joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452410
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4525e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4525c1
mov dl, 1
mov eax, dword [0x411fa0]
call fcn.0040343c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004041e0
lea eax, [ebp - 0x118]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, eax
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
mov dword [ebp - 0x10], eax
dec ebx
test ebx, ebx
jl 0x4525b0
inc ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x118]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.0043fe34
test al, al
jne 0x4524ad
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4525a3
xor edx, edx
push ebp
push 0x45259c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4524cd
mov ebx, dword [ebp - 0x10]
jmp 0x4524cf
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov dword [ebp - 0x260], ebx
mov byte [ebp - 0x25c], 0
lea ecx, [ebp - 0x260]
mov edx, 0x4525f0
lea eax, [ebp - 0x258]
call fcn.00408f50
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x452585
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x452628
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x452585
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x218]
mov ecx, pe_nt_image_headers32
call fcn.00404450
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x452585
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x218]
mov ecx, pe_nt_image_headers32
call fcn.00404450
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4525a3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x18], 4
dec dword [ebp - 0x14]
jne 0x45248e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415b1c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4525e7
lea eax, [ebp - 0x264]
call fcn.004041e0
ret
Function at 0x452f28
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45cb44]
cmp byte [eax + 0xa5], 0
jne 0x452f99
cmp dword [0x45cb5c], 0
jne 0x452f5a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x452ee4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45cb5c], eax
cmp dword [0x45cb58], 0
jne 0x452f75
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45cb58], eax
cmp dword [0x45cb60], 0
jne 0x452f99
push esp
push 0
push 0
push 0x452e88
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x45cb60], eax
pop edx
ret

Function at 0x45362c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45cb44]
cmp dword [eax + 0x30], 0
je 0x4536d6
cmp dword [ebx + 0x94], 0
jne 0x4536d0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4535bc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4536d0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x453696
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4536d0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413f00
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4536a5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454234
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x454269
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004042d0
jmp 0x454276
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404234
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x455430
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x455471
mov eax, esi
call fcn.0043b3cc
test al, al
je 0x455471
mov eax, dword [ebx + 0x84]
call fcn.0043b0c8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x455471
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043b0c8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x401000
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x465410
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x488fdc]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push edi
mov eax, dword [0x488fdc]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
push 0x24
mov edi, ecx
xor ebx, ebx
mov ebp, 0xf
push str.AlgorithmParametersBase:_parameter__
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.00404e60
push edi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x54]
push ecx
mov dword [esp + 0x80], ebx
call fcn.004052e0
push str.__not_used
push eax
lea edx, [esp + 0x44]
push edx
mov byte [esp + 0x8c], 1
call fcn.004052e0
add esp, 0x18
mov edi, eax
mov ecx, esi
mov byte [esp + 0x74], 2
call fcn.004482cd
mov byte [esp + 0x74], 3
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 6
push ebx
mov dword [ecx + 0x14], ebp
mov dword [ecx + 0x10], ebx
push edi
mov byte [ecx], bl
call fcn.00405720
mov edi, 0x10
cmp dword [esp + 0x44], edi
jb 0x4010d8
mov eax, dword [esp + 0x30]
push eax
call fcn.00445060
add esp, 4
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
cmp dword [esp + 0x60], edi
jb 0x4010f7
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.00445060
add esp, 4
mov dword [esp + 0x60], ebp
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
cmp dword [esp + 0x28], edi
jb 0x401116
mov edx, dword [esp + 0x14]
push edx
call fcn.00445060
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::AlgorithmParametersBase::ParameterNotUsed.0
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0044545a
add esp, 0x68
ret
Function at 0x401c20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
call edx
mov edi, dword [esp + 0x2c]
mov ebp, eax
mov eax, dword [esp + 0x38]
mov ecx, eax
and cl, 3
movzx ecx, cl
neg ecx
sbb ecx, ecx
mov esi, dword [esp + 0x28]
not ecx
and ecx, ebp
mov edx, edi
neg edx
sbb edx, edx
and edx, ebp
mov dword [esp + 0x10], edx
mov edx, eax
and dl, 2
movzx edx, dl
neg edx
sbb edx, edx
not edx
and edx, ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
test al, 8
je 0x401cb4
mov eax, dword [esp + 0x34]
mov ebx, eax
sub ebx, ebp
add esi, ebx
mov ebx, eax
sub ebx, ebp
add edi, ebx
mov ebx, dword [esp + 0x30]
sub eax, ebp
add ebx, eax
mov eax, dword [esp + 0x10]
neg eax
neg ecx
neg edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jmp 0x401cb8
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp ecx, ebp
jb 0x401d9b
mov ecx, eax
and ecx, 4
and eax, 1
mov dword [esp + 0x38], ecx
mov dword [esp + 0x20], eax
jmp 0x401cda
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x401d52
mov ecx, ebp
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x401d12
mov edx, edi
mov edi, ebx
sub edx, esi
mov eax, esi
sub edi, esi
mov dword [esp + 0x28], ecx
mov ebx, dword [edx + eax]
xor ebx, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebx
jne 0x401cf7
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
add eax, eax
add eax, eax
mov ecx, ebp
sub ecx, eax
je 0x401d4c
lea edx, [eax + ebx]
mov dword [esp + 0x30], edx
lea edx, [eax + edi]
add eax, esi
test ecx, ecx
je 0x401d4c
mov edi, dword [esp + 0x30]
sub edx, eax
sub edi, eax
mov dword [esp + 0x30], ecx
mov cl, byte [edx + eax]
xor cl, byte [eax]
inc eax
dec dword [esp + 0x30]
mov byte [edi + eax - 1], cl
jne 0x401d38
mov edi, dword [esp + 0x2c]
push ebx
push 0
push ebx
jmp 0x401d55
push ebx
push edi
push esi
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp dword [esp + 0x20], 0
je 0x401d6b
inc byte [esi + ebp - 1]
mov eax, dword [esp + 0x34]
add ebx, dword [esp + 0x1c]
add edi, dword [esp + 0x10]
add esi, dword [esp + 0x18]
sub eax, ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], eax
cmp eax, ebp
jae 0x401cd6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x14
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x14
ret 0x14
Function at 0x405900
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x405944
mov edi, ebx
sub esi, edx
mov eax, edx
sub edi, edx
mov dword [esp + 0xc], ecx
push ebp
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebp
jne 0x405928
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x40596d
add ebx, eax
add esi, eax
add edx, eax
test edi, edi
je 0x40596d
mov ecx, esi
mov esi, ebx
sub ecx, edx
mov eax, edx
sub esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
dec edi
mov byte [eax + esi - 1], dl
jne 0x405960
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x405980
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, eax
mov eax, ebp
shr eax, 2
xor ecx, ecx
xor edx, edx
test eax, eax
je 0x4059ba
mov edx, edi
sub esi, edi
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esi + edx]
xor ebx, dword [edx]
add edx, 4
or ecx, ebx
dec eax
jne 0x4059a4
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
pop ebx
lea eax, [edx*4]
sub ebp, eax
jne 0x4059d1
pop edi
xor eax, eax
test ecx, ecx
pop esi
sete al
pop ebp
pop ecx
ret
add esi, eax
add edi, eax
mov eax, ecx
mov edx, ecx
shr edx, 0x10
shr eax, 0x18
or al, dl
mov edx, ecx
shr edx, 8
or al, dl
or cl, al
test ebp, ebp
je 0x4059ff
mov eax, edi
sub esi, edi
mov edi, ebp
mov dl, byte [eax + esi]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x4059f4
pop edi
xor eax, eax
test cl, cl
pop esi
sete al
pop ebp
pop ecx
ret

Function at 0x405db0
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x4658f8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x488fdc]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
mov eax, dword [0x488fdc]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, dword [esp + 0x64]
call fcn.00406150
mov ecx, dword [esp + 0x68]
mov eax, dword [eax]
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x405e3d
push 0xe
push 0x4790cc
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], eax
mov byte [esp + 0x10], al
call fcn.00404e60
lea ecx, [esp + 8]
lea esi, [esp + 0x24]
mov dword [esp + 0x5c], 0
call fcn.00405b30
push 0x482160
mov edx, esi
push edx
call fcn.00448281
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0044545a
add esp, 0x58
ret 8
Function at 0x405e60
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x465a90
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x488fdc]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
mov eax, dword [0x488fdc]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], vtable.CryptoPP::NonblockingRng.0
mov dword [esp + 0x60], 2
call fcn.00406150
mov ecx, dword [esp + 0x68]
mov eax, dword [eax]
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x405ef8
push 0xe
push 0x4790cc
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], eax
mov byte [esp + 0x14], al
call fcn.00404e60
lea ecx, [esp + 0xc]
lea esi, [esp + 0x28]
mov byte [esp + 0x60], 3
call fcn.00405b30
push 0x482160
mov edx, esi
push edx
call fcn.00448281
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.0044545a
add esp, 0x5c
ret

Function at 0x4064e0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4654fb
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x488fdc]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push esi
push edi
mov eax, dword [0x488fdc]
xor eax, esp
push eax
lea eax, [esp + 0xe0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea edi, [esp + 0x7c]
neg edi
mov ebx, ecx
mov dword [esp + 0x18], eax
xor eax, eax
mov ecx, 0x10
and edi, 0xf
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea edi, [esp + edi + 0x7c]
mov dword [esp + 0x74], ecx
mov al, 1
mov dword [esp + 0xcc], ecx
lea edx, [esp + 0x2c]
mov ecx, 8
mov esi, 0x47993c
mov byte [esp + 0x6d], al
mov dword [esp + 0x78], edx
mov byte [esp + 0xc5], al
mov dword [esp + 0x14], edi
mov dword [esp + 0xd0], edi
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], vtable.CryptoPP::SHA256.0
mov dword [esp + 0xe8], 2
mov eax, dword [ebx + 0x34]
push 0x20
push eax
lea ecx, [esp + 0x24]
call fcn.0040af10
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.0040af10
mov eax, dword [esp + 0x1c]
mov esi, dword [ebx + 0x34]
lea edi, [eax + 0x38]
mov eax, dword [eax + 0x1c]
lea ecx, [esp + 0x1c]
call eax
mov edx, dword [edi]
push eax
push esi
lea ecx, [esp + 0x24]
call edx
mov edi, dword [esp + 0xd0]
mov byte [ebx + 0x5c], 0
cmp edi, dword [esp + 0x14]
jne 0x4065e9
mov ecx, dword [esp + 0xcc]
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x78]
lea eax, [esp + 0x2c]
cmp edi, eax
jne 0x4065fd
mov ecx, dword [esp + 0x74]
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.0044545a
mov esp, ebp
pop ebp
ret 8
Function at 0x406d20
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x406d30
movzx edx, byte [esi + str.cw]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x4bc370], edx
mov dword [esi*8 + 0x4bc374], eax
inc esi
cmp esi, 0x100
jl 0x406d30
mov dword [0x4bcb78], edi
mov dword [0x4bcb7c], edi
mov dword [0x4bcb70], edi
mov dword [0x4bcb74], edi
pop edi
pop esi
mov byte [0x4bcc14], 1
pop ebx
ret

Function at 0x406db0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x479388]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x4bbb70], edx
mov dword [eax*8 + 0x4bbb74], ebp
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x100
jl 0x406dc0
pop edi
pop esi
pop ebp
mov byte [0x4bcc15], 1
pop ebx
add esp, 0x10
ret
Function at 0x408450
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
movdqa xmm0, xmmword [eax]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movdqa xmm1, xmmword [edi]
lea edx, [esi - 1]
pxor xmm0, xmm1
movdqa xmmword [eax], xmm0
cmp edx, 1
jbe 0x4084a7
add edx, 0xfffffffe
shr edx, 1
lea ecx, [edi + 0x10]
inc edx
movdqa xmm1, xmmword [ecx]
movdqa xmm0, xmmword [eax]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx + 0x10]
add ecx, 0x20
dec edx
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
jne 0x408482
movdqa xmm0, xmmword [eax]
add esi, esi
movdqa xmm1, xmmword [edi + esi*8 - 0x10]
lea ecx, [edi + esi*8]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx]
pop edi
aesenclast xmm0, xmm1
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4084e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
movdqa xmm1, xmmword [eax]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
movdqa xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
pxor xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
pxor xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pxor xmm1, xmm0
movdqa xmmword [esi], xmm1
cmp ebx, 1
jbe 0x408584
add edi, 0x10
dec ebx
lea esp, [esp]
movdqa xmm0, xmmword [edi]
movdqa xmm1, xmmword [eax]
aesenc xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenc xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenc xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
add edi, 0x10
dec ebx
aesenc xmm1, xmm0
movdqa xmmword [esi], xmm1
jne 0x408540
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
movdqa xmm1, xmmword [eax]
add ebx, ebx
movdqa xmm0, xmmword [edi + ebx*8]
aesenclast xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenclast xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenclast xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pop edi
aesenclast xmm1, xmm0
movdqa xmmword [esi], xmm1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409070
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4656f0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x488fdc]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [0x488fdc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax], 0x47376c
mov dword [eax + 4], 0x473730
mov dword [eax + 0x18], 0x4736fc
mov dword [eax + 0x28], 0x4736cc
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0044545a
add esp, 0x14
ret
Function at 0x40dc50
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x110], ecx
push str.Unable_To_Determine_CPU
mov ecx, dword [ebp - 0x110]
add ecx, 0x244
call fcn.0040fdb0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40dd24
mov cl, byte [0x4664fb]
mov byte [ebp - 0x108], cl
push 0xff
push 0
lea edx, [ebp - 0x107]
push edx
call fcn.004456b0
add esp, 0xc
mov dword [ebp - 0x10c], 0x100
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
push str.ProcessorNameString
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dd1a
lea eax, [ebp - 0x108]
push eax
call fcn.0040f980
add esp, 4
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp - 0x110]
add ecx, 0x244
call fcn.0040fdb0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x40e140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x21c], ecx
mov al, byte [0x46653a]
mov byte [ebp - 0x210], al
push 0xff
push 0
lea ecx, [ebp - 0x20f]
push ecx
call fcn.004456b0
add esp, 0xc
mov dword [ebp - 0x218], 0x100
mov dl, byte [0x46653b]
mov byte [ebp - 0x108], dl
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.004456b0
add esp, 0xc
mov dword [ebp - 4], 0x100
mov byte [ebp - 0x211], 0
lea ecx, [ebp - 0x10c]
push ecx
push 0xf003f
push 0
push str.SOFTWAREFRISK_Software_InternationalFP_WinVersion
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e281
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x466b48
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40e274
mov byte [ebp - 0x211], 1
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp - 0x21c]
add ecx, 0x298
call fcn.0040fdb0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
push str.Package_version
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40e274
push 0x466b60
mov ecx, dword [ebp - 0x21c]
add ecx, 0x298
call fcn.00404c70
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x21c]
add ecx, 0x298
call fcn.00404c70
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x211]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret