joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4028c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x4029c8
mov esi, edx
test edx, edx
je 0x4029c8
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x4029c8
push esi
call fcn.00417020
add esp, 4
test eax, eax
je 0x40291a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402921
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402900
jmp 0x402923
mov ebp, 0x1505
jmp 0x402923
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x4029d0
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40298a
call fcn.00402ac0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x4029c8
push ecx
call fcn.00417020
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x402a3f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x4029e8
inc ebx
dec esi
je 0x40293f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402944
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x4029e0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00417020
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4029e0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00417040
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4029e0
mov eax, 0xffffffff
jmp 0x4029c8
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402a58
inc ebx
dec esi
je 0x402985
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x40298a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402a50
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00417020
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402a50
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00417040
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402a50
jmp 0x40298a
Function at 0x4031c0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403396
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40338f
mov dword [esp], ebp
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x40324f
mov eax, dword [esp + 4]
add dword [esp], eax
mov esi, dword [esp + 0xc]
mov eax, edi
mov ebp, 0x80078071
mul ebp
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mul ebp
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 8]
mov ebx, 0x15b0
je 0x40338f
xor ebp, ebp
cmp ebx, 8
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
jb 0x4032f3
mov eax, ebx
and eax, 0x1ff8
mov dword [esp + 4], eax
xor edx, edx
mov ebp, dword [esp]
nop word cs:[eax + eax]
mov eax, edx
movzx edx, byte [ebp + edx]
mov esi, edi
and esi, edx
xor edi, edx
lea edx, [edi + esi*2]
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
mov edx, ecx
and edx, esi
xor ecx, esi
movzx ebx, byte [ebp + eax + 6]
add ebx, esi
movzx edi, byte [ebp + eax + 7]
add edi, ebx
add ebx, ecx
lea ecx, [ebx + edx*2]
mov ebx, dword [esp + 8]
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, ebx
jb 0x403280
add ebp, edx
mov dword [esp], ebp
mov esi, dword [esp + 0xc]
mov ebp, dword [esp + 4]
mov eax, ebx
sub eax, ebp
jbe 0x40321b
mov edx, ebp
not edx
add edx, ebx
mov esi, ebx
and esi, 3
mov dword [esp + 4], eax
je 0x40333e
mov dword [esp + 0x10], edx
neg esi
xor edx, edx
mov ebx, dword [esp]
nop dword [eax]
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x403320
sub ebp, edx
mov edx, dword [esp + 0x10]
cmp edx, 3
jb 0x403210
jmp 0x40334a
mov ebx, dword [esp]
cmp edx, 3
jb 0x403210
mov eax, dword [esp + 8]
sub eax, ebp
xor edx, edx
nop word cs:[eax + eax]
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403360
jmp 0x403210
shl ecx, 0x10
or ecx, edi
jmp 0x40339b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x416d80
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov ecx, eax
and ecx, 3
je 0x416dac
cmp ecx, 2
jne 0x416dbc
shr eax, 1
mov ecx, eax
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
jmp 0x416ecd
shr eax, 2
mov ecx, eax
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
jmp 0x416ecd
test eax, eax
je 0x416ecd
cmp eax, 8
jb 0x416e3e
mov ecx, edi
sub ecx, ebx
cmp ecx, 0x20
jb 0x416e46
xor ebp, ebp
cmp eax, 0x20
jb 0x416e0d
mov ebp, eax
and ebp, 0xffffffe0
xor ecx, ecx
movups xmm0, xmmword [ebx + ecx]
movups xmm1, xmmword [ebx + ecx + 0x10]
movups xmmword [edi + ecx], xmm0
movups xmmword [edi + ecx + 0x10], xmm1
add ecx, 0x20
cmp ebp, ecx
jne 0x416de0
cmp ebp, eax
je 0x416ecd
test al, 0x18
je 0x416ed6
mov edi, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xfffffff8
lea edx, [ebx + ecx]
lea esi, [edi + ecx]
and eax, 7
nop dword [eax + eax]
movsd xmm0, qword [ebx + ebp]
movsd qword [edi + ebp], xmm0
add ebp, 8
cmp ecx, ebp
jne 0x416e20
cmp ecx, dword [esp + 0x1c]
mov edi, eax
jne 0x416e4c
jmp 0x416ecd
mov edx, ebx
mov esi, dword [esp + 0x14]
jmp 0x416e4a
mov edx, ebx
mov esi, edi
mov edi, eax
lea ebp, [edi - 1]
mov ebx, edi
and ebx, 7
je 0x416e72
xor eax, eax
nop dword [eax + eax]
movzx ecx, byte [edx + eax]
mov byte [esi + eax], cl
inc eax
cmp ebx, eax
jne 0x416e60
add edx, eax
add esi, eax
sub edi, eax
cmp ebp, 7
jb 0x416ecd
xor ecx, ecx
nop dword [eax]
movzx eax, byte [edx + ecx]
mov byte [esi + ecx], al
movzx eax, byte [edx + ecx + 1]
mov byte [esi + ecx + 1], al
movzx eax, byte [edx + ecx + 2]
mov byte [esi + ecx + 2], al
movzx eax, byte [edx + ecx + 3]
mov byte [esi + ecx + 3], al
movzx eax, byte [edx + ecx + 4]
mov byte [esi + ecx + 4], al
movzx eax, byte [edx + ecx + 5]
mov byte [esi + ecx + 5], al
movzx eax, byte [edx + ecx + 6]
mov byte [esi + ecx + 6], al
movzx eax, byte [edx + ecx + 7]
mov byte [esi + ecx + 7], al
add ecx, 8
cmp edi, ecx
jne 0x416e80
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret
and eax, 0x1f
mov ecx, dword [esp + 0x14]
lea esi, [ecx + ebp]
add ebx, ebp
mov edx, ebx
jmp 0x416e4a
Function at 0x431076
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x473614]
test eax, eax
jne 0x4310c8
movzx eax, byte [0x463640]
xor al, 0xd8
mov byte [0x463660], al
movzx eax, byte [0x463641]
xor al, 0xcb
mov byte [0x463661], al
movzx eax, byte [0x463642]
mov ecx, eax
add cl, al
and cl, 0xea
sub al, cl
add al, 0x75
mov byte [0x463662], al
movzx eax, byte [0x463643]
mov ecx, eax
add cl, al
and cl, 0xf2
sub al, cl
add al, 0x79
mov byte [str.Q_D], al
mov eax, 0xb7b03a27
xor eax, dword [0x463644]
mov dword [0x463664], eax
movzx eax, byte [0x463648]
xor al, 0x2b
mov byte [0x463668], al
movzx eax, byte [0x463649]
mov ecx, eax
add cl, al
and cl, 0x3e
sub al, cl
add al, 0x9f
mov byte [0x463669], al
movzx eax, byte [0x46364a]
xor al, 0xb1
mov byte [0x46366a], al
movzx eax, byte [0x46364b]
mov ecx, eax
add cl, al
and cl, 0x9a
sub al, cl
add al, 0xcd
mov byte [0x46366b], al
mov eax, 0x1c33223e
xor eax, dword [0x46364c]
mov dword [0x46366c], eax
movzx eax, byte [0x463650]
xor al, 0xf5
mov byte [0x463670], al
mov dword [0x473614], 1
push eax
sub esp, 0x10
mov ebx, esp
push eax
mov ecx, esp
push eax
mov eax, esp
push eax
mov edx, esp
mov edi, dword [0x4733c0]
test edi, edi
je 0x43112c
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov esi, dword [0x4733c4]
xor edx, edx
cmp dword [esi], eax
je 0x43113b
mov dword [ebp - 0x10], esi
cmp edi, 1
je 0x43112c
mov esi, ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
mov edx, 1
nop word cs:[eax + eax]
cmp dword [ecx], eax
je 0x431136
inc edx
add ecx, 0xc
cmp edi, edx
jne 0x431120
mov edi, 0xffffffff
jmp 0x4311c3
mov ecx, esi
mov esi, dword [ebp - 0x10]
movzx eax, byte [0x463670]
mov byte [ebx + 0x10], al
movaps xmm0, xmmword [0x463660]
movups xmmword [ebx], xmm0
lea eax, [edx + edx*2]
mov eax, dword [esi + eax*4 + 8]
mov dword [ebx + 1], eax
mov eax, dword [0x4733c8]
mov dword [ebx + 6], eax
mov word [ebx + 0xd], 0x14
mov dword [ecx], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x10
push 0x40
push 0x3000
push eax
push 0
push ecx
push 0xffffffffffffffff
mov esi, ecx
call dword [0x4733cc]
mov edi, dword [esi]
mov ecx, 4
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [esi]
mov edi, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
push 0x8000
push eax
push esi
push 0xffffffffffffffff
call dword [0x4733d0]
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
fcompi st(6)
sub esp, 0x78
push esi
mov esi, dword [ebp + 0xc]
push esi
lea eax, [ebp + 5]
push 0x78
push eax
push esi

Function at 0x408ae1
Capabilities:
Send data
Send data on socket

Disassembly:
push edx
mov edx, dword [ecx + 4]
lea eax, [ebp - 0xc]
push 1
push eax
fcmovnb st(0), st(7)
inc ebp
cld
add byte [eax], al
add byte [eax], al
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x408b2a
push edi
mov edi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
call edi
test eax, eax
je 0x408b15
mov ebp, ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xfe
call edi
invalid
push esi
invalid
Function at 0x4027a9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push 0x40e940
lea eax, [ebp - 0x268]
push str.PYTHONHOME_s
push eax
mov dword [ebp - 4], 0x104
call esi
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.MSVCR71.dll__putenv]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
push dword [ebp + 8]
call edi
test eax, eax
jne 0x40287b
push dword [0x40e8b0]
lea eax, [ebp - 0x54]
push dword [0x40ea44]
push str.SOFTWAREPythonPythonCore_d._dInstallPath
push eax
call esi
add esp, 0x10
lea eax, [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x80000001
call esi
test eax, eax
je 0x40284f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x80000002
call esi
test eax, eax
je 0x40284f
xor eax, eax
jmp 0x40287b
lea eax, [ebp - 0x158]
push 0x40c5c8
push eax
call sub.MSVCR71.dll_strcat
push dword [ebp + 8]
lea eax, [ebp - 0x158]
push eax
call sub.MSVCR71.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x158]
push eax
call edi
pop edi
pop esi
leave
ret
Function at 0x406840
Capabilities:
Check for vm using instruction vpcext
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
insb byte es:[edi], dx
inc ebx
nop
cmp eax, 0xffffffff
je 0x4069ef
mov esi, dword [esp - 0x7b]
pop ebp
invalid
mov eax, 0x975ef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xaf

Function at 0x40a5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
out 0x45, eax
or eax, 0
jge 0x40a5f9
mov eax, dword [ebp - 0x26]
xor ebx, ebx
cmp dword [eax], 0
je 0x40a5f9
mov ebx, dword [ebp - 0x7abcfb68]
xchg ebx, eax
jne 0x40a5f0
jmp 0x40a5ff
add byte [edx + 0x5ce4ff50], ch
rol dword [eax + 9], 0x83
les eax, [ecx]
clc
test ebx, ebx
mov dword [ebp - 0xc], edi
jle 0x40a64a
mov eax, dword [ebp + 0xc]
sub esi, dword [eax + 0x5589772b]
clc
mov dword [ebp + 0x10], eax
jmp 0x40a626
mov dh, 0x45
adc byte [ebx - 0xaecff4], cl
adc eax, sym.imp.MSVCRT.dll_wcslen
mov ecx, dword [eax + esi]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
inc eax
mov dword [esi], eax
jecxz 0x40a68d
cld
add edi, dword [ebx + ecx*4 - 0x47]
clc
add esi, 4
wait
mov dword [edx - 4], esp
and eax, dword [ebp - 8]
jne 0x40a623
int1
inc ebp
cld
mov eax, 0x52014053
mov dword [ebp + 9], eax
call dword [sym.imp.MSVCRT.dll_malloc]
xor ecx, 0x31
xor esp, dword [ebp + 0x45fedb85]
clc
xor ch, byte [eax + 0x7e]
push esp
mov eax, dword [ebp + 0xc]
mov eax, edx
hlt
mov eax, dword [ebp + 0x10]
xor dl, byte [edi]
mov dword [edx + ebx + 0x34fc248d], edx
push ebp
adc byte [ecx + 0x7b18b2b], cl
in eax, 0xa2
retf 0x33f0
mov dword [ebx], ebp
mov esi, dword [ecx - 0x355d1af9]
lock xor edx, dword [edx + 0x50]
call 0xbdabf0
mov ebx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
sbb al, cl
or ebx, 4
add esi, eax
mov eax, dword [ebp + 0x17]
dec eax
mov dword [ebp + 0xc], eax
jne 0x40a67f
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x2e]
mov eax, dword [ebp - 8]
push ebx
add al, 0x8f
add byte [eax], al
add byte [eax], al
mov byte [esi], 0
sub esi, eax
inc esi
push esi
push eax
call dword [0x402e20]
mov ecx, dword [ebp - 8]
add esp, 8
cmpsd dword [esi], dword es:[edi]
or bl, byte [esi + 0x74]
xor dword [ebx - 0x3f], edx
mov ecx, eax
xor eax, dword [edx - 0x7b]
fstp xword [esi + 0x1a]
or byte [edi + eax*4], dl
add edx, ecx
mov dword [edi + eax*4], edx
inc eax
cmp eax, ebx
jl 0x40a6e7
push ecx
dec ebp
or byte [ebx + 0x5f3989c3], cl
pop ebx
mov esp, ebp
add ebx, 0xe2fc098b
ret
Function at 0x485cd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4d000]
push edi
jmp 0x485cea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x485cf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x485ce0
mov eax, 1
add ebx, ebx
jne 0x485d03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x485d14
jne 0x485d33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x485d33
dec eax
add ebx, ebx
jne 0x485d20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x485cf8
add ebx, ebx
jne 0x485d2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x485d85
xor ecx, ecx
sub eax, 3
jb 0x485d4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x485dba
sar eax, 1
mov ebp, eax
jmp 0x485d56
add ebx, ebx
jne 0x485d56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x485d24
inc ecx
add ebx, ebx
jne 0x485d64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x485d24
add ebx, ebx
jne 0x485d71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x485d66
jne 0x485d82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x485d66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x485da4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x485d96
jmp 0x485ce6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x485da4
add edi, ecx
jmp 0x485ce6
pop esi
mov edi, esi
mov ecx, 0x2f8c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x485dc2
cmp byte [edi], 0x1b
jne 0x485dc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x485dc7
lea edi, [esi + 0x82000]
mov eax, dword [edi]
or eax, eax
je 0x485e3f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x86afc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x86bd8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x485df4
mov ecx, edi
jns 0x485e23
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x86bdc]
or eax, eax
je 0x485e39
mov dword [ebx], eax
add ebx, 4
jmp 0x485e11
call dword [esi + 0x86bec]
mov ebp, dword [esi + 0x86be0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x485e73
sub esp, 0xffffff80
jmp 0x44165e
Function at 0x4025f7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.Py_SetProgramName
push edi
mov ebx, eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 8], eax
call esi
push str.PySys_GetObject
push edi
mov dword [ebp - 4], eax
call esi
push str.Py_OptimizeFlag
push edi
mov dword [ebp - 0xc], eax
call esi
xor esi, esi
cmp dword [0x40c43c], esi
jne 0x402655
xor eax, eax
jmp 0x40269f
cmp ebx, esi
je 0x40269c
cmp dword [ebp + 8], esi
je 0x40269c
cmp dword [ebp - 8], esi
je 0x40269c
cmp dword [ebp - 4], esi
je 0x40269c
cmp dword [ebp - 0xc], esi
je 0x40269c
cmp eax, esi
je 0x40269c
xor ecx, ecx
cmp dword [ebp + 0xc], esi
push str.C:UsersAdminAppDataLocalTemp_a46e99c5da3871c18bbddf7ec2c406a68c0d5e70cbcf96c85c54af0a9629eae6.exe
setne cl
mov dword [eax], ecx
call dword [ebp + 8]
call ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004026a4
add esp, 0xc
mov esi, eax
call dword [ebp - 8]
mov eax, esi
jmp 0x40269f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4027a9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push 0x40d920
lea eax, [ebp - 0x268]
push str.PYTHONHOME_s
push eax
mov dword [ebp - 4], 0x104
call esi
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.MSVCRT.dll__putenv]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
push dword [ebp + 8]
call edi
test eax, eax
jne 0x40287b
push dword [0x40d890]
lea eax, [ebp - 0x54]
push dword [0x40da24]
push str.SOFTWAREPythonPythonCore_d._dInstallPath
push eax
call esi
add esp, 0x10
lea eax, [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x80000001
call esi
test eax, eax
je 0x40284f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x80000002
call esi
test eax, eax
je 0x40284f
xor eax, eax
jmp 0x40287b
lea eax, [ebp - 0x158]
push 0x40b5c8
push eax
call sub.MSVCRT.dll_strcat
push dword [ebp + 8]
lea eax, [ebp - 0x158]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x158]
push eax
call edi
pop edi
pop esi
leave
ret
Function at 0x402a0a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.Py_SetProgramName
push edi
mov ebx, eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 8], eax
call esi
push str.PyErr_Print
push edi
mov dword [ebp - 4], eax
call esi
mov esi, eax
xor eax, eax
cmp ebx, eax
je 0x402a91
cmp dword [ebp + 8], eax
je 0x402a91
cmp dword [ebp - 8], eax
je 0x402a91
cmp dword [ebp - 4], eax
je 0x402a91
cmp esi, eax
je 0x402a91
push str.C:UsersAdminAppDataLocalTemp_a46e99c5da3871c18bbddf7ec2c406a68c0d5e70cbcf96c85c54af0a9629eae6.exe
call dword [ebp + 8]
call ebx
push edi
call fcn.00402a99
push dword [ebp + 0xc]
call dword [ebp - 4]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x402a8a
call esi
call dword [ebp - 8]
mov eax, edi
jmp 0x402a94
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402a99
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.PyImport_ImportModule
push edi
call esi
push str.PyObject_SetAttrString
push edi
mov ebx, eax
call esi
push str.PyObject_GetAttrString
push edi
mov dword [ebp - 8], eax
call esi
push str.PyCFunction_New
push edi
mov dword [ebp + 8], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 4], eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 0x10], eax
call esi
push str.PyLong_FromVoidPtr
push edi
mov dword [ebp - 0x14], eax
call esi
xor esi, esi
mov dword [ebp - 0x18], eax
cmp ebx, esi
je 0x402ba7
cmp dword [ebp + 8], esi
je 0x402ba7
cmp dword [ebp - 8], esi
je 0x402ba7
cmp dword [ebp - 4], esi
je 0x402ba7
cmp dword [ebp - 0xc], esi
je 0x402ba7
cmp dword [ebp - 0x10], esi
je 0x402ba7
cmp dword [ebp - 0x14], esi
je 0x402ba7
push str.__builtin__
call ebx
mov edi, eax
pop ecx
cmp edi, esi
je 0x402b83
push str.ValueError
push edi
call dword [ebp + 8]
push str.OSError
push edi
mov dword [0x40d894], eax
call dword [ebp + 8]
add esp, 0x10
mov dword [0x40da2c], eax
mov esi, 0x40b0c8
push 0
push esi
call dword [ebp - 4]
push eax
push dword [esi]
push edi
call dword [ebp - 8]
add esi, 0x10
add esp, 0x14
cmp esi, 0x40b128
jb 0x402b68
mov eax, dword [ebp - 0xc]
mov dword [0x40d908], eax
mov eax, dword [ebp - 0x10]
mov dword [0x40d90c], eax
mov eax, dword [ebp - 0x14]
mov dword [0x40d704], eax
mov eax, dword [ebp - 0x18]
mov dword [0x40da50], eax
xor eax, eax
jmp 0x402baa
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret