joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fd97
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0045fa3b
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x45fde1
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00416aa8
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00416acb
jmp 0x45fdec
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0045098b
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x45fdf2
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0043b2e4
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x45fe2f
call fcn.0045fa3b
mov dword [esi + 0xc], 1
jmp 0x45fe34
call fcn.0045fa3b
cmp dword [esi], 0
je 0x45fe7d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x45fe55
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00416aa8
jmp 0x45fe67
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00402624
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00416acb
jmp 0x45fea1
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x45fea1
push dword [esi]
push dword [ebp + 8]
call fcn.0045098b
pop esi
pop ebp
ret 0xc

Function at 0x48766f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00439544
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4876a8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004872ac
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x408630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a3ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.0042d8f0
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x4086bb
push eax
push esi
call fcn.0042dd39
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.0042d89d
int3

Function at 0x40b0a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], edx
push esi
mov esi, ecx
test eax, eax
jne 0x40b0c6
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov eax, esi
mov dword [esi], 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.0040b030
test eax, eax
je 0x40b0f2
mov dword [esi], eax
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp - 4]
lea eax, [edi + 2]
push eax
call fcn.0044cb53
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40b11e
pop edi
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov eax, esi
pop ebx
mov dword [esi], 3
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push edi
push 1
push ebx
call fcn.0046833a
add esp, 0x10
cmp eax, edi
je 0x40b157
push ebx
call fcn.00448567
add esp, 4
mov dword [esi + 8], 0
mov dword [esi], 2
mov eax, esi
mov dword [esi + 4], 0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
cmp ecx, 8
jne 0x40b166
mov ecx, 2
jmp 0x40b190
cmp ecx, 4
je 0x40b15f
cmp ecx, 7
jne 0x40b177
mov ecx, 5
jmp 0x40b19e
test ecx, ecx
jne 0x40b186
mov edx, edi
mov ecx, ebx
call fcn.00409340
mov ecx, eax
cmp ecx, 2
je 0x40b190
cmp ecx, 3
jne 0x40b19e
shr edi, 1
xor edx, edx
lea eax, [edi + edi]
mov word [eax + ebx], dx
lea edi, [eax + 2]
push dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov edx, eax
push 1
push 1
push ecx
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
push eax
call fcn.0040ae20
add esp, 0x20
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40f480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x40f4ab
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40f494
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x41fa20
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bf08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [ebp + 0x1c]
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov edi, ecx
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
call fcn.0040e170
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ebx, eax
test esi, esi
je 0x41fa86
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
test eax, eax
je 0x41fa86
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push ebx
lea eax, [ebp + 0x1c]
mov dword [ebp + 0x1c], 0
push eax
push 0x270f
push 0
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.0041ddd0
mov ecx, dword [ebp + 0x20]
add esp, 0x1c
or dword [ecx], eax
pop edi
pop esi
pop ebx
test al, 2
jne 0x41fad3
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x24]
cmp eax, 0x45
jge 0x41fac6
add eax, 0x64
jmp 0x41fad0
cmp eax, 0x64
jl 0x41fad0
add eax, 0xfffff894
mov dword [ecx + 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x428bd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c888
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x48d06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
call fcn.0040d6d0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ebx, eax
test esi, esi
je 0x428c40
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
test eax, eax
je 0x428c40
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push ebx
lea eax, [ebp + 0x1c]
mov dword [ebp + 0x1c], 0
push eax
push 0x270f
push 0
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.00427250
mov ecx, dword [ebp + 0x20]
add esp, 0x1c
or dword [ecx], eax
test al, 2
jne 0x428c8a
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x24]
cmp eax, 0x45
jge 0x428c7d
add eax, 0x64
jmp 0x428c87
cmp eax, 0x64
jl 0x428c87
add eax, 0xfffff894
mov dword [ecx + 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x455b08
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00455985
Function at 0x463340
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46dfc2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x14], ebx
push edi
mov dword [ebp - 0x10], 0
je 0x463392
mov dword [ebx], 0x46f770
mov dword [ebx + 0x10], 0x46f778
mov dword [ebx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
lea esi, [ebx + 0x18]
mov ecx, ebx
push 0
push esi
mov dword [ebp + 0xc], esi
call fcn.00463170
lea edx, [ebx + 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
push 8
mov dword [ebp - 4], 4
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], esi
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0043feef
mov esi, eax
add esp, 4
test esi, esi
je 0x463425
push 1
mov byte [ebp - 4], 5
call fcn.0042dc39
add esp, 4
mov dword [esi + 4], eax
jmp 0x463427
xor esi, esi
lea eax, [ebx + 0x18]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x10]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov esi, dword [ebp + 0xc]
not ecx
and ecx, 1
mov dword [edi], 0
shl ecx, 2
mov eax, ebx
mov dword [edx], 0
mov edx, ecx
or edx, 2
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
and al, 2
mov dword [esi + 0x38], 0
mov eax, ebx
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
pop edi
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x464cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e188
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x48d06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push eax
push 0x20219
push 0
push str.SoftwareWorking_SolutionsAcquire
push 0x80000002
mov dword [ebp - 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x464d24
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
mov ecx, esi
push 0x47fdb4
mov word [esi], ax
call fcn.00406bc0
jmp 0x464e63
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push str.mainexe
push dword [ebp - 0x44]
call edi
test eax, eax
jne 0x464e3b
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
shr ecx, 1
inc ecx
cmp ecx, eax
ja 0x464d83
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x464d90
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040d180
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x48]
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0
push str.mainexe
push dword [ebp - 0x44]
call edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0041ac30
mov edi, eax
add esp, 8
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x464e33
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x464e01
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464df7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464e80
push edx
push ecx
call fcn.0043febe
add esp, 8
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
lea ecx, [ebp - 0x40]
call fcn.004068f0
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004406e4
mov esp, ebp
pop ebp
ret
call fcn.004453c3
int3
Function at 0x464e90
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 8], ebx
mov eax, dword [ebx + 0x18]
cmp eax, 1
jb 0x464ef1
push eax
push 0
push 0x100000
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x464ed8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
neg ebx
push esi
sbb bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and bl, byte [ebp - 1]
jne 0x464eee
push 0x47f3ac
push str.TMainControl
call dword [sym.imp.USER32.dll_FindWindowW]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x465750
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebx + 0x18], 0
je 0x464f45
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
cmp esi, edi
je 0x464f4b
lea eax, [ebp - 8]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x464f3e
mov eax, dword [ebp - 8]
cmp eax, dword [ebx + 0x18]
je 0x464f92
add esi, 4
cmp esi, edi
jne 0x464f26
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
sub edi, esi
test edi, 0xfffffffc
je 0x464f99
mov eax, esi
mov edi, dword [eax]
test esi, esi
je 0x464f89
mov ecx, dword [ebp - 0xc]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x464f7f
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464fd2
push ecx
push esi
call fcn.0043febe
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov esi, dword [ebp - 0x14]
jmp 0x464f57
test esi, esi
je 0x464fc9
mov ecx, dword [ebp - 0xc]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x464fbf
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464fd2
push ecx
push esi
call fcn.0043febe
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004453c3
int3
Function at 0x4661c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e3eb
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x48d06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x410]
push 0x400
push eax
push 0
mov dword [ebp - 0x42c], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 0
push eax
lea eax, [ebp - 0x410]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
cmp ebx, 1
jge 0x466255
mov dword [esi + 0x10], 0
xor eax, eax
push 7
mov dword [esi + 0x14], 7
mov ecx, esi
push str.Unknown
mov word [esi], ax
call fcn.00406bc0
jmp 0x466379
push ebx
call fcn.0044cb53
mov edi, eax
add esp, 4
test edi, edi
je 0x46622f
push edi
push ebx
push 0
lea eax, [ebp - 0x410]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0x47f49c
push edi
call sub.VERSION.dll_VerQueryValueA
cmp dword [ebp - 0x434], 0x34
jae 0x4662b0
push edi
call fcn.00448567
add esp, 4
mov ecx, esi
push str.Unknown
call fcn.00406950
jmp 0x466379
mov eax, dword [ebp - 0x42c]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
lea eax, [ebp - 0x410]
push edx
push str.V_i._i._i._i
push eax
call fcn.004659a0
push edi
call fcn.00448567
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x418], 0
add esp, 0x1c
mov dword [ebp - 0x414], 0xf
mov byte [ebp - 0x428], 0
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x466310
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
lea ecx, [ebp - 0x428]
call fcn.0040d200
lea eax, [ebp - 0x428]
mov dword [ebp - 4], 0
push eax
push esi
call fcn.0041aaa0
mov edx, dword [ebp - 0x414]
add esp, 8
cmp edx, 0x10
jb 0x466379
mov ecx, dword [ebp - 0x428]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46636f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466397
push edx
push ecx
call fcn.0043febe
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004406e4
mov esp, ebp
pop ebp
ret
call fcn.004453c3
int3
Function at 0x40f898
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40f8a7
pop dword [ebp - 0x44]
mov eax, 0x98098919
add eax, 0x68376f8e
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3a648
push 0
mov eax, 0xc2b53b15
sub eax, 0xc272e8fd
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x3a38
xor edx, edx
add edx, eax
mov edi, 0x5cef2a34
sub edi, 0x5cabd634
add edi, dword [ebp - 0x44]
mov esi, 0x4991b581
sub esi, 0x94671e80
mov ebx, dword [edi]
sub dword [ebp - 0x1c], 0xa034716f
add ebx, esi
mov dword [edx], ebx
xor dword [ebp - 8], eax
add edx, 0x46bccc56
sub edx, 0x46bccc52
add edi, 0x539637f5
add edi, 0xac69c80f
loop 0x40f902
add eax, 0xab179a7c
sub eax, 0xab16bec9
mov ebx, eax
add eax, 0x6ae21877
add eax, 0x951de78e
mov ecx, 0xc765948c
sub ecx, 0xc725948c
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x409830
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47eb5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004736ec
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4098b2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004715c6
mov eax, dword [eax]
push 0x49bc6c
push eax
call fcn.00464234
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00473977
test bl, bl
je 0x4098b2
push 0x49bc6c
lea ecx, [esp + 0xc]
call fcn.00473d07
push 0x49bc78
lea ecx, [esp + 0xc]
call fcn.00473d07
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4098ee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00473977
jmp 0x4099b9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x409972
lea edx, [esp + 0x7c]
push 0x49bc74
push edx
call fcn.00464234
add esp, 8
test eax, eax
je 0x409972
lea eax, [esp + 0x7c]
push 0x49bc70
push eax
call fcn.00464234
add esp, 8
test eax, eax
je 0x409972
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409902
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00473977
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a1b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a212
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc