joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408650
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x52965c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x408863
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408863
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408683
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x408863
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, 1
push 0
push eax
call fcn.00474bb0
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00474bb0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
add esp, 0x18
push esi
push eax
call ebx
push 0x4f32c4
lea eax, [ebp - 0x414]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408704
test al, 1
je 0x408704
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x408849
lea ecx, [ebp - 0x664]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40883d
nop dword [eax]
test byte [ebp - 0x664], 0x10
je 0x4087b8
cmp word [ebp - 0x638], 0x2e
jne 0x408777
mov ax, word [ebp - 0x636]
test ax, ax
je 0x408822
cmp ax, 0x2e
jne 0x408777
cmp word [ebp - 0x634], 0
je 0x408822
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00474bb0
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.00408650
add esp, 4
jmp 0x408820
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00474bb0
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40880f
test al, 1
je 0x40880f
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408740
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e5d8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0045e5d8
mov esp, ebp
pop ebp
ret
Function at 0x408880
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4088d8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4088d8
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4088b8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4088d8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4088d3
test al, 0x10
je 0x4088d3
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4088d8
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret

Function at 0x408fc0
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x408fef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.delete__s_failed__error_d
call fcn.00435160
add esp, 0xc
mov eax, 1
pop esi
pop ebp
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408fe7
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x409015
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x408fd2
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4441a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8956
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x52965c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [ecx + 4]
cmp eax, 2
je 0x444220
cmp eax, 3
je 0x444220
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi + 0x1fc]
jne 0x4441ff
push dword [ecx + 0x7c]
push str.bizhi_download__d
call fcn.00445870
add esp, 8
jmp 0x4443da
cmp eax, dword [esi + 0x20c]
jne 0x4443da
push dword [ecx + 0x7c]
push str.gm_download__d
call fcn.00445870
add esp, 8
jmp 0x4443da
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [esi + 0x1fc]
jne 0x444301
cmp eax, 2
jne 0x4442f2
lea ecx, [ebp - 0x42c]
call fcn.0043fec0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00474bb0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
mov eax, dword [0x52dee0]
push 0x52dee0
call dword [eax + 0x44]
push str.Utils
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
push dword [esi + 0x204]
lea ecx, [ebp - 0x42c]
call fcn.00440020
test eax, eax
je 0x4442cd
lea eax, [esi + 0x1e4]
push eax
push 0
lea eax, [esi - 4]
push eax
push 0x444910
push 0
push 0
call fcn.004a1368
add esp, 0x18
mov dword [esi + 0x1e8], eax
jmp 0x4442e7
lea eax, [ebp - 0x218]
push eax
push dword [esi + 0x204]
push str.unpack_bizhi_fail__src__s___output__s_
call fcn.00445870
add esp, 0xc
lea ecx, [ebp - 0x42c]
call fcn.0043fee0
mov dword [esi + 0x208], 1
jmp 0x4443da
cmp ecx, dword [esi + 0x20c]
jne 0x4443da
cmp eax, 2
jne 0x4443d0
lea ecx, [ebp - 0x438]
call fcn.0043fec0
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.00474bb0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
mov eax, dword [0x52dee0]
push 0x52dee0
call dword [eax + 0x44]
push str.Utils
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
push dword [esi + 0x214]
lea ecx, [ebp - 0x438]
call fcn.00440020
test eax, eax
je 0x4443ab
lea eax, [esi + 0x1f0]
push eax
push 0
lea eax, [esi - 4]
push eax
push 0x444930
push 0
push 0
call fcn.004a1368
add esp, 0x18
mov dword [esi + 0x1f4], eax
jmp 0x4443c5
lea eax, [ebp - 0x420]
push eax
push dword [esi + 0x214]
push str.unpack_gm_fail__src__s___output__s_
call fcn.00445870
add esp, 0xc
lea ecx, [ebp - 0x438]
call fcn.0043fee0
mov dword [esi + 0x218], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e5d8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401cf0
Capabilities:
Create thread

Disassembly:
mov eax, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
push ebx
push edi
mov ebx, ecx
push eax
push str.IPC_:_Server___StartServer
mov ecx, 0x40a888
call sub.cwbsv.dll_Ordinal_3322
mov ecx, eax
call sub.cwbsv.dll_Ordinal_3336
cmp dword [ebx], 0
je 0x401d1c
pop edi
xor eax, eax
pop ebx
ret 4
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x401d2b
pop edi
xor eax, eax
pop ebx
ret 4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
lea edx, [ebx + 4]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0x401c40
mov byte [ebx + 0x10c], 0
call dword [sym.imp.MSVCRT.dll__beginthread]
mov ecx, dword [ebx + 0x104]
add esp, 0xc
push 0x493e0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
pop esi
jne 0x401da9
mov edx, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
mov ecx, 0x40a888
push edx
push str.IPC_:_Server___StartServer_:_Failed___Timeout_on_window_creation
call sub.cwbsv.dll_Ordinal_3322
mov ecx, eax
call sub.cwbsv.dll_Ordinal_3336
mov ecx, ebx
call fcn.004020c0
pop edi
xor eax, eax
pop ebx
ret 4
mov eax, dword [ebx]
pop edi
pop ebx
ret 4
Function at 0x4022d0
Capabilities:
Create thread

Disassembly:
mov eax, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
push ebx
push esi
push edi
mov ebx, ecx
push eax
push str.IPC_:_Client___EstabolishConnection
mov ecx, 0x40a888
call sub.cwbsv.dll_Ordinal_3322
mov ecx, eax
call sub.cwbsv.dll_Ordinal_3336
mov edi, dword [esp + 0x10]
test edi, edi
je 0x40233c
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebx + 0x10c], eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x110]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x10c]
test eax, eax
jne 0x40233c
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
cmp dword [ebx], 0
je 0x402349
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
mov edi, dword [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x402220
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__beginthread]
mov ecx, dword [ebx + 0x104]
add esp, 0xc
push 0x493e0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4023c3
mov edx, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
mov ecx, 0x40a888
push edx
push str.IPC_:_Client___EstabolishConnection_:_Failure__Window_Creation_Timed_Out
call sub.cwbsv.dll_Ordinal_3322
mov ecx, eax
call sub.cwbsv.dll_Ordinal_3336
mov ecx, ebx
call fcn.00402410
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [ebx + 0x10c]
test eax, eax
je 0x4023e0
mov al, byte [esp + 0x18]
test al, al
jne 0x4023e0
push 1
push 0
mov ecx, ebx
call fcn.004023f0
mov eax, dword [ebx + 0x10c]
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x403b90
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x406d24
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 8]
mov byte [esi + 4], bl
call fcn.00402db0
lea edi, [esi + 0x28]
mov dword [esi + 0x24], ebx
mov eax, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], eax
lea ecx, [eax + 0xf4]
mov dword [eax + 0xf0], ebx
mov dword [ecx + 4], ebx
mov dword [ecx], 0x4081d0
push ebx
mov byte [esp + 0x20], 1
call sub.cwbco.dll_Ordinal_1700
push ebx
push 1
push ebx
push ebx
mov byte [esp + 0x2c], 2
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
push ebx
mov ecx, edi
mov dword [esi], eax
call fcn.004039c0
push esi
push ebx
push 0x404390
call dword [sym.imp.MSVCRT.dll__beginthread]
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov dword [esi + 0x20], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x405c50
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x406fd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0x14]
mov dword [esp + 0x18], ecx
call sub.cwbco.dll_Ordinal_1702
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x34], ebx
call fcn.00405be0
mov eax, dword [edi + 4]
mov esi, dword [eax]
cmp esi, eax
je 0x405ca5
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x3c]
add ecx, ebx
cmp ecx, edx
jge 0x405ca5
mov esi, dword [esi]
mov ebx, ecx
cmp esi, eax
jne 0x405c90
mov eax, dword [edi + 0x1c]
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
inc eax
mov dword [edi + 0x1c], eax
sub ebp, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + 4]
push 0x18
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ecx, esi
test esi, esi
jne 0x405cd9
mov ecx, eax
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x405ce5
mov ecx, eax
mov dword [eax + 4], ecx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
add eax, 8
test eax, eax
je 0x405d0e
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax + 4], ebp
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov ebp, dword [edi + 8]
mov edx, dword [esp + 0x3c]
inc ebp
sub ebx, edx
mov dword [edi + 8], ebp
mov ecx, dword [esi + 0xc]
add ecx, ebx
mov dword [esi + 0xc], ecx
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x405d3e
push edi
push 0
push 0x405ac0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [edi + 0x1c]
mov ecx, dword [esp + 0x18]
dec edi
mov dword [esp + 0x34], 0xffffffff
call sub.cwbco.dll_Ordinal_1704
mov ecx, dword [esp + 0x2c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x429128
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00428fa7

Function at 0x42e72f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042e3dd
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x402100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x405216], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.immortable
push str.Odios
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402148
xor eax, eax
jmp 0x402163
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4034c0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
call fcn.004035f0
push 0x405004
push section..data
call fcn.004035c0
add esp, 8
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x403541
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
test edx, edx
je 0x40352b
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x22
je 0x40352b
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
jmp 0x40350b
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x40353f
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
jmp 0x403557
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x20
jle 0x403557
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
jmp 0x403541
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x403577
mov edx, dword [ebp - 0x4c]
movsx eax, byte [edx]
cmp eax, 0x20
jg 0x403577
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
jmp 0x403557
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x403588
movzx eax, word [ebp - 0x18]
mov dword [ebp - 0x54], eax
jmp 0x40358f
mov dword [ebp - 0x54], 0xa
mov ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call section..text
mov dword [ebp - 0x50], eax
call fcn.00403660
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x403b2f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
call fcn.00403d35
push 0x5b
push eax
mov dword [ebp - 8], eax
call fcn.00407830
mov edi, eax
xor ebx, ebx
add esp, 0xc
cmp edi, ebx
je 0x403bf0
push esi
inc edi
push 0x5d
push edi
call fcn.00407830
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x403bef
mov byte [esi], bl
inc esi
push 0x3d
push esi
call fcn.00407830
pop ecx
pop ecx
cmp eax, ebx
je 0x403bef
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push edi
push dword [section..data]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403bb4
push ebx
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403be6
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x403bdd
cmp eax, 2
je 0x403bdd
push ebx
push str.Could_not_delete_value
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.00403d35
pop ecx
pop esi
pop edi
pop ebx
leave
ret

Function at 0x403d35
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x403d44
pop dword [ebp - 0x38]
mov eax, 0x24eec84d
add eax, 0xdb5174f7
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xa2a3b8c
add dword [ebp - 0x48], 0x442809bf
mov dword [ebp - 0x44], 0x62f37c87
sub dword [ebp - 0x44], 0x30c03042
mov dword [ebp - 0x40], 0x1d3f3f73
sub dword [ebp - 0x40], 0xd0f2fb45
mov dword [ebp - 0x3c], 0x5b7fb6b6
add dword [ebp - 0x3c], 0xa480494a
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x83aa242a
sub dword [ebp - 0x48], 0xf37bad4
mov dword [ebp - 0x44], 0x451e9dc3
sub dword [ebp - 0x44], 0x3b23c4e
mov dword [ebp - 0x40], 0xc36bc9f5
sub dword [ebp - 0x40], 0x5ffc5d89
mov dword [ebp - 0x3c], 0x47b8e7c6
sub dword [ebp - 0x3c], 0x47b8e7c6
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x1a286b09
add eax, 0xe619c61b
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x408ab
push 0
call eax
mov ecx, 0x8a8cdafa
add ecx, 0x757377af
mov edx, eax
mov ebx, 0x5a77df8
add ebx, 0xfa9bc608
add ebx, dword [ebp - 0x38]
mov edi, 0x5ed0d026
sub edi, 0x450c74e3
sub dword [ebp - 0x18], ecx
mov esi, dword [ebx]
xor dword [ebp - 0x10], 0xff7d75c0
xor esi, edi
sub dword [ebp - 0x1c], 0xff7fac79
mov dword [edx], esi
add edx, 0x3e7d63cb
sub edx, 0x3e7d63c7
add ebx, 4
loop 0x403e61
add eax, 0xc0496ca4
sub eax, 0xc0482f2d
xor ebx, ebx
add ebx, eax
add eax, 0xa0f25cb8
add eax, 0x5f0da34d
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x492110
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49213d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49213d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401930
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov ebx, 1
mov dword [ebp - 0xc], 0
push 1
push 0x4de7d0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4019bc
mov eax, 0x51eb851f
imul ebx
mov ecx, ebx
sar ecx, 0x1f
sar edx, 5
sub edx, ecx
imul esi, edx, 0x64
mov eax, ebx
sub eax, esi
jne 0x4019bc
cmp ebx, 0x15f90
jge 0x401985
xor eax, eax
jmp 0x4019b5
cmp ebx, 0x1d4c0
jge 0x401994
mov eax, 0x32
jmp 0x4019b5
cmp ebx, 0x2bf20
jge 0x4019a3
mov eax, 0x64
jmp 0x4019b5
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x4019b5
mov eax, 0xfa
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4019d0
inc ebx
cmp ebx, 0x57e40
jl 0x401948
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4019e8
mov dword [ebp - 0x10], 0x98
lea eax, [ebp - 0x10]
push eax
call fcn.00412100
pop ecx
mov eax, dword [0x4de7d4]
test eax, eax
jne 0x401a1e
cmp dword [0x4db0a0], 1
je 0x401aa2
xor ebx, ebx
xor esi, esi
cmp dword [0x4de7cc], 0
je 0x401a62
cmp dword [0x4db0a0], 1
mov dword [0x4de7d4], 1
je 0x401a4d
push dword [0x4de7c8]
mov dword [0x4de7d0], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x401ac0
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00450c00
push ebx
push 0x16
call fcn.00450c00
add esp, 0x10
jmp 0x401a1e
mov dword [0x4de7cc], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4de7c8], eax
cmp eax, 0xffffffff
jne 0x401a86
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x401a0b
push 0x4018c0
call fcn.00451620
push 0x401890
call fcn.00451620
add esp, 8
jmp 0x401a0b
push 1
push 2
call fcn.00450c00
mov esi, eax
push 1
push 0x16
call fcn.00450c00
add esp, 0x10
mov ebx, eax
jmp 0x401a02
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x70
call fcn.00412140
add esp, 0xc
test eax, eax
je 0x401aea
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov edx, 0x70
mov ecx, dword [edx + 0x4daffc]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4daff8]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4daff4]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4daff0]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x401af2
push dword [ebp - 0xc]
push dword [0x4de7c8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0xc]
jmp 0x401a3c