joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4037ff
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
call fcn.0041da36
push 0x5b
push eax
mov dword [ebp - 8], eax
call fcn.00407290
mov edi, eax
xor ebx, ebx
add esp, 0xc
cmp edi, ebx
je 0x4038c0
push esi
inc edi
push 0x5d
push edi
call fcn.00407290
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x4038bf
mov byte [esi], bl
inc esi
push 0xa
push esi
call fcn.00407290
pop ecx
pop ecx
cmp eax, ebx
je 0x403851
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push edi
push dword [section..data]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403884
push ebx
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4038b6
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, ebx
je 0x4038ad
cmp eax, 2
je 0x4038ad
push ebx
push str.Could_not_delete_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.00407f30
pop ecx
pop esi
pop edi
pop ebx
leave
ret

Function at 0x4038c4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
call fcn.0041da36
push 0x5b
push eax
mov dword [ebp - 8], eax
call fcn.00407290
mov edi, eax
xor ebx, ebx
add esp, 0xc
cmp edi, ebx
je 0x403985
push esi
inc edi
push 0x5d
push edi
call fcn.00407290
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x403984
mov byte [esi], bl
inc esi
push 0x3d
push esi
call fcn.00407290
pop ecx
pop ecx
cmp eax, ebx
je 0x403984
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push edi
push dword [section..data]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403949
push ebx
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40397b
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x403972
cmp eax, 2
je 0x403972
push ebx
push str.Could_not_delete_value
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.00407f30
pop ecx
pop esi
pop edi
pop ebx
leave
ret

Function at 0x403989
Capabilities:
Delete file

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call fcn.00407290
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40399f
pop esi
ret
inc esi
movsx eax, byte [esi]
push eax
call fcn.0040a885
pop ecx
test eax, eax
jne 0x40399f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret
Function at 0x4039b7
Capabilities:
Delete directory

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call fcn.00407290
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4039cd
pop esi
ret
inc esi
movsx eax, byte [esi]
push eax
call fcn.0040a885
pop ecx
test eax, eax
jne 0x4039cd
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret
Function at 0x403fcd
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Py_Initialize
push edi
call esi
push str.Py_SetProgramName
push edi
mov ebx, eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp - 4], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PySys_GetObject
push edi
mov dword [ebp - 8], eax
call esi
push str.Py_OptimizeFlag
push edi
mov dword [ebp - 0x10], eax
call esi
xor esi, esi
cmp dword [0x4306ac], esi
jne 0x404027
xor eax, eax
jmp 0x404071
cmp ebx, esi
je 0x40406e
cmp dword [ebp - 4], esi
je 0x40406e
cmp dword [ebp - 0xc], esi
je 0x40406e
cmp dword [ebp - 8], esi
je 0x40406e
cmp dword [ebp - 0x10], esi
je 0x40406e
cmp eax, esi
je 0x40406e
xor ecx, ecx
cmp dword [ebp + 8], esi
push 0x4325a0
setne cl
mov dword [eax], ecx
call dword [ebp - 4]
call ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00403eac
add esp, 0xc
mov esi, eax
call dword [ebp - 0xc]
mov eax, esi
jmp 0x404071
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x4044dd
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00408e10
mov eax, dword [0x42f180]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push dword [0x43292c]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
push ebp
lea eax, [esp + 0x18]
push eax
mov ebx, 0x425524
push ebx
push str.title
mov esi, str.Setup
push esi
call edi
push 0x50
pop ecx
lea eax, [esp + 0x10]
mov edx, 0x431140
call fcn.004015dd
push dword [0x43292c]
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push str.info
push esi
call edi
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, 0x431580
call fcn.004015dd
push dword [0x43292c]
push 0x50
push 0x4327c0
push ebx
push str.build_info
push esi
call edi
push dword [0x43292c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x43292c]
mov dword [0x431194], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x43292c]
mov dword [0x431190], eax
push 0xa
push 0x432590
push ebx
push str.target_version
push esi
call edi
push dword [0x43292c]
push 0x50
push 0x4312c0
push ebx
push str.name
push str.metadata
call edi
push dword [0x43292c]
push 0x104
push 0x4311a0
push ebx
push str.install_script
push esi
call edi
push dword [0x43292c]
mov ebp, 0x431550
push 0xa
push ebp
push ebx
push str.user_access_control
push esi
call edi
push 6
mov edi, str.force
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40462b
call fcn.004035da
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.0040362c
jmp 0x4046cb
push 5
mov edi, str.auto
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404658
call fcn.004035da
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.00403570
test eax, eax
je 0x404688
jmp 0x404621
cmp byte [0x431550], al
je 0x404688
push 5
mov edi, str.none
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404688
push eax
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x431140
call fcn.00402766
push eax
mov dword [0x432580], eax
call fcn.004043df
pop ecx
pop ecx
push dword [0x432814]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x43292c]
test eax, eax
je 0x4046bb
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x432930]
test eax, eax
je 0x4046cb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00407875
add esp, 0x1004
ret
Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7

Function at 0x41d2d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e95e
and dword [ebp - 4], 0
cmp dword [0x4310f8], 0
mov ebx, eax
jne 0x41d386
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41d437
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42d324
push edi
call esi
test eax, eax
je 0x41d437
push eax
call fcn.0040e8ec
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4310f8], eax
call esi
push eax
call fcn.0040e8ec
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4310fc], eax
call esi
push eax
call fcn.0040e8ec
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431100], eax
call esi
push eax
call fcn.0040e8ec
pop ecx
mov dword [0x431108], eax
test eax, eax
je 0x41d386
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040e8ec
pop ecx
mov dword [0x431104], eax
mov eax, dword [0x431104]
cmp eax, ebx
je 0x41d3de
cmp dword [0x431108], ebx
je 0x41d3de
push eax
call fcn.0040e967
push dword [0x431108]
mov esi, eax
call fcn.0040e967
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41d3de
test edi, edi
je 0x41d3de
call esi
test eax, eax
je 0x41d3d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d3d5
test byte [ebp - 0xc], 1
jne 0x41d3de
or dword [ebp + 0x10], 0x200000
jmp 0x41d417
mov eax, dword [0x4310fc]
cmp eax, ebx
je 0x41d417
push eax
call fcn.0040e967
pop ecx
test eax, eax
je 0x41d417
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41d417
mov eax, dword [0x431100]
cmp eax, ebx
je 0x41d417
push eax
call fcn.0040e967
pop ecx
test eax, eax
je 0x41d417
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4310f8]
call fcn.0040e967
pop ecx
test eax, eax
je 0x41d437
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d439
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42450e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x42453f
call fcn.0040caca
mov dword [eax], esi
call fcn.0040cab7
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040be53
add esp, 0x14
push 0x16
pop eax
jmp 0x424594
test dword [ebp + 0xc], 0xfffffff9
jne 0x42451b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42456c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040cadd
pop ecx
call fcn.0040cab7
mov eax, dword [eax]
jmp 0x424594
test al, 0x10
jne 0x424592
test al, 1
je 0x424592
test byte [ebp + 0xc], 2
je 0x424592
call fcn.0040caca
mov dword [eax], 5
call fcn.0040cab7
mov dword [eax], 0xd
jmp 0x424563
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x428b00
mov edi, 0x7c340019
xor esi, edi
push esi
mov ebx, 0x26a180
mov esi, 0xc15220
xor ebx, esi
pop ecx
xor ebx, ecx
mov edx, 0x77eec011
xor edx, 0x63fe446b
mov esi, 0x70f2a177
mov ecx, 0x39f2e1f3
xor ecx, esi
xor edx, ecx
xor edx, ebx
push 0x17b41afe
mov ebx, 0x17f4cb7e
pop edi
xor ebx, edi
mov ecx, ebx
add ecx, 0xffffffcb
dec ecx
mov eax, dword [ecx + 0x36]
mov edx, eax
dec edx
mov ebx, dword [edx + 1]
mov eax, 0xd238c0d5
xor ebx, eax
xor ebx, 0x7c86114
adc al, 0x61
enter 0xffffffffffff8907, 0xffffffffffffffda
xor edi, edi
add edi, edi
jmp 0x403f89

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404de0
add esp, 0x104
pop ebx
ret

Function at 0x406e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406f48
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406f32
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406e6d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f32
cmp dword [ebp - 0x10], 0
jne 0x406e82
mov eax, dword [ebp - 8]
call fcn.00403198
mov bl, 1
jmp 0x406f32
cmp dword [ebp - 0x10], 0x70000000
jb 0x406e90
call fcn.00405884
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00403420
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406e36
test eax, eax
jne 0x406f32
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406ee0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f32
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
jmp 0x406eeb
dec esi
test esi, esi
je 0x406ef9
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x406eea
cmp dword [ebp - 0xc], 7
jne 0x406f04
test esi, esi
je 0x406f04
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004034f0
cmp dword [ebp - 0xc], 7
jne 0x406f25
test esi, esi
je 0x406f25
lea eax, [ebp - 0x14]
call fcn.00403420
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f4f
lea eax, [ebp - 0x14]
call fcn.00403198
ret

Function at 0x407890
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4078ac
shr eax, 1
xor eax, 0xedb88320
jmp 0x4078ae
shr eax, 1
dec edx
jne 0x40789f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407898
pop esi
ret

Function at 0x4078c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078e7
call fcn.00407890
push 1
push 0x40c558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x407912
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078ed
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x409aa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x42c420], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x42c41c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x42c420], eax
cmp ecx, 0x26f
jl 0x409ab0
mov dword [0x422930], 0x270
ret

Function at 0x409af0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x42b020]
cmp eax, dword [0x422450]
je 0x409b08
mov dword [0x422930], 0x271
cmp dword [0x422930], 0x270
jl 0x409c27
cmp dword [0x422930], 0x271
jne 0x409b3f
mov eax, dword [0x42b020]
call fcn.00409aa0
mov eax, dword [0x42b020]
not eax
mov dword [0x42b020], eax
mov dword [0x422450], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x42c424]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x42c420]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x42ca54]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x422940]
xor edx, eax
mov dword [ebx*4 + 0x42c420], edx
cmp ebx, 0xe2
jl 0x409b48
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x42c424]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x42c420]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x42c094]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x422940]
xor edx, eax
mov dword [ebx*4 + 0x42c420], edx
cmp ebx, 0x26e
jl 0x409b9c
mov eax, dword [0x42cddc]
and eax, 0x80000000
mov edx, dword [0x42c420]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x42ca50]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x422940]
xor eax, edx
mov dword [0x42cddc], eax
mov dword [0x422930], 0
mov eax, dword [0x422930]
mov eax, dword [eax*4 + 0x42c420]
add dword [0x422930], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret
Function at 0x40b640
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x4221c0]
cmp ax, 0xcb
je 0x40b73c
cmp ax, 0xcc
je 0x40b73c
mov edx, dword [0x42d030]
test edx, edx
je 0x40b672
mov eax, dword [0x42ced0]
call edx
mov ebx, eax
jmp 0x40b677
mov ebx, 0x42ced4
cmp word [0x42cec0], 0
jle 0x40b69a
mov eax, 0x42cea0
call fcn.0040b8b0
mov eax, ebx
call fcn.0040b220
mov eax, ebx
call fcn.0040b290
mov edi, dword [ebx]
jmp 0x40b6ba
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40b6b5
mov edx, edi
mov eax, ebx
call fcn.0040a6f0
jmp 0x40b6b8
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40b6a0
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x42cec0], 0
jle 0x40b73c
mov edx, 0x42cde0
mov eax, ebx
call fcn.0040a820
mov edi, eax
test edi, edi
je 0x40b70f
mov eax, dword [0x42ce74]
mov dword [edi + 0xc], eax
cmp dword [0x42ce74], 0
je 0x40b704
mov eax, dword [0x42ce74]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x42ce74], eax
sub word [0x42cec0], 1
cmp word [0x42cec0], 0
sete bl
mov eax, 0x42cea0
call fcn.0040b8c0
test bl, bl
je 0x40b73c
mov eax, 0x42cea0
call fcn.0040b8a0
pop edi
pop esi
pop ebx
ret
Function at 0x40d120
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x42c260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.0040d300
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x42c260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402280
call sub.kernel32.dll_GetCommandLineA
mov dword [0x422230], eax
mov esi, dword [0x422230]
jmp 0x40d2c0
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x40d1b0
cmp byte [esi], 0
je 0x40d2c9
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x40d225
mov al, byte [esi]
cmp al, 1
jb 0x40d21b
sub al, 0x20
jbe 0x40d1ec
sub al, 2
je 0x40d1ff
jmp 0x40d21b
mov al, byte [ebp - 0x10c]
test al, al
je 0x40d22a
add dword [ebp - 0x110], 1
jmp 0x40d222
cmp byte [esi + 1], 0x22
je 0x40d216
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40d222
add esi, 1
jmp 0x40d222
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x40d1dc
test dword [ebp - 0x114], 0xffffffff
je 0x40d2b9
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.0040d300
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x42c260]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x40d2b1
mov al, byte [esi]
cmp al, 1
jb 0x40d2a7
sub al, 0x20
jbe 0x40d278
sub al, 2
je 0x40d28b
jmp 0x40d2a7
mov al, byte [ebp - 0x10c]
test al, al
je 0x40d2b6
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x40d2ae
cmp byte [esi + 1], 0x22
je 0x40d2a2
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40d2ae
add esi, 1
jmp 0x40d2ae
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x40d268
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x40d1b3
mov ebx, dword [ebp - 0x114]
mov dword [0x42c250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x42c260
call fcn.0040b4a0
mov eax, dword [0x42c260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40e2e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, esi
mov cl, 0
mov edx, 0x20
call fcn.004022c0
lea eax, [ebp - 8]
push eax
push 0
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 8]
push eax
push 0
lea eax, [esi + 4]
push eax
mov eax, esi
push eax
push 0
push 0
push 0
push dword [ebx + 0x14]
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebx + 4], eax
test eax, eax
sete bl
test bl, bl
je 0x40e348
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea eax, [ebp - 0x18]
call fcn.0041dce0
fstp qword [esi + 0x18]
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x40e500
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x88]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0x88], 0
mov eax, 1
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x40]
call fcn.00409120
call fcn.0040a4e0
push eax
test eax, eax
jne 0x40e608
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call dword [edx + 0xb8]
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0040e2e0
test al, al
je 0x40e608
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x34]
call fcn.0040a560
mov eax, 1
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x68]
call fcn.00409120
call fcn.0040a4e0
push eax
test eax, eax
jne 0x40e5f1
mov eax, dword [ebp - 0x30]
lea ebx, [eax - 1]
mov dword [ebp - 0x10], 0
cmp ebx, dword [ebp - 0x10]
jl 0x40e5f1
sub dword [ebp - 0x10], 1
mov esi, esi
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x10]
mov eax, dword [ebp - 8]
push dword [eax + 0x14]
call sub.advapi32.dll_RegEnumKeyExA
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x34]
call fcn.0041df40
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
call dword [ecx + 0xa4]
cmp ebx, dword [ebp - 0x10]
jg 0x40e5a0
call fcn.004093a0
mov eax, dword [ebp - 0x34]
call fcn.0040a590
pop eax
test eax, eax
je 0x40e608
call fcn.004094d0
call fcn.004093a0
lea eax, [ebp - 0x88]
call fcn.004028e0
pop eax
test eax, eax
je 0x40e622
call fcn.004094d0
pop ebx
leave
ret