joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41be60
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x43745b
mov eax, dword fs:[0]
push eax
mov eax, 0x2208
call fcn.004342f0
mov eax, dword [0x4508cc]
xor eax, esp
mov dword [esp + 0x2204], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4508cc]
xor eax, esp
push eax
lea eax, [esp + 0x221c]
mov dword fs:[0], eax
push 0x45f6b0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, 1
mov dword [esp + 0x14], esi
xor edi, edi
cmp dword [0x45f6cc], edi
mov dword [esp + 0x2224], edi
je 0x41bed0
cmp dword [0x45f6d0], edi
jne 0x41c02b
mov word [esp + 0x218], di
call fcn.0041bcd0
test eax, eax
jge 0x41bf06
push 0x1000
push str.This_program_requires_the_file_advrcntr3.dll__which_was_not_found_on_this_system.
lea eax, [esp + 0x220]
push 0x1000
push eax
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
add esp, 0x10
jmp 0x41bfa1
mov ebp, dword [esp + 0x2230]
mov ebx, dword [esp + 0x222c]
push ebp
push ebx
call fcn.0041bdb0
add esp, 8
test eax, eax
jge 0x41c02b
test bl, bl
je 0x41bf5b
push ebp
push 0
call fcn.0041bdb0
add esp, 8
test eax, eax
jl 0x41bf5b
mov ebp, dword [0x45f6d0]
add ebp, 0x14
push ebp
mov esi, 2
call fcn.0041be10
add esp, 4
test eax, eax
je 0x41bf5b
mov ecx, dword [ebp]
call ecx
mov edi, eax
mov edx, dword [esp + 0x2230]
mov eax, dword [esp + 0x2238]
mov ecx, dword [esp + 0x2234]
push edx
push eax
push ecx
push edi
push 0x12c
push 0x1fe
push esi
push str.Fatal_Error:_r_nInstallation_corrupted___please_reinstall_NERO__r_n_r_nError_Code:__i____i____i____i_r_nParameters:__i____i____i_r_nSee_Doc4536
push 0x1000
lea edx, [esp + 0x23c]
push 0x1000
push edx
call dword [sym.imp.MSVCR80.dll__snwprintf_s]
add esp, 0x2c
xor edi, edi
push 0x45f6b0
mov dword [0x45f6d0], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x43f778]
mov cx, word [0x43f77c]
push 0x1fa
lea edx, [esp + 0x22]
push edi
push edx
mov dword [esp + 0x24], eax
mov word [esp + 0x28], cx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x100
lea eax, [esp + 0x1c]
push eax
push str.NeroSuppressProxyCheck
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x41c005
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCR80.dll__wtoi]
add esp, 4
test eax, eax
jne 0x41c024
test byte [0x45f6d4], 1
jne 0x41c024
push 0x10
push str.Nero
lea edx, [esp + 0x220]
push edx
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0x80004005
jmp 0x41c038
push 0x45f6b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x221c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2204]
xor ecx, esp
call fcn.00412bbe
add esp, 0x2214
ret
Function at 0x41f540
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x437749
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4508cc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x84], 0
jne 0x41f600
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
push 0x410
push 0x410
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_2460]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC80U.DLL_Ordinal_5398]
push 0x4403a4
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC80U.DLL_Ordinal_899]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41f5ef
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorW]
test eax, eax
je 0x41f5ef
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x84], eax
mov dword [edi + 0xf8], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x41ffb0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x437885
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4508cc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
call sub.MFC80U.DLL_Ordinal_572
xor edi, edi
mov dword [esi], vtable.CXHTMLStatic.0
mov dword [esp + 0x24], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x6c], vtable.CFont.0
lea ebx, [esi + 0x78]
mov ecx, ebx
mov byte [esp + 0x24], 1
call sub.MFC80U.DLL_Ordinal_530
lea ebp, [esi + 0x8c]
mov ecx, ebp
mov byte [esp + 0x24], 2
call sub.MFC80U.DLL_Ordinal_557
push 0xf
mov byte [esp + 0x28], 3
call dword [sym.imp.USER32.dll_GetSysColor]
push 8
mov dword [esi + 0x54], eax
call dword [sym.imp.USER32.dll_GetSysColor]
push 0xffffffffffffffff
push edi
mov ecx, ebx
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0x74], edi
call sub.MFC80U.DLL_Ordinal_6001
push 0xffffffffffffffff
push edi
mov ecx, ebp
call sub.MFC80U.DLL_Ordinal_6002
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
push 0x410
push 0x411
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 4
call dword [sym.imp.MFC80U.DLL_Ordinal_2460]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC80U.DLL_Ordinal_5398]
push 0x4403a4
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC80U.DLL_Ordinal_899]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x4200df
push 0x6a
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
cmp eax, edi
je 0x4200df
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [esi + 0xa8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x422840
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp], 4
je 0x42287d
mov eax, 0xd
add esp, 8
ret 8
Function at 0x422a50
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x437f4a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4508cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x14], 0
cmp byte [ebp + 0x7c], 0
jne 0x422bc6
cmp byte [ebp + 0x13c], 0
mov ebx, dword [esp + 0x28]
je 0x422b40
lea esi, [ebp + 0x138]
push ebx
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
push 0x440f90
push 0x43bc54
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_5485]
lea edi, [ebp + 0x134]
push esi
mov ecx, edi
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
push str._br_
push 0x43bc54
mov ecx, edi
call dword [sym.imp.MFC80U.DLL_Ordinal_5485]
push 0x43bc54
push str._br_
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_5485]
push 0x43bc54
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_899]
push 0
push 0x3c
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_2260]
mov edi, eax
test edi, edi
jl 0x422b40
lea ecx, [ecx]
push edi
push 0x3e
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_2260]
cmp eax, edi
jle 0x422b2e
sub eax, edi
add eax, 1
push eax
push edi
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_1906]
push 0
push 0x3c
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_2260]
mov edi, eax
test edi, edi
jge 0x422b10
push ebp
call sub.MFC80U.DLL_Ordinal_1091
cmp byte [ebp + 0x13c], 0
je 0x422b57
lea eax, [ebp + 0x138]
jmp 0x422b72
push ebx
lea ecx, [esp + 0x2c]
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], 1
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [eax]
push ecx
push edx
push eax
call sub.MFC80U.DLL_Ordinal_1118
test byte [esp + 0x14], 1
mov dword [ebp + 0x78], eax
je 0x422b98
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
cmp byte [ebp + 0x7c], 0
mov eax, dword [ebp + 0x78]
je 0x422bc9
cmp eax, 2
je 0x422bc9
mov ecx, dword [ebp + 0x80]
mov edx, dword [ebp + 0x74]
push 4
mov dword [esp + 0x34], eax
lea eax, [esp + 0x34]
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 0x78]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x4244d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x438568
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4508cc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
lea edx, [edi + 0x14]
mov dword [esi + 0x10], ecx
push edx
lea ecx, [esi + 0x14]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
add edi, 0x4c
push edi
lea ecx, [esi + 0x4c]
mov byte [esp + 0x1c], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x427f10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x438568
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4508cc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x14]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov eax, dword [esp + 0x20]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x427f90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4385a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4508cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esi + 0x10]
push eax
mov dword [esp + 0x18], 1
mov dword [esi], 0
call sub.MFC80U.DLL_Ordinal_764
add esp, 4
lea ecx, [esi + 0x4c]
mov dword [esi + 0x10], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esi + 0x14]
mov dword [esp + 0x14], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x428152
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4508cc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx], 0xffffffff
je 0x428192
call fcn.004280ba
push 7
lea ecx, [ebp - 0x14]
push ecx
movzx eax, ax
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x428192
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR80.dll__wtoi]
pop ecx
jmp 0x428194
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412bbe
leave
ret
Function at 0x4282fb
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4508cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x42832d
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
jmp 0x4283ad
push esi
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
test esi, esi
pop ecx
jne 0x428344
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
jmp 0x4283ac
push esi
push dword [ebp - 0x18]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x428365
push esi
call dword [sym.imp.MSVCR80.dll_free]
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
jmp 0x4283ab
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x43f3f4
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x428354
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
push ecx
movzx ecx, word [eax + 0x16]
push ecx
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00428217
push esi
call dword [sym.imp.MSVCR80.dll_free]
lea esi, [ebp - 0x10]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00412bbe
leave
ret
Function at 0x42b860
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x438b9b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4508cc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CNMFUri.0
xor ebx, ebx
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov byte [esi + 7], bl
mov dword [esi + 8], 0xffffffff
mov byte [esi + 0xc], bl
lea ecx, [esi + 0x14]
mov dword [esi + 0x10], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x68]
mov byte [esp + 0x18], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x84]
mov byte [esp + 0x18], 3
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0xa0]
mov byte [esp + 0x18], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0xbc]
mov byte [esp + 0x18], 5
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0xd8]
mov byte [esp + 0x18], 6
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0xf4]
mov byte [esp + 0x18], 7
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x110]
mov byte [esp + 0x18], 8
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [esi + 0x130], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4332d0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi], 0
jne 0x43330a
mov ecx, dword [esi + 0x18]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x4332a0
push ecx
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
test eax, eax
mov dword [esi], eax
je 0x433301
pop esi
mov al, 1
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x14], eax
pop esi
mov al, bl
pop ebx
ret

Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x7c4b618f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x5632683a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x4190aa
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x57c
mov dword [esp], 0x10001
push esp
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 8]
cmp eax, 0x3ff
jae 0x4190cd
adc ch, al
adc eax, 0x85000000
sal byte [edx + ecx - 1], 0xe0
retf 4
call 0x4190e7
test eax, eax
je 0x4190e0
jmp eax
leave
push 0x42
adc byte [eax + 0x44], al
add byte [esp + edx*2 + 0x54], dl
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test eax, eax
jne 0x4190f6
call dword [sym.imp.ODBC32.dll_SQLBulkOperations]
and eax, 0x7fff
cmp byte [eax + 0x44], al
add byte [0x7fff], ah
sub ax, 0x7ffc
ror eax, 0xff
rol eax, 2
push esp
push esp
call dword [eax*4 + fcn.00443ff8]
and eax, 6
sub ax, 0x55
or eax, 0xffff0000
add eax, 0x419224
pop ecx
jmp ecx

Function at 0x4190e7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x57c
mov dword [esp], 0x10001
push esp
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 8]
cmp eax, 0x3ff
jae 0x4190cd
adc ch, al
adc eax, 0x85000000
sal byte [edx + ecx - 1], 0xe0
retf 4
call 0x4190e7
test eax, eax
je 0x4190e0
jmp eax
leave
push 0x42
adc byte [eax + 0x44], al
add byte [esp + edx*2 + 0x54], dl
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test eax, eax
jne 0x4190f6
call dword [sym.imp.ODBC32.dll_SQLBulkOperations]
and eax, 0x7fff
cmp byte [eax + 0x44], al
add byte [0x7fff], ah
sub ax, 0x7ffc
ror eax, 0xff
rol eax, 2
push esp
push esp
call dword [eax*4 + fcn.00443ff8]
and eax, 6
sub ax, 0x55
or eax, 0xffff0000
add eax, 0x419224
pop ecx
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0xa462b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0xa462ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa462d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa462c0
mov eax, 1
add ebx, ebx
jne 0xa462e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa462d8
jne 0xa462f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa462d8
xor ecx, ecx
sub eax, 3
jb 0xa46308
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa4637a
mov ebp, eax
add ebx, ebx
jne 0xa46313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xa46320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xa46344
inc ecx
add ebx, ebx
jne 0xa46330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa46325
jne 0xa46341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa46325
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa46364
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa46355
jmp 0xa462c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa46364
add edi, ecx
jmp 0xa462c6
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0xa463c3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1606c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa46381
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16074]
or eax, eax
je 0xa463bd
mov dword [ebx], eax
add ebx, 4
jmp 0xa4639e
call dword [esi + 0x16070]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xa463f4
cmp al, 0xef
ja 0xa463e7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xa463c9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xa463d6
mov ebp, dword [esi + 0x16078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa46428
sub esp, 0xffffff80
jmp 0xa35dd2