joyce8/EMBER2024-capa huggingface dataset:
Function at 0x580338
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044a4
xor eax, eax
push ebp
push 0x580438
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.00581fc0
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
cmp dword [ebp - 4], 0
je 0x5803fe
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ab44
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00580abc
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040aa20
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00580b30
jmp 0x580410
xor edx, edx
mov eax, ebx
call fcn.00580abc
xor edx, edx
mov eax, ebx
call fcn.00580b30
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58043f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404094
ret

Function at 0x5825cc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044a4
xor eax, eax
push ebp
push 0x582630
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.00582708
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x582637
lea eax, [ebp - 4]
call fcn.00404070
ret

Function at 0x58263c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044a4
xor eax, eax
push ebp
push 0x5826a0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0
push 0x5826ac
lea eax, [ebp - 4]
call fcn.00582708
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.005824a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5826a7
lea eax, [ebp - 4]
call fcn.00404070
ret
Function at 0x588030
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x164]
mov edx, ebx
mov eax, edi
call fcn.00588254
mov esi, eax
mov dword [edi + 0x164], esi
and esi, 0xff
add dword [edi + 0x168], esi
imul esi, dword [edi + 0x168], 0x8088405
inc esi
mov dword [edi + 0x168], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x16c]
mov eax, edi
call fcn.00588254
mov dword [edi + 0x16c], eax
pop edi
pop esi
pop ebx
ret

Function at 0x5880a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x5880c9
inc esi
mov eax, edi
call fcn.00588088
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.00588030
inc ebx
dec esi
jne 0x5880b3
pop edi
pop esi
pop ebx
ret

Function at 0x588158
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004044a4
xor eax, eax
push ebp
push 0x5881cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.005880d0
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.00588088
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00588030
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x588198
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5881d4
lea eax, [ebp - 4]
call fcn.00404070
ret
Function at 0x588cf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x588e97
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x588e53
mov eax, dword [ebp - 4]
call fcn.0058a378
cmp ebx, eax
jge 0x588e53
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xe8]
mov edx, ebx
call fcn.0057ea64
mov edx, dword [0x57fd48]
call fcn.00403498
mov esi, eax
mov eax, esi
call fcn.00580a28
test al, al
je 0x588e49
mov edi, dword [esi + 0x3c]
test edi, edi
jne 0x588e3d
xor eax, eax
push ebp
push 0x588e36
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00589220
mov edx, dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0x37]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 4]
movzx edx, word [ebp - 0x1b]
movzx eax, word [ebp - 0x19]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100]
mov cx, 1
mov esi, dword [eax]
call dword [esi + 0xc]
movzx esi, word [ebp - 0x17]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404624
mov eax, dword [ebp - 8]
call fcn.004044c0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x154]
mov al, byte [eax + 0x24]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00589004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x154]
mov dl, byte [ebp - 9]
mov byte [eax + 0x24], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x588e81
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x588e35
mov eax, dword [ebp - 4]
call fcn.005892a4
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b080
jmp 0x588e81
mov eax, dword [ebp - 8]
call fcn.00404070
jmp 0x588e81
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x40]
push eax
push 0
lea edx, [ebp - 0x44]
mov eax, 0xb3
call fcn.0040a580
mov ecx, dword [ebp - 0x44]
mov dl, 1
mov eax, dword [0x41150c]
call fcn.0040dc90
call fcn.00403aa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x588e9e
lea eax, [ebp - 0x44]
call fcn.00404070
ret
Function at 0x58cb18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
add esi, 0xfffffbf4
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 0x1a58], 0
jne 0x58cb58
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 1
mov eax, dword [ebp + 8]
mov dword [eax - 0x1a58], 0x10000
mov eax, 0x7fff
mov edx, dword [esi]
mov edx, dword [edx + 0xb7c]
mov word [edx + eax*2], 0
mov eax, edx
xor ecx, ecx
mov edx, 0xfffe
call fcn.00408d90
mov eax, dword [esi]
mov eax, dword [eax + 0x1a0]
mov ax, word [eax*8 + 0x5a49be]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a62], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x1a0]
mov ax, word [eax*8 + 0x5a49bc]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a64], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x1a0]
movzx eax, word [eax*8 + 0x5a49c0]
mov edx, dword [ebp + 8]
mov dword [edx - 0x1a68], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x1a0]
mov ax, word [eax*8 + 0x5a49c2]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6a], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x1a0]
cmp eax, 2
jg 0x58cbfc
mov eax, dword [esi]
mov eax, dword [eax + 0x254]
or word [eax + 8], 4
jmp 0x58cc0e
cmp eax, 8
jl 0x58cc0e
mov eax, dword [esi]
mov eax, dword [eax + 0x254]
or word [eax + 8], 2
mov eax, dword [ebp + 8]
mov word [eax - 0x10fe], 0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x1104], edx
mov bx, 0x8000
mov eax, dword [ebp + 8]
lea edi, [eax - 0x420]
mov eax, dword [esi]
mov edx, dword [eax + 0xb74]
mov ecx, ebx
mov eax, dword [edi + 4]
call dword [edi]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a5a], ax
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0
je 0x58cc66
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0xffff
jne 0x58cc7e
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 1
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5a], 0
jmp 0x58cce2
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 0
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0x106
jae 0x58cca0
mov eax, dword [ebp + 8]
push eax
call fcn.0058c940
pop ecx
mov eax, dword [ebp + 8]
mov word [eax - 0x1a6c], 0
xor ebx, ebx
movzx eax, bx
mov edx, dword [esi]
mov edx, dword [edx + 0xb74]
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 8]
mov dx, word [edx - 0x1a6c]
shl edx, 5
xor ax, dx
and ax, 0x7fff
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6c], ax
inc ebx
cmp bx, 2
jne 0x58ccae
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x59193c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffed0
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x1b8], 0
je 0x591960
mov eax, dword [ebx + 0x1b8]
call fcn.005821a4
test al, al
jne 0x591976
push esp
push 0x12d
call sub.kernel32.dll_GetTempPathA
mov edx, esi
mov eax, esp
call fcn.005824a0
jmp 0x591983
mov eax, esi
mov edx, dword [ebx + 0x1b8]
call fcn.004040c4
add esp, 0x130
pop esi
pop ebx
ret

Function at 0x598620
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xe0], ecx
mov esi, edx
lea edi, [ebp - 0xc9]
xor eax, eax
push ebp
push 0x59871f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi]
mov edx, dword [eax]
call dword [edx + 0x40]
push 0
push 0x598730
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x598701
push 0xc8
push edi
push ebx
call sub.user32.dll_GetWindowTextA
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov byte [edi + eax], 0
lea edx, [ebp - 0xd8]
mov eax, ebx
call fcn.0040a470
push dword [ebp - 0xd8]
push 0x598740
lea edx, [ebp - 0xe0]
mov eax, edi
call fcn.0040b080
mov eax, dword [ebp - 0xe0]
lea edx, [ebp - 0xdc]
call fcn.00409f58
push dword [ebp - 0xdc]
lea eax, [ebp - 0xd4]
mov edx, 3
call fcn.004043b0
mov edx, dword [ebp - 0xd4]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push ebp
mov eax, ebx
call fcn.00598550
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x598679
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x598726
lea eax, [ebp - 0xe0]
mov edx, 4
call fcn.00404094
ret

Function at 0x598eac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x45c], ebx
mov ebx, ecx
xor eax, eax
push ebp
push 0x598fb6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x201]
call fcn.0040ae58
mov edx, 0x598fc8
lea eax, [ebp - 0x201]
call fcn.0040af24
lea eax, [ebp - 0x201]
mov edx, ebx
call fcn.0040af24
lea edx, [ebp - 0x401]
mov ecx, 0xff
xor eax, eax
call fcn.00402a58
lea eax, [ebp - 0x45c]
lea edx, [ebp - 0x401]
call fcn.00404294
mov edx, dword [ebp - 0x45c]
lea eax, [ebp - 0x301]
call fcn.0040aee0
lea eax, [ebp - 0x448]
xor ecx, ecx
mov edx, 0x44
call fcn.00402ee0
mov dword [ebp - 0x448], 0x44
mov dword [ebp - 0x41c], 1
mov ax, word [ebp + 0xc]
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x448]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x201]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x598f8d
or esi, 0xffffffff
jmp 0x598f9d
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x458]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x598fbd
lea eax, [ebp - 0x45c]
call fcn.00404070
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401539
Capabilities:
Get file version info
Terminate process

Disassembly:
add byte [eax], al
ror ecx, 0x62
pop eax
and edx, dword [esi + 0x18e]
pop ebp
push esp
push dword [eax + 0x7ac]
push 0x7e6
shr edx, 0x8e
lea ecx, [esi + edi + 0x1d4c8ba]
xor word [edi + 0xecc], 0xcc00
mov ebx, ecx
call fcn.00401c74
push dword [edx - 0xe]
push dword [eax + 0x64]
xchg edi, eax
pop edx
xor dword [ebp - 0x22], edx
call dword [sym.imp.user32.dll_DestroyMenu]
shl edi, 0x84
sub dword [ecx - 0x5e], ebp
shl eax, 0xc6
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4018f9
Capabilities:
Get hostname

Disassembly:
add byte [ebx], al
mov cl, 0xa3
add al, 0
add byte [ebx + 0x2815ffdc], cl
adc byte [eax], al
inc eax
invalid
inc eax
invalid
xchg esi, eax
invalid
xchg esi, eax
invalid

Function at 0x401bb5
Capabilities:
Get file version info

Disassembly:
adc byte [eax], al
shr eax, 0x38
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add byte [esi - 0x7f], ah
stosb byte es:[edi], al
adc al, 9
add byte [eax], al
add byte [ecx + eax*4], dl
adc al, 0x81
sahf
outsb dx, byte [esi]
push es
add byte [eax], al
add byte [esi], ch
add al, ch
adc bh, bh
invalid
dec dword [ebp + 0x552c3e94]
add dword [edi + edi*8 + 0x4010a015], edi
mov al, byte [0x47004010]
call fcn.00401251
call 0x401bbe
sub edi, 0x822
call 0x400ee3
or dword [esp + 0x1ec], ebp
push dword [ebx + 0x50]
pop ebx
leave
mov edi, edi
push edx
mov edx, dword [esp + 8]
sub edx, 0x400000
add dword [esp + 4], edx
pop edx
ret 0x10
jp 0x401bbc
add byte [eax], al
add bh, bh
jno 0x401b49
mov word [ecx], fs
dec ebx
imul ebp, dword [ecx], 0xffffff95
cmc
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.ntdll.dll_NtLoadKey2
and dword [ebx + 0x6b], ecx
sub dword [ebp + 0x3f5], edx
call dword [sym.imp.ntdll.dll_NtLoadKey2]
or word [ebx + 0xc1a], 0x1a00
push 0x1ac
or eax, ebx
sub edx, 0x2e8
mov eax, ebp
lea esi, [edi + esi*4 + 0x5e]
push ebp
call 0x400cf8
add eax, dword [ecx + 0x413]
push dword [eax + 0x764]
invalid
invalid
invalid
Function at 0x401bbe
Capabilities:
Get file version info

Disassembly:
adc byte [eax], al
shr eax, 0x38
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add byte [esi - 0x7f], ah
stosb byte es:[edi], al
adc al, 9
add byte [eax], al
add byte [ecx + eax*4], dl
adc al, 0x81
sahf
outsb dx, byte [esi]
push es
add byte [eax], al
add byte [esi], ch
add al, ch
adc bh, bh
invalid
dec dword [ebp + 0x552c3e94]
add dword [edi + edi*8 + 0x4010a015], edi
mov al, byte [0x47004010]
call fcn.00401251
call 0x401bbe
sub edi, 0x822
call 0x400ee3
or dword [esp + 0x1ec], ebp
push dword [ebx + 0x50]
pop ebx
leave
mov edi, edi
push edx
mov edx, dword [esp + 8]
sub edx, 0x400000
add dword [esp + 4], edx
pop edx
ret 0x10
jp 0x401bbc
add byte [eax], al
add bh, bh
jno 0x401b49
mov word [ecx], fs
dec ebx
imul ebp, dword [ecx], 0xffffff95
cmc
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.ntdll.dll_NtLoadKey2
and dword [ebx + 0x6b], ecx
sub dword [ebp + 0x3f5], edx
call dword [sym.imp.ntdll.dll_NtLoadKey2]
or word [ebx + 0xc1a], 0x1a00
push 0x1ac
or eax, ebx
sub edx, 0x2e8
mov eax, ebp
lea esi, [edi + esi*4 + 0x5e]
push ebp
call 0x400cf8
add eax, dword [ecx + 0x413]
push dword [eax + 0x764]
invalid
invalid
invalid

Function at 0x401bfd
Capabilities:
Get file version info

Disassembly:
add al, 0
add byte [ecx], ah
push ecx
loope 0x401c03
mov bh, 0xaa
or eax, dword [eax]
add bh, bh
adc eax, sym.imp.version.dll_GetFileVersionInfoA

Function at 0x402ece
Capabilities:
Accept command line arguments

Disassembly:
add byte [eax], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
or edx, ebx
xchg esi, eax
int3

Function at 0x40534d
Capabilities:
Terminate process

Disassembly:
add byte [eax], al
call fcn.0040338d
push 0x14
push dword [esp + 0xc]
push 0x40034a
push 0x404204
call fcn.004024e9
mov edx, 0x69c
call dword [sym.imp.user32.dll_CreatePopupMenu]
xor eax, 0x93e
mov ebx, 0xc20
xchg esp, eax
or eax, eax
xchg edi, eax

Function at 0x405383
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push 0xffffffffffffffbc
push 0xffffffffffffffd2
push edx
push 0x404eca
call fcn.00402464
sub edx, dword [esp + 0x398]
shr edi, 0x40
push 0x8a
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x405994
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
call fcn.0040239a
add dword [ebx + 0x220], 0x2000
ror ebx, 0x68
sub edx, edi
push dword [eax + 0x83a]
ror edi, 0x40
xchg ebx, eax
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
ret

Function at 0x407c5c
Capabilities:
Terminate process

Disassembly:
push ebx
dec edi
jmp 0x4097e4
call fcn.0040b2a9
push esi
push dword [esp + 4]
push 0x400420
push 0x3fe6c3
call fcn.00402bfe
mov ebx, 0x5ea
mov ebx, dword [esp + 0x225]
call fcn.00408d44
mov ebx, dword [eax + 0x372]
jbe 0x4098fb
mov eax, dword [edx + 0x109]
mov ebx, dword [ebp + 0x16]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, edi
dec dword [ecx + 0x768bc84d]
jae 0x409904
adc eax, sym.imp.KERNEL32.dll_CreateIoCompletionPort
Function at 0x407e6e
Capabilities:
Terminate process

Disassembly:
add eax, ecx
push eax
push ebp
push 0x22
push edx
push 0x408682
jb 0x407ed8
mov dword [esp - 0xb], edx
call fcn.004089b3
ja 0x4083c2
pop edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xffffffffffffffee
push dword [esp + 8]
push 0x405037
call fcn.004023ff
push dword [edx - 0x70]
mov dword [ecx - 0x17], ebx
lea eax, [eax]
push esp
adc byte [eax + 0x452], 0
call dword [sym.imp.user32.dll_DialogBoxParamA]
push dword [esi + 0x5e]
push dword [esi + 0x5c0]
pop ecx
push dword [esi]
push dword [esp + 0xc]
push 0xa
push 0x400008
or al, 0
push 0xffffffffffffffe8
push 0xffffffffffffff8e
push 0x40083c
push 0x3fd248
call fcn.00402bfe
mov dword [edx - 0x16], ecx
inc ebx
push dword [esi + 0xac0]
push dword [edi + 0x50a]
call fcn.00408748
mov dword [esp - 0xf], ebx
test edx, ebx
xchg edi, eax
inc edx
xchg esp, eax
push 0x40091e
push dword [esp + 0xc]
push 0x4000f6
push 0x400084
push 0x3fe77d
call fcn.00402bfe
mov esp, dword [esp + 0x358]
call dword [sym.imp.ntdll.dll_RtlCheckForOrphanedCriticalSections]
push dword [eax + 0x24a]
call fcn.004085c6
mov ecx, ebx
push dword [eax + 0x3e]
mov ebx, esp
push 0xffffffffffffffea
mov ecx, edx
jae 0x408c11
ret 0xc
add byte [eax], al
sbb dword [eax + 0x6ac], 0xac00
test eax, ecx
pop ebx
nop
push 0x4007a4
push 0x400c9a
push 0x400d58
call fcn.00403ac7
push 0x400f44
push dword [esp + 0xc]
push 0xffffffffffffffba
push 0x3fdbc2
call fcn.00402464
push 0xdcc
mov ebp, dword [esi + 0x50e]
push dword [edx + 0xe08]
push 0xfffffffffffffff2
call dword [sym.imp.KERNEL32.dll_LocalLock]
sub al, 0x10
inc eax
add al, ch
inc ecx
add byte es:[eax], al
jmp 0x402d14

Function at 0x408f54
Capabilities:
Get hostname

Disassembly:
add byte [edi + 0x72], dh
push 0x3fb726
call fcn.004024e9
call dword [sym.imp.user32.dll_LoadBitmapA]
jno 0x408f0c
push 0xffffffffffffffe0
mov dword [eax + 0x28], ebp
xor byte [edi + 0x27c], 0
jl 0x40931c
push dword [edx + 0x49e]
push dword [esp + 4]
push 0x400936
adc eax, sym.imp.KERNEL32.dll_SetWaitableTimer
call dword [sym.imp.ntdll.dll_NtInitializeRegistry]
xchg ebx, eax
push 0x64
leave

Function at 0x409083
Capabilities:
Delete file

Disassembly:
je 0x4090a9
add al, 0x68
adc eax, 0xe8004040
invalid
outsb dx, byte [esi]
wait
invalid
cmp cl, byte [edx]
inc eax
add byte [eax + 0x78], ch
or al, byte [eax]
push ebx
push 0x40357b
call fcn.004024e9
push dword [edi + 0x22]
mov ebx, 0x554
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebx
call fcn.00409d69
push dword [eax + 0x60]
jno 0x409106
int3
xchg ecx, eax
push 0xffffffffffffffa2
push dword [esp + 0xc]
push 0x400d86
push 0x4009d4
push 0x3ffcb7
call fcn.0040239a
call fcn.00408f54
call dword [sym.imp.comdlg32.dll_PageSetupDlgA]
inc ebp
mov dword [eax + 0x29], ebx
jl 0x40946e
push 0x7c
ret
adc eax, sym.imp.user32.dll_LoadCursorFromFileA