joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004ef6b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x1004ef81
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x1004ef92
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.1004efd3
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx

Function at 0x1005133f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x10051288
add ebx, 0
push ecx
call 0x1005129d
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x72eea350
sub ebx, dword [0x72f09b8f]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x72f09b7f
call fcn.1004cd67
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.1004c275
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x100513fb
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x100513fb
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x100513b2
mov eax, 1
lock xchg dword [0x72f09b8b], eax
push 0x3dd1fc71
call 0x1005133f
push esi
add esp, 8
cmp eax, 0
jne 0x10051328
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x1005134e
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x10051363
cmp ecx, edx
cmp eax, 0
je 0x10051388
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x10051372
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.100513a1
dec eax
loope 0x100513a4
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x72f09b8b], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x100513d8
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x100513ed
jmp 0x100513f8
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x100512e6
Function at 0x10058460
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x10058736
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x72ef6803
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x72eed7c9
push 0xffffffffffffffff
call fcn.1004f660
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x100584ca
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.100584e2
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x1005872a
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x100586fe
Function at 0x10067f30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10067f52
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10067f52
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10067f52
ret
cmp word [ebx + 4], 0x14c
jne 0x10067f52
test word [ebx + 0x16], 2
je 0x10067f52
test word [ebx + 0x16], 0x100
je 0x10067f52
cmp word [ebx + 0x18], 0x10b
jne 0x10067f52
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10067f52
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10067fde
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10067f72
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1004eebd
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10067f52
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x10067fde
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10067f52
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10067f52
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10067f52
ret
cmp word [ebx + 4], 0x14c
jne 0x10067f52
test word [ebx + 0x16], 2
je 0x10067f52
test word [ebx + 0x16], 0x100
je 0x10067f52
cmp word [ebx + 0x18], 0x10b
jne 0x10067f52
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10067f52
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10067fde
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10067f72
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1004eebd
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10067f52
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x10068095
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100680ee
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10068095
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100680a4
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1046dd47
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100680f5
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1004ef6b
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10068194
add edi, 4
add eax, 2
dec ecx
jne 0x100680da
call 0x10068141
loope 0x10068137
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10068191
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100681a2
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10068155
cmp eax, ecx
ja 0x10068155
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100681df
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100681d5
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1004f44a
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x100680a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100680ee
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10068095
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100680a4
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1046dd47
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100680f5
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1004ef6b
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10068194
add edi, 4
add eax, 2
dec ecx
jne 0x100680da
call 0x10068141
loope 0x10068137
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10068191
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100681a2
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10068155
cmp eax, ecx
ja 0x10068155
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100681df
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100681d5
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1004f44a
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x406371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e86a
call fcn.0040d30f
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166e8]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4064e2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4064e2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4064e2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4064e2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40645b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4064d4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4064d4
mov ecx, 0x1234
cmp cx, ax
jne 0x4064d4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x4064ae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4063c9
mov eax, edi
call fcn.0040d2ca
ret 4

Function at 0x40ab42
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40ab51
pop dword [ebp - 0x3c]
mov eax, 0x47879dce
sub eax, 0x4746f27d
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3623d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x255bce93
add ecx, 0xdaa4705f
mov edx, eax
mov ebx, 0x41aa00
add ebx, dword [ebp - 0x3c]
mov edi, 0x17458c9b
xor dword [ebp - 0x2c], 0x4934ba16
mov esi, dword [ebx]
sub dword [ebp - 0x30], 0x44836fc5
add esi, edi
xor dword [ebp - 0x28], 0x8b05abe
mov dword [edx], esi
sub dword [ebp - 0xc], 0xab8c071e
add edx, 4
add ebx, 0x5e804fb8
sub ebx, 0x5e804fb4
loop 0x40ab9f
add eax, 0xa0d9053d
sub eax, 0xa0d816a2
xor ebx, ebx
add ebx, eax
add eax, 0x7cb95d01
add eax, 0x8346a304
mov ecx, 0xab21a8ae
sub ecx, 0xaae1a8ae
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
or al, 0xeb
inc ecx
push str...done_n
call dword [0x400164]
add esp, 6
mov eax, dword [0x410288]
test ecx, edx
je 0x401e28
inc esp
fist word [edi]
add byte [eax], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call 0x411cea
add esp, 4
pop edi
les eax, [edi + ebx*2]
bound ebx, qword [ebx - 0x75]
in eax, 0
jp 0x401e02
nop
lds edi, [eax + edx*4 - 0x70]
push esi
push ebp
mov ebp, esp
sub esp, 0x78
push esi
mov esi, dword [ebp + 0xc]
push esi
movsb byte es:[edi], byte [esi]
cdq
loop 0x401eb9
js 0x401ea1
push esi
call fcn.004086a4
dec bp
or byte [ebx - 0x3d3f37eb], cl
add byte [eax + 0x51], dl
add edx, 0x40
push 0x8d40b2ac
push edx
call dword [0xbf5680]
mov eax, dword [0xd802ac]
add esp, 0x14
test eax, eax
je 0x401e8c
push eax
push str.Total_of__d_requests_completed_n
call dword [sym.imp.MSVCRT.dll_strrchr]
xor eax, 0xff5608c4
adc eax, sym.imp.MSVCRT.dll_exit
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec ebx
loop 0x401e30
or eax, dword [ecx]
mov dword [0x41569e], edx
mov ebx, eax
rol dword [esi + 0x14], cl
lodsd eax, dword [esi]
fcom st(3)
inc esi
adc al, 0xad
or byte [ebx - 0x74bf8a06], cl
dec esi
add al, 0x6a
add al, dl
add byte [ecx - 0x18], dl
xchg esi, eax
insd dword es:[edi], dx
add byte [eax], al
fcomp qword [esi + 0x2508ec]
mov dword [edi], eax
cmp al, 8
aad 0
mov dword [esi + 0x59], 0
dec edi
adc eax, 0x7e4117ec
mov esp, eax
adc al, 0xa1
pushal
xchg ebp, eax
inc ecx
add byte [ebp - 0x5ee86f40], al
jo 0x401f04
inc ecx
add byte [ebx + 0x14c8c9ca], cl
dec esi
adc al, 0xeb
add ecx, dword [ebx + 0xbb388e]
mul byte [ecx + 0x40d028]
mov ecx, edx
leave
enter 0x4e14, 0x14
jmp 0x401f10
mov ebx, 0x28a1f600
rol byte [eax], 1
mov edx, dword [0x40d02c]
add ecx, eax
mov eax, dword [esi + 0x8cf]
loope 0x401ec3
cmp edi, eax
cmovnp esp, ebp
add byte [eax], al
add byte [eax + ecx + 0x3b], bh
nop
ja 0x5b402015
mov edx, dword [esi + 0x18]
mov ebx, dword [0x9f40d030]
mov eax, dword [esi + 4]
invalid

Function at 0x406dd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
test ah, ch
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp - 0x31]
push edi
mov edi, dword [ebp + 0x10]
test di, di
mov dword [esi + 0x10], ebx
mov word [esi + 0x28], bx
in al, 0xf
push edi
call dword [sym.imp.WS2_32.dll_WSARecv]
mov word [esi + 0x2a], ax
mov word [esi + 0xc], di
and eax, 2
jne 0x406e17
mov eax, 0x330010
mov dword [esi + 0x18], 0x640004
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], eax
rol dword [esi + 0x2c], cl
mov dword [esi + 0x20], eax
pop edi
pop esi
wait
pop ebp
ret
Function at 0x402a48
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404564
test esi, esi
jne 0x402a7e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404654
jmp 0x402a9c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040295c
mov edi, eax
test esi, esi
je 0x402a9c
cmp dword [ebx], 0
je 0x402a9c
dec esi
jmp 0x402a85
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4030ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x466008], 0x8088405
inc edx
mov dword [ebx + 0x466008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403628
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x466024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036c0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4036a0
xor eax, eax
push ebp
push 0x403699
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4036dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x466024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x466024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40436c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x468044], 0
je 0x4043cd
cmp word [0x468218], 0xd7b2
jne 0x404395
cmp dword [0x468220], 0
jbe 0x404395
mov eax, 0x468214
call dword [0x468230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x466094
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4043f4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x466034], 0
jne 0x4043e9
push 0
push 0x46608c
push 0x466094
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404520
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402714
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x468045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4044e8
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406138
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40619e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004047d4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004031ec
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406188
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4061a5
lea eax, [ebp - 0x10]
call fcn.00404564
ret

Function at 0x407c9c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a14
xor eax, eax
push ebp
push 0x407d7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404564
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404a24
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x407d64
mov eax, dword [ebp - 8]
mov edx, 0x73
call fcn.00404bb0
push 0
lea eax, [ebp - 0x10]
push eax
push 0x73
mov eax, dword [ebp - 8]
call fcn.00404a7c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, 0x407d90
call fcn.00404b68
test eax, eax
jne 0x407d3c
mov eax, dword [ebp - 8]
call fcn.00404564
jmp 0x407d64
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, 0x407d9c
call fcn.00404b68
mov ecx, eax
dec ecx
sub ecx, 0x50
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 0x51
call fcn.00404a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d81
lea eax, [ebp - 4]
call fcn.00404564
ret

Function at 0x407da0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a14
xor eax, eax
push ebp
push 0x407e55
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a24
push eax
call sub.kernel32.dll_OpenFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x407e37
lea eax, [ebp - 0x10]
mov edx, 0x186a0
call fcn.00404bb0
push 0
lea eax, [ebp - 0x14]
push eax
push 0x186a0
lea eax, [ebp - 0x10]
call fcn.00404a7c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x407e37
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 0x10]
mov eax, 0x407e6c
call fcn.00404b68
test eax, eax
jle 0x407e37
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e5c
lea eax, [ebp - 0x10]
call fcn.00404564
lea eax, [ebp - 4]
call fcn.00404564
ret
Function at 0x407e84
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a14
mov eax, dword [ebp - 8]
call fcn.00404a14
xor eax, eax
push ebp
push 0x407f0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 9]
xor al, 1
neg al
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00404a24
push eax
mov eax, dword [ebp - 4]
call fcn.00404a24
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
and al, byte [ebp + 0x10]
je 0x407ef1
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
call fcn.00408438
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f13
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404588
ret

Function at 0x407f88
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
xor edx, edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a14
xor eax, eax
push ebp
push 0x408142
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404824
cmp eax, 2
jl 0x40810f
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x154]
mov ecx, 0x408158
mov edx, dword [ebp - 4]
call fcn.00404870
mov eax, dword [ebp - 0x154]
call fcn.00404a24
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4080d6
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004047d4
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404870
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004047d4
test byte [ebp - 0x150], 0x10
je 0x40808e
mov eax, dword [ebp - 0x10]
mov edx, 0x408164
call fcn.00404970
je 0x4080be
mov eax, dword [ebp - 0x10]
mov edx, 0x408170
call fcn.00404970
je 0x4080be
lea eax, [ebp - 0x15c]
mov ecx, 0x40817c
mov edx, dword [ebp - 0xc]
call fcn.00404870
mov eax, dword [ebp - 0x15c]
call fcn.00407f88
jmp 0x4080be
mov eax, dword [ebp - 0xc]
call fcn.00404a24
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x4080be
push 0x20
mov eax, dword [ebp - 0xc]
call fcn.00404a24
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
call fcn.00404a24
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x40800d
mov eax, dword [ebp - 8]
push eax