joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4628dc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x462994
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00462874
test al, al
je 0x462976
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404e9c
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x462976
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405278
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00405278
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404f9c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x46292f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46299b
lea eax, [ebp - 0x2c]
call fcn.00404dac
lea eax, [ebp - 0xc]
call fcn.00404dac
ret

Function at 0x4629a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x462a5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00462874
test al, al
je 0x462a3e
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404e9c
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x462a3e
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405278
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00405278
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404f9c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4629f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462a63
lea eax, [ebp - 0x2c]
call fcn.00404dac
lea eax, [ebp - 0xc]
call fcn.00404dac
ret
Function at 0x462c60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0046243c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00405278
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x462cbe
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4fde74]
mov dl, 1
mov eax, dword [0x462334]
call fcn.0040f0ec
call fcn.004046c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x462cc8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405278
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x462d20
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4fe130]
mov dl, 1
mov eax, dword [0x462334]
call fcn.0040f0ec
call fcn.004046c4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0046246c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x463a14
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00408650
ret
Function at 0x463b3c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405268
xor eax, eax
push ebp
push 0x463ca6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.00463a14
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00405278
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x463c85
xor eax, eax
push ebp
push 0x463c7e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x463c67
xor eax, eax
push ebp
push 0x463c60
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x463c49
xor eax, eax
push ebp
push 0x463c42
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
sub ecx, ebx
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.00463a48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463c49
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463c67
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463c85
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.00463ac8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463cad
lea eax, [ebp - 4]
call fcn.00404dac
ret
Function at 0x464000
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], eax
mov esi, 0x4f7520
mov eax, dword [esp]
mov cl, byte [eax + 0x40]
mov edi, ecx
and edi, 0xff
mov eax, edi
add eax, 0x10
mov ebx, dword [esp]
mov byte [ebx + eax], dl
xor eax, eax
mov al, cl
mov ebx, dword [esp]
mov bl, byte [ebx + eax]
xor bl, dl
push ebx
add edi, 0x20
mov ebx, dword [esp + 4]
lea edi, [ebx + edi]
pop ebx
mov byte [edi], bl
mov ebx, dword [esp]
lea ebx, [ebx + eax + 0x30]
push ebx
mov ebx, dword [esp + 4]
xor dl, byte [ebx + 0x41]
and dl, 0xff
and edx, 0xff
mov dl, byte [esi + edx]
pop ebx
xor byte [ebx], dl
mov edx, dword [esp]
mov al, byte [edx + eax + 0x30]
mov edx, dword [esp]
mov byte [edx + 0x41], al
lea eax, [ecx + 1]
and al, 0xf
mov edx, dword [esp]
mov byte [edx + 0x40], al
mov ecx, eax
test cl, cl
jne 0x4640ea
xor eax, eax
mov byte [esp + 4], 0
mov edx, dword [esp]
mov cl, 8
and eax, 0xff
mov al, byte [esi + eax]
xor byte [edx], al
mov al, byte [edx]
inc edx
and eax, 0xff
mov al, byte [esi + eax]
xor byte [edx], al
mov al, byte [edx]
inc edx
and eax, 0xff
mov al, byte [esi + eax]
xor byte [edx], al
mov al, byte [edx]
inc edx
and eax, 0xff
mov al, byte [esi + eax]
xor byte [edx], al
mov al, byte [edx]
inc edx
and eax, 0xff
mov al, byte [esi + eax]
xor byte [edx], al
mov al, byte [edx]
inc edx
and eax, 0xff
mov al, byte [esi + eax]
xor byte [edx], al
mov al, byte [edx]
inc edx
dec cl
jne 0x464089
add al, byte [esp + 4]
inc byte [esp + 4]
cmp byte [esp + 4], 0x12
jne 0x464084
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x464284
Capabilities:
Hash data with md5

Disassembly:
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4651ac
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
push eax
mov eax, dword [eax]
mov esi, edx
or ecx, ecx
je 0x4651d0
mov edx, eax
shl edx, 8
mov bl, byte [esi]
shr eax, 0x18
xor al, bl
mov eax, dword [eax*4 + 0x4f7a60]
xor eax, edx
inc esi
dec ecx
jne 0x4651b7
mov ecx, eax
pop eax
mov dword [eax], ecx
pop ebx
pop esi
ret

Function at 0x4651d8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push ebx
push eax
mov eax, dword [eax]
mov esi, edx
xor ebx, ebx
or ecx, ecx
je 0x465206
mov edx, eax
shr edx, 8
and edx, 0xffffff
mov bl, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [eax*4 + 0x4f7660]
xor eax, edx
inc esi
dec ecx
jne 0x4651e5
mov ecx, eax
pop eax
mov dword [eax], ecx
pop ebx
pop esi
ret
Function at 0x46917c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffea8
mov dword [esp], eax
lea edi, [esp + 4]
mov edx, edi
mov eax, dword [esp]
mov ecx, 0x14
call fcn.00402c64
xor esi, esi
lea ebx, [esp + 0x18]
mov eax, dword [esp]
add eax, 0x30
mov edx, esi
shl edx, 2
add eax, edx
mov eax, dword [eax]
call fcn.00463e84
mov dword [ebx], eax
inc esi
add ebx, 4
cmp esi, 0x10
jne 0x4691a2
mov esi, 0x40
lea ebx, [esp + 0x4c]
mov eax, dword [ebx]
xor eax, dword [ebx - 0x14]
xor eax, dword [ebx - 0x2c]
xor eax, dword [ebx - 0x34]
mov dl, 1
call fcn.00463e2c
mov dword [ebx + 0xc], eax
add ebx, 4
dec esi
jne 0x4691ca
xor esi, esi
lea ebp, [esp + 0x18]
mov eax, dword [edi + 0xc]
push eax
mov ebx, esi
mov eax, ebx
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
call fcn.00469114
push eax
mov dl, 5
mov eax, dword [edi]
call fcn.00463e2c
pop edx
add edx, eax
add edx, dword [edi + 0x10]
push edx
mov eax, ebx
call fcn.00469158
pop edx
add edx, eax
add edx, dword [ebp]
mov ebx, edx
mov eax, dword [edi + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
mov dl, 0x1e
mov eax, dword [edi + 4]
call fcn.00463e2c
mov dword [edi + 8], eax
mov eax, dword [edi]
mov dword [edi + 4], eax
mov dword [edi], ebx
inc esi
add ebp, 4
cmp esi, 0x50
jne 0x4691eb
mov esi, 5
mov eax, edi
mov edx, dword [esp]
mov ecx, dword [eax]
add dword [edx], ecx
add edx, 4
add eax, 4
dec esi
jne 0x469251
add esp, 0x158
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x469560
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret

Function at 0x4695a0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret

Function at 0x4695f4
Capabilities:
Hash data using sha224

Disassembly:
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
ret
Function at 0x469680
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
ret

Function at 0x469ba0
Capabilities:
Hash data using tiger

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
xor eax, dword [ebp + 0x10]
xor edx, dword [ebp + 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [esi]
mov edx, dword [esi + 4]
push edx
push eax
mov eax, dword [ecx]
and eax, 0xff
mov edx, dword [eax*8 + 0x4f9264]
mov eax, dword [eax*8 + 0x4f9260]
push edx
push eax
mov eax, dword [ecx]
shr eax, 0x10
and eax, 0xff
mov edx, dword [eax*8 + 0x4f9a64]
mov eax, dword [eax*8 + 0x4f9a60]
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ecx + 4]
xor edx, edx
and eax, 0xff
mov edx, dword [eax*8 + 0x4fa264]
mov eax, dword [eax*8 + 0x4fa260]
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ecx + 4]
xor edx, edx
shr eax, 0x10
and eax, 0xff
mov edx, dword [eax*8 + 0x4faa64]
mov eax, dword [eax*8 + 0x4faa60]
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [ecx]
shr eax, 8
and eax, 0xff
mov edx, dword [eax*8 + 0x4faa64]
mov eax, dword [eax*8 + 0x4faa60]
push edx
push eax
mov eax, dword [ecx]
shr eax, 0x18
and eax, 0xff
mov edx, dword [eax*8 + 0x4fa264]
mov eax, dword [eax*8 + 0x4fa260]
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ecx + 4]
xor edx, edx
shr eax, 8
and eax, 0xff
mov edx, dword [eax*8 + 0x4f9a64]
mov eax, dword [eax*8 + 0x4f9a60]
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ecx + 4]
xor edx, edx
shrd eax, edx, 0x18
shr edx, 0x18
and eax, 0xff
mov edx, dword [eax*8 + 0x4f9264]
mov eax, dword [eax*8 + 0x4f9260]
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
add eax, dword [ebx]
adc edx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
call fcn.004061fc
mov dword [ebx], eax
mov dword [ebx + 4], edx
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x46a7d8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x46d420
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov ebx, eax
or esi, 0xffffffff
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.00405278
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46d45a
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
pop esi
pop ebx
ret

Function at 0x46e2a4
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov ebx, eax
or esi, 0xffffffff
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.00405278
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46e2de
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
pop esi
pop ebx
ret

Function at 0x46f128
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov ebx, eax
or esi, 0xffffffff
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.00405278
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46f162
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
pop esi
pop ebx
ret

Function at 0x46fb28
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x46fbbc
push 0
mov eax, ebx
call fcn.00405278
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x46fb97
mov eax, esi
call fcn.00405080
inc eax
push eax
mov eax, esi
call fcn.00405278
push eax
push 1
push 0
mov eax, edi
call fcn.00405278
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x46fbb2
mov ecx, dword [0x4fdd18]
mov dl, 1
mov eax, dword [0x46f80c]
call fcn.0040f0b0
call fcn.004046c4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x478d30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x478e08
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5021f4], 0
jne 0x478dec
lea eax, [ebp - 4]
mov edx, 0x478e20
call fcn.00404e44
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405278
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x478dec
mov eax, ebx
call fcn.00402a38
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x478de5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x478dcf
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x478e30
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x478dcf
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x5021f4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478dec
mov eax, dword [ebp - 0xc]
call fcn.00402a58
ret
mov ebx, dword [0x5021f4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478e0f
lea eax, [ebp - 4]
call fcn.00404dac
ret

Function at 0x483234
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x502218], 0
jne 0x483257
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4831a8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x502218], eax
ret
Function at 0x488a84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebp
push ebx
mov ebx, dword [esp + 0x18]
movaps xmm7, xmmword [ebx]
movaps xmm3, xmmword [ebx + 0x40]
movaps xmm4, xmmword [ebx + 0x10]
sub esp, 0x20
lea esi, [ecx + ecx]
add esi, esi
lea ebp, [ecx + ecx]
lea ebx, [ecx + ecx]
add ebx, ebx
sub ebx, ecx
add ebx, ebx
movlps xmm0, qword [eax]
movhps xmm0, qword [eax + ebp*8]
movlps xmm1, qword [eax + esi*8]
movhps xmm1, qword [eax + ebx*8]
movaps xmm2, xmm0
subps xmm0, xmm1
addps xmm2, xmm1
movlps qword [eax], xmm2
movhps qword [eax + ebp*8], xmm2
movaps xmm1, xmm0
movlhps xmm1, xmm1
shufps xmm0, xmm0, 0xbb
xorps xmm0, xmm7
addps xmm1, xmm0
movlps qword [eax + esi*8], xmm1
movhps qword [eax + ebx*8], xmm1
dec ecx
mov edi, ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
lea ecx, [eax + 8]
movlps xmm0, qword [eax + 8]
movhps xmm0, qword [eax + ebp*8 + 8]
movlps xmm1, qword [eax + esi*8 + 8]
movhps xmm1, qword [eax + ebx*8 + 8]
movaps xmm2, xmm0
subps xmm0, xmm1
addps xmm2, xmm1
movlps qword [eax + 8], xmm2
movhps qword [eax + ebp*8 + 8], xmm2
movaps xmm1, xmm0
movlhps xmm1, xmm1
shufps xmm0, xmm0, 0xbb
xorps xmm0, xmm7
addps xmm1, xmm0
movaps xmm5, xmmword [edx]
movaps xmm6, xmmword [edx + 0x10]
movaps xmm0, xmm1
shufps xmm0, xmm0, 0xb1
mulps xmm1, xmm5
mulps xmm0, xmm6
xorps xmm0, xmm7
addps xmm1, xmm0
movlps qword [eax + esi*8 + 8], xmm1
movhps qword [eax + ebx*8 + 8], xmm1
mov eax, ecx
add edx, 0x20
dec edi
jne 0x488af4
mov dword [esp], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp]
lea edi, [ecx + 8]
mov dword [esp + 4], edi
movlps xmm0, qword [ecx + 8]
movhps xmm0, qword [eax + ebp*8 + 8]
movlps xmm1, qword [eax + esi*8 + 8]
movhps xmm1, qword [eax + ebx*8 + 8]
movaps xmm2, xmm0
subps xmm2, xmm1
addps xmm0, xmm1
movlps qword [ecx + 8], xmm0
movhps qword [eax + ebp*8 + 8], xmm0
movaps xmm1, xmm2
movlhps xmm1, xmm1
shufps xmm2, xmm2, 0xbb
xorps xmm2, xmm3
addps xmm1, xmm2
movaps xmm2, xmm1
shufps xmm2, xmm2, 0xb1
xorps xmm2, xmm3
addps xmm1, xmm2
mulps xmm1, xmm4
movlps qword [eax + ebx*8 + 8], xmm1
movhps qword [eax + esi*8 + 8], xmm1
add edx, 0xffffffe0
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
mov eax, edi
lea edi, [eax + 8]
movlps xmm0, qword [eax + 8]
movhps xmm0, qword [eax + ebp*8 + 8]
movlps xmm1, qword [eax + esi*8 + 8]
movhps xmm1, qword [eax + ebx*8 + 8]
movaps xmm2, xmm0
subps xmm0, xmm1
addps xmm2, xmm1
movlps qword [eax + 8], xmm2
movhps qword [eax + ebp*8 + 8], xmm2
movaps xmm1, xmm0
movlhps xmm1, xmm1
shufps xmm0, xmm0, 0xbb
xorps xmm0, xmm7
addps xmm1, xmm0
movaps xmm5, xmmword [edx + 0x10]
movaps xmm6, xmmword [edx]
movaps xmm0, xmm1
shufps xmm0, xmm0, 0xb1
mulps xmm1, xmm5
mulps xmm0, xmm6
xorps xmm0, xmm7
addps xmm1, xmm0
movlps qword [eax + esi*8 + 8], xmm1
movhps qword [eax + ebx*8 + 8], xmm1
mov eax, edi
add edx, 0xffffffe0
dec ecx
jne 0x488bd1
add esp, 0x20
pop ebx
pop ebp
pop esi
pop edi
pop ebp
ret 4