joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f6e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb18
cmp dword [0x2d64a88], 0x594
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x28], esi
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], ebx
jne 0x401fa4
push 0
lea eax, [ebp - 0xb18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x4245b0]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
mov eax, dword [0x4245b4]
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x30], eax
call fcn.00401f64
mov ecx, dword [0x4245b8]
mov eax, dword [0x4245bc]
add dword [ebp - 4], 0x23f
push 0x20
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, ebx
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x2d64a88], 0xfa9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x2d64084]
cmove eax, edx
xor edx, edx
cmp dword [0x2d64a88], 0x3eb
mov dword [0x2d64084], eax
mov eax, dword [0x2d63a78]
cmove eax, edx
add ecx, ebx
mov dword [0x2d63a78], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov eax, dword [ebp - 8]
xor edx, ecx
add eax, dword [ebp - 0x2c]
mov ecx, dword [0x2d64a88]
xor eax, edx
mov dword [0x2d64080], 0xf4ea3dee
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
cmp ecx, 0x213
jne 0x4020c2
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push dword [ebp - 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
lea eax, [ebp - 0x34]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov eax, dword [ebp - 8]
mov ecx, dword [0x2d64a88]
sub edi, eax
cmp ecx, 0xc
jne 0x4020d8
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, edi
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov eax, edi
mov edx, dword [ebp - 4]
shr eax, cl
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0xc]
xor edx, eax
mov dword [ebp - 0xc], edx
call fcn.00401f6b
mov eax, dword [ebp - 0x18]
sub dword [ebp - 4], eax
dec esi
je 0x402124
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
jmp 0x401fe2
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416538
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408ae5
mov dword [ebp - 0x14], eax
cmp dword [0x48b19c], esi
jne 0x41662b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4165b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41670b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41670b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41670b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x48b19c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x48b1a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x48b1a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x48b1ac], eax
test eax, eax
je 0x416628
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x48b1a8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x416650
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x416643
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x416665
push 4
pop eax
jmp 0x41670d
cmp dword [ebp - 0x14], esi
je 0x416665
push dword [0x48b19c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41664a
mov eax, dword [0x48b1a8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4166c3
cmp dword [0x48b1ac], edi
je 0x4166c3
push eax
call ebx
push dword [0x48b1ac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4166c3
test eax, eax
je 0x4166c3
call ecx
test eax, eax
je 0x4166b8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4166b8
test byte [ebp - 8], 1
jne 0x4166c3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4166f3
mov eax, dword [0x48b1a0]
cmp eax, edi
je 0x4166f0
push eax
call ebx
test eax, eax
je 0x4166f0
call eax
mov esi, eax
test esi, esi
je 0x4166f0
mov eax, dword [0x48b1a4]
cmp eax, edi
je 0x4166f0
push eax
call ebx
test eax, eax
je 0x4166f0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x48b19c]
call ebx
test eax, eax
je 0x41670b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x41670d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406caa
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x402c00
pop dword [ebp - 0x28]
mov eax, 0xea04166f
sub eax, 0xe9c3ea6f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x8c221a24
add dword [ebp - 0x38], 0xc2302b27
mov dword [ebp - 0x34], 0x6b0ef5f7
add dword [ebp - 0x34], 0xc724564e
mov dword [ebp - 0x30], 0x16a797ac
add dword [ebp - 0x30], 0x35a4ac82
mov dword [ebp - 0x2c], 0x4b470fcd
sub dword [ebp - 0x2c], 0x4b470fcd
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x7572c6b9
sub dword [ebp - 0x38], 0x1005d63
mov dword [ebp - 0x34], 0xb2a101b
add dword [ebp - 0x34], 0x3642515a
mov dword [ebp - 0x30], 0xb65a8ac9
add dword [ebp - 0x30], 0xad14e1a3
mov dword [ebp - 0x2c], 0x3ff019a7
add dword [ebp - 0x2c], 0xc00fe659
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3284a
push 0
call eax
mov ecx, 0x3751
xor edx, edx
add edx, eax
mov esi, 0xe22faffc
sub esi, 0xe1eeaffc
add esi, dword [ebp - 0x28]
mov ebx, 0xcad27c45
sub ebx, 0xcf35e2f5
mov dword [ebp - 0x14], 0xeb347852
mov edi, dword [esi]
xor dword [ebp - 0x18], edx
xor edi, ebx
xor dword [ebp - 0xc], 0x1d0265cf
mov dword [edx], edi
add edx, 0x35b7ccf1
add edx, 0xca483313
add esi, 0x38712251
sub esi, 0x3871224d
loop 0x402d14
add eax, 0xd017
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x929fd008
sub ecx, 0x925fd008
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x7002e77
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x701a85c]
jne 0x7002e81
repz ret
jmp fcn.0700f55f

Function at 0x70034f1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x7003500
pop dword [ebp - 0x3c]
mov eax, 0x98162a60
add eax, 0x6eea0aa0
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x9174cbd7
add dword [ebp - 0x4c], 0xbcdd7974
mov dword [ebp - 0x48], 0x1b4d6ddb
sub dword [ebp - 0x48], 0xe91a2196
mov dword [ebp - 0x44], 0x5d38fbe2
sub dword [ebp - 0x44], 0x10ecb7b4
mov dword [ebp - 0x40], 0xbef6263f
sub dword [ebp - 0x40], 0xbef6263f
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x8e5fdfb2
add eax, 0x78a1407a
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x58e6051e
add dword [ebp - 0x4c], 0x1b8c6438
mov dword [ebp - 0x48], 0x14e824f6
sub dword [ebp - 0x48], 0xd37bc381
mov dword [ebp - 0x44], 0x808c39ab
sub dword [ebp - 0x44], 0x1d1ccd3f
mov dword [ebp - 0x40], 0x2e96aecc
sub dword [ebp - 0x40], 0x2e96aecc
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xa5c45595
add eax, 0x613cca93
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3db70
push 0
call eax
mov ecx, 0xf36bf745
add ecx, 0xc945d2d
mov edi, eax
mov esi, 0x701e000
add esi, dword [ebp - 0x3c]
mov ebx, 0x9b6a7e8d
sub ebx, 0xd3345fc1
xor dword [ebp - 0x1c], ebx
mov edx, dword [esi]
mov dword [ebp - 0x34], 0xbe9cc87f
xor edx, ebx
sub dword [ebp - 0x10], 0xc6a808f6
mov dword [edi], edx
xor dword [ebp - 0x20], 0x34679a94
add edi, 0xfcb302f
add edi, 0xf034cfd5
add esi, 0x2087d227
sub esi, 0x2087d223
loop 0x700361c
add eax, 0x57d0ff54
add eax, 0xa8304547
mov ebx, eax
add eax, 0x4be1bbad
add eax, 0xb41e4458
mov ecx, 0x5ad17d06
sub ecx, 0x53d17d06
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x700d408
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d476
cmp byte [esi + 0x10], 0
je 0x700d427
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
pop ecx
mov byte [esi + 0x10], 0
push edi
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d464
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_feof]
pop ecx
test eax, eax
jne 0x700d464
push str.stream_read_error
push eax
call fcn.070034f1
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d478
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x700d940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
je 0x700d95b
push str.Attempt_to_write_read_only_stream
push 0
call fcn.070034f1
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d999
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d98c
push 0x7013b70
jmp 0x700d954
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8

Function at 0x700dbc5
Capabilities:
Set current directory

Disassembly:
push 4
mov eax, 0x7010ec2
call fcn.07001aa5
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.0700da5a
and dword [esi + 0xc], 0
and dword [ebp - 4], 0
mov dword [esi], vtable.FileSharedStream.0
mov byte [esi + 0x10], 0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0700d99e
lea ecx, [ebp + 8]
call fcn.0700d6a0
mov eax, dword [esi + 0x14]
push dword [eax + 0x14]
mov edi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov byte [ebp - 4], 2
call edi
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700dc35
mov eax, dword [eax + 0x14]
jmp 0x700dc3a
mov eax, 0x7012365
push 0x7013bb4
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x700dc5a
push 0x7013ba0
push eax
call fcn.070034f1
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 8]
mov dword [esi + 8], eax
mov byte [ebp - 4], 1
call edi
push dword [ebp + 8]
mov ecx, 0x701a480
call fcn.070034f1
mov eax, esi
call fcn.07002d5f
ret 4
Function at 0x1000fff4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10010003
pop dword [ebp - 0x20]
mov eax, 0x635a9708
sub eax, 0x53599705
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x39179
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x50986f75
add ecx, 0xaf67d4a1
mov ebx, eax
mov edx, 0xdb97d9d3
add edx, 0x346a6a2d
add edx, dword [ebp - 0x20]
mov edi, 0xfa20ac5a
add edi, 0xed529747
xor dword [ebp - 0x1c], edx
mov esi, dword [edx]
mov dword [ebp - 0x14], 0xf210b99e
xor esi, edi
xor dword [ebp - 0x18], ecx
mov dword [ebx], esi
add dword [ebp - 4], ebx
add ebx, 0xeb93a1de
add ebx, 0x146c5e26
add edx, 0x11819c3d
sub edx, 0x11819c39
loop 0x1001005d
add eax, 0x35b06dfc
sub eax, 0x35af6ad1
xor ebx, ebx
add ebx, eax
add eax, 0xbf53dd58
add eax, 0x40ac22ad
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1002aaee
pop dword [ebp - 0x38]
mov eax, 0x1002aaee
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xb92a05b5
sub dword [ebp - 0x48], 0x6ad7c06a
mov dword [ebp - 0x44], 0x84d9c3e7
sub dword [ebp - 0x44], 0x52a677a2
mov dword [ebp - 0x40], 0x779c96ee
add dword [ebp - 0x40], 0xd4afad40
mov dword [ebp - 0x3c], 0x14bbf6a7
sub dword [ebp - 0x3c], 0x14bbf6a7
lea eax, [ebp - 0x48]
push eax
mov eax, 0x8ceffe99
sub eax, 0x7ced3e61
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x73af0ea8
sub dword [ebp - 0x48], 0xff3ca552
mov dword [ebp - 0x44], 0x4ee06252
sub dword [ebp - 0x44], 0xd7400dd
mov dword [ebp - 0x40], 0x8917f73e
sub dword [ebp - 0x40], 0x25a88ad2
mov dword [ebp - 0x3c], 0x7d92539d
add dword [ebp - 0x3c], 0x826dac63
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x53871d26
sub eax, 0x43845cfe
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x38e24
push 0
call eax
mov ecx, 0x51aa
mov edx, eax
mov ebx, 0x10039600
add ebx, dword [ebp - 0x38]
mov edi, 0x593a2b9
sub edi, 0x7656c949
xor dword [ebp - 8], 0x3b5c2a42
mov esi, dword [ebx]
xor esi, edi
xor dword [ebp - 0x18], ebx
mov dword [edx], esi
sub dword [ebp - 0x18], ecx
add edx, 0x539433dc
sub edx, 0x539433d8
add ebx, 0x6b609eae
sub ebx, 0x6b609eaa
loop 0x1002abff
add eax, 0x25cd8589
add eax, 0xda33b3f2
xor ebx, ebx
add ebx, eax
add eax, 0xb589b704
add eax, 0x4a764901
mov ecx, 0x5531f553
sub ecx, 0x4531f553
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404837
Capabilities:
Get disk information

Disassembly:
mov eax, 0x429b10
call fcn.00428650
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.00401f1f
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], ebx
je 0x40490d
mov eax, SysReAllocString
cmp ebx, eax
ja 0x404873
mov eax, ebx
add eax, eax
push eax
call fcn.00405733
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x14], ebx
je 0x404906
cmp ebx, dword [ebp - 0x18]
ja 0x404906
lea ecx, [ebp - 0x2c]
call fcn.00402679
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
jbe 0x4048ee
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4048e3
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401d25
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x14]
jb 0x4048b1
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x2c]
call fcn.00402153
push esi
call fcn.00402153
cmp dword [ebp - 0x18], ebx
pop ecx
pop ecx
sete al
jmp 0x40490f
push esi
call fcn.00402153
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405733
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x405742
pop dword [ebp - 0x14]
mov eax, 0x405742
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3807e
push 0
mov eax, 0x26f19bbf
add eax, 0xd951246d
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xa8d2d122
add ecx, 0x572d71e2
mov edx, eax
mov esi, 0xcfde00dd
add esi, 0x3065b723
add esi, dword [ebp - 0x14]
mov ebx, 0xec85740d
add dword [ebp - 0x10], ebx
mov edi, dword [esi]
add edi, ebx
mov dword [edx], edi
xor dword [ebp - 0xc], esi
add edx, 4
add esi, 4
loop 0x405796
add eax, 0x3869bb45
add eax, 0xc797439e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x10001660
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x220
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
xor edi, edi
cmp esi, ebx
je 0x10001791
cmp byte [esi], bl
je 0x10001791
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x10]
push ecx
push ebx
push 0xf003f
push ebx
push 0x1013f817
push ebx
push str.SoftwareMicroWorldDeviceControlDeviceWhlst
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ebx
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10001777
push 0x207
lea edx, [esp + 0x25]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x2c], bl
call fcn.10116880
lea edx, [esp + 0x2c]
add esp, 0xc
mov eax, esi
sub edx, esi
jmp 0x100016f0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x100016f0
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x10001770
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push str.EntryType
push edx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10001757
mov eax, dword [esp + 0x10]
push eax
call esi
cmp dword [esp + 0x14], 2
jne 0x10001770
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
mov eax, dword [esp + 0xc]
push eax
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.1010d699
add esp, 0x220
ret
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1010d699
add esp, 0x220
ret

Function at 0x100017b0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x210
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
lea eax, [esp + 8]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push str.SoftwareMicroWorldDeviceControlDeviceWhlst
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x10001847
mov edx, dword [esp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x208
lea ecx, [esp + 0x14]
push ecx
push ebx
push edx
xor esi, esi
mov byte [esp + 0x20], bl
call edi
test eax, eax
jne 0x10001846
cmp byte [esp + 0x10], bl
je 0x1000182b
lea ecx, [esp + 0x10]
call fcn.10001660
test eax, eax
jne 0x1000182b
inc esi
mov ecx, dword [esp + 0xc]
push 0x208
lea eax, [esp + 0x14]
push eax
inc esi
push esi
push ecx
mov byte [esp + 0x20], bl
call edi
test eax, eax
je 0x10001817
pop edi
mov ecx, dword [esp + 0x214]
pop esi
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x210
ret
Function at 0x10001860
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x31c
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x314], eax
push ebp
push esi
push 0x207
lea eax, [esp + 0x115]
push 0
push eax
mov byte [esp + 0x11c], 0
call fcn.10116880
add esp, 0xc
push 0x103
lea ecx, [esp + 0xd]
push 0
push ecx
mov byte [esp + 0x14], 0
call fcn.10116880
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
add esp, 0xc
push 0x208
lea edx, [esp + 0x114]
push edx
xor esi, esi
push esi
push edi
call ebp
test eax, eax
jne 0x1000191a
jmp 0x100018d0
lea eax, [esp + 8]
push eax
xor ecx, ecx
lea edx, [esp + 0x114]
mov byte [esp + 0xc], 0
call fcn.1005e8f0
add esp, 4
cmp byte [esp + 8], 0
je 0x10001904
lea ecx, [esp + 8]
push ecx
push ebx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x10001933
push 0x208
lea edx, [esp + 0x114]
push edx
inc esi
push esi
push edi
call ebp
test eax, eax
je 0x100018d0
xor eax, eax
pop esi
pop ebp
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.1010d699
add esp, 0x31c
ret
mov ecx, dword [esp + 0x31c]
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.1010d699
add esp, 0x31c
ret