joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a3384
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00405600
xor eax, eax
push ebp
push 0x6a348a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, 0x6a337c
call fcn.00407698
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x7c], 0xb
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0xb
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0xb
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0xb
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0xb
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0xb
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0xb
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebx + 0x3c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
mov eax, dword [ebx + 0x44]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebx + 0x4c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebx + 0x54]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x80]
mov ecx, 0xe
pop eax
call fcn.0040ca34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a3491
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405164
lea eax, [ebp + 8]
call fcn.00405140
ret
Function at 0x700504
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, esp
test edx, edx
je 0x700512
test ecx, ecx
jg 0x700519
xor eax, eax
jmp 0x70064e
sub eax, 2
je 0x700526
dec eax
je 0x70052e
dec eax
je 0x700536
jmp 0x70053e
mov dword [esi], 0x82ae04
jmp 0x700544
mov dword [esi], 0x82b204
jmp 0x700544
mov dword [esi], 0x82b604
jmp 0x700544
mov dword [esi], 0x82aa04
mov eax, 0x41d0980b
xor eax, reloc.kernel32.dll_DeleteCriticalSection
cmp ecx, 8
jl 0x700629
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
mov edi, dword [esi]
mov ebx, dword [edi + ebx*4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc edx
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
mov edi, dword [esi]
mov ebx, dword [edi + ebx*4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc edx
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
mov edi, dword [esi]
mov ebx, dword [edi + ebx*4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc edx
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
mov edi, dword [esi]
mov ebx, dword [edi + ebx*4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc edx
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
mov edi, dword [esi]
mov ebx, dword [edi + ebx*4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc edx
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
mov edi, dword [esi]
mov ebx, dword [edi + ebx*4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc edx
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
mov edi, dword [esi]
mov ebx, dword [edi + ebx*4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc edx
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
mov edi, dword [esi]
mov ebx, dword [edi + ebx*4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc edx
sub ecx, 8
cmp ecx, 8
jge 0x700555
test ecx, ecx
je 0x70064b
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
mov edi, dword [esi]
mov ebx, dword [edi + ebx*4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc edx
dec ecx
test ecx, ecx
jne 0x70062d
xor eax, reloc.kernel32.dll_DeleteCriticalSection
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x7859f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x7859fc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x785c3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [0x874e48]
call fcn.0049d220
xor eax, eax
push ebp
push 0x785bff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov ecx, 0x785c54
mov edx, dword [0x82c228]
call fcn.0040545c
mov dl, 1
mov eax, dword [0x41ed6c]
call fcn.004041c0
mov esi, eax
mov eax, dword [ebp - 0x10]
call fcn.0040be8c
test al, al
je 0x785bd6
call fcn.00785964
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x785bd0
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
mov eax, dword [0x83a1b4]
mov eax, dword [eax]
call fcn.00476854
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 8]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xc]
call fcn.0040b510
cmp dword [ebp - 0xc], 0
je 0x785bc4
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x3b
je 0x785bc4
push 3
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 0x2c], 0x20
mov byte [ebp - 0x2b], 0x2f
mov byte [ebp - 0x2a], 0x2c
mov byte [ebp - 0x29], 9
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0049136c
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0xc]
call fcn.004051d8
push 3
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 0x2c], 0x20
mov byte [ebp - 0x2b], 0x2f
mov byte [ebp - 0x2a], 0x2c
mov byte [ebp - 0x29], 9
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0049136c
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0xc]
call fcn.004051d8
push 3
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0x2c], 0x20
mov byte [ebp - 0x2b], 0x2f
mov byte [ebp - 0x2a], 0x2c
mov byte [ebp - 0x29], 9
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0049136c
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0xc]
call fcn.004051d8
or edx, reloc.kernel32.dll_DeleteCriticalSection
mov eax, dword [ebp - 0x18]
call fcn.0040ba78
mov edi, eax
cmp dword [ebp - 0x14], 0
je 0x785bc4
test edi, edi
jl 0x785bc4
mov edx, dword [0x491e48]
mov eax, 0x10
call fcn.0040622c
mov ebx, eax
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00405194
cmp byte [0x8342c4], 0
je 0x785b9d
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.0040ba78
mov dword [ebx + 4], eax
jmp 0x785ba2
xor eax, eax
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edi
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x14]
call fcn.0040b2c8
mov edx, dword [ebp - 0x38]
mov ecx, ebx
mov eax, dword [0x874e48]
call fcn.0049d548
inc dword [ebp - 8]
dec dword [ebp - 0x20]
jne 0x785a8b
mov byte [ebp - 1], 1
jmp 0x785be0
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, esi
call fcn.004041f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x785c06
mov eax, dword [0x874e48]
call fcn.0049d22c
ret
Function at 0x9e1526
Capabilities:
Hash data with md5

Disassembly:
jmp 0x9e21c6
jmp 0x9c107f
jmp 0x9c109e
and dword [eax + 4], 0
jmp 0x9fad37
push ax
lea esp, [esp + 2]
jmp 0x9fad63
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
jmp 0x9fad21
mov dword [eax + 0x10], reloc.kernel32.dll_DeleteCriticalSection
pushfd
lea esp, [esp]
lea esp, [esp + 4]
jmp 0x9fade9

Function at 0x9f8363
Capabilities:
Encrypt data using aes

Disassembly:
xor edx, eax
jmp 0x9f834e
push esi
mov esi, ecx
add esi, 0xc
jmp 0x9f835a
mov dword [esi], edx
pop esi
call 0x9f8363
lcall 0xbe47, 0x66f78766
sbb byte [0x7deb4628], bh
div dword [ebp - 0x1b]
invalid

Function at 0x9f8696
Capabilities:
Encrypt data using aes

Disassembly:
cmc
call fcn.009f860b
mov ebp, 0x3acfa83a
mov ebp, 0xea8f1f9b
sbb edi, eax
in eax, dx
cld
iretd
setne cl
mov dword [esp], edx
popal
cmc
and ecx, esi
jmp 0x9f85e9
shr ecx, 8
add di, 0x3be
bsf di, dx
pushal
mov di, 0xc0d3
jmp 0x9f85ff
mov byte [esp], dh
mov edi, edx
jmp 0x9f86bf
mov edx, dword [edx*4 + reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x9f86ce
sub esp, 0xb
push dword [esp + 3]
lea esp, [esp + 3]
and edx, esi
jmp 0x9f869d
shr edi, 0x18
movzx edi, byte [edi*4 + 0x9c9e14]
call fcn.009f876e
std
jns 0x9f86ca
mov byte [ebx - 0x69], bh
fstp qword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
fnstsw word [ebx]
mov ecx, 0xd9c1142f
mov ecx, edx
sub esp, 0xf
lea esp, [esp + 3]
jmp 0x9f8625

Function at 0x9f8c07
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
jmp 0x9f8c09
jmp 0x9f8bf1
mov edi, dword [edi*4 + reloc.kernel32.dll_DeleteCriticalSection]
and ebx, ecx
lea esp, [esp + 8]
jmp 0x9f8c1c
xor edi, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
bsr bx, si
setae bh
stc
jmp 0x9f8c58
push edi
mov edi, esi
jmp 0x9f8c42

Function at 0x9f8c99
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
clc
jmp 0x9f8ca2
mov word [esp], dx
mov dword [esp], esp
jmp 0x9f8c83
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov bh, 0x22
jmp 0x9f8ccc

Function at 0x9f8fe3
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp + 5]
lea esp, [esp + 2]
jmp 0x9f9018
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x9f9002
Function at 0x9f9106
Capabilities:
Encrypt data using aes

Disassembly:
rol di, 0xb
not di
jmp 0x9f8db0
lea ecx, [ecx*4]
lea ecx, reloc.kernel32.dll_DeleteCriticalSection
mov ebx, dword [ecx]
pop ecx
mov edi, dword [esp]
push ecx
jmp 0x9f8d84
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x9f8e8a
push word [esp + 0x1d]
lea esp, [esp + 1]
lea esp, [esp + 0x24]
popal
jmp 0x9f8d9a
cmc
and edi, ecx
call 0x9f8dc1
and edx, ecx
sub esp, 0x18
mov dword [esp + 8], esi
jmp 0x9f8f27
mov edx, dword [edx*4 + reloc.kernel32.dll_DeleteCriticalSection]
call fcn.009f8ef1
shr edi, 0x18
stc
jmp 0x9f8f68
and ebx, ecx
sub esp, 0x18
jmp 0x9f8fc7
mov edi, dword [edi*4 + reloc.kernel32.dll_DeleteCriticalSection]
and edi, ecx
mov edi, dword [edi*4 + reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x9f8f52
movzx ebx, byte [esi + 0xa]
push ax
mov word [esp], bx
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x9f8ffb
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
sub ebx, ebx
setnp bh
jmp 0x9f8fa0
and ebx, ecx
call fcn.009f8fd9
movzx ebx, byte [esi + 0xd]
jmp 0x9f905e
and edx, ecx
call fcn.009f9037
mov edi, edx
jmp 0x9f911f
clc
and edi, ecx
clc
pushfd
lea esp, [esp + 2]
jmp 0x9f909b
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x9f90ec
mov edx, edi
lea edx, [edx*4]
lea edx, reloc.kernel32.dll_DeleteCriticalSection
mov edi, dword [edx]
pop edx
jmp 0x9f908c
xor edi, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
push esi
dec bx
sub esp, 0x10
push word [esp + 6]
lea esp, [esp + 2]
jmp 0x9f90fb
and ebx, ecx
sub esp, 7
lea esp, [esp + 3]
lea esp, [esp + 0x24]
jmp 0x9f90cc
movzx ebx, byte [esi + 0xe]
cmc
call 0x9f9106
cmp byte [ebx - 0x61eb62e4], cl
sahf
pushfd
add byte [ebx + 0x43eb05ec], al
sbb ebx, dword [edi + 0x47996a0f]
jae 0x9f910a
add ax, si
add ch, byte [ebp - 0x3f]
out dx, eax
sbb byte [eax + 0x52], ah
shr edi, 0x18
pushal
push edx
jmp 0x9f90b8

Function at 0xa8106e
Capabilities:
Encode data using xor

Disassembly:
inc esp
add dword [esi - reloc.kernel32.dll_DeleteCriticalSection], eax
fiadd word [esi + ecx - 0x7e]
push edi
fisub dword [edx + reloc.kernel32.dll_DeleteCriticalSection]
insb byte es:[edi], dx
popfd
push cs
mov ebx, 0x7db8372
mov al, byte [0x937e32ce]
pop esp
adc al, 0xa8
fbstp tbyte [edi + 0x2d79a68c]
cmp al, 0x55
add dword [eax - 0x65], edx
xor bl, byte [esi + 0x2ea657e8]
jl 0xa8107a
je 0xa810fa
sbb eax, 0x94457b1b
xchg ebp, eax
mov bh, 0xa4
pushfd
dec esi
xchg ecx, eax
sub byte [ebp - 0x15ce0af], 0x2d
inc esp
fstp xword [esi]
out dx, al
xchg edi, eax
cmp byte [edi], dl
jmp 0xbbd7475a
push esi
out 0x6a, al
or byte [ecx - 0x5d7ec19c], 0x34
inc ebp
xor eax, 0xb3362235
sahf
xor eax, 0x9eb33622
std
or cl, byte [edi + 0x797d4198]
in al, 0x50
and byte [edx - 0x3466626c], 0x1f
pop ss
xchg ebx, eax
sbb eax, 0xd0885f
das
jae 0xa81107
test eax, 0x5cced9ef
scasd eax, dword es:[edi]
outsb dx, byte [esi]
enter 0x6dc, 0x30
push edx
dec ebp
call 0x71af7241
test dh, dh
jge 0xa81176
out 0xa, al
pop edi
and al, 0x3b
hlt
cld
sahf
invalid
Function at 0xadc840
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
pop word [esp]
jmp 0xadc84a
push ax
pop word [esp]
push word [esp]
mov word [esp], bp
mov dword [esp + 0x28], ebp
jmp 0xadc872

Function at 0xadc8f8
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
push eax
jmp 0xad7058
call 0xad705d
jmp 0xad7a74
bswap eax
mov ax, 0xaba1
mov eax, dword [esp]
call fcn.00ad7aa6
dec ebp
popal
jae 0xad7af1
inc edx
insb byte es:[edi], dx
je 0xad7a8a
bsr bx, bx
mov bx, word [esp]
mov ebx, 0x7b34e7cc
mov ebx, dword [esp + 0x24]
lea esp, [esp + 0x28]
popfd
jmp 0xad7ab6
push 0x319842a8
add dword [esp], reloc.kernel32.dll_DeleteCriticalSection
pushal
sete cl
jmp 0xad7ae3
push di
mov edx, eax
xchg al, ch
mov ch, byte [esp]
lea eax, reloc.kernel32.dll_DeleteCriticalSection
pop dx
mov fs, word [esi + 0x5a]
jmp 0xad7b12
cpuid
rdtsc
xchg bh, ah
mov ebx, edi
not bp
mov cl, ch
jmp 0xad7b54
lea ecx, [esp - 0x60]
mov cx, 0x61d6
lea eax, reloc.kernel32.dll_DeleteCriticalSection
jmp 0xad7b66
setle ah
bswap edi
lea ecx, [esp - 0x77]
xchg cx, di
mov ch, 5
mov dh, 0x1b
jmp 0xad7b3e
mov edi, 0x1f46117c
bswap ebx
mov al, 0x9c
mov di, 0x1f1
mov dl, byte [esp]
mov ecx, dword [esp]
jmp 0xad7bba
mov bx, 0x6363
lea esi, [eax*4]
lea ebp, [eax + 0x44]
jmp 0xad7be9
mov dl, 7
mov cx, 0x8650
mov si, word [esp]
mov dh, 0xe3
lea esi, reloc.kernel32.dll_DeleteCriticalSection
mov bp, word [esp]
jmp 0xad7ba4
mov esi, ecx
xchg dh, dl
mov dx, bp
xchg dx, ax
bswap ebp
mov si, word [esp]
jmp 0xad7bfc
setp ch
mov bh, 0x44
xchg esi, edx
xchg bl, bh
mov ebp, 0x79d2dc1c
setnp ch
jmp 0xad7bd3
pushfd
lea esp, [esp + 2]
rdtsc
cpuid
bswap ecx
xchg ebp, ebx
jmp 0xad7c7e
mov di, cx
rdtsc
xchg di, dx
mov eax, dword [esp]
jmp 0xad7c5f
mov edx, 0x35503bd1
xchg bp, cx
not bl
mov dh, byte [esp]
lea ebx, [esi - 0x6e]
lea esi, reloc.kernel32.dll_DeleteCriticalSection
jmp 0xad7c31
mov edi, 0x8f49bd34
mov dh, bh
lea esp, [esp]
push si
mov word [esp], dx
lea esi, [edi*4]
call fcn.00ad7cbf
and al, 0x57
mov esi, 0x124648d
lea esp, [esp + 1]
sete bh
mov edx, dword [esp]
lea esp, [esp]
mov ecx, ebx
xchg bl, dh
jmp 0xad7c47
call fcn.00adb5df
movzx ebx, word [eax + 0x3c]
jmp 0xadc93d
lea esp, [esp + 8]
xor ax, ax
cmp word [eax], 0x5a4d
je 0xadb5f4
jne 0xadc927
rol dword [edi - 0x29], 0xb2
inc ecx
mov edi, 0x96ef879
clc
sbb dl, byte [ecx - 0x2b]
inc ebp
sub al, 0xdf
xor eax, esp
mov eax, dword [esp]
call fcn.00adc8f8
sub eax, 0x10000
jmp 0xadc8ff
add ebx, eax
cmp word [ebx], 0x4550
je 0xad69f6
jne 0xadc927
add byte [eax], 0x96
int1
add al, ah
cmp al, 0xbd
sub eax, 0xc37c734
lahf
push eax
jmp 0xadb5da
Function at 0x41630c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], ecx
mov ebx, edx
mov edi, eax
lea edx, [esp + 4]
mov eax, ebx
mov ecx, 4
call fcn.004027b0
lea edx, [esp + 8]
mov esi, ebx
mov eax, esi
add eax, 4
mov ecx, 4
call fcn.004027b0
lea edx, [esp + 0xc]
mov eax, esi
add eax, 8
mov ecx, 4
call fcn.004027b0
lea edx, [esp + 0x10]
mov eax, esi
add eax, 0xc
mov ecx, 4
call fcn.004027b0
mov eax, dword [edi + 0xcc]
sub dword [esp + 0xc], eax
mov eax, dword [edi + 0xc8]
sub dword [esp + 4], eax
mov esi, 0x14
mov ebx, dword [esp + 4]
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x10]
add eax, eax
inc eax
imul dword [esp + 0x10]
mov edx, 5
call fcn.004160b0
mov ebp, eax
mov eax, dword [esp + 8]
add eax, eax
inc eax
imul dword [esp + 8]
mov edx, 5
call fcn.004160b0
mov ebx, eax
mov eax, esi
add eax, eax
push dword [edi + eax*4 + 0x24]
mov eax, dword [esp + 0x10]
pop edx
sub eax, edx
mov edx, ebx
call fcn.004160c4
xor eax, ebp
mov dword [esp + 0xc], eax
mov eax, esi
add eax, eax
push dword [edi + eax*4 + 0x20]
mov eax, dword [esp + 8]
pop edx
sub eax, edx
mov edx, ebp
call fcn.004160c4
xor ebx, eax
mov dword [esp + 4], ebx
dec esi
test esi, esi
jne 0x41637e
mov eax, dword [edi + 0x24]
sub dword [esp + 0x10], eax
mov eax, dword [edi + 0x20]
sub dword [esp + 8], eax
mov edx, dword [esp]
lea eax, [esp + 4]
mov ecx, 4
call fcn.004027b0
mov ebx, dword [esp]
mov edx, ebx
add edx, 4
lea eax, [esp + 8]
mov ecx, 4
call fcn.004027b0
mov edx, ebx
add edx, 8
lea eax, [esp + 0xc]
mov ecx, 4
call fcn.004027b0
mov edx, ebx
add edx, 0xc
lea eax, [esp + 0x10]
mov ecx, 4
call fcn.004027b0
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401396
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov esi, ecx
cmp dword [0x40b0c4], edx
jne 0x4013d5
push ebx
push edi
push 8
mov ecx, edx
pop edi
mov ebx, ecx
and bl, 1
movzx ebx, bl
neg ebx
sbb ebx, ebx
and ebx, 0xedb88320
shr ecx, 1
xor ecx, ebx
dec edi
jne 0x4013aa
mov dword [edx*4 + 0x40b0c0], ecx
inc edx
cmp edx, 0x100
jl 0x4013a5
pop edi
pop ebx
not esi
jmp 0x4013f3
movzx ecx, byte [eax]
dec dword [esp + 8]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x40b0c0]
inc eax
cmp dword [esp + 8], 0
ja 0x4013d9
mov eax, esi
not eax
pop esi
ret 4
Function at 0x403454
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x58569c]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
mov dword [esp + 0x28], ecx
xor esi, esi
lea ecx, [esp + 0x18]
or eax, 0x2001f
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call fcn.004033fe
mov ebx, eax
cmp ebx, esi
je 0x4034b7
cmp dword [esp + 0x10], esi
je 0x4034b3
push dword [esp + 0x10]
call dword [0x52b018]
mov eax, ebx
jmp 0x40352d
mov ebx, dword [0x52b014]
jmp 0x4034d5
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00403454
mov dword [esp + 0x24], eax
cmp eax, esi
jne 0x403544
lea eax, [esp + 0x28]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x44]
push eax
push esi
push dword [esp + 0x2c]
mov dword [esp + 0x3c], 0x100
call ebx
test eax, eax
je 0x4034bf
mov ebx, dword [0x52b018]
cmp dword [esp + 0x10], esi
je 0x403510
push dword [esp + 0x10]
call ebx
mov dword [esp + 0x10], esi
push dword [esp + 0x20]
mov dword [esp + 0x18], esi
call fcn.00403323
mov edi, eax
cmp dword [esp + 0x10], esi
je 0x40352b
push dword [esp + 0x10]
call ebx
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004fe191
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0x10], esi
je 0x403554
push dword [esp + 0x10]
call dword [0x52b018]
mov eax, dword [esp + 0x24]
jmp 0x40352d
Function at 0x4061a1
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0xf003f
xor edi, edi
push 0x542e0c
mov esi, eax
mov dword [ebp - 4], edi
push 0x80000001
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.0044ef31
cmp dword [ebp - 0xc], edi
je 0x406227
mov ebx, str.se_shortcuts_del
push ebx
lea eax, [ebp - 0xc]
push eax
call fcn.0044f021
test al, al
je 0x406227
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 4], edi
call fcn.0044f041
test eax, eax
jne 0x40621d
mov al, byte [ebp - 4]
test al, 1
je 0x406205
mov byte [esi], 1
test al, 2
je 0x40620d
mov byte [esi + 1], 1
test al, 4
je 0x406215
mov byte [esi + 2], 1
test al, 8
je 0x40621d
mov byte [esi + 3], 1
push ebx
push dword [ebp - 0xc]
call dword [0x52b00c]
lea esi, [ebp - 0xc]
call fcn.0044effe
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406636
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x63150
call fcn.0050c890
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
mov edi, ecx
push eax
mov dword [ebp - 0x6314c], edi
mov byte [ebp - 0x63145], 0
call fcn.00506540
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push 0x103
call dword [0x52b168]
xor eax, eax
push esi
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.00506540
add esp, 0xc
lea eax, [ebp - 0x438]
call fcn.004069bc
cmp dword [eax + 0x14], 8
jb 0x4066c0
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 1
xor edi, edi
lea esi, [ebp - 0x438]
call fcn.004021a4
lea edi, [ebp - 0x63144]
call fcn.0042f249
call fcn.0042f743
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x60cdc], 1
jb 0x406706
mov ebx, dword [ebx]
push ebx
lea eax, [ebp - 0x63144]
call fcn.00406497
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x63144]
mov dword [ebp - 0x60a9c], 0x493e0
call fcn.004064c6
lea esi, [ebp - 0x63144]
call fcn.0042f6bc
mov eax, esi
call fcn.0042f9ff
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x214]
push eax
call esi
test eax, eax
je 0x406789
lea eax, [ebp - 0x214]
push eax
call esi
test eax, eax
je 0x406789
mov eax, dword [ebp - 0x6314c]
cmp dword [eax + 0x14], 8
jb 0x40676e
mov eax, dword [eax]
push 3
push eax
lea eax, [ebp - 0x214]
push eax
call dword [0x52b120]
test eax, eax
je 0x406789
mov byte [ebp - 0x63145], 1
lea ecx, [ebp - 0x63144]
call fcn.0042f4f7
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x63145]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret