joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e5c
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0x2ac
mov eax, 0x49e26d
call fcn.0047bb4d
mov esi, 0x114
push esi
xor ebx, ebx
lea eax, [ebp - 0x160]
push ebx
push eax
call fcn.00475a50
add esp, 0xc
lea eax, [ebp - 0x160]
push eax
mov dword [ebp - 0x160], esi
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
jne 0x407f00
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.004090fb
mov esi, eax
push 0x4aa144
push esi
mov dword [ebp - 4], ebx
call fcn.0040b677
pop ecx
pop ecx
push edi
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x48]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x407ee0
mov eax, ebx
push eax
xor ecx, ecx
call fcn.0040d57f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.00404dda
lea eax, [ebp - 0x2b8]
jmp 0x4080b6
push 0x24
lea eax, [ebp - 0x184]
push ebx
push eax
call fcn.00475a50
add esp, 0xc
push 0x4aa17c
push 0x4aa190
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, ebx
je 0x407f38
lea ecx, [ebp - 0x184]
push ecx
call eax
jmp 0x407f45
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
cmp dword [ebp - 0x15c], 4
push 2
pop edi
jne 0x407f65
cmp dword [ebp - 0x150], 1
jne 0x40803f
xor eax, eax
jmp 0x4080c2
push 5
pop eax
cmp dword [ebp - 0x15c], eax
jne 0x407fbc
cmp dword [ebp - 0x158], ebx
jne 0x407f80
xor eax, eax
inc eax
jmp 0x4080c2
cmp dword [ebp - 0x158], 1
jne 0x407f91
push 2
pop eax
jmp 0x4080c2
cmp dword [ebp - 0x158], edi
jne 0x40803f
cmp word [ebp - 0x184], 9
je 0x407fb8
cmp word [ebp - 0x184], 6
je 0x407fb8
mov eax, edi
jmp 0x4080c2
push 3
jmp 0x407f8b
push 6
pop ecx
cmp dword [ebp - 0x15c], ecx
jne 0x40803f
cmp dword [ebp - 0x158], ebx
jne 0x407fed
cmp word [ebp - 0x184], 9
je 0x407fe6
cmp word [ebp - 0x184], cx
jne 0x4080c2
mov eax, ecx
jmp 0x4080c2
cmp dword [ebp - 0x158], 1
jne 0x408017
cmp word [ebp - 0x184], 9
je 0x408010
cmp word [ebp - 0x184], cx
je 0x408010
push 7
jmp 0x407f8b
push 8
jmp 0x407f8b
cmp dword [ebp - 0x158], edi
jne 0x40803f
push 9
pop eax
cmp word [ebp - 0x184], ax
je 0x408038
cmp word [ebp - 0x184], cx
jne 0x4080c2
push 0xa
jmp 0x407f8b
lea eax, [ebp - 0x220]
push eax
call fcn.004090fb
mov esi, eax
push 0x4aa1ac
push esi
mov dword [ebp - 4], edi
call fcn.0040b677
pop ecx
pop ecx
push dword [ebp - 0x15c]
push esi
call fcn.0040a33c
push 0x4aa1dc
push esi
call fcn.0040b677
pop ecx
pop ecx
push dword [ebp - 0x158]
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x2c]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x40809b
mov eax, ebx
push eax
xor ecx, ecx
call fcn.0040d57f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00404dda
lea eax, [ebp - 0x220]
or dword [ebp - 4], 0xffffffff
call fcn.00407bad
or eax, 0xffffffff
call fcn.0047bbd0
ret
Function at 0x408291
Capabilities:
Create thread

Disassembly:
push 0xd8
mov eax, 0x49e21f
call fcn.0047bb4d
mov edi, 0x4c6eee
push edi
push 0x11c
call fcn.00478f16
xor ebx, ebx
pop ecx
pop ecx
cmp eax, ebx
je 0x4082c9
push 0x54485245
mov esi, eax
call fcn.00407a1a
mov dword [ebp - 0x34], eax
jmp 0x4082cc
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ebx
jne 0x4082e6
xor ecx, ecx
push 0x4aa380
inc ecx
call fcn.0040d57f
pop ecx
xor eax, eax
jmp 0x4083dd
push edi
push 8
call fcn.00478f16
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 0x3c], esi
cmp esi, ebx
jne 0x408311
xor ecx, ecx
push 0x4aa3d8
inc ecx
call fcn.0040d57f
pop ecx
push dword [ebp - 0x34]
call fcn.004083e3
jmp 0x4082df
mov eax, dword [ebp + 8]
push 0xc
pop edi
push edi
mov dword [esi + 4], eax
lea eax, [ebp - 0x48]
push ebx
push eax
mov dword [esi], 0x416673
call fcn.00475a50
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
push ebx
push esi
push 0x408273
push ebx
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x48], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 8], eax
cmp eax, ebx
jne 0x4083d5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0xe4]
push eax
call fcn.004090fb
mov esi, eax
push 0x4aa42c
push esi
mov dword [ebp - 4], ebx
call fcn.0040b677
pop ecx
pop ecx
push edi
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x30]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x40839b
mov eax, ebx
xor ecx, ecx
push eax
inc ecx
call fcn.0040d57f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00404dda
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xe4]
call fcn.00407bad
push dword [ebp - 0x34]
call fcn.004083e3
push dword [ebp - 0x3c]
call fcn.00475a2d
jmp 0x4082de
mov eax, dword [ebp - 0x38]
mov dword [ecx + 4], eax
mov eax, ecx
call fcn.0047bbd0
ret
Function at 0x4083fe
Capabilities:
Check mutex on windows

Disassembly:
push 0xcc
mov eax, 0x49edbf
call fcn.0047bb4d
push 0x4c6eee
push 0x11c
call fcn.00478f16
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x408437
push 0x4d555458
mov esi, eax
call fcn.00407a1a
mov esi, eax
mov dword [ebp - 0x30], esi
jmp 0x40843c
mov dword [ebp - 0x30], edi
mov esi, edi
cmp esi, edi
jne 0x408455
xor ecx, ecx
push 0x4aa490
inc ecx
call fcn.0040d57f
pop ecx
xor eax, eax
jmp 0x40852c
xor edx, edx
mov ecx, esi
call fcn.00407aee
test al, al
jne 0x40846a
push esi
call fcn.004083e3
jmp 0x40844e
mov dword [ebp - 0x3c], 0xc
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
push edi
push edi
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [esi + 8], eax
cmp eax, edi
jne 0x40851c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0xd8]
push eax
call fcn.004090fb
mov esi, eax
push 0x4aa4e0
push esi
mov byte [ebp - 4], 1
call fcn.0040b677
pop ecx
pop ecx
push edi
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x2c]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x4084d8
mov eax, ebx
xor ecx, ecx
push eax
inc ecx
call fcn.0040d57f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00404dda
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0
call fcn.00407bad
push dword [ebp - 0x30]
call fcn.004083e3
cmp dword [ebp - 0x38], edi
je 0x40844e
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x40844e
cmp dword [ebp - 0x38], edi
je 0x40852a
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov eax, esi
call fcn.0047bbd0
ret
Function at 0x40dbc0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xe0
mov eax, 0x49fb74
call fcn.0047bb83
mov esi, ecx
mov edi, dword [esi + 4]
push dword [edi]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 4]
cmp dword [eax + 4], ebx
je 0x40dbff
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor al, al
call fcn.0047bbdf
ret
add eax, 0x10
push eax
push 4
push esi
push 0x40da45
push ebx
push ebx
call fcn.0047a44d
mov ecx, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebx
je 0x40dd5c
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
test eax, eax
jne 0x40dcc2
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.00407cf0
pop ecx
mov edi, eax
lea eax, [ebp - 0xec]
push eax
mov byte [ebp - 4], 2
call fcn.004090fb
mov esi, eax
push 0x4aabf4
push esi
mov byte [ebp - 4], 3
call fcn.0040b677
pop ecx
pop ecx
push esi
mov ecx, edi
call fcn.0040b9a3
pop ecx
lea ebx, [ebp - 0x30]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 4
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x40dc8e
mov eax, ebx
push eax
xor ecx, ecx
call fcn.0040d57f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00404dda
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 2
call fcn.00407bad
push 1
lea esi, [ebp - 0x4c]
call fcn.00404dda
and dword [ebp - 4], edi
mov esi, dword [ebp - 0x50]
mov eax, dword [esi + 4]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
cmp eax, 0xffffffff
jne 0x40dd7e
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 6
call fcn.00407cf0
pop ecx
mov edi, eax
lea eax, [ebp - 0xec]
push eax
mov byte [ebp - 4], 7
call fcn.004090fb
mov esi, eax
push 0x4aac2c
push esi
mov byte [ebp - 4], 8
call fcn.0040b677
pop ecx
pop ecx
push esi
mov ecx, edi
call fcn.0040b9a3
pop ecx
lea ebx, [ebp - 0x30]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 9
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x40dd2c
mov eax, ebx
push eax
xor ecx, ecx
call fcn.0040d57f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00404dda
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 7
call fcn.00407bad
push 1
lea esi, [ebp - 0x4c]
call fcn.00404dda
xor bl, bl
mov eax, dword [ebp - 0x54]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov al, bl
jmp 0x40dbf9
mov eax, dword [esi + 4]
mov byte [eax + 0xc], 1
mov eax, dword [esi + 4]
mov byte [eax + 0xd], 0
mov bl, 1
jmp 0x40dd5c
Function at 0x4179d9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc4
mov eax, 0x49ea85
call fcn.0047bb4d
push 0x4b02a0
push 3
pop ecx
call fcn.0040d57f
pop ecx
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
lea esi, [edi + 0x170]
mov eax, 0x4a9a00
mov dword [esi], ebx
mov byte [edi + 0x190], bl
call fcn.00404cae
mov dword [ebp - 4], ebx
push 0xffffffffffffffff
lea ecx, [edi + 0x174]
push ebx
lea eax, [ebp - 0x2c]
call fcn.00404d40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403d16
lea eax, [ebp - 0x34]
push eax
push 0x20019
push ebx
push dword [0x4c53b0]
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
je 0x417ad1
lea eax, [ebp - 0xd0]
push eax
call fcn.004090fb
mov esi, eax
mov dword [ebp - 4], 1
push 0x4b02f4
push esi
call fcn.0040b677
push dword [0x4c53b0]
push esi
call fcn.0040b677
push 0x4b028c
push esi
call fcn.0040b677
add esp, 0x18
lea ebx, [ebp - 0x2c]
mov ecx, esi
call fcn.00409165
push 2
pop ecx
mov byte [ebp - 4], cl
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x417aa8
mov eax, ebx
push eax
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xd0]
call fcn.00407bad
xor al, al
jmp 0x417b96
lea eax, [ebp - 0x30]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
push ebx
push ebx
push 0x4ad0b4
push dword [ebp - 0x34]
mov dword [ebp - 0x30], 4
call esi
test eax, eax
je 0x417b03
push 0x4b0330
push 2
pop ecx
call fcn.0040d57f
pop ecx
jmp 0x417b6e
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push 0x4ad0d8
push dword [ebp - 0x34]
mov dword [ebp - 0x30], ebx
call esi
cmp eax, ebx
jne 0x417b6e
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x30]
shr eax, 1
inc eax
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x38], ebx
call fcn.0040cddb
mov dword [ebp - 4], 3
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x20]
push ebx
push ebx
push 0x4ad0d8
push dword [ebp - 0x34]
call esi
push dword [ebp - 0x20]
call fcn.00477a67
pop ecx
mov ecx, dword [ebp - 0x20]
lea esi, [edi + 0x174]
call fcn.004051e0
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x20]
call fcn.00419335
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp dword [edi + 0x170], ebx
push 0x4b0370
setne al
push 3
pop ecx
mov byte [edi + 0x190], al
call fcn.0040d57f
pop ecx
mov al, 1
call fcn.0047bbd0
ret
Function at 0x417c0b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4c3204]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x58]
push eax
push 0x20019
xor esi, esi
push esi
push 0x4a9f48
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [ebp - 0x58], esi
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
je 0x417c43
xor al, al
jmp 0x417c8f
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x4a9fa4
push dword [ebp - 0x58]
mov dword [ebp - 0x5c], 0x4e
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
jne 0x417c3f
cmp dword [ebp - 0x58], esi
je 0x417c74
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.00477a67
pop ecx
lea ecx, [ebp - 0x54]
mov edi, eax
push ecx
mov eax, ebx
call fcn.00405148
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00475a38
leave
ret
Function at 0x41895f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x54
mov eax, 0x49d66b
call fcn.0047bb4d
lea eax, [ebp - 0x30]
mov esi, ecx
push eax
mov eax, 0x4a9a00
mov dword [ebp - 0x58], esi
xor ebx, ebx
call fcn.00404cae
mov dword [ebp - 4], ebx
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x30]
mov ecx, esi
call fcn.00404d40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00403d16
lea eax, [ebp - 0x50]
push eax
push 1
push ebx
push 0x4b0a28
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x418a75
mov esi, dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
mov edi, 0x4b0a70
push edi
push dword [ebp - 0x50]
mov dword [ebp - 0x54], ebx
call esi
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x54]
shr eax, 1
inc eax
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x5c], ebx
call fcn.0040cddb
mov dword [ebp - 4], 1
cmp dword [ebp - 0x60], ebx
jne 0x418a0e
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x24]
push ebx
push ebx
push edi
push dword [ebp - 0x50]
call esi
cmp eax, ebx
je 0x418a4a
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x4afb84
call fcn.00404cae
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x58]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4c]
call fcn.00404d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00403d16
push 0x4b0a90
push 2
pop ecx
call fcn.0040d57f
pop ecx
jmp 0x418a5e
push dword [ebp - 0x24]
call fcn.00477a67
mov esi, dword [ebp - 0x58]
pop ecx
mov ecx, dword [ebp - 0x24]
call fcn.004051e0
push dword [ebp - 0x50]
mov bl, 1
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x24]
call fcn.00419335
mov al, bl
call fcn.0047bbd0
ret
Function at 0x418bc5
Capabilities:
Get file version info

Disassembly:
push 0xd8
mov eax, 0x49ea3a
call fcn.0047bb4d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x4c]
mov edi, ecx
push eax
push edi
mov byte [ebp - 0x31], 1
call dword [sym.imp.VERSION.DLL_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x418c06
push 0x4b0c38
push 2
pop ecx
call fcn.0040d57f
pop ecx
xor al, al
jmp 0x418d72
push esi
call fcn.00474de9
pop ecx
push eax
push esi
push 0
push edi
mov dword [ebp - 0x38], eax
call dword [sym.imp.VERSION.DLL_GetFileVersionInfoW]
test eax, eax
jne 0x418c98
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0xe4]
push eax
call fcn.004090fb
mov esi, eax
and dword [ebp - 4], 0
push 0x4b0ca0
push esi
call fcn.0040b677
pop ecx
pop ecx
push edi
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x30]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x418c66
mov eax, ebx
push eax
push 2
pop ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xe4]
call fcn.00407bad
push dword [ebp - 0x38]
call fcn.00477120
jmp 0x418bfe
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x4a9bc8
push dword [ebp - 0x38]
call dword [sym.imp.VERSION.DLL_VerQueryValueW]
test eax, eax
je 0x418ced
mov eax, dword [ebp - 0x44]
movzx esi, word [eax + 0xa]
movzx ebx, word [eax + 8]
movzx edi, word [eax + 0xe]
movzx eax, word [eax + 0xc]
mov ecx, dword [ebp - 0x3c]
push 0x64
mov dword [ebp - 0x40], eax
pop eax
call fcn.0040bf03
movzx eax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push edi
push ebx
push esi
push 0x4b0d18
call fcn.0040cc9d
add esp, 0x14
jmp 0x418d60
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0xe4]
push eax
call fcn.004090fb
mov esi, eax
mov dword [ebp - 4], 2
push 0x4b0d40
push esi
call fcn.0040b677
pop ecx
pop ecx
push edi
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x30]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x418d37
mov eax, ebx
push eax
push 2
pop ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xe4]
call fcn.00407bad
mov byte [ebp - 0x31], 0
cmp dword [ebp - 0x38], 0
je 0x418d6f
push dword [ebp - 0x38]
call fcn.00477120
pop ecx
mov al, byte [ebp - 0x31]
call fcn.0047bbd0
ret
Function at 0x41c931
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax + 4]
sub esp, 0x24
push ebx
push esi
push edi
cmp eax, 1
je 0x41c94b
cmp eax, 2
jne 0x41c9d9
mov eax, dword [ebp + 8]
and dword [eax], 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
test eax, eax
je 0x41c9d9
mov ebx, dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
lea eax, [ebp - 8]
push eax
call ebx
mov edi, dword [ebp - 8]
add edi, dword [ebp - 0x18]
mov esi, dword [ebp - 4]
adc esi, dword [ebp - 0x14]
rdtsc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
push dword [ebp + 0xc]
call fcn.004087e4
pop ecx
test al, al
jne 0x41c9d9
lea eax, [ebp - 8]
push eax
call ebx
mov eax, dword [ebp - 4]
cmp eax, esi
jg 0x41c9ae
jl 0x41c98b
mov eax, dword [ebp - 8]
cmp eax, edi
jbe 0x41c98b
rdtsc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
sbb ecx, dword [ebp - 0x1c]
push 0
push 0xf4240
push ecx
push eax
call fcn.00490180
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov al, 1
jmp 0x41c9db
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x424f20
Capabilities:
Get file version info

Disassembly:
push 0xe0
mov eax, 0x49f0bc
call fcn.0047bb4d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x4c]
mov ebx, ecx
push eax
push ebx
mov edi, edx
mov byte [ebp - 0x31], 1
call dword [sym.imp.VERSION.DLL_GetFileVersionInfoSizeA]
mov esi, eax
test esi, esi
jne 0x424f6f
push 0x4b0c38
push 2
pop ecx
call fcn.0040d57f
pop ecx
xor al, al
jmp 0x4250d8
push esi
call fcn.00474de9
pop ecx
push eax
push esi
push 0
push ebx
mov dword [ebp - 0x38], eax
call dword [sym.imp.VERSION.DLL_GetFileVersionInfoA]
test eax, eax
jne 0x42500f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0xec]
push eax
call fcn.004090fb
mov esi, eax
and dword [ebp - 4], 0
push 0x4b0ca0
push esi
call fcn.0040b677
pop ecx
pop ecx
push edi
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x30]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x424fd3
mov eax, ebx
push eax
push 2
pop ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xec]
call fcn.00407bad
cmp dword [ebp - 0x38], 0
je 0x424f68
push dword [ebp - 0x38]
call fcn.00477120
jmp 0x424f67
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x4a9bc8
push dword [ebp - 0x38]
call dword [sym.imp.VERSION.DLL_VerQueryValueW]
test eax, eax
je 0x425053
mov eax, dword [ebp - 0x48]
mov cx, word [eax + 0xa]
mov edx, dword [ebp - 0x44]
mov word [edi], cx
mov cx, word [eax + 8]
mov word [edx], cx
mov cx, word [eax + 0xe]
mov edx, dword [ebp - 0x3c]
mov word [edx], cx
mov ax, word [eax + 0xc]
mov ecx, dword [ebp - 0x40]
mov word [ecx], ax
jmp 0x4250c6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0xec]
push eax
call fcn.004090fb
mov esi, eax
mov dword [ebp - 4], 2
push 0x4b7a40
push esi
call fcn.0040b677
pop ecx
pop ecx
push edi
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x30]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x42509d
mov eax, ebx
push eax
push 2
pop ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xec]
call fcn.00407bad
mov byte [ebp - 0x31], 0
cmp dword [ebp - 0x38], 0
je 0x4250d5
push dword [ebp - 0x38]
call fcn.00477120
pop ecx
mov al, byte [ebp - 0x31]
call fcn.0047bbd0
ret 0xc
Function at 0x428a3f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xf0
mov eax, 0x49ee48
call fcn.0047bb4d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x4b8ce8
mov esi, ecx
call fcn.00404cae
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x4b8ef8
push 3
pop ecx
mov byte [ebp - 0x4d], 1
call fcn.0040d57f
pop ecx
push esi
call fcn.00477a67
pop ecx
mov edi, eax
push esi
lea eax, [ebp - 0x4c]
call fcn.00405148
cmp dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x4c]
jae 0x428a99
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x58]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
je 0x428b51
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea eax, [ebp - 0xfc]
push eax
call fcn.004090fb
mov esi, eax
mov byte [ebp - 4], 1
push 0x4b8f50
push esi
call fcn.0040b677
push esi
lea ecx, [ebp - 0x4c]
call fcn.0040b9a3
add esp, 0xc
push 0x4b63c0
push esi
call fcn.0040b677
pop ecx
pop ecx
push edi
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x30]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x428b15
mov eax, ebx
xor ecx, ecx
push eax
inc ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00403d16
xor bl, bl
mov byte [ebp - 4], bl
lea eax, [ebp - 0xfc]
call fcn.00407bad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00403d16
mov al, bl
call fcn.0047bbd0
ret 4
mov edi, dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push ebx
mov esi, 0x4b8f88
push esi
push dword [ebp - 0x58]
mov dword [ebp - 0x5c], ebx
call edi
mov dword [ebp - 0x54], eax
cmp eax, ebx
jne 0x428bc0
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x5c]
shr eax, 1
inc eax
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x54], ebx
call fcn.0040cddb
mov byte [ebp - 4], 3
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x24]
push ebx
push ebx
push esi
push dword [ebp - 0x58]
call edi
push dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
call fcn.00477a67
mov esi, dword [ebp - 0x60]
pop ecx
mov ecx, dword [ebp - 0x24]
call fcn.004051e0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x24]
call fcn.00419335
jmp 0x428bd3
mov eax, dword [ebp - 0x60]
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ebx
jb 0x428bce
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x54], ebx
je 0x428be9
xor ecx, ecx
push 0x4b8de0
inc ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 0x4d], bl
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push 0x4b8fb0
push 3
pop ecx
call fcn.0040d57f
mov bl, byte [ebp - 0x4d]
pop ecx
jmp 0x428b3b