joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d8e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx esi, byte [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
push esi
mov dword [edi + 4], eax
lea eax, [edi + 8]
push eax
push dword [ebx + 0xc]
push dword [ebx + 8]
call sub.libcef.dll_cef_string_utf16_set
push esi
lea eax, [edi + 0x14]
push eax
push dword [ebx + 0x18]
push dword [ebx + 0x14]
call sub.libcef.dll_cef_string_utf16_set
push esi
lea eax, [edi + 0x20]
push eax
push dword [ebx + 0x24]
push dword [ebx + 0x20]
call sub.libcef.dll_cef_string_utf16_set
push esi
lea eax, [edi + 0x2c]
push eax
push dword [ebx + 0x30]
push dword [ebx + 0x2c]
call sub.libcef.dll_cef_string_utf16_set
add esp, 0x40
lea eax, [edi + 0x38]
push esi
push eax
push dword [ebx + 0x3c]
push dword [ebx + 0x38]
call sub.libcef.dll_cef_string_utf16_set
push esi
lea eax, [edi + 0x44]
push eax
push dword [ebx + 0x48]
push dword [ebx + 0x44]
call sub.libcef.dll_cef_string_utf16_set
mov eax, dword [ebx + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [ebx + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [ebx + 0x58]
mov dword [edi + 0x58], eax
mov eax, dword [ebx + 0x5c]
mov dword [edi + 0x5c], eax
lea eax, [edi + 0x60]
push esi
push eax
push dword [ebx + 0x64]
push dword [ebx + 0x60]
call sub.libcef.dll_cef_string_utf16_set
mov eax, dword [ebx + 0x6c]
mov dword [edi + 0x6c], eax
mov eax, dword [ebx + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [ebx + 0x74]
mov dword [edi + 0x74], eax
mov eax, dword [ebx + 0x78]
mov dword [edi + 0x78], eax
mov eax, dword [ebx + 0x7c]
mov dword [edi + 0x7c], eax
mov eax, dword [ebx + 0x80]
mov dword [edi + 0x80], eax
mov eax, dword [ebx + 0x84]
mov dword [edi + 0x84], eax
mov eax, dword [ebx + 0x88]
mov dword [edi + 0x88], eax
mov eax, dword [ebx + 0x8c]
mov dword [edi + 0x8c], eax
mov eax, dword [ebx + 0x90]
mov dword [edi + 0x90], eax
mov eax, dword [ebx + 0x94]
mov dword [edi + 0x94], eax
mov eax, dword [ebx + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [ebx + 0x9c]
mov dword [edi + 0x9c], eax
mov eax, dword [ebx + 0xa0]
mov dword [edi + 0xa0], eax
mov eax, dword [ebx + 0xa4]
mov dword [edi + 0xa4], eax
mov eax, dword [ebx + 0xa8]
mov dword [edi + 0xa8], eax
mov eax, dword [ebx + 0xac]
mov dword [edi + 0xac], eax
mov eax, dword [ebx + 0xb0]
mov dword [edi + 0xb0], eax
lea eax, [edi + 0xb4]
push esi
push eax
push dword [ebx + 0xb8]
push dword [ebx + 0xb4]
call sub.libcef.dll_cef_string_utf16_set
add esp, 0x40
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x49dc2d
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x4dbd3c
call fcn.004d5b70
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x49dd4a
cmp byte [ebx + 0x3e], 0
je 0x49dd4a
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.0049b6ce
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x49dc79
xor al, al
jmp 0x49dd4c
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0045b000
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x49dca9
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.0049b6ce
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x49dcde
sub eax, 1
je 0x49dce2
dec eax
sub eax, 1
je 0x49dd38
xor bl, bl
jmp 0x49dd3a
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x49dcf2
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x49dd1a
cmp eax, 0x10
jae 0x49dd01
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004ac1a6
add esp, 0x10
cmp esi, eax
jne 0x49dcda
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x49dd38
test esi, esi
jne 0x49dc9d
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00455410
jmp 0x49dc97
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00470850
mov al, bl
jmp 0x49dd4c
mov al, 1
call fcn.004d5b2b
ret

Function at 0x4b87fc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b84bf

Function at 0x4b8807
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b8640

Function at 0x4c0630
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x40724e
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x38], edi
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
call fcn.00407192
mov ebx, dword [ebp - 0x14]
mov eax, dword [esi + 8]
add ebx, 0x23f
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
push 0x20
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], eax
pop edi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov esi, dword [ebp - 8]
mov eax, esi
mov ecx, dword [0x74d3b4]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x4072d9
push 0x401124
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [0x74d3b4]
mov edx, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x74d3f8]
mov dword [ebp - 0x24], 0xedeb2e40
cmove eax, dword [ebp - 0x24]
and dword [ebp - 0x24], 0
cmp ecx, 0x3eb
mov dword [0x74d3f8], eax
mov eax, dword [0x74d400]
cmove eax, dword [ebp - 0x24]
mov dword [0x74d400], eax
lea eax, [ebx + esi]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x74d3fc], 0xf4ea3dee
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x1c]
sub edx, eax
mov dword [ebp - 0x10], eax
mov eax, edx
mov dword [ebp - 0x1c], edx
shl eax, 4
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, edx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
xor eax, dword [ebp - 0x24]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 8], eax
add ebx, 0x61c88647
mov dword [ebp - 0x14], ebx
dec edi
jne 0x40729e
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4073b8
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
shr esi, 3
push edi
mov edi, ecx
test esi, esi
je 0x4073f6
cmp dword [0x74d3b4], 0x959
jne 0x4073e6
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.0040724e
add edi, 8
dec esi
jne 0x4073c8
pop edi
pop esi
pop ebp
ret 4
Function at 0x410baf
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46e6f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a7e3
mov dword [ebp - 0x14], eax
cmp dword [0x74e194], esi
jne 0x410ca2
push 0x800
push esi
push 0x40511c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x410c2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x410d82
push esi
push esi
push 0x40511c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x410d82
push 0x405134
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410d82
push eax
call ebx
push 0x405140
push edi
mov dword [0x74e194], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405150
push edi
mov dword [0x74e198], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405164
push edi
mov dword [0x74e19c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x74e1a4], eax
test eax, eax
je 0x410c9f
push 0x405180
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x74e1a0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x410cc7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x410cba
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x410cdc
push 4
pop eax
jmp 0x410d84
cmp dword [ebp - 0x14], esi
je 0x410cdc
push dword [0x74e194]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x410cc1
mov eax, dword [0x74e1a0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x410d3a
cmp dword [0x74e1a4], edi
je 0x410d3a
push eax
call ebx
push dword [0x74e1a4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x410d3a
test eax, eax
je 0x410d3a
call ecx
test eax, eax
je 0x410d2f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x410d2f
test byte [ebp - 8], 1
jne 0x410d3a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x410d6a
mov eax, dword [0x74e198]
cmp eax, edi
je 0x410d67
push eax
call ebx
test eax, eax
je 0x410d67
call eax
mov esi, eax
test esi, esi
je 0x410d67
mov eax, dword [0x74e19c]
cmp eax, edi
je 0x410d67
push eax
call ebx
test eax, eax
je 0x410d67
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x74e194]
call ebx
test eax, eax
je 0x410d82
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x410d84
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409e1e
mov esp, ebp
pop ebp
ret
Function at 0x401317
Capabilities:
Read file on windows

Disassembly:
push 0x1c4
mov eax, 0x4326f9
call fcn.0041d016
mov ebx, ecx
xor edi, edi
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x1c8], 0x4066da
mov dword [ebp - 0x1c4], 0x406765
mov dword [ebp - 0x1c0], 0x4067a8
mov dword [ebp - 0x1bc], 0x4067eb
mov dword [ebp - 0x1b8], 0x40681d
mov dword [ebp - 0x1b4], 0x406873
mov dword [ebp - 0x1b0], 0x40689b
mov dword [ebp - 0x1ac], edi
call fcn.00405500
push str..zip
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], edi
call fcn.00405552
cmp dword [ebp - 0x18], 0x10
mov edx, dword [ebp - 0x2c]
jae 0x4013a2
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x1c8]
call fcn.00406a6a
mov esi, 0x4000
push esi
mov dword [ebp - 0x17c], eax
call fcn.00419cca
pop ecx
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x17c], edi
jne 0x4013e2
xor esi, esi
push edi
push 1
lea ecx, [ebp - 0x30]
call fcn.004057d3
mov eax, esi
call fcn.0041d060
ret
lea eax, [ebp - 0x174]
push eax
push ebx
mov dword [ebp - 0x194], edi
mov dword [ebp - 0x198], edi
mov dword [ebp - 0x19c], edi
mov dword [ebp - 0x1a0], edi
mov dword [ebp - 0x1a4], edi
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x190], edi
mov dword [ebp - 0x18c], edi
mov dword [ebp - 0x188], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401463
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x18e]
push eax
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x17c]
lea eax, [ebp - 0x1a8]
push 8
push eax
call fcn.00406b41
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x40150e
push 0x43a060
push dword [ebp - 0x178]
lea eax, [ebp - 0x180]
push eax
call fcn.0041a131
add esp, 0xc
cmp dword [ebp - 0x180], edi
je 0x401531
push dword [ebp - 0x180]
xor ebx, ebx
push esi
push 1
push dword [ebp - 0x184]
call fcn.0041a5fd
add esp, 0x10
cmp eax, esi
mov dword [ebp - 0x178], eax
jge 0x4014e5
push dword [ebp - 0x180]
call fcn.00419866
pop ecx
test eax, eax
jne 0x4014e5
or ebx, 0xffffffff
mov eax, dword [ebp - 0x178]
cmp eax, edi
jle 0x401502
mov ecx, dword [ebp - 0x184]
mov edx, dword [ebp - 0x17c]
call fcn.00406f6d
mov ebx, eax
cmp ebx, edi
jne 0x40150e
cmp dword [ebp - 0x178], edi
jg 0x4014af
cmp dword [ebp - 0x180], edi
je 0x401522
push dword [ebp - 0x180]
call fcn.0041ac71
pop ecx
cmp ebx, edi
jl 0x401531
mov ebx, dword [ebp - 0x17c]
call fcn.00407048
mov eax, dword [ebp - 0x17c]
call fcn.0040721b
xor esi, esi
inc esi
jmp 0x4013cf
Function at 0x401fe0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb98]
sub esp, 0xc18
mov eax, dword [0x4441c0]
xor eax, ebp
mov dword [ebp + 0xb94], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
mov word [ebp - 0x6c], ax
xor edi, edi
lea eax, [ebp - 0x6a]
push edi
push eax
call fcn.0041ca70
xor eax, eax
mov esi, 0x1fe
push esi
mov word [ebp + 0x794], ax
lea eax, [ebp + 0x796]
push edi
push eax
mov dword [ebp - 0x80], 0x800
call fcn.0041ca70
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x6c]
push eax
push str.ProductName
mov ebx, str.86D4B82A_ABED_442A_BE86_96357B70F4FE
push ebx
mov dword [ebp - 0x78], 0x200
call sub.msi.dll_MsiGetPropertyW
test eax, eax
jne 0x40213c
push str.Qbyrd_Toolbar
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40208c
push str.Search_Results_Toolbar
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40213c
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x794]
push eax
push str.VersionString
push ebx
call sub.msi.dll_MsiGetPropertyW
test eax, eax
jne 0x40213c
push 5
lea eax, [ebp + 0x794]
push str.1.7.1
push eax
call fcn.0041aa63
add esp, 0xc
test eax, eax
jne 0x40213c
mov dword [ebp - 0x70], edi
mov ebx, 0xf003f
call fcn.00411337
test eax, eax
je 0x4020da
mov ebx, 0xf013f
lea eax, [ebp - 0x70]
push eax
push ebx
push edi
push str.SOFTWAREClassesInstallerProductsA28B4D68DEBAA244EB686953B7074FEFSourceList
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40213c
push esi
mov word [ebp + 0x994], ax
lea eax, [ebp + 0x996]
push edi
push eax
call fcn.0041ca70
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x994]
push eax
push edi
push edi
mov esi, str.PackageName
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402156
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0xb94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004195cf
add ebp, 0xb98
leave
ret
push str.Ask_Toolbar.msi
lea eax, [ebp + 0x994]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x402179
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40213e
xor eax, eax
push 2
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x74]
push eax
push 1
push edi
push esi
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
inc edi
jmp 0x40216c
Function at 0x402763
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4441c0]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREAsk.com.tmpGeneral
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4027f6
push 0x206
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push ebx
push eax
call fcn.0041ca70
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x43a9b8
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4027ed
lea eax, [ebp - 0x74]
push eax
push esi
call fcn.0041a2f1
pop ecx
pop ecx
test eax, eax
je 0x4027ed
mov bl, 1
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x194]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004195cf
add ebp, 0x198
leave
ret
Function at 0x4068c7
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, dword [esp + 4]
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edi + edx*4]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edi + edx*4]
pop esi
mov dword [ecx + 8], eax
mov eax, dword [esp + 4]
ret

Function at 0x406ee5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [esi + 0x4090], eax
je 0x406f45
cmp dword [esi + 0x6c], eax
jbe 0x406f45
push ebx
mov dword [ebp - 4], 0xffffff78
sub dword [ebp - 4], esi
push edi
lea ebx, [esi + 0x88]
lea edx, [esi + 0x4094]
mov eax, edx
call fcn.004068aa
mov edi, dword [esi + 0x40a0]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx]
push eax
mov ecx, edx
call fcn.004068c7
mov al, byte [ebp - 0xc]
xor byte [ebx], al
mov eax, dword [ebp - 4]
add esp, 4
inc ebx
add eax, ebx
cmp eax, dword [esi + 0x6c]
jb 0x406f0f
pop edi
pop ebx
push dword [esi + 0x6c]
lea eax, [esi + 0x88]
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 8]
add esp, 0x10
cmp eax, dword [esi + 0x6c]
je 0x406f64
or dword [ebp - 8], 0xffffffff
and dword [esi + 0x6c], 0
mov eax, dword [ebp - 8]
leave
ret
Function at 0x407048
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push edi
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp + 8], edi
cmp ebx, edi
jne 0x407062
push 0xffffffffffffff9a
pop eax
jmp 0x407216
cmp dword [ebx + 0x2c], edi
je 0x40705a
cmp dword [ebx + 0x80], 8
push ebp
push esi
mov dword [ebx + 0x34], edi
jne 0x4070bf
cmp dword [ebx + 0x84], edi
jne 0x4070bf
lea ebp, [ebx + 0x30]
cmp dword [ebx + 0x40], 0
jne 0x40709d
mov esi, ebx
call fcn.00406ee5
lea eax, [ebx + 0x88]
mov dword [ebx + 0x40], 0x4000
mov dword [ebx + 0x3c], eax
mov esi, dword [ebx + 0x44]
push 4
push ebp
call fcn.0041578b
mov edi, eax
mov eax, dword [ebx + 0x44]
sub eax, esi
add dword [ebx + 0x6c], eax
pop ecx
pop ecx
test edi, edi
je 0x407080
cmp edi, 1
jne 0x4070bf
xor edi, edi
cmp dword [ebx + 0x6c], 0
jbe 0x4070d7
test edi, edi
jne 0x4070d7
mov esi, ebx
call fcn.00406ee5
cmp eax, 0xffffffff
jne 0x4070d7
or edi, eax
cmp dword [ebx + 0x80], 8
jne 0x4070f9
cmp dword [ebx + 0x84], 0
jne 0x407113
lea eax, [ebx + 0x30]
push eax
call fcn.00415efc
and dword [ebx + 0x68], 0
pop ecx
mov edi, eax
cmp dword [ebx + 0x84], 0
jne 0x407113
mov eax, dword [ebx + 0x408c]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x10], eax
mov esi, dword [ebx + 0x74]
mov ebp, dword [ebx + 0x40a4]
mov ecx, dword [esp + 0xc]
add ebp, dword [ebx + 0x44]
push 4
add esi, 0x10
pop edx
call fcn.004069ff
mov esi, dword [ebx + 0x74]
push 4
add esi, 0x14
pop edx
mov ecx, ebp
call fcn.004069ff
xor ecx, ecx
inc ecx
cmp dword [ebx + 0x5c], ecx
jne 0x407154
mov esi, dword [ebx + 0x74]
push 2
add esi, 0x24
pop edx
call fcn.004069ff
mov esi, dword [ebx + 0x74]
mov ecx, dword [esp + 0x10]
push 4
add esi, 0x18
pop edx
call fcn.004069ff
test edi, edi
jne 0x40717c
push dword [ebx + 0x78]
lea edi, [ebx + 0x24]
push dword [ebx + 0x74]
call fcn.00406928
pop ecx
pop ecx
mov edi, eax
push dword [ebx + 0x74]
call fcn.00419a5d
pop ecx
test edi, edi
jne 0x407208
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x70]
push edi
add eax, 0xe
push eax
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x18
test eax, eax
je 0x4071b3
or edi, 0xffffffff
jmp 0x4071ef
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x10]
push 4
pop esi
mov edi, ebx
call fcn.004069b6
mov edi, eax
pop ecx
test edi, edi
jne 0x4071ef
push dword [ebx + 0x20]
mov ecx, ebp
mov edi, ebx
call fcn.004069b6
mov edi, eax
pop ecx
test edi, edi
jne 0x4071ef
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.004069b6
pop ecx
mov edi, eax
push 0
push dword [esp + 0x18]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x10
test eax, eax
je 0x407208
or edi, 0xffffffff
inc dword [ebx + 0x40b0]
and dword [ebx + 0x2c], 0
pop esi
mov eax, edi
pop ebp
pop edi
add esp, 0xc
ret
Function at 0x4073df
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x81c0]
mov eax, 0x8240
call fcn.0042c140
mov eax, dword [0x4441c0]
xor eax, ebp
mov dword [ebp + 0x81bc], eax
push ebx
lea eax, [ebp - 0x54]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push 0x43bf18
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x4d], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407532
push 0x206
mov word [ebp + 0x7fb4], ax
lea eax, [ebp + 0x7fb6]
push ebx
push eax
call fcn.0041ca70
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x7fb4]
push eax
push dword [ebp - 0x54]
mov dword [ebp - 0x64], 0x104
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], 0x3fff
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x58], ebx
je 0x407529
push edi
xor edi, edi
cmp dword [ebp - 0x58], ebx
jbe 0x407528
push ebx
push ebx
push ebx
xor eax, eax
push ebx
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push edi
push dword [ebp - 0x54]
mov dword [ebp - 0x5c], 0x3fff
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40750b
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x16
jbe 0x40750b
mov ecx, str.GenericAskToolbar.dll
lea eax, [ebp + eax*2 - 0x76]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407502
cmp dx, bx
je 0x4074fe
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407502
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4074dc
xor eax, eax
jmp 0x407507
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x407513
inc edi
cmp edi, dword [ebp - 0x58]
jb 0x40749d
jmp 0x407528
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x407528
mov byte [ebp - 0x4d], 1
pop edi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x81bc]
mov al, byte [ebp - 0x4d]
xor ecx, ebp
pop ebx
call fcn.004195cf
add ebp, 0x81c0
leave
ret