joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10069860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, ecx
mov dword [esp + 4], 0xffffffff
push ebx
push esi
xor ecx, ecx
mov dword [esp + 0x10], eax
test byte [edx + 0x1c], 0x80
mov ebx, dword [eax + 8]
push edi
mov dword [esp + 0x18], ebx
jne 0x1006988d
xor edi, edi
jmp 0x100698a4
mov edi, dword [edx + 8]
test edi, edi
je 0x100698a4
mov eax, dword [edi + 0x38]
and al, 3
cmp al, 2
je 0x100698a4
mov edi, dword [edi + 0x14]
test edi, edi
jne 0x10069894
mov esi, dword [edx + 8]
test esi, esi
je 0x100699d8
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], edx
nop dword [eax]
cmp dword [ebp + 0x10], 0
je 0x100698cf
cmp dword [edx], 0
je 0x100699c2
cmp esi, edi
je 0x100699c2
cmp eax, dword [ebp + 0x14]
je 0x100699c2
push dword [esp + 0x10]
lea eax, [esp + 0x28]
mov edx, esi
push ecx
mov ecx, dword [esp + 0x1c]
push eax
push 1
push 0
push dword [ebp + 8]
call fcn.100699e0
add esp, 0x18
mov edx, eax
test byte [esi + 0x38], 8
mov dword [esp + 0x10], edx
je 0x10069911
movzx ecx, word [esi + 0x32]
jmp 0x10069915
movzx ecx, word [esi + 0x34]
movzx eax, cx
mov ecx, dword [ebx + 0x74]
mov dword [esp + 0x20], eax
cmp dword [ebx + 0x78], ecx
jg 0x1006993a
push eax
push edx
push dword [ebp + 0xc]
mov edx, 0x8b
mov ecx, ebx
call fcn.10033da0
add esp, 0xc
jmp 0x1006996c
mov edx, dword [ebp + 0xc]
lea eax, [ecx + 1]
mov dword [ebx + 0x74], eax
lea ecx, [ecx + ecx*4]
mov eax, dword [ebx + 0x70]
mov dword [eax + ecx*4 + 4], edx
mov edx, dword [esp + 0x10]
mov dword [eax + ecx*4 + 8], edx
mov edx, dword [esp + 0x20]
mov dword [eax + ecx*4], 0x8b
mov dword [eax + ecx*4 + 0xc], edx
mov dword [eax + ecx*4 + 0x10], 0
mov eax, dword [ebx + 0x74]
test eax, eax
jle 0x10069983
lea ecx, [eax + eax*4]
mov edx, 1
mov eax, dword [ebx + 0x70]
mov word [eax + ecx*4 - 0x12], dx
mov edx, dword [esp + 0x24]
test edx, edx
je 0x100699b9
mov eax, dword [esp + 0x14]
not edx
mov ebx, dword [eax + 8]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 0x3c]
add eax, dword [ecx + 0x38]
jns 0x100699ac
push edx
mov edx, ebx
call fcn.10034550
add esp, 4
jmp 0x100699b5
mov ecx, dword [ecx + 0x40]
mov eax, dword [ebx + 0x74]
mov dword [ecx + edx*4], eax
mov ebx, dword [esp + 0x18]
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov edx, dword [esp + 0x1c]
mov esi, dword [esi + 0x14]
add edx, 4
inc eax
mov dword [esp + 0x1c], edx
mov dword [ebp + 0xc], eax
test esi, esi
jne 0x100698c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c33b1
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10120048]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x100c3491
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x100c348a
push ebx
cmp dword [ebp - 0x20], 0x10
jb 0x100c346f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100c346f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100c346f
mov edx, dword [esi]
test edx, edx
jne 0x100c343d
push 0x200
push edx
push dword [0x101256bc]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100c3489
lea ebx, [esi + 8]
jmp 0x100c3465
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x100c3465
shl eax, 3
push eax
push edx
push 0
push dword [0x101256bc]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x100c3489
shl dword [esi + 4], 1
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100c33f5
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100db65f
leave
ret

Function at 0x100c349f
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.100c33b1
cmp dword [esi], ebx
je 0x100c34ff
push edi
mov edi, ebx
cmp dword [esi + 8], ebx
jbe 0x100c34fe
mov eax, dword [esi]
push dword [eax + edi*4]
push ebx
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100c34f5
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.100c325e
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
push 0
pop ebx
cmp edi, dword [esi + 8]
jb 0x100c34c5
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100c3503
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x100c354f
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100c353e
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100c3537
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x100c3514
pop ebx
push dword [esi]
push 0
push dword [0x101256bc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret
Function at 0x100c3551
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
imul edi, ecx, 0x2c
add edi, dword [0x10125b90]
mov al, byte [edi + 0x14]
mov esi, dword [edi]
and al, 1
je 0x100c356d
sub esi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100c358e
push 0xa
pop eax
jmp 0x100c35cd
mov byte [esi], 0xe9
mov eax, dword [edi + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [edi + 0x14], 1
je 0x100c35a9
mov eax, dword [edi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [edi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100c3a99
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x10125b88]
push esi
xor esi, esi
jmp 0x100c3aab
cmp dword [edx + 4], esi
jne 0x100c3aff
mov edx, dword [edx]
test edx, edx
jne 0x100c3aa4
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x100c3afb
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x100c3ad2
mov eax, dword [0x10125b88]
mov dword [edx], eax
mov dword [0x10125b88], edx
pop edi
test edx, edx
jne 0x100c3aff
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret

Function at 0x100f1614
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100f148a

Function at 0x100fdff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100fe01d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100fe01d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407d20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x407e52
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1f8]
call sub.Vcl50.bpl__Controls_TControl_BringToFront_qqrv
lea edx, [ebp - 4]
mov eax, ebx
call sub.Vcl50.bpl__Controls_TControl_GetText_qqrv
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1f0]
call sub.Vcl50.bpl__Graphics_TCanvas_TextHeight_qqrx17System_AnsiString
mov edx, eax
inc edx
mov eax, dword [ebx + 0x1f8]
call sub.Vcl50.bpl__Controls_TControl_SetTop_qqri
mov edx, 0x10
mov eax, dword [ebx + 0x1f8]
call sub.Vcl50.bpl__Controls_TControl_SetLeft_qqri
cmp byte [ebx + 0x2b5], 0
je 0x407d92
mov esi, dword [ebx + 0x1fc]
mov edi, dword [ebx + 0x218]
jmp 0x407d9e
mov esi, dword [ebx + 0x218]
mov edi, dword [ebx + 0x1fc]
mov eax, esi
call sub.Vcl50.bpl__Controls_TControl_BringToFront_qqrv
mov eax, edi
call sub.Vcl50.bpl__Controls_TControl_SendToBack_qqrv
mov edx, 2
mov eax, esi
call sub.Vcl50.bpl__Controls_TControl_SetLeft_qqri
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x1f8]
call sub.Vcl50.bpl__Controls_TControl_GetText_qqrv
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x1f8]
mov eax, dword [eax + 0x1f0]
call sub.Vcl50.bpl__Graphics_TCanvas_TextHeight_qqrx17System_AnsiString
mov edx, eax
mov eax, dword [ebx + 0x1f8]
add edx, dword [eax + 0x34]
add edx, 2
mov eax, esi
call sub.Vcl50.bpl__Controls_TControl_SetTop_qqri
mov edx, dword [ebx + 0x3c]
sub edx, dword [esi + 0x34]
sub edx, 2
mov eax, esi
call sub.Vcl50.bpl__Controls_TControl_SetHeight_qqri
mov edx, dword [ebx + 0x38]
sub edx, dword [esi + 0x30]
sub edx, 2
mov eax, esi
call sub.Vcl50.bpl__Controls_TControl_SetWidth_qqri
mov edx, dword [esi + 0x30]
mov eax, edi
call sub.Vcl50.bpl__Controls_TControl_SetLeft_qqri
mov edx, dword [esi + 0x34]
mov eax, edi
call sub.Vcl50.bpl__Controls_TControl_SetTop_qqri
mov edx, dword [esi + 0x3c]
mov eax, edi
call sub.Vcl50.bpl__Controls_TControl_SetHeight_qqri
mov edx, dword [esi + 0x38]
mov eax, edi
call sub.Vcl50.bpl__Controls_TControl_SetWidth_qqri
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e59
lea eax, [ebp - 8]
mov edx, 2
call sub.Vcl50.bpl__System__LStrArrayClr_qqrv
ret
Function at 0x40a514
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.Vcl50.bpl__Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
jne 0x40a543
push 0
push 0
call sub.Vcl50.bpl__Forms_AllocateHWnd_qqrynpqqrr17Messages_TMessage_v
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
push eax
call sub.user32.dll_OpenClipboard
xor ecx, ecx
xor edx, edx
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esp]
call sub.Vcl50.bpl__Classes_TStream_GetSize_qqrv
mov dword [esp + 8], eax
xor ecx, ecx
xor edx, edx
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esp + 8]
inc eax
push eax
push 0x42
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
xor ebx, ebx
jmp 0x40a5bc
mov edx, dword [esp + 8]
sub edx, ebx
mov eax, 0x8000
call fcn.0040a3a0
push eax
mov edx, edi
mov eax, ebx
call fcn.0040a500
mov edx, eax
mov eax, dword [esp + 4]
pop ecx
mov esi, dword [eax]
call dword [esi + 4]
mov esi, eax
movzx eax, si
add ebx, eax
push edi
call sub.kernel32.dll_GlobalUnlock
test si, si
je 0x40a5c5
lea eax, [ebx + 1]
cmp eax, dword [esp + 8]
jl 0x40a584
mov edx, edi
mov eax, ebx
call fcn.0040a500
mov byte [eax], 0
push edi
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_EmptyClipboard
push edi
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
mov eax, dword [sym.imp.Vcl50.bpl__Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
cmp eax, dword [esp + 0xc]
je 0x40a605
mov eax, dword [esp + 0xc]
call sub.Vcl50.bpl__Forms_DeallocateHWnd_qqrui
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x40a60c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, edx
mov dword [esp], eax
mov eax, dword [sym.imp.Vcl50.bpl__Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jne 0x40a63a
push 0
push 0
call sub.Vcl50.bpl__Forms_AllocateHWnd_qqrynpqqrr17Messages_TMessage_v
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_OpenClipboard
xor ecx, ecx
xor edx, edx
mov eax, dword [esp]
mov esi, dword [eax]
call dword [esi + 0xc]
push ebx
call sub.user32.dll_GetClipboardData
mov edi, eax
push edi
call sub.kernel32.dll_GlobalSize
mov esi, eax
xor ebx, ebx
jmp 0x40a6a0
mov edx, esi
sub edx, ebx
dec edx
mov eax, 0x8000
call fcn.0040a3a0
push eax
mov edx, edi
mov eax, ebx
call fcn.0040a500
mov edx, eax
mov eax, dword [esp + 4]
pop ecx
mov ebp, dword [eax]
call dword [ebp + 8]
mov edx, esi
sub edx, ebx
dec edx
mov eax, 0x8000
call fcn.0040a3a0
add ebx, eax
push edi
call sub.kernel32.dll_GlobalUnlock
lea eax, [ebx + 1]
cmp esi, eax
jg 0x40a664
call sub.user32.dll_CloseClipboard
mov eax, dword [sym.imp.Vcl50.bpl__Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
cmp eax, dword [esp + 4]
je 0x40a6c5
mov eax, dword [esp + 4]
call sub.Vcl50.bpl__Forms_DeallocateHWnd_qqrui
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41b5ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc9c
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.Vcl50.bpl__System__LStrAddRef_qqrv
xor eax, eax
push ebp
push 0x41b6d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20d]
mov edx, dword [ebp - 4]
call sub.Vcl50.bpl__Sysutils_StrPCopy_qqrpcx17System_AnsiString
lea edx, [ebp - 0xc]
xor eax, eax
call sub.Vcl50.bpl__System__LGetDir_qqrucr17System_AnsiString
lea eax, [ebp - 0x30d]
mov edx, dword [ebp - 0xc]
call sub.Vcl50.bpl__Sysutils_StrPCopy_qqrpcx17System_AnsiString
lea eax, [ebp - 0x354]
xor ecx, ecx
mov edx, 0x44
call sub.Vcl50.bpl__System__FillChar_qqrv
mov dword [ebp - 0x354], 0x44
mov dword [ebp - 0x328], 1
mov word [ebp - 0x324], bx
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x354]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x20d]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x41b69c
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x41b6ba
push 0xffffffffffffffff
mov eax, dword [ebp - 0x364]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x364]
push eax
call sub.kernel32.dll_GetExitCodeProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b6df
lea eax, [ebp - 0xc]
call sub.Vcl50.bpl__System__LStrClr_qqrr17System_AnsiString
lea eax, [ebp - 4]
call sub.Vcl50.bpl__System__LStrClr_qqrr17System_AnsiString
ret
Function at 0x4026b4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x67101c], 0x8088405
inc edx
mov dword [0x67101c], edx
mul edx
mov eax, edx
ret

Function at 0x403218
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00401e58
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4031e0
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4057e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x405812
cmp dword [ebx + 0x64], 0
jne 0x405812
cmp dword [ebx + 0x6c], 0
jne 0x405812
mov esi, edi
jmp 0x40589e
cmp esi, 0xffffffff
jne 0x40581d
dec esi
jmp 0x40589e
mov eax, dword [ebx + 0x64]
mov edx, edi
sub edx, 0x106
add edx, edi
cmp eax, edx
jl 0x40589e
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
xchg edx, eax
call fcn.004023c8
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
mov word [edx], 0
cmp edi, dword [esp]
ja 0x40586d
mov cx, word [esp]
sub cx, di
mov word [edx], cx
dec eax
test eax, eax
jne 0x405850
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
mov word [edx], 0
cmp edi, dword [esp]
ja 0x405897
mov cx, word [esp]
sub cx, di
mov word [edx], cx
dec eax
test eax, eax
jne 0x40587a
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x4058fc
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.0040579c
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jl 0x4058e7
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jge 0x4058fc
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4057f2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408900
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x40890f
add esp, 0xfffffff0
call fcn.00402ab0
mov ebx, edx
mov edi, eax
mov esi, 0x672254
push 0x408a00
call sub.kernel32.dll_LoadLibraryW
mov dword [esi], eax
cmp dword [esi], 0
je 0x4089e4
push 0x408a18
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x672220], eax
push 0x408a28
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x672224], eax
push 0x408a38
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x672228], eax
push 0x408a4c
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x67222c], eax
push 0x408a5c
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x672230], eax
push 0x408a7c
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x672234], eax
push 0x408a8c
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x672238], eax
push 0x408ab4
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x67223c], eax
push 0x408ac4
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x672240], eax
push 0x408ae0
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x672244], eax
inc byte [edi + 0x24]
mov eax, edi
call fcn.00408d90
test bl, bl
je 0x4089f9
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x412fdc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
cmp dword [0x67226c], 0xca
jne 0x412ff8
call fcn.00412f48
mov dword [0x67226c], 0xcb
mov eax, dword [0x67226c]
cmp eax, 0xcb
jne 0x413028
mov eax, dword [0x6723b8]
cmp byte [eax + 0xc], 0
je 0x41301c
mov ebx, dword [0x6723b8]
call dword [ebx]
cmp eax, 2
jne 0x41300f
mov eax, dword [0x6722ac]
mov dword [0x6722b4], eax
jmp 0x413034
cmp eax, 0xcc
je 0x413034
call fcn.00656a70
call fcn.00412f68
pop ebx
ret

Function at 0x413774
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, 0x1c
call fcn.00658ea4
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
pop esi
pop ebx
ret
Function at 0x413804
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41392e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.0040330c
lea eax, [ebp - 0x18]
call fcn.00413540
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004135e4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4138f9
xor eax, eax
push ebp
push 0x4138f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00413660
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00413774
test al, al
je 0x4138d0
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x1c]
xor edx, edx
call fcn.00403358
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4138d0
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4138ca
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00413804
dec ebx
cmp ebx, 0xffffffff
jne 0x41389a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4138f9
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00413660
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 0x18]
call fcn.004036e0
push eax
mov dl, byte [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.004135b0
push eax
call sub.advapi32.dll_RegDeleteKeyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413935
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403298
ret

Function at 0x413a38
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
call fcn.00403aa8
inc eax
add eax, eax
push eax
mov eax, esi
call fcn.00403a98
push eax
push 1
push 0
mov eax, edi
call fcn.00403a98
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
pop edi
pop esi
pop ebx
ret
Function at 0x42ff4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x11], dl
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
shl eax, 8
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + 1]
add ax, dx
mov word [ebp - 0x10], ax
push ebp
xor eax, eax
call fcn.0042fe9c
pop ecx
mov word [ebp - 0x1a], ax
mov edi, 1
lea ebx, [ebp - 0x10]
mov esi, dword [ebp - 0x18]
add esi, 2
xor eax, eax
mov al, byte [esi]
shl eax, 8
xor edx, edx
mov dl, byte [esi + 1]
add ax, dx
xor ax, word [ebx]
mov word [ebx + 2], ax
push ebp
mov eax, edi
call fcn.0042fe9c
pop ecx
xor word [ebp - 0x1a], ax
inc edi
add esi, 2
add ebx, 2
cmp edi, 8
jne 0x42ff8d
movzx eax, word [ebp - 0x1a]
shr eax, 8
mov dl, byte [ebp - 0x1a]
and dl, 0xff
xor al, dl
xor al, byte [ebp - 0x11]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x430008
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
test dl, dl
je 0x430021
add esp, 0xfffffff0
call fcn.00402ab0
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4300a9
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00656138
lea eax, [esi + 0x54]
fstp qword [eax]
wait
lea eax, [ebp - 0x18]
call fcn.00618f24
lea eax, [esi + 0x54]
add eax, 8
mov dx, word [ebp - 0x18]
mov word [eax], dx
lea eax, [esi + 0x54]
add eax, 8
add eax, 2
mov dx, word [ebp - 0x14]
mov word [eax], dx
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x66ef3c]
mov eax, dword [eax]
call fcn.00655260
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
lea eax, [esi + 0x54]
add eax, 8
add eax, 4
mov edx, dword [ebp - 8]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4300b0
lea eax, [ebp - 0x1c]
call fcn.00403880
ret