joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f0a58
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5f0ab5
cmp byte [ebx + 0xeb], 0
jne 0x5f0ab5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040ba58
mov eax, dword [esi]
test eax, eax
je 0x5f0aa2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5f0ac2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040bcb0
jmp 0x5f0ac2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040bcb0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5f26e4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5f2755
mov eax, esi
call fcn.005444cc
test al, al
je 0x5f2755
mov eax, dword [ebx + 0x98]
call fcn.00544064
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5f2755
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x5f2746
push 0
mov eax, dword [ebx + 0x98]
call fcn.00544064
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0053a29c
jmp 0x5f2755
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005f24f0
pop esi
pop ebx
ret
Function at 0x5faf10
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x94], 0
jne 0x5faf96
mov eax, dword [ebx + 8]
call fcn.00544064
mov ecx, eax
mov dl, 1
mov eax, dword [0x557088]
call fcn.0053db48
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
xor edx, edx
mov eax, esi
call fcn.005667cc
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5fa7e0
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.00544064
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.00544064
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa4], 0
jne 0x5fb018
mov eax, dword [ebx + 8]
call fcn.00544064
mov ecx, eax
mov dl, 1
mov eax, dword [0x557088]
call fcn.0053db48
mov dword [ebx + 0xa4], eax
mov esi, dword [ebx + 0xa4]
mov dl, 1
mov eax, esi
call fcn.005667cc
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5fa82c
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
call fcn.00544064
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa4]
call fcn.00544064
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5fb096
mov eax, dword [ebx + 8]
call fcn.00544064
mov ecx, eax
mov dl, 1
mov eax, dword [0x557b7c]
call fcn.0053db48
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov byte [esi + 0x2b0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00544064
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00544064
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x639e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
jmp 0x639e92
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 8
jge 0x639ee0
movzx edx, word [ebp + 0xc]
and edx, 0x80
je 0x639eb4
movzx eax, word [ebp + 0xc]
xor eax, 0x658e
mov word [ebp + 0xc], ax
movzx ecx, word [ebp + 0xc]
shl ecx, 1
mov word [ebp + 0xc], cx
movzx edx, byte [ebp + 8]
and edx, 0x80
je 0x639ed6
mov ax, word [ebp + 0xc]
add ax, 1
mov word [ebp + 0xc], ax
mov cl, byte [ebp + 8]
shl cl, 1
mov byte [ebp + 8], cl
jmp 0x639e8a
mov ax, word [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x639f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp 0x639f4f
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jbe 0x639fc5
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
mov byte [ebp - 2], dl
mov byte [ebp - 1], 0
jmp 0x639f6b
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 8
jge 0x639fba
movzx edx, word [ebp + 0x10]
and edx, 0x8000
je 0x639f8d
movzx eax, word [ebp + 0x10]
xor eax, 0x8411
mov word [ebp + 0x10], ax
mov cx, word [ebp + 0x10]
shl cx, 1
mov word [ebp + 0x10], cx
movzx edx, byte [ebp - 2]
and edx, 0x80
je 0x639fb0
mov ax, word [ebp + 0x10]
add ax, 1
mov word [ebp + 0x10], ax
mov cl, byte [ebp - 2]
shl cl, 1
mov byte [ebp - 2], cl
jmp 0x639f63
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x639f46
mov ax, word [ebp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x6b1b30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x104], ecx
mov dword [eax + 0x100], ecx
mov dword [eax + 0x108], 0x6a09e667
mov dword [eax + 0x10c], 0xbb67ae85
mov dword [eax + 0x110], 0x3c6ef372
mov dword [eax + 0x114], 0xa54ff53a
mov dword [eax + 0x118], 0x510e527f
mov dword [eax + 0x11c], 0x9b05688c
mov dword [eax + 0x120], 0x1f83d9ab
mov dword [eax + 0x124], 0x5be0cd19
mov dword [eax], 0x428a2f98
mov dword [eax + 4], 0x71374491
mov dword [eax + 8], 0xb5c0fbcf
mov dword [eax + 0xc], 0xe9b5dba5
mov dword [eax + 0x10], 0x3956c25b
mov dword [eax + 0x14], 0x59f111f1
mov dword [eax + 0x18], 0x923f82a4
mov dword [eax + 0x1c], 0xab1c5ed5
mov dword [eax + 0x20], 0xd807aa98
mov dword [eax + 0x24], 0x12835b01
mov dword [eax + 0x28], 0x243185be
mov dword [eax + 0x2c], 0x550c7dc3
mov dword [eax + 0x30], 0x72be5d74
mov dword [eax + 0x34], 0x80deb1fe
mov dword [eax + 0x38], 0x9bdc06a7
mov dword [eax + 0x3c], 0xc19bf174
mov dword [eax + 0x40], 0xe49b69c1
mov dword [eax + 0x44], 0xefbe4786
mov dword [eax + 0x48], 0xfc19dc6
mov dword [eax + 0x4c], 0x240ca1cc
mov dword [eax + 0x50], 0x2de92c6f
mov dword [eax + 0x54], 0x4a7484aa
mov dword [eax + 0x58], 0x5cb0a9dc
mov dword [eax + 0x5c], 0x76f988da
mov dword [eax + 0x60], 0x983e5152
mov dword [eax + 0x64], 0xa831c66d
mov dword [eax + 0x68], 0xb00327c8
mov dword [eax + 0x6c], 0xbf597fc7
mov dword [eax + 0x70], 0xc6e00bf3
mov dword [eax + 0x74], 0xd5a79147
mov dword [eax + 0x78], 0x6ca6351
mov dword [eax + 0x7c], 0x14292967
mov dword [eax + 0x80], 0x27b70a85
mov dword [eax + 0x84], 0x2e1b2138
mov dword [eax + 0x88], 0x4d2c6dfc
mov dword [eax + 0x8c], 0x53380d13
mov dword [eax + 0x90], 0x650a7354
mov dword [eax + 0x94], 0x766a0abb
mov dword [eax + 0x98], 0x81c2c92e
mov dword [eax + 0x9c], 0x92722c85
mov dword [eax + 0xa0], 0xa2bfe8a1
mov dword [eax + 0xa4], 0xa81a664b
mov dword [eax + 0xa8], 0xc24b8b70
mov dword [eax + 0xac], 0xc76c51a3
mov dword [eax + 0xb0], 0xd192e819
mov dword [eax + 0xb4], 0xd6990624
mov dword [eax + 0xb8], 0xf40e3585
mov dword [eax + 0xbc], 0x106aa070
mov dword [eax + 0xc0], 0x19a4c116
mov dword [eax + 0xc4], 0x1e376c08
mov dword [eax + 0xc8], 0x2748774c
mov dword [eax + 0xcc], 0x34b0bcb5
mov dword [eax + 0xd0], 0x391c0cb3
mov dword [eax + 0xd4], 0x4ed8aa4a
mov dword [eax + 0xd8], 0x5b9cca4f
mov dword [eax + 0xdc], 0x682e6ff3
mov dword [eax + 0xe0], 0x748f82ee
mov dword [eax + 0xe4], 0x78a5636f
mov dword [eax + 0xe8], 0x84c87814
mov dword [eax + 0xec], 0x8cc70208
mov dword [eax + 0xf0], 0x90befffa
mov dword [eax + 0xf4], 0xa4506ceb
mov dword [eax + 0xf8], 0xbef9a3f7
mov dword [eax + 0xfc], 0xc67178f2
pop ebp
ret
Function at 0x6c0f40
Capabilities:
Authenticate hmac

Disassembly:
push 0x733481
call fcn.008b1a54
mov eax, dword [0xbb88aa82]
pop ebx
sal byte [eax + 0x1d2e1723], cl
je 0x6c0f9e
inc esi
jl 0x6c0f80
inc esp
add bh, byte [0xfa5c4135]
mul bh
imul edx, dword [eax - 0xde6646c], 0x6b
les esp, [esi - 0x271f72bb]
sbb ecx, dword [ebx - 0x59697ff5]
xor dl, byte [edx]
imul edx, dword [edx], 0xffffffb6
mov esp, 0x939bbde6
xchg ebx, eax
push edx
jecxz 0x6c0f4f
pop esi
out 0x57, al
xchg dword [eax + eax*4 + 0x2c], eax
in al, 0x36
add cl, byte [eax - 0x45]
mov byte [0x931418b7], al
and ah, byte [esi]
out dx, al
cmp dword [esi - 0x19], eax
loop 0x6c0fd7
sub byte [ecx + 0x58498788], 0xf
push ds
bound ebx, qword [ecx - 0x6f]
test eax, 0x58498788
nop dword [edx + 0x59]
xchg ecx, eax
xchg edi, eax
cmp cl, 0xef
cmp edi, dword [edi - 0x6a]
lcall 0x3226, 0x69994d07
xchg byte [eax + 0x78], ah
adc dword [eax + 0x7d2d885d], edi
sti
enter 0xffffffffffffb4f0, 0x5c
dec esi
push ebp
xchg dword [edi + 0x53], ebx
shl dword [ebx], cl
arpl word [ebx + 0x21fafa3b], dx
into
fild word [ebp + 0x3b270c58]
cmp eax, 0x3affa987
cmp edi, dword [0x3affa987]
je 0x6c1012
int 0xcf
aam 0x34
pop ds
std
invalid
mov edx, 0xdc47b2a3
mov ebx, 0xc9134c79
mov edx, 0x37d4fe0f
adc byte [ebx], bh
dec esp
jnp 0x6c107c
in eax, dx
dec esp
hlt
mov esi, 0x74ccc5a3
movsd dword es:[edi], dword [esi]
lock xor byte [0xcccccca7], bl
int3

Function at 0x6d2700
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateDirectoryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6d2728
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x6d2728
xor eax, eax
jmp 0x6d272d
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x6d4270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x62
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x66
mov eax, dword [ebp + 0xc]
shl eax, 1
cmp eax, dword [ebp + 0x14]
jbe 0x6d42cc
or eax, 0xffffffff
jmp 0x6d4319
jmp 0x6d42d7
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jae 0x6d4317
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
sar ecx, 4
and ecx, 0xf
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp + ecx - 0x14]
mov byte [eax + edx*2], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
and eax, 0xf
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov al, byte [ebp + eax - 0x14]
mov byte [edx + ecx*2 + 1], al
jmp 0x6d42ce
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x6d9180
Capabilities:
Check http status code

Disassembly:
lodsb al, byte [esi]
pushal
add byte [ebx + 0x68c35de5], cl
push 0x97c3b6
invalid
retf 0x1d88
push 0x97c3b6
call fcn.008b1a54
push esi
in al, 0x13
inc dword [edi]
dec esi
cdq
push ebp
or byte [ecx - 0x3fd4e082], dh
mov dh, 0x63
movsb byte es:[edi], byte gs:[esi]
enter 0xffffffffffff9a4e, 0x69
sub al, 0x86
cmp al, 0xc8
leave
shl dword [0x655c2e11], 1
jo 0x6d91b0
push dword [ebx - 0x3b]
jae 0x6d9178
adc ecx, esp
int3

Function at 0x6e69f0
Capabilities:
Check for software breakpoints

Disassembly:
push 0xb05753
call fcn.008b1a54
xlatb
idiv byte [0x4b2a72b7]
and eax, 0xd9def809
shl dword [ebp - 0x1e4b3500], 1
pushal
push esi
popal
mov dh, 0xe1
outsd dx, dword [esi]
mov bh, 0x3c
rcr byte [ebx - 0x6551b6ee], 1
xchg edx, eax
dec esp
push 0xffffffffffffffb8
mov byte [edi + 0x7fb2b206], dl
mov dh, 0x37
dec ecx
cld
out 0xe3, al
adc dh, byte [ecx + 0x356aedec]
push 0x35
mov ch, 0x99
sbb ebp, esp
aam 0x28
lea eax, [ebx + 0x7f]
pop eax
pop esp
inc ebp
call [ecx]
shl ecx, cl
dec esi
sbb ebx, edx
loope 0x6e6a91
add al, 0xfe
jno 0x6e6a2f
mov bh, 0xbb
lodsd eax, dword [esi]
jnp 0x6e6a71
add eax, 0xe9ca2613
mov dword [0x19d], eax
dec ebp
leave
cmp eax, 0x48962772
jno 0x6e6a7b
retf 0x67e9
xor al, 0x56
jne 0x6e6a1c
mov eax, 0xa54afd73
jae 0x6e6a63
dec edx
movsd dword es:[edi], dword [esi]
add ebp, ebx
push ss
push eax
js 0x5907d7ea
pop eax
std
retf 0xc49c
cmp byte [esi + 0x1e], dh
lahf
jb 0x6e6a3f
inc eax
jbe 0x6e6a4f
mov dh, 0xff
std
push es
insb byte es:[edi], dx
and byte [ecx], ch
add byte [esi + 0x38397097], bl
invalid

Function at 0x6f1ff0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jle 0x6f202b
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x6f2023
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x6f202d
inc edx
add eax, 0x28
cmp edx, esi
jl 0x6f2013
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x6f24a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x3c]
movzx ecx, word [edi + eax + 0x14]
add edi, eax
xor edx, edx
xor ebx, ebx
lea esi, [ecx + edi + 0x18]
cmp dx, word [edi + 6]
jb 0x6f24d3
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push eax
call fcn.006f22e0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp ecx, eax
jb 0x6f24f4
mov edx, dword [esi + 8]
add edx, eax
cmp ecx, edx
jb 0x6f2507
movzx eax, word [edi + 6]
inc ebx
add esi, 0x28
cmp ebx, eax
jl 0x6f24d0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x4041dc
Capabilities:
Encode data using xor

Disassembly:
push 0x28
mov eax, 0x467b80
call fcn.0044baef
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], esi
lea eax, [ebp + 0xc]
push eax
xor edi, edi
lea eax, [ebp - 0x2c]
inc edi
push eax
mov dword [ebp - 4], edi
call fcn.00404037
pop ecx
pop ecx
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00403939
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x18], esi
jbe 0x404241
push esi
lea ecx, [ebp - 0x2c]
call fcn.004034fa
xor byte [eax], 0x5a
push esi
lea ecx, [ebp - 0x2c]
call fcn.004034fa
movzx eax, byte [eax]
push eax
mov ecx, ebx
call fcn.00403a69
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x40421b
push 0
push edi
lea ecx, [ebp - 0x2c]
call fcn.004018f0
push 0
push edi
lea ecx, [ebp + 0xc]
call fcn.004018f0
mov eax, ebx
call fcn.0044bb72
ret

Function at 0x404271
Capabilities:
Delete directory

Disassembly:
push 8
mov eax, 0x4672f8
call fcn.0044ba86
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040394d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.BnB0cA
mov byte [ebp - 4], 1
call fcn.004023d2
lea eax, [ebp - 0x14]
push eax
call fcn.004041dc
add esp, 0x20
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.00403e47
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401268
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.0040394d
call fcn.00403b00
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401268
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401268
call fcn.0044bb5e
ret
Function at 0x40430a
Capabilities:
Check os version

Disassembly:
push ebp
sub esp, 0x94
lea ebp, [esp - 4]
mov eax, dword [0x48c170]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0xc
mov eax, 0x46734c
call fcn.0044ba86
mov ebx, dword [ebp + 0xa0]
sub esp, 0x1c
xor esi, esi
mov dword [ebp - 0x14], esi
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.DzQxNDUtNA
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ebx
call fcn.004023d2
push ebx
call fcn.004041dc
mov dword [ebp - 4], esi
mov esi, 0x94
push esi
xor edi, edi
lea eax, [ebp]
push 0
inc edi
push eax
mov dword [ebp - 0x14], edi
call fcn.0044b3d0
add esp, 0x2c
lea eax, [ebp]
push eax
mov dword [ebp], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp + 4], 5
jne 0x4043e1
cmp dword [ebp + 8], edi
jne 0x4043b2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.DTM0Ago
call fcn.004023d2
lea eax, [ebp - 0x10]
push eax
call fcn.004041dc
add esp, 0x20
mov dword [ebp - 4], edi
jmp 0x40443e
push 2
pop esi
cmp dword [ebp + 8], esi
jne 0x404451
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.DTM0AgoFbG4
call fcn.004023d2
lea eax, [ebp - 0x10]
push eax
call fcn.004041dc
add esp, 0x20
mov dword [ebp - 4], esi
jmp 0x40443e
cmp dword [ebp + 4], 6
jne 0x404451
cmp dword [ebp + 8], 0
jne 0x404414
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.DTM0DDMpLjs
call fcn.004023d2
lea eax, [ebp - 0x10]
push eax
call fcn.004041dc
add esp, 0x20
mov dword [ebp - 4], 3
jmp 0x40443e
cmp dword [ebp + 8], edi
jne 0x404451
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.DTM0bQ
call fcn.004023d2
lea eax, [ebp - 0x10]
push eax
call fcn.004041dc
add esp, 0x20
mov dword [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.00403f47
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401268
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0044ba77
add ebp, 0x98
leave
ret

Function at 0x40453a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x48c170]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x110], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.0044b3d0
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x10c]
push eax
mov ecx, edi
call fcn.00404476
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0044ba77
leave
ret
Function at 0x404689
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x318
lea ebp, [esp - 4]
mov eax, dword [0x48c170]
xor eax, ebp
mov dword [ebp + 0x318], eax
push 0x10
mov eax, 0x4673d9
call fcn.0044ba86
mov eax, dword [ebp + 0x328]
and dword [ebp - 4], 0
mov edi, dword [ebp + 0x324]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x1c], edi
call fcn.0040464b
mov esi, 0x105
push esi
xor ebx, ebx
lea eax, [ebp + 0x108]
push 0
inc ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0044b3d0
add esp, 0x10
push esi
lea eax, [ebp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
lea eax, [ebp]
push 0
push eax
call fcn.0044b3d0
add esp, 0xc
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp + 0x210]
push 0
push eax
call fcn.0044b3d0
add esp, 0xc
lea eax, [ebp + 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [ebp - 0x18]
mov ecx, edi
call fcn.00404476
push dword [ebp - 0x10]
mov ecx, edi
push str.APPPATH
mov dword [ebp - 0x14], ebx
call fcn.00403bed
lea eax, [ebp + 0x108]
push eax
push str.SYSTEMPATH
mov ecx, edi
call fcn.00403bed
lea eax, [ebp]
push eax
push str.WINDOWSPATH
mov ecx, edi
call fcn.00403bed
lea eax, [ebp + 0x210]
push eax
push str.TEMPPATH
mov ecx, edi
call fcn.00403bed
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401268
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x318]
xor ecx, ebp
call fcn.0044ba77
add ebp, 0x31c
leave
ret
Function at 0x4062bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xa4
mov eax, dword [0x48c170]
xor eax, ebp
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x70]
mov edx, dword [ebp + 0x74]
push edi
mov edi, dword [ebp + 0x78]
test eax, eax
jne 0x4062f7
lea eax, [ebp - 0x38]
push eax
push 1
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40630b
push ebx
lea ebx, [ebp - 0x38]
push ebx
or eax, 1
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop ebx
test eax, eax
je 0x406313
xor eax, eax
jmp 0x406346
test edi, edi
je 0x406338
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push edi
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0x96
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40630f
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0x64]
xor ecx, ebp
pop edi
call fcn.0044ba77
add ebp, 0x68
leave
ret

Function at 0x408e71
Capabilities:
Encode data using xor

Disassembly:
push 0x28
mov eax, 0x467b80
call fcn.0044baef
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], esi
lea eax, [ebp + 0xc]
push eax
xor edi, edi
lea eax, [ebp - 0x2c]
inc edi
push eax
mov dword [ebp - 4], edi
call fcn.00404037
pop ecx
pop ecx
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00403939
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x18], esi
jbe 0x408eda
push esi
lea ecx, [ebp - 0x2c]
call fcn.004034fa
xor byte [eax], 0x5a
push esi
lea ecx, [ebp - 0x2c]
call fcn.004034fa
movsx ax, byte [eax]
movzx eax, ax
push eax
mov ecx, ebx
call fcn.00408572
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x408eb0
push 0
push edi
lea ecx, [ebp - 0x2c]
call fcn.004018f0
push 0
push edi
lea ecx, [ebp + 0xc]
call fcn.004018f0
mov eax, ebx
call fcn.0044bb72
ret
Function at 0x408ef8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x100
lea ebp, [esp - 4]
mov eax, dword [0x48c170]
xor eax, ebp
mov dword [ebp + 0x100], eax
push 0x44
mov eax, 0x467bbe
call fcn.0044bab9
mov ecx, dword [ebp + 0x10c]
mov eax, dword [ebp + 0x118]
mov esi, dword [ebp + 0x110]
mov edi, dword [ebp + 0x114]
xor ebx, ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], ebx
call fcn.00403939
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x11c]
cmp eax, ebx
jne 0x408f62
lea eax, [ebp - 0x14]
push eax
push 0x20019
jmp 0x408f6c
lea ecx, [ebp - 0x14]
push ecx
or eax, 0x20019
push eax
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40902e
push 0xfe
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.0044b3d0
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x30], 0xff
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], 4
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x409025
push dword [ebp - 0x18]
call fcn.0044ddf8
pop ecx
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x40901e
cmp dword [ebp - 0x24], 1
jne 0x40901e
mov ecx, dword [ebp - 0x20]
push edi
call fcn.00404008
push edi
call fcn.0044b603
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x100]
xor ecx, ebp
call fcn.0044ba77
add ebp, 0x104
leave
ret