joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7813480f
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
xor ebx, ebx
push ebx
push ebx
mov ebp, str.__MSVCRT_HEAP_SELECT
push ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x78134961
push esi
push ebx
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x7813495f
push esi
push ebx
push ebp
call edi
test eax, eax
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
jbe 0x78134953
cmp eax, esi
ja 0x78134953
cmp byte [ebx], 0
mov ecx, ebx
je 0x78134889
mov al, byte [ecx]
cmp al, 0x61
jl 0x78134883
cmp al, 0x7a
jg 0x78134883
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x78134875
push 0x16
push ebx
push str.__GLOBAL_HEAP_SELECTED
call fcn.781311b7
add esp, 0xc
test eax, eax
jne 0x781348a1
mov edi, ebx
jmp 0x781348fc
push 0x105
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x78134953
push 3
push esi
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
cmp byte [esi], 0
mov ecx, esi
je 0x781348e5
mov al, byte [ecx]
cmp al, 0x61
jl 0x781348df
cmp al, 0x7a
jg 0x781348df
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x781348d1
push esi
push ebx
call sym.MSVCR80.dll_strstr
pop ecx
pop ecx
push esi
push 0
mov edi, eax
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
test edi, edi
je 0x78134953
push 0x2c
push edi
call sym.MSVCR80.dll_strchr
test eax, eax
pop ecx
pop ecx
je 0x78134953
inc eax
cmp byte [eax], 0x20
je 0x7813490e
mov cl, byte [eax]
xor esi, esi
cmp cl, 0x30
jl 0x78134953
cmp cl, 0x39
jg 0x78134934
imul esi, esi, 0xa
movsx ecx, cl
inc eax
lea esi, [esi + ecx - 0x30]
mov cl, byte [eax]
cmp cl, 0x30
jge 0x7813491d
cmp esi, 2
je 0x78134943
cmp esi, 3
je 0x78134943
cmp esi, 1
jne 0x78134953
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov eax, esi
jmp 0x781349c1
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
call sym.MSVCR80.dll__get_osplatform
test eax, eax
pop ecx
je 0x7813497d
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
lea eax, [esp + 0x14]
push eax
call sym.MSVCR80.dll__get_winmajor
test eax, eax
pop ecx
je 0x78134999
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
cmp dword [esp + 0x10], 2
jne 0x781349ac
cmp dword [esp + 0x14], 5
jb 0x781349ac
xor eax, eax
inc eax
jmp 0x781349c1
lea eax, [esp + 0x18]
push eax
call fcn.781347e2
cmp byte [esp + 0x1c], 6
pop ecx
sbb eax, eax
add eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x78138894
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.MSVCR80.dll__invalid_parameter

Function at 0x78139847
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x781c19c8]
jne 0x78139851
repz ret
jmp sym.MSVCR80.dll___report_gsfailure
Function at 0x7815472c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154759
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.781311b7
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78154735
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154788
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x781547af
test al, 1
je 0x781547af
test byte [esp + 0xc], 2
je 0x781547af
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x7815477f
xor eax, eax
pop esi
ret

Function at 0x78154a51
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154a7e
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.781311b7
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154a9c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78154a79
test byte [esp + 0xc], 0x80
je 0x78154aa8
and eax, 0xfffffffe
jmp 0x78154aab
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
je 0x78154a8d
xor eax, eax
pop esi
ret

Function at 0x78155c9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155cca
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.781311b7
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78155ca6
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155cf9
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x78155d20
test al, 1
je 0x78155d20
test byte [esp + 0xc], 2
je 0x78155d20
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x78155cf0
xor eax, eax
pop esi
ret
Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.781311b7
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x4171b4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x4171b8]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call sym.__amsg_exit
jmp 0x4011d3
mov eax, dword [0x4171b8]
test eax, eax
jne 0x4011c9
mov dword [0x4171b8], 1
mov dword [esp + 4], 0x41b014
mov dword [esp], 0x41b00c
call sym.__initterm
jmp 0x4011d3
mov dword [0x41701c], 1
mov eax, dword [0x4171b8]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x41b008
mov dword [esp], section..CRT
call sym.__initterm
mov dword [0x4171b8], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x4171b4
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call sym.__pei386_runtime_relocator
mov dword [esp], sym.__gnu_exception_handler_4
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x417174], eax
mov dword [esp], sym.___mingw_invalidParameterHandler
call sym.__set_invalid_parameter_handler
call sym.__fpreset
mov eax, dword [0x417004]
mov dword [esp + 4], 0x417008
mov dword [esp], eax
call sym._duplicate_ppstrings
call sym.___main
mov eax, dword [0x40e048]
mov edx, dword [0x41700c]
mov dword [eax], edx
mov ecx, dword [0x41700c]
mov edx, dword [0x417008]
mov eax, dword [0x417004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.main
mov dword [0x417014], eax
mov eax, dword [0x417018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x417014]
mov dword [esp], eax
call sym._exit
mov eax, dword [0x41701c]
test eax, eax
jne 0x4012de
call sym.__cexit
mov eax, dword [0x417014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x41714c], 1
mov dword [0x417150], 1
mov dword [0x417154], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x406784
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x407358
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x407377
mov eax, 0
jmp 0x4073bb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40739a
mov eax, 0
jmp 0x4073bb
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x4073b6
mov eax, 0
jmp 0x4073bb
mov eax, 1
leave
ret
Function at 0x4073bd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40741c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x407414
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x407414
mov eax, dword [ebp - 4]
jmp 0x407430
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x4073f1
mov eax, 0
leave
ret
Function at 0x4107c5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f5ac]
jne 0x4107cf
repz ret
jmp fcn.00416fa7

Function at 0x421814
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00417127
and dword [ebp - 4], 0
cmp dword [0x431640], 0
mov ebx, eax
jne 0x4218c5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x421976
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x429d94
push edi
call esi
test eax, eax
je 0x421976
push eax
call fcn.004170b5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x431640], eax
call esi
push eax
call fcn.004170b5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x431644], eax
call esi
push eax
call fcn.004170b5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431648], eax
call esi
push eax
call fcn.004170b5
pop ecx
mov dword [0x431650], eax
test eax, eax
je 0x4218c5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004170b5
pop ecx
mov dword [0x43164c], eax
mov eax, dword [0x43164c]
cmp eax, ebx
je 0x42191d
cmp dword [0x431650], ebx
je 0x42191d
push eax
call fcn.00417130
push dword [0x431650]
mov esi, eax
call fcn.00417130
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42191d
test edi, edi
je 0x42191d
call esi
test eax, eax
je 0x421914
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x421914
test byte [ebp - 0xc], 1
jne 0x42191d
or dword [ebp + 0x10], 0x200000
jmp 0x421956
mov eax, dword [0x431644]
cmp eax, ebx
je 0x421956
push eax
call fcn.00417130
pop ecx
test eax, eax
je 0x421956
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x421956
mov eax, dword [0x431648]
cmp eax, ebx
je 0x421956
push eax
call fcn.00417130
pop ecx
test eax, eax
je 0x421956
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431640]
call fcn.00417130
pop ecx
test eax, eax
je 0x421976
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x421978
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406e95
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x406fdc
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x406f3b
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x406ee5
cmp ecx, 0x40010001
je 0x406ee5
cmp ecx, 0x40020001
je 0x406ee5
cmp ecx, 0x40030001
jne 0x406ef0
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x406f02
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x406f35
dec ecx
je 0x406f2f
dec ecx
je 0x406f29
dec ecx
je 0x406f23
dec ecx
je 0x406f1d
dec ecx
jne 0x406f48
or dword [ebp - 4], 0xe
jmp 0x406f48
or dword [ebp - 4], 0xc
jmp 0x406f48
or dword [ebp - 4], 0xa
jmp 0x406f48
or dword [ebp - 4], 8
jmp 0x406f48
or dword [ebp - 4], 6
jmp 0x406f48
or dword [ebp - 4], 2
jmp 0x406f48
cmp ecx, 0x40030000
jne 0x406f48
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x406f58
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x406f66
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x406f74
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x406f82
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x406f97
push 3
jmp 0x406fc2
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x406fc8
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x406fb4
xor edx, edx
inc edx
jmp 0x406fc3
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x406fd4
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x406f85
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x406fe9
mov eax, 0x8876086c
jmp 0x406ff3
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8

Function at 0x41040c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x641180
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x410464
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x410464
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x410464
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x41048d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x641180
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4104fb
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4104f2
cmp dword [ebp - 0xc], 4
jne 0x4104f2
cmp dword [ebp - 0x10], edi
je 0x4104f2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x6b545c], edi
xor eax, eax
jmp 0x410523
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x6b545c], edi
jge 0x41051e
mov dword [0x6b545c], edi
call fcn.00410468
test eax, eax
je 0x41051e
emms
mov dword [0x6b545c], 1
mov eax, dword [0x6b545c]
pop edi
leave
ret

Function at 0x410603
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x41063a
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x41065c
cmp dword [ebp - 0x20], 4
ja 0x410666
jne 0x410656
cmp dword [ebp - 0x1c], 0xa
jb 0x410656
cmp word [ebp - 0x18], 0x55d
jae 0x410666
mov byte [ebp + 0x73], 1
jmp 0x410666
cmp dword [ebp - 0x14], 2
jne 0x41067c
test bl, bl
je 0x410697
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x410687
dec eax
je 0x410680
sub eax, 3
jne 0x41067c
cmp byte [ebp + 0x73], 0
je 0x4106a8
xor eax, eax
jmp 0x4106b0
call fcn.00410526
jmp 0x4106b0
cmp byte [ebp + 0x73], 0
jne 0x41067c
call fcn.0041055e
and eax, 4
jmp 0x4106b0
cmp dword [ebp + 0x7c], 0xa
je 0x4106a8
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x4106b0
call fcn.0041055e
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x42dbb3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x42dbc1
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x42dc95
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x643798]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x643798]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x643798]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x643798]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x643798]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x643798]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x643798]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x643798]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x42dbde
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x42dcb5
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x643798]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x42dc9b
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x43ff20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 1
call dword [sym.imp.libG.pyc_ilGenImages]
push dword [ebp - 4]
call dword [sym.imp.libG.pyc_ilBindImage]
push 0x600
call dword [sym.imp.libG.pyc_ilEnable]
push 0x602
call dword [sym.imp.libG.pyc_ilOriginFunc]
mov edi, dword [ebp + 8]
push edi
push 0
call dword [sym.imp.libG.pyc_ilLoad]
test al, al
jne 0x43ff76
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
mov dword [eax], 2
xor al, al
mov esp, ebp
pop ebp
ret 8
push esi
mov esi, dword [sym.imp.libG.pyc_ilGetInteger]
push 0xde4
call esi
cmp eax, 0x40
je 0x43ff9d
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov dword [eax], 3
xor al, al
mov esp, ebp
pop ebp
ret 8
push 0xde5
call esi
cmp eax, 0x80
je 0x43ffbf
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov dword [eax], 4
xor al, al
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 4]
push eax
push 1
call dword [sym.imp.libG.pyc_ilDeleteImages]
call dword [sym.imp.libG.pyc_ilShutDown]
push 0x666ae4
push edi
call fcn.005cafeb
mov esi, eax
add esp, 8
test esi, esi
jne 0x43ffee
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 2
push 2
push 0
push esi
call fcn.005cb7a9
push esi
call fcn.005cbecd
push 0
push 0
push esi
mov dword [ebx + 0x394], eax
call fcn.005cb7a9
push dword [ebx + 0x394]
call fcn.00584f25
push esi
push 1
push dword [ebx + 0x394]
mov dword [ebx + 0x39c], eax
push eax
call fcn.005cc0d6
push esi
call fcn.005cb456
push edi
call fcn.004c8020
add esp, 0x38
mov dword [ebx + 0x398], eax
mov al, 1
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x447d20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp ecx, edx
mov eax, edx
cmovbe eax, ecx
cmovbe ecx, edx
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov dword [ebp - 4], ecx
xor eax, eax
nop dword [eax + eax]
movzx ecx, byte [edx]
inc edx
imul eax, eax, 0x1000193
xor eax, ecx
lea ecx, [ebp]
cmp edx, ecx
jb 0x447d40
mov esp, ebp
pop ebp
ret