joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af728
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af7ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4af81c
push ebx
push 0x4af82c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087c4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405884
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4af7aa
mov ax, 0x83
call fcn.004af34c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004af6fc
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4af7b3
call fcn.004af6fc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af806
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x4af91c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
jmp 0x4af9db
cmp dword [esi + 0x10], 0x1000
jne 0x4af9c7
test byte [esi + 0x15], 1
jne 0x4af9c7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4af978
cmp ebp, 2
je 0x4af978
cmp ebp, 0x10
je 0x4af978
cmp ebp, 0x20
jne 0x4af994
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4af994
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4af9a5
mov eax, dword [esi]
add eax, ebx
call fcn.004af914
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4af998
cmp byte [esp + 4], 0
je 0x4af9c7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4af94d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x402dfb
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp - 4]
push ebx
push edi
push eax
mov eax, dword [0x434ad0]
xor edi, edi
or eax, 8
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402e8d
mov ebx, 0x105
jmp 0x402e46
cmp dword [ebp + 0x10], edi
jne 0x402e81
push edi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.00402dfb
test eax, eax
jne 0x402e5c
push ebx
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x402e2d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406419
test eax, eax
je 0x402e95
push edi
push dword [0x434ad0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402e8d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x434ad0], edi
jne 0x402e8a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402e8a
mov eax, edi
jmp 0x402e8d
Function at 0x402f4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x9c
mov ecx, dword [esp + 0xa0]
mov eax, 0x422518
push ebx
push esi
push edi
mov edi, dword [esp + 0xb4]
mov ebx, 0x8000
test edi, edi
cmovne ebx, dword [esp + 0xb8]
xor esi, esi
test edi, edi
cmovne eax, edi
mov dword [esp + 0x18], eax
test ecx, ecx
js 0x402f93
mov eax, dword [0x434a38]
add eax, ecx
push eax
call fcn.00402f35
push 4
lea eax, [esp + 0x10]
push eax
push dword [0x40a010]
call fcn.0040647b
test eax, eax
jne 0x402fb1
push 0xfffffffffffffffd
pop eax
jmp 0x403113
mov eax, dword [esp + 0xc]
push ebp
test eax, eax
jns 0x403131
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x10]
and dword [0x40ce84], esi
and dword [0x40ce80], esi
and ecx, 0x7fffffff
mov dword [esp + 0x14], eax
mov eax, 0x40e508
mov dword [0x40c968], 8
mov dword [0x416510], eax
mov dword [0x41650c], eax
mov dword [0x416508], 0x416508
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], ecx
jle 0x403110
mov ebp, 0x4000
cmp ecx, ebp
cmovl ebp, ecx
push ebp
push 0x41e518
call fcn.00402f1f
test eax, eax
je 0x40318b
sub dword [esp + 0x10], ebp
mov dword [0x40c95c], ebp
mov ebp, dword [esp + 0x1c]
mov dword [0x40c958], 0x41e518
push 0x40c958
mov dword [0x40c960], ebp
mov dword [0x40c964], ebx
call fcn.00406d41
mov dword [esp + 0x28], eax
test eax, eax
js 0x40312d
mov eax, dword [0x40c960]
sub eax, ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x434ad4], 1
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
je 0x4030d3
sub eax, dword [esp + 0x14]
cmp eax, 0xc8
ja 0x403097
test ecx, ecx
jne 0x4030d3
mov eax, dword [esp + 0x20]
push eax
push 0x64
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [esp + 0x30]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.0040595b
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40311f
test edi, edi
jne 0x4030f7
push eax
push ebp
push dword [esp + 0xbc]
call fcn.0040652d
test eax, eax
je 0x403129
mov eax, dword [esp + 0x18]
jmp 0x403103
mov ebp, dword [0x40c960]
sub ebx, eax
mov dword [esp + 0x1c], ebp
add esi, eax
cmp dword [esp + 0x28], 1
jne 0x403044
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x9c
ret 0x10
test ecx, ecx
jg 0x40300f
jmp 0x403110
push 0xfffffffffffffffe
jmp 0x40318d
push 0xfffffffffffffffc
jmp 0x40318d
test edi, edi
jne 0x403174
test eax, eax
jle 0x403110
mov ebp, 0x41e518
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push ebp
call fcn.00402f1f
test eax, eax
je 0x40318b
push edi
push ebp
push dword [esp + 0xbc]
call fcn.0040652d
test eax, eax
je 0x403129
mov eax, dword [esp + 0x10]
add esi, edi
sub eax, edi
mov dword [esp + 0x10], eax
test eax, eax
jg 0x40313e
jmp 0x403110
mov esi, dword [esp + 0xbc]
cmp eax, esi
cmovl esi, eax
push esi
push edi
call fcn.00402f1f
test eax, eax
jne 0x403110
push 0xfffffffffffffffd
pop eax
jmp 0x403112
Function at 0x403190
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x4031af
mov eax, dword [0x40c950]
test eax, eax
je 0x4031a7
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40c950], 0
ret
cmp dword [0x40c950], 0
je 0x4031c0
push 0
call fcn.00405dea
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x434a40]
jbe 0x4031f3
push 0
push 0x403458
push 0
push 0x6f
push dword [0x4339d4]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x40c950], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x405a3f
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405a59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4

Function at 0x405a5f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push 4
pop eax
mov word [ebp - 0x1e], ax
mov eax, 0x40883c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov word [ebp - 0x20], 1
mov dword [ebp - 0x10], 0x40882c
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405acd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405ad7
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
je 0x405ad1
xor eax, eax
jmp 0x405ad7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret 4
Function at 0x405d79
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, esi
pop esi
cmova eax, ecx
test eax, eax
je 0x405db2
cmp word [ebp + eax*2 - 0x23e], 0x5c
mov ecx, 0x4082c0
jne 0x405db7
mov ecx, 0x4082c2
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x23c]
lea eax, [ecx + eax*2]
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esp, ebp
pop ebp
ret 4

Function at 0x405e1a
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x405e3d
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405e8a
pop ecx
pop ecx
inc dword [0x434ab0]
ret 8

Function at 0x405e8a
Capabilities:
Get file size

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x40898c
mov ebp, 0x4309a0
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [esp + 0x1c]
mov ebx, 0x400
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x405ed9
push 1
push 0
push esi
call fcn.0040644e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x405fbd
cmp eax, ebx
jg 0x405fbd
push ebx
mov esi, 0x4301a0
push esi
push dword [esp + 0x20]
call edi
test eax, eax
je 0x405fbd
cmp eax, ebx
jg 0x405fbd
push esi
push ebp
push str._ls_ls_r_n
push 0x42fda0
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x4349ec]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00405add
push 4
push 0xc0000000
push esi
call fcn.0040644e
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x405fbd
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x405fb6
push esi
push edi
push ebx
call fcn.0040647b
test eax, eax
je 0x405fb6
push str._Rename__r_n
push edi
call fcn.0040665e
test eax, eax
jne 0x405fc3
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x42fda0
lea eax, [ecx + edi]
push eax
call fcn.004061e3
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.0040652d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x4089a0
add eax, 0xa
push eax
call fcn.0040665e
mov ecx, eax
test ecx, ecx
je 0x405f87
lea edx, [edi + esi]
lea eax, [edx + ebp]
cmp edx, ecx
jbe 0x405ff7
sub eax, edx
mov dword [esp + 0x1c], eax
mov ebx, eax
mov al, byte [edx]
mov byte [ebx + edx], al
dec edx
cmp edx, ecx
ja 0x405fe9
mov ebx, dword [esp + 0x10]
sub ecx, edi
inc ecx
jmp 0x405f89
Function at 0x4060bc
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.004066b1
mov edi, eax
cmp edi, 0xffffffff
je 0x4060ff
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x4060e7
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4060ef
xor eax, eax
inc eax
jmp 0x406101
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4060de
test byte [ebp + 0xc], 4
jne 0x4060ff
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x406165
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x42f5a0
push ebx
call fcn.00406642
push ebx
call fcn.004066d9
mov esi, eax
test esi, esi
jne 0x406186
xor eax, eax
jmp 0x4061de
push esi
call fcn.00406808
test byte [0x4349e8], 0x80
je 0x4061a2
movzx eax, word [esi]
test ax, ax
je 0x406182
cmp eax, 0x5c
je 0x406182
sub esi, ebx
sar esi, 1
jmp 0x4061bc
call fcn.00406106
test eax, eax
je 0x4061b6
test byte [eax], 0x10
je 0x406182
push ebx
call fcn.004067db
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x4061a8
call fcn.0040608d
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop esi
pop ebx
ret 4

Function at 0x406205
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x42ed58], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x42ed58
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406244
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x40624a
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00406165
mov dword [esp + 0x14], eax
test bl, 8
je 0x40628c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434aa8], eax
jmp 0x40640d
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x4062a9
test eax, eax
je 0x4063fc
test bl, 2
je 0x4063c1
push esi
push 0x42eda0
call fcn.00406642
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x4062cc
push str..
push 0x42eda0
call ebp
jmp 0x4062d2
push esi
call fcn.004067db
xor eax, eax
cmp word [esi], ax
jne 0x4062e3
cmp word [0x42eda0], 0x5c
jne 0x4062eb
push 0x4082c0
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x42eda0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4063ac
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x406335
cmp word [esp + 0x4a], 0
je 0x40638e
cmp word [esp + 0x4a], ax
jne 0x406335
cmp word [esp + 0x4c], 0
je 0x40638e
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406642
test byte [esp + 0x1c], 0x10
je 0x40635c
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x40638e
push ebx
push esi
call fcn.0040624a
jmp 0x40638e
push edi
push esi
call fcn.004060bc
test eax, eax
jne 0x406386
test edi, edi
je 0x40637e
push esi
push 0xfffffffffffffff1
call fcn.0040595b
xor eax, eax
push eax
push esi
call fcn.00405e1a
jmp 0x40638e
inc dword [0x434aa8]
jmp 0x40638e
push esi
push 0xfffffffffffffff2
call fcn.0040595b
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x406317
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x40640c
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4063fc
push esi
call fcn.00406106
test eax, eax
je 0x40640c
push esi
call fcn.0040608d
mov eax, edi
or eax, 1
push eax
push esi
call fcn.004060bc
test eax, eax
jne 0x406404
test edi, edi
je 0x4063fc
push esi
push 0xfffffffffffffff1
call fcn.0040595b
xor eax, eax
push eax
push esi
call fcn.00405e1a
jmp 0x40640c
inc dword [0x434aa8]
jmp 0x40640c
push esi
push 0xffffffffffffffe5
call fcn.0040595b
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x40644e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x4064ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406526
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0x800
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40650f
cmp dword [ebp + 0x14], 1
je 0x406514
cmp dword [ebp + 0x14], 2
je 0x406514
xor eax, eax
mov word [esi], ax
push dword [ebp - 4]
xor eax, eax
mov word [esi + 0x7fe], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x40657a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x408978]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40897c]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4065c6
test edi, edi
jne 0x406587
mov word [esi], ax
jmp 0x4065c8
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4066b1
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4066d3
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x4068fd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4313f4], 0
push esi
jne 0x406937
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x40690e
mov dword [ecx*4 + 0x4313f0], edx
inc ecx
cmp ecx, 0x100
jl 0x406909
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406961
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4313f0]
inc esi
sub edx, 1
jne 0x406949
not ecx
mov eax, ecx
pop esi
ret 0xc

Function at 0x420870
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x420876
ret
Function at 0x4c8e09
Capabilities:
Parse pe header

Disassembly:
push 0
call fcn.00bb56fc
nop
test eax, eax
je 0x4c8e49
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4c8e49
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4c8e49
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4c8e49
cmp dword [ecx + 0x74], 0xe
jbe 0x4c8e49
cmp dword [ecx + 0xe8], 0
je 0x4c8e49
mov al, 1
ret
xor al, al
ret

Function at 0x50b58c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x541ff4
call fcn.0051eb50
mov bh, 0x12
pop edi
out 0, eax
pushal
sub byte [edx], cl
std
and ecx, dword [esi]
test byte [esi + 0x584c0a0c], 0x91

Function at 0x51f5de
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [ebx]
add dword [esp], 0x61e198
xchg dword [esp], edx
push edi
mov edi, dword [esp + 4]
pop edi
xchg dword [esp + 4], edx
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 6]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
xchg dword [esp], edx
lea ebx, [ebx]
popfd
push ebp
mov ebp, esp
leave
jmp 0xb3d740

Function at 0x525494
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xb90798
call fcn.00b8dd38
xor dword [edi + ecx*8], ebx
mov ebp, 0x974bc307
xchg dword [eax + 0x50], edi
invalid

Function at 0x528cb4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0x528d0f
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
sub dword [ebp + 8], 1
mov byte [edi - 1], dl
jne 0x528cd4
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x52ba9c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add al, 0x87
pop ebp
invalid
call 0xbbb850
xchg edi, eax
pop edx
and esi, dword [ecx - 0x5f]
adc dword [edx], ebp
loopne 0x512504
sbb al, 0x55
cld
or byte [ebx], ah
out dx, al
lodsd eax, dword [esi]
mov bl, 0x4d
push eax
mov eax, 0xe01c245b
sub al, 0xd6
mov edx, 0x85ea7cbb
mov dword [0xb5bd9316], eax
adc byte [ebx], dl
push 0xffffffffffffffac
or dword [0xb33fc79a], edi
mov edx, 0x24fa13ee
retf
jmp 0x53a2c8
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
je 0x50ebb4
mov edi, edi
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 4]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0xb94178
call fcn.00529974
jecxz 0x53a295
sbb dl, byte [ebx + 0x7e179ffb]
fistp qword [edi + 6]
dec edx
sub ch, ah
jg 0x53a35a
push 0x79
cmp al, 0x87
into
mov ecx, eax
push esi
xchg esi, ecx
pop ecx
test esi, esi
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 8]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
je 0x51d273
xchg ecx, edi
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, edi
mov edi, dword [esp]
xchg esi, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, esi
mov esi, dword [esp]
pushfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x44]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
call 0x53a33f
push ebp
mov ebp, esp
leave
add dword [esp], 0xfffe2f1f
xchg dword [esp], eax
pushfd
add ebp, 0x11
popfd
lea ebp, [ebp - 0x11]
xchg dword [esp + 4], eax
push edi
add al, 0x57
mov edi, dword [esp + 4]
lea edi, [edi + 0x7b]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
xchg dword [esp], eax
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x73]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
popfd
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x23]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
jmp 0x512518