joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4227d4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
xor esi, esi
push dword [ebp + 8]
push str._AutoUp__BA_DeleteSummaryFileInDir__Start_Delete_Summary_File_:___s
push 1
call fcn.00408aae
push 0x44d338
push dword [ebp + 8]
call fcn.0041f276
add esp, 0x14
mov dword [ebp - 8], eax
test eax, eax
jne 0x422814
mov dword [ebp - 4], 3
jmp 0x422935
lea ecx, [ebp - 0x148]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x422838
and dword [ebp - 4], 0
jmp 0x422925
test byte [ebp - 0x148], 0x20
je 0x4228e9
lea eax, [ebp - 0x11c]
push eax
call fcn.00437370
cmp eax, 6
pop ecx
mov dword [ebp - 4], eax
jle 0x4228e9
push 2
lea eax, [ebp - 0x11c]
push 0x457314
push eax
call fcn.00429880
test eax, eax
jne 0x4228e9
mov eax, dword [ebp - 4]
push 4
push str..scd
lea eax, [ebp + eax - 0x120]
push eax
call fcn.00429880
test eax, eax
jne 0x4228e9
test esi, esi
je 0x42289a
push esi
call fcn.0042a5d0
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.0041f276
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x4228c7
lea eax, [ebp - 0x11c]
push eax
push str._AutoUp__BA_DeleteSummaryFileInDir__ERROR:_Create_pSummaryFilePath_Fail____s__
push 1
call fcn.00408aae
add esp, 0xc
push esi
call fcn.0041f8ad
pop ecx
test eax, eax
push esi
jne 0x4228da
push str._AutoUp__BA_DeleteSummaryFileInDir__INFO:_Success_Delete_Summary_File_:___s
jmp 0x4228df
push str._AutoUp__BA_DeleteSummaryFileInDir__INFO:_Fail_Delete_Summary_File_:___s
push 1
call fcn.00408aae
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x422838
push ebx
call edi
push dword [ebp + 8]
and dword [ebp - 4], 0
or ebx, 0xffffffff
push str._AutoUp__BA_DeleteSummaryFileInDir__End_Delete_Summary_File_:___s
push 1
call fcn.00408aae
add esp, 0xc
test esi, esi
je 0x422925
push esi
call fcn.0042a5d0
push dword [ebp - 8]
call fcn.0042a5d0
cmp ebx, 0xffffffff
je 0x422935
push ebx
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x422b10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push str.PerfStatsStartStat
push 0x80000006
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x422bd3
push ebx
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
push dword [ebp + 0xc]
mov ebx, eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea eax, [ebx + eax + 2]
push eax
push 0x40
call esi
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push str._s_s
push ebx
call fcn.00437b3a
add esp, 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push edi
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push dword [ebp - 4]
call edi
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x422bc1
push dword [ebp - 8]
push 0x40
call esi
mov esi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push esi
push eax
push 0
push ebx
push dword [ebp - 4]
call edi
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
pop edi
leave
ret 8

Function at 0x422bdb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call esi
push dword [ebp + 0xc]
mov ebx, eax
call esi
lea eax, [ebx + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push str._s_s
push ebx
call fcn.00437b3a
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push str.PerfStatsStatData
push 0x80000006
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x422c6c
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push eax
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x422c7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push str.PerfStatsStopStat
push 0x80000006
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x422d3f
push ebx
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
push dword [ebp + 0xc]
mov ebx, eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea eax, [ebx + eax + 2]
push eax
push 0x40
call esi
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push str._s_s
push ebx
call fcn.00437b3a
add esp, 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push edi
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push dword [ebp - 4]
call edi
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x422d2d
push dword [ebp - 8]
push 0x40
call esi
mov esi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push esi
push eax
push 0
push ebx
push dword [ebp - 4]
call edi
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
pop edi
leave
ret 8

Function at 0x422d9a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 4], edi
je 0x422daf
mov eax, 0xb7
jmp 0x422e1a
mov eax, dword [ebp + 8]
cmp eax, 0xa
jb 0x422e17
cmp eax, 0x64
ja 0x422e17
push 0x32
mov dword [esi + 0xc], eax
pop ecx
mov dword [ebp + 8], edi
mov edx, ecx
cmp edx, eax
sbb edx, edx
and edx, ecx
add edx, ecx
cmp ecx, eax
sbb ecx, ecx
mov dword [esi + 0x14], edx
and ecx, 0xc8
add ecx, 0x12c
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x10], eax
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x422e8e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x422e13
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x422e1a
xor eax, eax
jmp 0x422e1a
push 0x57
pop eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x424472
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push edi
push 7
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x2b]
mov byte [ebp - 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0x20
cmp eax, ebx
je 0x42453e
cmp dword [ebp + 0xc], ebx
je 0x42453e
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.SoftwareNetscapeNetscape_Navigator
push 0x80000002
call edi
test eax, eax
jne 0x42453e
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
push str.CurrentVersion
push dword [ebp - 8]
call esi
test eax, eax
jne 0x424534
push 0x1f
lea eax, [ebp - 0x2c]
push str.Main
push eax
call fcn.004390ab
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x20019
lea eax, [ebp - 0x2c]
push ebx
push eax
push dword [ebp - 8]
call edi
test eax, eax
jne 0x424534
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
push ebx
push str.Plugins_Directory
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebx
leave
ret
Function at 0x424542
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4246d7
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4246d7
cmp dword [ebp + 0x10], 0
je 0x4246d7
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4246d7
cmp dword [ebp + 0x18], 0
je 0x4246d7
and byte [edi], 0
cmp byte [esi], 0x2e
jne 0x4245a1
cmp byte [esi + 1], 0x5c
jne 0x4245a1
add esi, 2
push esi
push dword [ebp + 0x10]
push ebx
push edi
call fcn.0042527d
add esp, 0x10
jmp 0x4246c4
push 9
push str.WINSYSTEM
push esi
call fcn.004361cb
add esp, 0xc
test eax, eax
jne 0x4245cf
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [esi + 9], 0x5c
jne 0x4246c4
add esi, 0xa
jmp 0x424674
push 0xb
push str.WINCOMMON64
push esi
call fcn.004361cb
add esp, 0xc
test eax, eax
jne 0x424607
push 1
push ebx
push edi
call fcn.00425900
add esp, 0xc
cmp byte [edi], 0
je 0x4246d7
cmp byte [esi + 0xb], 0x5c
jne 0x4246c4
add esi, 0xc
jmp 0x424674
push 9
push str.WINCOMMON
push esi
call fcn.004361cb
add esp, 0xc
test eax, eax
jne 0x424631
push eax
push ebx
push edi
call fcn.00425900
add esp, 0xc
cmp byte [edi], 0
je 0x4246d7
jmp 0x4245bd
push 3
push 0x457598
push esi
call fcn.004361cb
add esp, 0xc
test eax, eax
jne 0x424658
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [esi + 3], 0x5c
jne 0x4246c4
add esi, 4
jmp 0x424674
cmp byte [esi], 0x24
jne 0x42467b
cmp byte [esi + 1], 0x57
jne 0x42467b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [esi + 2], 0x5c
jne 0x4246c4
add esi, 3
push esi
push edi
jmp 0x424592
push 0xe
push str.NETSCAPEPLUGIN
push esi
call fcn.004361cb
add esp, 0xc
test eax, eax
jne 0x4246dc
push ebx
push edi
call fcn.00424472
cmp byte [edi], 0
pop ecx
pop ecx
je 0x4246b7
cmp byte [esi + 0xe], 0x5c
jne 0x4246b2
add esi, 0xf
push esi
push edi
push ebx
push edi
call fcn.0042527d
add esp, 0x10
cmp byte [edi], 0
jne 0x4246c9
push ebx
push dword [ebp + 0x10]
push edi
call fcn.004363c3
add esp, 0xc
cmp byte [edi], 0
je 0x4246d7
push dword [ebp + 0x18]
push edi
push ebx
push edi
call fcn.0042527d
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
cmp byte [esi], 0
je 0x4246b7
cmp byte [esi + 1], 0x3a
jne 0x4246b7
push ebx
push esi
jmp 0x4246bb
Function at 0x4247e9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x62b]
mov byte [ebp - 0x62c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, str.version.dll
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x127]
mov byte [ebp - 0x128], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x22b]
mov byte [ebp - 0x22c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x4249cf
cmp dword [ebp + 0x14], ebx
je 0x4249cf
push dword [ebp + 0xc]
mov byte [eax], bl
lea eax, [ebp - 0x62c]
push dword [ebp + 8]
push 0x400
push eax
call fcn.0042527d
add esp, 0x10
mov esi, 0x104
lea eax, [ebp - 0x128]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4249cf
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.0042527d
add esp, 0x10
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0xc], edi
je 0x4249cf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetFileVersionInfoA
push edi
call esi
push str.GetFileVersionInfoSizeA
push edi
mov dword [ebp + 8], eax
call esi
push str.VerQueryValueA
mov edi, eax
push dword [ebp - 0xc]
call esi
cmp dword [ebp + 8], ebx
mov dword [ebp - 8], eax
je 0x4249c2
cmp edi, ebx
je 0x4249c2
cmp eax, ebx
je 0x4249c2
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x62c]
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x4249bf
push esi
call fcn.00436f7e
mov edi, eax
pop ecx
cmp edi, ebx
je 0x4249bf
push edi
push esi
push dword [ebp - 0x14]
lea eax, [ebp - 0x62c]
push eax
call dword [ebp + 8]
test eax, eax
je 0x4249b8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
push str.VarFileInfoTranslation
push edi
call dword [ebp - 8]
test eax, eax
je 0x4249b8
cmp dword [ebp - 0x18], ebx
je 0x4249b8
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
movzx eax, word [eax]
shr ecx, 0x10
push ecx
push eax
lea eax, [ebp - 0x82c]
push str.StringFileInfo_04hX_04hXFileVersion
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x82c]
push eax
push edi
call dword [ebp - 8]
test eax, eax
je 0x4249b8
cmp dword [ebp - 0x10], ebx
je 0x4249b8
cmp dword [ebp + 0xc], ebx
je 0x4249b8
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp - 4], 1
push edi
call fcn.00436e95
pop ecx
mov ebx, dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
jmp 0x4249d1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x424a69
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
mov byte [ebp - 0x400], bl
push dword [ebp + 0xc]
xor esi, esi
rep stosd dword es:[edi], eax
push dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x400]
push 0x400
push eax
call fcn.0042527d
add esp, 0x10
lea eax, [ebp - 0x400]
push ebx
push ebx
push 3
push ebx
push 1
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x424adf
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x424ad8
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x424f37
Capabilities:
Read file on windows

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0043df3e
add esp, 0xc
cmp eax, 0xffffffff
jne 0x424f58
call fcn.00438e8b
mov eax, dword [eax]
ret
sub eax, dword [esp + 0xc]
neg eax
sbb eax, eax
and eax, 5
ret

Function at 0x4253a3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov dword [ebx], esi
jne 0x4253bd
mov dword [ebx], 0x16
jmp 0x4253f9
push 0x8000
push dword [ebp + 8]
call fcn.00439173
mov edi, eax
pop ecx
cmp edi, 0xffffffff
pop ecx
mov dword [ebp + 8], edi
je 0x4253f0
push 2
push esi
push edi
call fcn.0043e8e9
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x4253fd
push edi
call fcn.0043db67
pop ecx
call fcn.00438e8b
mov eax, dword [eax]
mov dword [ebx], eax
xor eax, eax
jmp 0x425466
push 0
push 0
push edi
call fcn.0043e8e9
lea eax, [esi + 2]
push eax
call fcn.00436f7e
mov edi, eax
add esp, 0x10
test edi, edi
je 0x425443
push esi
push edi
push dword [ebp + 8]
call fcn.0043df3e
add esp, 0xc
cmp eax, esi
jne 0x425438
and byte [edi + esi], 0
and byte [edi + esi + 1], 0
lea eax, [edi + esi]
jmp 0x425449
call fcn.00438e8b
mov eax, dword [eax]
mov dword [ebx], eax
jmp 0x425449
mov dword [ebx], 0xc
push dword [ebp + 8]
call fcn.0043db67
cmp dword [ebx], 0
pop ecx
je 0x425464
test edi, edi
je 0x425464
push edi
call fcn.00436e95
pop ecx
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x425800
Capabilities:
Get common file path

Disassembly:
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x425843
push str.GetSystemWindowsDirectoryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x425843
push dword [esp + 8]
push dword [esp + 8]
call eax
test eax, eax
jne 0x425851
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AIL:GetSystemWindowsDirectory_err_d
push 1
call fcn.00408aae
add esp, 0xc
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
ret
Function at 0x4259b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4259be
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp word [ebp + 0x10], 0
not eax
je 0x4259ef
push esi
movzx edx, byte [ecx]
movzx esi, al
add dword [ebp + 0x10], 0xffff
xor edx, esi
shr eax, 8
mov edx, dword [edx*4 + 0x457ab8]
xor eax, edx
inc ecx
cmp word [ebp + 0x10], 0
jne 0x4259cb
pop esi
not eax
pop ebp
ret

Function at 0x425a54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0040ce9d
mov edi, eax
test edi, edi
je 0x425a9e
mov ecx, edi
call fcn.0040cfad
mov esi, dword [ebp + 0x1c]
push eax
push esi
push edi
push 0x457eb8
push 1
call fcn.00408aae
add esp, 0x14
mov ecx, edi
call fcn.0040cfad
test eax, eax
je 0x425a9e
neg esi
sbb esi, esi
and esi, 0xffffff00
add esi, 0x20219
jmp 0x425aa3
mov esi, 0x20019
test edi, edi
je 0x425aaf
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
lea eax, [ebp - 4]
push eax
push esi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x425ae8
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x42766d
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
mov word [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x80000002
call fcn.0042782a
add esp, 8
test eax, eax
jne 0x427696
jmp 0x427824
mov word [ebp - 4], 0
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42781e
push str.GetUserDefaultUILanguage
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4276d8
call dword [ebp - 0xc]
mov word [ebp - 4], ax
jmp 0x427814
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 4], ax
mov dword [ebp - 0xa0], 0x94
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x427814
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0xa4], 0x200
mov dword [ebp - 0x2ac], 1
cmp dword [ebp - 0x90], 2
jne 0x427797
lea eax, [ebp - 0x2a8]
push eax
push str..DEFAULTControl_PanelInternational
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x427788
lea ecx, [ebp - 0xa4]
push ecx
lea edx, [ebp - 0x2a4]
push edx
lea eax, [ebp - 0x2ac]
push eax
push 0
push str.Locale
mov ecx, dword [ebp - 0x2a8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x427788
lea edx, [ebp - 4]
push edx
push 0x45db10
lea eax, [ebp - 0x2a4]
push eax
call fcn.00435da0
add esp, 0xc
mov ecx, dword [ebp - 0x2a8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x427814
mov dword [ebp - 0x90], 1
cmp dword [ebp - 0x90], 0
je 0x427814
lea edx, [ebp - 0x2a8]
push edx
push str.Control_PanelDesktopResourceLocale
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x427807
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x2a4]
push ecx
lea edx, [ebp - 0x2ac]
push edx
push 0
push 0
mov eax, dword [ebp - 0x2a8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x427807
lea ecx, [ebp - 4]
push ecx
push 0x45db58
lea edx, [ebp - 0x2a4]
push edx
call fcn.00435da0
add esp, 0xc
mov eax, dword [ebp - 0x2a8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ax, word [ebp - 4]
jmp 0x427826
jmp 0x42781e
mov esp, ebp
pop ebp
ret

Function at 0x428ef2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push esi
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x428f33
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x428f38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0040ce9d
mov esi, eax
test esi, esi
je 0x428f5a
mov ecx, esi
call fcn.0040cfad
cmp eax, 1
mov edi, 0x20119
je 0x428f5f
mov edi, 0x20019
test esi, esi
je 0x428f6b
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
lea eax, [ebp - 4]
push eax
push edi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x428fa4
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x42ad30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x42ad3d
xor eax, eax
ret 0xc
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x42ae40
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4477a0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4477a0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4477a0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4477a0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4477a0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4477a0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4477a0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4477a0]
xor eax, edx
inc ecx
dec edi
jne 0x42ad58
pop edi
test esi, esi
je 0x42ae62
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4477a0]
xor eax, edx
inc ecx
dec esi
jne 0x42ae44
pop esi
pop ebx
not eax
ret 0xc