joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012e4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
call fcn.0040128c
test eax, eax
jne 0x4012f8
xor eax, eax
pop esi
pop ebx
ret
jmp loc.0041f547

Function at 0x401b44
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ecx, edx
sub ecx, 4
lea ebx, [ecx + eax]
cmp edx, 0x10
jl 0x401b61
mov dword [ebx], 0x80000007
mov edx, ecx
call fcn.00401d00
pop ebx
ret
cmp edx, 4
jl 0x401b72
mov ecx, edx
jmp loc.0041f41f
pop ebx
ret

Function at 0x401c30
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
xor edi, edi
mov eax, dword [ebx]
test eax, 0x80000000
je 0x401c4b
and eax, 0x7ffffffc
add edi, eax
add ebx, eax
mov eax, dword [ebx]
test al, 2
jne 0x401c62
mov esi, ebx
mov eax, esi
call fcn.00401ac0
mov eax, dword [esi + 8]
add edi, eax
jmp 0x41b674
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x401d00
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
mov ebx, edi
mov dword [ebx + 8], esi
mov eax, ebx
add eax, esi
sub eax, 0xc
mov dword [eax + 8], esi
cmp esi, 0x1000
jg 0x401d4e
mov edx, esi
shr edx, 2
mov eax, dword [0x40c474]
mov eax, dword [eax + edx*4 - 0xc]
test eax, eax
jne 0x401d40
mov eax, dword [0x40c474]
mov dword [eax + edx*4 - 0xc], ebx
mov dword [ebx + 4], ebx
mov dword [ebx], ebx
jmp 0x401d7a
mov edx, dword [eax]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
jmp 0x401d7a
cmp esi, 0x3c00
jl 0x401d63
mov edx, esi
mov eax, edi
call fcn.00401c68
test al, al
jne 0x401d7a
mov eax, dword [0x40c468]
mov dword [0x40c468], ebx
mov edx, dword [eax]
mov dword [ebx + 4], eax
mov dword [ebx], edx
jmp 0x41ce96
pop edi
pop esi
pop ebx
ret

Function at 0x402684
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
mov eax, ecx
cmp edi, esi
jg 0x4026a3
je 0x4026c1
sar ecx, 2
js 0x4026c1
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
lea esi, [esi + ecx - 4]
lea edi, [edi + ecx - 4]
sar ecx, 2
js 0x4026c1
std
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
jmp loc.0041c5d2
pop edi
pop esi
ret

Function at 0x4026c4
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_GetSystemTime
movzx eax, word [ebp - 0x10]
imul eax, eax, 0x3c
add ax, word [ebp - 0xe]
imul eax, eax, 0x3c
jmp loc.0041ba2f

Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x402924
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je fcn.0040292f
mov ecx, dword [eax]
jmp loc.0041b5a3

Function at 0x402b28
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [section.DATA], 0
je 0x402b47
push eax
push eax
push edx
push esp
push 2
push 0
push 0xeedfad4
jmp loc.0041c33a
ret
Function at 0x402b70
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [section.DATA], 1
jbe 0x402b80
push eax
push ebx
jmp loc.0041cdc4
ret

Function at 0x403094
Capabilities:
Packed with generic packer

Disassembly:
xor edx, edx
lea eax, [ebp - 0xc]
jmp loc.0041b9b1

Function at 0x40310c
Capabilities:
Packed with generic packer
Set thread local storage value

Disassembly:
push ebx
cmp dword [0x40c3d0], 0
jge 0x403120
mov eax, 0xe2
call fcn.00403e41
push 8
push 0x40
call sub.kernel32.dll_LocalAlloc
mov ebx, eax
test ebx, ebx
jne 0x40313e
mov eax, 0xe2
call fcn.00403e41
jmp 0x40314a
push ebx
mov eax, dword [0x40c3d0]
push eax
jmp 0x41d9c2
mov dword [0x40c48c], ebx
pop ebx
ret

Function at 0x403154
Capabilities:
Get thread local storage value

Disassembly:
mov cl, byte [0x40c030]
jmp loc.0041d031

Function at 0x403198
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [eax]
test edx, edx
je fcn.004031b7
mov dword [eax], 0
mov ecx, dword [edx - 8]
dec ecx
jl fcn.004031b7
mov dword [edx - 8], ecx
jne fcn.004031b7
lea eax, [edx - 8]
jmp loc.0041bd77

Function at 0x4031e8
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x40320f
mov ecx, dword [edx - 8]
inc ecx
jg 0x40320c
push eax
push edx
mov eax, dword [edx - 4]
call fcn.00403254
mov edx, eax
pop eax
push edx
mov ecx, dword [eax - 4]
call fcn.00402684
pop edx
pop eax
jmp 0x40320f
mov dword [edx - 8], ecx
xchg dword [eax], edx
test edx, edx
je 0x403228
mov ecx, dword [edx - 8]
dec ecx
jl 0x403228
mov dword [edx - 8], ecx
jne 0x403228
lea eax, [edx - 8]
jmp 0x41c367
ret

Function at 0x403420
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x403451
mov ecx, dword [edx - 8]
dec ecx
je 0x403451
push ebx
mov ebx, eax
mov eax, dword [edx - 4]
jmp loc.0041fa6e
mov eax, edx
ret

Function at 0x403454
Capabilities:
Packed with generic packer

Disassembly:
push ebx
test eax, eax
je 0x403486
mov ebx, dword [eax - 4]
test ebx, ebx
je 0x403486
dec edx
jl 0x40347e
cmp edx, ebx
jge 0x403486
sub ebx, edx
test ecx, ecx
jl 0x403486
cmp ecx, ebx
jg 0x403482
add edx, eax
mov eax, dword [esp + 8]
call fcn.00403278
jmp 0x40348f
xor edx, edx
jmp 0x403467
mov ecx, ebx
jmp 0x403471
mov eax, dword [esp + 8]
jmp 0x41d99b
pop ebx
ret 4

Function at 0x4034f0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
xor edi, edi
test edx, edx
je 0x403545
mov eax, dword [ebx]
test eax, eax
je 0x403526
cmp dword [eax - 8], 1
jne 0x403526
jmp loc.0041f57f
mov eax, edx
call fcn.00403254
mov edi, eax
mov eax, dword [ebx]
test eax, eax
je 0x403545
mov edx, edi
mov ecx, dword [eax - 4]
cmp ecx, esi
jl 0x403540
mov ecx, esi
call fcn.00402684
mov eax, ebx
call fcn.00403198
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret

Function at 0x403554
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
push ebx
mov cl, byte [edx + 1]
push esi
push edi
mov ebx, eax
lea esi, [edx + ecx + 0xa]
mov edi, dword [edx + ecx + 6]
mov eax, dword [esi + 4]
mov edx, dword [esi]
add eax, ebx
jmp loc.0041fc6e
Function at 0x4038b4
Capabilities:
Encode data using xor

Disassembly:
mov dl, al
cmp eax, 0x70c8561f
mov ebx, 0xd819b020
xor eax, 0x8baddbe9
cdq
push eax
push 0xffffffffffffffc6
mov bh, 0xc2
push ecx
xor al, 0xaa
lahf
js 0x4037e8
fld xword [di + 0x158b]
inc esp
mov byte [0x4b50aa1c], al
invalid
sbb al, 0x11
push eax
mov ebx, 0x51c2b7c6
xor al, 0xaa
lahf
js 0x40384c
fld xword [di + 0x158b]
inc esp
mov byte [0xe650ab1c], al
invalid

Function at 0x4039a4
Capabilities:
Packed with generic packer

Disassembly:
cmp word [edx], 0x100
jne 0x4039b3
mov edx, dword [edx + 8]
jmp fcn.004031e8
push ebx
mov ebx, eax
sub esp, 0x10
mov word [esp], 0
mov eax, esp
mov ecx, pe_nt_image_headers32
call fcn.004038b4
mov eax, ebx
call fcn.00403198
mov eax, dword [esp + 8]
mov dword [ebx], eax
add esp, 0x10
pop ebx
ret

Function at 0x403c25
Capabilities:
Packed with generic packer

Disassembly:
lea ecx, [eax + 0x14c]
mov dword [eax + 0x14], ecx
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], FormatMessageA
jmp loc.004200bf

Function at 0x403f67
Capabilities:
Packed with generic packer

Disassembly:
mov edx, 0x40b078
mov ecx, 2
call fcn.00403e9c
jmp loc.0041ffbd

Function at 0x4042e8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x40438a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x40c3d0]
shl eax, 2
mov dword [0x40c3d4], eax
xor eax, eax
mov dword [0x40c020], eax
xor eax, eax
mov dword [0x40c024], eax
xor eax, eax
mov dword [0x40c028], eax
call fcn.00403154
xor edx, edx
mov dword [eax + 4], edx
xor eax, eax
mov dword [0x40c02c], eax
mov byte [0x40c033], 2
mov byte [0x40c034], 2
mov byte [0x40c035], 3
mov word [0x40c3dc], 0
mov word [0x40c3ec], 1
call fcn.0040285c
mov eax, 0x40c038
mov edx, 0x404398
call fcn.00403c25
mov eax, 0x40c204
jmp loc.0041fe2b

Function at 0x404c20
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
jmp loc.0041fb1b

Function at 0x404d2c
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
mov esi, edx
mov edi, eax
mov edx, ecx
cmp edi, esi
jg 0x404d49
je 0x404d65
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
jmp loc.0041c723
lea esi, [esi + ecx - 1]
lea edi, [edi + ecx - 1]
and ecx, 3
std
rep movsb byte es:[edi], byte [esi]
sub esi, 3
sub edi, 3
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
cld
pop edi
pop esi
ret

Function at 0x405010
Capabilities:
Packed with generic packer

Disassembly:
and al, 0xdf
mov cl, al
mov eax, 1
mov ebx, dword [ebp - 8]
cmp ebx, dword [ebp + 8]
ja 0x404fdb
jmp loc.0041f96c
xor eax, eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
sub ecx, edx
call fcn.00404df4
cmp cl, 0x44
je 0x404ffe
cmp cl, 0x55
je 0x405010
cmp cl, 0x58
jne 0x404fd9
mov ecx, 0x10
jmp fcn.00405015
or eax, eax
jns 0x405010
neg eax
call 0x405010
mov al, 0x2d
inc ecx
dec esi
mov byte [esi], al
ret
jmp loc.0041e617

Function at 0x405160
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esi
jmp loc.0041e155
Function at 0x40520c
Capabilities:
Get geographical location
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
jmp loc.0041e407

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x405280
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4053b6
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetSystemDefaultLCID
mov dword [ebp - 8], eax
mov ebx, 1
mov esi, 0x40c4bc
jmp loc.0041b000

Function at 0x4056d8
Capabilities:
Packed with generic packer

Disassembly:
inc dword [0x20000000]
inc ecx
dec ebp
push eax
dec ebp
add byte [eax], al
add bh, bh
invalid
mov dword [ecx], eax
add byte [ebx + 0xb8], al
cmp dword [eax], 0
je 0x4056c9
jmp loc.0041dfe9
in eax, dx
cli
hlt
arpl si, ax
loop 0x40571e
invalid
lcall 0x9b12, 0xd09760f
dec ebp
loope 0x405683
nop
xchg esp, eax
pop ebp
inc eax
aad 0x5e
mov ebp, 0x9ea1c5ae
ret
mov ch, 0xe6
jns 0x4056ae
sbb dword [edi - 0x1cf81128], edi
enter 0xffffffffffffdd04, 0xffffffffffffffd7
inc edi
pop ecx
mov al, 0x74
shl dword [eax], 1
cmpsd dword [esi], dword es:[edi]
jo 0x4056e6
sub cl, byte [ecx + 0x56]
popal
ror byte [eax - 0x2c], 0xa9
mul byte [ebx - 0x48f97b2a]
cmp esi, 0xa257cb21
mov edx, 0x1dd9628b
invalid

Function at 0x4058c4
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4058d8
add esp, 0xfffffff0
call fcn.00402ac8
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x40591e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.00405194
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
jmp loc.0041fa2e
Function at 0x4059b0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4059c6
add esp, 0xfffffff0
call fcn.00402ac8
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x405a1c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00404cdc
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00405194
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.004031e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a23
lea eax, [ebp - 8]
mov edx, 2
call 0x919b93d5
sub edi, dword [ebx + 0x5aff58c8]
xor ebx, edx
push 0x6b9ed1bb
mov edi, 0x1ab00322
pop ecx
xor edi, ecx
xor edi, ebx
mov ebx, 0
xor ebx, edi
add ebx, 0xffffffff
mov eax, dword [ebx + 1]
mov esi, 0
mov edi, 0
xor esi, edi
push esi
mov edi, 0
xor edi, esp
mov ecx, edi
add esp, 0xfffffffc
mov dword [esp], ecx
mov ecx, 0x384415c7
xor ecx, 0x38441587
push ecx
mov ebx, 0x9d64
add ebx, 0x9c
push ebx
push 0x3ab815b6
mov ebx, 0x3af805b6
pop ecx
xor ebx, ecx
push ebx
call eax
pop eax
mov ecx, 0x5e5b8a7f
add ecx, 0x31
push ecx
push 0x6dd90e3f
mov esi, 0x33c2d230
pop edi
xor esi, edi
pop edx
xor esi, edx
mov ecx, 0x73d9efc1
xor ecx, 0x7b60166a
mov ebx, 0xb7f9001
xor ebx, 0x3c66a8b
xor ebx, ecx
mov edi, 0x7647b3e8
mov edx, 0xa18c41e
xor edx, edi
mov ecx, 0x340e3bc3
xor ecx, 0x4811754b
xor ecx, edx
mov edi, 0xfffffffc
add esp, edi
push esp
pop edx
mov dword [edx], ebx
jmp loc.0041f3a3

Function at 0x405a17
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4059c6
add esp, 0xfffffff0
call fcn.00402ac8
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x405a1c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00404cdc
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00405194
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.004031e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a23
lea eax, [ebp - 8]
mov edx, 2
call 0x919b93d5
sub edi, dword [ebx + 0x5aff58c8]
xor ebx, edx
push 0x6b9ed1bb
mov edi, 0x1ab00322
pop ecx
xor edi, ecx
xor edi, ebx
mov ebx, 0
xor ebx, edi
add ebx, 0xffffffff
mov eax, dword [ebx + 1]
mov esi, 0
mov edi, 0
xor esi, edi
push esi
mov edi, 0
xor edi, esp
mov ecx, edi
add esp, 0xfffffffc
mov dword [esp], ecx
mov ecx, 0x384415c7
xor ecx, 0x38441587
push ecx
mov ebx, 0x9d64
add ebx, 0x9c
push ebx
push 0x3ab815b6
mov ebx, 0x3af805b6
pop ecx
xor ebx, ecx
push ebx
call eax
pop eax
mov ecx, 0x5e5b8a7f
add ecx, 0x31
push ecx
push 0x6dd90e3f
mov esi, 0x33c2d230
pop edi
xor esi, edi
pop edx
xor esi, edx
mov ecx, 0x73d9efc1
xor ecx, 0x7b60166a
mov ebx, 0xb7f9001
xor ebx, 0x3c66a8b
xor ebx, ecx
mov edi, 0x7647b3e8
mov edx, 0xa18c41e
xor edx, edi
mov ecx, 0x340e3bc3
xor ecx, 0x4811754b
xor ecx, edx
mov edi, 0xfffffffc
add esp, edi
push esp
pop edx
mov dword [edx], ebx
jmp loc.0041f3a3
Function at 0x405cf4
Capabilities:
Check os version
Packed with generic packer

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je fcn.00405d14
mov eax, dword [esp + 0x10]
jmp loc.0041e4ef

Function at 0x406638
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x406665
mov eax, ebx
jmp loc.0041fbfd
mov eax, esi
mov edx, ebx
call fcn.0040322c
pop esi
pop ebx
ret

Function at 0x406680
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov al, byte [ebx + esi - 1]
push eax
call sub.kernel32.dll_IsDBCSLeadByte
test eax, eax
je 0x4066a7
mov eax, ebx
jmp loc.0041c7ef
mov eax, 1
pop esi
pop ebx
ret

Function at 0x406888
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
mov edi, edx
mov esi, eax
push esp
lea eax, [esp + 8]
push eax
push 0x1000
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_GetFullPathNameA
mov ebx, eax
test ebx, ebx
jle 0x4068ce
cmp ebx, 0x1000
jge 0x4068ce
lea edx, [esp + 4]
mov eax, edi
mov ecx, ebx
jmp loc.0041f9ee
mov eax, edi
mov edx, esi
call fcn.0040322c
add esp, 0x1004
pop edi
pop esi
pop ebx
ret

Function at 0x406950
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
jne 0x40695b
xor eax, eax
pop ebx
ret
mov eax, ebx
jmp loc.0041fcbe

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
jmp loc.0041d22c

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404de0
add esp, 0x104
pop ebx
ret

Function at 0x406e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406f48
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
jmp loc.0041ecaf
Function at 0x406fa0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push edx
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x407012
push dword fs:[eax]
mov dword fs:[eax], esp
fnstcw word [ebp - 2]
xor eax, eax
push ebp
push 0x406ff4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
jmp loc.0041ec79

Function at 0x407284
Capabilities:
Packed with generic packer

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, edx
push 0
push 0x400
lea edx, [esp + 8]
push edx
push 0
push eax
push 0
jmp loc.0041db65

Function at 0x4073ec
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x407461
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00407284
cmp dword [ebp - 4], 0
jne 0x407434
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], ebx
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x407478
call fcn.00405194
jmp loc.0041f2a9

Function at 0x4074a0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
mov edx, edi
mov ecx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 8]
cmp esi, eax
je fcn.004074c4
mov edx, 0x26
mov eax, dword [ebx]
jmp loc.0041d974

Function at 0x4076ac
Capabilities:
Clear file content
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_SetEndOfFile_1
test eax, eax
jne fcn.004076c3
mov eax, dword [ebx]
jmp loc.0041bdb5

Function at 0x407c5c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov esi, eax
xor eax, eax
mov dword [esp], eax
mov ebp, edx
test edi, edi
jle 0x407caf

Function at 0x407e2c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov edx, esi
mov ecx, edi
mov eax, ebx
call fcn.00405194
mov eax, dword [ebp - 4]
jmp loc.0041fb9a

Function at 0x407eb8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
test eax, eax
je fcn.00407ed9
push 0x8000
push 0
push eax
call sub.kernel32.dll_VirtualFree_1
jmp loc.0041b84c

Function at 0x4080c4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
xor eax, eax
push esi
mov dword [ebx + 4], eax
xor edx, edx
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebx + 0x18], edx
mov dword [ebx + 0xc], ecx
mov dword [ebx + 8], 0xffffffff
xor esi, esi
mov eax, ebx
call fcn.00408084
jmp loc.0041c3c1
Function at 0x408104
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov eax, dword [esp]
xor ebp, ebp
mov edi, edx
test edi, edi
mov ebx, dword [eax + 8]
mov eax, dword [esp]
mov esi, dword [eax + 0xc]
je 0x408150

Function at 0x408274
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
jmp loc.0041e6df

Function at 0x408aa8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], ecx
mov ebx, eax
cmp edx, 0x50
je 0x408abe
mov eax, 1
jmp 0x408af0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040838c
test eax, eax
jne 0x408af0
mov ecx, dword [ebx]
mov edx, 0x300
add ecx, dword [ebx + 4]
shl edx, cl
mov ecx, dword [ebp + 0xc]
add edx, 0x736
add edx, edx
mov dword [ecx], edx
mov edx, dword [ebp + 8]
jmp 0x41c655
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x408da8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x40c95c]
jmp loc.0041fc46

Function at 0x408dd8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push edi
mov dword [esp + 4], esi
lea edx, [esp + 4]
xor ecx, ecx
mov eax, ebx
jmp loc.0041b31a

Function at 0x408f38
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x408f64
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x40b208
jmp loc.0041b260

Function at 0x408fac
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [eax], 0
je fcn.00408fbb
mov eax, dword [eax + 4]
push eax
jmp loc.0041cb78

Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409034
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x409054
mov byte [ebp - 1], 0
jmp 0x40909a
xor eax, eax
push ebp
push 0x40908a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
jmp loc.0041fd27
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret