joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037e7b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1003a680
push 0xffffffffffffffff
push 0x100683cd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100bc054]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x100c]
mov dword [ebp - 0x18], edi
xor ebx, ebx
lea eax, [ebp]
push 0x1000
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1003cd40
mov eax, dword [ebp + 0x1010]
add esp, 0xc
test eax, eax
je 0x10037ee6
mov esi, dword [eax]
jmp 0x10037ee8
mov esi, ebx
movzx ecx, word [esi]
mov eax, ebx
mov edx, ebx
test cx, cx
je 0x1003800d
cmp cx, 0x2e
jne 0x10037f04
inc eax
cmp eax, 1
jg 0x10037f17
inc edx
movzx ecx, word [esi + edx*2]
test cx, cx
jne 0x10037ef8
cmp eax, 1
jle 0x1003800d
push 0x100a0b00
push esi
call fcn.10058d9a
pop ecx
pop ecx
test eax, eax
js 0x1003800d
push esi
call fcn.100379a5
pop ecx
test al, al
je 0x1003800d
push 0x100a0b18
lea ecx, [ebp - 0x14]
call fcn.1000155e
push 0x100a0b70
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10012712
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x10037f79
call fcn.100016f0
push esi
lea ecx, [ebp - 0x10]
call fcn.1000155e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x14]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x10037fa2
call fcn.100016f0
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x10037fad
mov eax, dword [esi]
jmp 0x10037faf
mov eax, ebx
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10037ff5
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1000
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x100a0b74
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10037ff5
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
mov ecx, edi
push eax
call fcn.1000155e
test esi, esi
je 0x1003802d
mov ecx, esi
call fcn.100016f0
jmp 0x1003802d
push str.1.3.1
push esi
call fcn.10058d9a
push esi
call fcn.100379a5
add esp, 0xc
mov ecx, edi
push 0x100a0606
call fcn.10012712
mov ecx, dword [ebp + 0x1010]
test ecx, ecx
je 0x1003803c
call fcn.100016f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1003a5a7
add ebp, 0x1004
leave
ret
Function at 0x100383b1
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push 0x10
mov eax, 0x10068458
call fcn.1003a5de
xor esi, esi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
and dword [ebp - 4], esi
lea ecx, [ebp - 0x14]
call fcn.1000155e
mov edi, dword [ebp - 0x14]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
test edi, edi
je 0x100383e6
xor eax, eax
cmp dword [edi], eax
sete al
jmp 0x100383e8
mov eax, ebx
test al, al
je 0x100383f3
push 0x100a061a
jmp 0x10038411
test edi, edi
je 0x100383fb
mov eax, dword [edi]
jmp 0x100383fd
xor eax, eax
push eax
call fcn.10038353
pop ecx
test eax, eax
jne 0x1003844c
lea ecx, [ebp - 0x14]
call fcn.10029b00
push eax
call dword [sym.imp.wsock32.dll_gethostbyname]
test eax, eax
je 0x100384b8
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.wsock32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x18]
call fcn.10012712
push eax
lea ecx, [ebp - 0x10]
call fcn.100015bc
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1003845c
call fcn.100016f0
jmp 0x1003845c
cmp eax, ebx
jne 0x100384b8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.100015bc
lea ecx, [ebp - 0x10]
call fcn.10029b00
push eax
call dword [sym.imp.wsock32.dll_inet_addr]
push 2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push 4
push eax
call dword [sym.imp.wsock32.dll_gethostbyaddr]
mov esi, eax
test esi, esi
je 0x100384b5
mov ecx, dword [esi]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038487
sub ecx, edx
push ecx
push dword [esi]
call fcn.10058d9a
pop ecx
pop ecx
push dword [esi]
lea ecx, [ebp - 0x18]
call fcn.10012712
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100384b0
call fcn.100016f0
mov esi, dword [ebp - 0x10]
jmp 0x100384ba
mov esi, dword [ebp - 0x10]
xor bl, bl
test edi, edi
je 0x100384c5
mov ecx, edi
call fcn.100016f0
test esi, esi
je 0x100384d0
mov ecx, esi
call fcn.100016f0
mov al, bl
call fcn.1003a5b8
ret
Function at 0x10058d9a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10058da9
pop dword [ebp - 8]
mov eax, 0x10058da9
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x48c9b
push 0
mov eax, 0xfcdd06ac
add eax, 0x132989c4
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x4bec
mov esi, eax
mov edx, 0xaa927fc1
sub edx, 0x9a8205c1
add edx, dword [ebp - 8]
mov edi, 0x56b00b57
add edi, 0xfa2458d0
mov ebx, dword [edx]
xor dword [ebp - 4], 0x2c942c60
xor ebx, edi
mov dword [esi], ebx
mov dword [ebp - 4], 0xa3aee0be
add esi, 0x84cecb66
add esi, 0x7b31349e
add edx, 0xf3a1169c
add edx, 0xc5ee968
loop 0x10058dfd
add eax, 0xc875cd1a
sub eax, 0xc874aa97
xor ebx, ebx
add ebx, eax
add eax, 0xd73c84db
add eax, 0x28c37b2a
mov ecx, 0xd4156d7d
add ecx, 0x3bea9283
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x406243
pop dword [ebp - 0x20]
mov eax, 0x5c91810b
add eax, 0xa3aee138
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x87e0ea2b
sub dword [ebp - 0x30], 0x398ea4e0
mov dword [ebp - 0x2c], 0x4a701c6d
sub dword [ebp - 0x2c], 0x183cd028
mov dword [ebp - 0x28], 0x8a0677ee
sub dword [ebp - 0x28], 0x3dba33c0
mov dword [ebp - 0x24], 0xc8f654c4
add dword [ebp - 0x24], 0x3709ab3c
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xcd795d18
add dword [ebp - 0x30], 0xa6f90c3e
mov dword [ebp - 0x2c], 0x79087df9
sub dword [ebp - 0x2c], 0x379c1c84
mov dword [ebp - 0x28], 0xf8490fe0
sub dword [ebp - 0x28], 0x94d9a374
mov dword [ebp - 0x24], 0xd57edff
sub dword [ebp - 0x24], 0xd57edff
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xdae80409
sub eax, 0xdaa78309
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x354b7
push 0
call eax
mov ecx, 0x26003107
add ecx, 0xda00100f
xor edi, edi
add edi, eax
mov ebx, 0x255c9aac
sub ebx, 0x2515b6ac
add ebx, dword [ebp - 0x20]
mov esi, 0x501c05e1
sub esi, 0x192dcd67
add dword [ebp - 0x14], 0xf07ec4ed
mov edx, dword [ebx]
add dword [ebp - 0x18], eax
xor edx, esi
xor dword [ebp - 8], edi
mov dword [edi], edx
sub dword [ebp - 0x18], 0xdedd5d5
add edi, 0x7df242b3
sub edi, 0x7df242af
add ebx, 4
loop 0x406362
add eax, 0x230a50bc
sub eax, 0x23095991
mov ebx, eax
add eax, 5
mov ecx, 0x347ef825
sub ecx, 0x343ef825
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x1000d40f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x10015406
call fcn.10013c9a
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x1000d630
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.1000fe15
add esp, 0x10
test eax, eax
js 0x1000d62a
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x1000d4b3
push edi
call fcn.100081d8
pop ecx
test al, al
je 0x1000d4b3
mov eax, edi
call fcn.10013eb0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000d4c5
push edi
lea ecx, [ebp - 0x424]
call fcn.1000fe15
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.1000fe15
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000d62a
push 0x60
push ebx
push eax
call fcn.1000e9b2
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x1000d51d
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.1000e9b2
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x1000d51d
call fcn.100037d1
mov ebx, eax
jmp 0x1000d5f9
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x1000d544
call fcn.100037d1
jmp 0x1000d5ec
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x1000d53a
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x1000d577
mov ebx, 0x8007000e
jmp 0x1000d5ee
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000fe15
jmp 0x1000d59d
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000d570
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.1000fe15
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.1000fe15
mov ebx, eax
test edi, edi
je 0x1000d5f9
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000d612
lea ecx, [ebp - 0x418]
call fcn.1000cc05
or dword [ebp - 4], 0xffffffff
jmp 0x1000d622
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x1000d618
mov eax, ebx
jmp 0x1000d65e
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x1000d645
lea ecx, [ebp - 0x418]
call fcn.1000cc05
or dword [ebp - 4], 0xffffffff
jmp 0x1000d655
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x1000d64b
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.10013be7
ret 0x10
Function at 0x1000f1e0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x3c
push esi
mov esi, dword [eax + 8]
push edi
mov edi, dword [ebp + 0x10]
add esi, 0x568
push 0x10017bc0
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000f269
push str.file:__
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000f269
push dword [ebp + 0xc]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000f269
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push edi
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
test eax, eax
je 0x1000f26c
mov eax, dword [ebp - 0x30]
cmp eax, 1
je 0x1000f265
add eax, 0xfffffffd
cmp eax, 1
ja 0x1000f26c
mov esi, edi
jmp 0x1000f26c
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.1000fe15
add esp, 0x10
pop edi
pop esi
leave
ret 0x20
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x403e59
pop dword [ebp - 8]
mov eax, 0x403e59
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xf6167d72
sub dword [ebp - 0x18], 0xa7c43827
mov dword [ebp - 0x14], 0xb4788aed
add dword [ebp - 0x14], 0x7dbac158
mov dword [ebp - 0x10], 0xb00be33a
sub dword [ebp - 0x10], 0x63bf9f0c
mov dword [ebp - 0xc], 0x6b0a9601
add dword [ebp - 0xc], 0x94f569ff
lea eax, [ebp - 0x18]
push eax
mov eax, 0x2933edd9
add eax, 0xd70c828b
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xd1d0472f
add dword [ebp - 0x18], 0xa2a22227
mov dword [ebp - 0x14], 0x9af89163
sub dword [ebp - 0x14], 0x598c2fee
mov dword [ebp - 0x10], 0x2bb2b60d
sub dword [ebp - 0x10], 0xc84349a1
mov dword [ebp - 0xc], 0x25ce01f4
sub dword [ebp - 0xc], 0x25ce01f4
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xd5bc1853
add eax, 0x2a845855
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x321fd
push 0
call eax
mov ecx, 0x3582
xor edi, edi
add edi, eax
mov ebx, 0xeebad5a1
sub ebx, 0xee79d5a1
add ebx, dword [ebp - 8]
mov esi, 0xffe36404
add esi, 0x42fc1500
mov dword [ebp - 4], 0x3ba210f2
mov edx, dword [ebx]
add dword [ebp - 4], 0x8bc6102a
add edx, esi
xor dword [ebp - 4], 0x9d932264
mov dword [edi], edx
sub dword [ebp - 4], 0xd804a25
add edi, 4
add ebx, 4
loop 0x403f72
add eax, 0x3125fbe5
sub eax, 0x3125330a
mov ebx, eax
add eax, 5
mov ecx, 0x90dd8f2c
add ecx, 0x6f6270d4
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10002e01
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10002e10
pop dword [ebp - 0x40]
mov eax, 0x897dc9c7
sub eax, 0x797d9bb7
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x36fecab7
sub dword [ebp - 0x50], 0xe8ac856c
mov dword [ebp - 0x4c], 0x892e57f0
add dword [ebp - 0x4c], 0xa904f455
mov dword [ebp - 0x48], 0x7e2d3435
add dword [ebp - 0x48], 0xce1f0ff9
mov dword [ebp - 0x44], 0x119aee62
sub dword [ebp - 0x44], 0x119aee62
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x683259a2
add dword [ebp - 0x50], 0xc400fb4
mov dword [ebp - 0x4c], 0x90410a22
sub dword [ebp - 0x4c], 0x4ed4a8ad
mov dword [ebp - 0x48], 0xb7447169
add dword [ebp - 0x48], 0xac2afb03
mov dword [ebp - 0x44], 0xa6596a3d
sub dword [ebp - 0x44], 0xa6596a3d
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xefe5bb87
add eax, 0x201a9fed
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x388f2
push 0
call eax
mov ecx, 0x4fff
xor edi, edi
add edi, eax
mov ebx, 0x1000b800
add ebx, dword [ebp - 0x40]
mov edx, 0x2982d80e
xor dword [ebp - 0x30], 0xb4e8884e
mov esi, dword [ebx]
sub dword [ebp - 0xc], edx
xor esi, edx
sub dword [ebp - 0x18], 0x794541d
mov dword [edi], esi
add dword [ebp - 0x14], esi
add edi, 0xa65036c1
sub edi, 0xa65036bd
add ebx, 4
loop 0x10002f1d
add eax, 0x132cf
xor ebx, ebx
add ebx, eax
add eax, 0x8ef952d2
sub eax, 0x8ef952cd
mov ecx, sym.libEGL.dll_Ordinal_0
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x100024f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10002551
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002512
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x402fc0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x4034e0
test edx, edx
je 0x4034e0
call fcn.00402fd7
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x406cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00406cc9

Function at 0x42c1a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [esp + 0x68], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x42c1c7
mov eax, dword [esi]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x42c298
mov ebx, eax
push eax
call fcn.004ecac3
add esp, 4
mov edi, eax
cmp byte [esi + 0xb], 0
jns 0x42c1ec
mov esi, dword [esi]
push edi
push ebx
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42c291
xor esi, esi
dec esi
lea eax, [esp + 0xc]
mov dword [eax], esi
lea ecx, [esp + 8]
mov dword [ecx], esi
push ecx
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42c291
cmp dword [esp + 8], 3
jbe 0x42c291
mov eax, dword [esp + 0xc]
movzx ecx, word [eax]
movzx eax, word [eax + 2]
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x10]
movdqa xmmword [ebx + 0x40], xmm0
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
push eax
push ecx
push str.StringFileInfo_04x_04xInternalName
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 4]
mov dword [eax], esi
mov ecx, esp
mov dword [ecx], esi
push ecx
push eax
push ebx
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42c291
mov eax, dword [esp]
test eax, eax
je 0x42c291
dec eax
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
push dword [esp + 8]
call fcn.0042c2c0
jmp 0x42c2a2
xor eax, eax
mov edi, dword [ebp + 8]
jmp 0x42c29a
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004ed092
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42da70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x2c], ecx
mov esi, dword [ebp + 8]
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ecx, [ebp - 0x1c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push str.GROUP:
call fcn.0051cfc0
test esi, esi
je 0x42dbbd
mov ebx, dword [ebp + 0xc]
push esi
call fcn.00508d20
add esp, 4
lea edi, [ebp - 0x1c]
mov ecx, edi
push eax
push esi
call fcn.00467ff0
mov ecx, edi
push 8
push str.__NAME:
call fcn.00467ff0
test ebx, ebx
je 0x42dbbd
mov esi, dword [ebp + 0x10]
push ebx
call fcn.00508d20
add esp, 4
lea edi, [ebp - 0x1c]
mov ecx, edi
push eax
push ebx
call fcn.00467ff0
mov ecx, edi
push 0xc
push str.__DURATION:
call fcn.00467ff0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov edx, eax
or edx, ecx
jne 0x42db15
lea ecx, [ebp - 0x1c]
push 0x12
push str.unknown_unfinished
jmp 0x42db60
sub eax, dword [esi]
sbb ecx, dword [esi + 4]
lea esi, [ebp - 0x28]
push ecx
push eax
push esi
call fcn.004698b0
add esp, 0xc
movzx eax, byte [esi + 0xb]
test al, al
jns 0x42db38
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
jmp 0x42db3b
and eax, 0x7f
lea ecx, [ebp - 0x1c]
push eax
push esi
call fcn.00467ff0
cmp byte [ebp - 0x1d], 0
jns 0x42db56
push dword [ebp - 0x28]
call fcn.004eca8e
add esp, 4
lea ecx, [ebp - 0x1c]
push 5
push str.__us_
call fcn.00467ff0
mov ecx, edi
push 2
push 0x58493d
call fcn.00467ff0
movzx eax, byte [ebp - 0x11]
test al, al
jns 0x42db83
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x42db86
and eax, 0x7f
xor ecx, ecx
push ecx
push ecx
push eax
push edi
mov eax, dword [ebp - 0x2c]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp byte [ebp - 0x11], 0
jns 0x42dba9
push dword [ebp - 0x1c]
call fcn.004eca8e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push str.string::append_received_nullptr
push str.__s___nullptr
push 0xb21
push str....._buildtools_third_partylibc_trunkinclude_string
push str._s:_d:_assertion__s_failed:__s
call fcn.0051d7e0
int3
Function at 0x435420
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x218]
mov dword [esi], 0x101
lea ebx, [ebp - 0x212]
push 0x202
push 0xff
push ebx
call fcn.004f0310
add esp, 0xc
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test eax, eax
jne 0x435485
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 8]
push ebx
call fcn.00508f54
add esp, 4
mov ecx, edi
push eax
push ebx
call fcn.00468e50
jmp 0x435469

Function at 0x4354a0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, 2
pop ebp
jmp fcn.004354c0
Function at 0x438020
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x224
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 0x214], esi
mov eax, dword [ecx]
mov dword [ebp - 0x22c], ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x230], ecx
or ecx, 0x2001f
lea edi, [ebp - 0x210]
mov dword [edi], esi
push edi
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x438075
mov ebx, eax
jmp 0x438145
mov ebx, dword [ebp - 0x210]
lea eax, [ebp - 0x21c]
mov dword [eax], ebx
mov ecx, dword [ebp - 0x230]
and ecx, 0x300
mov dword [eax + 4], ecx
xor eax, eax
dec eax
lea ecx, [ebp - 0x224]
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea eax, [ebp - 0x228]
mov dword [eax], 0x100
push 0x200
push 0xff
push edi
call fcn.004f0310
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x228]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4380ff
lea ecx, [ebp - 0x21c]
push edi
call fcn.00438020
test eax, eax
jne 0x438132
mov dword [ebp - 0x228], 0x100
mov ebx, dword [ebp - 0x21c]
jmp 0x4380bf
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x43811a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov ecx, dword [ebp - 0x22c]
push dword [ebp + 8]
call fcn.00438710
mov ebx, eax
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x438145
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, ebx
add esp, 0x224
pop esi
pop edi
pop ebx
pop ebp
ret 4