joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c58
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
test esi, esi
je 0x409e14
cmp dword [edi + 0xc], 0
je 0x409c97
mov eax, dword [edi + 0xc]
dec eax
je 0x409c81
dec eax
je 0x409c8d
jmp 0x409c97
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x409c97
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
mov byte [ebp - 5], 0
xor edx, edx
mov dword [ebp - 0xc], edx
cmp dword [edi + 0xc], 0
je 0x409cf3
xor ebx, ebx
cmp esi, ebx
jle 0x409d10
push 0
lea eax, [ebp - 0xc]
push eax
mov edx, esi
sub edx, ebx
cmp edx, 0x4000
jge 0x409cc4
mov ecx, esi
sub ecx, ebx
jmp 0x409cc9
mov ecx, 0x4000
push ecx
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne dl
and edx, 1
mov byte [ebp - 5], dl
test dl, dl
je 0x409d10
add ebx, 0x4000
cmp esi, ebx
jg 0x409cac
jmp 0x409d10
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne cl
and ecx, 1
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
jne 0x409e10
cmp byte [edi + 0x14], 0
je 0x409e10
cmp dword [edi + 0xc], 0
jne 0x409e10
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
mov eax, edi
call fcn.0040a04c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
lea eax, [edi + 0x17]
call fcn.0040a7fc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
push ebx
call sub.KERNEL32.DLL_SetLastError
mov eax, esi
cdq
cmp edx, dword [ebp - 0x18]
jne 0x409d65
cmp eax, dword [ebp - 0x1c]
jae 0x409dad
jmp 0x409d67
jge 0x409dad
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x409d87
cmp eax, 0xffffffff
ja 0x409dad
jmp 0x409d89
jg 0x409dad
mov eax, esi
cdq
add eax, dword [ebp - 0x14]
adc edx, dword [ebp - 0x10]
cmp edx, 0
jne 0x409d9e
cmp eax, 0xffffffff
jbe 0x409dad
jmp 0x409da0
jle 0x409dad
lea edx, [edi + 0x17]
mov eax, 0x4bb2e4
call fcn.0042ea68
lea edx, [edi + 0x17]
mov eax, 0x4bb2e4
call fcn.0042ea9c
test al, al
je 0x409dfa
mov ecx, dword [ebp - 0xc]
cmp ecx, esi
jae 0x409c97
cmp dword [ebp - 0xc], 0
jbe 0x409c97
mov eax, edi
call fcn.0040a04c
push edx
push eax
mov eax, dword [ebp - 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.00409f94
jmp 0x409c97
lea ecx, [edi + 0x17]
mov eax, 0x4bb2e4
xor edx, edx
call fcn.0042ea50
jmp 0x409e10
mov byte [edi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push esi
push edi
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x409f3a
cmp esi, 0x4e20
jle 0x409f30
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x409f8a
mov eax, ebx
call fcn.0040a2c8
test al, al
je 0x409f71
cmp esi, 0x4e20
jle 0x409f71
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.00409f10
jmp 0x409f8d
cmp dword [ebx + 0xc], 1
jne 0x409f85
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x409f85
xor eax, eax
jmp 0x409f8d
or eax, 0xffffffff
jmp 0x409f8d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40a440
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.0041113c
test eax, eax
je 0x40a466
test ebx, ebx
je 0x40a466
cmp word [ebx], 0
je 0x40a466
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x40a46e
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x40a481
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.0040adb8
xor eax, eax
jmp 0x40a49c
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x40a490
cmp eax, 3
jne 0x40a497
mov eax, 2
jmp 0x40a49c
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x40a7b4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
lea edx, [ebp - 0x400]
call fcn.0040d324
cmp byte [ebp - 0x400], 0
je 0x40a7d9
lea eax, [ebp - 0x400]
jmp 0x40a7db
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x40a7ef
cmp eax, 5
je 0x40a7ef
xor edx, edx
jmp 0x40a7f4
mov edx, 1
mov eax, edx
mov esp, ebp
pop ebp
ret
Function at 0x40a7fc
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd0
push ebx
push esi
mov ebx, eax
lea edx, [ebp - 0x430]
mov eax, ebx
call fcn.0040d324
cmp dword [0x4abd90], 0
jne 0x40a83f
push 0x4abd94
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
test esi, esi
je 0x40a83f
push str.GetDiskFreeSpaceExA
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4abd90], eax
cmp dword [0x4abd90], 0
je 0x40a8b0
lea edx, [ebp - 0x430]
mov ecx, 0x400
mov eax, ebx
call fcn.0040ca48
xor eax, eax
lea edx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
push edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x18]
push eax
cmp byte [ebp - 0x430], 0
je 0x40a87f
lea edx, [ebp - 0x430]
jmp 0x40a881
xor edx, edx
push edx
call dword [0x4abd90]
test eax, eax
je 0x40a8b0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
ja 0x40a8b0
mov eax, dword [ebp - 0x14]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x18]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
jmp 0x40a912
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x24]
push ecx
push eax
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push edx
push ecx
cmp byte [ebp - 0x430], 0
je 0x40a8d1
lea eax, [ebp - 0x430]
jmp 0x40a8d3
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jne 0x40a8e6
mov eax, 0x163e00
xor edx, edx
jmp 0x40a912
mov eax, dword [ebp - 0x1c]
imul dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
call fcn.004a439c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a918
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0041113c
test eax, eax
je 0x40a943
test ebx, ebx
je 0x40a943
cmp word [ebx], 0
je 0x40a943
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x40ad8c
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0041113c
test eax, eax
je 0x40adae
test ebx, ebx
je 0x40adae
cmp word [ebx], 0
je 0x40adae
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
pop esi
pop ebx
ret

Function at 0x40adb8
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.0041113c
test eax, eax
je 0x40ade5
test ebx, ebx
je 0x40ade5
cmp word [ebx], 0
je 0x40ade5
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x40adf4
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x40af50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9b0
push ebx
push esi
push edi
mov edi, eax
mov eax, 0x4abee0
call fcn.004a0204
mov word [ebp - 0x30], 8
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.0040fcbc
inc dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov word [ebp - 0x30], 0x14
mov word [ebp - 0x30], 0x20
mov edx, 0x10000
call fcn.00402aa8
inc dword [ebp - 0x24]
or esi, 0xffffffff
mov word [ebp - 0x30], 0x14
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov eax, edi
call fcn.0040a25c
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
cmp dword [0x4cfe40], 0
je 0x40afe6
lea eax, [ebp - 0x250]
call fcn.004781fc
push pe_nt_image_headers32
lea edx, [ebp - 0x450]
push edx
push dword [0x4cfe40]
call sub.USER32.DLL_GetWindowTextA
push 0
push 0
xor edx, edx
mov eax, edi
call fcn.00409f94
jmp 0x40b096
add dword [ebp - 0x48], 1
adc dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
and eax, 0xf
xor edx, edx
cmp edx, 0
jne 0x40b070
cmp eax, 0
jne 0x40b070
cmp dword [0x4cfe40], 0
je 0x40b06b
push 0
push 0x10000
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
call fcn.004a439c
push edx
push eax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.0040fb80
push eax
mov eax, 0x51e
call fcn.00413388
push eax
lea edx, [ebp - 0x650]
push edx
call fcn.004a2e18
add esp, 0xc
lea eax, [ebp - 0x650]
call fcn.0047820c
call fcn.004774b8
call fcn.00410b54
mov ecx, ebx
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00411a00
cmp dword [ebp + 0xc], 0x80000000
mov esi, eax
jne 0x40b08b
cmp dword [ebp + 8], 0
je 0x40b096
mov eax, ebx
cdq
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0x80000000
jne 0x40b0ac
cmp dword [ebp + 8], 0
jne 0x40b0ac
mov ecx, 0x10000
jmp 0x40b0cb
cmp dword [ebp + 0xc], 0
jne 0x40b0bd
cmp dword [ebp + 8], 0x10000
jbe 0x40b0c6
jmp 0x40b0bf
jle 0x40b0c6
mov ecx, 0x10000
jmp 0x40b0cb
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [ebp - 0x1c]
mov eax, edi
call fcn.00409e1c
mov ebx, eax
test eax, eax
jne 0x40aff8
cmp dword [0x4cfe40], 0
je 0x40b103
lea eax, [ebp - 0x250]
call fcn.0047820c
lea eax, [ebp - 0x450]
call fcn.004781d0
call fcn.004774b8
mov eax, esi
mov edx, 2
xor eax, 0xffffffff
push eax
lea eax, [ebp - 0x1c]
dec dword [ebp - 0x24]
call fcn.004017f0
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040fd28
pop eax
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b140
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.0041113c
test eax, eax
je 0x40b1a7
test ebx, ebx
je 0x40b16d
cmp word [ebx], 0
jne 0x40b177
test esi, esi
je 0x40b1a7
cmp word [esi], 0
je 0x40b1a7
lea ecx, [ebp - 0x1004]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0040dd30
push eax
lea ecx, [ebp - 0x804]
mov edx, ebx
mov eax, edi
call fcn.0040dd30
push eax
call sub.KERNEL32.DLL_MoveFileW
test eax, eax
setne al
and eax, 1
jmp 0x40b1b8
push dword [ebp - 4]
push edi
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b2c4
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3b8
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0041113c
test eax, eax
je 0x40b381
test ebx, ebx
je 0x40b381
cmp word [ebx], 0
je 0x40b381
xor esi, esi
push 0x4abdc0
call sub.KERNEL32.DLL_GetModuleHandleA
test eax, eax
je 0x40b30f
push 0x4abdcc
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
test esi, esi
jne 0x40b31a
xor eax, eax
jmp 0x40b3e9
lea edx, [ebp - 0x804]
mov eax, ebx
call fcn.0040ae48
lea eax, [ebp - 0x804]
call fcn.00411474
mov word [ebp + eax*2 - 0x802], 0
push 0x1e
push 0
lea edx, [ebp - 0x824]
push edx
call fcn.0049fc54
mov dword [ebp - 0x820], 3
mov word [ebp - 0x814], 0x54
add esp, 0xc
lea ecx, [ebp - 0x804]
mov dword [ebp - 0x81c], ecx
lea eax, [ebp - 0x824]
push eax
call esi
test eax, eax
sete al
and eax, 1
jmp 0x40b3e9
lea edx, [ebp - 0xc28]
mov eax, esi
call fcn.0040adf8
lea edx, [ebp - 0xc28]
push edx
call fcn.0049fe04
pop ecx
mov byte [ebp + eax - 0xc27], 0
push 0x1e
push 0
lea ecx, [ebp - 0xc48]
push ecx
call fcn.0049fc54
mov dword [ebp - 0xc44], 3
mov word [ebp - 0xc38], 0x54
add esp, 0xc
lea eax, [ebp - 0xc28]
mov dword [ebp - 0xc40], eax
lea edx, [ebp - 0xc48]
push edx
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c07c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40c085
mov eax, dword [ebp - 4]
add esp, 0xfffffb08
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edi, [ebp - 0x20fc]
mov eax, 0x4ac0b0
call fcn.004a0204
lea eax, [ebp - 0x10e8]
call fcn.00414bf8
lea eax, [ebp - 0x10bc]
call fcn.00414bf8
lea eax, [ebp - 0x1090]
call fcn.00414bf8
push 0
lea ecx, [ebp - 0x1cfc]
mov edx, ebx
mov eax, esi
call fcn.00413c50
test al, al
jne 0x40c0f9
xor eax, eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
jmp 0x40c2ac
cmp byte [ebp - 0x1cfc], 0
je 0x40c10b
cmp byte [ebp - 0x1064], 0
jne 0x40c11f
xor eax, eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
jmp 0x40c2ac
lea eax, [ebp - 0x1cfc]
call fcn.0040c4d0
lea edx, [ebp - 0x1064]
call fcn.0040fdc0
test eax, eax
je 0x40c14f
mov eax, esi
call fcn.0040c4d0
lea edx, [ebp - 0x1064]
call fcn.0040fdc0
test eax, eax
je 0x40c163
xor eax, eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
jmp 0x40c2ac
xor ebx, ebx
mov eax, edi
mov ecx, 0x400
mov edx, esi
call fcn.0040ffdc
push ebx
push str.rtmp_d
mov eax, edi
call fcn.0040c4d0
push eax
call fcn.004a2e18
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.0040a918
test al, al
je 0x40c1a1
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x40c165
mov eax, edi
xor edx, edx
call fcn.0040a918
test al, al
je 0x40c1c2
xor eax, eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
jmp 0x40c2ac
lea eax, [ebp - 0x24fc]
mov ecx, 0x400
mov edx, esi
call fcn.0040ffdc
lea eax, [ebp - 0x1cfc]
call fcn.0040c4d0
push eax
lea eax, [ebp - 0x24fc]
call fcn.0040c4d0
push eax
call fcn.0049fdd4
add esp, 8
push edi
lea edx, [ebp - 0x24fc]
push edx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x40c219
xor eax, eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
jmp 0x40c2ac
mov word [ebp - 0xc34], 8
lea eax, [ebp - 0xc20]
call fcn.00409724
inc dword [ebp - 0xc28]
mov word [ebp - 0xc34], 0x14
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.0040a918
test al, al
jne 0x40c25e
push 1
lea eax, [ebp - 0xc20]
xor ecx, ecx
mov edx, esi
call fcn.00409994
mov ebx, eax
lea eax, [ebp - 0x24fc]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x40c285
lea eax, [ebp - 0xc20]
call fcn.00409af8
lea eax, [ebp - 0xc20]
call fcn.00409b88
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0xc20]
dec dword [ebp - 0xc28]
call fcn.004097d4
pop eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cb34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
call sub.SHELL32.DLL_SHGetMalloc
mov byte [esi], 0
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x1a
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
test eax, eax
jne 0x40cba9
push esi
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
test eax, eax
je 0x40cba9
cmp byte [esi], 0
je 0x40cba9
mov eax, esi
call fcn.0040ca00
push 0x4ac132
push esi
call fcn.0049fcf8
add esp, 8
xor edx, edx
mov eax, esi
call fcn.0040a918
test al, al
jne 0x40cba4
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.0040a440
test eax, eax
je 0x40cba4
xor ebx, ebx
jmp 0x40cba9
mov ebx, 1
test bl, bl
jne 0x40cbc1
push 0x400
push esi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov eax, esi
call fcn.0040cad0
push dword [ebp - 8]
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x40cbd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
mov byte [ebx], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareWinRARPaths
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x40cc22
mov dword [ebp - 8], 0x400
lea edx, [ebp - 8]
lea ecx, [ebp - 0xc]
push edx
push ebx
push ecx
push 0
push str.AppData
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
cmp byte [ebx], 0
je 0x40cc34
xor edx, edx
mov eax, ebx
call fcn.0040a918
test al, al
jne 0x40cc3b
mov eax, ebx
call fcn.0040cb34
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410b54
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x4ad03c], 0
jne 0x410b6d
call fcn.004a82c8
mov dword [0x4ad038], eax
inc byte [0x4ad03c]
call fcn.004a82c8
sub eax, dword [0x4ad038]
cmp eax, 0x64
jle 0x410ba9
cmp dword [0x4d27e4], 0
je 0x410ba4
mov eax, 0x4bb2e4
mov edx, 0xff
call fcn.0042ecec
mov eax, 0x4bb2e4
mov edx, 0xff
call fcn.0042ecd4
call fcn.00480728
cmp dword [0x4ad034], 0
je 0x410bbd
push dword [0x4ad034]
call sub.KERNEL32.DLL_Sleep
ret
Function at 0x4110dc
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x411129
lea edx, [ebp - 0x10]
push edx
push str.SeShutdownPrivilege
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [ebp - 4]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
push 0x80000000
push 0xd
call sub.USER32.DLL_ExitWindowsEx
mov esp, ebp
pop ebp
ret

Function at 0x411a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0x4bd234
mov dword [ebp - 4], edx
mov esi, ecx
cmp dword [edi + 4], 0
mov ebx, eax
jne 0x411a20
call fcn.004119c8
mov eax, dword [ebp - 4]
jmp 0x411a39
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x411a41
test al, 7
jne 0x411a25
cmp esi, 8
jb 0x411aca
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x411a4a
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp esi, dword [ebp - 8]
jbe 0x411af4
mov ecx, dword [ebp - 8]
mov edx, ebx
shr ebx, 8
xor dl, byte [eax + ecx]
and edx, 0xff
mov ecx, dword [edi + edx*4]
xor ecx, ebx
mov ebx, ecx
inc dword [ebp - 8]
cmp esi, dword [ebp - 8]
ja 0x411ad4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x411bcc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
xor edx, dword [eax + 0x204]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
xor edx, dword [eax + 0x208]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ecx + 8]
mov edx, dword [edx + 0xc]
xor ebx, dword [eax + 0x20c]
xor edx, dword [eax + 0x210]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov ecx, edx
mov esi, edx
shr esi, 0x15
shl ecx, 0xb
or ecx, esi
mov esi, dword [ebp - 0x18]
and esi, 3
add ecx, ebx
xor ecx, dword [eax + esi*4 + 0x204]
mov edi, ecx
mov esi, ecx
shr edi, 8
and esi, 0xff
and edi, 0xff
movzx esi, byte [eax + esi + 0x104]
movzx edi, byte [eax + edi + 0x104]
shl edi, 8
or esi, edi
mov edi, ecx
shr edi, 0x10
shr ecx, 0x18
and edi, 0xff
and ecx, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl edi, 0x10
shl ecx, 0x18
or esi, edi
or esi, ecx
mov ecx, ebx
xor esi, dword [ebp - 8]
mov dword [ebp - 0x10], esi
mov esi, ebx
shr esi, 0xf
shl ecx, 0x11
or ecx, esi
mov esi, dword [ebp - 0x18]
and esi, 3
xor ecx, edx
add ecx, dword [eax + esi*4 + 0x204]
mov edi, ecx
mov esi, ecx
shr edi, 8
and esi, 0xff
and edi, 0xff
movzx esi, byte [eax + esi + 0x104]
movzx edi, byte [eax + edi + 0x104]
shl edi, 8
or esi, edi
mov edi, ecx
shr edi, 0x10
shr ecx, 0x18
and edi, 0xff
and ecx, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl edi, 0x10
shl ecx, 0x18
or esi, edi
or esi, ecx
xor esi, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edx
mov ecx, esi
mov edx, ecx
mov ebx, dword [ebp - 0x10]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x20
jl 0x411c18
mov ecx, dword [ebp - 0x14]
xor ebx, dword [eax + 0x204]
mov dword [ecx], ebx
xor edx, dword [eax + 0x208]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor edx, dword [eax + 0x20c]
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
xor edx, dword [eax + 0x210]
mov dword [ecx + 0xc], edx
mov edx, dword [ebp - 4]
call fcn.00411f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret