joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4793da
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x110
xor ebx, ebx
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.00689b00
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47942a
cmp dword [ebp - 0x114], 6
jb 0x47942a
inc ebx
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00682c16
mov esp, ebp
pop ebp
ret

Function at 0x47b0ee
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.0047b039
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push esi
push 0x47b1bf
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 8], eax
test eax, eax
mov edx, 0x80004005
pop esi
cmove ecx, edx
mov eax, ecx
ret

Function at 0x47b11e
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x47b131
mov eax, 0x80004005
jmp 0x47b15b
call fcn.0047b074
test al, al
jne 0x47b159
cmp byte [ebp + 8], al
je 0x47b14c
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x47b159
push 0xffffffffffffffff
mov ecx, esi
mov byte [esi + 0xc], 1
call fcn.0047b196
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x511976
Capabilities:
Enumerate gui resources

Disassembly:
push 0xc
mov eax, 0x6ed738
call fcn.00682c5e
mov edi, ecx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
xor ebx, ebx
push ebx
push dword [edi + 0x304]
mov dword [edi + 0x2fc], 1
call esi
push ebx
push dword [edi + 0x8c]
call esi
push 8
push dword [edi + 0x260]
call esi
lea ecx, [edi + 0x25c]
call fcn.004cd13a
push ebx
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
lea ecx, [edi + 0x394]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call fcn.004cf3b6
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x511a3d
mov esi, str.clicked_restart_button__qq_instance_id:_u_n
push dword [ecx + ebx*4]
push esi
push str.TXUPD
push 2
push str.CTrayTipsDlg::OnBtnClickRestart
push 0x9d
push str.E:FixReplayAttackscodingTXUpdate_serviceuiengineTrayTipsDlg.cpp
call fcn.004ce9b9
mov eax, dword [ebp - 0x18]
push dword [eax + ebx*4]
push esi
call fcn.0047380a
mov eax, dword [ebp - 0x14]
add esp, 0x24
mov ecx, dword [ebp - 0x18]
inc ebx
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x5119ff
lea eax, [ebp - 0x18]
push eax
push 0x5118d3
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [ebp - 0x18]
call fcn.00512258
xor eax, eax
call fcn.00682c27
ret 0x10

Function at 0x512976
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 0x10

Function at 0x512986
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 0x10
Function at 0x53edb1
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 3
test eax, eax
je 0x53eded
mov eax, dword [esi]
cmp dword [eax + edi*8 + 4], 0
je 0x53edd5
push dword [eax + edi*8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi]
push dword [eax + edi*8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
inc edi
sub eax, dword [esi]
sar eax, 3
cmp edi, eax
jb 0x53edc3
pop edi
mov ecx, esi
pop esi
jmp fcn.0054160e

Function at 0x53f1ca
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x53f24d
cmp dword [ebp + 0xc], 0
je 0x53f24d
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x53f24c
push esi
push 0x290
call fcn.00682bd5
push dword [ebp + 8]
mov esi, eax
push 0x104
push esi
call fcn.006aee9a
push dword [ebp + 0xc]
lea ecx, [esi + 0x208]
push 0x40
push ecx
call fcn.006aee9a
add esp, 0x1c
mov dword [esi + 0x288], edi
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x28c], eax
xor eax, eax
push eax
push eax
push esi
push 0x53f98e
push eax
push eax
call fcn.006ad77b
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebp
ret

Function at 0x53f24f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x53f2c4
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x53f2c3
push esi
push 0x290
call fcn.00682bd5
push dword [ebp + 8]
mov esi, eax
push 0x104
push esi
call fcn.006aee9a
xor eax, eax
mov dword [esi + 0x288], edi
add esp, 0x10
mov word [esi + 0x208], ax
mov ecx, dword [edi]
push edi
call dword [ecx + 4]
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x28c], eax
xor eax, eax
push eax
push eax
push esi
push 0x53f98e
push eax
push eax
call fcn.006ad77b
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebp
ret
Function at 0x554ab2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_int___thiscall_CTXStringW::GetLength_void_const
test eax, eax
jle 0x554b72
lea esi, [eax - 1]
push esi
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_wchar_t___thiscall_CTXStringW::GetAt_int_const
push 0x5c
pop edi
cmp ax, di
jne 0x554b06
push esi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_
push eax
lea ecx, [ebp - 4]
call fcn.0051b603
lea ecx, [ebp - 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x554b1e
test al, 0x10
jne 0x554b6d
push edi
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_int___thiscall_CTXStringW::ReverseFind_wchar_t_const
cmp eax, 0xffffffff
je 0x554b72
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_
lea ecx, [ebp - 8]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call fcn.00554ab2
pop ecx
xor esi, esi
lea ecx, [ebp - 4]
push esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 8]
test eax, eax
jne 0x554b68
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
jmp 0x554b74
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor esi, esi
inc esi
jmp 0x554b74
xor esi, esi
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5986dc
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0x1388
mov dword [esi], 0x72cf70
call sym.txupd.exe_public:_int___thiscall_CTXThreadModel::StopThread_unsigned_long_int_
lea ecx, [esi + 0x38]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
mov ecx, esi
pop esi
jmp sym.txupd.exe_protected_virtual:_void___thiscall_CTXThreadModel::destructor_void_

Function at 0x5c0f1c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ecx, 0xabe974
call fcn.0041c516
lea eax, [ebp + 8]
mov ecx, 0xabe96c
push eax
call fcn.005c08d3
mov ecx, dword [0xabe96c]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp eax, ecx
je 0x5c0f57
cmp esi, dword [eax + 0x10]
jb 0x5c0f57
mov dword [ebp - 8], eax
jmp 0x5c0f5c
mov dword [ebp - 0xc], ecx
mov eax, ecx
xor ebx, ebx
inc ebx
cmp eax, ecx
je 0x5c0f8c
push esi
push str._sock_recv_thread_exists__return__sock0x_x
push str.sock
push 3
push str.func
push 0x151
push str.file
call fcn.004e4f3c
add esp, 0x1c
jmp 0x5c1080
push 0x14
call fcn.00682bd5
mov edi, eax
xor ebx, ebx
pop ecx
test edi, edi
je 0x5c0fac
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
jmp 0x5c0fae
mov edi, ebx
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
xor eax, eax
push ebx
inc eax
mov dword [edi], esi
push ebx
push eax
push ebx
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push edi
push 0x5c24df
push ebx
push ebx
mov dword [edi + 0x10], eax
mov dword [edi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x5c1039
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], edi
mov edi, 0xabe96c
push eax
mov ecx, edi
mov dword [ebp - 0x14], esi
call fcn.005c013f
push eax
add eax, 0x10
mov ecx, edi
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.005c0660
push dword [0xabe970]
push esi
push str.create_recv_thread_ok__sock0x_x__runningThread_lu
push str.sock
push 2
push str.func
push 0x162
push str.file
call fcn.004e4f3c
xor ebx, ebx
add esp, 0x20
inc ebx
jmp 0x5c1080
mov esi, dword [0xabe970]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push dword [ebp - 4]
push str._Fail_to_Create_Recv_Thread__Sock0x_x__threadCount_u__err_u
push str.sock
push 2
push str.func
push 0x167
push str.file
call fcn.004e4f3c
add esp, 0x24
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x14
push edi
call fcn.00682c08
pop ecx
pop ecx
mov ecx, 0xabe974
call fcn.0041c51e
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x663120
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x148
mov eax, dword [0x7b088c]
xor eax, esp
mov dword [esp + 0x144], eax
push esi
mov esi, ecx
push edi
mov dword [esi], 0
mov dword [esi + 0x18], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.IsWow64Process
push str.kernel32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x66318c
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push edi
call eax
test eax, eax
jne 0x663183
mov eax, 2
jmp 0x66318c
xor eax, eax
cmp dword [esp + 8], eax
setne al
push 0x118
mov dword [esi + 0x24], eax
lea eax, [esp + 0x38]
push 0
push eax
mov dword [esp + 0x3c], 0x11c
call fcn.00689b00
add esp, 0xc
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
cmp edx, 5
jne 0x6631e1
test ecx, ecx
jle 0x663212
xor eax, eax
cmp ecx, 1
setne al
inc eax
mov dword [esi], eax
jmp 0x663212
cmp edx, 6
jne 0x66320a
cmp byte [esp + 0x14a], 1
jne 0x663202
xor eax, eax
test ecx, ecx
setne al
lea eax, [eax*2 + 3]
mov dword [esi], eax
jmp 0x663212
mov dword [esi], 4
jmp 0x663212
jle 0x663212
mov dword [esi], 5
movzx eax, word [esp + 0x144]
xorps xmm0, xmm0
mov dword [esi + 0x10], eax
movzx eax, word [esp + 0x146]
mov dword [esi + 0x14], eax
lea eax, [esp + 0xc]
push eax
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
movups xmmword [esp + 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [esp + 0xc]
test eax, eax
je 0x66326d
cmp eax, 6
je 0x663264
cmp eax, 9
jne 0x663274
mov dword [esi + 0x18], 1
jmp 0x663274
mov dword [esi + 0x18], 2
jmp 0x663274
mov dword [esi + 0x18], 0
mov ecx, dword [esp + 0x20]
mov eax, esi
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
xor ecx, esp
call fcn.00682c16
add esp, 0x148
ret

Function at 0x666fb0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0xb4
mov eax, dword [esp + 0xb8]
push ebx
push dword [esp + 0xc0]
xor ebx, ebx
push dword [eax]
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x667017
call fcn.006345a0
cmp eax, 4
jg 0x667009
push 4
push 0x24
push str.threading_thread_local_win.cc
lea ecx, [esp + 0x14]
call fcn.00633660
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.004d4587
add esp, 8
mov ebx, 1
test bl, 1
je 0x667017
lea ecx, [esp + 8]
call fcn.00633930
pop ebx
add esp, 0xb4
ret

Function at 0x6d0e88
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006d0a8d

Function at 0x6d0e93
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006d0c0e

Function at 0x6d76ce
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006d6ebd
Function at 0x6d76d9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006d70f8

Function at 0x6d7ad8
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006d78cc

Function at 0x6e0280
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov ecx, dword [ecx + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, dword [ecx + 0x3c]
push esi
push edi
xor esi, esi
mov dword [esp + 0x10], ecx
add ebx, ecx
xor edi, edi
movzx eax, word [ebx + 6]
cmp esi, eax
jae 0x6e02da
movzx eax, word [ebx + 0x14]
lea edx, [ebx + 0x18]
add eax, edi
add edx, eax
je 0x6e02da
mov eax, dword [edx + 0xc]
add ecx, eax
neg eax
sbb eax, eax
and eax, ecx
cmp eax, ebp
ja 0x6e02c6
mov ecx, dword [edx + 8]
add ecx, eax
cmp ecx, ebp
ja 0x6e02d0
mov ecx, dword [esp + 0x10]
inc esi
add edi, 0x28
jmp 0x6e0299
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
pop ecx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4

Function at 0x6e0430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, ecx
test ebx, ebx
jne 0x6e0449
pop ebp
xor al, al
pop ebx
add esp, 8
ret 8
mov eax, dword [ebp + 4]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov eax, dword [ebp]
push dword [ecx + 0x78]
mov ecx, ebp
call dword [eax]
mov esi, eax
mov dword [esp + 0xc], esi
test esi, esi
jne 0x6e0471
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 8
mov eax, dword [esp + 0x18]
push edi
cmp eax, 0xffff
ja 0x6e048c
pop edi
pop esi
mov word [ebx], ax
mov al, 1
pop ebp
pop ebx
add esp, 8
ret 8
mov eax, dword [ebp]
mov ecx, ebp
push dword [esi + 0x20]
call dword [eax]
mov ecx, dword [esi + 0x18]
mov edi, eax
mov dword [esp + 0x14], eax
lea ebx, [eax + ecx*4]
cmp eax, ebx
je 0x6e04f7
mov eax, ebx
sub eax, edi
sar eax, 2
mov eax, eax
test eax, eax
jns 0x6e04b6
add eax, 1
sar eax, 1
push dword [edi + eax*4]
lea esi, [edi + eax*4]
mov ecx, ebp
mov eax, dword [ebp]
call dword [eax]
mov ecx, dword [esp + 0x1c]
mov edx, ecx
mov cl, byte [ecx]
test cl, cl
je 0x6e04de
cmp cl, byte [eax]
jne 0x6e04de
mov cl, byte [edx + 1]
inc edx
inc eax
test cl, cl
jne 0x6e04d1
movzx eax, byte [eax]
movzx ecx, byte [edx]
sub ecx, eax
je 0x6e0503
test ecx, ecx
jle 0x6e04f1
lea edi, [esi + 4]
jmp 0x6e04f3
mov ebx, esi
cmp edi, ebx
jne 0x6e04a6
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 8
mov edi, dword [esp + 0x10]
mov ecx, ebp
mov eax, dword [ebp]
push dword [edi + 0x24]
call dword [eax]
sub esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
sar esi, 2
mov ax, word [eax + esi*2]
add ax, word [edi + 0x10]
pop edi
pop esi
pop ebp
mov word [ecx], ax
mov al, 1
pop ebx
add esp, 8
ret 8
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0xa4d22
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x647266ea
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4017c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
xor esi, esi
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x4017fd
lea ecx, [esp + 8]
push ecx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40187d
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 0
push edi
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x401867
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.004b001f
mov esi, eax
add esp, 4
test esi, esi
je 0x401867
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8

Function at 0x401890
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 4]
mov dword [esp + 8], 0
push eax
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x4018d2
lea ecx, [esp + 4]
push ecx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40190e
lea edx, [esp + 0x14]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
pop esi
add esp, 0xc
ret 8

Function at 0x401920
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 4]
mov dword [esp + 0xc], 0
push eax
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x40196a
lea ecx, [esp + 4]
push ecx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4019a6
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x30], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
fld qword [esp + 0xc]
pop esi
add esp, 0x10
ret 8