joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f1af
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4247e0]
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4247e4]
mov dword [ebp - 8], eax
call dword [sym.imp.msvcrt.dll_towupper]
movzx ebx, ax
pop ecx
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], bx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x45f217
push 0x41
xor esi, esi
pop edi
jmp 0x45f210
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], di
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x45f20f
inc esi
inc edi
cmp di, bx
jb 0x45f1fb
jmp 0x45f21a
or esi, reloc.ADVAPI32.dll_TraceMessage
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4
Function at 0x45ff90
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, eax
xor esi, esi
push edi
mov edi, ecx
test ebx, ebx
je 0x46008e
test edi, edi
je 0x46008e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4693a4]
cmp eax, 0xea60
jae 0x45ffe0
mov ecx, edi
mov edx, 0x469398
call fcn.004636a0
test al, al
je 0x45ffe0
mov eax, dword [0x469394]
mov dword [ebx], eax
jmp 0x460093
push edi
push 0x424a68
push 0x80000002
call fcn.0045fe64
cmp eax, 3
je 0x45fffa
cmp eax, 2
jne 0x460030
push edi
push 0x424ad8
push 0x80000001
call fcn.0045fe64
cmp eax, 3
je 0x460014
cmp eax, 2
jne 0x460030
push edi
call fcn.0045cfd7
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x460029
push eax
call fcn.0045fd06
mov dword [ebx], eax
jmp 0x46002e
mov esi, 0xc00d0fda
xor eax, eax
test eax, eax
je 0x460044
mov esi, eax
jle 0x460044
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x460093
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 5
pop ecx
cmp eax, ecx
jae 0x460093
push 0x22
mov dword [ebp - 8], ecx
pop ecx
push edi
or eax, reloc.ADVAPI32.dll_TraceMessage
lea edi, [ebp - 0xc]
mov dword [ebp - 0xc], 0x469398
mov word [ebp - 4], cx
call fcn.004637f0
mov eax, dword [ebx]
mov dword [0x469394], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4693a4], eax
mov eax, edi
call fcn.00463afc
jmp 0x460093
mov esi, 0x80004003
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x46013e
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, eax
xor esi, esi
push edi
mov edi, ecx
test ebx, ebx
je 0x46022d
test edi, edi
je 0x46022d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0xea60
cmp eax, dword [0x469390]
jae 0x46018e
mov ecx, edi
mov edx, 0x469384
call fcn.004636a0
test al, al
je 0x46018e
mov eax, dword [0x469380]
mov dword [ebx], eax
jmp 0x460232
push edi
push 0x424a68
push 0x80000002
call fcn.0046009f
test eax, eax
je 0x4601e7
push edi
push 0x424ad8
push 0x80000001
call fcn.0046009f
mov dword [ebp - 4], eax
test eax, eax
je 0x4601e7
push edi
call fcn.0045cfd7
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x4601ce
push eax
call fcn.0045fd46
mov dword [ebx], eax
jmp 0x4601e7
mov eax, dword [ebp - 4]
mov esi, eax
test eax, eax
jle 0x4601e3
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x460232
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 5
pop ecx
cmp eax, ecx
jae 0x460232
push 0x22
mov dword [ebp - 0xc], ecx
pop ecx
push edi
or eax, reloc.ADVAPI32.dll_TraceMessage
lea edi, [ebp - 0x10]
mov dword [ebp - 0x10], 0x469384
mov word [ebp - 8], cx
call fcn.004637f0
mov eax, dword [ebx]
mov dword [0x469380], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x469390], eax
mov eax, edi
call fcn.00463afc
jmp 0x460232
mov esi, 0x80004003
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x460344
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, eax
xor eax, eax
push edi
mov edx, 0x406524
mov dword [ebp - 8], eax
mov bl, al
call fcn.0045db8b
test al, al
jne 0x460374
mov edx, 0x4064f8
call fcn.0045db8b
test al, al
je 0x46037b
xor bl, bl
jmp 0x4604db
mov edx, 0x406550
call fcn.0045db8b
test al, al
je 0x4604c6
cmp dword [esi + 0x60], reloc.ADVAPI32.dll_TraceMessage
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x4603aa
call edi
sub eax, dword [esi + 0x64]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x1388
jbe 0x4603ba
push 1
push esi
call fcn.0046116a
mov dword [esi + 0x60], eax
call edi
mov dword [esi + 0x64], eax
cmp dword [esi + 0x60], reloc.ADVAPI32.dll_TraceMessage
je 0x4603c6
test byte [esi + 0x60], 0x10
jne 0x460374
mov eax, esi
call fcn.0045d4f7
cmp eax, 0x80
je 0x460374
lea ecx, [ebp - 0x20]
call fcn.004636d2
and dword [ebp - 4], 0
lea eax, [ebp - 0x20]
mov ecx, esi
call fcn.0045d5d7
test eax, eax
js 0x4604bc
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.0046013e
mov ebx, dword [ebp - 4]
shr ebx, 3
and bl, 1
jne 0x4604bc
test byte [ebp - 4], 1
je 0x460487
push reloc.ADVAPI32.dll_EventRegister
push esi
call fcn.0045d6c1
test al, al
je 0x460487
lea ecx, [ebp - 0x14]
call fcn.004636d2
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, esi
call fcn.0045d352
test eax, eax
js 0x46047d
push 0x404ff4
lea eax, [ebp - 0x14]
call fcn.0046403c
test eax, eax
jns 0x46047d
push 0x404fdc
lea eax, [ebp - 0x14]
call fcn.0046403c
test eax, eax
jns 0x46047d
push 0x404fb0
lea eax, [ebp - 0x14]
call fcn.0046403c
test eax, eax
jns 0x46047d
push 0x404f98
lea eax, [ebp - 0x14]
call fcn.0046403c
test eax, eax
jns 0x46047d
inc bl
lea eax, [ebp - 0x14]
call fcn.00463afc
jmp 0x4604bc
cmp byte [0x468a9b], 0
je 0x4604bc
lea ecx, [ebp - 0x14]
call fcn.004636d2
lea eax, [ebp - 0x14]
mov ecx, esi
call fcn.0045d5d7
test eax, eax
js 0x4604b1
push dword [ebp - 0x14]
call fcn.004604e7
mov byte [ebp - 8], al
lea eax, [ebp - 0x14]
call fcn.00463afc
mov bl, byte [ebp - 8]
lea eax, [ebp - 0x20]
call fcn.00463afc
jmp 0x4604db
lea edi, [ebp - 8]
mov eax, esi
call fcn.0046023e
test eax, eax
js 0x4604db
cmp dword [ebp - 8], 0
setne bl
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x460956
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x468a98], 0
push esi
jne 0x46099c
xor eax, eax
push eax
push eax
push eax
push 0x460802
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x460993
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x468a98], 0
je 0x4609eb
push edi
lea ecx, [ebp - 0xc]
call fcn.004636d2
push dword [ebp + 8]
or eax, reloc.ADVAPI32.dll_TraceMessage
lea edi, [ebp - 0xc]
call fcn.004637f0
pop edi
test eax, eax
js 0x4609e3
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x4609c6
mov eax, esi
call fcn.00463ed0
mov eax, 0x467d64
push eax
mov ecx, esi
call fcn.00462679
test al, al
je 0x4609e3
lea eax, [ebp - 0xc]
call fcn.00463afc
mov al, 1
jmp 0x4609ed
lea eax, [ebp - 0xc]
call fcn.00463afc
xor al, al
pop esi
leave
ret 4

Function at 0x460acb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi]
add eax, eax
mov dword [ebp - 8], eax
xor ecx, ecx
lea eax, [ebp - 8]
push eax
push ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push ecx
push dword [ebp + 0xc]
mov dword [esi], ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x460b13
cmp dword [ebp - 4], 1
je 0x460b0a
cmp dword [ebp - 4], 2
je 0x460b0a
push 0xd
pop eax
jmp 0x460b13
mov eax, dword [ebp - 8]
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x460f4c
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
lea ecx, [ebp - 0x74]
mov dword [ebp - 8], 0x80070005
call fcn.0045d220
push dword [ebp + 8]
lea ecx, [ebp - 0x74]
push 2
call fcn.0045d420
mov ebx, 0x80072af9
test eax, eax
js 0x460fbc
lea eax, [ebp - 0x74]
call fcn.0045d4f7
cmp eax, 4
jne 0x460fbc
lea eax, [ebp - 0x74]
push eax
call fcn.00461ba4
cmp byte [0x468a9a], 0
mov esi, eax
mov dword [ebp - 8], esi
je 0x460fbf
test esi, esi
js 0x460faf
lea eax, [ebp - 0x74]
push eax
call fcn.00461e74
jmp 0x460fbc
cmp esi, ebx
jne 0x460fbf
lea eax, [ebp - 0x74]
push eax
call fcn.00461df5
mov esi, dword [ebp - 8]
test esi, esi
jns 0x46108f
cmp esi, ebx
je 0x46108f
lea eax, [ebp - 0xc]
push eax
xor eax, eax
push eax
push dword [ebp + 8]
push 0x460ea7
push eax
push eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x46108c
push 0xfa0
push 0x424d0c
xor edi, edi
mov ebx, 0x468bac
call fcn.0045cddd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x461085
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x461085
mov eax, dword [0x467fd0]
cmp eax, 0x467fd0
je 0x46104c
test byte [eax + 0x44], 1
je 0x46104c
cmp byte [eax + 0x41], 3
jb 0x46104c
push dword [ebp - 8]
push reloc.ole32.dll_CreateStreamOnHGlobal
push dword [eax + 0x3c]
push dword [eax + 0x38]
call fcn.00460b5b
cmp dword [ebp - 8], edi
je 0x46105a
mov dword [ebp - 8], reloc.ADVAPI32.dll_TraceMessage
jmp 0x461085
cmp byte [0x468a9a], 0
je 0x461085
mov ecx, dword [ebp - 0x58]
xor edx, edx
test ecx, ecx
je 0x461076
xor eax, eax
cmp word [ecx], dx
setne al
jmp 0x461078
mov eax, edx
test al, al
je 0x461085
lea eax, [ebp - 0x74]
push eax
call fcn.00461e74
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 8]
lea ecx, [ebp - 0x74]
call fcn.0045fe22
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x4631ef
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
cmp byte [ebx + 0x10], 0
jne 0x463334
push esi
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push 0x425b00
push 0x80000002
mov byte [ebx + 0x10], 1
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x463333
push edi
mov edi, dword [ebp - 8]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0x104
call fcn.004636d2
lea eax, [ebp - 0x24]
push eax
mov eax, 0x104
call fcn.004637a7
jmp 0x463317
lea ecx, [ebp - 0x18]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
mov eax, esi
inc esi
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x24]
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x46331f
test esi, esi
je 0x463289
xor ecx, ecx
cmp word [esi], cx
setne al
test al, al
je 0x4632f1
cmp dword [ebp - 4], 0
je 0x4632f1
lea ecx, [ebp - 0x30]
call fcn.004636d2
push 0x2e
pop eax
lea edi, [ebp - 0x30]
cmp ax, word [esi]
jne 0x4632ac
lea eax, [esi + 2]
push eax
jmp 0x4632ad
push esi
or eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.004637f0
mov esi, dword [ebp - 0x30]
xor eax, eax
test esi, esi
je 0x4632c6
xor ecx, ecx
cmp word [esi], cx
setne al
test al, al
je 0x4632dc
push esi
call fcn.0045cf24
cmp eax, reloc.ADVAPI32.dll_TraceMessage
jne 0x4632dc
push esi
push ebx
call fcn.00462e80
lea eax, [ebp - 0x30]
call fcn.00463afc
lea eax, [ebp - 0x24]
call fcn.00463afc
mov edi, dword [ebp - 0xc]
jmp 0x4632f9
lea eax, [ebp - 0x24]
call fcn.00463afc
mov esi, 0x104
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
call fcn.004636d2
lea eax, [ebp - 0x24]
push eax
mov eax, esi
call fcn.004637a7
mov esi, dword [ebp - 0x10]
test eax, eax
jns 0x463256
lea eax, [ebp - 0x24]
call fcn.00463afc
test edi, edi
je 0x463332
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret

Function at 0x4636d2
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor ecx, ecx
xor eax, eax
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov word [esi + 8], ax
cmp dword [0x468b7c], eax
jne 0x463767
push 0x110
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov dword [0x468b7c], 1
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x463767
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 5
jb 0x46374b
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jae 0x463754
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 6
jb 0x463767
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 2
jne 0x463767
mov dword [0x467bdc], 0x7f
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004655f1
leave
ret
Function at 0x463c8e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
call fcn.00463afc
test esi, esi
jne 0x463cb8
mov eax, dword [0x469218]
mov esi, dword [eax + 8]
test esi, esi
jne 0x463cb8
mov eax, 0x80070057
jmp 0x463d2b
mov eax, edi
shr eax, 4
inc eax
movzx eax, ax
push 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x463cdb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x463cf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x463cf1
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x463d2b
jmp 0x463d02
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
test edx, edx
jne 0x463d09
mov eax, 0x8000ffff
jmp 0x463d2b
and edi, 0xf
je 0x463d1a
movzx eax, word [edx]
lea edx, [edx + eax*2]
lea edx, [edx + 2]
dec edi
jne 0x463d0e
movzx ecx, word [edx]
mov edi, dword [ebp + 8]
lea eax, [edx + 2]
push eax
mov eax, ecx
call fcn.004637f0
pop edi
pop esi
pop ebp
ret 4

Function at 0x463d9b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
call fcn.00463afc
test ebx, ebx
jne 0x463dbd
mov eax, 0x80070057
jmp 0x463eaf
push edi
xor ecx, ecx
lea eax, [ebp - 8]
push eax
push ecx
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp + 0xc]
mov edi, 0x80070057
push ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x463eac
cmp dword [ebp - 4], 1
je 0x463dfd
cmp dword [ebp - 4], 2
je 0x463dfd
cmp dword [ebp - 4], 7
jne 0x463eac
mov ecx, dword [ebp - 8]
shr ecx, 1
test byte [esi + 8], 0x20
mov dword [ebp - 8], ecx
je 0x463e48
cmp ecx, dword [esi + 4]
jb 0x463e16
mov ecx, dword [esi + 4]
mov dword [ebp - 8], ecx
lea eax, [ecx + ecx]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push dword [esi]
push 0
push 0
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi + 4]
mov edx, eax
test ecx, ecx
jle 0x463e42
mov eax, dword [esi]
xor ebx, ebx
mov word [eax + ecx*2 - 2], bx
test edx, edx
jne 0x463eac
jmp 0x463e9a
mov eax, esi
call fcn.004642af
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x463eac
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push ebx
push 0
push 0
push dword [ebp + 0xc]
add ecx, ecx
push dword [ebp + 8]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x463e92
test byte [esi + 8], 4
je 0x463e88
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x463eac
lea esi, [ebp - 0x10]
call fcn.0046354b
jmp 0x463eac
push ebx
mov eax, esi
call fcn.004642f0
cmp dword [ebp - 4], 2
je 0x463ea4
xor edi, edi
jmp 0x463eac
push esi
call fcn.00463f46
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4655e2
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x466100
call fcn.00465944
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], TraceMessage
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
mov esi, ebx
push ebx
push edi
push 0x469a00
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x465459
cmp eax, edi
jne 0x46544c
xor edi, edi
inc edi
mov esi, edi
jmp 0x46545c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x465430
xor edi, edi
inc edi
cmp dword [0x469a04], edi
jne 0x46546e
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x46549c
cmp dword [0x469a04], ebx
jne 0x465496
mov dword [0x469a04], edi
push 0x401054
push 0x401048
call fcn.004653d0
pop ecx
pop ecx
test eax, eax
je 0x46549c
jmp 0x4655cb
mov dword [0x468044], edi
cmp dword [0x469a04], edi
jne 0x4654bf
push 0x401044
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x469a04], 2
test esi, esi
jne 0x4654cf
push ebx
push 0x469a00
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x469a08], 0
je 0x4654f1
push 0x469a08
call fcn.004657b0
pop ecx
test eax, eax
je 0x4654f1
push ebx
push 2
push ebx
call dword [0x469a08]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x46554e
test cl, cl
je 0x46550d
test edi, edi
jne 0x46554e
mov al, byte [esi]
test al, al
je 0x46551d
cmp al, 0x20
ja 0x46551d
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x46550d
test byte [ebp - 0x3c], 1
je 0x465529
movzx eax, word [ebp - 0x38]
jmp 0x46552c
push reloc.ole32.dll_CoRegisterClassObject
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x468040], eax
cmp dword [0x468058], 0
jne 0x4655a7
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x46555f
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x465572
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4654fe
cmp dword [0x468044], 0
jne 0x4655bb
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x468040]
mov dword [ebp - 4], TraceMessage
jmp 0x4655d7
mov dword [ebp - 4], TraceMessage
mov eax, 0xff
call fcn.00465989
ret
call fcn.00465871
jmp 0x4653f9

Function at 0x465720
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x465736
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], reloc.ADVAPI32.dll_TraceMessage
jne 0x465751
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x465760
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
movzx ebx, word [ecx + 6]
add eax, 0x18
push esi
xor edx, edx
add eax, ecx
push edi
test ebx, ebx
je 0x46579e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x465796
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4657a0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x465786
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x409124
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x409162
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x409169
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40c720
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4

Function at 0x409308
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x434a24], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x409345
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x409330
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409322
mov dword [ecx*4 + 0x434a20], eax
inc ecx
cmp ecx, 0x100
jne 0x40931b
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x409367
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x434a20]
jmp 0x40934f
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x408288
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4159b8
call fcn.0040ba99
and dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
test ecx, ecx
je 0x4082d0
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4082d0
mov eax, dword [ecx + 0x3c]
add eax, ecx
je 0x4082d0
cmp dword [eax], 0x4550
jne 0x4082d0
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x1c], 1
jmp 0x4082d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.0040bade
ret
Function at 0x402f10
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45a008], 0x8088405
inc edx
mov dword [ebx + 0x45a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403368
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45a024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403400
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033e0
xor eax, eax
push ebp
push 0x4033d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40341c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45a024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45a024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040fc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45c048], 0
je 0x40415d
cmp word [0x45c21c], 0xd7b2
jne 0x404125
cmp dword [0x45c224], 0
jbe 0x404125
mov eax, 0x45c218
call dword [0x45c234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45a070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404184
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45a034], 0
jne 0x404179
push 0
push 0x45a068
push 0x45a070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret