joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a6fa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x80c], 0
and dword [ebp - 0x808], 0
xor eax, eax
mov word [ebp - 0x804], ax
push 0x7fe
push 0
lea eax, [ebp - 0x802]
push eax
call fcn.0043bad0
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x45a775
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 0x808]
call dword [sym.imp.SHELL32.dll_ILFree]
jmp 0x45a78b
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x804]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402a51
mov eax, dword [ebp - 0x80c]
or eax, 1
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a99c
mov esp, ebp
pop ebp
ret

Function at 0x45ca65
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
call fcn.0045c6ed
push 0
push 0
push dword [ebp - 4]
push 0x45c29f
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x50], eax
movzx eax, byte [ebp + 8]
test eax, eax
je 0x45caaa
mov ecx, dword [ebp - 4]
call fcn.0045c12a
jmp 0x45caac
mov al, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x45dc8f
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 1], 0
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
je 0x45dcb4
push 2
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0x10]
movzx eax, word [ecx + eax]
test eax, eax
jne 0x45dcff
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45dcfd
push 0x483a50
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x45dcea
mov dword [ebp - 0xc], 1
jmp 0x45dcee
and dword [ebp - 0xc], 0
mov al, byte [ebp - 0xc]
mov byte [ebp - 1], al
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x45dd48
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45dd48
push dword [ebp + 0x10]
push 0
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x45dd35
mov dword [ebp - 0x10], 1
jmp 0x45dd39
and dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov byte [ebp - 1], al
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x45dd4f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e873
mov eax, dword fs:[0]
push eax
mov eax, 0x102c
call fcn.0043baa0
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x1030], 0
and dword [ebp - 0x102c], 0
lea ecx, [ebp - 0x1028]
call fcn.00402f95
and dword [ebp - 4], 0
lea eax, [ebp - 0x102c]
push eax
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45de31
mov dword [ebp - 0x1038], 1
xor eax, eax
mov word [ebp - 0x1010], ax
push 0xffe
push 0
lea eax, [ebp - 0x100e]
push eax
call fcn.0043bad0
add esp, 0xc
mov dword [ebp - 0x1034], 0x800
lea eax, [ebp - 0x1034]
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1038]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x102c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45de25
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1028]
call fcn.0040c49d
push dword [ebp - 0x102c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1028]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402af6
mov eax, dword [ebp - 0x1030]
or eax, 1
mov dword [ebp - 0x1030], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1028]
call fcn.00402e75
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a99c
mov esp, ebp
pop ebp
ret
Function at 0x45e2b7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e904
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x50], 4
and dword [ebp - 0x44], 0
push str.Software_
lea ecx, [ebp - 0x28]
call fcn.00402a51
and dword [ebp - 4], 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
call fcn.0040c6a4
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x54]
push eax
push str.InstallLog
lea ecx, [ebp - 0x28]
call fcn.0040277e
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x44], 0
je 0x45e341
mov dword [ebp - 0x48], 1
jmp 0x45e345
and dword [ebp - 0x48], 0
mov al, byte [ebp - 0x48]
mov byte [ebp - 0x58], al
push dword [ebp - 0x58]
call fcn.00463d62
pop ecx
call fcn.0045e693
push 0xd0
call fcn.0043ae82
pop ecx
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x5c]
call fcn.00463d6f
mov dword [ebp - 0x4c], eax
jmp 0x45e37c
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x60]
mov dword [0x49b948], eax
push str.Common
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x40]
call fcn.0040d1a0
pop ecx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x68]
push 1
push 0
mov ecx, dword [0x49b948]
call fcn.00463ddb
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402e75
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402e75
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a99c
mov esp, ebp
pop ebp
ret
Function at 0x4651ce
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f25d
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x74]
call fcn.004659c7
push 1
push 3
lea ecx, [ebp - 0x138]
call fcn.00419121
and dword [ebp - 4], 0
lea eax, [ebp - 0x138]
push eax
call fcn.00467569
pop ecx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x138]
call fcn.004190a4
mov dword [ebp - 0x7c], eax
push dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x74]
add ecx, 0x24
call fcn.0040218f
lea ecx, [ebp - 0x28]
call fcn.00402e75
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, dword [ebp - 0x74]
mov word [ecx + 0x3c], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, dword [ebp - 0x74]
mov word [ecx + 0x3e], ax
push 0x24
lea eax, [ebp - 0x40]
push eax
call fcn.0045a6fa
pop ecx
pop ecx
mov dword [ebp - 0x80], eax
push dword [ebp - 0x80]
mov ecx, dword [ebp - 0x74]
add ecx, 0x40
call fcn.0040218f
lea ecx, [ebp - 0x40]
call fcn.00402e75
push 0x25
lea eax, [ebp - 0x58]
push eax
call fcn.0045a6fa
pop ecx
pop ecx
mov dword [ebp - 0x84], eax
push dword [ebp - 0x84]
mov ecx, dword [ebp - 0x74]
add ecx, 0x58
call fcn.0040218f
lea ecx, [ebp - 0x58]
call fcn.00402e75
lea eax, [ebp - 0x70]
push eax
call fcn.0045a089
pop ecx
mov dword [ebp - 0x88], eax
push dword [ebp - 0x88]
mov ecx, dword [ebp - 0x74]
add ecx, 0x70
call fcn.0040218f
lea ecx, [ebp - 0x70]
call fcn.00402e75
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
je 0x465314
mov eax, dword [ebp - 0x74]
add eax, 0x88
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x78]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.00418c6f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a99c
mov esp, ebp
pop ebp
ret
Function at 0x46749e
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x42d], 0
or dword [ebp - 0x434], 0xffffffff
push dword [ebp + 0xc]
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0xffffffff
jne 0x4674dd
xor al, al
jmp 0x46755b
mov dword [ebp - 0x42c], 0x428
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x46750e
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x46755b
mov ecx, dword [ebp + 0x10]
call fcn.0040277e
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.0044405b
pop ecx
pop ecx
test eax, eax
jne 0x467532
mov byte [ebp - 0x42d], 1
jmp 0x467549
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x46750e
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x42d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a99c
mov esp, ebp
pop ebp
ret
Function at 0x468685
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
push 2
pop eax
imul eax, eax, 0
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0x400
jae 0x4686b2
jmp 0x4686b7
call fcn.0043b216
xor eax, eax
mov ecx, dword [ebp - 0x41c]
mov word [ebp + ecx - 0x40c], ax
lea eax, [ebp - 0x40c]
push eax
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x468885
mov eax, dword [0x4864b4]
mov dword [ebp - 0xc], eax
mov ax, word [0x4864b8]
mov word [ebp - 8], ax
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x410], eax
cmp dword [ebp + 8], 0
je 0x468713
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x420], eax
jmp 0x46871a
and dword [ebp - 0x420], 0
push 0x4864ac
push 0x4864e0
push dword [ebp - 0x420]
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
push 2
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x410]
mov cx, word [ecx]
mov word [ebp + eax - 0xc], cx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x42c], eax
push 0
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
je 0x4687a5
push 0
push 0x40000000
push dword [ebp - 0x414]
push dword [ebp - 0x418]
call fcn.0043b480
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], edx
cmp dword [ebp + 8], 0
je 0x4687b9
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x424], eax
jmp 0x4687c0
and dword [ebp - 0x424], 0
push 0x4864bc
push 0x4864dc
push dword [ebp - 0x414]
push dword [ebp - 0x418]
push str.FreeSpaceM_
push 0x486558
push dword [ebp - 0x42c]
push str.Type_
push 0x486578
lea eax, [ebp - 0xc]
push eax
push str.Disk_Info_
push dword [ebp - 0x424]
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
mov ecx, eax
call fcn.00419bc6
push eax
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
mov ecx, eax
call fcn.0042e8bc
push eax
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
mov eax, dword [ebp - 0x410]
movzx eax, word [eax]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x410]
inc eax
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x430], 0
je 0x468874
jmp 0x46884c
mov eax, dword [ebp - 0x410]
movzx eax, word [eax]
test eax, eax
jne 0x468739
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a99c
mov esp, ebp
pop ebp
ret
Function at 0x469042
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f597
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.00459f71
pop ecx
pop ecx
and dword [ebp - 4], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x4690b6
mov byte [ebp - 0x255], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402e75
mov al, byte [ebp - 0x255]
jmp 0x469227
mov dword [ebp - 0x254], 0x22c
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x469101
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x256], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402e75
mov al, byte [ebp - 0x256]
jmp 0x469227
cmp dword [ebp + 0xc], 0
je 0x469115
mov eax, dword [ebp + 0xc]
add eax, 0x10
mov dword [ebp - 0x260], eax
jmp 0x46911c
and dword [ebp - 0x260], 0
push 0x4868bc
push 0x486900
lea eax, [ebp - 0x28]
push eax
push 0x4868ec
push dword [ebp - 0x260]
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e0ad
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
push dword [ebp - 0x24c]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
je 0x469182
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24c]
push dword [ebp + 0xc]
call fcn.0046749e
add esp, 0xc
movzx eax, al
test eax, eax
je 0x4691e7
cmp dword [ebp + 0xc], 0
je 0x4691b2
mov eax, dword [ebp + 0xc]
add eax, 0x10
mov dword [ebp - 0x268], eax
jmp 0x4691b9
and dword [ebp - 0x268], 0
push 0x486954
lea eax, [ebp - 0x230]
push eax
push 0x48694c
push dword [ebp - 0x268]
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
push eax
call fcn.0041e358
pop ecx
pop ecx
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x469154
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x257], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402e75
mov al, byte [ebp - 0x257]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a99c
mov esp, ebp
pop ebp
ret
Function at 0x4693fa
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f5e2
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.004021e0
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00420d6e
push 0x1e
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.0043bad0
add esp, 0xc
and dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 3
lea ecx, [ebp - 0x28]
call fcn.0040277e
mov dword [ebp - 0x48], eax
and dword [ebp - 0x44], 0
mov eax, 0x614
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x469485
mov dword [ebp - 0x30], 1
jmp 0x469489
and dword [ebp - 0x30], 0
mov al, byte [ebp - 0x30]
mov byte [ebp - 0x29], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402e75
mov al, byte [ebp - 0x29]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a99c
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x20a7bd8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x20a7be2
pushal
call 0x20a7be8
pop ebp
sub ebp, 0x10
sub ebp, 0x1ca7bd8
jmp 0x20a7bfe
mov eax, 0x1ca7bd8
add eax, ebp
add eax, 0x4c
mov ecx, 0x583
mov edx, 0xe0d6ffc1
xor byte [eax], dl
inc eax
dec ecx
jne 0x20a7c15
jmp 0x20a7c28
dec edx
or al, 0x4a
dec eax
std
rol ecx, 0xc1
inc eax
add byte [ecx], bh
rol ecx, 0xc1
ret 0x790c
Function at 0x403370
Capabilities:
Create process on windows
Resume thread
Self delete

Disassembly:
push ebp
lea ebp, [esp - 0x1e4]
sub esp, 0x264
mov eax, dword [0x40c17c]
xor eax, ebp
mov dword [ebp + 0x1e0], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x28]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0xdc]
push str._s.bat
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
lea eax, [ebp + 0xdc]
push 0x407f3c
push eax
call dword [sym.imp.MSVCR80.dll_fopen]
mov esi, dword [sym.imp.MSVCR80.dll_fprintf]
push str.:Repeat_n
push eax
mov dword [ebp - 0x2c], eax
call esi
lea eax, [ebp - 0x28]
push eax
mov edi, str.del___s__n
push edi
push dword [ebp - 0x2c]
call esi
lea eax, [ebp - 0x28]
push eax
push str.if_exist___s__goto_Repeat_n
push dword [ebp - 0x2c]
call esi
lea eax, [ebp + 0xdc]
push eax
push edi
push dword [ebp - 0x2c]
call esi
add esp, 0x40
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR80.dll_fclose]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR80.dll_memset
add esp, 0x10
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0x407370
push ebx
push esi
push ebx
push ebx
push ebx
lea eax, [ebp + 0xdc]
push eax
push ebx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x54], 1
mov word [ebp - 0x50], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403495
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push dword [ebp - 0x38]
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push 0x80

Function at 0x4034ad
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll__strdup]
mov esi, dword [sym.imp.MSVCR80.dll_strchr]
push 0x5b
push eax
mov dword [ebp - 8], eax
call esi
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40356f
push edi
inc ebx
push 0x5d
push ebx
call esi
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x40356e
mov byte [edi], 0
inc edi
push 0xa
push edi
call esi
xor esi, esi
cmp eax, esi
pop ecx
pop ecx
je 0x4034ff
mov byte [eax], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push esi
push ebx
push dword [section..data]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403532
push esi
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403564
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, esi
je 0x40355b
cmp eax, 2
je 0x40355b
push esi
push str.Could_not_delete_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403573
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll__strdup]
mov esi, dword [sym.imp.MSVCR80.dll_strchr]
push 0x5b
push eax
mov dword [ebp - 8], eax
call esi
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x403635
push edi
inc ebx
push 0x5d
push ebx
call esi
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x403634
mov byte [edi], 0
inc edi
push 0x3d
push edi
call esi
xor esi, esi
cmp eax, esi
pop ecx
pop ecx
je 0x403634
mov byte [eax], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push esi
push ebx
push dword [section..data]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4035f8
push esi
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40362a
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, esi
je 0x403621
cmp eax, 2
je 0x403621
push esi
push str.Could_not_delete_value
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403639
Capabilities:
Delete file

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x403650
pop esi
ret
push edi
mov edi, dword [sym.imp.MSVCR80.dll_isspace]
inc esi
movsx eax, byte [esi]
push eax
call edi
test eax, eax
pop ecx
jne 0x403657
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
ret

Function at 0x40366d
Capabilities:
Delete directory

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x403684
pop esi
ret
push edi
mov edi, dword [sym.imp.MSVCR80.dll_isspace]
inc esi
movsx eax, byte [esi]
push eax
call edi
test eax, eax
pop ecx
jne 0x40368b
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
ret
Function at 0x100015b0
Capabilities:
Authenticate hmac

Disassembly:
lds ebx, [ecx + edx - 0x70]
rcl byte [edi - 0xa5c4be0]
cld
nop
mov word [edi + 0x48], ds
sub ecx, esi
bound edi, qword [ebx]
mov ebp, 0x53bf8481
xor byte [ebx], ch
invalid
ljmp 0xaa3c:0x689c8236
cmp al, 0xaa
mov dh, 0xf8
and al, 0x58
je 0x1000158e
test al, 0xa8
jbe 0x10001502
cld
jnp 0x100015a7
sbb al, 0x4c
mov esi, 0xa283609f
push esp
sbb dword [eax], 0xb286a751
mov eax, 0x3216117c
outsb dx, byte [esi]
cwde
scasd eax, dword es:[edi]
lea esp, [ebp - 0x15]
sbb dword [ebx + ebx*8 + 0x694ace2a], 0x90460069
adc al, 0xbc
or eax, ecx
enter 0xfffffffffffffde0, 0x6f
loopne 0x10001577
outsd dx, dword [esi]
sbb ebx, edx
daa
pop eax
lahf
test al, 0x17
xor al, 0x42
outsd dx, dword [esi]
sub eax, 0xe9527866
jle 0x100015ff
loop 0x10001592
mov bh, byte [eax - 0x354361f2]
test eax, 0x20b63372
mov esp, 0x3372a9ca
mov dh, 0x20
inc eax
test eax, 0x80daeba1
test byte [ebx], bl
lodsb al, byte [esi]
imul eax, dword [ebp + 0x74], 0xffffffb7
aam 0x2d
add ebx, 0x47
ja 0x100015c1
sub eax, 0x7747c383
adc al, 0x7a
push 0xdec67ac7
jp 0x10001578
ficom word [ebx]
loopne 0x1000153b
push eax
pop ecx
jp 0x10001617
invalid
jp 0x10001578
ficom word [ebx]
loopne 0x1000153b
push eax
pop ecx
ja 0x10001540
ljmp 0xba5f:0x76957b56
mov dh, 0x36
pop ds
adc dh, byte [edi - 0x4967a9de]
mov edi, 0xa50e4016
movsb byte es:[edi], byte [esi]
call fcn.100055e1
lodsb al, byte [esi]
call 0xd0a9e30c
dec byte [ecx - 0x7858ca92]
pop edi
pushal
idiv ebx
sbb eax, 0x54b4ab9f
mov ebp, 0xaa1e8623
sbb edi, dword [edi + 0x4c]
jg 0x1000163e