joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a518
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45a52f
add esp, 0xfffffff0
call fcn.00403608
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d694
mov eax, dword [0x46e620]
cmp word [eax + 2], 0
jne 0x45a557
mov eax, dword [0x46e620]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045bbf0
mov eax, dword [0x46e6dc]
cmp word [eax + 2], 0
jne 0x45a571
mov eax, dword [0x46e6dc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045bde8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415058]
call fcn.004032b4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415058]
call fcn.004032b4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41fba0]
call fcn.004275f8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45a6f8
mov eax, dword [0x46e534]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004279c8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45c388
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46e534]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c5a4
test eax, eax
je 0x45a666
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408848
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c5cc
test eax, eax
je 0x45a67a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004042a4
mov eax, dword [0x46e3f8]
cmp byte [eax], 0
jne 0x45a6ae
mov eax, ebx
call fcn.0045a820
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045c564
mov eax, ebx
call fcn.0045cf28
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45a6ee
call fcn.00403660
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45aaa0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46fbbc]
cmp dword [eax + 0x30], 0
je 0x45ab4a
cmp dword [ebx + 0x94], 0
jne 0x45ab44
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45aa30
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45ab44
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45ab0a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45ab44
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041754c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45ab19
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45b6ac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45b6e1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404124
jmp 0x45b6ee
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404088
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45c740
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45c781
mov eax, esi
call fcn.00442684
test al, al
je 0x45c781
mov eax, dword [ebx + 0x84]
call fcn.00442380
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c781
push 0
mov eax, dword [ebx + 0x84]
call fcn.00442380
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45d440
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4145f8]
call fcn.004049a0
xor eax, eax
push ebp
push 0x45d584
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46de2c], 0
jne 0x45d493
mov ecx, dword [0x46e408]
mov dl, 1
mov eax, dword [0x40720c]
call fcn.0040b850
call fcn.00403a70
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402cf8
mov eax, ebx
call fcn.00404870
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45d594
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405924
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404880
test eax, eax
jle 0x45d52b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45d524
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004042bc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004042a4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408018
test eax, eax
jne 0x45d524
mov ebx, 0x15
jmp 0x45d530
mov ebx, 0x10
jmp 0x45d530
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x46de2c]
call fcn.0045d398
mov eax, dword [ebp - 8]
call fcn.0045d398
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.0040593c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d58b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404058
lea eax, [ebp - 0x10]
mov edx, dword [0x4145f8]
call fcn.00404a70
ret

Function at 0x465cf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00421650
cmp ebx, dword [ebp - 8]
jge 0x465d5b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00421918
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00421918
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00421944
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x465d21
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x465d64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00421650
cmp ebx, dword [ebp - 8]
jge 0x465dc7
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00421918
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00421918
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00421944
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x465d8d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x401400
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x426104], 0
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov esi, eax
mov edi, 0x433948
jne 0x4014de
xor edx, edx
lea ecx, [ecx]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x426100], ecx
inc edx
cmp edx, 0x100
jl 0x401420
not ebp
mov eax, ebp
test esi, esi
jbe 0x40150b
jmp 0x4014f0
movzx edx, byte [edi]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x426100]
dec esi
inc edi
test esi, esi
ja 0x4014f0
pop edi
pop esi
not eax
pop ebp
ret 4

Function at 0x401700
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x110
mov eax, dword [0x42419c]
xor eax, esp
mov dword [esp + 0x10c], eax
mov ecx, dword [0x4436d0]
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
or ecx, 8
push ecx
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4017f2
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x105
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
test eax, eax
jne 0x40179e
mov ebp, dword [esp + 0x12c]
lea ebx, [ebx]
mov edx, dword [esp + 0x10]
test ebp, ebp
jne 0x4017e6
push ebp
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.00401700
test eax, eax
jne 0x40179e
mov ecx, dword [esp + 0x10]
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
push ecx
call esi
test eax, eax
je 0x401770
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [str.ADVAPI32]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x4017c5
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x40180d
mov ecx, dword [str.RegDeleteKeyExA]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40180d
mov edx, dword [0x4436d0]
push 0
push edx
push ebx
push edi
call eax
jmp 0x4017f2
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040f602
add esp, 0x110
ret 0xc
cmp dword [0x4436d0], 0
jne 0x4017ed
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x4017ed
jmp 0x4017f2
Function at 0x404bf0
Capabilities:
Create directory

Disassembly:
push 0x44a400
call fcn.00408610
mov cl, byte [0x44a400]
mov al, cl
or al, 0x20
cmp cl, 0x5c
mov cl, byte [0x44a401]
jne 0x404c14
cmp cl, 0x5c
je 0x404c22
sub al, 0x61
cmp al, 0x19
ja 0x404c1f
cmp cl, 0x3a
je 0x404c22
xor eax, eax
ret
push 0x44a400
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + 0x44a400]
push eax
push 0x44a400
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
je 0x404c54
push 0x420124
push 0x44a400
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x44a400
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x44a400
push 0x44a000
call fcn.00407f90
ret
Function at 0x407900
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x43de08
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
mov dword [0x43de08], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x407933
add esp, 0x14
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp]
add esp, 0x14
ret

Function at 0x4079c0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
mov bl, byte [esp + 8]
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
cmp edi, 0xffffffff
je 0x407a1b
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
and eax, 0xfffffffe
push eax
push esi
call ebp
push esi
test bl, 1
je 0x4079fd
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x407a12
pop edi
pop ebp
mov eax, 1
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x407a12
pop edi
pop ebp
mov eax, 1
pop ebx
ret 4
test bl, 4
jne 0x407a1b
push edi
push esi
call ebp
pop edi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x407db0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push 0x400
push eax
push 0x43de50
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, 0x43de50
call fcn.00407d50
mov esi, eax
test esi, esi
jne 0x407dd8
pop edi
xor eax, eax
pop esi
ret
push esi
call fcn.00408610
test byte [0x441608], 0x80
je 0x407df1
mov al, byte [esi]
test al, al
je 0x407dd3
cmp al, 0x5c
je 0x407dd3
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
push ebp
push 0x43de50
sub esi, 0x43de50
call edi
cmp eax, esi
mov ebp, dword [sym.imp.USER32.dll_CharPrevA]
jle 0x407e72
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
jmp 0x407e20
push 0x43e650
push 0x43de50
call ebx
cmp eax, 0xffffffff
je 0x407e41
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [0x43e650], 0x10
je 0x407eb6
push 0x43de50
call edi
add eax, 0x43de50
lea ecx, [ecx]
cmp byte [eax], 0x5c
je 0x407e64
push eax
push 0x43de50
call ebp
cmp eax, 0x43de50
ja 0x407e50
push 0x43de50
mov byte [eax], 0
call edi
cmp eax, esi
jg 0x407e20
push 0x43de50
call edi
lea ecx, [eax + 0x43de50]
push ecx
push 0x43de50
call ebp
cmp byte [eax], 0x5c
je 0x407e9c
push 0x420124
push 0x43de50
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x43de50
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edx, edx
cmp eax, 0xffffffff
setne dl
pop ebp
pop ebx
pop edi
pop esi
mov eax, edx
ret
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret

Function at 0x407f40
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x407f5c
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret

Function at 0x407f60
Capabilities:
Get file attributes

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, dword [esp + 8]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [esp + 8]
push ecx
push edx
push 0
push 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 8

Function at 0x407f90
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, 0x64
lea esp, [esp]
dec esi
mov dword [esp + 0x14], 0x61736e
call edi
xor edx, edx
mov ecx, 0x1a
div ecx
mov eax, dword [esp + 0x18]
push ebp
push 0
add byte [esp + 0x1e], dl
lea edx, [esp + 0x1c]
push edx
push eax
call ebx
test eax, eax
jne 0x407fea
test esi, esi
jne 0x407fb0
pop edi
pop esi
mov byte [ebp], 0
pop ebp
pop ebx
ret 8
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 8
Function at 0x408000
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0x420484
push 0x43e250
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
test esi, esi
je 0x408070
push esi
call edi
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push 1
push 0
push 1
push 0
push esi
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 0x43e250
push esi
call ebx
test eax, eax
je 0x408194
cmp eax, 0x400
jg 0x408194
mov edx, dword [esp + 0x20]
push 0x400
push 0x43ef90
push edx
call ebx
test eax, eax
je 0x408194
cmp eax, 0x400
jg 0x408194
push 0x43ef90
push 0x43e250
push str._s_s_r_n
push 0x43e790
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x4415ac]
mov ecx, dword [eax + 0x128]
add esp, 0x10
push ecx
push 0x43ef90
mov dword [esp + 0x1c], ebx
call fcn.00408330
push 0x43ef90
call edi
mov edx, eax
inc edx
push 0
neg edx
sbb edx, edx
and edx, eax
push edx
push 4
push 0
push 1
push 0xc0000000
push 0x43ef90
call ebp
mov ebp, eax
cmp ebp, 0xffffffff
je 0x408194
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40818d
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40818d
cmp edi, dword [esp + 0x10]
jne 0x40818d
push str._Rename__r_n
mov eax, esi
call fcn.00407ec0
test eax, eax
jne 0x40819c
push str._Rename__r_n
lea edx, [esi + edi]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
mov eax, edi
add eax, esi
mov ecx, ebx
mov edx, 0x43e790
call fcn.00407f20
push 0
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0x420490
add eax, 0xa
call fcn.00407ec0
test eax, eax
je 0x408157
lea ecx, [esi + edi]
lea edx, [ecx + ebx]
cmp ecx, eax
jbe 0x4081c5
mov bl, byte [ecx]
mov byte [edx], bl
dec ecx
dec edx
cmp ecx, eax
ja 0x4081b7
mov ebx, dword [esp + 0x14]
sub eax, esi
inc eax
jmp 0x408159
Function at 0x408220
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
neg eax
sbb eax, eax
and eax, 0x100
lea ecx, [esp + 8]
push ecx
or eax, 0x20019
push eax
mov eax, dword [esp + 0x10]
push 0
push edx
push eax
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408294
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x18], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40827f
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x408282
cmp eax, 2
je 0x408282
mov byte [esi], 0
mov edx, dword [esp + 8]
push edx
mov byte [esi + 0x3ff], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret 8
Function at 0x408b70
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x42419c]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0040ca00
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0040caa0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0040f602
add esp, 0x68
ret
Function at 0x408d00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x420ae0
push 0x80000002
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408e91
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408d93
cmp dword [esp + 0x14], 1
jne 0x408e78
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x408e78
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x408dd8
cmp dword [esp + 0x14], 1
jne 0x408e78
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x408e78
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x408e0f
cmp dword [esp + 0x14], 1
jne 0x408e78
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x408e78
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x408e78
cmp dword [esp + 0x14], 3
jne 0x408e78
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x408e78
lea eax, [esi + 0xc]
call fcn.00408be0
test eax, eax
je 0x408e78
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret