joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4020ad
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
push pe_nt_image_headers32
mov dword [ebp + 8], edi
push dword [ebx + 0x2c]
call fcn.00401023
push eax
push edi
call fcn.00401d0d
add esp, 0x10
test eax, eax
jne 0x4020e2
xor al, al
jmp 0x402183
movzx ecx, word [esi + 0x14]
mov edi, eax
sub edi, dword [ebp + 8]
and dword [ebp + 8], 0
lea edx, [ecx + esi + 0x18]
movzx ecx, word [esi + 6]
test ecx, ecx
mov dword [ebp - 4], ecx
jle 0x40211c
mov ecx, dword [edx + 0x14]
cmp edi, ecx
jb 0x40210e
mov esi, dword [edx + 0x10]
add esi, ecx
cmp edi, esi
jb 0x40211c
add edx, 0x28
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 4]
jl 0x4020fe
mov ecx, dword [edx + 0xc]
sub ecx, dword [edx + 0x14]
mov edx, dword [ebx + 0xc]
add ecx, dword [edx + 0x34]
add ecx, edi
mov dword [0x414dbc], ecx
cmp dword [eax + 0x100], 0x100
jne 0x40215d
cmp byte [eax + 0x105], 0
jne 0x40215d
add ecx, 0x100
mov dword [0x414dc4], 0xc
mov dword [0x414dc0], ecx
jmp 0x402181
add ecx, 0x104
push 0x10
mov dword [0x414dc0], ecx
mov eax, dword [eax + 0x100]
pop ecx
mov dword [0x414dc4], eax
cmp eax, ecx
jb 0x402181
mov dword [0x414dc4], ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402270
Capabilities:
Get file size

Disassembly:
sub esp, 0x110
push ebx
xor ebx, ebx
cmp dword [ecx + 4], ebx
mov dword [esp + 0x10], ecx
jne 0x402354
push ebp
push esi
push edi
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [esp + 0x13c]
call edi
mov esi, eax
push str.Game_files_are_corrupt__please_re_install_game_and_try_again.
cmp esi, 0xffffffff
setne al
push eax
call fcn.00404e87
pop ecx
pop ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [esp + 0x1c], eax
call ebp
and dword [esp + 0x14], 0
mov eax, dword [str.Background.jpg]
mov esi, 0x4104dc
jmp 0x40233c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call edi
push dword [esi]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
push str.file__s_missing_
push eax
call fcn.00407268
cmp dword [esp + 0x1c], 0xffffffff
lea eax, [esp + 0x2c]
push eax
setne al
push eax
call fcn.00404e87
add esp, 0x14
push 0
push dword [esp + 0x14]
call ebx
push dword [esp + 0x10]
add dword [esp + 0x18], eax
call ebp
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x4022e5
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add ecx, eax
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebp
mov al, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x402360
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [ebp + 0x10]
push ebx
push eax
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0xc]
cmp eax, 0xffffffff
push str.Could_not_get_file_size
mov dword [esi], eax
setne al
push eax
call fcn.00404e87
push dword [esi]
call fcn.004068d5
add esp, 0xc
lea ecx, [ebp + 8]
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], ebx
push ebx
push ecx
push dword [esi]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4023d1
mov eax, dword [esi]
cmp eax, dword [ebp + 8]
jne 0x4023d1
mov bl, 1
push str.There_was_an_error_in_reading_the_file_contents_into_memory.
push ebx
call fcn.00404e87
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x402475
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
or dword [eax], 0xffffffff
or dword [eax + 0x10], 0xffffffff
or dword [eax + 8], 0xffffffff
push edi
xor edi, edi
mov dword [eax + 4], edi
mov dword [eax + 0x14], edi
mov esi, dword [ecx + 0x28]
mov dword [ebp + 0xc], edi
mov dword [eax + 0xc], esi
movzx edx, word [ecx + 0x14]
lea edx, [edx + ecx + 0x18]
movzx ecx, word [ecx + 6]
cmp ecx, edi
mov dword [ebp + 8], ecx
jbe 0x4024d8
mov ecx, dword [edx + 0x10]
mov edi, dword [edx + 8]
cmp edi, ecx
jae 0x4024bc
mov ecx, edi
mov edi, dword [edx + 0xc]
cmp esi, edi
jb 0x4024ca
lea ebx, [edi + ecx]
cmp esi, ebx
jb 0x4024ef
inc dword [ebp + 0xc]
add edx, 0x28
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp + 8]
jb 0x4024b0
push str.Error_calculating_file_offset__what_type_of_PE_file_is_this___
push 0
call fcn.00404e87
pop ecx
xor al, al
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
sub esi, edi
mov dword [eax], ebx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov edx, dword [edx + 0x14]
add edx, esi
sub ecx, esi
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
mov al, 1
jmp 0x4024e8

Function at 0x402f53
Capabilities:
Create thread
Print debug messages

Disassembly:
push esi
mov esi, ecx
fld dword [esi + 0x18]
fcomp dword [0x40e28c]
fnstsw ax
test ah, 0x41
je 0x402f85
call fcn.00406160
test al, al
jne 0x402f85
push 0
push str.Demo_Expired
push str.Thank_you_for_playing__your_demo_has_expired._nBuy_now_to_upgrade_instantly.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
ret
mov ecx, esi
call fcn.004036dd
call fcn.00401029
mov ecx, eax
call fcn.0040119d
test al, al
jne 0x402f83
call fcn.00401029
mov ecx, eax
call fcn.0040105e
mov ecx, esi
call fcn.00402fbb
test al, al
je 0x402f83
mov ecx, esi
pop esi
jmp fcn.00403147
Function at 0x402fbb
Capabilities:
Create process on windows
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x950
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0xc], ecx
call fcn.00407210
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 0x50], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call edi
test eax, eax
jne 0x403039
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x950]
push str.GameWrapper:_Duplicate_Thread_Failed__last_error__x_n
push eax
call fcn.00407268
add esp, 0xc
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x40313c
push 2
push 1
lea eax, [ebp - 8]
push 0x100001
push eax
call esi
push eax
call fcn.00401029
mov ecx, eax
call fcn.004011e5
push eax
call esi
push eax
call edi
test eax, eax
jne 0x403095
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x950]
push str.GameWrapper:_Duplicate_Game_Failed__last_error__x_n
push eax
call fcn.00407268
add esp, 0xc
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40313c
push dword [ebp - 8]
mov edi, str.0x_08x
lea eax, [ebp - 0x150]
push edi
push eax
call fcn.00407268
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
push str.GAME_HANDLE
call esi
push dword [ebp - 4]
lea eax, [ebp - 0x150]
push edi
push eax
call fcn.00407268
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
push str.WRAPPER_HANDLE
call esi
mov eax, dword [ebp - 0xc]
add eax, 0x48
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push ebx
push str.RAW_003.wdt
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x403140
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x950]
push str.GameWrapper:_Create_Process_Failed__last_error__x_n
push eax
call fcn.00407268
add esp, 0xc
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
xor al, al
jmp 0x403142
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4036dd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov byte [esi + 0x15], 1
push dword [0x415380]
call edi
call fcn.00401029
mov ecx, eax
call fcn.004018f0
mov ebx, eax
test ebx, ebx
je 0x403787
and byte [esi + 0x14], 0
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 1
push ebx
call edi
lea edi, [esi + 4]
cmp dword [edi], 0
jne 0x403733
cmp dword [esi + 0xc], 0
je 0x403787
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x403787
mov eax, dword [esi + 0xc]
cmp dword [ebp - 8], eax
jne 0x403761
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [edi]
jne 0x403761
mov ecx, dword [ebp - 4]
cmp ecx, dword [esi + 0x10]
jne 0x403761
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [esi + 8]
je 0x403787
mov ecx, dword [esi + 8]
mov esi, dword [esi + 0x10]
mov edx, dword [edi]
sub esi, ecx
push 1
sub eax, edx
push esi
push eax
push ecx
push edx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0x10
push 0
push edi
call fcn.00407210
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40396c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
fld dword [ebp + 8]
fcomp dword [0x40e28c]
fnstsw ax
test ah, 5
jp 0x403984
fldz
fstp dword [ebp + 8]
push edi
call fcn.004039ca
mov edi, eax
test edi, edi
je 0x4039c7
push esi
xor esi, esi
push esi
call fcn.00402699
add byte [ebp + esi + 8], al
inc esi
cmp esi, 4
pop ecx
jb 0x403993
lea eax, [ebp + 8]
push 4
push eax
push 4
push 0
push dword [ebp + 0xc]
call fcn.004026b4
pop ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebp
ret
Function at 0x40438d
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push dword [0x415380]
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esi + 0x30]
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp byte [esi], al
je 0x40441f
mov dword [ebp - 4], eax
call fcn.004063d0
test eax, eax
jle 0x404438
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x2c]
push eax
call fcn.004063f0
mov esi, eax
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
movsd dword es:[edi], dword [esi]
pop ecx
push 0xcc0020
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ebx
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
inc dword [ebp - 4]
call fcn.004063d0
cmp dword [ebp - 4], eax
jl 0x4043cf
pop edi
jmp 0x404438
push 0xcc0020
push eax
push eax
push ebx
push dword [esi + 0x28]
push dword [esi + 0x2c]
push eax
push eax
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
push dword [0x415380]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop esi
pop ebx
leave
ret

Function at 0x40468d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
fldz
push ebx
push esi
fstp dword [ebp - 4]
call fcn.004039ca
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x4046f0
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
push dword [ebp + 8]
call fcn.004026b4
pop ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4046e2
push esi
call fcn.00402699
sub byte [ebp + esi - 4], al
inc esi
cmp esi, 4
pop ecx
jb 0x4046cf
jmp 0x4046e9
mov dword [ebp - 4], 0x47a8c000
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
fld dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x404ac4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404b7b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x404b07
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404b7b
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebx
je 0x404afe
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
jne 0x404b2a
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x404afe
lea ecx, [ebp - 8]
push ebx
push ecx
mov dword [ebp - 8], ebx
push dword [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], ebx
je 0x404b7b
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jge 0x404b76
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x404b7b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x404b7b
cmp dword [ebp + 8], ebx
jne 0x404b7f
xor al, al
jmp 0x404bb6
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, ebx
je 0x404b8e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
push 0x40e2b8
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
test eax, eax
jl 0x404bab
cmp dword [esi], ebx
je 0x404bab
mov bl, 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405630
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
pop esi
ret

Function at 0x405650
Capabilities:
Enumerate files on windows
Move file

Disassembly:
sub esp, 0x458
lea edx, [esp + 0x354]
push ebx
mov ebx, dword [esp + 0x464]
push esi
push edi
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40566b
lea edi, [esp + 0x360]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x360]
repne scasb al, byte es:[edi]
mov eax, dword [0x41137c]
lea ecx, [esp + 0x11c]
push ecx
push edx
mov dword [edi - 1], eax
mov byte [esp + 0x17], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x14], esi
je 0x4057a1
push ebp
mov ebp, dword [esp + 0x46c]
test byte [esp + 0x120], 0x10
jne 0x405785
lea edx, [esp + 0x260]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4056d6
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x260]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1c]
and ecx, 3
mov eax, ebp
rep movsb byte es:[edi], byte [esi]
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40571f
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00405630
add esp, 4
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x260]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x405785
mov byte [esp + 0x13], al
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x120]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4056bd
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
add esp, 0x458
ret
Function at 0x4057c0
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x34c
lea edx, [esp + 0x248]
push ebx
push esi
mov esi, dword [esp + 0x358]
push edi
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4057db
lea edi, [esp + 0x254]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
mov eax, dword [str..]
mov cl, byte [0x41138c]
dec edi
push edx
mov dword [edi], eax
lea eax, [esp + 0x258]
push eax
mov byte [edi + 4], cl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4058f0
push ebp
lea ebp, [esp + 0x14]
sub ebp, esi
mov eax, esi
mov cl, byte [eax]
mov byte [eax + ebp], cl
inc eax
test cl, cl
jne 0x40582e
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
mov cx, word [0x4103b8]
mov word [edi - 1], cx
lea edi, [esp + 0x144]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov edi, 0x411384
lea esi, [esp + 0x144]
mov ecx, 2
repe cmpsb byte [esi], byte es:[edi]
je 0x4058d1
mov edi, 0x411380
lea esi, [esp + 0x144]
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4058d1
test byte [esp + 0x118], 0x10
je 0x4058c4
lea eax, [esp + 0x14]
push eax
call fcn.004057c0
jmp 0x4058ce
lea ecx, [esp + 0x14]
push ecx
call fcn.00405630
add esp, 4
lea edx, [esp + 0x118]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esi, dword [esp + 0x360]
test eax, eax
jne 0x40582c
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x34c
ret
Function at 0x41512a
Capabilities:
Encode data using xor

Disassembly:
invalid
and bh, byte [esi + 0x69dff529]
inc eax
hlt
out dx, eax
pop edx
push ebp
add eax, 0xb81c702f
jge 0x4151a4
invalid
jo 0x415144
mov eax, 0xc94f797d
jns 0x41517b
dec edi
leave
cmp dword [esi + 0x7f442484], esi
pop ebp
sbb eax, 0x182d1f
jb 0x4150f2
xor byte es:[ebx + 0x553db4dc], ch
daa
xchg esp, eax
jne 0x415121
jmp 0xd8dce212
pop esi
jl 0x415104
jmp 0x415126
push esp
dec esp
imul bh
xchg edx, eax
inc edi
inc eax
ror byte [0xc44f642a], 1
sub ah, byte [edi + ecx*2 - 0x3c]
dec edi
les ebp, [edx]
xor dword [ebp + 0x18], ebp
pop edx
mov edi, 0xce66f73e
sub dh, byte [ecx]
insd dword es:[edi], dx
sbb byte [edx - 0x41], bl
mul dword ds:[esi - 0x32]
sbb dl, byte [ebp - 0x22432b33]
jbe 0x4151b4
int 0xd4
mov esp, 0x7a2576dd
cmp dh, byte [esi - 0x42]
jp 0x4151cb
jbe 0x415151
pop ds
inc esp
loopne 0x415170
inc edi
inc esi
add eax, dword [edx - 0x60]
lds eax, [edi - 0x4b184378]
jnp 0x4151ab
mov ah, 0x7b
pop es
insb byte es:[edi], dx
adc byte [ecx - 0x30], dh
pop ebx
test eax, 0x397f6c60
insb byte es:[edi], dx
jg 0x4151e7
jge 0x415179
jo 0x4151a1
invalid
add eax, 0xd76acab
stosd dword es:[edi], eax
lodsb al, byte [esi]
jbe 0x4151c5
xor edi, 0xdfae7db8
inc edx
aam 0x15
test ebp, eax
jge 0x4151b3
out dx, al
or eax, 0x575bfcbf
adc al, 0xb6
inc edx
mov dh, 0x42
add esi, edi
je 0x415189
sub ecx, dword [ecx]
sbb byte [ecx + ecx*8], ah
sub cl, bh
cmp dword [ecx + 0x3d6d0295], eax
or eax, 0xb4ed1037
std
notrack call 0xcc425d31
das
jnp 0x4151c4
or eax, dword [ecx]
int3
ljmp 0x244e:0x911d0eee

Function at 0x417da0
Capabilities:
Query or enumerate registry value

Disassembly:
and bh, ah
std
lahf
xor eax, dword [ebx + 0x6d747656]
in al, 0x94
cmpsd dword [esi], dword es:[edi]
rol ebp, 0xf6
leave
loope 0x417d96
fnstenv [ebx - 0x530f152b]
mov ebp, 0x5d7f7c64
mov edi, 0x1ec5ac27
and byte [ebx], ch
push 0x8c917a31
xlatb
or bl, dh
pushal
dec eax
push esi
push edi
push ebx
push ebp
mov ecx, dword [esp + 0x28]
cmp ecx, 0
jle 0x417e6d
sub byte [ebx - 0x71f0ff07], al
xchg esi, eax
add byte [eax], al
add byte [ebx - 0x74dfdb94], cl
jl 0x417e02
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
sbb al, 0x8b
push esp
and al, 0x24
movd mm6, dword [esp + 0x14]
movd mm7, dword [esp + 0x18]
movss xmm1, dword [ebp]
movss xmm0, dword [edx]
unpcklps xmm0, xmm1
cvtps2pi mm0, xmm0
sub ecx, 1
je 0x417dcd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x417e10
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4c3049]
mov dl, byte [0x4c3044]
and al, dl
mov edx, dword [0x4c3038]
or al, 0x50
Function at 0x417e25
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov byte [0x4c3044], al
mov eax, dword [0x4c303c]
mov ecx, eax
push esi
shl ecx, 4
and edx, ecx
xor ecx, ecx
mov cl, byte [0x4c3045]
mov dword [0x4c3038], edx
mov edx, dword [0x4c3034]
xor esi, esi
and edx, 8
imul edx, ecx
or eax, edx
mov edx, dword [0x4c6b1c]
push edx
mov dword [0x4c303c], eax
dec esp
add al, ch
mov ebp, 0x8d000a24
inc esp
and al, 4
push eax
push 0x20019
push esi
push str.CLSIDEC529B00_1A1F_11D1_BAD9_00609744111AInprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x417e91
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov ecx, dword [0x4c6b1c]
mov dword [esp + 0xc], 0x104
push ecx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dl, byte [0x4c3049]
mov al, byte [0x4c3048]
xor al, dl
mov edx, dword [esp + 0x14]
mov byte [0x4c3048], al
mov al, byte [0x4c3043]
or al, 8
lea ecx, [esp + 0xc]
shr al, 3
and eax, 0xff
push ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
fild dword [esp + 0xc]
push edx
push 0
push 0
push str.ThreadingModel
fdivr qword [0x4c69d0]
push eax
fadd qword [0x4c3050]
fstp qword [0x4c69c0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417f08
mov esi, 1
push 0x4c7d38
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret 4

Function at 0x43f4ab
Capabilities:
Encode data using xor

Disassembly:
xor ebp, dword [esi]
cmp eax, eax
xchg esp, eax
mov byte [0xba4b4c7e], al
wait
invalid
xchg edx, eax
push 0x8948c574
inc eax
and ebx, dword [ecx - 0x5b]
sbb al, dh
stosd dword es:[edi], eax
xchg ebp, eax
fmul st(7)
adc ebp, dword [ebx - 0x61]
jge 0x43f467
sub bl, byte [ecx + 0x758774e8]
and eax, 0xd222f91b
in al, dx
inc esp
into
push edi
mov ebx, 0x1a33d34c
or eax, 0x82808de1
dec ebx
push eax
cmp byte [ebx], dl
push eax
and ecx, dword [ebp - 0x30]
mov esp, 0x5b82bc98
lds ebx, [ecx + 0x242a4a66]
and byte [0xfd9d6d83], dh
imul ecx, dword [0x7d32daa3], 0x63
mov eax, dword [0x552fc5ef]
cmpsd dword [esi], dword es:[edi]
nop
mov al, 0xd3
mov ah, 0xea
push ecx
invalid