joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000248f
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
mov esi, eax
push edi
lea ebx, [esi + 0x94]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esi + 0xb4]
and dword [ebp - 4], 0
test edi, edi
je 0x100024e4
lea eax, [edi + 2]
push eax
call fcn.100046d4
mov dword [ebp - 4], eax
lea eax, [edi + 2]
push eax
push 0
push dword [ebp - 4]
call fcn.10008ac0
push edi
push dword [esi + 0xb0]
push dword [ebp - 4]
call fcn.10009290
add esp, 0x1c
and dword [esi + 0xb4], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x10002556
mov esi, dword [ebp + 8]
add esi, 0x68
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10002511
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0x20
push 4
push ebx
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000254d
push ebx
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp - 4]
mov dword [ebp + 8], ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 1
push dword [ebp - 4]
call fcn.10004cc0
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100043f7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10015024]
jne 0x10004401
repz ret
jmp fcn.100051fc
Function at 0x1000c5a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10008bac
and dword [ebp - 4], 0
cmp dword [0x10016c10], 0
mov ebx, eax
jne 0x1000c654
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000c705
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000c705
push eax
call fcn.10008b3a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10016c10], eax
call esi
push eax
call fcn.10008b3a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10016c14], eax
call esi
push eax
call fcn.10008b3a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10016c18], eax
call esi
push eax
call fcn.10008b3a
pop ecx
mov dword [0x10016c20], eax
test eax, eax
je 0x1000c654
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10008b3a
pop ecx
mov dword [0x10016c1c], eax
mov eax, dword [0x10016c1c]
cmp eax, ebx
je 0x1000c6ac
cmp dword [0x10016c20], ebx
je 0x1000c6ac
push eax
call fcn.10008bb5
push dword [0x10016c20]
mov esi, eax
call fcn.10008bb5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000c6ac
test edi, edi
je 0x1000c6ac
call esi
test eax, eax
je 0x1000c6a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000c6a3
test byte [ebp - 0xc], 1
jne 0x1000c6ac
or dword [ebp + 0x10], 0x200000
jmp 0x1000c6e5
mov eax, dword [0x10016c14]
cmp eax, ebx
je 0x1000c6e5
push eax
call fcn.10008bb5
pop ecx
test eax, eax
je 0x1000c6e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000c6e5
mov eax, dword [0x10016c18]
cmp eax, ebx
je 0x1000c6e5
push eax
call fcn.10008bb5
pop ecx
test eax, eax
je 0x1000c6e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10016c10]
call fcn.10008bb5
pop ecx
test eax, eax
je 0x1000c705
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000c707
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ae2b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
add dword [edx + 0x9f25d1], 0x1a10558b
push esi
mov ecx, 0xdbfc57c0
xor edi, edi
xor esi, esi
cmp byte [esi], bl
xor byte [eax + eax - 0xb6d7700], bh
loope 0x40ae92
clc
je 0x40b3d7
jmp 0x40ae69
mov cl, byte [edx + eax + 0x730]
test byte [ecx - 0x437f188b], bl
add dh, byte [eax]
jmp 0x40ae7a
add byte [eax + 0xf], dh
test byte [esi], cl
add eax, 0x453b0000
hlt
inc ebp
invalid
lea eax, [esi + 1]
sbb al, bl
jge 0x40b3f2
fild dword [ecx]
lea eax, [esi + 0x201]
push eax
push edi
call fcn.004098aa
add esp, 0x6f
mov ecx, esp
je 0x40b3f8
xchg edi, eax
shr byte [0x5b5e5f72], cl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x429cc6
Capabilities:
Encode data using xor

Disassembly:
mov bl, byte [eax]
push ds
adc al, 1
mov byte [ecx + eax], bl
mov byte [ecx], ah
jno 0x429d20
jne fcn.00429cc6
mov ebp, dword [edx + 0x24]
adc byte [ebx + 0x5614c874], cl
push edi
pop es
mov ebx, 0x12824
add byte [ebx - 0x3f7af7ca], al
jle 0x429d0a
cmp ecx, dword [edi - 0x75]
invalid
popfd
je 0x429d46
adc al, 0x8b
invalid
cmp eax, dword [esi + esi*2 + 0x1c]
add ebx, ebp
cmp ebx, edi
adc byte [esi], dl
in eax, dx
push ebx
invalid
add dword [eax], eax
add byte [ebx - 0x3f7af73c], al
jle 0x429d14
cmp edi, ebx
ja 0x429d50
mov esi, dword [ebp - 0x75]
inc esp
and al, 0x14
add ebx, ebp
cmp ebx, eax
ja 0x429d63
ljmp 0x128:0x2494ff53
test dword [eax + 0x7e], edi
out 0x8d, al
wait
add byte [eax], al
add byte [eax], al
xor ebp, 0x1076173b
push edi
cmp edi, 0xf9282494
add ch, bh
mov ebp, 0xbb8508c4
jg 0x429d50
mov ebx, 0xde3bea7f
cmp ebx, esi
ja 0x429dac
mov eax, esi
je 0x429d9d
mov ecx, dword [esp + 0x96011c]
mov ebp, ebx
sub ebp, esi
add dword [esi + 0x2beb8b00], edx
out dx, al
mov dword [ebp - 0x3c], edi
sbb al, 0x8d
dec ecx
add byte [edx - 0x3b75d715], cl
ficom word [eax + ebp]
mov ch, bl
sub byte [edx + 0x2814dec4], cl
mov byte [eax], cl
mov ecx, dword [esp - 0x4b]
inc eax
dec ecx
mov dword [edi], ecx
and al, 0x1c
jne 0x429d80
mov ebp, dword [esp + 0x11c]
cmp edi, esi
jne 0x429d10
mov edi, ebx
int3
add esi, ebp
cmp edi, esi
jae 0x429dd0
sub eax, esp
cmp esi, edi
jbe 0x429dd0
push edi
salc
call dword [esp + 0x138]
add dword [eax + ecx], 0xffffff85
shr byte [ebx], 0xea
cmp edi, esi
jb 0x429e23
lea esp, [esp - 0x43]
mov eax, dword [ebx + esi*8 + 0x10]
sub edi, dword [ebx + edi - 0x10]
jbe 0x429d88
push edi
push esi
jb 0x429d72
and al, 0x28
add dword [eax], eax
add byte [ebx - 0x3f7af73c], al
je 0x429dd0
mov eax, dword [ebp + edi*4 + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, edx
mov edi, esi
sub ecx, ebx
sub edi, eax
cmp edi, dword [ecx + 0x5c]
sub eax, 0x14736256
mov ecx, dword [esp + 0x18]
popal
inc esp
mov word [eax], fs
xor byte [esp + ecx*4 + 0xba0098], 0x41
mov dword [esp + 0xfdac835], esp
sub dword [ecx], 0xfffffffe
invalid
pop esp
and al, 0xfd
mov ch, 0xfa
std
invalid
Function at 0x42a522
Capabilities:
Encode data using xor

Disassembly:
in al, dx
mov ecx, dword [eax]
mov ebx, dword [ebx + 0x50dc7889]
push ecx
call fcn.0042fc3f
movsd dword es:[edi], dword [esi]
pop ecx
adc eax, 0x25e8658b
jge 0x42a4f9
cmp dword [ebp - 0x1c], 0
jne 0x42a50e
push edi
call fcn.0042a199
salc
cmpsb byte [esi], byte es:[edi]
cld
invalid
push esi
dec ecx
je 0x42a54a
or byte [ebx - 0x7c6953ba], cl
je 0x42a5fb
test al, 0xea
jne 0x6642fbfb
test al, 0x79
pushal
or eax, dword [ebx + 0x5b892093]
or al, 0xe9
mov dl, 0
add byte [edx + 0x1c01c883], bl
test eax, 0x4689460c
or al, 0x75
xchg ebp, eax
enter 0x1c01, 0xffffffffffffffa9
or al, 0x46
mov dword [esi + 0xc], eax
jne 0x42a4ea
inc esi
or al, 0x97
dec esp
add byte [eax], al
pop ecx
jmp 0x42a563
push dword [esi - 0xc]
push dword [esi + 8]
push dword [esi + 0x10]
call fcn.0042f004
add esp, 0xc
test eax, eax
mov dword [esi + 4], eax
je 0x42a5ea
xbegin 0x8bad1a6d
push esi
or al, 0xf6
not dword [ecx + 0x75]
aaa
mov ecx, dword [ecx - 0x67cf0]
push edi
je 0x42a5a5
lodsb al, byte [esi]
stc
sar edi, 7
mov ecx, dword [ebx - 0x43]
loopne 0x42a523
inc esp
add byte [ebx + 0x3c8d1fe1], al
iretd
mov edi, 0x446290
mov cl, byte [edi + 4]
invalid
neg eax
sbb esi, dword [ecx - 0x7d]
loopne 0x42a601
invalid
add eax, 0x10
imul ebx, dword [edi + 0xc], 0x52ac54
xlatb
enter 0x5dff, 0xffffffffffffffc3

Function at 0x42cca3
Capabilities:
Authenticate hmac

Disassembly:
lds esi, [0x8dd544de]
or al, 0x80
mov eax, dword [0x3a4488a8]
outsb dx, byte [esi]
or al, 0x88
jmp 0x42cc9c
cmp eax, ecx
in eax, dx
ljmp 0xec8b
Function at 0x41f250
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x41f320
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [esi + 0x3fc]
mov edx, dword [edx + 0x324]
call sub.AIMP.Runtime.dll__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
push 1
mov ecx, 0x20
mov edx, 0x20
mov eax, dword [esi + 0x404]
call sub.AIMP.Runtime.dll__Acl_Gdiplus_TACLGdiplusImage_CloneAsBitmap_qqriio
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call sub.AIMP.Runtime.dll__Vcl_Graphics_TBitmap_SetHandle_qqrp9HBITMAP__
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x30]
mov eax, dword [esi + 0x3f0]
call sub.AIMP.Runtime.dll__Acl_Listview_TACLCustomListView_GetCount_qqrv
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x41f30a
inc ebx
mov dword [ebp - 8], 0
push 0
mov eax, dword [esi + 0x3f0]
mov eax, dword [eax + 0x2f4]
mov edx, dword [ebp - 8]
call sub.AIMP.Runtime.dll__Acl_Listview_TACLListViewCustomItems_GetItem_qqri
lea ecx, [ebp - 0xc]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
xor ecx, ecx
call sub.AIMP.Runtime.dll__Acl_Classes_TACLStringList_Add_qqrx20System_UnicodeStringxp14System_TObject44System__DelphiInterface_17S
inc dword [ebp - 8]
dec ebx
jne 0x41f2d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f327
lea eax, [ebp - 0xc]
call sub.AIMP.Runtime.dll__System__UStrClr_qqrpv
ret
Function at 0x4ba7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x4ba805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x4ba878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4ba83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x4ba86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x4ba86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x4ba831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4ba7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x100370ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x100370c9
pop dword [ebp - 0x3c]
mov eax, 0xff1d20e9
add eax, 0x10e64fe0
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x8196b56f
add dword [ebp - 0x4c], 0xccbb8fdc
mov dword [ebp - 0x48], 0x4a07d476
sub dword [ebp - 0x48], 0x17d48831
mov dword [ebp - 0x44], 0x5e9991bb
sub dword [ebp - 0x44], 0x124d4d8d
mov dword [ebp - 0x40], 0xa3c35aac
add dword [ebp - 0x40], 0x5c3ca554
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x45b5a3da
add eax, 0xca501d32
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x57d50ec
add dword [ebp - 0x4c], 0x6ef5186a
mov dword [ebp - 0x48], 0xe796986a
add dword [ebp - 0x48], 0x59d5c90b
mov dword [ebp - 0x44], 0xc927cd31
add dword [ebp - 0x44], 0x9a479f3b
mov dword [ebp - 0x40], 0x92ab5f2f
sub dword [ebp - 0x40], 0x92ab5f2f
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x63e7a9fa
add eax, 0xac1e1646
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x5af22
push 0
call eax
mov ecx, 0x4cb121d8
sub ecx, 0x4cb0d5a4
xor ebx, ebx
add ebx, eax
mov esi, 0xc6872bf9
add esi, 0x497f9e07
add esi, dword [ebp - 0x3c]
mov edx, 0x1d257665
add edx, 0x35662f1f
xor dword [ebp - 0x28], 0x101baa38
mov edi, dword [esi]
mov dword [ebp - 0x28], 0x2374d790
add edi, edx
add dword [ebp - 0x20], 0xb446f9ca
mov dword [ebx], edi
add dword [ebp - 0x28], ebx
add ebx, 0x8fe2f120
add ebx, 0x701d0ee4
add esi, 0xbd6af122
add esi, 0x42950ee2
loop 0x100371ed
add eax, 0x123a3
xor ebx, ebx
add ebx, eax
add eax, 0x601da0c4
add eax, 0x9fe25f41
mov ecx, 0xd081bb4b
sub ecx, 0xc081bb4b
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x41f0e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp + 8], 0x200
jnp 0x41f0fe
xchg eax, eax
jmp 0x41f104
nop
xchg edx, edx
jnp 0x41f0fa
or byte [ebp + 0x4d8df445], 8
lea eax, [ebp - 0xc]
lea ecx, [ebp + 8]
push eax
push 0
push 0
push 0
lea edx, [ebp - 0x310]
push ecx
push edx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
jnp 0x41f129
xchg edi, edi
jmp 0x41f12f
nop
xchg ebp, ebp
jnp 0x41f125
sub dword [ebx + 4], edi
jnp 0x41f135
xchg edi, edi
jmp 0x41f13b
nop
xchg edx, edx
jnp 0x41f131
adc byte [ebx + 4], bh
jnp 0x41f141
xchg edi, edi
jmp 0x41f147
nop
xchg edx, edx
jnp 0x41f13d
add dword [ebp - 0x3e7af00a], 0x8d000000
inc ebp
cld
test esi, esi
jne 0x41f210
lea eax, [ebp - 4]
lea ecx, [ebp - 0x110]
push eax
lea edx, [ebp - 0x310]
push ecx
push edx
push edi
mov dword [ebp - 4], 0x104
call fcn.0041f2c0
add esp, 0x10
mov esi, eax
jnp 0x41f179
xchg esi, esi
jmp 0x41f17f
nop
xchg ebx, ebx
jnp 0x41f175
sar dword [ebx + 4], 1
jnp 0x41f185
xchg ecx, ecx
jmp 0x41f18b
nop
xchg ebp, ebp
jnp 0x41f181
mov byte [0x2b75f685], al
test esi, esi
jne 0x41f1ba
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x110], 0
jnp 0x41f1a0
xchg ebp, ebp
jmp 0x41f1a6
nop
xchg ebp, ebp
jnp 0x41f19c
test byte [ebp - 0x10f73], cl
call dword [ecx - 0x18]
outsb dx, byte [esi]
add byte [eax], al
add byte [ebx - 0x7a99fb3c], al
sal byte [ebp + 0x1e], 0x43
lea ecx, [ebp - 0x110]
push ecx
call 0x41f220
add esp, 4
test ax, ax
jne 0x41f1d8
inc ebx
jnp 0x41f1c1
xchg edi, edi
jmp 0x41f1c7
nop
xchg esi, esi
jnp 0x41f1bd
and byte [ebx + 4], bh
jnp 0x41f1cd
xchg esi, esi
jmp 0x41f1d3
nop
xchg ecx, ecx
jnp 0x41f1c9
mov ecx, gs
sbb edi, edi
invalid
jmp 0x41f0f1
jnp 0x41f1de
xchg edx, edx
jmp 0x41f1e4
nop
xchg ebp, ebp
jnp 0x41f1da
cmp byte [ebx + 4], 0x87
fucomi st(3)
push es
jnp 0x41f1ea
xchg ebx, ebx
jmp 0x41f1f0
nop
xchg ebx, ebx
jnp 0x41f1e6
fnstsw word [ebx + 4]
jnp 0x41f1f6
xchg edx, edx
jmp 0x41f1fc
nop
xchg ebx, ebx
jnp 0x41f1f2
adc cl, byte [ebx - 0x3899f3ab]
add al, byte [ecx]
add byte [ebx + 4], bh
mov edx, dword [ebp + 0xc]
mov word [edx], 1
jnp 0x41f20a
xchg edx, edx
jmp 0x41f210
nop
xchg edi, edi
jnp 0x41f206
lea ecx, [ebx + 0x5b5e5fc6]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f2c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push edi
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
jnp 0x41f2e5
xchg ecx, ecx
jmp 0x41f2eb
nop
xchg edx, edx
jnp 0x41f2e1
sar byte [ebx + 4], 0x87
fucomi st(3)
push es
jnp 0x41f2f1
xchg ebx, ebx
jmp 0x41f2f7
nop
xchg ebx, ebx
jnp 0x41f2ed
sub byte [ebx + 4], bh
jnp 0x41f2fd
xchg esi, esi
jmp 0x41f303
nop
xchg ebx, ebx
jnp 0x41f2f9
adc al, byte [ebp + 0x567275ff]
test edi, edi
jne 0x41f379
push esi
jnp 0x41f30e
xchg eax, eax
jmp 0x41f314
nop
xchg esi, esi
jnp 0x41f30a
or byte [ebx + 4], bh
jnp 0x41f31a
xchg esi, esi
jmp 0x41f320
nop
xchg ebp, ebp
jnp 0x41f316
xor eax, 0x4291c068
add al, ch
push es
sldt word [eax]
push 0x4291c0
call fcn.00420230
mov esi, eax
add esp, 4
test esi, esi
je 0x41f36e
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 8]
push ecx
push edx
push edi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
jnp 0x41f353
xchg ebp, ebp
jmp 0x41f359
nop
xchg ebx, ebx
jnp 0x41f34f
add dword [esi - 0x18], edx
loope 0x41f3b6
push esi
call fcn.00414d40
add esp, 4
jnp 0x41f368
invalid
xchg eax, eax
jmp 0x41f36e
nop
xchg edx, edx
jnp 0x41f364
and byte [ebx - 0xaef3b3], cl
adc eax, sym.imp.ADVAPI32.dll_RegCloseKey
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
jnp 0x41f37f
xchg ebx, ebx
jmp 0x41f385
nop
xchg ebp, ebp
jnp 0x41f37b
xor bh, byte [ebx + 4]
jnp 0x41f38b
xchg eax, eax
jmp 0x41f391
nop
xchg esi, esi
jnp 0x41f387
add edi, dword [ebx + 4]
jnp 0x41f397
xchg eax, eax
jmp 0x41f39d
nop
xchg ebp, ebp
jnp 0x41f393
bound ecx, qword [ebx - 0x3ca2a039]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edi
pop edi
pop ebp
ret
cmp byte [ecx], al
add byte [eax], al
Function at 0x298072e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29876b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807306
xor eax, eax
jmp 0x298073c1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807328
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807328
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298073c1
cmp dword [esi + 0x4c], 0
je 0x298073bf
call fcn.29806a7d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x29807352
push dword [esi + 0x4c]
push eax
call fcn.2983e081
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x298073bf
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x298073bf
cmp eax, 1
jle 0x2980738d
cmp eax, 3
jne 0x298073bf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x29807344
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x298073b1
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x298073bf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x298073c1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801cc0
leave
ret 4
Function at 0x29826d7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29854690
call fcn.2985114e
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x29826f9e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2983e081
add esp, 0x10
test eax, eax
js 0x29826f98
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29826e21
push edi
call fcn.29827ddd
pop ecx
test al, al
je 0x29826e21
mov eax, edi
call fcn.29851670
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x29826e33
push edi
lea ecx, [ebp - 0x424]
call fcn.2983e081
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2983e081
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x29826f98
push 0x60
push ebx
push eax
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29826e8b
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29826e8b
call fcn.29825061
mov ebx, eax
jmp 0x29826f67
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x29826eb2
call fcn.29825061
jmp 0x29826f5a
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x29826ea8
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x29826ee5
mov ebx, 0x8007000e
jmp 0x29826f5c
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2983e081
jmp 0x29826f0b
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x29826ede
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2983e081
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2983e081
mov ebx, eax
test edi, edi
je 0x29826f67
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29826f80
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826f90
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826f86
mov eax, ebx
jmp 0x29826fcc
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x29826fb3
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826fc3
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826fb9
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851106
ret 0x10
Function at 0x403eae
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x46106c]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 8]
and dword [esp + 4], 0
and dword [esp + 8], 0
push esi
push dword [ebp + 0xc]
mov esi, ecx
mov dword [esp + 0x14], 0x67452301
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], 0xefcdab89
push eax
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.00403d13
push esi
lea eax, [esp + 0xc]
push eax
call fcn.00403dc8
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0040f12e
mov esp, ebp
pop ebp
ret 8

Function at 0x403f89
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
mov esi, dword [0x46494c]
mov ebx, ecx
push edi
mov edi, dword [0x464950]
cmp esi, edi
je 0x403fb2
mov ecx, esi
call fcn.0040277c
add esi, 0x18
cmp esi, edi
jne 0x403f9e
mov esi, dword [0x46494c]
mov edi, dword [0x46495c]
mov dword [0x464950], esi
mov esi, dword [0x464958]
cmp esi, edi
je 0x403fdc
mov ecx, esi
call fcn.0040277c
add esi, 0x18
cmp esi, edi
jne 0x403fc8
mov esi, dword [0x464958]
mov dword [0x46495c], esi
mov eax, dword [ebx + 0x3c]
push 0x40
push 0x3000
mov edi, dword [eax + ebx + 0x50]
add edi, edi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40400f
mov ecx, 0x457bd4
call fcn.00403f1d
xor eax, eax
jmp 0x404061
push edi
push 0
push esi
call fcn.0042a960
add esp, 0xc
mov edx, esi
mov ecx, ebx
call fcn.00404065
test eax, eax
jne 0x40403b
mov ecx, str.MmMapFile
call fcn.00403f1d
mov ecx, esi
call fcn.004045bd
jmp 0x40400b
mov ecx, esi
call fcn.004040ca
test eax, eax
jne 0x40404d
mov ecx, str.DoRelocationTable
jmp 0x40402d
mov ecx, esi
call fcn.00404140
test eax, eax
jne 0x40405f
mov ecx, str.DoImportTable
jmp 0x404006
mov eax, esi
pop edi
pop esi
pop ebx
ret