joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4801a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
mov edi, dword [ebp + 8]
cmp byte [edi], 0
je 0x4801ea
cmp byte [edi + 1], 0
je 0x4801d8
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4801f0
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
push ebx
je 0x480215
cmp byte [edi + 1], 0
je 0x48020e
push 1
push 0
push 0
push dword [edi + 4]
call ecx
mov ebx, eax
sub ebx, dword [edi + 0xc]
jmp 0x480218
xor ebx, ebx
mov dword [ebp - 0x14], ebx
jmp 0x480227
mov ebx, dword [edi + 0x1c]
mov eax, 0xffff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
cmp ebx, eax
jae 0x48022a
mov dword [ebp - 0x10], ebx
push esi
push 0x404
call fcn.00426a3c
mov esi, eax
add esp, 4
test esi, esi
jne 0x480252
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov eax, 4
mov dword [ebp - 0xc], 0xffffffff
cmp ecx, eax
jbe 0x480358
lea esp, [esp]
add eax, 0x400
cmp eax, ecx
mov edx, eax
mov eax, 0x404
cmova edx, ecx
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x20], edx
sub ebx, ecx
mov dword [ebp - 0x1c], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x4802ba
cmp byte [edi + 1], 0
je 0x480358
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4802bd
mov dword [edi + 0x1c], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0x18], ebx
je 0x4802e5
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4802e0
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x48030e
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x4802f8
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0x18], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call fcn.00424600
mov eax, dword [ebp - 0x18]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x480358
lea eax, [ebx - 3]
test eax, eax
js 0x480340
mov edi, edi
dec eax
cmp byte [eax + esi], 0x50
jne 0x48033c
cmp byte [eax + esi + 1], 0x4b
jne 0x48033c
cmp byte [eax + esi + 2], 5
jne 0x48033c
cmp byte [eax + esi + 3], 6
je 0x480375
test eax, eax
jns 0x480320
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x480358
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
cmp eax, ecx
jb 0x480270
push esi
call fcn.004239a7
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0xc]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.0042419e
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x480343
Function at 0x480380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4a3350]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
cmp byte [esi], 0
je 0x4803c7
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4803c2
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x4803f4
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x4803d8
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.00424600
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x480412
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042419e
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x4803ff
cmp byte [esi + 8], 0
je 0x4803ff
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042419e
mov esp, ebp
pop ebp
ret

Function at 0x480570
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
mov ecx, esi
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
mov ecx, dword [edi]
shr eax, 8
xor dl, al
movsx eax, dl
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x49a318]
xor eax, ecx
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, esi
shr esi, 8
and eax, 0xff
xor esi, dword [eax*4 + 0x49a318]
mov al, dl
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
ret

Function at 0x481090
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push edi
push 0
push 0
mov edi, ecx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x48110c
push 0
push 2
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x48110c
push esi
lea esi, [edi + 8]
push esi
push 0x49ae24
push 1
push 0
push 0x49aef4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x48110b
push str.._rootcimv2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edx, dword [esi]
lea ecx, [edi + 0xc]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [edi], eax
mov esi, dword [edx]
push eax
push edx
call dword [esi + 0xc]
test eax, eax
js 0x48110b
mov dword [edi + 4], 1
pop esi
pop edi
ret
Function at 0x408fc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x12c
mov eax, dword [0x447d10]
mov dword [esp + 0x128], eax
mov al, byte [0x449d54]
test al, al
jne 0x4090da
lea eax, [esp]
push eax
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea ecx, [esp + 4]
push ecx
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x409031
mov eax, dword [esp + 4]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov edx, dword [esp + 4]
mov eax, dword [esp]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
jmp 0x409043
lea eax, [esp + 0x24]
push 0x4398b8
push eax
call fcn.00416f3f
add esp, 8
mov eax, dword [esp]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409053
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x10]
call fcn.00403ef0
push 8
push str.PES6CO_
lea ecx, [esp + 0x10]
call fcn.00408870
push 0x16
push str.PES6_Colombia_v._Copas
lea ecx, [esp + 0x10]
call fcn.00408870
push 1
push 0x439890
lea ecx, [esp + 0x10]
call fcn.00408870
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x4090aa
lea eax, [esp + 0xc]
push 0x410
push eax
push 0x449388
call fcn.004171a0
mov eax, dword [esp + 0x2c]
add esp, 0xc
cmp eax, 0x10
mov byte [0x449d54], 1
jb 0x4090da
mov eax, dword [esp + 0xc]
push eax
call fcn.0042cfc9
add esp, 4
mov ecx, dword [esp + 0x128]
mov eax, 0x449388
call fcn.004164ae
add esp, 0x12c
ret

Function at 0x40c553
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c568
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40c57a
xor eax, eax
jmp 0x40c5ac
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40c59e
cmp esi, eax
jae 0x40c576
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40c590
cmp esi, eax
jae 0x40c576
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x10e88058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10e881a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10e8807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e8806a
add dl, dl
jne 0x10e88089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e880dc
xor eax, eax
add dl, dl
jne 0x10e88096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e8817d
add dl, dl
jne 0x10e880a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e880b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e880bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e880c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10e880d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10e88075
mov eax, 1
add dl, dl
jne 0x10e880ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e880f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e880e1
sub eax, ebx
mov ebx, 1
jne 0x10e88128
mov ecx, 1
add dl, dl
jne 0x10e8810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10e88119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e88105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e88075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10e8813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10e8814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e88136
cmp eax, 0x7d00
jae 0x10e8816d
cmp eax, 0x500
jb 0x10e88168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e88075
cmp eax, 0x7f
ja 0x10e88170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e88075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10e8819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10e88075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40f22e
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f2cb
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f2cb
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f2cb
push 4
push 0xffffffffffffffff
push esi
push 0x40f9e5
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f2cb
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f296
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f2cb
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f2d1
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f2cd

Function at 0x41329c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4132ab
pop dword [ebp - 0x2c]
mov eax, 0x4132ab
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x41a17
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x4308
mov edx, eax
mov edi, 0xf0b09b76
sub edi, 0xf06c1376
add edi, dword [ebp - 0x2c]
mov esi, 0x6fc47841
mov dword [ebp - 0x18], 0x610cb0be
mov ebx, dword [edi]
xor ebx, esi
sub dword [ebp - 8], eax
mov dword [edx], ebx
xor dword [ebp - 0x10], eax
add edx, 0x1f03a5c8
sub edx, 0x1f03a5c4
add edi, 0xb77ef7ac
sub edi, 0xb77ef7a8
loop 0x4132f4
add eax, 0xe7f8582
sub eax, 0xe7e868f
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x413ca1
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413cb1
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x413cb7
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x413cdf
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x413cc6
mov esi, ecx
jmp 0x413ce2
movzx esi, si
pop edi
cmp cx, si
je 0x413cff
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x413ce3
mov eax, 0x437338
jmp 0x413d07
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x1001305b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1001306a
pop dword [ebp - 0x18]
mov eax, 0xd425b637
add eax, 0x3bdb7a33
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xb63c0ac1
add dword [ebp - 0x28], 0x98163a8a
mov dword [ebp - 0x24], 0x78c4838d
add dword [ebp - 0x24], 0xb96ec8b8
mov dword [ebp - 0x20], 0xa70191bd
add dword [ebp - 0x20], 0xa54ab271
mov dword [ebp - 0x1c], 0xedf47f1
add dword [ebp - 0x1c], 0xf120b80f
lea eax, [ebp - 0x28]
push eax
mov eax, 0xa8390cf5
add eax, 0x67c8f30f
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x5a6d1be
sub dword [ebp - 0x28], 0x91346868
mov dword [ebp - 0x24], 0x6761fe9b
add dword [ebp - 0x24], 0xda0a62da
mov dword [ebp - 0x20], 0xc1b0217f
sub dword [ebp - 0x20], 0x5e40b513
mov dword [ebp - 0x1c], 0x235d7c7a
add dword [ebp - 0x1c], 0xdca28386
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3ea5b
push 0
call eax
mov ecx, 0x4f6d
mov edi, eax
mov ebx, 0x1e17870c
add ebx, 0xf1eb34f4
add ebx, dword [ebp - 0x18]
mov esi, 0x1e02267c
mov edx, dword [ebx]
xor dword [ebp - 4], 0x424ef33a
add edx, esi
sub dword [ebp - 4], ecx
mov dword [edi], edx
mov dword [ebp - 4], 0x3ee5f601
add edi, 4
add ebx, 4
loop 0x1001317b
add eax, 0xd97f9c9e
sub eax, 0xd97e6c17
xor ebx, ebx
add ebx, eax
add eax, 0xa52d8976
add eax, 0x5ad2768f
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x417e10
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x4c9bbc]
sub esp, 0x14
push esi
push edi
invalid
nop

Function at 0x417e34
Capabilities:
Query or enumerate registry value

Disassembly:
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push SysFreeString
add byte [eax + 0x103415ff], al
dec esp
invalid

Function at 0x417e44
Capabilities:
Query or enumerate registry value

Disassembly:
test eax, eax
jne 0x417ed5
mov edx, edi
mov eax, esi
pop edi
pop esi
add esp, 0x14
ret

Function at 0x417e74
Capabilities:
Query or enumerate registry value

Disassembly:
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
sbb byte [eax + 0x51], dl
push 0
push str.Browse_For_Folder_Width
dec esp
add byte [edx - 1], dl
invalid
test eax, eax
jne 0x417e93
push es
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
invalid
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.Browse_For_Folder_Height
push eax
call ebx
pop ebp
pop ebx
test eax, eax

Function at 0x417e7c
Capabilities:
Query or enumerate registry value

Disassembly:
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
sbb byte [eax + 0x51], dl
push 0
push str.Browse_For_Folder_Width
dec esp
add byte [edx - 1], dl
invalid
test eax, eax
jne 0x417e93
push es
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
invalid
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.Browse_For_Folder_Height
push eax
call ebx
pop ebp
pop ebx
test eax, eax

Function at 0x417e84
Capabilities:
Query or enumerate registry value

Disassembly:
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
sbb byte [eax + 0x51], dl
push 0
push str.Browse_For_Folder_Width
dec esp
add byte [edx - 1], dl
invalid
test eax, eax
jne 0x417e93
push es
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
invalid
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.Browse_For_Folder_Height
push eax
call ebx
pop ebp
pop ebx
test eax, eax

Function at 0x417e8c
Capabilities:
Query or enumerate registry value

Disassembly:
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
sbb byte [eax + 0x51], dl
push 0
push str.Browse_For_Folder_Width
dec esp
add byte [edx - 1], dl
invalid
test eax, eax
jne 0x417e93
push es
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
invalid
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.Browse_For_Folder_Height
push eax
call ebx
pop ebp
pop ebx
test eax, eax
Function at 0x417e94
Capabilities:
Query or enumerate registry value

Disassembly:
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
sbb byte [eax + 0x51], dl
push 0
push str.Browse_For_Folder_Width
dec esp
add byte [edx - 1], dl
invalid
test eax, eax
jne 0x417e93
push es
mov edi, dword [esp + 0x1c]
xor esi, esi
push 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
invalid
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.Browse_For_Folder_Height
push eax
call ebx
pop ebp
pop ebx
test eax, eax

Function at 0x437880
Capabilities:
Encode data using xor

Disassembly:
clc
add edi, eax
mov al, byte [0x2ec812b0]
xchg ebp, eax
xor al, 0xb2
sbb byte [edx + 0x7f72b12b], dh
mov ecx, 0x4be7bad0
or ebx, dword [ecx - 0x24da179e]
cdq
xchg byte [ebx], cl
sbb dword [ebp - 0xc66bb0], ebx
inc esi
invalid

Function at 0x4bbd0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c6478
cmp edx, dword [eax]
je 0x4bbd2f
add eax, 8
inc ecx
cmp eax, 0x4c6508
jl 0x4bbd20
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c6478]
jne 0x4bbe5d
mov eax, dword [0x4cadfc]
cmp eax, 1
je 0x4bbe37
test eax, eax
jne 0x4bbd60
cmp dword [0x4c63a0], 1
je 0x4bbe37
cmp edx, 0xfc
je 0x4bbe5d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bbd97
lea eax, [ebp - 0x1a4]
push 0x4c1d30
push eax
call fcn.004bc6f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bcb80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bbdda
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bcb80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1d2c
push edi
call fcn.004bea50
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c1d10
push eax
call fcn.004bc6f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc700
lea eax, [ebp - 0xa0]
push 0x4c1d0c
push eax
call fcn.004bc700
push dword [esi + 0x4c647c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc700
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c1ce4
push eax
call fcn.004be9c4
add esp, 0x2c
pop edi
jmp 0x4bbe5d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c647c]
push 0
push eax
push dword [esi]
call fcn.004bcb80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret