joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5142e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x56c118
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x118]
test eax, eax
jne 0x514390
mov eax, dword [0xe0fe38]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.0055ac26
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.0055ac75
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.0055abd2
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x514377
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x514377
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x118], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.0055a842
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x517490
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56c5a0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x517637
mov ecx, dword [0xe0fe38]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x51758c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.005161b0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.0055a92f
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0055a842
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xe091a8
call fcn.0055a8b0
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.00516570
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.0055a92f
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.0055a842
lea ecx, [esp + 0xc]
call fcn.0055ad0a
mov ecx, dword [esp + 0xc]
push 0xe09be4
push ecx
call fcn.00536444
add esp, 8
test eax, eax
je 0x5175b4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x5174ed
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.0055a842
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0055a842
jmp 0x51763b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00517230
test eax, eax
push 0
je 0x51761f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.005158d0
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x517605
cmp eax, 0x64
jg 0x5175f3
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x517590
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x517590
cmp eax, 0x64
jge 0x51758c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x517590
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.005158d0
mov esi, eax
jmp 0x517590
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x517645
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x5214a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xe6a790]
xor edx, edx
cmp eax, edx
jne 0x5214c6
xor eax, eax
mov byte [eax + 0xe6a690], al
inc eax
cmp eax, 0x100
jl 0x5214ae
mov dword [0xe6a790], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xe6a690
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x521557
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x52152a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x5214f8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x5215d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x521623
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x52160a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x527fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56c8ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00528900
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xdd26cc
call fcn.0055a583
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x528073
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0055a583
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x52806c
push 0
mov ecx, eax
call fcn.0051f0e0
mov dword [esi + 0xc], eax
jmp 0x528075
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x528075
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x548433
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x548554
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x548538
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x54848a
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x548468
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x548f9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x548ff3
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x548ff3
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x548ff3
xor eax, eax
inc eax
jmp 0x548ff5
xor eax, eax
leave
ret 0x10
Function at 0x54901e
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x54908c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0xdd980c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x549083
cmp dword [ebp - 0xc], 4
jne 0x549083
cmp dword [ebp - 0x10], edi
je 0x549083
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0xe154e8], edi
xor eax, eax
jmp 0x5490cb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0xe154e8], edi
jge 0x5490c6
lea eax, [ebp - 0x34]
push eax
mov dword [0xe154e8], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x5490c6
cmp word [ebp - 0x14], 5
jb 0x5490c6
call fcn.00548ff9
test eax, eax
je 0x5490c6
emms
mov dword [0xe154e8], 1
mov eax, dword [0xe154e8]
pop edi
leave
ret

Function at 0x55cc4d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x55cc85
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0055ac9d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0055ac75
jmp 0x55cc91
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x55e343
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x55e385
call fcn.00564897
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x55e385
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x55e37c
xor eax, eax
jmp 0x55e38d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0055e393
pop edi
pop esi
pop ebx
ret 4

Function at 0x564dc7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x564df5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x564e13
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00564d2d
jmp 0x564e13
mov eax, dword [esi + 0x14]
test eax, eax
je 0x564e13
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00564d2d
test edi, edi
mov eax, edi
jne 0x564dfd
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x3af414e3
nop
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x4c432fd0
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x402940
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], 0xfffff000
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x18], 0x1000
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x41], 0x12
mov dword [ebp - 0x28], 0x4550
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0x5a4d
mov dword [ebp - 0x20], 0
mov edi, dword [ebp - 0x24]
mov word [ebp - 0x2e], memmove
mov byte [ebp - 0x35], 1
mov bl, byte [ebp - 0x35]
mov dword [ebp - 0x40], eax
mov word [ebp - 0xe], 0x1300
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], 0
cmp eax, 0
mov byte [ebp - 0x49], bl
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], edi
jne 0x4029e6
mov eax, 0
lea ecx, [ebp - 0xe]
mov edx, eax
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x3c], 0
mov esi, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1c]
and esi, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
jmp 0x402ae4
mov al, byte [ebp - 0x41]
and al, 0x32
mov byte [ebp - 0x41], al
mov word [ebp - 0xe], 0x6fc0
lea eax, [ebp - 0x41]
mov ecx, dword [ebp - 0x40]
mov dx, word [ebp - 0x2e]
mov si, ax
xor dx, si
mov word [ebp - 0x2e], dx
movzx eax, word [ecx]
mov ecx, dword [ebp - 0x5c]
cmp eax, ecx
jne 0x402a7a
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x34]
xor edx, 0
mov dword [ebp - 0x34], edx
mov si, word [ebp - 0x2e]
add si, 0x2a
mov word [ebp - 0x2e], si
mov edx, dword [ebp - 0x58]
cmp dword [ecx + eax], edx
jne 0x402a54
mov word [ebp - 0x2e], 0x5322
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
jmp 0x402ae4
lea eax, [ebp - 0x20]
mov ecx, 0
mov edx, dword [ebp - 0x34]
mov esi, ecx
sub esi, dword [ebp - 0x20]
mov dword [ebp - 0x34], esi
sub ecx, edx
mov di, word [ebp - 0x2e]
mov bx, ax
mov dword [ebp - 0x34], ecx
xor di, bx
mov word [ebp - 0x2e], di
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x54]
sub eax, ecx
mov edx, dword [ebp - 0x50]
and eax, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
add eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x41]
mov dx, word [ebp - 0x2e]
mov esi, dword [ebp - 0x1c]
xor esi, 0
mov dword [ebp - 0x1c], esi
mov di, cx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
or dx, di
mov dword [ebp - 0x34], eax
mov word [ebp - 0x2e], dx
mov bl, byte [ebp - 0x49]
test bl, 1
jne 0x4029f4
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x1c]
xor eax, 0
mov dword [ebp - 0x1c], eax
mov cl, byte [ebp - 0x41]
add cl, 0x43
mov byte [ebp - 0x41], cl
mov eax, 0
mov cl, byte [ebp - 0x41]
sub eax, dword [ebp - 0x1c]
mov dl, byte [ebp - 0x41]
xor dl, 0xeb
mov byte [ebp - 0x41], dl
or cl, 0xf8
mov byte [ebp - 0x41], cl
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x3c]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404900
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x431f1c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10], 0
je 0x404adb
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x40492c
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404adb
cmp dword [edi + 0x10], 0
je 0x404adb
push 0x100
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x130], 0x11c
push 0
push eax
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
call fcn.0040f0d0
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1a], ax
mov dword [ebp - 0x18], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [ebp - 0x130]
mov dword [ebp - 0x12c], 6
xor ecx, ecx
mov dword [ebp - 0x128], 2
push eax
mov word [ebp - 0x1c], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x404ac9
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x140], 0x10
jb 0x4049f9
mov edi, dword [edi]
lea eax, [ebp - 0x140]
mov dword [ebp - 0x13c], edi
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x16c], 0
push eax
push 0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x170], 0x30
mov dword [ebp - 0x164], 2
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 1
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x148], 0x1000
mov dword [ebp - 0x14], 0xaac56b
mov dword [ebp - 0x10], 0x11d0cd44
mov dword [ebp - 0xc], 0xc000c28c
mov dword [ebp - 8], 0xee95c24f
call sub.WINTRUST.dll_WinVerifyTrust
mov esi, eax
mov dword [ebp - 0x154], 2
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
call sub.WINTRUST.dll_WinVerifyTrust
test esi, esi
jne 0x404adb
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d173
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0040d173
mov esp, ebp
pop ebp
ret
Function at 0x406610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d683
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x431f1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
xor eax, eax
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 7
mov word [edi + 0xc], ax
lea esi, [edi + 0x28]
mov dword [edi + 0x24], eax
push 0x40
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0040ced6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xor eax, eax
mov word [edi + 0x30], ax
mov eax, edi
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4081e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d80e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x431f1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea ebx, [edi + 0x18]
mov dword [ebp - 4], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], 7
mov word [ebx], ax
lea esi, [edi + 0x30]
mov byte [ebp - 4], 1
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0040ced6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov esi, dword [ebp + 8]
mov byte [ebp - 4], 2
cmp edi, esi
je 0x40827c
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x408271
mov eax, dword [esi]
push dword [esi + 0x10]
mov ecx, edi
push eax
call fcn.00402690
push 1
push 0x422d48
mov ecx, edi
call fcn.00402510
push 0x10
push str.cfgsproduct.dat
mov ecx, eax
call fcn.00402510
cmp ebx, esi
je 0x4082b1
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4082a6
mov eax, dword [esi]
push dword [esi + 0x10]
mov ecx, ebx
push eax
call fcn.00402690
push 1
push 0x422d48
mov ecx, ebx
call fcn.00402510
push 0xc
push str.cfgsoem.ini
mov ecx, eax
call fcn.00402510
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4090e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x431f1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, edx
push esi
mov esi, dword [ebp + 0x10]
mov word [ebp - 0x1c], ax
lea eax, [ecx + 2]
mov dword [ebp - 0xc], 0
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 8], 7
mov dword [ebp - 0x20], eax
jmp 0x409120
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409120
sub ecx, dword [ebp - 0x20]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402690
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x24]
push ecx
push 0x20219
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 0
cmovae eax, dword [ebp - 0x1c]
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4091a3
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
add eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x20]
push eax
push 0
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x24]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4091a3
mov eax, dword [ebp - 0x20]
cmp eax, 1
je 0x40919f
cmp eax, 2
jne 0x4091a3
xor esi, esi
jmp 0x4091a8
mov esi, 0x80004005
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x4091de
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4091d4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4091f1
push edx
push ecx
call fcn.0040cf06
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d173
mov esp, ebp
pop ebp
ret
call fcn.00410b2a
int3