joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a190
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b845
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
push esi
push edi
mov eax, dword [0x1009b128]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.10040720
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1003a223
mov eax, dword [ebx + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x1003a372
cmp dword [0x100cfa58], 0x71c71c7
je 0x1003a388
mov dword [ebp - 0x24], 0x100cfa54
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x20], 0
call fcn.10057514
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0xf
mov dword [ebp - 4], 3
mov ecx, dword [0x100cfa58]
mov edi, dword [0x100cfa6c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100905f0]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x100905f0]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x100cfa50]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x1003a31d
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.10011a00
call fcn.10078fd0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x1003a2fd
cmp edi, 0x200
jae 0x1003a2fb
shl edi, 3
cmp edi, ecx
jae 0x1003a2fd
mov edi, ecx
push edi
call fcn.1003b510
push dword [ebp - 0x14]
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10040720
mov ecx, dword [0x100cfa58]
mov edx, dword [eax]
jmp 0x1003a320
mov edx, dword [ebp - 0x1c]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x100cfa58], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x100cfa68]
and eax, dword [ebp - 0x14]
mov ecx, dword [0x100cfa5c]
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x100cfa54]
mov esi, dword [ebp - 0x20]
jne 0x1003a355
mov dword [ecx + eax*8], esi
jmp 0x1003a365
cmp dword [ecx + eax*8], edx
jne 0x1003a35f
mov dword [ecx + eax*8], esi
jmp 0x1003a369
cmp dword [ecx + eax*8 + 4], edi
jne 0x1003a369
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebx + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push str.unordered_map_set_too_long
call fcn.10054dc0
int3
Function at 0x1003b510
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebx + 8]
cmp ecx, eax
ja 0x1003b6b1
lea eax, [ecx - 1]
mov esi, dword [0x100cfa54]
or eax, edi
mov dword [ebp - 4], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x100cfa5c
lea eax, [edi + edi]
push eax
call fcn.10019470
mov ecx, dword [0x100cfa54]
lea eax, [edi - 1]
mov dword [0x100cfa68], eax
mov dword [0x100cfa6c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1003b67b
nop dword [eax]
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x100cfa5c]
imul edi, edi, 0x1000193
and edi, dword [0x100cfa68]
lea eax, [eax + edi*8]
mov edi, dword [eax]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
cmp edi, esi
jne 0x1003b5e9
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1003b671
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x1003b62c
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x1003b624
mov eax, dword [ecx + 4]
mov esi, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov dword [eax], edx
mov edi, dword [edx + 4]
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 4]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], ecx
jmp 0x1003b671
mov edi, eax
cmp dword [ebp - 8], eax
je 0x1003b645
mov eax, dword [eax + 4]
mov edi, eax
mov esi, dword [ecx + 8]
cmp esi, dword [eax + 8]
je 0x1003b686
cmp dword [ebp - 8], eax
jne 0x1003b633
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
mov dword [eax], edx
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
mov dword [eax], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], esi
mov esi, dword [ebp - 8]
mov dword [edx + 4], esi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
mov esi, dword [ebp - 4]
mov ecx, edx
cmp edx, esi
jne 0x1003b590
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
mov esi, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov dword [eax], edx
mov edi, dword [edx + 4]
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov edi, dword [ebp - 0x10]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
jmp 0x1003b66e
push str.invalid_hash_bucket_count
call fcn.10054dc0
int3
Function at 0x1003bd10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 4], ecx
push eax
lea ecx, [ebp - 4]
mov edi, edx
call fcn.1000b490
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
cmp byte [ebp - 0xc], 0
je 0x1003bd69
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004b5d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007cfb5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1009b128]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 0xc]
mov ebx, edx
cmp dword [edx + 0x14], 0x10
jb 0x1004b60a
mov ebx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1004b628
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1004b616
push edi
push edx
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.1004f960
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1004b659
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0x5d1745d
je 0x1004b775
lea eax, [esi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x20], 0
call fcn.10057514
add esp, 4
mov ebx, eax
mov dword [ebp - 0x20], ebx
push dword [ebp + 0xc]
lea ecx, [ebx + 8]
call fcn.1000c290
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100905f0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100905f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x1004b711
mov ecx, esi
call fcn.1004c9d0
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1004f960
mov edx, dword [eax]
jmp 0x1004b714
mov edx, dword [ebp - 0x1c]
mov eax, dword [esi + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [esi + 8], eax
mov dword [ebx], edx
mov dword [ebx + 4], ecx
mov dword [ecx], ebx
mov dword [edx + 4], ebx
mov eax, dword [esi + 0x18]
and eax, edi
mov dword [ebp + 0xc], ecx
mov ecx, dword [esi + 0xc]
mov edi, dword [ebp - 0x14]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi]
jne 0x1004b742
mov dword [ecx + eax*8], ebx
jmp 0x1004b754
cmp esi, edx
jne 0x1004b74b
mov dword [ecx + eax*8], ebx
jmp 0x1004b758
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1004b758
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10054dc0
int3
Function at 0x1004b780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007cff5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
push esi
push edi
mov eax, dword [0x1009b128]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0x18], edx
cmp dword [edx + 0x14], 0x10
jb 0x1004b7d1
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1004b7f5
mov esi, dword [ebp - 0x18]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1004b7e0
mov esi, dword [ebp - 0x14]
push edi
push edx
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.1004f960
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x1004b817
mov eax, dword [ebx + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x1004b950
cmp dword [esi + 8], 0x5d1745d
je 0x1004b966
lea eax, [esi + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x18], 0
call fcn.10057514
mov esi, eax
add esp, 4
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x18], esi
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 5
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov eax, dword [ecx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100905f0]
mov eax, dword [ecx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100905f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ecx]
jbe 0x1004b900
call fcn.1004c9d0
mov ecx, dword [ebp - 0x14]
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1004f960
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax]
jmp 0x1004b903
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 4]
inc dword [ecx + 8]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0x18]
and eax, edi
mov dword [ebp - 0x18], edx
mov edx, dword [ecx + 0xc]
mov edi, dword [ebp - 0x20]
mov ecx, dword [edx + eax*8]
cmp ecx, dword [edi]
jne 0x1004b930
mov dword [edx + eax*8], esi
jmp 0x1004b943
cmp ecx, dword [ebp - 0x18]
jne 0x1004b93a
mov dword [edx + eax*8], esi
jmp 0x1004b947
mov ecx, dword [ebp - 0x14]
cmp dword [edx + eax*8 + 4], ecx
jne 0x1004b947
mov dword [edx + eax*8 + 4], esi
mov eax, dword [ebx + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push str.unordered_map_set_too_long
call fcn.10054dc0
int3
Function at 0x100548e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov ecx, 0x401000
call fcn.10054ac0
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.1000b490
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1005493e
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x53ec8b55
jne 0x10054950
mov eax, 0x3e9
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.10054b10
cmp eax, 0x16197be9
jne 0x1005496b
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.10054b10
cmp eax, 0x94bf
jne 0x10054986
mov eax, 0x3f3
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.10054b10
cmp eax, 0x94bf
jne 0x100549a1
mov eax, 0x44d
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.10054b10
cmp eax, 0x94bf
jne 0x100549bc
mov eax, 0x457
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.10054b10
cmp eax, 0x3539f633
jne 0x100549d7
mov eax, 0xc80
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.10054b10
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x10054b10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
call fcn.10054ac0
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.1000b490
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x10054b69
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1006b626
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006b49c

Function at 0x1006d7b4
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006d736
Function at 0x402d3b
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
lea eax, [ebp - 4]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or al, 9
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004060ba
xor ebx, ebx
cmp eax, ebx
jne 0x402e1e
test byte [ebp + 0x10], 2
je 0x402d9c
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 8], ebx
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x402e03
lea eax, [ebp - 0x110]
push 0x105
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x402dd8
test edi, edi
jne 0x402e03
push dword [ebp + 0x10]
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 4]
call fcn.00402d3b
test eax, eax
jne 0x402de1
lea eax, [ebp - 0x110]
push 0x105
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x402db1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406640
test eax, eax
jne 0x402e13
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x402e1e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x402e1e
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x403143
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x403160
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x403172
mov dword [ebp - 0xc], 0x79ed20
mov eax, dword [ebp + 8]
test eax, eax
jl 0x403187
mov ecx, dword [0x7c5fb8]
add ecx, eax
push ecx
call fcn.00403348
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.00403332
test eax, eax
je 0x403320
test byte [ebp + 0x17], 0x80
je 0x4032cb
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
and dword [0x414478], 0
and dword [ebp + 0x14], 0x7fffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov byte [0x414460], 0xb
mov dword [ebp + 8], eax
jle 0x403328
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x4031dd
mov esi, dword [ebp + 0x14]
mov edi, 0x79ad20
push esi
push edi
call fcn.00403332
test eax, eax
je 0x403320
sub dword [ebp + 0x14], esi
mov dword [0x414450], edi
mov dword [0x414454], esi
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push 0x414450
mov dword [0x414458], edi
mov dword [0x41445c], eax
call fcn.00406765
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x4032c3
mov esi, dword [0x414458]
sub esi, edi
call ebx
test byte [0x7c6014], 1
mov edi, eax
je 0x40327e
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
ja 0x40324b
cmp dword [ebp + 0x14], 0
jne 0x40327e
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.00405355
mov dword [ebp - 0x10], edi
test esi, esi
je 0x4032b7
cmp dword [ebp + 0x10], 0
jne 0x40329d
push esi
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00405e6e
test eax, eax
je 0x4032c7
add dword [ebp - 4], esi
jmp 0x4032ab
mov eax, dword [0x414458]
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 4
jne 0x403200
jmp 0x403328
cmp dword [ebp + 0x14], 0
jg 0x4031d0
jmp 0x403328
push 0xfffffffffffffffc
jmp 0x403322
push 0xfffffffffffffffe
jmp 0x403322
test edi, edi
jne 0x40330d
cmp dword [ebp + 0x14], edi
jle 0x403328
mov ebx, dword [ebp - 8]
cmp dword [ebp + 0x14], ebx
mov esi, dword [ebp + 0x14]
jl 0x4032e1
mov esi, ebx
mov edi, 0x79ad20
push esi
push edi
call fcn.00403332
test eax, eax
je 0x403320
push esi
push edi
push dword [ebp + 0xc]
call fcn.00405e6e
test eax, eax
je 0x4032c7
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x4032d7
jmp 0x403328
cmp dword [ebp + 0x14], esi
jge 0x403315
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403332
test eax, eax
jne 0x403325
push 0xfffffffffffffffd
pop eax
jmp 0x40332b
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40581b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x408384
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x408374
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40586c
xor eax, eax
jmp 0x405893
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405893
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
jne 0x405868
call esi
pop esi
leave
ret 4

Function at 0x4058cd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x7bcd70], 0x44
push eax
xor eax, eax
push 0x7bcd70
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40590c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405910
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
ret 4

Function at 0x4059ae
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405da2
mov edi, eax
cmp edi, 0xffffffff
je 0x4059ef
test byte [esp + 0x10], 1
push esi
je 0x4059d1
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4059d7
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4059e0
xor eax, eax
inc eax
jmp 0x4059f1
test byte [esp + 0x10], 4
jne 0x4059ef
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x4059f6
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405cb4
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405a35
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7c5fe8], eax
jmp 0x405bbf
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405a4f
test eax, eax
je 0x405b6d
test bl, 2
je 0x405b6d
mov esi, 0x7b8d70
push edi
push esi
call fcn.00406234
cmp dword [ebp + 8], 0
je 0x405a6e
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405a74
push edi
call fcn.00405c0d
cmp byte [edi], 0
jne 0x405a82
cmp byte [0x7b8d70], 0x5c
jne 0x405a8d
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405b63
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405bf1
cmp byte [eax], 0
je 0x405ad3
cmp byte [ebp - 0x1c], 0
je 0x405ad3
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405ae9
mov al, byte [esi + 1]
test al, al
je 0x405b42
cmp al, 0x2e
jne 0x405ae9
cmp byte [esi + 2], 0
je 0x405b42
push esi
push ebx
call fcn.00406234
test byte [ebp - 0x14c], 0x10
je 0x405b0e
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405b42
push dword [ebp + 0xc]
push edi
call fcn.004059f6
jmp 0x405b42
push dword [ebp - 4]
push edi
call fcn.004059ae
test eax, eax
jne 0x405b3a
cmp dword [ebp - 4], eax
je 0x405b32
push edi
push 0xfffffffffffffff1
call fcn.00405355
push 0
push edi
call fcn.0040600d
jmp 0x405b42
inc dword [0x7c5fe8]
jmp 0x405b42
push edi
push 0xfffffffffffffff2
call fcn.00405355
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405ab1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405b6d
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405bbf
cmp dword [ebp - 0xc], esi
jne 0x405b81
inc dword [0x7c5fe8]
jmp 0x405bbf
push edi
call fcn.004065ab
test eax, eax
je 0x405bbf
push edi
call fcn.00405bc6
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004059ae
test eax, eax
jne 0x405bb7
cmp dword [ebp - 4], esi
je 0x405b79
push edi
push 0xfffffffffffffff1
call fcn.00405355
push esi
push edi
call fcn.0040600d
jmp 0x405bbf
push edi
push 0xffffffffffffffe5
call fcn.00405355
pop edi
pop esi
pop ebx
leave
ret 8