joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40acc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 0xffff
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, edx
push edi
test ebx, ebx
jle 0x40ad01
mov edi, ebx
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
xor eax, ecx
shr cx, 8
and eax, 0xff
xor cx, word [eax*2 + 0x4235e0]
movzx ecx, cx
sub edi, 1
jne 0x40ace0
not ecx
lea edi, [ebx + 2]
movzx eax, cx
xor esi, esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov byte [eax], 0x7e
inc eax
test edi, edi
jle 0x40ad4f
nop dword [eax]
cmp esi, ebx
lea ecx, [ebp + 8]
cmovne ecx, edx
mov edx, ecx
mov cl, byte [edx]
cmp cl, 0x7e
je 0x40ad3b
cmp cl, 0x7d
je 0x40ad3b
mov byte [eax], cl
inc eax
jmp 0x40ad49
mov byte [eax], 0x7d
mov cl, byte [edx]
xor cl, 0x20
mov byte [eax + 1], cl
add eax, 2
inc esi
inc edx
cmp esi, edi
jl 0x40ad20
mov ecx, dword [ebp + 0x14]
mov byte [eax], 0x7e
sub eax, dword [ebp + 0x10]
pop edi
inc eax
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
pop ebp
ret 0x10

Function at 0x40ade0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x1c], eax
cmp eax, 0xffffffff
jne 0x40ae14
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
ret 4
push 0
lea ecx, [ebp + 8]
push ecx
push 0x1c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40ae4e
cmp dword [esi], 0xed26ff3a
je 0x40ae43
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xb
pop esi
pop ebp
ret 4
mov byte [esi + 0x20], 1
xor eax, eax
pop esi
pop ebp
ret 4
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x1e
pop esi
pop ebp
ret 4
Function at 0x40ae70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], eax
push esi
xor esi, esi
push edi
cmp byte [ebx + 0x20], 0
jne 0x40aea9
lea eax, [esi + 2]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b500
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 0x1c], esi
cmp dword [ebx + 0x14], esi
jbe 0x40afcc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x28]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40afb3
mov esi, dword [ebx + 0xc]
imul esi, dword [ebp - 0xc]
push esi
call fcn.0040b57a
mov edi, eax
add esp, 4
test edi, edi
je 0x40af9b
mov ax, word [ebp - 0x10]
mov ecx, 0xcac1
cmp ax, cx
jne 0x40af31
push 0
lea eax, [ebp - 0x28]
push eax
push esi
push edi
push dword [ebx + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40af51
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.0040b542
add esp, 4
jmp 0x40afbb
mov ecx, 0xcac2
cmp ax, cx
je 0x40af67
mov ecx, 0xcac3
cmp ax, cx
jne 0x40af8b
push esi
push 0
push edi
call fcn.00411990
add esp, 0xc
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
push 0
push edx
push esi
push dword [ebp - 0x14]
mov eax, dword [ecx]
push dword [ebp - 0x18]
push edi
call dword [eax + 4]
add dword [ebp - 0x18], esi
push edi
adc dword [ebp - 0x14], 0
call fcn.0040b542
mov esi, dword [ebp - 0x1c]
add esp, 4
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, dword [ebx + 0x14]
jb 0x40aec1
xor esi, esi
jmp 0x40afcc
push edi
mov esi, 0xd
call fcn.0040b542
add esp, 4
jmp 0x40afbb
mov eax, 0xe
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b500
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40afcc
push dword [ebx + 0x1c]
mov byte [ebx + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b500
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416076
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041273d
mov dword [ebp - 0x14], eax
cmp dword [0x42c134], esi
jne 0x416169
push 0x800
push esi
push 0x42055c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4160f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x416249
push esi
push esi
push 0x42055c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x416249
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416249
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x42c134], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42c138], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x42c13c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42c144], eax
test eax, eax
je 0x416166
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42c140], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41618e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x416181
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4161a3
push 4
pop eax
jmp 0x41624b
cmp dword [ebp - 0x14], esi
je 0x4161a3
push dword [0x42c134]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x416188
mov eax, dword [0x42c140]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x416201
cmp dword [0x42c144], edi
je 0x416201
push eax
call ebx
push dword [0x42c144]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x416201
test eax, eax
je 0x416201
call ecx
test eax, eax
je 0x4161f6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4161f6
test byte [ebp - 8], 1
jne 0x416201
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x416231
mov eax, dword [0x42c138]
cmp eax, edi
je 0x41622e
push eax
call ebx
test eax, eax
je 0x41622e
call eax
mov esi, eax
test esi, esi
je 0x41622e
mov eax, dword [0x42c13c]
cmp eax, edi
je 0x41622e
push eax
call ebx
test eax, eax
je 0x41622e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42c134]
call ebx
test eax, eax
je 0x416249
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x41624b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b500
mov esp, ebp
pop ebp
ret
Function at 0x502cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x5052ec
mov ecx, dword [edx]
jmp 0x502cfe
mov edi, dword [edx + 4]
mov eax, dword [edi]
add edi, 4
mov esi, edi
mov ebx, esi
add edi, eax
jmp 0x502d10
mov edx, edi
dec edx
sub ecx, eax
sub ecx, 4
push edx
mov edx, 0x5052ec
mov dword [edx], ecx
mov dword [edx + 4], edi
pop edx
mov al, byte [edi]
mov ah, byte [esi]
add ah, byte [0x5050a3]
xor al, ah
jmp 0x502d35
mov byte [edi], al
cmp esi, edx
je 0x502d42
inc esi
inc edi
dec ecx
jne 0x502d24
jmp 0x502d46
mov esi, ebx
jmp 0x502d3c
jmp 0x502d4b
mov edi, esi
push 0x40
push 0x5052ec
push 0x111
jmp 0x502d5e
push dword [0x505290]
jmp 0x502d6b
call dword [sym.imp.user32.dll_SendMessageA]
mov ecx, dword [0x5052ec]
mov edi, dword [0x5052f0]
jmp 0x502d84
mov esi, dword [0x5052e0]
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x502d8a
mov esi, dword [0x50509e]
mov ecx, dword [0x50509a]
push ecx
jmp 0x502da7
add ecx, esi
mov dword [0x505270], ecx
pop ecx
mov eax, dword [esi]
inc esi
inc esi
nop
inc esi
inc esi
mov edi, dword [0x5052e0]
mov ebx, esi
add ebx, eax
mov dword [0x50526c], ebx
mov edx, esi
jmp 0x502dd0
add esi, eax
mov ecx, 0
movzx eax, byte [edx]
inc eax
cmp edx, ebx
jae 0x502e58
cmp eax, ecx
jae 0x502deb
jmp 0x502dea
ret
sub eax, ecx
mov ecx, eax
test ecx, ecx
je 0x502dfc
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x502df3
inc edx
mov al, byte [edx]
inc edx
movzx ecx, byte [edx]
test ecx, ecx
je 0x502e0f
push ecx
mov byte [edi], al
inc edi
dec ecx
jne 0x502e08
pop ecx
inc edx
movzx eax, byte [edx]
jmp 0x502e1a
inc cl
cmp cl, 0
jne 0x502e42
inc al
cmp al, 0
jne 0x502e35
inc edx
jmp 0x502e2e
movzx eax, word [edx]
inc edx
inc edx
jmp 0x502e3e
mov al, 0
dec al
jmp 0x502e3e
dec cl
jmp 0x502e54
dec cl
inc al
cmp al, 0
jne 0x502e52
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x502e54
dec al
jmp 0x502ddb
mov ecx, dword [0x505270]
sub ecx, esi
jmp 0x502e67
test ecx, ecx
je 0x502e74
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x502e6b
mov edi, dword [0x5052e0]
jmp 0x502e7f
sub edi, 0x3fd
mov dword [0x5052e0], edi
jmp 0x502e90
ret
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
jmp section..htext

Function at 0x40892b
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
call fcn.00408948
and ebx, ebx
xor dword [ecx], esi
inc ecx
cmp ecx, edi
jne fcn.0040892b
push 0xb4efe88c
pop ebx
ret

Function at 0x10002b20
Capabilities:
Authenticate hmac

Disassembly:
out 0xd0, eax
sbb byte [ebx], cl
clc
daa
into
insb byte es:[edi], dx
mov fs, word [edx + 0x43]
dec ebx
lcall 0x5305, 0x79e1e387
jnp 0x10002b46
cmp eax, 0xef3acbda
dec edx
inc esi
invalid
cmp al, 0x36
mov dword [edx], edi
mov dword ss:[edx], edi
jae 0x10002b8b
stc
leave
inc byte [ebx + 1]
sub eax, 0xbee6ac17
aas
pop ds
add byte [ecx + 0xf], ah
wait
sub eax, 0x90e1357c
and edx, eax
dec ebp
add dword [esi - 0x64efe13e], edi
dec eax
jnp 0x10002b21
fimul dword [ebx + 0x41c9ba5e]
mov ebx, dword [esi - 0x46]
leave
inc ecx
jns 0x10002ae9
pop ebp
invalid
pop ecx
popfd
xchg ebx, eax
shr ebp, 1
dec edx
sub byte ds:[eax], al
ret 0x6fa1
Function at 0x4025f0
Capabilities:
Enumerate gui resources

Disassembly:
test byte [0x4a6470], 1
jne 0x402621
or dword [0x4a6470], 1
push 0x47c500
mov dword [0x4a6468], 0x483c74
mov dword [0x4a646c], 0
call fcn.00455dea
add esp, 4
push str.RandomLogicInstaller
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4a646c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40264e
push esi
push 0x402660
call dword [sym.imp.USER32.dll_EnumWindows]
xor al, al
ret
mov al, 1
ret

Function at 0x402ba0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402bb9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402bf4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402bf0
lea ebx, [ebx]
cmp esi, eax
jae 0x402bf4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402be0
cmp esi, eax
jb 0x402bfa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403040
Capabilities:
Set registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x4a0800]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x410]
test eax, eax
jne 0x403076
xor al, al
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00454f77
add esp, 0x40c
ret
test edi, edi
je 0x40305f
push eax
lea eax, [esp + 0xc]
push 0x200
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00455e96
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x20006
push 0
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4030df
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40305f
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4030e4
mov ecx, dword [esp]
sub eax, edx
sar eax, 1
add eax, eax
push eax
push edi
push 1
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40305f
mov eax, dword [esp]
test eax, eax
je 0x40311c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x408]
xor ecx, esp
mov al, 1
call fcn.00454f77
add esp, 0x40c
ret
Function at 0x403140
Capabilities:
Set registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x4a0800]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x410]
test eax, eax
jne 0x403176
xor al, al
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00454f77
add esp, 0x40c
ret
push eax
lea eax, [esp + 0xc]
push 0x200
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00455e96
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x20006
push 0
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4031db
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40315f
mov ecx, dword [esp]
push 4
lea eax, [esp + 0x418]
push eax
push 4
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40315f
mov eax, dword [esp]
test eax, eax
je 0x40320a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x408]
xor ecx, esp
mov al, 1
call fcn.00454f77
add esp, 0x40c
ret

Function at 0x403230
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x4a0800]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x410]
test eax, eax
push ebp
mov ebp, dword [esp + 0x418]
push esi
push edi
mov edi, ecx
mov esi, edx
je 0x4032f8
push eax
lea eax, [esp + 0x18]
push 0x200
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 4
call fcn.00455e96
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x20]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4032f8
mov ecx, dword [esi]
test ecx, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jne 0x403312
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push ebp
push ecx
call edi
test eax, eax
jne 0x4032f8
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004383e6
mov ecx, dword [esp + 0x10]
lea edx, [ecx + ecx]
push edx
push 0
push eax
mov dword [esi], eax
call fcn.00459580
mov ecx, dword [esi]
add esp, 0x10
test ecx, ecx
jne 0x40332a
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00454f77
add esp, 0x40c
ret
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x403317
sub eax, esi
sar eax, 1
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push 0
push 0
push ebp
push ecx
call edi
test eax, eax
jne 0x4032f8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40334f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.00454f77
add esp, 0x40c
ret
Function at 0x403370
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x410
mov eax, dword [0x4a0800]
xor eax, esp
mov dword [esp + 0x40c], eax
mov eax, dword [esp + 0x414]
test eax, eax
jne 0x4033a6
xor al, al
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.00454f77
add esp, 0x410
ret
push eax
mov ecx, 4
lea eax, [esp + 0x10]
push 0x200
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
call fcn.00455e96
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40338f
mov edx, dword [esp]
lea eax, [esp + 4]
push eax
push ebx
lea ecx, [esp + 0x10]
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40338f
mov eax, dword [esp]
test eax, eax
je 0x403413
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x40c]
xor ecx, esp
mov al, 1
call fcn.00454f77
add esp, 0x410
ret
Function at 0x406fe0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x475060
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4a0800]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x4a0800]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
push eax
mov edi, ecx
call dword [sym.imp.ole32.dll_CoCreateGuid]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
xor ebx, ebx
push edx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.00402930
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 0xc]
add eax, 0xfffffffe
push eax
push 1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.00408b40
mov byte [esp + 0x38], 1
mov ecx, dword [eax]
mov eax, ecx
lea esi, [eax + 2]
jmp 0x407080
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x407080
sub eax, esi
sar eax, 1
push eax
lea esi, [edi + 0x58]
push ecx
call fcn.00401750
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4070bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [edi + 0x6c]
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004383e6
add esp, 4
cmp dword [esi + 0x18], 8
mov edi, eax
jb 0x4070e9
mov esi, dword [esi + 4]
jmp 0x4070ec
add esi, 4
mov ecx, edi
mov edi, edi
movzx eax, word [esi]
mov word [ecx], ax
add esi, 2
add ecx, 2
cmp ax, bx
jne 0x4070f0
push str.SoftwareVHLDMACHINE_ID
mov ebx, str.Installation_GUID
mov esi, SysReAllocString
call fcn.00403040
push edi
call fcn.004383e1
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407146
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00454f77
add esp, 0x2c
ret
Function at 0x407240
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x475e2b
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x4a0800]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a0800]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xd0]
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
call fcn.0040d920
mov dword [esp + 0xc8], ebx
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x4072af
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x40735b
push esi
call fcn.004383e6
add esp, 4
cmp dword [esp + 0x38], 8
mov edi, eax
mov eax, dword [esp + 0x24]
jae 0x4072de
lea eax, [esp + 0x24]
mov edx, dword [esp + 0x18]
push edi
push esi
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x407352
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x4878dc
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x407352
cmp dword [esp + 0x1c], ebx
je 0x407352
mov eax, dword [esp + 0x14]
cmp dword [eax], 0xfeef04bd
jne 0x407352
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
push 0x4878e0
lea ecx, [esp + 0x50]
push 0x40
push ecx
call fcn.00456467
add esp, 0x1c
add ebp, 0x94
push ebp
lea edx, [esp + 0x40]
call fcn.00408e50
push edi
call fcn.004383e1
add esp, 4
cmp dword [esp + 0x38], 8
jb 0x40736f
mov edx, dword [esp + 0x24]
push edx
call fcn.004383e1
add esp, 4
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.00454f77
add esp, 0xb8
ret 4