joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e00
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x42b21c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], 0
push str.retryExtractStub
push 0x42197c
push 1
push str._s__s
call fcn.00401ce0
add esp, 0x10
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00404940
add esp, 0xc
push 0x2e
lea eax, [ebp - 0x310]
push eax
call fcn.00406300
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x405e79
mov ecx, dword [ebp - 0x41c]
mov byte [ecx], 0
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str..old
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041186a
add esp, 8
test eax, eax
jne 0x405eca
push 0x76
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404140
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
jne 0x405fe7
push 0x2e
lea edx, [ebp - 0x108]
push edx
call fcn.00406300
add esp, 8
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov byte [eax], 0
push str..new
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x76
lea edx, [ebp - 0x108]
push edx
call fcn.00404140
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 8
jne 0x405fdd
cmp dword [ebp + 0x10], 0
je 0x405f5a
push 1
push str.Called_MovefileEx
call fcn.00401ce0
add esp, 8
push 5
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x405fdd
push 0x104
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push str.wininit.ini
lea eax, [ebp - 0x20c]
push eax
push 0
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.wininit.ini
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push ecx
push 1
push str._s__s
call fcn.00401ce0
add esp, 0x10
mov dword [ebp - 0x418], 8
push str.retryExtractStub
push 0x4219c0
push 1
push str._s__s
call fcn.00401ce0
add esp, 0x10
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x406150
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x42b21c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x138]
push ecx
push 0
push 0xf003f
push 0
push 0x421437
push 0
mov edx, dword [str.SoftwareOnflow]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x4062cc
push 0x42c1d4
call fcn.00410000
add esp, 4
push eax
push 0x42c1d4
push 1
push 0
push str.Install_Date
mov eax, dword [ebp - 0x138]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x144], eax
mov ecx, dword [0x42c308]
mov dword [ebp - 0x134], ecx
jmp 0x4061f1
mov edx, dword [ebp - 0x134]
mov eax, dword [edx]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x4062bf
mov ecx, dword [ebp - 0x134]
cmp dword [ecx + 8], 0
je 0x4062ba
mov edx, dword [ebp - 0x134]
cmp dword [edx + 0xc], 0
je 0x4062ba
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 8]
push ecx
push str._s___Plugins
lea edx, [ebp - 0x130]
push edx
call fcn.004012e0
add esp, 0xc
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.00410000
add esp, 4
push eax
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0xc]
push eax
push 1
push 0
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x138]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 8]
push ecx
push str._s___Time
lea edx, [ebp - 0x130]
push edx
call fcn.004012e0
add esp, 0xc
push 0x42c1d4
call fcn.00410000
add esp, 4
push eax
push 0x42c1d4
push 1
push 0
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4061e3
mov edx, dword [ebp - 0x138]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x406900
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x42b21c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x118]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x406a7a
mov dword [ebp - 0x114], 0x103
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x103
je 0x4069e7
mov dword [ebp - 0x114], 0x103
mov edx, dword [ebp - 0x10c]
add edx, 1
mov dword [ebp - 0x10c], edx
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x110], eax
jmp 0x40698b
cmp dword [ebp - 0x10c], 0
je 0x406a5f
mov dword [ebp - 0x114], 0x103
mov edx, dword [ebp - 0x10c]
sub edx, 1
mov dword [ebp - 0x10c], edx
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x406a5d
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.00406900
add esp, 8
jmp 0x4069e7
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x406a90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x42b21c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x21c]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x406c7a
mov dword [ebp - 0x214], 0x103
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x103
je 0x406b77
mov dword [ebp - 0x214], 0x103
mov edx, dword [ebp - 0x210]
add edx, 1
mov dword [ebp - 0x210], edx
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x218], eax
jmp 0x406b1b
cmp dword [ebp - 0x210], 0
je 0x406c6d
mov dword [ebp - 0x214], 0x103
mov edx, dword [ebp - 0x210]
sub edx, 1
mov dword [ebp - 0x210], edx
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x406c68
mov dword [ebp - 0x214], 0x103
lea edx, [ebp - 0x220]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406c68
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406c68
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.00411392
add esp, 8
test eax, eax
jne 0x406c68
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.00406900
add esp, 8
jmp 0x406b77
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x406c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x42b21c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], 0
cmp dword [ebp + 8], 0
je 0x406d3d
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.ONFLOWTESTTEMPTEMPTEMP.html
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x42158c
lea eax, [ebp - 0x108]
push eax
call fcn.004107a4
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x406d3d
mov ecx, dword [ebp - 0x10c]
push ecx
push 1
push 2
push 0x4215b4
call fcn.004109da
add esp, 0x10
mov edx, dword [ebp - 0x10c]
push edx
call fcn.00410321
add esp, 4
lea eax, [ebp - 0x108]
push eax
call fcn.00410bc3
add esp, 4
mov dword [ebp - 0x110], 1
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x40a790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0xb
mov dword [ebp - 4], 0xff
mov dword [ebp - 0x14], 4
call esi
test eax, eax
jne 0x40a84e
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x421d14
push dword [ebp - 0x10]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40a849
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a844
cmp dword [ebp - 0xc], 4
jne 0x40a844
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
test eax, eax
mov edx, 0xff
cmovne ecx, edx
mov dword [ebp - 4], ecx
push dword [ebp - 8]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x42b21c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x74]
push eax
push 0x20019
push 0
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xb
mov dword [ebp - 0x80], 0x64
call ebx
push 0x64
mov edi, eax
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0040bfd0
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x7c]
call fcn.00411630
add esp, 0x18
test edi, edi
jne 0x40a978
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push 0x421d14
push dword [ebp - 0x74]
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x40a960
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x6c]
push 0
push 0
push eax
push 0
push dword [ebp - 0x78]
push dword [ebp - 0x70]
call ebx
mov esi, eax
test esi, esi
jne 0x40a95b
cmp dword [ebp - 0x6c], 1
jne 0x40a95b
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x78]
push dword [ebp - 0x70]
call ebx
cmp dword [ebp - 0x6c], 1
mov esi, eax
jne 0x40a95b
test esi, esi
jne 0x40a95b
push dword [ebp + 0x10]
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x7c]
call fcn.00411630
add esp, 0xc
push dword [ebp - 0x70]
call edi
push dword [ebp - 0x74]
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040af7c
mov esp, ebp
pop ebp
ret
Function at 0x40a990
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x40aa10
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x421d14
push dword [ebp - 8]
call esi
mov esi, eax
test esi, esi
jne 0x40aa05
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40aa20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x190
xor esi, esi
call fcn.00401160
mov edi, dword [ebp + 0xc]
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
push 6
push esi
push esi
push esi
push dword [edi]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x40ab1d
cmp dword [edi], esi
je 0x40aabc
mov eax, edi
xor ecx, ecx
add edi, 8
nop dword [eax]
mov edx, dword [eax + 4]
test edx, edx
je 0x40aab9
mov eax, dword [edi]
test eax, eax
je 0x40aab9
cmp byte [eax], 0
je 0x40aab9
lea eax, [ebp - 8]
push eax
lea eax, [ebx + 4]
add eax, ecx
push eax
push 0
push 6
push 0
push 0
push 0
push edx
push dword [ecx + ebx]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40aaef
mov eax, dword [ebp + 0xc]
inc esi
add edi, 4
lea ecx, [esi*4]
add eax, ecx
cmp dword [eax], 0
jne 0x40aa70
mov edi, dword [ebp + 0xc]
lea eax, [esi + 1]
lea eax, [edi + eax*4]
push str._Default_
push dword [eax]
mov dword [ebp + 0xc], eax
call fcn.0040bd60
mov edi, dword [ebp + 0x10]
add esp, 8
push edi
test eax, eax
je 0x40aafb
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push 1
push 0
push 0x421437
jmp 0x40ab0c
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp + 0xc]
push edi
push 1
push 0
push dword [eax]
push dword [ebx + esi*4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp esi, 0xffffffff
jle 0x40ab3a
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + esi*4]
test eax, eax
je 0x40ab34
push eax
call edi
mov dword [ebx + esi*4], 0
dec esi
cmp esi, 0xffffffff
jg 0x40ab23
push ebx
call fcn.004011a0
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4149c3
Capabilities:
Get number of processors

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
invalid

Function at 0x4149e9
Capabilities:
Get number of processors

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x438c96
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
mov edi, 0x38c1d5f1
sub esi, 1
sub edi, 0x9b6c01bd
call fcn.00438ce0
add edi, edi
sub edi, esi
sub edi, 0x932a91b
xor dword [edx], ebx
mov esi, 0x904bba7d
inc edx
and edi, edi
cmp edx, eax
jne fcn.00438c96
sub edi, 0xa5933560
push 0x5b127140
mov esi, dword [esp]
add esp, 4
ret
Function at 0x411844
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x429e48
call fcn.004279c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x42c020
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.004025be
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.004025be
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
mov byte [esi + 0x60], bl
call fcn.004025be
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.004025be
lea eax, [esi + 0x80]
mov byte [esi + 0x7c], 1
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 7
call fcn.004025be
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x42bfe8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x411d7a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x429f71
call fcn.004279c0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.00401acd
push dword [esi + 0x24]
call fcn.004020df
push dword [esi + 0x18]
call fcn.004020df
push dword [esi + 0xc]
call fcn.004020df
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi], 0x42c054
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x401f14
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c914
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x478
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x110]
call fcn.00407e8e
mov dword [ebp - 4], 0
push 0x410288
mov eax, dword [ebp - 0xe8]
push eax
push 0x410294
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 1
push 3
push 0
push 0
push SysReAllocString
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
je 0x402189
mov dword [ebp - 0x21c], 0
push 0
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x468], eax
mov edx, dword [ebp - 0x468]
mov dword [ebp - 0x220], edx
push 0
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x224]
push ecx
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40217c
mov dword [ebp - 0x228], 0
mov ecx, dword [ebp - 0x220]
add ecx, dword [ebp - 0x21c]
mov byte [ecx - 1], 0
mov byte [ebp - 4], 1
push 0xa
mov edx, dword [ebp - 0x220]
push edx
lea ecx, [ebp - 0x344]
call fcn.00402570
mov dword [ebp - 0x474], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x344]
call fcn.004023a0
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x228], eax
push str.Installers
mov ecx, dword [ebp - 0x228]
push ecx
call fcn.00402380
add esp, 8
test eax, eax
je 0x402148
lea ecx, [ebp - 0x344]
call fcn.004023a0
mov dword [ebp - 0x47c], eax
mov edx, dword [ebp - 0x47c]
mov dword [ebp - 0x228], edx
push 0x3d
mov eax, dword [ebp - 0x228]
push eax
lea ecx, [ebp - 0x460]
call fcn.00402570
mov dword [ebp - 0x480], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x460]
call fcn.00402550
mov byte [ebp - 0x484], al
mov ecx, dword [ebp - 0x484]
and ecx, 0xff
cmp ecx, 1
jne 0x402115
lea ecx, [ebp - 0x460]
call fcn.004023a0
lea ecx, [ebp - 0x460]
call fcn.004023a0
mov dword [ebp - 0x488], eax
mov edx, dword [ebp - 0x488]
push edx
mov eax, dword [ebp - 0xe8]
push eax
push 0x4102a8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [ebp - 0x220], 0
je 0x402139
mov edx, dword [ebp - 0x220]
mov dword [ebp - 0x46c], edx
mov eax, dword [ebp - 0x46c]
push eax
call fcn.0040c57c
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x460]
call fcn.00402600
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x344]
call fcn.00402600
jmp 0x402175
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x470], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.00407ffa
mov eax, dword [ebp - 0x470]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret