joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5701f020
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa0
push ebx
push esi
push edi
mov byte [ebp - 0x1049], cl
mov edi, edx
mov ebx, eax
mov eax, dword [ebp + 0x14]
call sub.rtl120.bpl__System__LStrAddRef_qqrpv
lea esi, [ebp - 0x1058]
xor eax, eax
push ebp
push 0x5701f200
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov esi, 0x570255a8
lea edi, [ebp - 0x48]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, 0x570255f0
lea edi, [ebp - 0x1048]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebp
lea eax, [ebp + 0x14]
xor edx, edx
call sub.rtl120.bpl__System__EnsureAnsiString_qqrr27System__AnsiStringT_us_i0__us
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, dword [ebp + 0x14]
call sub.rtl120.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
pop edx
call fcn.5701ef18
pop ecx
cmp byte [ebp - 0x1049], 0
je 0x5701f0bd
lea eax, [ebp - 0x48]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 1
jmp 0x5701f0d0
lea eax, [ebp - 4]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 0xffffffff
shr edi, 3
dec edi
test edi, edi
jl 0x5701f1ea
inc edi
mov dword [ebp - 0x1060], edi
cmp dword [ebp + 0x10], 0
jne 0x5701f0ed
cmp dword [ebp + 0xc], 0
je 0x5701f16a
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
movzx edx, byte [eax]
inc edx
and dl, 0xff
mov byte [eax], dl
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x5701f114
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x5701f0f5
lea eax, [ebp + 0xc]
mov eax, dword [eax]
call fcn.5701eb2c
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.5701eb2c
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.5701eb58
pop ecx
mov eax, dword [esi]
call fcn.5701eb2c
xor dword [ebx], eax
mov eax, dword [ebp - 0x105c]
call fcn.5701eb2c
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x5701f1db
cmp byte [ebp + 8], 0
jne 0x5701f1c2
mov edi, ebx
mov eax, dword [edi]
call fcn.5701eb2c
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.5701eb2c
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.5701eb58
pop ecx
mov eax, dword [esi]
call fcn.5701eb2c
mov dword [edi], eax
mov eax, dword [ebp - 0x105c]
call fcn.5701eb2c
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x5701f1db
push ebp
mov eax, dword [ebp - 0x1054]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1050]
call fcn.5701eb58
pop ecx
add ebx, 8
dec dword [ebp - 0x1060]
jne 0x5701f0e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5701f207
lea eax, [ebp + 0x14]
call sub.rtl120.bpl__System__LStrClr_qqrpv
ret
Function at 0x5701f5b4
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jle 0x5701f6df
lea eax, [esi + 2]
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, edx
add edx, edx
mov eax, edi
xor ecx, ecx
call sub.rtl120.bpl__System__LStrSetLength_qqrv
mov ecx, dword [edi]
mov eax, esi
mov edi, 3
cdq
idiv edi
mov edi, eax
test edi, edi
jle 0x5701f651
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
movzx edx, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x570265f0]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x570265f0]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x570265f0]
mov byte [ecx + 2], dl
and eax, 0x3f
movzx eax, byte [eax + 0x570265f0]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec edi
jne 0x5701f5f1
mov eax, esi
mov esi, 3
cdq
idiv esi
dec edx
je 0x5701f666
dec edx
je 0x5701f697
jmp 0x5701f6e6
movzx eax, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x570265f0]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x570265f0]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x5701f6e6
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x570265f0]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x570265f0]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x570265f0]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
jmp 0x5701f6e6
mov eax, edi
call sub.rtl120.bpl__System__LStrClr_qqrpv
pop edi
pop esi
pop ebx
ret

Function at 0x5701fb3c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 4
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0xc]
mov dword [edx], eax
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp dword [eax], 0
setne al
pop ebp
ret

Function at 0x5701fc14
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_GetFileSize
mov edx, dword [ebp + 8]
add eax, dword [edx - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_SetFilePointer
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_SetEndOfFile
pop ebp
ret
Function at 0x5701fee8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x57020062
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x5701ff7b
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
jbe 0x5701ff70
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov edx, dword [ebp - 0x210]
mov eax, ebx
mov ecx, 0x5702007c
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
jmp 0x5701ffd4
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x5701ffd4
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
jbe 0x5701ffcb
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x20a]
mov ecx, 0
call sub.rtl120.bpl__System__LStrFromPChar_qqrr27System__AnsiStringT_us_i0__pcus
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 0x214]
call sub.rtl120.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
mov edx, dword [ebp - 0x214]
mov eax, ebx
mov ecx, 0x5702007c
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
jmp 0x5701ffd4
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
push dword [ebx]
push 0x5702008c
lea eax, [ebp - 0x21c]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cx, 0x30
mov edx, 8
call sym.madBasic_.bpl__Madstrings_IntToHexExW_qqruiib
push dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push eax
mov cx, 0x30
mov edx, 1
mov eax, esi
call sym.madBasic_.bpl__Madstrings_IntToHexExW_qqruiib
push dword [ebp - 0x220]
push 0x570200ac
mov eax, ebx
mov edx, 5
call sub.rtl120.bpl__System__UStrCatN_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57020069
lea eax, [ebp - 0x220]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0x218]
call sub.rtl120.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x214]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x57020a30
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
cmp word [eax], 0x5a4d
jne 0x57020ada
mov ecx, eax
mov ebx, ecx
add ebx, 0x3c
mov esi, dword [ebx]
add esi, ecx
cmp dword [esi], 0x4550
jne 0x57020ada
cmp word [esi + 0x18], 0x20b
jne 0x57020a67
lea ecx, [esi + 0x18]
xor ebx, ebx
mov dword [ecx + 0x40], ebx
jmp 0x57020a6c
xor ecx, ecx
mov dword [esi + 0x58], ecx
xor ecx, ecx
mov ebx, edx
shr ebx, 1
dec ebx
test ebx, ebx
jb 0x57020a9a
inc ebx
movzx edi, word [eax]
add ecx, edi
test ecx, 0xffff0000
je 0x57020a94
mov edi, ecx
and edi, 0xffff
shr ecx, 0x10
add edi, ecx
mov ecx, edi
add eax, 2
dec ebx
jne 0x57020a78
test dl, 1
je 0x57020ab2
movzx eax, byte [eax]
add ecx, eax
mov eax, ecx
and eax, 0xffff
shr ecx, 0x10
add eax, ecx
mov ecx, eax
mov eax, ecx
and ax, 0xffff
shr ecx, 0x10
add ax, cx
movzx eax, ax
mov ecx, eax
cmp word [esi + 0x18], 0x20b
jne 0x57020ad5
add edx, ecx
lea eax, [esi + 0x18]
mov dword [eax + 0x40], edx
jmp 0x57020ada
add edx, ecx
mov dword [esi + 0x58], edx
pop edi
pop esi
pop ebx
ret
Function at 0x57021320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x570213df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x14]
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov dword [ebx + 0x1c], eax
xor eax, eax
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0x8000
jbe 0x570213b3
push 0
push 2
push 0
push 0
lea edx, [ebp - 8]
mov eax, ebx
call fcn.5701fee8
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0xc0000000
call fcn.57020120
mov esi, eax
mov dword [ebx + 0x20], esi
cmp esi, 0xffffffff
je 0x570213ac
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
push eax
push esi
call sub.kernel32.dll_WriteFile
jmp 0x570213c9
xor eax, eax
mov dword [ebx + 0x20], eax
jmp 0x570213c9
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
lea eax, [ebx + 0x10]
call sub.rtl120.bpl__System__LStrFromPCharLen_qqrr27System__AnsiStringT_us_i0__pcius
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570213e6
lea eax, [ebp - 8]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x57021e38
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 2
mov eax, dword [ebp + 8]
push eax
call sym.madBasic_.bpl__Madres_GetResourceW_qqsuipbt2usrpvrui
test eax, eax
je 0x57021f1d
lea eax, [ebp - 0x22]
mov byte [eax], 0x42
lea eax, [ebp - 0x22]
mov byte [eax + 1], 0x4d
mov eax, dword [ebp - 0xc]
add eax, 0xe
mov dword [ebp - 0x20], eax
mov word [ebp - 0x1c], 0
mov word [ebp - 0x1a], 0
mov dword [ebp - 0x18], 0x36
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0xe]
cmp ax, 8
ja 0x57021ea9
mov ecx, eax
mov eax, 4
shl eax, cl
add dword [ebp - 0x18], eax
mov cl, 1
mov dl, 1
mov eax, dword [ebp + 0x14]
call fcn.57020704
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x57021f1d
xor eax, eax
push ebp
push 0x57021f16
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x10]
push eax
push 0xe
lea eax, [ebp - 0x22]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WriteFile
mov dword [ebp - 4], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57021f1d
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x57021f28
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp + 0x14]
call fcn.57020704
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x57022014
xor eax, eax
push ebp
push 0x5702200d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetFileSize
mov ebx, eax
sub ebx, 0xe
mov eax, ebx
call sub.rtl120.bpl__System__GetMem_qqri
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x57021fef
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0xe
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x57021fcc
cmp ebx, dword [ebp - 0xc]
jne 0x57021fcc
push ebx
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 2
mov eax, dword [ebp + 8]
push eax
call sym.madBasic_.bpl__Madres_UpdateResourceW_qqsuipbt2uspvui
test eax, eax
jne 0x57021fd0
xor eax, eax
jmp 0x57021fd2
mov al, 1
neg al
sbb eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57021ff6
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__FreeMem_qqrpv
ret
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402594
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4025a2
call dword [0x40b004]
or eax, eax
je 0x4025a3
ret
mov al, 1
jmp fcn.00402614

Function at 0x4025ac
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4025ba
call dword [0x40b008]
or eax, eax
jne 0x4025bb
ret
mov al, 2
jmp fcn.00402614

Function at 0x4025c4
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4025fc
test edx, edx
je 0x4025e6
push eax
mov eax, ecx
call dword [0x40b00c]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402614
mov dword [eax], edx
mov eax, ecx
call dword [0x40b008]
or eax, eax
jne 0x4025df
ret
mov al, 1
jmp fcn.00402614
test edx, edx
je 0x402610
push eax
mov eax, edx
call dword [0x40b004]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret

Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x403780
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402614
cmp eax, edx
je 0x4037f0
cmp word [eax], 8
jb 0x4037a5
push eax
push edx
cmp word [eax], 0x100
je 0x40379b
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4037a3
add eax, 8
call fcn.00403198
pop edx
pop eax
cmp word [edx], 8
jae 0x4037bc
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
jne 0x4037dc
mov edx, dword [edx + 8]
or edx, edx
je 0x4037d3
mov ecx, dword [edx - 8]
inc ecx
jle 0x4037d3
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x403744
ret

Function at 0x40515c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405195
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40519e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4051a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4051c9
mov al, byte [esp]
jmp 0x4051cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40693c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406984
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004068d8
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40698b
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x406b8c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406c1a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406bd7
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406c04
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406beb
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406bfa
lea edx, [ebp - 4]
call fcn.00406a50
test ebx, ebx
je 0x406bfa
dec ebx
jmp 0x406bdc
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c21
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c28
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404d30
add esp, 0x104
pop ebx
ret

Function at 0x406d70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406ea8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406e92
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406dcd
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406e92
cmp dword [ebp - 0x10], 0
jne 0x406de2
mov eax, dword [ebp - 8]
call fcn.00403198
mov bl, 1
jmp 0x406e92
cmp dword [ebp - 0x10], 0x70000000
jb 0x406df0
call fcn.004057d4
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00403420
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406d96
test eax, eax
jne 0x406e92
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406e40
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406e92
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
jmp 0x406e4b
dec esi
test esi, esi
je 0x406e59
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x406e4a
cmp dword [ebp - 0xc], 7
jne 0x406e64
test esi, esi
je 0x406e64
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004034f0
cmp dword [ebp - 0xc], 7
jne 0x406e85
test esi, esi
je 0x406e85
lea eax, [ebp - 0x14]
call fcn.00403420
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406eaf
lea eax, [ebp - 0x14]
call fcn.00403198
ret
Function at 0x4077f0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x40780c
shr eax, 1
xor eax, 0xedb88320
jmp 0x40780e
shr eax, 1
dec edx
jne 0x4077ff
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4077f8
pop esi
ret

Function at 0x40783b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x407847
call fcn.004077f0
push 1
push 0x40c558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x407872
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40784d
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x408ee0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408e94
test al, al
jne 0x408f01
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408f4d
xor eax, eax
push ebp
push 0x408f3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f44
lea eax, [ebp - 0xc]
call fcn.00408ed0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409254
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x409343
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406c54
mov edx, dword [ebp - 8]
mov ecx, 0x40935c
xor eax, eax
call fcn.00409148
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x409311
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409274
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408cfc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404be4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004071e4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408ccc
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x4045b0
call fcn.004057e0
call fcn.00402eb4
jmp 0x409274
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40934a
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret