joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009d08
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x100edf0
call fcn.01009d3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x101043c
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1009abf
cmp eax, esi
jne 0x1009ab2
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1009ac2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1009a99
xor esi, esi
inc esi
mov eax, dword [0x1010438]
cmp eax, esi
jne 0x1009ad5
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1009b04
mov eax, dword [0x1010438]
test eax, eax
jne 0x1009afe
mov dword [0x1010438], esi
push 0x10012d4
push 0x10012c8
call fcn.010099fe
pop ecx
pop ecx
test eax, eax
je 0x1009b04
jmp 0x1009c2c
mov dword [0x10100e8], esi
mov eax, dword [0x1010438]
cmp eax, esi
jne 0x1009b28
push 0x10012c4
push 0x10012bc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1010438], 2
test ebx, ebx
jne 0x1009b34
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1010440], 0
je 0x1009b58
push 0x1010440
call fcn.01009f79
pop ecx
test eax, eax
je 0x1009b58
push 0
push 2
push 0
call dword [0x1010440]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1009bb4
test al, al
je 0x1009b72
cmp dword [ebp - 0x1c], 0
jne 0x1009bb4
mov al, byte [esi]
test al, al
je 0x1009b82
cmp al, 0x20
ja 0x1009b82
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1009b72
test byte [ebp - 0x3c], 1
je 0x1009b8e
movzx eax, word [ebp - 0x38]
jmp 0x1009b91
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x10100e4], eax
cmp dword [0x10100d8], 0
jne 0x1009c08
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x1009bc3
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1009bd6
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1009b5f
cmp dword [0x10100e8], 0
jne 0x1009c17
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10100e4]
jmp 0x1009c38
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01009d81
ret
call fcn.0100a0c6
jmp 0x1009a5f
Function at 0x100a273
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x100a296
mov edi, 0x80070057
jmp 0x100a387
push esi
push 0x60
push 8
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
jne 0x100a2ba
mov edi, 0x8007000e
jmp 0x100a345
push ebx
push ebx
push 0x1001e04
lea eax, [ebp - 8]
push eax
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
push eax
call fcn.0100a24e
mov edi, eax
cmp edi, ebx
jne 0x100a345
push ebx
push 0x5e
push esi
push dword [ebp - 8]
call sub.bcrypt.dll_BCryptGenRandom
push eax
call fcn.0100a24e
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, ebx
jne 0x100a345
xor ecx, ecx
mov dword [ebp - 0xc], 5
mov eax, dword [ebp - 4]
movzx eax, word [esi + eax*2]
cdq
push 0xa
pop edi
idiv edi
mov eax, dword [ebp - 4]
add edx, 0x30
inc dword [ebp - 4]
dec dword [ebp - 0xc]
mov word [esi + eax*2], dx
jne 0x100a2fa
lea eax, [ecx + 1]
cmp eax, 8
je 0x100a32e
mov edx, dword [ebp - 4]
inc dword [ebp - 4]
push 0x2d
pop ecx
mov word [esi + edx*2], cx
mov ecx, eax
cmp ecx, 8
jl 0x100a2f3
mov edi, dword [ebp - 0x10]
xor eax, eax
mov word [esi + 0x5e], ax
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor esi, esi
cmp dword [ebp - 8], ebx
je 0x100a353
push ebx
push dword [ebp - 8]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
cmp esi, ebx
je 0x100a386
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
cmp eax, 0xffffffff
je 0x100a386
mov ecx, esi
cmp eax, ebx
je 0x100a377
mov byte [ecx], bl
inc ecx
dec eax
jne 0x100a371
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x100b9d0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1010004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x218], ebx
cmp ecx, ebx
je 0x100bb03
cmp eax, ebx
je 0x100bb03
mov edx, dword [ebp + 0x10]
cmp edx, ebx
je 0x100ba18
cmp word [edx], bx
je 0x100ba18
mov dword [esi], edx
jmp 0x100ba1e
mov dword [esi], 0x1002204
push eax
mov dword [esi + 4], ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x100ba3e
mov dword [ebp - 0x214], 0x8007000e
jmp 0x100bb21
lea edi, [esi + 8]
push edi
push 0x100234c
push 1
push ebx
push 0x100241c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x214], eax
cmp eax, ebx
jne 0x100bb21
push dword [esi + 4]
lea eax, [ebp - 0x210]
push dword [esi]
push 0x10021f4
push 0x105
push eax
call fcn.01003ac7
add esp, 0x14
mov dword [ebp - 0x214], eax
cmp eax, ebx
jne 0x100bb21
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x218], eax
cmp eax, ebx
jne 0x100bab2
mov dword [ebp - 0x214], 0x8007000e
jmp 0x100bb0d
mov eax, dword [edi]
mov ecx, dword [eax]
lea edi, [esi + 0xc]
push edi
push ebx
push ebx
push 0x80
push ebx
push ebx
push ebx
push dword [ebp - 0x218]
push eax
call dword [ecx + 0xc]
mov dword [ebp - 0x214], eax
cmp eax, ebx
jne 0x100bb0d
push dword [edi]
call fcn.0100b83a
mov dword [ebp - 0x214], eax
cmp eax, ebx
jne 0x100bb0d
mov edi, dword [edi]
mov eax, dword [edi]
push ebx
lea ecx, [esi + 0x10]
push ecx
push ebx
push ebx
push dword [esi + 0x14]
push edi
call dword [eax + 0x18]
mov dword [ebp - 0x214], eax
jmp 0x100bb0d
mov dword [ebp - 0x214], 0x80070057
cmp dword [ebp - 0x218], ebx
je 0x100bb21
push dword [ebp - 0x218]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01009dc4
leave
ret 0xc
Function at 0x100da47
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1010004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x100dab5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100dab1
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x100db22
lea eax, [ebp - 0x10]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100da9d
push esi
push 1
mov esi, 0x100280c
push esi
push dword [ebp - 0x10]
call fcn.0100d998
mov edi, eax
cmp edi, ebx
jge 0x100daf0
push 0x1002788
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x100db21
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push 1
push 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
cmp eax, ebx
je 0x100db15
jle 0x100db1f
and eax, 0xffff
or eax, 0x80070000
jmp 0x100db1f
push ebx
push esi
push dword [ebp - 0x10]
call fcn.0100d998
mov edi, eax
pop esi
cmp dword [ebp - 0x14], ebx
je 0x100db33
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x10], ebx
je 0x100db41
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.01009dc4
leave
ret 4
Function at 0x100db58
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
xor ebx, ebx
push 0x20a
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x100db95
mov dword [ebp - 4], 0x8007000e
jmp 0x100dc79
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ebx, eax
test ebx, ebx
ja 0x100dbc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100dc57
and eax, 0xffff
or eax, 0x80070000
jmp 0x100dc57
lea eax, [ebx + ebx]
push eax
push 0
call esi
push eax
call edi
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x100dbe1
mov dword [ebp - 4], 0x8007000e
jmp 0x100dc5a
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x100dba7
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x100dc05
mov dword [ebp - 4], 0x80004005
jmp 0x100dc5a
cmp eax, 3
jne 0x100dc5a
push 0x105
push dword [ebp - 8]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x100dc2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jmp 0x100dbaf
push dword [ebp - 8]
push 0x1002840
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x100dc5a
push dword [ebp + 8]
call fcn.0100d811
mov dword [ebp - 4], eax
test eax, eax
jne 0x100dc5a
push dword [ebp + 8]
call fcn.0100da47
mov dword [ebp - 4], eax
push dword [ebp - 8]
xor ebx, ebx
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
cmp dword [ebp - 0xc], ebx
je 0x100dc79
push dword [ebp - 0xc]
push ebx
call esi
push eax
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100dcf0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1010004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1002858
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ddc5
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100ddb4
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x100dd9e
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x100ddb4
push eax
push edi
push dword [ebp - 0x110]
call fcn.0100dc88
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x100ddc7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01009dc4
leave
ret 4

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x5128346e
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x5de81ad6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4027f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4027d8
xor eax, eax
push ebp
push 0x4027d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402814
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4027d8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x403e80
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404038
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403ee1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404054
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403f4e
xor eax, eax
push ebp
push 0x403f47
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x403f30
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404074
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f4e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40402f
cmp byte [ebp - 0xd], 0
jne 0x403f90
cmp byte [ebp - 0x12], 0
je 0x40402f
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x403fa9
dec ebx
cmp byte [ebx], 0x2e
je 0x403fb8
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x403fa8
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40402f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x403fe5
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40402f
cmp byte [ebp - 0xd], 0
je 0x40402f
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40402f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406178
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406282
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4061cb
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.0040317c
jmp 0x406269
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.0040612c
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.0040614c
mov ebx, eax
test esi, esi
je 0x4061f3
dec esi
test esi, esi
jl 0x4061f3
cmp edi, ebx
jne 0x4061d2
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.004031bc
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403408
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403204
cmp eax, 2
jl 0x406269
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406269
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403204
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406269
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403204
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406289
lea eax, [ebp - 0x110]
call fcn.00403098
ret

Function at 0x4062c4
Capabilities:
Get file attributes

Disassembly:
call fcn.0040504c
push eax
call sub.kernel32.dll_GetFileAttributesA
and al, 0x10
sete al
ret

Function at 0x40638c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40645b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409fb8
xor ebx, ebx
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edi
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x406445
cmp dword [ebp - 0x10], 0
jbe 0x406443
mov ebx, dword [ebp - 0x10]
dec ebx
test ebx, ebx
jb 0x406443
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00403534
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
call fcn.004033d4
push eax
push esi
push edi
call sub.advapi32.dll_RegEnumValueA
lea eax, [ebp - 0x18]
call fcn.004033d4
push eax
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00403534
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.00409fa8
inc esi
dec ebx
jne 0x4063ee
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406462
lea eax, [ebp - 0x18]
call fcn.00403098
ret
Function at 0x4067a4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40683c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x4067f1
mov eax, dword [ebx + 0x19]
call fcn.004033c8
push eax
push esi
mov eax, edi
call fcn.004033c8
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004033c8
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x406826
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.004033c8
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00405f9c
mov eax, dword [ebp - 8]
call fcn.004033c8
push eax
mov eax, edi
call fcn.004033c8
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004033c8
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406843
lea eax, [ebp - 8]
call fcn.00403098
ret
Function at 0x408c98
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x408ca7
mov edx, dword [edx + 0x36]
jmp fcn.004031bc
mov ecx, dword [edx + 0x18]
jecxz 0x408c9f
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.00403534
pop edx
mov ecx, dword [ebx]
jecxz 0x408ccf
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x408d40
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x408d4c
or byte [eax + 0x27], 0x10
mov byte [eax + 0x4e], dl
mov ecx, dword [eax + 0x18]
jecxz 0x408d68
push eax
je 0x408d69
call dword [0x41812c]
pop eax
push 5
push dword [eax + 0x18]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x15a], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x41812c]
ret

Function at 0x40aefc
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
cmp byte [0x418294], 0xff
je 0x40af12
mov al, byte [0x418294]
jmp 0x40af72
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x40af4b
mov al, 3
mov edx, dword [esp + 4]
cmp edx, 6
jb 0x40af37
mov al, 6
jmp 0x40af6d
cmp edx, 5
jb 0x40af6d
cmp dword [esp + 8], 1
jb 0x40af47
mov al, 5
jmp 0x40af6d
mov al, 4
jmp 0x40af6d
cmp eax, 1
jne 0x40af6b
mov al, 1
cmp dword [esp + 4], 4
ja 0x40af67
cmp dword [esp + 4], 4
jne 0x40af6d
cmp dword [esp + 8], 0xa
jb 0x40af6d
mov al, 2
jmp 0x40af6d
xor eax, eax
mov byte [0x418294], al
add esp, 0x94
ret
Function at 0x1003c1f2
Capabilities:
Encode data using xor

Disassembly:
sbb ch, byte [esi + 0x5234a418]
xor ecx, ebx
dec eax
mov ch, byte [ebx + 0x20c32b54]
psubb mm1, qword [ecx]
aam 0xe5
invalid