joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, edi
shr eax, 5
inc eax
mov edx, edi
mov dword [esp + 0xc], edi
mov ecx, edi
cmp edi, eax
jb 0x446681
mov esi, dword [ebp + 0xc]
movzx esi, byte [esi + ecx - 1]
mov ebx, edx
shl ebx, 5
add esi, ebx
mov ebx, edx
shr ebx, 2
add esi, ebx
sub ecx, eax
xor edx, esi
cmp ecx, eax
jae 0x44665f
mov dword [esp + 0xc], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, edx
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x4466f4
cmp dword [eax + 0xc], edi
jne 0x4466ee
test edi, edi
je 0x4466a5
test byte [eax + 7], 0x10
jne 0x4466ee
mov esi, dword [ebp + 0xc]
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x4466c6
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x4466ea
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x4466b2
test ecx, ecx
je 0x44670d
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x4466ea
cmp ecx, 1
jbe 0x44670d
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x4466ea
cmp ecx, 2
jbe 0x44670d
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x44670d
mov edx, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x446696
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
push edi
push eax
push ecx
call fcn.00446570
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x10]
mov cl, byte [eax + 5]
movzx edx, byte [edx + 0x14]
movzx ebx, cl
not edx
and ebx, 3
test bl, dl
je 0x446706
pop edi
xor cl, 3
pop esi
mov byte [eax + 5], cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
add edx, edx
mov eax, edx
shr eax, 5
push ebx
push esi
inc eax
push edi
mov esi, edx
mov dword [ebp - 4], edx
mov ecx, edx
cmp edx, eax
jb 0x446781
lea ebx, [ebx]
mov edi, dword [ebp + 0xc]
movzx edi, byte [edi + ecx - 1]
mov ebx, esi
shl ebx, 5
add edi, ebx
mov ebx, esi
shr ebx, 2
add edi, ebx
sub ecx, eax
xor esi, edi
cmp ecx, eax
jae 0x446760
mov dword [ebp - 4], esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, esi
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x4467f3
cmp dword [eax + 0xc], edx
jne 0x4467ed
test edx, edx
je 0x4467a5
test byte [eax + 7], 0x10
je 0x4467ed
mov edi, dword [ebp + 0xc]
mov ecx, edx
lea esi, [eax + 0x10]
cmp edx, 4
jb 0x4467c6
mov ebx, dword [edi]
cmp ebx, dword [esi]
jne 0x4467ea
sub ecx, 4
add esi, 4
add edi, 4
cmp ecx, 4
jae 0x4467b2
test ecx, ecx
je 0x446810
mov bl, byte [esi]
cmp bl, byte [edi]
jne 0x4467ea
cmp ecx, 1
jbe 0x446810
mov bl, byte [esi + 1]
cmp bl, byte [edi + 1]
jne 0x4467ea
cmp ecx, 2
jbe 0x446810
mov cl, byte [esi + 2]
cmp cl, byte [edi + 2]
je 0x446810
mov esi, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
jne 0x446796
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push edx
push eax
push ecx
call fcn.00446570
add esp, 0x10
mov byte [eax + 7], 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov cl, byte [eax + 5]
mov esi, dword [esi + 0x10]
movzx ebx, byte [esi + 0x14]
movzx edx, cl
and edx, 3
not ebx
test bl, dl
je 0x446809
pop edi
xor cl, 3
pop esi
mov byte [eax + 5], cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
mov esi, dword [eax*4 + 0x496f30]
mov edi, esi
mov dword [esp + 0xc], esi
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x446f98
sub edi, ecx
mov eax, edi
shr eax, 5
inc eax
mov ebx, edi
mov dword [esp + 0x14], edi
mov ecx, edi
cmp edi, eax
jb 0x446fd6
movzx edx, byte [esi + ecx - 1]
mov esi, ebx
shl esi, 5
add edx, esi
mov esi, ebx
shr esi, 2
add edx, esi
mov esi, dword [esp + 0xc]
sub ecx, eax
xor ebx, edx
cmp ecx, eax
jae 0x446fb3
mov dword [esp + 0x14], ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [eax]
dec ecx
and ecx, ebx
mov edx, dword [edx + ecx*4]
test edx, edx
je 0x447062
jmp 0x446ff0
cmp dword [edx + 0xc], edi
jne 0x44705c
test edi, edi
je 0x446fff
test byte [edx + 7], 0x10
jne 0x44705c
mov eax, edi
lea ecx, [edx + 0x10]
cmp edi, 4
jb 0x447024
lea esp, [esp]
mov ebx, dword [esi]
cmp ebx, dword [ecx]
jne 0x447054
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x447010
test eax, eax
je 0x4470d3
mov bl, byte [ecx]
cmp bl, byte [esi]
jne 0x447054
cmp eax, 1
jbe 0x4470d3
mov bl, byte [ecx + 1]
cmp bl, byte [esi + 1]
jne 0x447054
cmp eax, 2
jbe 0x4470d3
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
je 0x4470d3
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov edx, dword [edx]
test edx, edx
jne 0x446ff0
mov edx, dword [ebp + 8]
push ebx
push edi
push esi
push edx
call fcn.00446570
add esp, 0x10
mov ecx, dword [esp + 0x10]
or byte [eax + 5], 0x20
lea edx, [ecx + 1]
inc ecx
mov byte [eax + 6], dl
mov dword [esp + 0x10], ecx
cmp ecx, 0x20
jl 0x446f84
mov ecx, dword [0x497030]
test ecx, ecx
je 0x4470cc
mov esi, 0x497030
mov bl, 0x2e
mov edi, edi
mov eax, ecx
add esi, 4
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4470a8
sub eax, edi
push eax
mov eax, dword [ebp + 8]
push ecx
push eax
call fcn.00446640
or byte [eax + 5], 0x20
mov byte [eax + 6], bl
mov ecx, dword [esi]
add esp, 0xc
test ecx, ecx
jne 0x4470a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov al, byte [edx + 5]
mov esi, dword [esi + 0x10]
movzx ebx, byte [esi + 0x14]
movzx ecx, al
and ecx, 3
not ebx
test bl, cl
je 0x4470f1
xor al, 3
mov byte [edx + 5], al
mov eax, edx
jmp 0x447071
Function at 0x45c290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4ae9fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x41c], ecx
lea ecx, [ebp - 0x40c]
push edi
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], 0
mov edi, 0x400
jmp 0x45c2e6
mov eax, dword [ebp - 0x410]
lea edx, [ebp - 0x40c]
sub ecx, edx
mov dword [ebp - 0x424], ecx
je 0x45c350
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x48]
mov esi, eax
cmp edx, dword [ecx + 0x44]
jb 0x45c308
call fcn.00436a70
mov eax, dword [ebp - 0x424]
mov ebx, dword [esi + 8]
push eax
lea ecx, [ebp - 0x40c]
push ecx
push esi
call fcn.00446640
mov dword [ebx], eax
mov dword [ebx + 8], 4
add dword [esi + 8], 0x10
inc dword [ebp - 0x414]
lea eax, [ebp - 0x418]
add esp, 0xc
lea edx, [ebp - 0x40c]
push eax
mov dword [ebp - 0x418], edx
call fcn.00423c90
add esp, 4
mov ebx, dword [ebp + 0xc]
cmp edi, ebx
jbe 0x45c359
mov edi, ebx
mov ecx, dword [ebp - 0x41c]
push ecx
push edi
lea edx, [ebp - 0x40c]
push 1
push edx
call fcn.00472a0b
mov ecx, dword [ebp - 0x418]
add ecx, eax
add esp, 0x10
sub ebx, eax
mov dword [ebp - 0x418], ecx
mov dword [ebp + 0xc], ebx
je 0x45c38f
cmp eax, edi
je 0x45c2e0
lea eax, [ebp - 0x40c]
sub ecx, eax
mov edi, ecx
je 0x45c3e9
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x48]
mov esi, eax
cmp edx, dword [ecx + 0x44]
jb 0x45c3b3
call fcn.00436a70
mov ebx, dword [esi + 8]
push edi
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.00446640
mov dword [ebx], eax
mov dword [ebx + 8], 4
add dword [esi + 8], 0x10
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x40c]
add esp, 0xc
inc dword [ebp - 0x414]
mov dword [ebp - 0x418], ecx
mov eax, dword [ebp - 0x414]
mov esi, dword [ebp - 0x410]
call fcn.004208d0
mov dword [ebp - 0x414], 1
test ebx, ebx
je 0x45c466
mov edi, dword [ebp - 0x420]
mov esi, dword [edi + 8]
mov eax, dword [esi - 8]
sub esi, 0x10
add eax, 0xfffffffd
cmp eax, 4
ja case.0x45c41f.6
jmp dword [eax*4 + 0x45c47c]
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
jmp 0x45c44f
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
jmp 0x45c44f
mov eax, dword [esi]
call fcn.00434f50
jmp 0x45c44f
call fcn.00436ca0
test eax, eax
je 0x45c44d
mov ecx, dword [esi]
mov eax, dword [ecx + 0xc]
jmp 0x45c44f
xor eax, eax
test eax, eax
jne 0x45c466
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d3c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0046d3c1
mov esp, ebp
pop ebp
ret
Function at 0x4600c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x40]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], edx
test esi, esi
jne 0x460103
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x4600fc
mov esi, dword [eax + 0x20]
jmp 0x460103
test bl, bl
jns 0x460103
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 0x24]
mov dword [ebp - 0x10], esi
mov esi, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
cmp si, word [eax + 6]
jae 0x4601d0
lea ebx, [ecx + 0x4c]
lea esp, [esp]
mov esi, dword [edi + 0x40]
mov ecx, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ecx
mov dword [ebp - 4], ecx
test edi, edi
jne 0x460158
mov ecx, dword [ebx]
test cl, 0x40
je 0x460151
mov edi, dword [eax + 0x20]
jmp 0x460158
test cl, cl
jns 0x460158
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x460187
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
cmp eax, esi
ja 0x460187
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.00460010
test eax, eax
je 0x4601ee
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [ebp - 0x1c], edx
mov edx, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
jmp 0x4601af
mov eax, dword [ebx]
test eax, 0x2000000
je 0x46019e
test dword [ebp - 0x10], 0x2000000
je 0x46019e
or dword [ebp - 0x10], eax
jmp 0x4601a9
or eax, dword [ebp - 0x10]
and eax, 0xfdffffff
mov dword [ebp - 0x10], eax
sub edi, dword [ebp - 0x1c]
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp ecx, esi
jl 0x460130
lea ecx, [ebp - 0x1c]
mov eax, edi
mov dword [ebp - 0xc], 1
call fcn.00460010
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d3c1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ae9fc]
jne 0x46d3cb
repz ret
jmp fcn.00476cec

Function at 0x470956
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x47097d
call fcn.0047121b
mov dword [eax], esi
call fcn.00471208
push 0x16
pop esi
mov dword [eax], esi
call fcn.00470bf0
mov eax, esi
jmp 0x4709d2
test dword [ebp + 0xc], 0xfffffff9
jne 0x470963
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4709aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047122e
pop ecx
call fcn.00471208
mov eax, dword [eax]
jmp 0x4709d2
test al, 0x10
jne 0x4709d0
test al, 1
je 0x4709d0
test byte [ebp + 0xc], 2
je 0x4709d0
call fcn.0047121b
mov dword [eax], 5
call fcn.00471208
mov dword [eax], 0xd
jmp 0x4709a1
xor eax, eax
pop esi
pop ebp
ret

Function at 0x480918
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x48093f
call fcn.0047121b
mov dword [eax], esi
call fcn.00471208
push 0x16
pop esi
mov dword [eax], esi
call fcn.00470bf0
mov eax, esi
jmp 0x480994
test dword [ebp + 0xc], 0xfffffff9
jne 0x480925
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x48096c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047122e
pop ecx
call fcn.00471208
mov eax, dword [eax]
jmp 0x480994
test al, 0x10
jne 0x480992
test al, 1
je 0x480992
test byte [ebp + 0xc], 2
je 0x480992
call fcn.0047121b
mov dword [eax], 5
call fcn.00471208
mov dword [eax], 0xd
jmp 0x480963
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4869d7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ae9fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004795a6
and dword [ebp - 0x14], 0
cmp dword [0x4b130c], 0
mov dword [ebp - 0x18], eax
jne 0x486a8a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x486b32
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x495bb8
push ebx
call edi
test eax, eax
je 0x486b32
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x495ba8
push ebx
mov dword [0x4b130c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4b1310], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4b1314], eax
call edi
push eax
call esi
mov dword [0x4b131c], eax
test eax, eax
je 0x486a8a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4b1318], eax
mov eax, dword [0x4b1318]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x486ae3
cmp dword [0x4b131c], ecx
je 0x486ae3
push eax
call esi
push dword [0x4b131c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x486ae3
test ebx, ebx
je 0x486ae3
call edi
test eax, eax
je 0x486ada
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x486ada
test byte [ebp - 8], 1
jne 0x486ae3
or dword [ebp + 0x10], 0x200000
jmp 0x486b16
mov eax, dword [0x4b1310]
cmp eax, dword [ebp - 0x18]
je 0x486b16
push eax
call esi
test eax, eax
je 0x486b16
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x486b16
mov eax, dword [0x4b1314]
cmp eax, dword [ebp - 0x18]
je 0x486b16
push eax
call esi
test eax, eax
je 0x486b16
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b130c]
call esi
test eax, eax
je 0x486b32
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x486b34
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d3c1
leave
ret
Function at 0x408898
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42b7a4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4088b5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4088e3
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4088be
mov dword [ecx*4 + 0x42b7a0], eax
inc ecx
cmp ecx, 0x100
jne 0x4088b7
jmp 0x4088a9
cmp edx, ebx
je 0x4088fc
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x42b7a0]
jmp 0x4088e3
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x409130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.qmpJQplM
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x409152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x409159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x409148
mov eax, 1
add ebx, ebx
jne 0x40916b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x409160
jne 0x40917c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409160
xor ecx, ecx
sub eax, 3
jb 0x409190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x409202
mov ebp, eax
add ebx, ebx
jne 0x40919b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4091a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4091cc
inc ecx
add ebx, ebx
jne 0x4091b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4091ad
jne 0x4091c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4091ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4091ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4091dd
jmp 0x40914e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4091ec
add edi, ecx
jmp 0x40914e
pop esi
mov edi, esi
mov ecx, 5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40920a
cmp byte [edi], 0
jne 0x40920a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40920f
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x40927e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa10c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa164]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40923c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa16c]
or eax, eax
je 0x409278
mov dword [ebx], eax
add ebx, 4
jmp 0x409259
call dword [esi + 0xa168]
mov ebp, dword [esi + 0xa170]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4092b2
sub esp, 0xffffff80
jmp 0x40124f
Function at 0x405a11
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x4dbe18
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x405a69
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x405a69
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x405a69
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x405a92
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x4dbe18
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x405b00
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405af7
cmp dword [ebp - 0xc], 4
jne 0x405af7
cmp dword [ebp - 0x10], edi
je 0x405af7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x4fa8f8], edi
xor eax, eax
jmp 0x405b28
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4fa8f8], edi
jge 0x405b23
mov dword [0x4fa8f8], edi
call fcn.00405a6d
test eax, eax
je 0x405b23
emms
mov dword [0x4fa8f8], 1
mov eax, dword [0x4fa8f8]
pop edi
leave
ret

Function at 0x405c08
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x405c3f
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x405c61
cmp dword [ebp - 0x20], 4
ja 0x405c6b
jne 0x405c5b
cmp dword [ebp - 0x1c], 0xa
jb 0x405c5b
cmp word [ebp - 0x18], 0x55d
jae 0x405c6b
mov byte [ebp + 0x73], 1
jmp 0x405c6b
cmp dword [ebp - 0x14], 2
jne 0x405c81
test bl, bl
je 0x405c9c
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x405c8c
dec eax
je 0x405c85
sub eax, 3
jne 0x405c81
cmp byte [ebp + 0x73], 0
je 0x405cad
xor eax, eax
jmp 0x405cb5
call fcn.00405b2b
jmp 0x405cb5
cmp byte [ebp + 0x73], 0
jne 0x405c81
call fcn.00405b63
and eax, 4
jmp 0x405cb5
cmp dword [ebp + 0x7c], 0xa
je 0x405cad
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x405cb5
call fcn.00405b63
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x408d38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x408e59
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x408e3d
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x408d8f
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x408d6d
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret