + 0x14]
cmp eax, dword [esi + 0x244]
jl 0x401510
mov ecx, ebx
call fcn.00406c28
push eax
lea eax, [esp + 0x20]
push 0xa
push eax
push 0x40a0a0
push 0x40a098
push ebp
call edi
lea eax, [esp + 0x1e]
push eax
call fcn.00407141
mov word [esi + 0x240], ax
mov ax, word [esi + 0x23c]
pop ecx
push eax
mov ecx, esi
call fcn.00401615
test al, al
jne 0x4015f8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea edi, [esi + 0x312]
push eax
mov ecx, esi
mov word [edi], ax
call fcn.00401615
test al, al
jne 0x40160d
mov ax, word [edi]
mov ecx, esi
and eax, 0x3ff
or ah, 4
push eax
mov word [edi], ax
call fcn.00401615
test al, al
jne 0x40160d
push edi
mov ecx, esi
call fcn.00401643
test al, al
jne 0x40160d
mov ax, word [esi + 0x240]
mov word [edi], ax
jmp 0x40160d
mov ax, word [esi + 0x23c]
mov byte [esi + 0x23e], 1
mov word [esi + 0x312], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x403152
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x22f], bl
jne 0x4032e8
cmp byte [esi + 0x22b], bl
jne 0x4032e8
cmp byte [esi + 0x22e], bl
je 0x4032e8
cmp byte [esi + 0x228], bl
jne 0x4032e8
lea eax, [ebp - 0x270]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4032e8
lea eax, [ebp - 0x16c]
push eax
push ebx
lea eax, [ebp - 0x270]
push 0x40a310
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4032e8
lea eax, [ebp - 0x16c]
push ebx
push eax
lea ecx, [esi + 0x240]
call fcn.00406c28
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4032e8
push edi
push ebx
push 0x4000000
push 3
push ebx
push 1
lea eax, [ebp - 0x16c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x10
mov dword [ebp - 8], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x64]
push 0x40a2f8
rep stosd dword es:[edi], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x68], 0x44
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x24c]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 4], eax
call edi
push eax
lea ecx, [ebp - 0x14]
push dword [ebp - 4]
call fcn.0040171c
push 0x40a2f0
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push eax
mov dword [ebp - 4], eax
call edi
push eax
lea ecx, [ebp - 0x14]
push dword [ebp - 4]
call fcn.0040171c
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [esi + 0x234]
push esi
call edi
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.0040171c
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
call fcn.00406c28
push eax
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x10]
call fcn.004016cb
push dword [ebp - 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x24]
call fcn.004032ee
cmp dword [ebp - 8], 0xffffffff
pop edi
je 0x4032e4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4032ea
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x4046f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
and byte [ebp - 0x148], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x147]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
push eax
push 0x40a180
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40476c
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0xc], 0x104
mov eax, 0x40a170
je 0x40474c
mov eax, 0x40a418
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x148]
push ecx
push esi
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x148], 0
je 0x4047b2
lea eax, [ebp - 0x148]
mov edi, 0x408240
push esi
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x38], 0x408248
mov dword [ebp - 0x30], edi
call fcn.00405fb4
mov esi, 0x40823c
push 0x40a370
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], 1
call fcn.004041c9
jmp 0x4047e3
lea eax, [ebp - 0x148]
mov edi, 0x408240
push esi
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x1c], 0x408248
mov dword [ebp - 0x14], edi
call fcn.00405fb4
mov esi, 0x40823c
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x28]
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx + 0xc], 0x408248
mov dword [ecx + 0x14], edi
call fcn.00406023
mov edi, dword [ebp + 8]
test byte [ebp - 4], 2
mov dword [edi], esi
je 0x40480f
and dword [ebp - 4], 0xfffffffd
lea ecx, [ebp - 0x28]
call fcn.004060b3
test byte [ebp - 4], 1
je 0x40481d
lea ecx, [ebp - 0x44]
call fcn.004060b3
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x405b58
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push edi
mov ebx, 0xf003f
push eax
push ebx
push 0
mov edi, VariantInit
push 0x40a590
push edi
mov dword [ebp - 0xc], 0xa
call esi
test eax, eax
jne 0x405bad
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x40a620
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x405c08
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push ebx
push 0
push 0x40a568
push edi
call esi
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x405be2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push edi
push 0x40a560
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp dword [ebp - 8], edi
je 0x405bf0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x405c0a
cmp dword [ebp - 4], edi
je 0x405c02
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, 0x409
jmp 0x405c27
xor edi, edi
lea eax, [ebp - 0x18]
push eax
call fcn.00407141
cmp dword [ebp - 4], edi
pop ecx
mov esi, eax
je 0x405c24
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, si
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407184
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x4071d6
push eax
call fcn.00401c7e
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4071d6
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x40a604
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4071da
xor al, al
jmp 0x40723b
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x40a5e8
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x407239
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.00401c7e
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x407239
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x407227
mov al, 1
pop ebx
leave
ret 4
Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66da28
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x19
push 0x6a8c00
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00417040
lea eax, [esp + 4]
push eax
push 6
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004176d0
cmp dword [esp + 0x1c], 0x10
jb 0x401072
mov ecx, dword [esp + 8]
push ecx
call fcn.00613a18
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::Integer::DivideByZero.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x401090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66da28
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x32
push str.Integer:_no_integer_satisfies_the_given_parameters
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00417040
lea eax, [esp + 4]
push eax
push 6
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004176d0
cmp dword [esp + 0x1c], 0x10
jb 0x401102
mov ecx, dword [esp + 8]
push ecx
call fcn.00613a18
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::Integer::RandomNumberNotFound.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x401f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66d6db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea edi, [esi + 0xc]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov bl, byte [esp + 0x30]
mov dword [esp + 0x20], 1
cmp bl, al
je 0x401f8a
mov ebp, dword [esp + 0x2c]
push ebp
mov ecx, edi
call fcn.00413620
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
push ebp
push eax
push ecx
push edx
call fcn.00615e1c
add esp, 0x10
jmp 0x401f98
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov eax, esi
mov byte [esi], bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc