joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x404176
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x404165
jg 0x4040d0
test edx, edx
je 0x404165
nop dword [eax]
call fcn.004064d0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x404124
jg 0x4040e7
test esi, esi
je 0x404124
cmp ebx, eax
jg 0x4040f7
jl 0x4040f1
cmp edi, esi
jae 0x4040f7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0040d590
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x404149
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x40415f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x4040d0
jl 0x40415f
test edi, edi
jne 0x4040d0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x404198
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x40419a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x404218
jg 0x4041ad
test esi, esi
je 0x404218
test eax, eax
jl 0x4041fc
jg 0x4041b7
test ebx, ebx
je 0x4041fc
cmp edi, eax
jg 0x4041c7
jl 0x4041c1
cmp esi, ebx
jae 0x4041c7
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.0040d590
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x404218
jg 0x4041ff
test esi, esi
je 0x404218
jmp 0x4041ff
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x404218
push eax
push esi
push 1
push edx
call fcn.00413c0a
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x43d054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4047a0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bf4e
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4047dc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4047dc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bf4e
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4048c4
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x404804
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x404837
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0041086a
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bf4e
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x404897
sub eax, 1
je 0x404897
sub eax, 2
jne 0x4048c4
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.0041086a
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bf4e
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4048b4
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00413c0a
add esp, 0x10
cmp edi, eax
jne 0x4048c4
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4047c7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bf4e
mov esp, ebp
pop ebp
ret 4
Function at 0x406000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43d054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4060ba
cmp byte [esi + 0x3d], 0
je 0x4060ba
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4060a8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x406070
sub eax, 1
je 0x406074
sub eax, 2
jne 0x4060a8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bf4e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x406091
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00413c0a
add esp, 0x10
cmp edi, eax
jne 0x4060a8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bf4e
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bf4e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040bf4e
mov esp, ebp
pop ebp
ret

Function at 0x4063d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba30
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x43d054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0040c146
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0040a1d3
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [edx + 0x4c], 0
mov eax, dword [0x43f0ac]
mov ecx, dword [0x43f0b0]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4077c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bb50
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x43d054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0040c146
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0040a1d3
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ad6c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x43d054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x40ad91
xor eax, eax
jmp 0x40aded
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x40adbe
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x40adbe
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x40ae74
cmp dword [edi + 0x4c], 0
je 0x40ade7
mov ecx, edi
call fcn.0040aa16
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x40adfd
push dword [edi + 0x4c]
push ebx
call fcn.0040a414
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x40adec
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040bf4e
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x42d1a4]
mov ecx, dword [ebp - 0x2c]
call esi
sub eax, 0
je 0x40ae47
sub eax, 1
je 0x40ae47
dec eax
sub eax, 1
jne 0x40ade7
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x40add9
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x40ae64
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.00413c0a
add esp, 0x10
cmp esi, eax
jne 0x40ade7
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x40ade7
mov ax, bx
jmp 0x40adec

Function at 0x41e3b9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041e06a
Function at 0x41e3c4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041e1f4
Function at 0x406371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e86a
call fcn.0040d30f
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166e8]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4064e2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4064e2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4064e2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4064e2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40645b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4064d4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4064d4
mov ecx, 0x1234
cmp cx, ax
jne 0x4064d4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x4064ae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4063c9
mov eax, edi
call fcn.0040d2ca
ret 4

Function at 0x409413
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x409422
pop dword [ebp - 0x28]
mov eax, 0x6689fe69
sub eax, 0x66496a47
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x37a16
push 0
mov eax, 0x5636e898
add eax, 0xaa0a07f8
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x451e
xor edx, edx
add edx, eax
mov ebx, 0xf885cf44
add ebx, 0x7bbdabc
add ebx, dword [ebp - 0x28]
mov esi, 0x9a151d1
sub esi, 0xb14725e2
sub dword [ebp - 0xc], 0xa2adf5ec
mov edi, dword [ebx]
mov dword [ebp - 0x20], 0x1f9bca52
sub edi, esi
xor dword [ebp - 0xc], 0xe631a9b9
mov dword [edx], edi
add edx, 0x4d6be617
sub edx, 0x4d6be613
add ebx, 0xba6e0308
add ebx, 0x4591fcfc
loop 0x40947d
add eax, 0x83eafe41
sub eax, 0x83e9f6f6
xor ebx, ebx
add ebx, eax
add eax, 0xcf7fb498
add eax, 0x30804b6d
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x431d00
Capabilities:
Encode data using xor

Disassembly:
xor byte [esi], bl
test al, 0xbb
out dx, al
xor esp, dword [esp + ebx*8]
mov bl, 0x2f
push ecx
salc
rcl dword [ebx + 0x7f], cl
fucompi st(4)
enter 0xffffffffffffb3b0, 0x57
inc ebx
inc esp
jne 0x431d86
inc edx
mov dh, 0xa3
hlt
add dword [eax - 0x78bf5db6], edx
push ebp
fcom qword [di - 0x7452]
aaa
test byte [ebx - 0x3f1b7589], dh
xchg esp, eax
jmp 0x431d05
cld
add eax, ebp
dec edx
fld dword [ebx]
inc edx
push ds
xchg ebx, eax
xor al, 0x13
pop ds
adc eax, 0x2998636
out 0x64, al
jb 0x431d27
mov esi, 0xde06d3fb
or al, 0xe0
fimul word [eax]
outsb dx, byte [esi]
mov eax, 0xaf0228f9
xor dl, bh
mov edi, 0x89f44cbe
inc ecx
sbb byte [eax + 0x42], cl
mov dword [edi + 0x76], ebx
add dword [edx + 0x34295b57], ebp
lodsb al, byte [esi]
jg 0x431d9f
call 0xef6f346
dec ecx
je 0x431e0a
insd dword es:[edi], dx
push es
sub ah, byte [eax]
cld
xlatb
lodsd eax, dword [esi]
stosb byte es:[edi], al
push esi
adc eax, 0x6577747d
div ebx
in eax, 0x24
scasd eax, dword es:[edi]
jecxz 0x431e28
test al, 7
stosb byte es:[edi], al
inc esi
adc eax, 0x3e43353d
push 1
stosb byte es:[edi], al
outsd dx, dword [esi]
push edi
fbstp tbyte [edx - 0x11228c28]
ret
pop edi
add bh, byte [edi - 0x6a6d0ba3]
adc byte [ebp + 0x3ac0054c], cl
bound esp, qword [ecx - 0x7e]
scasd eax, dword es:[edi]
fiadd word [eax + 0xe]
mov edx, dword [ebx + ebp - 0x73]
add edi, dword [ebx + 0x734c4fc1]
insd dword es:[edi], dx
push ss
les ecx, cs:[ecx + 0x41]
and byte [eax], 0x9a
add eax, 0xc00a7acf
cmp eax, 0xa84be186
retf

Function at 0x44a5e0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 4]
push eax
push 1
push 0
push str.SOFTWAREBorlandDelphiRTL
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a638
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.FPUMaskValue
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov cl, byte [esp + 0xc]
and cl, 0x3f
test eax, eax
movzx si, cl
je 0x44a665
mov edx, dword [0x4ce8ec]
push 0x4ce5f0
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, esi
pop esi
or eax, 0xffffffc0
add esp, 0x10
ret
Function at 0x4a06e0
Capabilities:
Encode data using xor

Disassembly:
add dh, dl
sub al, 0xb3
and al, 0x3d
mov edi, 0xcb696f41
xor bh, byte [ebx - 0x52]
sub eax, 0x8104f5fd
cwde
dec edx
jo 0x4a067e
sub ch, byte [esi + 0x6c]
scasd eax, dword es:[edi]
and byte [eax + 0x53], bh
pushal
pushfd
scasb al, byte es:[edi]
in eax, dx
invalid
add byte [edx], 0x6b
pop es
mov al, byte [0xd4053a97]
lahf
je 0x4a068c
mov al, byte [0x5bb44965]
dec ecx
mov ah, 0x5b
sub cl, al
fcom qword [ebx + 0x6c]
sbb ebp, dword [eax]
test eax, 0xd26a8941
mov bl, byte [eax - 0x40f75281]
xor dword [0x3faac719], 0xffffffa6
aam 0x97
cmc
mov dl, 0xdb
fst st(0)
jno 0x4a06eb
xchg byte [ecx], al
and edx, esp
invalid

Function at 0x4a580c
Capabilities:
Encode data using xor

Disassembly:
shl bh, 1
aam 0x4e
mov ch, 3
add al, 0xb9
inc eax
inc ebx
out dx, al
mov ebx, 0x31daa63f
dec edi
inc esi
adc eax, 0x54236cf3
sub eax, 0x7f77be3f
mov dl, 0x89
pushal
cli
mov bh, 0xac
mov esi, ebx
stosd dword es:[edi], eax
salc
adc eax, 0x82f8a544
sbb ebx, dword [esi]
iretd
dec ebp
outsd dx, dword [esi]
in al, 0x3e
push es
adc dh, al
pop edi
or byte es:[ebx - 0x32c4f1e0], cl
mov edx, 0xca10db74
pop ss
push edx
push esp
mov ah, 0x96
les eax, [ecx + ebp]
int 0xbc
add al, 0xb8
jo 0x4a577c
pop esi
pop ecx
int3
add bl, byte [0xaeea5eb9]
sbb ch, cl
add dword [edx + 0x48], ebx
cli
jne 0x4a5858
fstp dword [edi]
in al, dx
stosb byte es:[edi], al
fdiv dword [ecx]
lahf
jo 0x4a582b
add ebx, dword [ebp - 0x83f9b93]
mov ah, cl
sal bh, 0x88
int3
outsb dx, byte [esi]
jo 0x4a5831
push ebp
les eax, [ecx - 0x7f19dbe6]
add byte [edx + edi*2], dh
in eax, dx
sbb ah, byte [esi]
add byte [eax], 0x34
jp 0x4a5826
imul esi, dword [ecx - 0xf], 0x41adff8
jg 0x4a57d3
mov byte [0xd09458d9], al
pushal

Function at 0x4ac2de
Capabilities:
Encode data using xor

Disassembly:
out 0xc3, eax
sbb bh, dh
cdq
mov bh, 0x48
cli
adc dword [edx + 0x1ff6f933], ebx
mov ch, 0x40
Function at 0x4046e4
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x404726
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x404746
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.00408194
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x40499c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00407524
test esi, esi
jne 0x4049d2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004076ac
jmp 0x4049f0
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404880
mov edi, eax
test esi, esi
je 0x4049f0
cmp dword [ebx], 0
je 0x4049f0
dec esi
jmp 0x4049d9
add esp, 0x20c
pop edi
pop esi
pop ebx
ret
Function at 0x406244
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.0040663c
mov byte [esp], al
cmp byte [esp], 0
jne 0x4063d0
test edi, edi
je 0x4063d0
mov byte [esp + 1], 0
test ebp, ebp
jle 0x406307
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x4062e2
cmp edi, 0xffffffff
je 0x4062a3
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4062a3
mov byte [esp], 0
jmp 0x4063d0
mov ebx, dword [esi]
cmp ebx, 1
jg 0x4062e2
test ebx, ebx
jne 0x4062d8
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.0040278c
test eax, eax
jne 0x4062d8
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4063d0
call 0x406760
dec ebp
test ebp, ebp
jg 0x406288
cmp edi, 0xffffffff
je 0x406307
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x406305
mov byte [esp], 0
jmp 0x4063d0
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x406252
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.0040278c
cmp ebx, eax
jne 0x406307
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00406440
mov edx, eax
mov ebx, dword [0x4f18f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x40636e
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40636c
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x40636e
xor edi, edi
cmp byte [esp], 0
je 0x406397
mov ebx, dword [esi]
test bl, 1
jne 0x4063b0
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.0040278c
cmp ebx, eax
jne 0x406374
mov byte [esp + 1], 1
jmp 0x4063b0
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.0040278c
cmp ebx, eax
jne 0x406397
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x406321
cmp byte [esp], 0
je 0x4063d0
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4071bc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f1058], 0
je 0x407223
cmp word [0x4f1344], 0xd7b2
jne 0x4071e5
cmp dword [0x4f134c], 0
jbe 0x4071e5
mov eax, 0x4f1340
call dword [0x4f135c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x407250
call fcn.00407ddc
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4eb032], 0
jne 0x40723f
push 0
push 0x4eb9ca
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret