joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8159df
Capabilities:
Encode data using xor

Disassembly:
lea edx, [ecx*8 + 0x768fb82f]
mov dword [esp + edx - 0x6aa139cf], ecx
mov edx, dword [edi + edx - 0x6aa139cf]
push ecx
xor edx, ebx
pop ecx
movsx eax, cl
bswap edx
push eax
xor byte [esp + eax - 0x31], 0xad
inc eax
dec edx
rol edx, 1
rol ecx, 0x50
shr eax, 2
bswap edx
rol eax, cl
xor ebx, edx
or ecx, ecx
adc esi, edx
inc dword [esp + ecx - 0x3034be7e]
or cl, 0x87
mov edx, dword [esp + eax*2 - 0x64]
mov cx, word [ebp + ecx - 0x3034be87]
shr al, 0x81
cbw
bt edx, edx
lea ebp, [eax + ebp - 0x18]
sal word [esp + eax*8 - 0xcb], 0xc5
ror eax, 0x49
lea edi, [eax + edi - 0xd000001]
sal edx, 0x3c
call fcn.00818145
mov word [esi], ss
sub ah, ah
or ch, byte [esi - 0x59]
xchg edx, eax
unpcklps xmm5, xmmword [eax - 0x1de98bb4]
loop 0x8159f7
in al, 0xe1
cmp eax, 0x63eaae06
pop eax
pop esi
hlt

Function at 0x8270c7
Capabilities:
Authenticate hmac

Disassembly:
cmp bl, byte [edi - 0x3f61de2e]
mov al, 0x8e
push eax
insb byte es:[edi], dx
int 0x61
add ecx, ebx
or edi, dword [ecx + 0x157bc471]
in al, dx
sal dh, 1
neg al
shl byte [esp + ecx - 0x15d27e1], 0xa1
bts ecx, ecx
neg al
shl byte [esp + ecx - 0x15d27e1], 0xa1
bts ecx, ecx
call fcn.007bd06b
nop
movsd dword es:[edi], dword [esi]
fcomp qword [edi]
mov esp, gs
inc esi
jns 0x8270b0
mov bh, 0x43
in al, 0x3f
enter 0x7c64, 0xffffffffffffffdb
insd dword es:[edi], dx
invalid

Function at 0x83a54f
Capabilities:
Encode data using xor

Disassembly:
rol ecx, 0xd9
movsx eax, word [esp]
pop eax
mov ecx, dword [ebp]
btc dx, dx
jae 0x6d545e
mov dl, byte [ebp + 4]
push eax
call fcn.0087064c
lea edx, [esp + edx + 4]
sar ax, cl
jb 0x684adb
mov ecx, dword [ecx + edx - 0x864a]
lea edx, [eax + eax*8 + 0x701e9bc]
and dl, al
sbb esi, 4
cdq
xor eax, edx
shr eax, 0x85
mov dword [esi + eax - 0x267fff], ecx
mov dword [esp + eax*4 - 0x99fffc], eax
pop ecx
jns fcn.0083a396

Function at 0x83cf28
Capabilities:
Authenticate hmac

Disassembly:
lea esi, [edx + esi - 0x1b4a6604]
xor dl, dh
mov ecx, dword [esi + edx*2 - 0x3694cccc]
jge 0x6d57b3
mov ecx, dword [edi]
mov edx, 0x28a3cb28
sar edx, 4
lea edi, [edi + edx - 0x28a3cae]
rol edx, 0x76
sub dx, 0x5a7
xor ecx, ebx
lea eax, [edx*8 + 0x68be6a07]
sub eax, edx
push eax
lea ecx, [ecx + eax + 0x32640ac2]
neg eax
or dword [esp + edx - 0x2c809ce8], 0xc08ac323
sar al, 0xa1
not ecx
push edx
call fcn.0081eb6c
adc edi, 6
mov dword [esp], 0x3694cc01
dec dword [esp]
shld eax, edx, cl
ror dword [esp], 0x21
mov edx, dword [esp]
mov dword [edi + edx*4 - 0x6d299800], eax
neg dword [esp + edx*4 - 0x6d299800]
jno 0x6b2c24
Function at 0x848903
Capabilities:
Encode data using xor

Disassembly:
rol ecx, 1
shr edx, 0x19
shr word [esp + edx - 0x14], 0x21
neg ecx
shl dword [esp + edx - 0x15], 0xcb
jns 0x8d943f
xor ebx, ecx
add edi, ecx
movzx ecx, dl
call fcn.007b5365
call fcn.0078e10a
sbb ebx, dword [ecx]
mov cl, 0xb7
mov dword [ebp + 0x4c], eax
lodsd eax, dword [esi]
lds ebx, [ebp + 0x21]
and esp, dword [edi - 0x40c8ad3b]
pop edx
mov edx, 0x45b0ef29
in eax, dx
push 0xfffffffffffffffe
mov edi, 0xb6d5afc5
rol dh, 1
inc ebp
salc
inc ebx
pop ecx
cmp bh, al
test al, 0xca
pop ebp
lcall 0xc590, 0x36099345
in al, 0x9b
pop es
push ecx
leave
jbe 0x78faa4
pop edi
mov dl, 0x44
invalid
sbb ah, bh
xchg ecx, eax
xchg esp, eax
in eax, 0xde
add eax, 0xf8668bab
invalid
invalid
loop 0x78fa8b
jno 0x78fa58
or byte [ecx + edx*8 + 0x76], dl
sub cl, byte [esi - 0xa210d63]
popfd
fdivrp st(5)
jecxz 0x78fa9a
imul ebx, dword [ecx + esi*8], 0xfffffff9
xchg ecx, eax
fcmovnu st(0), st(6)
add ch, 0xd4
mov al, byte [0x7991ecf7]
test al, 0x1f
jle 0x78fa7b
adc byte [eax - 1], cl
jo 0x78fac9
add dh, byte [ebx]
pop eax
xchg ebp, eax
jmp 0xf3708845
div edx
cmp byte [esi - 0x14], ch
dec esp
mov eax, 0x2a436346
mov al, byte [ebp + 0x63]
sbb byte [eax - 0x35871e96], 0x1d
invalid
mov eax, edx
rol ecx, 1
sub ax, 0x2c14
xor ecx, 0x6da641b1
mov dword [esp + edx - 0x2acc29c8], 0xbe323018
lea ecx, [ecx + eax*4 + 0x4f7c72ce]
xchg dx, ax
or word [esp + edx*2 - 0x5599fb66], 0x971e
js 0x78fa08
ror ecx, 2
ror dl, 0x61
sbb eax, edx
btc edx, 0xab
lea ecx, [ecx + eax + 0x14eaab30]
and dl, dh
rol edx, 0xf4
neg al
xor ecx, 0x4c3cd529
cwde
add edx, 0xc10ebb0b
xor ebx, ecx
cbw
sal ax, 7
add edi, ecx
sar dx, 0xa1
xor al, 0x87
jns fcn.007cd4a2

Function at 0x84ecad
Capabilities:
Encode data using xor

Disassembly:
ror ecx, 2
sub edx, 0x9e17cf38
add dx, word [esp + edx - 0x61e830bf]
mov dword [esp + edx - 0x61e81ec9], eax
lea ecx, [edx + ecx + 0x402e3251]
push edx
add eax, edx
add edx, eax
xor ebx, ecx
imul eax
jae 0x8962a5
setno al
add edi, ecx
movzx ecx, dx
mov dword [esp + ecx*8 - 0x5ce60], edi
ret 0xc
mov ebp, 0xed318502
movzx edx, bp
btc edx, edx
mov edx, dword [edx + edi - 0x8506]
movzx ecx, bp
lea edi, [edi + ecx*4 - 0x21404]
xchg edx, edi
not cl
mov ebp, edx
mov edx, ecx
sar dl, 0xe5
jb 0x6db650
jns 0x896287
inc edi
jb 0x8962e1
pop ebp
cdq
or al, 0xc7
pop edi
adc ah, byte [esi + ebx]
rcl edi, cl
dec esi
dec ecx
adc byte [ebp + 0x32142f57], dh
test eax, 0x91ac36ab
or byte [esi], dh
dec ebp
inc edx
iretd
pop ds
or eax, dword [esp + ebp - 0x58]
div dword [eax]
stc
push esp
insd dword es:[di], dx
jb 0x896316
inc ebp
das
cmc
invalid
xchg esi, eax
push ecx
invalid
Function at 0x8545b4
Capabilities:
Packed with generic packer

Disassembly:
bswap ecx
xor ebx, ecx
lea eax, [edx + edx - 0x4dc07f62]
add edi, ecx
movsx ecx, al
sal eax, 0xdd
fsub qword [edx + ebp - 0x5541fa72]
mov dword [esp + eax*2 - 0x80000000], edi
ret
lea esp, [esp + 0xc]
call fcn.00874082
fld qword [ebp]
mov eax, 0xf035cb06
mov edx, 0x821f5396
sub edi, 4
lea ecx, [eax + edx*2 - 0xa4bc761]
xor eax, 0x8eb89110
jae 0x669cc2
rol eax, 0xbf
inc ecx
not dword [esp + eax - 0x5541fa72]
xadd eax, edx
rol ecx, 1
and byte [esp + eax - 0x5541f96f], 0x91
bswap ecx
xchg al, dl
xchg edx, eax
dec dword [esp + edx - 0x5541f972]
inc ecx
xadd eax, edx
neg ecx
dec eax
jno 0x821c5d

Function at 0x85cdde
Capabilities:
Encode data using xor

Disassembly:
inc al
mov dword [esp], edx
ror al, 1
not dx
and edx, edx
sbb al, 0x1a
shr dx, 0x2a
sal edx, 0xa1
bt edx, 6
ror al, 1
and dx, 0x2d9a
add edx, 0x1022600e
inc al
ror al, 1
xor bl, al
ror dl, 0xc3
not dword [esp + edx - 0x6b2a60c1]
lea eax, [esp + eax + 8]
adc dl, dl
xadd word [esp + edx - 0x6b2a6084], dx
mov word [eax + edx - 0x6b2aff52], cx
mov eax, 0x9eac7daa
sar dl, 0xe4
mov eax, dword [edi + edx - 0x6b2aff05]
push edx
and dword [esp + edx - 0x6b2afefd], edx
shl byte [esp + edx - 0x6b2aff04], 0xa5
lea edi, [edi + edx - 0x6b2aff01]
shr dword [esp + edx - 0x6b2afefd], 0x41
pop edx
lea ecx, [edx + edx + 0x16ab8397]
xor eax, ebx
rol eax, 2
imul edx, edx
dec eax
xadd ecx, edx
je 0x727547
not eax
adc edx, ecx
sbb eax, 0x4928c7b6
rol eax, 1
not cx
jmp fcn.004eddfc
Function at 0x860d17
Capabilities:
Check for software breakpoints

Disassembly:
lea edi, [edi + eax - 0x1d50ab4]
sal dl, cl
cbw
bt ax, ax
mov word [edi + eax*8 - 0xeaffdb0], dx
movsx edx, ax
bswap eax
idiv eax
jmp ebp
bswap eax
sub ecx, 0x24920603
xchg dx, ax
ror ecx, 2
mul eax
cmovb dx, ax
xor ebx, ecx
push eax
rol eax, 0xd7
add ebp, ecx
sub eax, edx
rol dx, 0x85
pop edx
movzx dx, byte [edi + eax - 0x1d50ab6]
mov cl, byte [edi + eax - 0x1d50ab4]
bt eax, 0x2b
jb 0x6546ea
invalid
add esp, dword [ecx]
add al, 0x83
loopne 0x860c6a
stosd dword es:[edi], eax
xor edx, dword [esi + ebx*8 + 0x402b5818]
ljmp 0x306e
mov cl, 0xf3
outsb dx, byte [esi]
xor ch, dl
xlatb
dec ecx
invalid
sbb ecx, edx
leave
dec edi
rol dword [esi + 0x41], 1
test al, 0xc7
jbe 0x860c66
int1
xchg ecx, eax
jne 0x860c2d
push 0x45bedd15
invalid
jns 0x860c84
loop 0x860c1d
aam 0xf0
popfd
imul cl
pop es
mov ch, dl
and cl, byte [ecx - 0x73fe207e]
stosd dword es:[edi], eax
pushfd
push ds
invalid
insd dword es:[edi], dx
outsd dx, dword [esi]
sbb ecx, dword [ecx + 0x41480049]
add byte [eax + 0x41], cl
cmp eax, 0x8fb63fc1
dec esp
xchg edi, eax
xchg esi, eax
out dx, eax
or eax, 0x2758cff3
je 0x860c7c
loopne 0x860d13
pop ecx
test dl, bh
dec edi
adc al, 0x54
push ebp
shl dword [ecx], 0x29
cdq
leave
jno 0x860c81
mov ch, 0xb9
scasd eax, dword es:[edi]
xor eax, 0xfb890153
mov ecx, 0x15335af
mov ebx, edi
call 0xad98f2f1
pop es
fnsave dword [edi]
in al, 0xfc
sahf
mov dl, 0x8a
mov ch, 0xe9
jl 0x860c45
mov dh, byte [ebp + 0x1a887ce9]
fdivr dword [edi + 0xfe8650c]
sbb bl, al
mov edi, 0xfe8650c
les ecx, [0x71ce6ba3]
out dx, eax
dec ebx
pop esp
jmp 0x41715fc8
fbld tbyte fs:[0x46d0ea26]
jno 0x860ca5
leave
test eax, 0x9698fc3f
stosb byte es:[edi], al
popfd
cmp esi, dword [ebx]
cmp cl, byte [esi]
push cs
push cs
push eax
daa
fisub word [eax]
jbe 0x860d7e
push 0xde9b9b1d
std
jmp 0x860cb8
jge 0x860d03
fidivr word [esi - 0x58]
jns 0x860d9e
adc byte ss:[ecx + 0x6e], 0x41
push esp
cmp al, 0xcc
and al, byte [ecx + 0x42]
ret
neg dword gs:[ebx - 0x3b9dcd67]
test byte [ecx - 0x6a], bh
scasd eax, dword es:[edi]
fsub dword [ebp + 0x5f]
out dx, al
lahf
xchg edi, eax
cli
mov al, 3
and dword [edx], eax
ror byte [edx], 0x4b
xor byte [esi + ecx*4 - 0x50], ah
add al, al
or cl, byte [ebx + 0x30]
invalid
loope 0x860dbb
loop 0x860db3
cmp dword [edx], eax
mov byte [ebp - 0x7e2ef84c], dh
out dx, al
add al, 0
add byte [eax], al
mov edx, 0x5915f1a6
lea ecx, [edx*2 + 0x6f032a3f]
lea eax, [ecx*4 - 0x49f4126a]
mov ecx, dword [esi + ecx - 0x212f0d8b]
imul edx
xor ecx, ebx
div eax
bts edx, eax
bswap ecx
lea eax, [eax + eax*4 - 0x64c18371]
shr dl, 0x47
sbb ecx, 0xa5361dbc
xor ecx, 0x8394df31
cwde
ror ax, 0xe4
rol ecx, 3
jmp 0x8522be
Function at 0x88fdec
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edi]
mov dword [esp], ecx
movzx edx, cx
not cl
mov ecx, dword [edi + edx*2 - 0xc226]
call fcn.0077c2d1
mov edx, 0x2f235501
push edx
movzx eax, dx
lea esi, [esi + eax*2 - 0xaa06]
not al
sal edx, 0xf0
mov ecx, dword [eax + esi - 0x55fe]
xchg dword [esp + edx - 0x55010000], edx
cdq
xor ecx, ebx
bt eax, edx
sal byte [esp + edx + 2], 0x87
xor edx, edx
ror ecx, 1
cwd
mul dl
xor ecx, 0x15ee0b
not edx
or dx, 0xc42a
call fcn.0055028a
xchg ecx, eax
cld
push es
jp 0x88fe27
imul ebp, dword [bp + di], 0xffffff91
invalid

Function at 0x89023c
Capabilities:
Packed with generic packer

Disassembly:
ror eax, 3
sbb edx, 0xe3920d9b
not edx
ror ecx, 0x87
dec edx
neg edx
cbw
not edx
bswap edx
not cl
bts ax, 0x31
xor ebx, edx
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x18]
call fcn.007f2d8d
mov edx, 0xb8903706
sar edx, 0x8d
sbb edi, 0
lea ecx, [edx + 0x7f36d833]
neg edx
movzx eax, cx
movzx eax, byte [edi + edx*4 - 0x8edfc]
xor al, bl
jmp 0x888b26
xchg cx, dx
imul edx, ecx
lea edi, [edi + edx - 0x77fe3c03]
mov edx, dword [edi + ecx - 0x3bff]
neg cx
xor edx, ebx
not cl
lea eax, [ecx*2 - 0x7bd5744a]
neg edx
lea edx, [ecx + edx + 0x40a2980a]
not edx
call fcn.0075639c
neg ecx
xor eax, ebx
movzx edx, cx
xadd cl, dl
shl edx, 0x9c
inc eax
rol eax, 1
sar edx, 0xeb
xor eax, 0xe6148322
lea ecx, [edx*2 + 0x159892ac]
lea eax, [ecx + eax + 0x7f0999da]
bt edx, ecx
imul ecx, ecx
rol ecx, 6
bswap eax
sar dl, 0xa2
or dl, cl
ror ecx, 0x51
neg eax
not edx
xor ebx, eax
push ecx
imul dx, cx
add esi, eax
push edx
imul cx, cx
mov dword [esp + ecx - 0x72176990], esi
ret 4
ror al, 1
dec ecx
je 0x785c9c
neg al
dec al
xor al, 0xb8
inc al
btr cx, cx
setae dl
neg dl
rol al, 1
add ecx, 0xa5a74220
sar ecx, cl
sbb ecx, ecx
xor bl, al
inc cx
lea ebp, [ebp + ecx*2 - 4]
sar dl, 0xa1
mov word [ebp + edx*2 - 0x477fe], ax
jb 0x7f4903
mov edx, 0xebaa053c
mov ecx, dword [esi]
call fcn.008b5088
je 0x7c4c70

Function at 0x8b90c6
Capabilities:
Check for trap flag exception

Disassembly:
shld ax, dx, cl
call fcn.008c98e4
jmp 0x6f0418

Function at 0x8ca2cd
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, byte [edi + ecx - 0x156b01b7]
movsx edx, ax
lea edi, [eax + edi - 0x113ff]
cwde
cwd
xor cl, bl
mov dword [esp + eax*2 - 0x2800], 0xc0ae46a9
dec dl
add cl, dl
neg cl
mov dword [esp + eax - 0x13fc], edx
sub dl, dl
rol cl, 1
or dword [esp + eax*2 - 0x27fc], edx
bswap eax
adc word [esp + eax - 0x13fffd], dx
neg cl
xor bl, cl
lea ebp, [ebp + eax*4 - 0x500002]
neg eax
push eax
mov word [ebp + edx*4], cx
pop eax
pop edx
pop eax
js fcn.006a8969

Function at 0x8d950f
Capabilities:
Encode data using xor

Disassembly:
push ecx
sub esi, 4
mov edx, dword [esi]
rol cx, 0x2c
jb 0x8ca9bc
xor edx, ebx
bswap edx
sub ecx, 0x8138eebd
sar ecx, 0x2f
not edx
mov dword [esp + 4], 0xc83a85be
dec edx
call fcn.0089bd9c
Function at 0x401330
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x401343
push 0x80004005
call fcn.0040102a
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x40134a
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x40137a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x41b214]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
lea edx, [ebp - 0x214]
push edx
push 0x2001f
mov eax, ecx
mov ecx, dword [ebp + 8]
xor esi, esi
push esi
mov dword [ebp - 0x220], eax
mov eax, dword [eax]
push ecx
push eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
cmp edi, esi
jne 0x401497
xor eax, eax
cmp dword [ebp - 0x210], esi
je 0x4013e8
push dword [ebp - 0x210]
call ebx
cmp eax, esi
mov ecx, dword [ebp - 0x214]
mov edi, eax
mov dword [ebp - 0x210], ecx
jne 0x401497
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push ecx
jmp 0x40145b
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.0040137a
cmp eax, esi
mov dword [ebp - 0x214], eax
jne 0x4014ba
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x218], pe_nt_image_headers32
call edi
test eax, eax
je 0x401420
cmp dword [ebp - 0x210], esi
je 0x401481
push dword [ebp - 0x210]
call ebx
mov dword [ebp - 0x210], esi
push dword [ebp - 0x21c]
mov eax, dword [ebp - 0x220]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [ebp - 0x210], esi
je 0x4014a7
push dword [ebp - 0x210]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004076ec
leave
ret 4
cmp dword [ebp - 0x210], esi
je 0x4014ca
push dword [ebp - 0x210]
call ebx
mov eax, dword [ebp - 0x214]
jmp 0x4014a9
Function at 0x401753
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x41b214]
xor eax, ebp
mov dword [ebp + 0x394], eax
mov eax, dword [ebp + 0x3a4]
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 0x74], eax
call dword [0x41b068]
mov eax, dword [ebp + 0x3a0]
xor esi, esi
push 2
push esi
push edi
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x70], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, esi
mov dword [ebp - 0x78], eax
jne 0x4017b2
call fcn.00401120
mov esi, eax
jmp 0x401889
push dword [ebp - 0x74]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x4017cd
call fcn.00401120
jmp 0x40187e
push edi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov dword [ebp - 0x74], eax
je 0x4017c3
push edi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x40180b
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x70], eax
je 0x401801
lea eax, [ebp - 0x70]
call fcn.004031a7
mov eax, 0x8007000e
jmp 0x40189b
push 2
pop ecx
mul ecx
cmp edx, esi
ja 0x401819
cmp eax, 0xffffffff
jbe 0x401823
push 0x80070057
call fcn.0040102a
cmp eax, 0x400
jbe 0x401836
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00403273
jmp 0x40183c
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x70], eax
mov ebx, dword [ebp - 0x70]
cmp ebx, esi
jne 0x40184a
mov esi, 0x8007000e
jmp 0x401880
call dword [0x41b068]
push edi
push ebx
push edi
push dword [ebp - 0x74]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x4017c3
mov ecx, dword [ebp - 0x70]
push dword [ebp + 0x3a8]
mov word [ecx + eax*2], si
mov ecx, dword [ebp - 0x70]
lea edx, [ebp - 0x80]
call fcn.0040208d
mov esi, eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x70], eax
je 0x401899
lea eax, [ebp - 0x70]
call fcn.004031a7
mov eax, esi
mov ecx, dword [ebp + 0x394]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004076ec
add ebp, 0x398
leave
ret 0xc
Function at 0x402f44
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x41b214]
xor eax, ebp
mov dword [ebp + 0x198], eax
push ebx
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareCoralExplorer
push 0x80000002
mov dword [ebp - 0x78], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40302a
cmp dword [ebp - 0x78], ebx
je 0x40302a
push esi
push edi
push 0x206
lea eax, [ebp - 0x6e]
push ebx
push eax
mov byte [ebp - 0x71], bl
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x7c], ebx
mov word [ebp - 0x70], bx
call fcn.00407c10
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
mov edi, str.Path
push edi
push dword [ebp - 0x78]
call esi
test eax, eax
jne 0x402ff8
cmp dword [ebp - 0x7c], 0x104
jae 0x402ff8
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push edi
push dword [ebp - 0x78]
call esi
test eax, eax
jne 0x402ff8
mov byte [ebp - 0x71], 1
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x71], bl
pop edi
pop esi
je 0x40302a
lea eax, [ebp - 0x70]
push str.Coral.exe
push eax
call fcn.00407bd6
pop ecx
pop ecx
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
jmp 0x40302c
xor al, al
mov ecx, dword [ebp + 0x198]
xor ecx, ebp
pop ebx
call fcn.004076ec
add ebp, 0x19c
leave
ret
Function at 0x40331f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x41b214]
xor eax, ebp
mov dword [ebp + 0xa8], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
push ebx
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], eax
xor ebx, ebx
lea eax, [ebp - 0x6c]
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi], vtable.CTrayNotifyIcon.0
mov dword [esi + 0x3e0], edi
mov dword [esi + 0x3e4], edi
mov dword [esi + 0x3e8], edi
mov dword [esi + 0x3ec], edi
inc ebx
push eax
mov dword [esi + 0x3f0], edi
mov dword [esi + 0x3f4], ebx
mov dword [esi + 0x3f8], edi
mov dword [esi + 0x3fc], edi
mov dword [esi + 0x400], edi
mov dword [esi + 0x404], edi
mov dword [esi + 0x408], edi
mov dword [esi + 0x40c], edi
mov dword [ebp - 0x6c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4033ca
cmp dword [ebp - 0x68], 6
jb 0x4033ca
mov dword [esi + 0x3f8], 3
jmp 0x403418
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x403418
push str.DllGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x403418
lea ecx, [ebp - 0x80]
push ecx
mov dword [ebp - 0x80], 0x14
call eax
test eax, eax
jl 0x403418
cmp dword [ebp - 0x7c], 6
jb 0x40340c
mov dword [esi + 0x3f8], 2
jmp 0x403418
cmp dword [ebp - 0x7c], 5
jb 0x403418
mov dword [esi + 0x3f8], ebx
push 0x3bc
lea ebx, [esi + 0x24]
push edi
push ebx
call fcn.00407c10
add esp, 0xc
mov ecx, esi
call fcn.004037ce
mov ecx, dword [ebp + 0xa8]
mov dword [ebx], eax
pop edi
xor ecx, ebp
mov eax, esi
pop ebx
call fcn.004076ec
add ebp, 0xac
leave
ret
Function at 0x404159
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x41b214]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov dword [ebx], edi
mov dword [ebx + 0x1c], edi
push 7
pop eax
mov dword [ebx + 0x20], eax
mov word [ebx + 0xc], di
lea esi, [ebx + 0x24]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], di
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x54], edi
push edi
mov word [ebx + 0x44], di
call fcn.00407ecb
push eax
call fcn.00407f07
push 0x20a
lea eax, [ebp - 0x20e]
push edi
push eax
mov word [ebp - 0x210], di
call fcn.00407c10
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x404239
push 0x410
lea eax, [ebp - 0x622]
push edi
push eax
mov word [ebp - 6], di
mov word [ebp - 0x624], di
call fcn.00407c10
add esp, 0xc
push 0x208
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x40422c
cmp eax, edi
je 0x40422c
mov word [ebp + eax*2 - 0x624], di
lea eax, [ebp - 0x624]
jmp 0x404232
lea eax, [ebp - 0x210]
call fcn.00403a77
xor edi, edi
mov eax, dword [ebx + 0x38]
cmp eax, edi
je 0x40425d
lea edi, [eax - 1]
mov eax, esi
call fcn.00404f88
cmp word [eax], 0x5c
je 0x40425b
push 0x418294
push esi
call fcn.00404eb4
xor edi, edi
cmp dword [ebx + 0x38], edi
jne 0x40426e
mov eax, 0x418298
call fcn.00403a77
xor edi, edi
mov ecx, dword [ebp - 4]
mov dword [ebx + 4], edi
pop edi
xor ecx, ebp
mov eax, ebx
pop esi
call fcn.004076ec
leave
ret
Function at 0x405a08
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [eax + 4]
test eax, eax
je 0x405a3e
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0x20000005
push eax
mov dword [ebp - 8], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x405a3e
mov eax, dword [ebp - 4]
jmp 0x405a40
xor eax, eax
xor edx, edx
leave
ret