joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f0a1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x904
mov eax, dword [0x46b730]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push pe_nt_image_headers32
lea eax, [ebp - 0x904]
push 0
push eax
call fcn.0041b964
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
xor edi, edi
call fcn.0041b69a
push 0x5c
pop esi
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.004380ad
pop ecx
pop ecx
test eax, eax
je 0x42f106
xor ecx, ecx
mov dword [ebp + edi*4 - 0x904], eax
mov word [eax], cx
inc edi
cmp edi, 0x40
jge 0x42f149
test eax, eax
je 0x42f13f
lea eax, [ebp - 0x804]
push eax
call fcn.0042f173
test eax, eax
js 0x42f0e6
jmp 0x42f13f
mov eax, dword [ebp + edi*4 - 0x908]
dec edi
mov word [eax], si
push 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x42f149
cmp edi, 1
jg 0x42f121
xor eax, eax
inc eax
jmp 0x42f14b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041b956
leave
ret 4

Function at 0x42f246
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x42f28e
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x42f28e
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42f28e
cmp word [eax + 2], 0
je 0x42f28e
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x42f28e
add eax, 0x30
jmp 0x42f293
mov eax, 0x40a25c
pop esi
pop ebp
ret
Function at 0x430efe
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x46b730]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], eax
test ebx, ebx
jne 0x430f43
push 0x15b3c8
call fcn.00419d97
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x430f3c
and dword [ebp - 0x4c], ebx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4310a7
cmp dword [0x46ebc4], eax
je 0x430f5a
mov eax, dword [0x46cc7c]
mov dword [ebx], eax
xor eax, eax
inc eax
jmp 0x4310a7
push edi
mov dword [ebx], eax
lea eax, [ebp - 0x4c]
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x430f88
push 0x15b3c9
call fcn.00419d97
xor edi, edi
jmp 0x431092
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 2
push dword [ebp - 0x4c]
call edi
test eax, eax
je 0x430fa8
push 0x15b3ca
jmp 0x430f7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x430fba
push 0x15b3cb
jmp 0x430f7c
push esi
push dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
call fcn.0042ef71
mov esi, dword [ebp - 0x50]
test al, al
jne 0x430fde
push 0x15b3cc
call fcn.00419d97
xor edi, edi
jmp 0x431086
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x4c]
call edi
test eax, eax
jne 0x430ff8
push 0x15b3cd
jmp 0x430fd2
push 0x43
lea eax, [ebp - 0x47]
push 0
push eax
mov byte [ebp - 0x48], 0
call fcn.0041b964
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x431030
push 0x15b3ce
jmp 0x430fd2
and dword [ebp - 0x58], 0
xor edi, edi
inc edi
cmp dword [esi], 0
jbe 0x431079
lea eax, [esi + 4]
mov dword [ebp - 0x50], eax
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x431061
mov eax, dword [ebp - 0x50]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x431077
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x50]
inc ecx
add eax, 8
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], eax
cmp ecx, dword [esi]
jb 0x431042
jmp 0x431079
mov dword [ebx], edi
mov dword [0x46ebc4], edi
mov eax, dword [ebx]
mov dword [0x46cc7c], eax
test esi, esi
je 0x431091
push esi
call fcn.00417047
pop ecx
pop esi
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4310a4
and dword [ebp - 0x4c], 0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041b956
leave
ret 4
Function at 0x431be2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x46b730]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor bl, bl
call fcn.00438235
test eax, eax
je 0x431d03
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor edi, edi
push edi
push 0x40a430
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x218], edi
call esi
test eax, eax
jne 0x431cd5
lea eax, [ebp - 0x218]
push eax
push 0x20119
push edi
push 0x40a430
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x431cd5
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push 0x40a494
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 0x20a
call esi
test eax, eax
jne 0x431cd5
cmp dword [ebp - 0x220], 1
jne 0x431cd5
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push 0x40a494
push dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x20a
call esi
test eax, eax
jne 0x431cd5
cmp dword [ebp - 0x220], 1
jne 0x431cd5
inc bl
mov eax, dword [ebp - 0x218]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x431cee
push eax
mov dword [ebp - 0x218], edi
call esi
mov ecx, dword [ebp - 0x214]
test ecx, ecx
je 0x431d01
push ecx
mov dword [ebp - 0x214], edi
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0041b956
leave
ret
Function at 0x432ecf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4384b2
call fcn.0041ce4c
mov ebx, dword [ebp + 8]
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x432ef8
cmp dword [0x46ec58], edi
je 0x432fe2
push 2
pop ebx
jmp 0x432f12
cmp edi, 1
jne 0x432fe2
mov eax, ebx
call fcn.00433dc0
test al, al
je 0x432fe2
xor ebx, ebx
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x1c], ebx
call fcn.00433de2
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
shr eax, 1
and eax, 0x10
or eax, ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 8]
jmp 0x432fc4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x432f59
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
call fcn.004335b9
test eax, eax
je 0x432ff6
push 0x1c049f
push 0
call fcn.00419dec
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x46cc90], 0
push ebx
mov ecx, 0x46ec68
call fcn.00432d4e
movzx eax, word [esi + 0xc]
and dword [ebp - 0x14], 0
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.004336d0
mov esi, eax
test esi, esi
je 0x432f45
mov ebx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00433e03
inc edi
cmp edi, 2
jl 0x432ee0
mov eax, esi
call fcn.0041cf24
ret 0x18
push ebx
mov ecx, 0x46ec68
call fcn.00432cb2
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x432fd6
movzx ecx, word [ebx + 0xc]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x20], eax
je 0x433031
cmp dword [ebp - 0x20], 3
jne 0x43302c
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x43302c
and cl, 0xf
cmp cl, 4
je 0x433031
push 2
pop esi
jmp 0x432fd6
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xd]
mov dword [eax], 1
call fcn.00433e03
xor eax, eax
jmp 0x432fee
Function at 0x4334ba
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x438523
call fcn.0041ce4c
mov esi, dword [ebp + 8]
cmp esi, dword [0x46ec5c]
jne 0x4334d8
xor al, al
jmp 0x4335b1
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x4334e9
xor ecx, ecx
cmp dword [0x46ec58], ecx
jmp 0x4334f4
mov eax, esi
call fcn.00433dc0
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x4334d1
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.00433de2
mov dword [ebp - 4], edi
movzx edi, bl
neg edi
sbb edi, edi
and edi, 2
xor ebx, ebx
jmp 0x433572
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x433528
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
call fcn.004335b9
test eax, eax
je 0x433597
push 0x1c04c2
xor ebx, ebx
push ebx
call fcn.00419dec
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp + 8]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x46ec68
mov dword [eax + 0x46cc90], ebx
call fcn.00432d4e
mov dword [ebp + 8], ebx
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
push ebx
or eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.004336d0
mov ebx, eax
test ebx, ebx
je 0x43351c
jmp 0x4335a4
push dword [ebp + 8]
mov ecx, 0x46ec68
call fcn.00432cb2
lea ecx, [ebp + 0xf]
call fcn.00433e03
test ebx, ebx
sete al
call fcn.0041cf24
ret 8

Function at 0x433d14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], eax
test ecx, ecx
jne 0x433d26
mov ecx, dword [edi]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
push 0xffff
push dword [ebp + 8]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp dword [ebp - 4], 2
mov esi, eax
jae 0x433d57
cmp dword [ebp + 0xc], 1
je 0x433d54
cmp dword [ebp + 0xc], 2
jne 0x433d57
push 2
pop esi
mov eax, esi
call fcn.004335b9
test eax, eax
je 0x433d7b
push 0x1c0491
push 0
call fcn.00419dec
push edi
mov ecx, 0x46ec68
call fcn.00432d4e
jmp 0x433db8
test esi, esi
jne 0x433dad
mov ecx, dword [ebp + 0xc]
cmp ecx, 2
je 0x433d8c
cmp ecx, 1
jne 0x433d9b
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebp + 0x10]
push eax
push ecx
call fcn.00433490
test eax, eax
jne 0x433dad
push 2
pop esi
push edi
mov ecx, 0x46ec68
call fcn.00432cb2
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x433e24
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x438579
call fcn.0041ce4c
mov esi, dword [ebp + 8]
cmp esi, dword [0x46ec5c]
jne 0x433e42
xor eax, eax
jmp 0x433fa7
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
or edi, 0xffffffff
test ebx, ebx
jne 0x433e65
cmp dword [0x46ec58], ebx
je 0x433f67
push 2
pop edi
jmp 0x433e7f
cmp ebx, 1
jne 0x433f67
mov eax, esi
call fcn.00433dc0
test al, al
je 0x433f67
xor edi, edi
and dword [ebp - 0x10], 0
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x20], edi
call fcn.00433de2
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
push eax
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, edi
jmp 0x433f2a
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x433eb3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 2
mov edi, eax
jae 0x433edf
cmp dword [ebp - 0x1c], 1
je 0x433edc
cmp dword [ebp - 0x1c], 2
jne 0x433edf
push 2
pop edi
mov eax, edi
call fcn.004335b9
test eax, eax
je 0x433f47
push 0x1c0496
xor edi, edi
push edi
call fcn.00419dec
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp - 0x10]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x46ec68
mov dword [eax + 0x46cc90], edi
call fcn.00432d4e
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call fcn.004336d0
mov edi, eax
test edi, edi
je 0x433ea7
jmp 0x433f58
push dword [ebp - 0x10]
mov ecx, 0x46ec68
call fcn.00432cb2
test edi, edi
je 0x433f73
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.00433e03
mov ecx, dword [ebp - 0x18]
inc ebx
cmp ebx, 2
jl 0x433e4d
jmp 0x433f82
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.00433e03
mov ecx, dword [ebp - 0x18]
test edi, edi
jne 0x433f9d
cmp dword [ebp - 0x1c], 2
je 0x433f95
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x433fa5
push ecx
call fcn.004326ab
jmp 0x433fa3
push esi
call fcn.0043214b
mov ecx, eax
mov eax, ecx
call fcn.0041cf24
ret 4
Function at 0x437b0a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x46b730]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x29c], eax
mov eax, dword [0x46d194]
push ebx
mov ebx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x437ce5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov dword [ebp - 0x2a0], edi
test edi, edi
je 0x437ce4
push esi
xor esi, esi
cmp dword [edi], esi
jne 0x437ce3
mov dword [edi], 1
cmp ebx, 0x7e
ja 0x437ce1
mov ebx, dword [edi + ebx*4 + 4]
mov dword [ebp - 0x2a4], ebx
test ebx, ebx
je 0x437ce1
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.0041b964
mov eax, dword [ebp + 0x14]
and eax, 3
add esp, 0xc
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x298], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push ebx
mov dword [ebp - 0x294], eax
call fcn.00437e0d
cmp eax, dword [ebx + 0x24]
jg 0x437c06
mov ecx, dword [ebx + 0x48]
cmp ecx, dword [ebx + 0x44]
jae 0x437c06
test byte [ebx + 4], 1
jne 0x437c06
test dword [ebx + 4], 0x400
jne 0x437c06
test byte [ebp + 0x14], 0x10
jne 0x437c06
cmp dword [0x46fbb0], esi
je 0x437c06
push esi
lea eax, [ebp - 0x28c]
push eax
push 0x20
push 1
call dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
movzx eax, ax
mov dword [ebp - 0x290], eax
jmp 0x437c08
mov eax, esi
mov edi, dword [ebp - 0x298]
mov esi, ebx
mov ebx, dword [ebp - 0x29c]
push ebx
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push edi
call fcn.00437f02
test byte [esi + 4], 2
jne 0x437c47
mov esi, dword [esi]
mov eax, dword [ebp - 0x290]
test esi, esi
jne 0x437c16
mov ebx, dword [ebp - 0x2a4]
test edi, edi
mov edi, dword [ebp - 0x2a0]
jne 0x437c8e
test byte [0x46d540], 2
je 0x437c8e
push dword [ebp - 0x29c]
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push dword [ebx + 8]
push dword [ebx + 0x38]
push dword [ebx + 0x34]
push 0x408318
push dword [0x46d54c]
push dword [0x46d548]
call fcn.00437cf4
mov esi, dword [ebx + 0xc]
cmp esi, 0xffffffff
je 0x437cdc
mov esi, dword [edi + esi*4 + 4]
test esi, esi
je 0x437cdc
mov edi, dword [ebp - 0x298]
mov ebx, dword [ebp - 0x290]
push 0
push ebx
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push edi
call fcn.00437f02
test byte [esi + 4], 2
jne 0x437cd6
mov esi, dword [esi]
test esi, esi
jne 0x437caa
mov edi, dword [ebp - 0x2a0]
and dword [edi], 0
jmp 0x437ce3
mov dword [edi], esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041b956
leave
ret 0x10
Function at 0x403910
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fe], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404670], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404604], eax
mov dword [0x4040f6], eax
mov dword [0x4045f0], 0x30
mov dword [0x4045f4], 2
jmp 0x403955
mov dword [0x4045f8], 0x402f69
mov dword [0x4045fc], 0
mov dword [0x404600], 0
mov dword [0x404618], 0x404564
mov dword [0x404610], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404608], eax
mov dword [0x40461c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40460c], eax
push 0x4045f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040f6]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push str.first
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404668], eax
push 5
push dword [0x404668]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404668]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404620]
jmp 0x403a29
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a1b
mov eax, dword [0x404628]
jmp 0x403a44
call 0x402a90
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7e31167c
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x705a47f9
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x3a5f262d
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0xe3d2823
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4155c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x320
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x31c], eax
push ebx
push 0x103
lea eax, [esp + 0x11c]
push eax
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x11c]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 4], eax
test eax, eax
je 0x415704
push esi
push eax
call fcn.00490ef9
add esp, 4
mov esi, eax
mov eax, dword [esp + 8]
push esi
push eax
push 0
lea ecx, [esp + 0x128]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jle 0x4156fa
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
lea eax, [esp + 0x24]
push str.StringFileInfo_04x_04xFileVersion
push eax
call fcn.00415400
add esp, 0x10
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
push esi
call sub.VERSION.dll_VerQueryValueW
mov ecx, dword [esp + 0xc]
push str.2000_XP_Vista
push ecx
lea edx, [esp + 0x24]
push str.Version__s_for_Windows__s
push edx
call fcn.00415400
mov ecx, dword [0x4ee914]
add esp, 0x10
test ecx, ecx
je 0x4156e6
push str.translation
call fcn.00476150
test al, al
je 0x4156e6
mov ecx, dword [0x4ee914]
lea eax, [esp + 0x10]
push eax
push 1
call fcn.00476210
test al, al
je 0x4156e6
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str._n_nTranslated_by
lea ecx, [esp + 0x24]
push ecx
call edi
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x24]
push eax
call edi
pop edi
mov edx, dword [ebx + 4]
lea ecx, [esp + 0x1c]
push ecx
push 0x488
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push esi
call fcn.0049119f
add esp, 4
pop esi
mov ecx, dword [esp + 0x320]
pop ebx
xor ecx, esp
call fcn.004911aa
add esp, 0x320
ret

Function at 0x415bd0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
call fcn.004911c0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x415c3a
mov eax, dword [esp + 4]
cmp eax, 5
jae 0x415c23
cmp eax, 4
jne 0x415c3a
cmp dword [esp + 8], 0x5a
jb 0x415c3a
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004911aa
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.004911aa
add esp, 0x118
ret