joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a130
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43a163
push esi
call fcn.0043d220
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43a15c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43a1e9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43a1d2
mov eax, dword [esi + 8]
test eax, eax
je 0x43a187
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43a1ce
cmp eax, 2
je 0x43a1d2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43a17a
cmp eax, 3
je 0x43a1ad
cmp eax, 1
jne 0x43a17a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43a17a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43a17a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043a210
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43a1f8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043a210
add esp, 4
pop esi
ret

Function at 0x458776
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4587ae
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045682a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00456802
jmp 0x4587ba
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x459e64
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x459ea6
call fcn.0045f91d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x459ea6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x459e9d
xor eax, eax
jmp 0x459eae
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00459eb4
pop edi
pop esi
pop ebx
ret 4

Function at 0x45fe4d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x45fe7b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45fe99
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0045fdb3
jmp 0x45fe99
mov eax, dword [esi + 0x14]
test eax, eax
je 0x45fe99
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0045fdb3
test edi, edi
mov eax, edi
jne 0x45fe83
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4052b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40531e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403b68
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004028d8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405308
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405325
lea eax, [ebp - 0x10]
call fcn.004038f8
ret

Function at 0x409464
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40949d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004039e8
jmp 0x4094a6
mov eax, ebx
mov edx, esi
call fcn.0040394c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4094b0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4094d1
mov al, byte [esp]
jmp 0x4094d3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409b58
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x4099d0
mov eax, dword [0x41350c]
cmp byte [eax], 0
je 0x409bd4
mov eax, dword [0x41342c]
call fcn.00402854
call fcn.0040271c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406e18
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x409c1c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x409c0a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x413408]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x414660]
call fcn.00404808
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40a8b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40a91c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403b68
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004069d8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a923
lea eax, [ebp - 0xc]
call fcn.004038f8
ret

Function at 0x4123c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403d84
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x412418
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x41358c]
mov dl, 1
mov eax, dword [0x411f78]
call fcn.00409d18
call fcn.00403358
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00412080
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x412610
Capabilities:
Create process on windows
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x412588
call fcn.00405518
xor eax, eax
push ebp
push 0x4126dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.0041249c
mov edx, dword [ebp - 0x14]
mov eax, 0x414880
call fcn.0040394c
cmp dword [0x414880], 0
je 0x4126c2
lea edx, [ebp - 0x18]
mov eax, 0x4126f4
call fcn.0040b3e8
mov edx, dword [ebp - 0x18]
mov eax, 0x414884
call fcn.0040394c
push dword [0x414884]
push 0x412704
push dword [0x414880]
mov eax, 0x414884
mov edx, 3
call fcn.00403c54
mov eax, dword [0x414884]
call fcn.00403d84
push eax
push 0x412708
call sub.kernel32.dll_SetEnvironmentVariableA
push 0x412710
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageA
push 5
push 0x41271c
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4126e4
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0040391c
ret
Function at 0x4019b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x4019d6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401a6a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401a25
cmp eax, 0x40
je 0x401a25
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4019c9
cmp eax, 0x40
je 0x4019c9
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x4019c9
mov dword [esp + 8], 0x34
mov dword [esp + 4], 0x4038e0
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x20742ba5
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1a026e6
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401960
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c4f90
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x534]
mov eax, 0x51eb851f
imul edi
mov eax, dword [esp + 0x28]
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [edi + eax]
mov edi, dword [esi + 0x548]
add edi, eax
mov dword [esi + 0x534], edx
mov eax, 0x51eb851f
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ecx
mov dword [esi + 0x548], edi
jle 0x4019d6
push 1
mov ecx, esi
call fcn.00401860
mov dword [esi + 0x534], 0
push 0x4cc3cc
lea ecx, [esp + 0x14]
call fcn.0042aa80
push str.Stars
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
call fcn.0042aa80
mov ecx, dword [esi + 0x534]
push 1
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.00457070
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call fcn.0042a980
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.0042a980
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x415200
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c6750
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x3ec]
test eax, eax
je 0x415238
mov ecx, dword [esi + 8]
push eax
call fcn.004508b0
mov dword [esi + 0x3ec], 0
mov eax, dword [esp + 0x24]
cmp eax, 9
je 0x4152a8
cmp eax, 0xa
je 0x4152a8
cmp dword [esi + 0x140], 0x64
jne 0x41527f
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
push eax
mov ecx, esi
call fcn.00415030
mov eax, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.00414e90
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
mov dword [esi + 0x3dc], eax
mov byte [esi + 0x3e0], 0
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x3e4], ecx
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
mov ecx, dword [esi + 0x140]
cmp ecx, 0x61
jne 0x415311
cmp eax, 9
jne 0x415311
mov al, byte [esp + 0x30]
test al, al
jne 0x4152f3
push str.PistolNewSound
lea ecx, [esp + 8]
call fcn.0042aa80
lea edx, [esp + 4]
push edx
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.0044e260
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0042a980
mov eax, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.00414e90
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
cmp ecx, 0x5e
jne 0x415374
cmp eax, 0xa
jne 0x415374
mov al, byte [esp + 0x30]
test al, al
jne 0x415356
push str.CannonNew
lea ecx, [esp + 0x10]
call fcn.0042aa80
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [esp + 0x20], 1
call fcn.0044e260
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0042a980
mov edx, dword [esp + 0x28]
push edx
mov ecx, esi
call fcn.00414e90
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
mov dword [esi + 0x3dc], eax
mov al, byte [esp + 0x2c]
mov byte [esi + 0x3e0], al
mov al, byte [esi + 0x145]
test al, al
je 0x41528c
cmp ecx, 0x62
jne 0x4153b3
mov dword [esi + 0x3e4], 9
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
test al, al
je 0x41528c
cmp ecx, 0x5f
jne 0x41528c
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x3e4], 0xa
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x4176d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c69a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push ebx
mov ebx, dword [0x500c10]
push esi
mov esi, ecx
mov ecx, eax
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0xc1a00000
mov dword [esp + 0x3c], ebx
mov eax, dword [ebx]
cmp eax, 1
mov edx, dword [esi + 0xe4]
mov dword [esp + 0x34], 0
mov dword [esp + 0x10], edx
je 0x417773
cmp eax, 0xffffffff
je 0x41774a
dec eax
mov dword [ebx], eax
push 0x44
mov esi, ebx
call fcn.0042e150
mov ebx, eax
add esp, 4
add esi, 4
lea edi, [ebx + 4]
mov ecx, 0x10
mov dword [ebx], 1
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x3c], ebx
mov eax, dword [esp + 0x10]
push ebp
push eax
lea ebp, [ebx + 4]
push ebp
call fcn.0041b4bb
mov eax, dword [ebx]
cmp eax, 1
je 0x4177bc
cmp eax, 0xffffffff
je 0x417791
dec eax
mov dword [ebx], eax
push 0x44
mov esi, ebx
call fcn.0042e150
mov ebx, eax
lea ebp, [ebx + 4]
add esp, 4
add esi, 4
mov ecx, 0x10
mov edi, ebp
mov dword [ebx], 1
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x40], ebx
push ebp
lea ecx, [esp + 0x28]
push ecx
mov edx, ecx
push edx
call fcn.0041a445
mov eax, dword [ebx]
cmp eax, 1
je 0x417804
cmp eax, 0xffffffff
je 0x4177d9
dec eax
mov dword [ebx], eax
push 0x44
mov esi, ebx
call fcn.0042e150
mov ebx, eax
lea ebp, [ebx + 4]
add esp, 4
add esi, 4
mov ecx, 0x10
mov edi, ebp
mov dword [ebx], 1
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x40], ebx
push ebp
lea eax, [esp + 0x1c]
push eax
mov ecx, eax
push ecx
call fcn.0041a445
fld dword [esp + 0x24]
fadd dword [esi + 0xc4]
mov edx, dword [esp + 0x44]
push edx
lea eax, [esp + 0x1c]
fstp dword [esp + 0x28]
push eax
fld dword [esp + 0x30]
lea edx, [esp + 0x2c]
fadd dword [esi + 0xc8]
push edx
fstp dword [esp + 0x34]
fld dword [esp + 0x38]
fadd dword [esi + 0xcc]
fstp dword [esp + 0x38]
fld dword [esp + 0x24]
fadd dword [esi + 0xc4]
fstp dword [esp + 0x24]
fld dword [esp + 0x28]
fadd dword [esi + 0xc8]
fstp dword [esp + 0x28]
fld dword [esp + 0x2c]
fadd dword [esi + 0xcc]
mov esi, dword [esi + 8]
fstp dword [esp + 0x2c]
mov ecx, dword [esi + 0x30]
call fcn.0040b590
mov eax, dword [ebx]
cmp eax, 0xffffffff
mov dword [esp + 0x38], 0xffffffff
pop ebp
je 0x4178a4
mov ecx, eax
dec ecx
mov eax, ecx
test eax, eax
mov dword [ebx], ecx
jg 0x4178a4
push ebx
call fcn.0042df40
add esp, 4
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x41d619
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41d671
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x41d671
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x41d671
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x41d69a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x41d708
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41d6ff
cmp dword [ebp - 0xc], 4
jne 0x41d6ff
cmp dword [ebp - 0x10], edi
je 0x41d6ff
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x4e939c], edi
xor eax, eax
jmp 0x41d730
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4e939c], edi
jge 0x41d72b
mov dword [0x4e939c], edi
call fcn.0041d675
test eax, eax
je 0x41d72b
emms
mov dword [0x4e939c], 1
mov eax, dword [0x4e939c]
pop edi
leave
ret

Function at 0x41d810
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x41d847
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x41d869
cmp dword [ebp - 0x20], 4
ja 0x41d873
jne 0x41d863
cmp dword [ebp - 0x1c], 0xa
jb 0x41d863
cmp word [ebp - 0x18], 0x55d
jae 0x41d873
mov byte [ebp + 0x73], 1
jmp 0x41d873
cmp dword [ebp - 0x14], 2
jne 0x41d889
test bl, bl
je 0x41d8a4
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x41d894
dec eax
je 0x41d88d
sub eax, 3
jne 0x41d889
cmp byte [ebp + 0x73], 0
je 0x41d8b5
xor eax, eax
jmp 0x41d8bd
call fcn.0041d733
jmp 0x41d8bd
cmp byte [ebp + 0x73], 0
jne 0x41d889
call fcn.0041d76b
and eax, 4
jmp 0x41d8bd
cmp dword [ebp + 0x7c], 0xa
je 0x41d8b5
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x41d8bd
call fcn.0041d76b
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x42af30
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
xor eax, eax
mov edi, 0x20
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
add ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
sub eax, 0x61c88647
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
add edx, ebx
dec edi
jne 0x42af48
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret

Function at 0x42afa0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov eax, 0xc6ef3720
mov edi, 0x20
jmp 0x42afc0
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebp, eax
add ebx, edx
xor ebx, ebp
sub ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add eax, 0x61c88647
mov ebp, eax
and ebp, 3
mov ebp, dword [esi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
sub edx, ebx
dec edi
jne 0x42afc0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
ret

Function at 0x4300e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c6ceb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0x4cc3a8
push ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0xc], esi
mov dword [esi + 4], 0x4d2ec8
call fcn.00435290
mov dword [esi + 0x34], 0x4d2e98
mov dword [esi + 0x38], ebx
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x30], ebx
push ebx
lea ecx, [esi + 0x50]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x3c], 0x4d2ed0
call fcn.00435290
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x74], ebx
mov dword [esi + 0x70], 0x4d2e9c
or eax, 0xffffffff
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x7c], ebx
mov byte [esi + 0x78], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x430390
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4c6d16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0x4cc3a8
push ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0xc], esi
mov dword [esi + 4], 0x4d2ec8
call fcn.00435290
mov dword [esi + 0x34], 0x4d2e98
mov dword [esi + 0x38], ebx
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x30], ebx
push ebx
lea ecx, [esi + 0x50]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x3c], 0x4d2ed0
call fcn.00435290
mov dword [esi + 0x70], 0x4d2e9c
mov dword [esi + 0x74], ebx
or eax, 0xffffffff
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov al, 1
mov dword [esi + 0x40], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x78], al
mov dword [esi + 0x7c], ebx
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
mov ecx, esi
call fcn.00430260
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10