joyce8/EMBER2024-capa huggingface dataset:
Function at 0x521bb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c378
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00521ce0
add esp, 4
mov esi, dword [ebp - 0x18]
mov dword [ebp - 4], 0
test esi, esi
je 0x521c84
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
or eax, 0xffffffff
dec esi
cmp esi, eax
cmovb eax, esi
cmp word [ecx + eax*2], 0x5c
lea eax, [ecx + eax*2]
je 0x521c23
cmp eax, ecx
je 0x521c7f
sub eax, 2
cmp word [eax], 0x5c
jne 0x521c16
sub eax, ecx
sar eax, 1
cmp eax, esi
je 0x521c4a
push 0xffffffffffffffff
push 0x2f
lea ecx, [ebp - 0x28]
call fcn.00521ea0
cmp eax, esi
je 0x521c4a
push 1
push 0x5ad728
lea ecx, [ebp - 0x28]
call fcn.0043eb30
push 0x14
push 0x5b8b90
lea ecx, [ebp - 0x28]
call fcn.0043eb30
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push str.IEProxySwitch
push str.Support
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x521c84
mov bl, 1
jmp 0x521c86
or eax, 0xffffffff
jmp 0x521c27
xor bl, bl
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x521cbc
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x521cb2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x521cd9
push edx
push ecx
call fcn.00546044
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
call fcn.00555394
int3

Function at 0x521dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0x208
push 0
mov dword [ebp - 0x214], esi
push eax
mov dword [ebp - 0x210], 0
call fcn.0054b380
add esp, 0xc
test edi, edi
jne 0x521e10
push 0x5ac698
jmp 0x521e7d
lea eax, [ebp - 0x210]
push eax
cmp ebx, 0x80000002
jne 0x521e2a
push 0x20219
push 0
push edi
push ebx
jmp 0x521e33
push 0x20019
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x521e76
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x103
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.InstallRoot
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.0043e5b0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
Function at 0x521f40
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a5d89
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x62819c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00517660
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
call fcn.00517660
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00517660
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
call fcn.00517660
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 3
call fcn.00517660
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.00517660
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 5
call fcn.00517660
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 6
call fcn.00517660
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 7
call fcn.00517660
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 8
call fcn.00517660
lea ecx, [esi + 0xf0]
mov byte [ebp - 4], 9
call fcn.00517660
lea ecx, [esi + 0x108]
mov byte [ebp - 4], 0xa
call fcn.00517660
lea ecx, [esi + 0x120]
mov byte [ebp - 4], 0xb
call fcn.00517660
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 0xc
call fcn.00517660
lea ecx, [esi + 0x150]
mov byte [ebp - 4], 0xd
call fcn.00517660
lea ecx, [esi + 0x168]
mov byte [ebp - 4], 0xe
call fcn.00517660
lea ecx, [esi + 0x180]
mov byte [ebp - 4], 0xf
call fcn.00517660
lea ecx, [esi + 0x198]
mov byte [ebp - 4], 0x10
call fcn.00517660
mov dword [esi + 0x1b0], 0
mov eax, esi
mov dword [esi + 0x1b4], 0
mov dword [esi + 0x1b8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x52b570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6da8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x62819c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x6336f4]
xor bl, bl
mov dword [ebp - 0x24], esi
test esi, esi
je 0x52b5b0
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x6336f8], 0
mov dword [ebp - 4], 0
jne 0x52b75f
cmp dword [0x6336f0], 0
je 0x52b75f
cmp dword [0x6336d8], 0
je 0x52b75f
cmp dword [0x6336ec], 0
je 0x52b75f
cmp dword [0x6336a4], 0
je 0x52b75f
cmp dword [0x6336a0], 0
je 0x52b75f
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push 0
push str.SOFTWAREPdfRegUnHook
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x52b62d
xor bl, bl
jmp 0x52b75f
call fcn.0052ded0
call fcn.00530430
call fcn.005315e0
call fcn.0052f710
call fcn.0052c430
push 0x52b930
push 0x6336f0
call fcn.00532d60
mov ebx, eax
push 0x52b780
push 0x6336d8
mov dword [ebp - 0x20], ebx
call fcn.00532d60
xor edi, edi
mov dword [ebp - 0x10], eax
add esp, 0x10
cmp dword [0x63365c], edi
je 0x52b68d
push 0x52ba70
push 0x63365c
call fcn.00532d60
add esp, 8
mov edi, eax
cmp dword [0x63369c], 0
mov dword [ebp - 0x14], 0
je 0x52b6b2
push 0x52bbc0
push 0x63369c
call fcn.00532d60
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [0x6336a0], 0
mov dword [ebp - 0x18], 0
je 0x52b6d7
push 0x52bf20
push 0x6336a0
call fcn.00532d60
add esp, 8
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x52b6f9
cmp dword [ebp - 0x10], 0
je 0x52b6f9
cmp dword [0x63365c], 0
je 0x52b6ee
test edi, edi
je 0x52b6f9
mov byte [0x6336f8], 1
mov bl, 1
jmp 0x52b75f
xor bl, bl
mov byte [0x6336f8], 0
cmp dword [ebp - 0x20], 0
je 0x52b715
push 0x6336f0
call fcn.005331d0
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x52b728
push 0x6336d8
call fcn.005331d0
add esp, 4
test edi, edi
je 0x52b739
push 0x63365c
call fcn.005331d0
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x52b74c
push 0x63369c
call fcn.005331d0
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x52b75f
push 0x6336a0
call fcn.005331d0
add esp, 4
test esi, esi
je 0x52b76a
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5331d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
cmp dword [0x633708], ebx
jne 0x5331f7
push 0x63370c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x633708], 1
push 0x63370c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x633724]
test esi, esi
je 0x53332e
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
lea eax, [esi + 0x30]
cmp eax, ecx
je 0x533237
mov esi, dword [esi]
test esi, esi
jne 0x533216
pop edi
push 0x63370c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x53332d
push dword [esi + 8]
push dword [esi + 4]
call fcn.00533420
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push dword [esi + 8]
mov dword [ebp - 4], ebx
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x533328
mov eax, dword [esi + 8]
xor ecx, ecx
mov edx, dword [esi + 4]
test eax, eax
je 0x533292
mov al, byte [esi + ecx + 0x50]
mov byte [ecx + edx], al
inc ecx
mov eax, dword [esi + 8]
cmp ecx, eax
jb 0x533280
mov edx, dword [esi + 4]
mov ebx, dword [ebp - 0xc]
push eax
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [esi + 8]
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [esi + 4]
xor ebx, ebx
mov dword [edi], eax
mov edi, dword [0x633724]
mov dword [ebp - 0xc], 1
test edi, edi
je 0x533323
lea ebx, [ebx]
cmp edi, esi
je 0x5332e1
mov ebx, edi
mov edi, dword [edi]
test edi, edi
jne 0x5332d0
mov ebx, dword [ebp - 0xc]
jmp 0x533328
test ebx, ebx
jne 0x5332f7
mov eax, dword [edi]
dec dword [0x633728]
mov ebx, dword [ebp - 0xc]
mov dword [0x633724], eax
jmp 0x533328
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x70
push ebx
call esi
mov eax, dword [edi]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x70
push ebx
call esi
dec dword [0x633728]
mov ebx, dword [ebp - 0xc]
jmp 0x533328
mov ebx, 1
call fcn.00533350
pop edi
push 0x63370c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x533350
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x633730], esi
jbe 0x5333a6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x63372c]
push dword [eax + esi*4]
call ebx
mov eax, dword [0x63372c]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x633730]
jb 0x533384
pop ebx
push dword [0x63372c]
call fcn.00554cf4
add esp, 4
mov dword [0x63372c], 0
mov dword [0x633730], 0
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x533660
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x633724]
xor ebx, ebx
test esi, esi
je 0x5336d4
mov ecx, dword [ebp + 8]
cmp esi, ecx
je 0x533687
mov ebx, esi
mov esi, dword [esi]
test esi, esi
jne 0x533675
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x533694
mov eax, dword [esi]
mov dword [0x633724], eax
jmp 0x5336ba
lea eax, [ebp - 4]
push eax
push 0x40
push 0x70
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi]
mov dword [ebx], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x70
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
je 0x5336ce
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
dec dword [0x633728]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5450e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00546790
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x1008]
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push edx
push 0x20219
push 0
push eax
push ecx
mov dword [ebp - 0x1008], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5451d3
push 0x1000
push eax
mov dword [ebp - 0x100c], eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0054b380
add esp, 0xc
mov dword [ebp - 0x1010], 0x1000
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0
push esi
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x1008]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x545191
cmp dword [ebp - 0x100c], 1
jne 0x5451d3
lea edx, [ebp - 0x1004]
lea esi, [edx + 2]
lea ebx, [ebx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x5451a0
sub edx, esi
lea eax, [ebp - 0x1004]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.0042daa0
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
Function at 0x5453d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc0], ebx
push esi
test ecx, ecx
jne 0x545409
mov ecx, edx
lea esi, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x545400
sub ecx, esi
push edi
push ecx
push edx
lea ecx, [ebp - 0xbc]
mov byte [ebp - 0x54], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xbc], 0x67452301
mov dword [ebp - 0xb8], 0xefcdab89
mov dword [ebp - 0xb4], 0x98badcfe
mov dword [ebp - 0xb0], 0x10325476
call fcn.00545b40
cmp byte [ebp - 0x54], 0
jne 0x545589
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xc]
mov edi, dword [ebp - 0xac]
lea esi, [ebp - 0xac]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xa8]
mov byte [ebp - 0x54], 1
mov dword [ebp - 0xc0], eax
mov ecx, dword [esi]
lea esi, [esi + 4]
mov byte [edx], cl
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [edx + 2], al
lea eax, [ebp - 4]
mov byte [edx + 3], cl
add edx, 4
cmp edx, eax
jb 0x5454b0
mov edx, edi
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0xbc]
push eax
push 0x5cde38
call fcn.00545b40
push 8
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0xbc]
call fcn.00545b40
lea edx, [ebp - 0x64]
lea esi, [ebp - 0xbc]
mov edi, edi
mov ecx, dword [esi]
lea esi, [esi + 4]
mov byte [edx], cl
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [edx + 2], al
lea eax, [ebp - 0x54]
mov byte [edx + 3], cl
add edx, 4
cmp edx, eax
jb 0x545520
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], eax
push 0x42
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.0054b380
add esp, 0xc
lea edi, [ebp - 0x50]
xor esi, esi
mov edi, edi
movzx eax, byte [ebp + esi - 0x64]
push eax
push str._02x
push 3
push 3
push edi
call fcn.005154c0
inc esi
add esp, 0x14
add edi, 4
cmp esi, 0x10
jl 0x5455a0
xor eax, eax
mov dword [ebx + 0x10], 0
lea ecx, [ebp - 0x50]
mov dword [ebx + 0x14], 7
mov word [ebx], ax
lea edx, [ecx + 2]
pop edi
jmp 0x5455e0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5455e0
sub ecx, edx
lea eax, [ebp - 0x50]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.0042daa0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
Function at 0x56f8b7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056f568

Function at 0x56f8c2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056f6f2

Function at 0x57124c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005711ce

Function at 0x5796ea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x592290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.0054b380
add esp, 0xc
mov dword [ebp - 0x210], 0x208
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.InfoHD
push str.SoftwareKingsoftOffice6.0Common
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
test eax, eax
je 0x59231a
xor eax, eax
mov word [esi], ax
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, esi
mov word [esi], ax
mov eax, dword [ebp - 0x210]
shr eax, 1
dec eax
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042daa0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
Function at 0x40519b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ab2a8]
jne 0x4051a5
repz ret
jmp fcn.0040b4a7

Function at 0x40bf1a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407c7c
and dword [ebp - 4], 0
cmp dword [0x4b5a04], 0
mov ebx, eax
jne 0x40bfcb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c07c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40c07c
push eax
call fcn.00407c0a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4b5a04], eax
call esi
push eax
call fcn.00407c0a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4b5a08], eax
call esi
push eax
call fcn.00407c0a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b5a0c], eax
call esi
push eax
call fcn.00407c0a
pop ecx
mov dword [0x4b5a14], eax
test eax, eax
je 0x40bfcb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407c0a
pop ecx
mov dword [0x4b5a10], eax
mov eax, dword [0x4b5a10]
cmp eax, ebx
je 0x40c023
cmp dword [0x4b5a14], ebx
je 0x40c023
push eax
call fcn.00407c85
push dword [0x4b5a14]
mov esi, eax
call fcn.00407c85
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c023
test edi, edi
je 0x40c023
call esi
test eax, eax
je 0x40c01a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c01a
test byte [ebp - 0xc], 1
jne 0x40c023
or dword [ebp + 0x10], 0x200000
jmp 0x40c05c
mov eax, dword [0x4b5a08]
cmp eax, ebx
je 0x40c05c
push eax
call fcn.00407c85
pop ecx
test eax, eax
je 0x40c05c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c05c
mov eax, dword [0x4b5a0c]
cmp eax, ebx
je 0x40c05c
push eax
call fcn.00407c85
pop ecx
test eax, eax
je 0x40c05c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b5a04]
call fcn.00407c85
pop ecx
test eax, eax
je 0x40c07c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c07e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x406243
pop dword [ebp - 0x38]
mov eax, 0x2d618e02
add eax, 0xd2ded441
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x5dead539
add dword [ebp - 0x48], 0xf0677012
mov dword [ebp - 0x44], 0xd69aca5c
add dword [ebp - 0x44], 0x5b9881e9
mov dword [ebp - 0x40], 0xf384e0e1
add dword [ebp - 0x40], 0x58c7634d
mov dword [ebp - 0x3c], 0xd5ceffb5
sub dword [ebp - 0x3c], 0xd5ceffb5
lea eax, [ebp - 0x48]
push eax
mov eax, 0x7e8ab6ab
sub eax, 0x7e4a35a7
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xa6ad3c02
add dword [ebp - 0x48], 0xcdc52d54
mov dword [ebp - 0x44], 0xb9296d30
add dword [ebp - 0x44], 0x8842f445
mov dword [ebp - 0x40], 0x627b7be
add dword [ebp - 0x40], 0x5d47b4ae
mov dword [ebp - 0x3c], 0xad50bd27
sub dword [ebp - 0x3c], 0xad50bd27
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x35cff
push 0
call eax
mov ecx, 0xa70be867
add ecx, 0x58f45ac1
mov edx, eax
mov ebx, 0x18160b66
sub ebx, 0x17cf2766
add ebx, dword [ebp - 0x38]
mov edi, 0x31ca5412
sub dword [ebp - 0x30], eax
mov esi, dword [ebx]
xor dword [ebp - 0x30], 0xd01b962c
xor esi, edi
add dword [ebp - 8], 0x497d230f
mov dword [edx], esi
add dword [ebp - 0x24], 0x7afd3b2a
add edx, 4
add ebx, 4
loop 0x40635a
add eax, 0xb0afd96d
add eax, 0x4f512606
mov ebx, eax
add eax, 0x1a5ed54e
sub eax, 0x1a5ed549
mov ecx, 0x1b652fa2
add ecx, 0xe4dad05e
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x402d28
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xf97008], 0x8088405
inc edx
mov dword [ebx + 0xf97008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x42ec60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42ec8d
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x42ec7e
and ecx, 3
je 0x42eca5
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x42ec92
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x42ecb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x42ece9
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x42ecd1
pop esi
and esi, 3
je 0x42ed0e
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x42ecef
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x42ed18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42ed44
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x42ed35
and ecx, 3
je 0x42ed5c
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x42ed49
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x42ed64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x42ed70
pop edi
pop ebx
ret