joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b380b
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xf170ace8
dec dword [edx]
pushfd
or eax, dword ds:[ebp - 0x7df98b37]
add dword [edx], ebp
call dword [eax]
jne 0x5b3779
lea ebx, [ebp + 0x18]
or byte [esi + 0x24], 4
leave
je 0x5b37b9
mov eax, dword [ecx]
push 0x8910ff01
fldcw word [eax]
aas
dec dword ds:[ebx - 0xfb274dc]
xor ecx, ebp
sub byte [ebx + ebx*4], al
add cl, byte ds:[ecx - 0xb9a7220]
pop esi
pop edi
sbb bl, byte [ebp - 0x3d]
mov ebp, esp
inc ecx
push edi
push esi
push eax
mov eax, dword [0x128f1490]
notrack call 0x6b4b7d39
xor al, ch
mov dl, 0x1a
push cs
add bh, byte [esi]
les eax, [ecx + ecx*4]
mov dword [ebx + 0x26891ce4], 0x893e5e8d
fld1
jne 0x5b3833
mov edi, eax
and esp, 0x1c
mov dword [esi], esp
lea ebx, [esi + 0x3e]
mov ecx, ebx
call 0x41a33f
out 0xff, al
mov ecx, dword [eax + edx]
mov edi, dword [esi]
adc al, 0x89
enter 0x41c7, 0x14
add byte [eax], al
add byte [eax], al
mov dword [esi], edi
mov dword [esi + 8], eax
push edx
call 0x3f475d84
mov eax, dword [ebp + 0x3e]
mov ecx, edi
mov dword [eax], eax
mov dword [esi], eax
call fcn.005b3869
jne 0x5b37fd
mov dword [esi], edi
mov eax, dword [eax + esi*8 + 0x31]
lock xor dword [eax], ebp
invalid
xchg edi, eax
push cs
push cs
add cl, byte [ecx - 0xb9b7210]
pop esi
push ds
pop ebx
pop ebp
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
or eax, 0x128fc590
add byte [ebp + 8], 0x30
fisttp dword [ebp - 0x16ce10c2]
mov dword [ebp - 0x10], ecx
mov ecx, 0x3eff
push es
and ecx, dword [ebp + 0xc]
mov dword [esi + 4], eax
xor dword [eax], eax
mov byte [ebp + 0x3e], bl
inc eax
push eax
inc ebp
push 0
loopne 0x5b37ff
aad 0x3e
inc dword [ebx + 0x44890c3e]
sahf
or byte [edx - 0x7d], al
sti
add al, 0x75
in al, 0x3e
dec ebp
invalid

Function at 0x5bac08
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0
add byte [eax], al
and al, byte [esi + 0x18]
or dl, byte [esi + 0xc]
pop esi
add al, 0x89
jne 0x5bac04
xor byte [edx + eax*8], 0xc
cmp al, 0
inc ebp
in al, dx
sub esi, ebx
je 0x5bac45
lea ecx, [esp + edi]
add byte [eax], al
add byte ds:[ebx + 0x48b04c9], al
or cl, byte [ebx + 0x3e1ceb18]
pop ebx
pop ebx
add al, 0x89
dec ebp
or al, 0x84
inc ebx
or byte [eax], dl
call fcn.005beb3f
test al, al
jne 0x5bacab
mov eax, dword [ebp + 0x30]
mov eax, dword [eax + 0x3e]
mov esi, dword [eax + ebp*4]
cmp esi, ebx
je 0x5bac32
mov eax, dword [eax + esi*8]
lea edi, [esi]
add al, 0x8b
add dword [ecx + 0xc75f6d9], ecx
xor al, ch
add dword ds:[eax], eax
add byte [ebx - 0x74e77dfd], cl
add bh, byte [ecx]
lock and dword ds:[ebx + 0x890449], ecx
mov ecx, dword [eax + 4]
mov dword [ecx], esi
dec esi
add al, 0x89
sbb dword [ebx + 0xe8b0450], ecx
add al, 0x89
add al, 0x8b
inc ecx
add al, 0x89
push eax
add al, 0x89
or al, byte [ebx + ecx*4]
invalid
xor ecx, ecx
mov dword [ebp + 8], eax
sbb byte [eax], 0x88
or byte [ebx + eax*4], al
or byte ds:[esi + 0x4d], bl
pop ebx
pop ebp
ret 0xc
Function at 0x5c7a4b
Capabilities:
Encode data using xor

Disassembly:
dec esp
sbb byte [eax], 0x90
push 0x6f
xlatb
cld
xchg ebp, eax
xchg eax, edx
aam 0xf2
mov dword [0xc5651b0b], eax
movsb byte es:[edi], byte [esi]
aad 0xdd
ror dword [ecx], cl
sub ecx, dword [edx - 0x727e70da]
sbb bl, byte [edi + ecx - 0x69b1cad1]
push ebp
hlt
outsb dx, byte [esi]
mov bh, 0x63
and byte [ebp - 0x3d], cl
mov byte [edi + edi*2 - 0x17], 0xdd
or dh, byte [0xe0524015]
and eax, 0x541d3c03
cmp byte [ebp - 0x42f14384], al
adc dword [eax + 0x7b0c7566], ebx
ja 0x5c7a1d
sal dword [esp + edi*2 - 0x2f], 1
and al, 0x58
adc al, 0x58
or dword [eax], ebp
js 0x5c7ab2
xor edi, dword [edx + 0x4d]
bound ebp, qword [ebp + 0x2aacb9cb]
hlt
pop edx
cmc
fist dword [0x3f10621b]
inc ecx
xor cl, byte cs:[ebp + 0x54]
cmp al, 0x46
mov byte [0x48b5cf5c], al
fistp word [eax - 0x4f032299]
loope 0x5c7aba
xchg dword [esi + 0x27020155], ecx
push ds
inc esi
and edi, dword [edx + 0xf]
pop ecx
rcr byte [eax + 0x257d6c5a], 1
lodsd eax, dword [esi]
and dl, byte [ecx + esi*8]
lcall 0xdc8f, 0xea739df2
dec esp
sbb eax, 0x8727cdac
lcall 0x245d, 0x2b3f57bb
sub eax, 0xdf374428
salc
iretd

Function at 0x5d9907
Capabilities:
Encode data using xor

Disassembly:
arpl word [ecx + 0x320e835f], si
ret
jge 0x5d98f4
arpl word [edx + 0x22cd8a82], dx
mov dh, 0x42
xor al, 0x53
add byte [ebp + 0x78097961], bh
jno 0x5d9909
and byte [0x10ec3582], 0x7f
mov eax, 0xe6161aad
mov cl, 0xab
push ecx
xchg esp, eax
xor byte [ebx - 0x4b], ah
movsd dword es:[edi], dword [esi]
invalid

Function at 0x5e3b73
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x25ad931d
stosb byte es:[edi], al
lodsd eax, dword [esi]
push ebx
int3
rcr byte [eax], 1
jge 0x5538c6
fidiv dword [eax - 0x66b8e5eb]
inc edi
cdq
imul esi, dword [edi + 0x51], 0xec34fcee
sar dword [edx], 0xf1
je 0x55393c
in al, 0xc
inc esp
xchg dword fs:[ebx - 0x3b], esi
xor dl, byte [ebp - 0x7e066227]
test eax, 0x986114c
cmc
or ebp, esi
push ecx
fldenv [ebx]
jecxz 0x553964
test ecx, esi
loop 0x55390d
pop eax
cmc
pop eax
and esp, dword [edi]
mov edi, 0xed24b454
xor dword [esi - 0x48ae36f4], eax
insb byte es:[edi], dx
push es
cmpsd dword [esi], dword es:[edi]
les eax, [esi - 0x11]
mov ch, 0x15
test byte [eax], bl
mov eax, 0xd735fe2a
xor dl, byte [edi]
dec esp
sub bh, dh
xor eax, 0x4c1732d7
call 0xa07a6641
xchg ecx, eax
loop 0x553954
int1
pop es
outsb dx, byte [esi]
dec esi
xchg esi, eax
shl dword [0xe6d3df71], 0x64
adc dword [eax - 0x50], ebp
mov dword [0x8bd0f4f2], eax
push esp
mov dl, 4
in al, 0x14
rol edx, 0xc8
mov esp, 0xd2afd6f4
dec esi
movsd dword es:[edi], dword [esi]
out 0x89, al
cli
lodsd eax, dword [esi]
xor al, 0xd2
mov byte [0x753825ad], al
daa
cmp al, 0x7b
mov ah, 0xee
test dword [0x41804284], edx
mov cl, 0x57
add al, 0x73
add al, 0xa7
fisub dword [eax + 0x3a]
xor byte [edx + eax*4 - 0x15], 0x65
jno 0x553962
loop 0x55392d
push es
invalid
push edi
call 0xf7408dd9
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x120001c2]
lea ebx, [ebp + 0x3efffed4]
call fcn.00467a75
jmp 0x553905
Function at 0x602c70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
cmp dword [0x60c8dc], 0
jne 0x602e65
mov dword [ebp - 0x20], 0x5a4d
mov dword [ebp - 0x10], 0x4550
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0x400000
jmp 0x602cc2
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7c000
jae 0x602e65
mov ecx, dword [ebp - 0xc]
add ecx, 0x1000
mov dword [ebp - 0xc], ecx
mov byte [0x60c7c8], 0xc3
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push str.aclui.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov dword [0x60c8dc], edx
push 2
mov eax, dword [0x60c8dc]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x602e60
mov ecx, dword [0x60c8dc]
xor edx, edx
mov dx, word [ecx]
cmp edx, dword [ebp - 0x20]
je 0x602d5a
jmp 0x602cb9
mov eax, dword [0x60c8dc]
mov ecx, dword [0x60c8dc]
add ecx, dword [eax + 0x3c]
mov dword [0x60c9cc], ecx
push 0x100
mov edx, dword [0x60c9cc]
push edx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x602e60
mov eax, dword [0x60c9cc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, dword [ebp - 0x10]
je 0x602d9c
jmp 0x602cb9
mov edx, dword [0x60c8d4]
add edx, 1
mov dword [0x60c8d4], edx
mov eax, dword [0x60c9cc]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [0x60c8dc]
mov dword [ebp - 0x1c], edx
mov eax, dword [0x60c9cc]
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x5bec64eb
je 0x602de8
cmp dword [ebp - 8], 0x5c1d66c2
je 0x602de8
cmp dword [ebp - 8], 0x5c58463c
jne 0x602e06
push 1
push str.Warning
push str.Invalid_parameter._Continue_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x602e06
xor ebx, dword [edx]
call ebx
int3
cmp dword [ebp - 8], 0x5be19d8a
je 0x602e21
cmp dword [ebp - 8], 0x5c176269
je 0x602e21
cmp dword [ebp - 8], 0x5c544726
jne 0x602e49
mov eax, dword [0x60c8dc]
push eax
mov eax, 3
push eax
xor eax, eax
push eax
mov eax, dword [ebp - 0x1c]
call eax
mov eax, dword [0x60c8dc]
push eax
mov eax, 1
push eax
xor eax, eax
push eax
mov eax, dword [ebp - 0x1c]
call eax
cmp dword [ebp - 0x24], 0
je 0x602e60
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x24], 0
jmp 0x602cb9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c6480]
mov dword [esp + 4], ecx

Function at 0x409eb5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
test al, 1
je 0x40b3d6
test byte [edi], dl
invalid
add byte [eax], al
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x5c], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], 1
call fcn.00420db6
outsb dx, byte [esi]
add dword [eax], eax
mov edx, eax
mov dword [esp + 0x20], eax
add esp, 4
test edx, edx
or eax, 1
mov dword [0x4c6488], 0
push 0x43b5ec
mov dword [0x4c6480], eax
mov dword [0x4c6490], 0
mov dword [0x4c6494], 1
call fcn.00422d40
add esp, 4
jmp 0x409ebf
Function at 0x40a30b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esi], ecx
cmp dword [ecx + 0x1c], 0
je 0x409f3c

Function at 0x40a379
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or eax, 0xfe830000
or byte [edi], cl
test byte [edi], bh
or eax, 0x758b0000
or al, 0x8b
jl 0x40a3af
and byte [ebx - 0x76d7dbbc], cl
jge 0x40a3a3
adc byte [esi], dl
add byte [eax], al
add byte [ebp - 0x1d7af00a], al
add al, 0
add byte [ecx + 0x4c6488ff], al
add byte [esi + edi - 0x7d], dh
jg 0x40a3c7
add al, 0xf
test byte [ebp + 4], dl
add byte [eax], al

Function at 0x40fd12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x10]
sub esp, 0x10
mov dword [esp + 0x28], ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x30], 3
mov edx, dword [edi]
mov eax, dword [eax + edx*4]
mov edx, esp
movsx ecx, word [eax + 0xa]
dec eax
or cl, byte [ecx - 0x74b3dbb4]
or byte [ebx - 0x74fd76ff], cl
inc ecx
add al, 0x89
inc edx
add al, 0x8b
inc ecx
or byte [ecx + 0x418b0842], cl
or al, 0x8d
mov esi, dword [ecx + eax]
add byte [eax], al
mov dword [edx + 0xc], eax
inc dword [eax]
Function at 0x45f7d3
Capabilities:
Encode data using xor

Disassembly:
cld
add dword ds:[ebx], esi
xor eax, eax
shr byte [edx + 8], cl
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x45f7f0
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x45f7e7
pop ecx
invalid

Function at 0x4654a2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor edx, edx
xor esi, esi
cmp dword [edi + 4], edx
jbe 0x4654e6
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
xor ecx, ecx
test ax, ax
je 0x4654df
mov eax, dword [edi]
movzx eax, word [eax + edx*2]
mov dword [ebp + 8], eax
movzx eax, word [ebx]
cmp word [ebp + 8], ax
je 0x4654f0
inc ecx
movzx eax, word [ebx + ecx*2]
test ax, ax
jne 0x4654cc
je 0x46550c
add eax, dword [edx + 0x46]
inc edx
inc esi
cmp esi, dword [edi + 4]
jb 0x4654b9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, edx
jmp 0x4654e9
call 0x31423798
call 0x5347c5a3
inc esi
add dl, byte [eax + 0x50]
push esi
push edi
push 1
push eax
call dword [0x7ebf184]
call 0x7521db02
xor dword [ebx], esi
leave
mov eax, esi
push 2
pop edx
cmp ebx, esi
jl 0x465538
mov eax, ebx
dec dword [ebx - 0x2195be9]

Function at 0x4687fa
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c3190]
jne 0x468807
call 0x835604e1
mov eax, dword [0x4c6ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c6ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0x56ffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x46883f
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c3190]
jne 0x468851
call 0x835604e1
mov eax, dword [0x4c6ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c6ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0x56ffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]

Function at 0x4688a4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cld
jns 0x468894
fadd qword [0x4b9e48]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4b9e20]
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
mov dword [0x4c6530], ecx
inc esi
mov ecx, 0x4c6530
jl 0x46888b
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c6eec
jl 0x4688b5
mov dword [0x4c3190], esi
mov dword [0x4c6518], esi
pop esi
ret
Function at 0x469161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe837ffdc
lea ecx, [ebp - 0xdc]
push esi
push edi
call 0x1b18fb7
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call 0x30af8ffd
add esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x4691a5
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.00469135
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x46918f
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46eb7b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8d0000d4
push ebx
push esi
mov ebx, ecx
lea ecx, [esp + 0x74]
push edi
call fcn.004076bf
test byte [ebp + 0xc], cl
xor eax, eax
push 0x8be674e3
mov dword [esp + 0x28], eax
call fcn.00409af0
dec eax
jge 0x46ebb3
jle 0x46ebf4
add al, 0x8b
xor byte [ebx - 0x53271732], cl
stc
dec dword [eax + 0x4e]
into
call fcn.0040988f
dec eax
dec esi
fsubr dword [ecx + edi*8 + 0x84e48ff]
mov eax, dword [ecx]
mov dword [esp + 0x34], eax
mov dword [esp + 0x48], eax
or byte [ebx + 0x24448901], cl
xor al, 0x89
inc esp
and al, 0x48
mov eax, dword [ecx + 4]
mov dword [esp + 0x4c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x50], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x54], eax
inc dword [eax]
mov eax, dword [edi + 4]
mov esi, dword [eax + 4]
je 0x46ebb1
call fcn.0040988f
dec eax
dec esi
or byte [ebx + 0x24448901], cl
sub byte [ecx - 0x7497dbbc], cl
inc ecx
add al, 0x89
push 0x8904418b
inc esp
and al, 0x6c
mov eax, dword [ecx + 8]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 0x14]
mov dword [esp + 0x74], eax
inc dword [eax]
call fcn.004076bf
lea ecx, [esp + 0x38]
call fcn.004076bf
mov eax, dword [edi + 4]
mov esi, dword [eax + 8]
mov ecx, esi
call fcn.0040988f
test byte [esi + 8], al
mov ecx, dword [eax]
call fcn.0041fcde
push eax
lea ecx, [esp + 0x30]
call fcn.00405286
mov esi, 0x834b7908
push esi
push dword [esp + 0x30]
jmp 0x46ecec
call 0x31424490
call 0xfa53760
test dword [ebx - 1], edx
invalid
Function at 0x402d00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
sub esp, 8
movsd xmm0, qword [0x4372e0]
movsd qword [esp], xmm0
call fcn.0040c4d0
fstp st(0)
add esp, 8
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x10], edx
sub esp, 8
movsd xmm0, qword [0x437230]
movsd qword [esp], xmm0
sub esp, 8
movsd xmm0, qword [0x4372c8]
movsd qword [esp], xmm0
call fcn.0040c500
fstp st(0)
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
jmp 0x402d76
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x18], 0
je 0x402d9d
cmp dword [ebp - 8], 0
jne 0x402d9d
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.00403910
add esp, 8
mov dword [ebp - 8], eax
jmp 0x402d6e
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x403910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0
sub esp, 8
movsd xmm0, qword [0x437228]
movsd qword [esp], xmm0
sub esp, 8
movsd xmm0, qword [0x437260]
movsd qword [esp], xmm0
call fcn.0040cb21
fstp st(0)
add esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x3c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00403ed0
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x78
mov dword [ebp - 0x18], ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x40398a
xor eax, eax
jmp 0x403aca
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403ed0
add esp, 8
mov dword [0x449ca0], eax
mov edx, dword [0x449ca0]
mov eax, dword [edx + 0x18]
mov dword [ebp - 4], eax
sub esp, 8
movsd xmm0, qword [0x437258]
movsd qword [esp], xmm0
call fcn.0040c8b6
fstp st(0)
add esp, 8
mov ecx, dword [0x449ca0]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [0x449c9c], edx
push 0
push 0
push 0x448110
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x449ca0]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov dword [0x449c94], ecx
push 0
push 0
push str.We_are_being_here
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0x449ca0]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [0x449c98], eax
sub esp, 8
movsd xmm0, qword [0x437250]
movsd qword [esp], xmm0
call fcn.0040c790
fstp st(0)
add esp, 8
cmp dword [ebp - 4], 0
jbe 0x403ac7
mov ecx, dword [ebp - 4]
mov edx, dword [0x449c98]
mov eax, dword [edx + ecx*4 - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403ed0
add esp, 8
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
call section..text
add esp, 4
cmp eax, dword [ebp + 0xc]
jne 0x403ab2
sub esp, 8
movsd xmm0, qword [0x437270]
movsd qword [esp], xmm0
call fcn.0040c230
fstp st(0)
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [0x449c94]
movzx edx, word [ecx + eax*2 - 2]
mov eax, dword [0x449c9c]
mov ecx, dword [eax + edx*4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00403ed0
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403aca
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
je 0x403ac7
cmp dword [ebp - 8], 0
je 0x403a3f
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x41f117
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041ef55

Function at 0x4211af
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420a37

Function at 0x4211ba
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420c72
Function at 0x41a810
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
sub esp, 0x130
mov eax, dword [esp + 0x134]
push ebx
push esi
push edi
test eax, eax
mov dword [esp + 0xc], 1
je 0x41a916
push 0x2c
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x41a916
call fcn.0049b880
mov ebx, dword [0x4d8620]
mov eax, dword [0x4d8618]
mov esi, dword [0x4d861c]
push 0
push 2
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 0x128
sbb al, 0x28
add dword [eax], eax
add bh, bh
invalid
mov edi, eax
clc
cmp edi, 0xffffffff
je 0x41a916
lea eax, [esp + 0x14]
push eax
push edi
call esi
test eax, eax
je 0x41a907
lea ecx, [esp + 0x14]
push ecx
push edi
call ebx
test eax, eax
je 0x41a907
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
push 0
call ebp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
mov eax, dword [esp + 0x144]
lea esi, [esp + 0x3c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41a8e3
test cl, cl
je 0x41a8df
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41a8e3
add eax, 2
add esi, 2
test cl, cl
jne 0x41a8bf
xor eax, eax
jmp 0x41a8e8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41a8f0
dec dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push edi
call dword [esp + 0x1c]
test eax, eax
jne 0x41a89c
mov eax, dword [esp + 0x10]
pop ebp
test eax, eax
je 0x41a916
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x130
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x130
ret

Function at 0x434140
Capabilities:
Authenticate hmac

Disassembly:
jmp [eax - 0x77000000]
shl dword [edx], cl
sbb bh, ch
pop esp
loopne 0x434102
ja 0x4341b7
ret 0x5e06
push cs
inc ecx
lodsd eax, dword [esi]
adc edx, edi
movsd dword es:[edi], dword [esi]
jge 0x4341a0
lodsb al, byte [esi]
xor ebp, eax
stosb byte es:[edi], al
outsb dx, byte [esi]
salc
mov esi, 0x755c0c98
adc ecx, esi
mov eax, dword [0x314c237f]
movsd dword es:[edi], dword [esi]
lds edi, [edx]
sar ebp, 1
mov cs, word [ebx + 0xe]
cmc
lds esi, [eax + 0x267bdf69]
push es
xchg edx, eax
invalid
stosb byte es:[edi], al
jle 0x43415c
mov esi, 0x7d4c0cb5
fild dword [0xedf7f752]
inc esp
lcall 0x6382, 0xf9f1b291
int1
stc
and byte [ebx + 0xf], 0x9e
push 0xffffffffffffffb5