joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e06f
Capabilities:
Encode data using xor

Disassembly:
cmc
pushal
cmp ecx, dword [ebp - 4]
lea esp, [esp + 0x20]
jp 0x4a3f7c
jae 0x4a7853
clc
clc
cmp si, bx
bt di, si
add ecx, 1
pushfd
call fcn.004a70a0
mov edi, ebx
seta bh
pop ebx
call 0x45dea8
jmp 0x45e38d
lea esp, [esp + 0x44]
ja 0x4542e8
jmp 0x454ca8
bswap ax
lea eax, [esi*4 + 0x4cf31405]
lea edi, [edi + 1]
mov eax, 0x67522a93
pushal
bswap ax
mov eax, dword [esp + 0x20]
pushal
jmp 0x45b95e
add al, 0x8b
push 0x8f8ced10
mov dword [esp + 8], esp
pushfd
push 0x8a28c018
ror al, 5
stc
clc
neg al
bt bx, 7
cmc
rol al, 4
stc
cmp al, byte [edi]
lea esp, [esp + 0x1c]
jp 0x45fa13
cwde
lea edi, [edi + 1]
not ax
bswap ax
setns al
pop eax
jmp 0x4a7131
pushal
lea esp, [esp + 0x20]
jb 0x4a4579
clc
cmp ebx, ecx
cmp byte [edi - 1], 0
call fcn.004a2d5e
lea ebx, [edx - 0x8871ed9]
jmp 0x454925
bswap ax
jmp 0x45df37
xor al, 0x60
cmp cx, 0xee79
neg al
call fcn.004a7809
pushal
lea esp, [esp + 0x28]
jae 0x4a7853
stc
push 0x357f9858
add ecx, 1
pushfd
mov word [esp], cx
mov dword [ebp - 8], ecx
pushal
mov word [esp], dx
lea esp, [esp + 0x28]
jmp 0x4a438b
call fcn.0045f478
not al
lodsb al, byte [esi]
pushal
mov byte [esp + 0x10], cl
test ch, dh
jmp 0x4a2d63
push 0x4eb58902
push dword [esp]
jmp 0x4a3e96
pushal
pushal
lea esp, [esp + 0x44]
jbe 0x4a7853
cmc
sub di, 0xa4cc
stc
movzx di, dl
sub ecx, 1
neg si
mov dword [ebp - 4], ecx
movzx edi, cl
bsf di, sp
adc cl, cl
mov ecx, dword [ebp - 8]
shr di, cl
btr esi, ebp
add ecx, dword [ebp - 4]
movzx di, al
shr ecx, 1
bsr di, ax
mov edi, dword [ebx + ecx*4]
bt eax, eax
clc
add edi, eax
movsx si, dl
push 0x7f5ffd2e
mov esi, dword [ebp + 0xc]
lea esp, [esp + 4]
call fcn.0045ddda
pushfd
clc
cmc
cmp ecx, dword [ebp - 8]
jmp 0x4a436b
lea esp, [esp + 4]
je 0x45bf8c
shl bl, cl
add dword [ebp - 4], ecx
dec bl
shr bh, 4
sub ecx, 8
pushfd
test di, 0x2d1d
shr ecx, 1
dec di
shrd di, cx, cl
dec bx
mov edi, dword [esi]
add bl, 0xb7
not bx
bt ebx, ebx
add edi, dword [ebp + 0x10]
sbb bx, 0x4fd2
add esi, 8
jmp 0x4a3ed5
call fcn.0045fa68
dec esp
loope 0x4a71a8
push ecx
imul edx, dword [edx + 0x402acf69], 0xf92a3071
xchg edx, eax
mov ah, 0x5a
in al, dx
push es
cmp bl, byte [esi]
lodsd eax, dword [esi]
rcl bh, cl
mov dl, 0xbd
push esi
sbb eax, 0xea46222c
inc edx
xor byte [edx], cl
or al, 0xb2
rcl byte [esp + ecx + 0x577d2215], 0xc1
je 0x4a7156
push edx
not byte [edx - 0x14]
inc ebp
rcr bl, cl
call 0xe551eb94
jl 0x4a71d0
iretd
pop esi
enter 0x4b74, 0x54
fnsave dword [esp + edi*2 + 0x51f79a3b]
cmp byte [ecx], dl
out 0xbb, al
pushal
pop esp
cmc
push eax
stosb byte es:[edi], al
or eax, 0xc909bb69
jmp 0x4a4e21
dec dword [ebp + 0xf342464]
xor ecx, 0x52
sti
invalid
Function at 0x45e181
Capabilities:
Encode data using xor

Disassembly:
nop
lahf
invalid
scasb al, byte es:[edi]
xchg ebx, eax
or dword [ecx + 0x4b], ebp
and al, 0x98
ljmp 0x4775
pushfd
mov byte [esp + 8], bh
dec al
test dh, cl
call fcn.0045ba9c
jae 0x45e19c
mov dl, 0x19
rcr byte [ebx - 0x41], 1
adc al, 0x39
loop 0x45e15f
invalid
inc esp
push cs
jp 0x45e14f
pop ss
mov cl, 0xad
and eax, 0xdd267f17
pop ebp
xor ah, byte [edx - 0x59]
clc
push esp
ja 0x45e1a9
or al, 0xd7
sbb byte [eax + edx*2], dl
xor dword [ebx - 0x55f42b0d], ebx
jecxz 0x45e1d4
fiadd word [0xc85d586f]
imul ebp, dword [ebx + 0x4f], 0x28be760e
arpl word [ecx - 0x53f70bcd], sp
pop eax
into
mov edx, dword [edi - 0x32542ddb]
mov dl, 0x7b
stosb byte es:[edi], al
mov edi, 0x5e8e02ca
jbe 0x45e1e7
xlatb
mov dword [0x3a938c1a], eax
pop ecx
vaddsubpd ymm0, ymm5, ymmword [edi - 0x15f630c5]
mov word [ebx - 0x2a3aa6c6], ss
rol byte [edi - 0x15f630c5], 1
inc ebp
insb byte es:[edi], dx
mov dword [esi - 0x3f78a694], 0x47b3824d
in al, dx
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404712
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x404733
jl 0x40472a
test edi, edi
jne 0x404733
xor eax, eax
xor edx, edx
jmp 0x4047f4
cmp dword [ebx + 0x38], 0
je 0x404748
push eax
push edi
push dword [ebp + 8]
call fcn.004047fa
jmp 0x4047f4
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40478f
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40478f
cmp eax, edi
jb 0x404769
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.004061a0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x404795
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x4047e9
mov ecx, ebx
call fcn.00403f62
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x4047d4
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040cfac
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x4047e9
jmp 0x4047a7
test edx, edx
je 0x4047e9
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040cfac
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x405b4c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405b8b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405b8b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405b8b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405b8b
cmp dword [ecx + 0x74], 0xe
jbe 0x405b8b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x412066
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x425f10
push 0x425f08
push str.FlsAlloc
push 0x1e
call fcn.00411ed3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41209a
push dword [ebp + 8]
mov ecx, esi
call dword [0x422148]
call esi
jmp 0x4120a0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4120e4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x425f20
push 0x425f18
push str.FlsGetValue
push 0x20
call fcn.00411ed3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41211b
push dword [ebp + 8]
mov ecx, esi
call dword [0x422148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41557b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004153ec

Function at 0x415975
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00405cb0
mov eax, dword [0x478d00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041358a
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4159b7
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x415b13
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00420840
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x47a648]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00416b45
mov ecx, dword [esi*4 + 0x47a648]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x415b0c
cmp eax, dword [edi + ecx + 0x24]
jne 0x415b0c
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x415b0c
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00416b45
add esp, 0x14
test edx, edx
jl 0x415b0c
jg 0x415a82
test eax, eax
jb 0x415b0c
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x415b0c
jl 0x415a9c
cmp dword [ebp - 0x1008], eax
ja 0x415b0c
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x415aba
test ebx, ebx
je 0x415af3
cmp ecx, edi
jae 0x415af3
mov al, byte [ecx]
cmp al, 0xd
jne 0x415ad4
lea eax, [edi - 1]
cmp ecx, eax
jae 0x415ae0
cmp byte [ecx + 1], 0xa
jne 0x415ae0
inc ecx
jmp 0x415ae0
movzx eax, al
movsx eax, byte [eax + 0x478fd0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x415aba
cmp edx, ebx
jne 0x415aba
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x415b11
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00404f15
leave
ret
Function at 0x415fe3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x47a648]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x416023
cmp byte [ebx], 0xa
jne 0x416023
or byte [eax + edi + 0x28], 4
jmp 0x416028
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x416126
mov al, byte [edx]
cmp al, 0x1a
je 0x416108
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x416057
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41607c
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x416086
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x416039
jmp 0x416126
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416103
cmp dword [ebp - 0xc], 0
je 0x416103
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x47a648]
test byte [eax + edi + 0x28], 0x48
je 0x4160dd
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4160c8
mov byte [esi], dl
jmp 0x4160d9
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x47a648]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x416126
cmp byte [ebp - 1], 0xa
jne 0x4160ec
cmp esi, ebx
jne 0x4160ec
mov byte [esi], 0xa
jmp 0x416125
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00416b63
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x416126
mov byte [esi], 0xd
jmp 0x416125
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x47a648]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x416122
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x416126
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41612f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x47a648]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x416172
cmp word [esi], dx
jne 0x416172
or byte [edi + eax + 0x28], 4
jmp 0x416177
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4162ca
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4162aa
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4161b9
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4161ef
cmp eax, edx
jae 0x4161fb
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x416191
jmp 0x4162ca
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4162a6
cmp dword [ebp - 0x14], 0
je 0x4162a6
mov eax, dword [ebx*4 + 0x47a648]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41627e
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x416247
mov word [esi], cx
jmp 0x41627a
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x47a648]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x47a648]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x47a648]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4162ca
pop ebx
cmp word [ebp - 4], bx
jne 0x41628f
cmp esi, dword [ebp + 0xc]
jne 0x41628f
mov word [esi], bx
jmp 0x4162c7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00416b63
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4162ca
push 0xd
jmp 0x4162c3
mov ecx, dword [ebx*4 + 0x47a648]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4162c1
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4162ca
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x418e14
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x418eb1
push ebx
push esi
call fcn.00418ddd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00417a62
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x418e5e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x418eb0
push edi
push eax
call fcn.00412699
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x418e7e
call fcn.00411b9b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x418eaf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00417a62
add esp, 0x20
test eax, eax
jne 0x418e9d
push edi
call fcn.00411b9b
jmp 0x418ea5
push ebx
call fcn.00411b9b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x420640
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42066d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42066d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40154f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x14c
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [0x7a436c]
lea edi, [ebp - 0x121]
mov dword [ebp - 0x12c], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], edx
or eax, 8
mov dword [esp + 0xc], eax
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x4015ca
jmp 0x401651
cmp dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x1c]
je 0x4015bd
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 1
push edx
jmp 0x401651
xor ecx, ecx
mov edx, edi
call fcn.0040154f
test eax, eax
jne 0x4015f0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumKeyA
sub esp, 0x10
test eax, eax
je 0x40159e
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
mov dword [esp], 2
call fcn.0040708e
test eax, eax
push edi
je 0x40162d
mov edx, dword [0x7a436c]
mov dword [esp + 0xc], 0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], edx
call eax
sub esp, 0x10
jmp 0x401651
cmp dword [0x7a436c], 0
mov eax, 1
jne 0x401651
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
push ebx
setne al
push ebx
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4038e4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x40390e
mov eax, dword [0x421c44]
test eax, eax
je 0x403902
mov dword [esp], eax
call sub.USER32.dll_DestroyWindow
push ecx
mov dword [0x421c44], 0
jmp 0x40397a
cmp dword [0x421c44], 0
je 0x403926
mov dword [esp], 0
call fcn.00407045
push edx
jmp 0x40397a
call sub.KERNEL32.dll_GetTickCount
cmp eax, dword [0x7a43ec]
jbe 0x40397a
mov eax, dword [0x7a444c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x403cbe
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call sub.USER32.dll_CreateDialogParamA
sub esp, 0x14
mov dword [0x421c44], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
push eax
push eax
leave
ret
Function at 0x40735d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x14]
lea edx, [ebp - 0xc]
mov byte [ebx], 0
cmp dword [ebp + 0x18], 1
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
sbb eax, eax
xor al, al
add eax, 0x20119
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x4073fc
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0x400
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x4073e6
mov eax, dword [ebp - 0x14]
dec eax
cmp eax, 1
jbe 0x4073e9
mov byte [ebx], 0
mov byte [ebx + 0x3ff], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push ebx
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x4076d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x64
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x1c]
jmp 0x40772a
mov dword [esi], 0x61736e
call sub.KERNEL32.dll_GetTickCount
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], esi
div ecx
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
add edx, 0x61
mov byte [ebp - 0x1a], dl
call sub.KERNEL32.dll_GetTempFileNameA
sub esp, 0x10
test eax, eax
jne 0x407735
dec edi
cmp edi, 0xffffffff
jne 0x4076ee
mov byte [ebx], 0
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x407741
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x7a36b8
mov dword [esp + 4], eax
call fcn.00407312
push eax
push eax
mov dword [esp], 0x7a36b8
call fcn.0040713d
test eax, eax
push ebx
mov ebx, eax
je 0x4077ed
mov dword [esp], eax
call fcn.004071af
cmp byte [0x7a43fc], 0
push ecx
jns 0x4077b3
mov al, byte [ebx]
cmp al, 0x5c
je 0x4077ed
test al, al
jne 0x4077b3
jmp 0x4077ed
mov dword [esp], 0x7a36b8
call fcn.004070de
test eax, eax
push edx
je 0x4077a4
test byte [eax], 0x10
je 0x4077ed
mov dword [esp], 0x7a36b8
call fcn.00407296
push ecx
jmp 0x4077b9
sub ebx, 0x7a36b8
mov dword [esp], 0x7a36b8
call sub.KERNEL32.dll_lstrlenA
cmp eax, ebx
push edx
jg 0x40778e
mov dword [esp], 0x7a36b8
call fcn.004072ce
push ecx
mov dword [esp], 0x7a36b8
call sub.KERNEL32.dll_GetFileAttributesA
inc eax
setne al
push edx
movzx eax, al
jmp 0x4077ef
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4077f6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
push edx
xor edx, edx
cmp eax, 0xffffffff
setne dl
neg edx
and eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call sub.KERNEL32.dll_CreateFileA
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc

Function at 0x407851
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
push edx
je 0x40787a
and eax, 0xfffffffe
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_SetFileAttributesA
push ecx
push ecx
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x407efa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [0x7a3eb8], 0x44
mov dword [esp + 0x20], 0x7a3eb8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x407f76
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x18]
push ecx
leave
ret 4

Function at 0x407f7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x7a3f00], 0
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
jne 0x407fbe
xor edx, edx
mov eax, edx
xor edi, edi
mov ecx, eax
inc edi
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor eax, ecx
cmp edi, 8
jne 0x407f97
mov dword [edx*4 + 0x7a3efc], eax
inc edx
cmp edx, 0x100
jne 0x407f93
mov eax, dword [ebp + 8]
not eax
jmp 0x407fd8
mov dl, byte [ebx]
dec esi
inc ebx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x7a3efc]
test esi, esi
jne 0x407fc5
not eax
pop ebx
pop esi
pop edi
pop ebp
ret 0xc