joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418fb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e488
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x47c0e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x47c0c8]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.00418ba0
test eax, eax
je 0x4190d8
mov esi, dword [ebp - 0x18]
mov edi, dword [0x47c0c8]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x419083
cmp dword [esi], 0
je 0x419076
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x419043
mov eax, 1
jmp 0x4190a4
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41907c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call eax
jmp 0x4190a4
cmp dword [esi + 4], 0
jne 0x419083
mov eax, 1
jmp 0x4190a4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4190ce
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x4190b6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x4190db
xor ebx, ebx
jmp 0x41917f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x41917f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x419138
mov ecx, dword [ebx]
test ecx, ecx
je 0x41919e
push ecx
push eax
call fcn.00445394
add esp, 8
test eax, eax
je 0x419138
mov edx, dword [edi]
test edx, edx
je 0x419138
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419110
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x419143
lea eax, [edx + 0xd]
jmp 0x419178
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419150
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x467df0
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x41918a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403106
int3
Function at 0x41a8c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a931
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x41a8ff
cmp eax, 2
jne 0x41a91b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x41a92b
test ecx, ecx
je 0x41a926
test cl, 1
jne 0x41a91b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x41a92b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x41ea00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e9e8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x47c0e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x28]
push 0x1a
push eax
call fcn.0041f6c0
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x41ea67
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41eae5
push dword [ebp - 0x44]
lea eax, [ebp - 0x40]
mov ecx, esi
push 1
push eax
call fcn.0041f6c0
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x41eaab
mov ecx, eax
call fcn.00405dd6
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x41eae5
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41eadb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ebed
push edx
push ecx
call fcn.0041bc8b
add esp, 8
cmp dword [ebp - 0x18], 0
jne 0x41eb10
xor eax, eax
mov dword [edi + 0x10], 0
push eax
mov dword [edi + 0x14], 7
mov ecx, edi
push 0x462588
mov word [edi], ax
call fcn.0040aad5
jmp 0x41ebc6
call fcn.004038e4
mov ecx, eax
test ecx, ecx
je 0x41ebf2
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00402826
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040343b
mov edx, dword [ebp - 0x48]
add esp, 8
mov byte [ebp - 4], 1
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41eb77
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x44]
xor eax, eax
mov ecx, esi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41eb92
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.0040aad5
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41ebc6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x28]
call fcn.0040d0c7
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bf41
mov esp, ebp
pop ebp
ret 8
call fcn.00434919
push 0x80004005
call fcn.00403106
int3
Function at 0x421780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ef72
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x47c0e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x818], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x81c], 1
test ecx, ecx
je 0x4218b0
test eax, eax
je 0x4218b0
test ebx, ebx
je 0x4218b0
lea edx, [ebp - 0x818]
push edx
push 0x20219
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42189f
cmp dword [ebp - 0x818], eax
je 0x4218b0
push 0x802
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.004317b0
add esp, 0xc
mov dword [ebp - 0x820], 0x800
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xffff
push ebx
push 0
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x42189f
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421881
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040aad5
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x4218b0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bf41
mov esp, ebp
pop ebp
ret 0x10
Function at 0x428840
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45fbe0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x47c0e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x428989
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x428989
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x428989
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x428989
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 5
push 0x80000000
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x428975
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push edi
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x42896e
cmp dword [ebp - 0x1c], ebx
jne 0x42896e
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
cmp eax, ecx
ja 0x42890d
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x428907
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x428919
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0040aa53
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x20]
mov ecx, esi
push 0
call fcn.0040d001
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x42896e
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44bed7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044bd56

Function at 0x4516e0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004513a0
Function at 0x45bd90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460d41
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x47c0e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.004038e4
mov ecx, eax
test ecx, ecx
je 0x45bf24
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45bee5
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45bed7
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x45bee5
add eax, 0x10
push 0x482e70
push eax
mov dword [ebp - 0x20], eax
call fcn.0045cf97
mov esi, eax
add esp, 8
test esi, esi
je 0x45bee5
push dword [ebp - 0x20]
push 0
push esi
call fcn.004317b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45be9a
push esi
call fcn.0041bca2
add esp, 4
jmp 0x45bee5
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45bea0
sub ecx, edx
sar ecx, 1
je 0x45bece
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45beb6
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.0040465f
push esi
call fcn.0041bca2
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45bee5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45bf04
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bf41
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00403106
int3
Function at 0x45bf30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47c0e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x45bf54
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x45bfb6
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x45bfb6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x45bfd1
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bf41
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rol eax, 0x8f
bswap esi
rol edx, 0xa3
rcr edi, 0xbe
imul ebx
ror esi, 0x41
inc edi
rcl ebx, 0x40
imul esi
imul esi
rcr esi, 0x5b
mov edi, 0x55
sub edx, 0xba
neg esi
or ebx, 0x81
sbb eax, 0x1d
bswap ebx
bswap edi
sbb edx, 0x8c
bswap ebx
inc esi
sbb edx, 0
sub edi, 0xad
bswap eax
ror ebx, 0x5c
and edx, 0
inc eax
rcl edi, 0x6d
not esi
rcl esi, 0xc5
neg edx
imul esi
mov edi, 0x89
not esi
not esi
inc ebx
and edi, 0xf6
inc eax
inc edi
bswap edx
neg edi
not ebx
add ebx, 0xa2
not edx
rcl ebx, 0x29
sub eax, 0x7f
mov eax, 0x8a
imul edi
neg eax
not edi
xor ecx, ecx
xor edi, edi
and eax, 0x7f
neg ebx
inc eax
or eax, 0xb5
neg esi
add edx, 0xa1
sbb ebx, 0xf4
sbb ebx, 0xdc
bswap esi
bswap ebx
bswap eax
and ebx, 0x21
inc eax
rcl esi, 0x2b
not esi
imul eax
imul esi
ror esi, 0x7f
imul eax
imul ebx
neg esi
not ebx
neg edx
add ebx, 0x78
bswap edx
or eax, 0xcc
bswap esi
rcr edi, 0x70
bswap ebx
mov eax, 0xc8
imul ebx
not eax
rcl edi, 0xae
imul esi
dec edx
imul esi
rcr esi, 0x31
rcr esi, 0xdf
imul ebx
dec edi
mov edi, 0x25
neg edi
rcr eax, 0x99
imul edi
rcr esi, 4
inc esi
not edi
bswap edx
mov edi, 0xcc
bswap esi
mov ecx, dword [ebp + 0xc]
rcl edi, 0x99
bswap ebx
rcl edi, 0x38
dec edx
inc eax
inc ebx
and edx, 0x45
dec edx
rol edx, 0xb8
ror edx, 0x68
add edx, 0x8f
rol eax, 0xb
neg ebx
rcr eax, 0x1e
add ebx, 0xc2
ror eax, 0x35
imul eax
rcl edx, 0xfe
rcl esi, 0x53
rol edi, 0x59
or edx, 0x4a
neg eax
not esi
bswap ebx
sub edx, 0x53
rcl esi, 0xf3
sub edx, 0x14
and edx, 0x68
neg eax
sbb esi, 0x77
add edx, 0x1c
neg ebx
dec esi
dec esi
dec edx
inc edi
neg edx
rol edi, 0
inc ebx
sbb esi, 0x85
rol esi, 0xe2
or ebx, 6
not ebx
rcr esi, 0x3a
bswap edi
and eax, 0x95
neg esi
dec eax
not edi
neg esi
mov edi, dword [ebp + 8]
mov esi, eax
xor esi, eax
mov esi, esi
not byte [edi]
xor ebx, esi
xor esi, eax
xor ebx, esi
xor esi, eax
xor eax, esi
mov eax, ebx
xor ebx, eax
xor esi, ebx
mov ebx, ebx
add byte [edi], 0x79
mov esi, esi
xor esi, eax
xor eax, esi
xor eax, ebx
mov ebx, eax
mov eax, ebx
mov ebx, eax
xor eax, eax
xor esi, ebx
sub byte [edi], 0x30
xor eax, ebx
xor esi, eax
xor esi, ebx
xor ebx, eax
mov ebx, esi
xor eax, eax
xor eax, eax
xor ebx, esi
xor eax, esi
imul byte [edi]
inc edi
loop 0x4013c7
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4042c5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48fdd0]
jne 0x4042cf
repz ret
jmp fcn.00406045
Function at 0x404956
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004036f1
and dword [ebp - 4], 0
cmp dword [0x490c68], 0
mov ebx, eax
jne 0x404a07
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404ab8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404ab8
push eax
call fcn.0040367f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x490c68], eax
call esi
push eax
call fcn.0040367f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x490c6c], eax
call esi
push eax
call fcn.0040367f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x490c70], eax
call esi
push eax
call fcn.0040367f
pop ecx
mov dword [0x490c78], eax
test eax, eax
je 0x404a07
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040367f
pop ecx
mov dword [0x490c74], eax
mov eax, dword [0x490c74]
cmp eax, ebx
je 0x404a5f
cmp dword [0x490c78], ebx
je 0x404a5f
push eax
call fcn.004036fa
push dword [0x490c78]
mov esi, eax
call fcn.004036fa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404a5f
test edi, edi
je 0x404a5f
call esi
test eax, eax
je 0x404a56
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404a56
test byte [ebp - 0xc], 1
jne 0x404a5f
or dword [ebp + 0x10], 0x200000
jmp 0x404a98
mov eax, dword [0x490c6c]
cmp eax, ebx
je 0x404a98
push eax
call fcn.004036fa
pop ecx
test eax, eax
je 0x404a98
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404a98
mov eax, dword [0x490c70]
cmp eax, ebx
je 0x404a98
push eax
call fcn.004036fa
pop ecx
test eax, eax
je 0x404a98
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x490c68]
call fcn.004036fa
pop ecx
test eax, eax
je 0x404ab8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404aba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ed6b
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x40eae0
and edi, ecx
dec ecx
call fcn.0040ed93
and edi, ecx
add ecx, edi
xor dword [edx], ebx
inc edx
and edi, ecx
push ecx
pop ecx
cmp edx, eax
jne fcn.0040ed6b
ret
Function at 0x406410
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x81047b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4046cc
call fcn.00407071
push 4
mov dword [esp + 0x18], 0
call fcn.00408000
mov edi, eax
add esp, 4
test edi, edi
je 0x406484
push ebx
call fcn.00406f49
mov dword [edi], eax
call fcn.00406d08
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407032
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406478
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040705a
pop ebx
jmp 0x406486
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408a71
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x813dd0]
jne 0x408a7b
repz ret
jmp fcn.0040dedc
Function at 0x4130b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x813dd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040acad
and dword [ebp - 0x14], 0
cmp dword [0x815814], 0
mov dword [ebp - 0x18], eax
jne 0x413169
push 0x404070
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x413211
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404064
push ebx
call edi
test eax, eax
je 0x413211
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x404054
push ebx
mov dword [0x815814], eax
call edi
push eax
call esi
push 0x404040
push ebx
mov dword [0x815818], eax
call edi
push eax
call esi
push 0x404024
push ebx
mov dword [0x81581c], eax
call edi
push eax
call esi
mov dword [0x815824], eax
test eax, eax
je 0x413169
push 0x40400c
push ebx
call edi
push eax
call esi
mov dword [0x815820], eax
mov eax, dword [0x815820]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4131c2
cmp dword [0x815824], ecx
je 0x4131c2
push eax
call esi
push dword [0x815824]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4131c2
test ebx, ebx
je 0x4131c2
call edi
test eax, eax
je 0x4131b9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4131b9
test byte [ebp - 8], 1
jne 0x4131c2
or dword [ebp + 0x10], 0x200000
jmp 0x4131f5
mov eax, dword [0x815818]
cmp eax, dword [ebp - 0x18]
je 0x4131f5
push eax
call esi
test eax, eax
je 0x4131f5
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4131f5
mov eax, dword [0x81581c]
cmp eax, dword [ebp - 0x18]
je 0x4131f5
push eax
call esi
test eax, eax
je 0x4131f5
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x815814]
call esi
test eax, eax
je 0x413211
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x413213
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408a71
leave
ret
Function at 0x80eeb0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0x80c
cmp dword [0xb9a560], 0x37
jne 0x80ef5c
mov eax, dword [esp]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
push 0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 8]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
lea ecx, [esp + 0x410]
push ecx
push 0
push 0x404118
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0x404170
push 0x4041b4
push 0x4041f8
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov edx, dword [0xb9a564]
mov dword [esp], edx
mov eax, 0x5d1
add dword [esp], eax
mov eax, dword [esp]
mov cl, byte [eax + esi]
mov edx, dword [0x81a5c4]
mov byte [edx + esi], cl
add esp, 0x80c
ret