joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422e9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x422fee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x422fee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.00422ff8
test eax, eax
je 0x422fee
add ebx, 0x28
dec ecx
jne 0x422fc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x42309e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x4230c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x42312e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x4230e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x42312e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x423105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x42312e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x423123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x42312e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x42316b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x423172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x4231a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x4231a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x423dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.00423f04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.00423f20
push edx
push dword [ebp + 0x10]
push eax
call fcn.00423eec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00423f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00423ecb
push ecx
push dword [ebp + 8]
call fcn.00423f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00423f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00423ecb
push ecx
push dword [ebp + 8]
call fcn.00423f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00423f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00423ecb
push ecx
push dword [ebp + 8]
call fcn.00423f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00423f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00423ecb
cmp ecx, 0x2b
jne 0x423e0f
leave
ret 0xc

Function at 0x4254b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x425544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x133b0
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4255d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x133b0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x133b0
call fcn.004253fa
push 0x133b0
push dword [ebp + 0xc]
call fcn.004231a8
test eax, eax
jne 0x4255b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x133b0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.004255dd
test eax, eax
je 0x4255d6
jmp 0x425574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4255d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x42560b
Capabilities:
Terminate process

Disassembly:
call fcn.00425618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x41dbd0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59dac6
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x1004610]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf0], ecx
push 0
push 0x10063f0
call fcn.0041dab0
add esp, 8
push 0x10063f0
mov ecx, 0x10067dc
call fcn.00429580
push 0
push 0x1a
push 0x104
mov ecx, 0x10067d8
call fcn.004299d0
push eax
push 0
call dword [0x5b745c]
push 0xffffffffffffffff
mov ecx, 0x10067d8
call fcn.00429390
push 1
push 0x5bac28
call fcn.0041db40
add esp, 8
mov dword [0x10062d8], 0x114
push 0x10062d8
call dword [0x5b7394]
call fcn.0054d28c
mov eax, dword [eax + 4]
mov dword [ebp - 0xc8], eax
call fcn.0054d28c
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcc], ecx
mov edx, 0x80
movzx eax, dx
push eax
mov ecx, dword [ebp - 0xcc]
push ecx
call dword [0x5b767c]
mov dword [0x10062d4], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xf0]
add eax, 0xa4
push eax
call fcn.005412ac
push 0
call fcn.0054c45f
add esp, 4
push 0
lea ecx, [ebp - 0x98]
push ecx
call fcn.0042fd00
add esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x98]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0xd0], eax
xor ecx, ecx
cmp dword [ebp - 0xd0], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x41dd27
mov eax, dword [ebp - 0x98]
push eax
call fcn.00431470
add esp, 4
jmp 0x41dd34
push 0x5babec
call fcn.00431470
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00402640
mov dword [ebp - 0xb0], vtable.VObj.0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xb0], vtable.ExprItem.0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xb0], vtable.AnyArray.0
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xd8], ecx
mov edx, dword [ebp - 0xd8]
mov dword [edx], 0
mov eax, dword [ebp - 0xd8]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0xd8]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0xb0]
mov eax, dword [edx + 4]
mov dword [0x10062d0], eax
lea ecx, [ebp - 0xb0]
call fcn.0041de90
push 0
call fcn.005630cd
add esp, 4
push eax
call fcn.00561311
add esp, 4
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ecx + 0x44]
push edx
call fcn.004f9e60
add esp, 4
call fcn.00473c30
call fcn.004c6a80
call dword [0x5b7398]
mov dword [0x1006604], eax
push 0
lea ecx, [ebp - 0x94]
call fcn.0042b520
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xf0]
lea ecx, [ebp - 0x94]
mov dword [eax + 0x20], ecx
push 0
mov edx, 0x66
movzx eax, dx
push eax
lea ecx, [ebp - 0x94]
call fcn.00541dd1
push 0
lea ecx, [ebp - 0x94]
call fcn.005444ed
mov ecx, dword [0x1006604]
push ecx
call dword [0x5b739c]
mov dword [0x1006604], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00541417
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x434560
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x10325476
pop ebp
ret

Function at 0x436410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + 0x100]
mov byte [ebp - 2], cl
mov edx, dword [ebp + 0x10]
mov al, byte [edx + 0x101]
mov byte [ebp - 1], al
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
jmp 0x436446
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x4364f6
movzx ecx, byte [ebp - 2]
add ecx, 1
and ecx, 0x800000ff
jns 0x436469
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 2], cl
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
movzx edx, byte [ebp - 1]
add ecx, edx
and ecx, 0x800000ff
jns 0x43648d
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 1], cl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0x10]
push eax
movzx ecx, byte [ebp - 2]
add ecx, dword [ebp - 0x10]
push ecx
call fcn.004363e0
add esp, 8
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x10]
movzx edx, byte [eax + edx]
add ecx, edx
and ecx, 0x800000ff
jns 0x4364d0
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 9], cl
movzx eax, byte [ebp - 9]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + eax]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov byte [edx], cl
jmp 0x43643d
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 2]
mov byte [eax + 0x100], cl
mov edx, dword [ebp + 0x10]
mov al, byte [ebp - 1]
mov byte [edx + 0x101], al
mov esp, ebp
pop ebp
ret
Function at 0x4d2c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0xfbbdc0
mov eax, dword [ebp + 8]
push eax
call fcn.0056647b
add esp, 8
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [ebp - 4], 0
setne cl
test ecx, ecx
jne 0x4d2c6c
mov dword [ebp - 0xc], 0
cmp dword [ebp - 4], 0
je 0x4d2c67
mov edx, dword [ebp - 4]
push edx
call fcn.00566339
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x4d2cc2
mov eax, dword [ebp - 4]
push eax
push 1
push 2
push 0xfc9afc
call fcn.005665f4
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x5b7378]
shl eax, 1
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005665f4
add esp, 0x10
mov dword [ebp - 0x10], 1
cmp dword [ebp - 4], 0
je 0x4d2cbf
mov edx, dword [ebp - 4]
push edx
call fcn.00566339
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4d2cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0xfbbdc0
mov eax, dword [ebp + 8]
push eax
call fcn.0056647b
add esp, 8
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [ebp - 4], 0
setne cl
test ecx, ecx
jne 0x4d2d1c
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x4d2d17
mov edx, dword [ebp - 4]
push edx
call fcn.00566339
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x4d2d5b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call dword [0x5b7374]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.005665f4
add esp, 0x10
mov dword [ebp - 0xc], 1
cmp dword [ebp - 4], 0
je 0x4d2d58
mov ecx, dword [ebp - 4]
push ecx
call fcn.00566339
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4dc110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a8753
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1004610]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [eax], vtable.VObj.0
mov ecx, dword [ebp - 0x4c]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x4c]
mov dword [edx], vtable.ExprItem.0
mov eax, dword [ebp - 0x4c]
mov dword [eax + 8], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], vtable.ExprItem_Solver.0
mov ecx, dword [ebp - 0x4c]
add ecx, 0xc
call fcn.004025e0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x4c]
add edx, 0x10
mov dword [ebp - 0x48], edx
lea eax, [ebp - 0x19]
push eax
lea ecx, [ebp - 0x1a]
push ecx
mov ecx, dword [ebp - 0x48]
call fcn.005357e0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov dword [edx + 0x30], eax
mov ecx, dword [ebp - 0x4c]
cmp dword [ecx + 0x30], 0
jne 0x4dc1b6
mov edx, dword [ebp - 0x4c]
fld qword [0xfc9e70]
fstp qword [edx + 0x38]
jmp 0x4dc1c2
mov eax, dword [ebp - 0x4c]
fld qword [0xfc9e68]
fstp qword [eax + 0x38]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x53ac70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x53ac84
xor eax, eax
jmp 0x53ac9f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00566174
add esp, 0x10
mov esp, ebp
pop ebp
ret 0xc

Function at 0x53acb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x53acc4
xor eax, eax
jmp 0x53acdf
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005665f4
add esp, 0x10
mov esp, ebp
pop ebp
ret 0xc
Function at 0x599850
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x59986a
pop edi
lea eax, [esi + 1]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x59997a
push ebp
jmp 0x599880
mov eax, ebx
cmp ebx, 0x15b0
jb 0x59988f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x59993b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x5998b0
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x5998b0
test eax, eax
je 0x59994d
nop
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x599940
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x599880
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret

Function at 0x7b6e88
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7b6e92
pushal
call 0x7b6e98
pop ebp
sub ebp, 0x10
sub ebp, 0x3b6e88
jmp 0x7b6eae
mov eax, 0x3b6e88
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e0
mov edx, 0x69f79af
xor byte [eax], dl
inc eax
dec ecx
jne 0x7b6ec5
jmp 0x7b6ed8
and al, 0x62
and al, 0x26
xchg ebx, eax
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
outsb dx, byte cs:[esi]
push edi
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
lodsb al, byte [esi]
bound edx, qword [edi]
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
adc eax, 0xafafaf87
pop eax
dec ebp
lodsb al, byte [esi]
and al, 0x2e
mov dword [0xacafafaf], eax
push 0xffffffffffffffff
inc edi
invalid
Function at 0x40141e
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
mov edi, dword [esp + 0x128]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or eax, 9
push eax
push dword [esp + 0x12c]
push dword [esp + 0x12c]
call fcn.00405fc3
test eax, eax
jne 0x401527
xor ebp, ebp
test byte [esp + 0x128], 2
je 0x401493
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x401503
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x4014ce
test edi, edi
jne 0x401503
push dword [esp + 0x128]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.0040141e
test eax, eax
jne 0x4014d8
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014a6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.0040655e
test eax, eax
jne 0x401514
push dword [esp + 0x124]
push dword [esp + 0x124]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x401527
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401527
push 0
push esi
push dword [esp + 0x12c]
push dword [esp + 0x12c]
call eax
pop edi
pop esi
pop ebp
add esp, 0x110
ret 0xc
Function at 0x402f57
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x50
mov ecx, dword [esp + 0x54]
mov eax, 0x421118
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x6c]
mov ebx, 0x8000
test edi, edi
cmovne ebx, dword [esp + 0x70]
xor esi, esi
test edi, edi
cmovne eax, edi
mov dword [esp + 0x10], eax
test ecx, ecx
js 0x402f93
mov eax, dword [0x42f138]
add eax, ecx
push eax
call fcn.00402f40
push 4
lea eax, [esp + 0x70]
push eax
push dword [0x40a010]
call fcn.004065c0
test eax, eax
je 0x403173
mov eax, dword [esp + 0x6c]
test eax, eax
jns 0x40311b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [0x40ba84], esi
and dword [0x40ba80], esi
mov dword [esp + 0x70], eax
mov eax, 0x40d108
mov dword [0x415110], eax
mov dword [0x41510c], eax
mov eax, dword [esp + 0x6c]
and eax, 0x7fffffff
mov dword [0x40b568], 8
mov ecx, eax
mov dword [0x415108], 0x415108
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], ecx
jbe 0x403113
mov ebp, 0x4000
cmp ecx, ebp
cmovl ebp, ecx
push ebp
push 0x41d118
call fcn.00402f2a
test eax, eax
je 0x403173
sub dword [esp + 0x6c], ebp
mov dword [0x40b55c], ebp
mov ebp, dword [esp + 0x10]
mov dword [0x40b558], 0x41d118
push 0x40b558
mov dword [0x40b560], ebp
mov dword [0x40b564], ebx
call fcn.00406e95
mov dword [esp + 0x1c], eax
test eax, eax
js 0x403117
mov eax, dword [0x40b560]
sub eax, ebp
mov dword [esp + 0x64], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x42f1d4], 1
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
je 0x4030cf
sub eax, dword [esp + 0x70]
cmp eax, 0xc8
ja 0x403093
test ecx, ecx
jne 0x4030cf
mov eax, dword [esp + 0x14]
push eax
push 0x64
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [esp + 0x24]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push 0
call fcn.00405a12
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x64]
test eax, eax
je 0x40310b
test edi, edi
jne 0x4030f0
push eax
push ebp
push dword [esp + 0x70]
call fcn.0040667f
test eax, eax
je 0x40315b
mov eax, dword [esp + 0x64]
jmp 0x4030fc
mov ebp, dword [0x40b560]
sub ebx, eax
mov dword [esp + 0x10], ebp
add esi, eax
cmp dword [esp + 0x1c], 1
jne 0x403040
jmp 0x403113
test ecx, ecx
jg 0x40300b
mov eax, esi
jmp 0x403176
push 0xfffffffffffffffc
jmp 0x403175
test edi, edi
jne 0x40315f
test eax, eax
jle 0x403113
mov ebp, 0x41d118
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push ebp
call fcn.00402f2a
test eax, eax
je 0x403173
push edi
push ebp
push dword [esp + 0x70]
call fcn.0040667f
test eax, eax
je 0x40315b
mov eax, dword [esp + 0x6c]
add esi, edi
sub eax, edi
mov dword [esp + 0x6c], eax
test eax, eax
jg 0x403128
jmp 0x403113
push 0xfffffffffffffffe
jmp 0x403175
mov esi, dword [esp + 0x70]
cmp eax, esi
cmovl esi, eax
push esi
push edi
call fcn.00402f2a
test eax, eax
jne 0x403113
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
Function at 0x403180
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x40319f
mov eax, dword [0x40b550]
test eax, eax
je 0x403197
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40b550], 0
ret
cmp dword [0x40b550], 0
je 0x4031b0
push 0
call fcn.00405f30
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x42f0e0]
jbe 0x4031e3
push 0
push 0x403446
push 0
push 0x6f
push dword [0x42e8d4]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0x40b550], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x405b3a
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405b54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4

Function at 0x405b5a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push 4
pop eax
mov word [ebp - 0x1e], ax
mov eax, 0x408550
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov word [ebp - 0x20], 1
mov dword [ebp - 0x10], 0x408540
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405bc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405bd2
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
je 0x405bcc
xor eax, eax
jmp 0x405bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret 4