joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012941
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x100ec274]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 4]
or eax, 0x2001f
mov dword [esp + 0x10], ebx
push eax
push ecx
push dword [edi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.10012d20
mov esi, eax
test esi, esi
je 0x100129a7
cmp dword [esp + 0xc], ebx
je 0x100129a0
push dword [esp + 0xc]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
jmp 0x10012a36
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
mov ebx, dword [sym.imp.advapi32.dll_RegEnumKeyExW]
jmp 0x100129eb
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.10012d20
mov esi, eax
test esi, esi
jne 0x10012a4d
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x28]
mov dword [esp + 0x38], 0x100
call ebx
test eax, eax
je 0x100129c2
cmp dword [esp + 0xc], 0
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
je 0x10012a15
push dword [esp + 0xc]
call esi
and dword [esp + 0xc], 0
push dword [esp + 0x1c]
and dword [esp + 0x14], 0
mov ecx, edi
call fcn.10012d20
cmp dword [esp + 0xc], 0
mov edi, eax
je 0x10012a34
push dword [esp + 0xc]
call esi
mov eax, edi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1008a5be
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0xc], 0
jmp 0x10012994

Function at 0x10012d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10012d2f
pop dword [ebp - 0x44]
mov eax, 0x10012d2f
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x4e834
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x3dc2
xor esi, esi
add esi, eax
mov edi, 0x10115200
add edi, dword [ebp - 0x44]
mov ebx, 0xbaa48c95
add ebx, 0x4fd4e92c
xor dword [ebp - 0x18], 0x6387c628
mov edx, dword [edi]
sub dword [ebp - 0xc], eax
xor edx, ebx
xor dword [ebp - 4], eax
mov dword [esi], edx
add dword [ebp - 0x18], 0xe4c3e37f
add esi, 0xebb2aea3
add esi, 0x144d5161
add edi, 4
loop 0x10012d7a
add eax, 0x889e20d8
add eax, 0x7762c903
xor ebx, ebx
add ebx, eax
add eax, 0x9aadf8ea
sub eax, 0x9aadf8e5
mov ecx, 0x25088319
add ecx, 0xeaf77ce7
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10013570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x41c
mov eax, 0x1008d0d6
call fcn.1008bdcf
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x418], eax
xor eax, eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x414], eax
push 0x60
push eax
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.kernel32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
push 2
pop eax
test edi, edi
jne 0x100135e1
push eax
push edi
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x100135e1
call fcn.10011e99
mov esi, eax
jmp 0x100136c3
push dword [ebp - 0x418]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10013604
call fcn.10011e99
jmp 0x100136b6
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x100135fa
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x1001362d
mov esi, 0x8007000e
jmp 0x100136b8
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
test edx, edx
ja 0x100136e6
jb 0x10013648
cmp eax, 0xffffffff
ja 0x100136e6
cmp eax, 0x400
jbe 0x1001365d
push eax
lea ecx, [ebp - 0x414]
call fcn.10012d20
jmp 0x10013669
lea eax, [ebp - 0x410]
mov dword [ebp - 0x414], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x414], 0
je 0x10013623
push esi
push dword [ebp - 0x414]
push esi
push ebx
push 0
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100135fa
mov eax, dword [ebp - 0x414]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x424]
push dword [ebp - 0x414]
call fcn.10012d20
mov esi, eax
test edi, edi
je 0x100136c3
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x410]
cmp dword [ebp - 0x414], eax
je 0x100136dc
lea ecx, [ebp - 0x414]
call fcn.10011e61
mov eax, esi
call fcn.1008bd84
ret 0x10
push 0x80070216
call fcn.10012d20
int3

Function at 0x10016137
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.kernel32.dll_GetFileSizeEx]
test eax, eax
jne 0x10016169
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
jmp 0x1001616b
xor eax, eax
pop ebp
ret 0xc
Function at 0x10016f73
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x118
mov eax, 0x1008d448
call fcn.1008bdcf
mov edi, ecx
and dword [ebp - 4], 0
xor esi, esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x120], ebx
test ebx, ebx
jle 0x10016fab
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.10012d20
mov esi, eax
test esi, esi
js 0x100170fc
cmp dword [edi + 0xac], 0
je 0x10016fbf
lea ecx, [edi + 0xa8]
call fcn.10012d20
cmp ebx, 0x64
jle 0x10017032
mov byte [ebp - 4], 2
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
call esi
xor ebx, ebx
lea edx, [ebp - 0x120]
mov ecx, 0xa5a9
mov dword [ebp - 0x120], ebx
call fcn.10012d20
push ebx
call esi
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x11c], ebx
mov ecx, 0xa5aa
call fcn.10012d20
push ecx
push dword [ebp - 0x120]
lea ecx, [edi + 0x30]
push dword [ebp - 0x11c]
call fcn.10012d20
push dword [ebp - 0x11c]
call esi
push dword [ebp - 0x120]
call esi
mov esi, 0x80004005
jmp 0x1001711a
xor eax, eax
mov dword [ebp - 0x11c], eax
test ebx, ebx
jle 0x1001711a
mov ebx, dword [ebp - 0x124]
push eax
lea ecx, [ebp + 8]
call fcn.10012d20
lea ecx, [ebp - 0x118]
push dword [eax]
call fcn.10012d20
push dword [eax]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
lea eax, [ebp - 0x114]
cmp dword [ebp - 0x118], eax
je 0x10017083
push dword [ebp - 0x118]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
cmp esi, 0xffffffff
jne 0x100170a8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x100170b6
cmp eax, 3
je 0x100170b6
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x100170b2
mov ebx, esi
shr ebx, 4
and ebx, 1
xor esi, esi
test esi, esi
js 0x100170fc
push dword [ebp - 0x11c]
lea ecx, [ebp + 8]
call fcn.10012d20
mov ecx, edi
test ebx, ebx
jne 0x100170d4
push ebx
push dword [eax]
call fcn.10017376
jmp 0x100170db
push dword [eax]
call fcn.100175cb
mov esi, eax
test esi, esi
js 0x100170fc
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp eax, dword [ebp - 0x120]
jl 0x10017048
jmp 0x1001711a
lea ecx, [edi + 0xa8]
call fcn.10012d20
push dword [edi + 0xbc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
and dword [edi + 0xbc], 0
lea ecx, [ebp + 8]
call fcn.10019119
mov eax, esi
call fcn.1008bd84
ret 0xc
Function at 0x10046b8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10046ba0
test al, 0x10
jne 0x10046ba0
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x10046ba3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
test esi, esi
jne 0x10046bb1
xor eax, eax
jmp 0x10046be4
movzx eax, word [esi]
mov ecx, eax
push ebx
mov ebx, edi
test ax, ax
je 0x10046be1
mov ecx, esi
movzx edx, word [ecx + 2]
movzx ecx, ax
shl ecx, 0x10
or ecx, edx
xor edi, ecx
test dx, dx
je 0x10046be1
add ebx, 2
lea ecx, [esi + ebx*2]
movzx eax, word [ecx]
test ax, ax
jne 0x10046bc0
mov eax, edi
pop ebx
pop edi
pop esi
ret

Function at 0x100470b6
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x1004710c
test esi, esi
je 0x1004710c
push 2
pop edx
call fcn.10012d20
mov edi, eax
test edi, edi
jne 0x100470d7
mov eax, 0x80004005
jmp 0x10047111
mov ecx, esi
call fcn.10001da2
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push 0
push edi
call dword [sym.imp.advapi32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
jmp 0x10047111
mov eax, 0x80070057
pop edi
pop esi
ret 4

Function at 0x10047116
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10047126
mov eax, 0x80070057
jmp 0x1004716a
call fcn.10012d20
mov edi, eax
test edi, edi
je 0x10047167
push 0
call fcn.100474e6
neg eax
sbb eax, eax
and eax, 0x100
push eax
push esi
push edi
call dword [sym.imp.advapi32.dll_RegDeleteKeyExW]
push edi
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp esi, 2
je 0x10047167
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
jmp 0x1004716a
xor eax, eax
inc eax
pop edi
pop esi
pop ecx
ret
Function at 0x10056595
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc0
mov eax, 0x1008eff9
call fcn.1008bdcf
mov eax, dword [ebp - 0xc8]
xor ebx, ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc8], 0x100fd92c
mov dword [0x100fd92c], ebx
mov dword [0x100fd930], ebx
mov dword [0x100fd934], ebx
xor ecx, ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], ebx
push eax
inc ecx
push ecx
push ebx
push str.Control_PanelInternational
push ADsGetObject
mov dword [ebp - 0xcc], ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10056732
mov edi, dword [sym.imp.advapi32.dll_RegGetValueW]
lea eax, [ebp - 0xc0]
push eax
push ebx
push ebx
push 0x20000020
push str.Languages
push str.User_Profile
push dword [ebp - 0xc4]
mov dword [ebp - 0xc0], ebx
call edi
test eax, eax
jne 0x10056726
cmp dword [ebp - 0xc0], 3
jbe 0x10056726
push dword [ebp - 0xc0]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10056726
lea eax, [ebp - 0xc0]
push eax
push esi
push ebx
push 0x20
push str.Languages
push str.User_Profile
push dword [ebp - 0xc4]
call edi
test eax, eax
jne 0x1005671e
mov ebx, dword [ebp - 0xc0]
cmp ebx, 3
jbe 0x1005671e
xor edx, edx
shr ebx, 1
push edx
pop ecx
mov eax, edx
mov edi, edx
mov word [esi + ebx*2 - 2], cx
je 0x1005671e
jmp 0x100566ab
cmp eax, ebx
jae 0x100566b1
inc eax
cmp word [esi + eax*2], dx
je 0x100566a6
cmp word [esi + edi*2], dx
jne 0x10056719
cmp edi, eax
jbe 0x10056719
xor ecx, ecx
lea eax, [esi + eax*2]
mov word [ebp - 0xbc], cx
lea ecx, [ebp - 0xbc]
push 0x55
push ecx
push eax
call dword [sym.imp.kernel32.dll_ResolveLocaleName]
test eax, eax
je 0x10056714
cmp word [ebp - 0xbc], 0
je 0x10056714
mov eax, dword [0x100fd930]
lea ecx, [ebp - 0xbc]
push ecx
cmp eax, dword [0x100fd934]
je 0x10056709
mov ecx, eax
call fcn.10012d20
add dword [0x100fd930], 0x18
jmp 0x10056714
push eax
mov ecx, 0x100fd92c
call fcn.1005ca38
lea eax, [edi + 1]
xor edx, edx
inc edi
cmp edi, ebx
jb 0x100566ab
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push dword [ebp - 0xc4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, 0x100fd92c
call fcn.1008bd84
ret 4
Function at 0x431088
Capabilities:
Encode data using xor

Disassembly:
leave
or dword [eax - 0x56], edi
mov ebp, 0xe761e77
jp 0x43105d
adc edx, dword [edi + 0x4f]
xor al, bl
jp 0x43104a
push ebp
push edi
xchg ebx, eax
cmp al, 0x53
cwde
popfd
inc edi
push cs
xchg ebx, eax
fisub word [0x50c35c1c]
pop es
cmc
cmp ebx, eax
xlatb
xchg ebp, eax
pop es
push ss
pop esi
or byte [eax - 0x3a], cl
mov al, byte [0x3882d0d]
push ebp
fisubr word [edx]
pushfd
cld
into
ret
pop esp
ret
or dl, byte [edi + 0x54]
pop edx
cmp al, 0xba
jbe 0x43103b
pop esp
pushfd
or ch, ch
salc
mov ecx, 0xdb47b893
or dword [ebx + 0x2a1880e7], edi
ret 0x8f69

Function at 0x4bd558
Capabilities:
Encode data using xor

Disassembly:
std
invalid
dec eax
ja 0x4bd47f
cmc
pop es
sbb byte [ecx - 0x46], ah
mov edx, 0xa8203735
mul byte [ebx]
rol byte [ebx], 1
mov dword [0xeb07bfc2], eax
dec edi
mov esi, 0x8a7ef858
jecxz 0x4bd4e2
mov dh, byte [edi]
xchg esi, eax
mov eax, 0x54099a9
mov al, 0xfc
dec esp
retf
Function at 0x506158
Capabilities:
Encode data using xor

Disassembly:
cmc
mov esi, 0xba26c86c
add eax, 0xb87ceec7
test dword [edi - 0x154c23a5], 0x943f12e2
xchg dword [ebx - 0x24], ebx
mov bl, 0xea
loop 0x506159
aas
xchg esp, eax
movsb byte es:[edi], byte [esi]
enter 0x2039, 0x1d
sub edi, esp
test al, 0x6a
pop eax
hlt
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
xchg ebx, eax
xor dword [ebx], esp
jne 0x506140
mov eax, 0xf89c3fd9
or al, 0x6d
out 0xd7, eax
xchg dword [ebx - 0x33], eax
sub al, bh
dec eax
mov ebp, 0x6e7a1943
push edi
xor dword [0x5ce49bc3], 0x72
xlatb
test al, 0xc3
sbb eax, 0xe55c8993
aaa
pop ecx
cmp ah, ch
sbb dl, bh
sbb byte [edx + 0x3e], dh
pop edx
pop edx
out 0x58, al
or byte [ebx], ah
je 0x50616d
xor byte [eax + 0x27], ch
or al, 0x9d
xchg byte [esi + 0x282a5878], bl
jne 0x506134
mov dh, 0x4d
leave
inc esi
xor byte [edx + esi*8 + 0x19faf9ad], ch
int 0x6e
cli
sbb ebp, ecx
outsb dx, byte [esi]
test ecx, esi
int1
sub ch, byte [esi - 0x7bc31ba4]
dec ebp
test al, 0x4a
ja 0x50618b
mov edi, esp
jp 0x5061aa
cmpsd dword [esi], dword es:[edi]
js 0x50623b
mov dword [0x982a2e2a], eax
imul ebx, ebx, 0xffffffae
outsd dx, dword [esi]
and eax, 0xf4c97c9a
add al, 0xec
jg 0x5061af
mov cl, 0xa8
enter 0x51ab, 0x3b
lea ecx, [0x9986f268]
jg 0x506237
or edx, ecx
mov edi, 0xaac3ab15
cmp ebx, dword [edi + 0xc1a5587]
int3
test dh, ah
cdq
adc eax, 0xb5aa5c7b
salc
jnp 0x506299
stosb byte es:[edi], al
mov ch, 0xd6
xchg ecx, eax
fnstsw word [eax - 0x7e543e2f]
pop edx
xchg edx, eax
xchg esi, eax
clc
add byte [edi - 0xcc306ce], al
sub eax, 0x1a7fd70c
sub byte [0x91616908], dl
scasb al, byte es:[edi]
pop esi
js 0x5062c1
jo 0x506289
test edx, 0x96ef35a9
call 0x6362d94f
or ah, al
sbb eax, 0x2c1ee409
mov dl, 0xb3
cli
into
ud2
sar eax, cl
adc dh, ch
adc ch, byte [edx - 0x15]
stc
fist word [esi - 0x67]
test bl, 0xa8
fidiv dword [ebx + 0x66ae2a46]
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
hlt
inc esi
sub ch, byte [esi - 0xb935b9a]
pop edx
sub dword [ecx - 0x56], edi
call 0xd7fccafb
movsd dword es:[edi], dword [esi]
test al, 0x15
sti
popfd
aam 0x40
cdq
invalid
shl dword [esi - 0x7b216e21], cl
wait
aad 0x29
and byte [eax + 0x46], al
add ch, bh
mov dword [eax - 0x6d], ebx
outsb dx, byte [esi]
cwde
mov al, dh
adc byte [ebx + 0x54], al
push 0x5d
mov ebp, dword [ecx]
stosb byte es:[edi], al
mov gs, word fs:[edx - 0x5a]
cld
pop dword [ebx]
popfd
retf 0x637a
Function at 0x50cc78
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
movsb byte es:[edi], byte [esi]
ja 0x50cc2b
mov ecx, 0x70183cb0
call 0x4a42bc2
pop edi
xor byte [edi + 0x765b4b89], bh
pushfd
cmp eax, 0x4bb567fd
sbb dh, 0x6e
loope 0x50cc32
sbb eax, 0x91b8eb30
fstp dword [eax + ebp*2]
out dx, eax
fmul st(7)
stosd dword es:[edi], eax
cmp al, 0x85
invalid
clc
leave
push edx
xor dword [esi + edi], 0x74
mov bl, 0xd2
mov dword [0x6ff85f6b], eax
push 0x7a
mov ch, byte [ebx]
loopne 0x50cc28
fst dword [esi - 0x80]
int 0x6f
dec esp
daa
mov dword [0x32e3cb88], eax
push esp
jmp 0x50ccfc
sbb ebp, ebp
lea edx, [ecx + 0x298ce499]
mov cl, bh
and cl, al
mov bl, al
cwde
fldenv [ebx]
jg 0x50ccbd
fisubr dword [esi + 0x7f]
pop es
in eax, 0x42
jmp dword [eax + 0xa3851f6]
jg 0x50cccb
jbe 0x50cc8f
xchg esi, eax
invalid

Function at 0x62b118
Capabilities:
Encode data using xor

Disassembly:
test dword [edx + 0x40], ebx
xor dword [esi - 0x37], ebx
dec esp
sub dword [edx - 0x44], ecx
add dh, byte [edi - 0x46]
bound edx, qword [esi + 0x752eae5a]
or ebx, dword [esi + 0x31]
mov bl, 0x5b
mov byte [ebp - 0x80], dh
jne 0x62b116
pop esi
xor dword [ebx - 0x7f8a77a5], esi
jp 0x62b182
inc ebp
neg byte [ebp + ecx*4 + 0x6dee784e]
dec esi
js 0x62b109
insd dword es:[edi], dx
pushfd
lea ecx, [esi + 0x78]
dec esi
js 0x62b109
dec esi
js 0x62b109
insd dword es:[edi], dx
aas
mov esi, 0x4de43e4f
sub byte [edi], 0x8e
jg 0x62b0f7
das
mov gs, word [esi]
jg 0x62b0f7
fdivr st(4)
add eax, 0x74de3ffa
adc al, 0xc0
je 0x62b123
adc al, 0xc0
mov dl, 0x32
sal byte [edx + 0x7f718cdc], 0x85
dec eax
add edx, dword [edi + 0x7c]
push esi
jno 0x62b1b9
test dword [eax + 3], ecx
push edi
jl 0x62b196
das
out 0x2c, al
mov ch, 0xc7
je 0x62b1a6
rcr al, 1
add esi, dword [0xff4e849e]
fidiv dword [eax - 0x1689bab0]
push edi
mov dl, 0xdb
xor byte [edi + ecx*4], ch
clc
dec ebp
test byte [eax + 0x44c08e96], ah
sahf
jae 0x62b138
jle 0x62b10b
mov esp, 0x608d3e77
fmulp st(5)
test eax, 0x1c6de7d2
jmp esp
xchg edi, eax
lodsb al, byte [esi]
cmpsd dword [esi], dword es:[edi]
pop esi
dec ebp
pop es
inc eax
rcr dword [esi + 0x7f365fea], 1
mov dl, 0x85
jbe 0x62b182
xchg ebx, eax
inc edx
invalid
pop edi
jge 0x62b12e
aaa
add ebx, dword [ecx - 0x72]
outsb dx, byte [esi]
fild word [esi - 1]
mov edi, 0x150d0a10
pushal
lea ebx, [edi - 0x1a8f7002]
push ss
push es
dec byte [edi + 0x616e570]
sbb dl, bl
pop sp
and ecx, dword [edx + 0x43]
cmpsb byte [esi], byte es:[edi]
inc esi

Function at 0x63cae3
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
xor eax, ebx
imul eax, dword [ebx], 0x20
sar dword [0x947c798c], 1
dec edi
out dx, eax
xor ecx, dword [edi + edx*8]
or al, 0xbe
or eax, ecx
sub bh, byte [esi - 0x17]
fdivr st(7), st(0)
sbb al, 0x97
lodsb al, byte [esi]
or al, 0x7c
das
pop ebx
mov cl, byte cs:[edi + eax*2 - 0x72e813cb]
invalid
fstp dword [esi - 0x326bc63]
out 0xf4, eax
dec esp
jbe 0x63caba
retf
Function at 0x40154f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov esi, eax
lea eax, [ebp - 0x1c]
mov ebx, edx
mov dword [esp + 0x10], eax
mov eax, dword [0x430918]
or eax, 8
mov dword [ebp - 0x12c], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
lea edi, [ebp - 0x121]
sub esp, 0x14
test eax, eax
je 0x4015ca
jmp 0x401651
cmp dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x1c]
je 0x4015bd
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 1
push edx
jmp 0x401651
xor ecx, ecx
mov edx, edi
call fcn.0040154f
test eax, eax
jne 0x4015f0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumKeyA
sub esp, 0x10
test eax, eax
je 0x40159e
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
mov dword [esp], 2
call fcn.004070a2
test eax, eax
push edi
je 0x40162d
mov edx, dword [0x430918]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
call eax
sub esp, 0x10
jmp 0x401651
mov eax, 1
cmp dword [0x430918], 0
jne 0x401651
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
setne al
push ebx
push ebx
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403911
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x40393b
mov eax, dword [0x421c60]
test eax, eax
je 0x40392f
mov dword [esp], eax
call sub.USER32.dll_DestroyWindow
push ecx
mov dword [0x421c60], 0
jmp 0x4039a7
cmp dword [0x421c60], 0
je 0x403953
mov dword [esp], 0
call fcn.00407059
push edx
jmp 0x4039a7
call sub.KERNEL32.dll_GetTickCount
cmp eax, dword [0x430998]
jbe 0x4039a7
mov eax, dword [0x4309f8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x403ceb
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call sub.USER32.dll_CreateDialogParamA
sub esp, 0x14
mov dword [0x421c60], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
push eax
push eax
leave
ret
Function at 0x4076f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, 0x64
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x1c]
jmp 0x407742
mov dword [esi], 0x61736e
call sub.KERNEL32.dll_GetTickCount
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
div ecx
add edx, 0x61
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x1a], dl
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_GetTempFileNameA
sub esp, 0x10
test eax, eax
jne 0x40774d
dec edi
cmp edi, 0xffffffff
jne 0x407706
mov byte [ebx], 0
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x407759
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x42eaa8
call fcn.00407326
push eax
push eax
mov dword [esp], 0x42eaa8
call fcn.00407151
test eax, eax
push ebx
mov ebx, eax
je 0x407805
mov dword [esp], eax
call fcn.004071c3
cmp byte [0x4309a8], 0
push ecx
jns 0x4077cb
mov al, byte [ebx]
cmp al, 0x5c
je 0x407805
test al, al
je 0x407805
jmp 0x4077cb
mov dword [esp], 0x42eaa8
call fcn.004070f2
test eax, eax
push edx
je 0x4077bc
test byte [eax], 0x10
je 0x407805
mov dword [esp], 0x42eaa8
call fcn.004072aa
push ecx
jmp 0x4077d1
sub ebx, 0x42eaa8
mov dword [esp], 0x42eaa8
call fcn.0040729e
cmp eax, ebx
push edx
jg 0x4077a6
mov dword [esp], 0x42eaa8
call fcn.004072e2
push ecx
mov dword [esp], 0x42eaa8
call sub.KERNEL32.dll_GetFileAttributesA
inc eax
setne al
push edx
movzx eax, al
jmp 0x407807
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x40780e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
push edx
xor edx, edx
cmp eax, 0xffffffff
mov dword [esp], ebx
setne dl
neg edx
and eax, edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x407869
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
push edx
je 0x407892
and eax, 0xfffffffe
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetFileAttributesA
push ecx
push ecx
mov ebx, dword [ebp - 4]
leave
ret 4