joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c6f0
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
xor bl, bl
cmp dword [esi + 0x14], 8
jb 0x49c70d
mov eax, dword [esi]
jmp 0x49c70f
mov eax, esi
test eax, eax
je 0x49c833
cmp word [eax], 0
je 0x49c833
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49c833
test al, 0x10
jne 0x49c833
cmp dword [esi + 0x14], 8
jb 0x49c741
mov esi, dword [esi]
push 0x4be7ac
push esi
call fcn.0044e1fb
mov esi, eax
add esp, 8
test esi, esi
je 0x49c833
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [esp + 0x18], xmm0
call fcn.004505d4
push 2
push 0
push esi
call fcn.0044fd61
lea eax, [esp + 0x24]
push eax
push esi
call fcn.004505d4
lea eax, [esp + 0x34]
push eax
push esi
call fcn.0045065b
add esp, 0x24
cmp dword [esp + 0x10], 0x28
jbe 0x49c82a
xor eax, eax
mov dword [esp + 0x20], 0x48535844
push esi
push 1
mov word [esp + 0x40], ax
xorps xmm0, xmm0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x28]
push 0x28
push eax
mov dword [esp + 0x34], 0x28
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
movsd qword [esp + 0x40], xmm0
call fcn.0044e863
add esp, 0x10
test eax, eax
je 0x49c82a
mov eax, dword [esp + 0x2c]
not eax
ror eax, 3
cmp eax, dword [esp + 0xc]
jne 0x49c82a
cmp dword [esp + 0x20], 0x48535844
jne 0x49c82a
cmp dword [esp + 0x24], 0x28
jne 0x49c82a
movzx ecx, word [esp + 0x38]
add ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
add ecx, dword [esp + 0x40]
add eax, 0x28
add eax, ecx
cmp eax, dword [esp + 0x10]
sete bl
push esi
call fcn.0044dad4
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a13a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb ecx, dword [ebp - 0x48f0f3b2]
ror byte [ebx + 0x318b0441], 1
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x40a0ad
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40a09e
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], pe_nt_image_headers32
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00409e59
ficomp dword [edi]
inc edx
mov edi, 0x50a8458d
call fcn.00409e69
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00409e1e
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
clc
div ecx
test edx, edx
je 0x40a147
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
invalid
Function at 0x4055a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push ecx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
xor esi, esi
mov ecx, dword [ebx + 0x3c]
mov edi, dword [ecx + ebx + 0x78]
mov ecx, dword [edi + ebx + 0x24]
add edi, ebx
add ecx, ebx
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x20]
add eax, ebx
mov dword [ebp - 8], eax
cmp dword [edi + 0x18], esi
jbe 0x405622
nop
mov ecx, dword [eax + esi*4]
add ecx, ebx
call fcn.00405520
mov ecx, dword [ebp - 4]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x405610
test dl, dl
je 0x40560c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x405610
add ecx, 2
add eax, 2
test dl, dl
jne 0x4055f0
xor eax, eax
jmp 0x405615
sbb eax, eax
or eax, 1
test eax, eax
je 0x40562b
mov eax, dword [ebp - 8]
inc esi
cmp esi, dword [edi + 0x18]
jb 0x4055e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
pop edi
movzx eax, word [eax + esi*2]
pop esi
mov eax, dword [ecx + eax*4]
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a7b9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40a7f8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40a7f8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40a7f8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40a7f8
cmp dword [ecx + 0x74], 0xe
jbe 0x40a7f8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4164cc
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4237b8
push 0x4237b0
push str.FlsAlloc
push 0x1f
call fcn.0041638b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416500
push dword [ebp + 8]
mov ecx, esi
call dword [0x42114c]
call esi
jmp 0x416506
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41654a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4237c8
push 0x4237c0
push str.FlsGetValue
push 0x21
call fcn.0041638b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416581
push dword [ebp + 8]
mov ecx, esi
call dword [0x42114c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x416589
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4237d0
push 0x4237c8
push str.FlsSetValue
push 0x22
call fcn.0041638b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4165c3
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42114c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41ac7c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41ad19
push ebx
push esi
call fcn.0041ac45
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00418cbd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41acc6
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ad18
push edi
push eax
call fcn.00417604
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41ace6
call fcn.0041621e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ad17
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00418cbd
add esp, 0x20
test eax, eax
jne 0x41ad05
push edi
call fcn.0041621e
jmp 0x41ad0d
push ebx
call fcn.0041621e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41ad1c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x41ad2d
pop esi
ret
push ebx
push edi
push esi
call fcn.0041ac45
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00417604
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41ad55
push ebx
push esi
push edi
call fcn.00408290
add esp, 0xc
push 0
call fcn.0041621e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x41b125
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041ad6a
Function at 0x40eaa7
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestEnumTypeTraits.exe_gMozillaPoisonSize], eax
call fcn.0040ae7c
pop ecx
mov ecx, dword [sym.TestEnumTypeTraits.exe_gMozillaPoisonSize]
mov dword [sym.TestEnumTypeTraits.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40eadf
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestEnumTypeTraits.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x416465
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41646b
ret

Function at 0x428ff2
Capabilities:
Access peb ldr_data

Disassembly:
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4290de
push dword fs:[eax]
push dword [eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0x8c
call fcn.00402b24
mov eax, dword [esi + 0x54]
inc esi
push esp
mov dword [ebx], eax
mov dword [ebx + 4], 0x44000000
lea edx, [ebx + 8]
mov eax, esi
call fcn.00428f6c
test byte [esi + 0x40], 1
je 0x42902f
or dword [ebx + 4], 0x2000000
or dword [ebx + 8], 0x10000
test byte [esi + 0x20], 0x10
jne 0x429047
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
jne 0x429047
or dword [ebx + 4], 0x8000000
cmp byte [esi + 0x174], 0
je 0x429057
or dword [ebx + 4], 0x10000
mov eax, dword [esi + 0x30]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x18], eax
mov edi, dword [esi + 0x24]
test edi, edi
je 0x429082
mov eax, edi
call fcn.0042bf10
mov dword [ebx + 0x1c], eax
jmp 0x42908b
mov eax, dword [esi + 0x164]
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x24], 0xb
mov eax, fcn.00406bd4
mov dword [ebx + 0x28], eax
push 0x7f00
push 0
call fcn.00406e88
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [ebx + 0x40], eax
mov eax, dword [0x4924dc]
mov dword [ebx + 0x34], eax
lea edx, [ebp - 0x104]
mov eax, dword [esi]
call fcn.00402d58
lea edx, [ebp - 0x104]
lea eax, [ebp - 4]
call fcn.00403ce4
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x4c]
call fcn.004088f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4290e5
lea eax, [ebp - 4]
call fcn.00403ab0
ret
Function at 0x4032cc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, dword [edx + 0x6b]
add eax, dword [ebx - 0x48f0fd40]
adc byte [esi - 0x7b], ah
salc
add eax, 2
movzx edx, word [eax]
test si, dx
je 0x4032e5
xor dx, 0x20
jbe 0x4032d4
cmp dword es:[eax], 0x22
jne 0x4032f7
cmp word [eax + 2], 0x22
jne 0x4032f7
add eax, 4
jmp 0x4032d7
xor edi, edi
mov esi, eax
jmp 0x403329

Function at 0x40331c
Capabilities:
Accept command line arguments

Disassembly:
cmp bp, 0x22
jne 0x403325
add eax, 2
jmp fcn.0040330c
movzx edx, word [eax]
test dx, dx
jl 0x40331a
cmp dx, 0x22
jne fcn.00403388
cmp dword [bx + si], 0
je 0x403329
add eax, 2
jmp 0x403329
inc edi
add eax, 2
movzx ebp, word [eax]
cmp bp, 0x20
ja 0x4032fd
mov eax, ecx
mov edx, edi
call fcn.00406258
mov eax, esi
mov esi, dword [ebx]
xor ecx, ecx
jmp 0x403377
cmp di, 0x22
je 0x40336f
add dword [eax + 2], 0xffffffeb
or byte [esi - 0x37], ah
adc al, 0x4e
add eax, 2
inc ecx
movzx edx, word [eax]
invalid
mov word [esi + ecx*2], di
add eax, 2
inc ecx
movzx edi, word [eax]
cmp di, 0x20
ja 0x403343
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4033e8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00405f9c
test esi, esi
jne 0x403420
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
enter 0xffffffffffffd48b, 0xffffffffffffff8b
ret
call fcn.004060d8
jmp 0x40343e
call sub.kernel32.dll_GetCommandLineW
mov edi, ecx
mov edx, ebx
mov eax, edi
call 0x3c324c
mov edi, eax
test esi, esi
je 0x40343e
cmp dword [ebx], 0
je 0x40343e
dec esi
jmp 0x403427
mov eax, dword [0x20cc0]
add byte [edi + 0x5e], bl
pop ebx
ret

Function at 0x4039cc
Capabilities:
Encode data using xor

Disassembly:
inc eax
add byte [eax], al
or byte [eax], al
sub ah, bh
test byte [ecx + 0x402a], dl
add byte [eax - 0x4a19df0c], al
sub eax, 0x40
mov al, byte [0xe35fa935]
xor byte [eax], al
add byte [eax], al
add al, 0xbf
leave
sbb ecx, dword [esi + 0x4034]
add ch, al
lodsb al, byte cs:[esi]
mov byte [0x4037b1], al
add byte [eax + 0x76], al
cmp ch, byte [ebx + 3]
fidivr word [edx]
inc eax
add byte [eax], al
call 0xc7433e31
mov bh, byte [esi]
inc eax
add byte [eax], cl
bound ebp, qword [ebp + eax*8 + 0x41ad78eb]
inc eax
add byte [eax + 0x66b7177a], al
xlatb
fadd dword [eax + eax*2]
nop
lodsb al, byte [esi]
outsb dx, byte [esi]
xor bh, byte [eax - 0x7a]
xchg dword [eax + 0x40], ecx
inc eax
test eax, 0xa100404b
in eax, dx
enter 0x1bce, 0xffffffffffffffc2
ror dword [esi + 0x40], 1
loopne 0x40395f
adc al, 0x40
popal
push ecx
pop ecx
test byte [edx + 0x40], dl
enter 0x19a5, 0xffffffffffffff90
mov ecx, 0x55a56fa5
inc eax
cmp cl, byte [edi]
and ah, dh
daa
invalid

Function at 0x403b48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x51e120]
mov dword [ebp - 8], eax

Function at 0x4043c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push edx
push esi
push edi
push ebp
add esp, 0xfffffff4
cmp edx, 0xffffff8b
invalid
Function at 0x4050d0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x52a050], 0
je 0x405131
cmp word [0x52a32c], 0xd7b2
jne 0x4050f9
cmp dword [0x52a334], 0
jbe 0x4050f9
mov eax, 0x52a328
call dword [0x52a344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40515c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x51e02c], 0
jne 0x40514d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
invalid
jnp 0x40510c
invalid

Function at 0x40be24
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x48be4d
test al, dl
je 0x40bed0
push 0
push 0
cmp word [eax - 0xa], 0x7402
push cs
push edx
mov edx, eax
mov eax, esp
call 0xf04061b8
pop edx
mov eax, dword [esp]
cmp dword fs:[edx - 0xa], 2
je 0x40be63
push eax
lea eax, [ebp + 8]
call 0xf7c061b6
pop eax
mov edx, dword [eax + 4]
movzx ecx, word [edx]
cmp word [eax], cx
je 0x40be72
movzx ecx, word [eax]
sub eax, ecx
jmp 0x40be99
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ecx, dword [edx - 0x14]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
test eax, eax
je 0x40bee0
test edx, edx
jne 0x40be34
add dword [eax - 4], 0xffffffc3
sub eax, dword [edx - 0xc]
ret

Function at 0x40ce68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, edx
mov eax, esi
call fcn.00406028
push eax
call sub.kernel32.dll_GetFileAttributesW
sub eax, 0xffffffff
je 0x40ce86
test al, 0x10
xchg esp, eax
rcr byte [esi + 0x4b], 0xc3
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x40cec7
xor ebx, 3
je 0x40cea7
cmp ebx, 0x7b
je 0x40cea7
mov eax, esi
call fcn.0040cd28
test al, al
jne 0x40ceab
xor eax, eax
jmp 0x40cead
mov al, 1
ficomp word [ebx - 0x3d]
test al, 0x10
jne 0x40cecd
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ror dword [ebp - 0x74aaffc0], 0xec
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
jno 0x40cf31
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cld

Function at 0x40ceb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00406028
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
invalid

Function at 0x40d8a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
push ebx
mov edi, edx
mov esi, eax
mov ebx, ecx
xor eax, eax
or ecx, ecx
je 0x40d8e6
repne scasb al, byte es:[edi]
test eax, 0x89d889cb
xlatb
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40d8e6
mov al, byte [esi - 1]
cmp al, 0x61
jb 0x40d8d2
cmp eax, 0x2c02777a
and byte [edx - 0x53f00a9], cl
inc ecx
mov dl, byte [edi - 1]
sar dl, 0x41
jb 0x40d8e2
cmp dl, 0x7a
jbe 0x40d8e2
sub dl, 0x20
sub eax, edx
je 0x40d8c1
pop ebx
pop esi
pop edi
inc ebx
mov eax, eax
Function at 0x40e0ac
Capabilities:
Encode data using xor

Disassembly:
or cl, cl
jne 0x40c6ad
or eax, eax
jns 0x40c6a8
neg eax
call 0x8040c6a8
mov ax, 0x2d
mov dword es:[esi - 4], eax
sub esi, 2
inc ecx
ret
mov ecx, 0xa
push edx
push esi
xor eax, 0x66f1f7d2
and edx, 0x70
sub esi, 2
add di, ax
cmp dh, byte [edx + 4]
add dx, 7
mov word [esi], dx
or eax, eax
jne 0x40c6af
pop ecx
pop edx
sub dword [ecx - 0x7596162f], esi
jbe 0x40c6eb
add ecx, edx
sub esi, edx
mov ax, 0x30
sub esi, ebx
jmp 0x40c6e5
mov word [esi + edx*2], ax
dec edx
jne 0x40c6e1
mov word [esi], ax
ret
or cl, cl
and al, 0xdf
mov cl, al
mov eax, 1
add byte [eax], al
mov ebx, dword [ebp - 0xc]
cmp ebx, dword [ebp + 8]
jg case.default.0x40e009
inc dword [ebp + 0x74]
mov esi, dword [ebp + 0xc]
lea esi, [esi + ebx*8]
mov eax, dword [esi]
movzx edx, byte [esi + 4]
jmp dword [edx*4 + 0x40e010]
xor eax, eax
call fcn.0040e270
add al, byte [eax]
add byte [ebx + 0x4d8bec55], cl
fsubr qword [ecx]
rcl ecx, 1
jmp 0xe93d3df8
xchg edi, eax
std
invalid
dec dword [ebp + 0x558b9a75]
invalid
cmp edx, 0x20
jbe 0x40e07e
xor edx, edx
mov ebx, ecx
sub cl, 0x44
je 0x40c748
mov ecx, 0x10
cmp bl, 0x58
je 0x40c748
mov ecx, 0xa
cmp bl, 0x55
je 0x40c748
jmp case.0x40e009.1
lea esi, [ebp - 0x86]
mov edx, dword [ebp - 0x20]
mov ebx, ecx
cmp edx, 0x10
jbe 0x40e0b9
xor edx, edx
sub cl, 0x44
je 0x40c68c
mov ecx, 0x10
cmp bl, 0x58
je 0x40c68c
mov ecx, 0xa
cmp bl, 0x55
je 0x40c68c
jmp case.0x40e009.1
cmp cl, 0x53
jne case.0x40e009.1
mov eax, esi
mov ecx, 1
jmp 0x40e132
xor ecx, ecx
ret
cmp cl, 0x53
jne case.0x40e009.1
movzx ecx, byte [eax]
inc eax
mov esi, fcn.00405cb8
jmp 0x40e14e
add esi, dword [ebp - 4]
mov edx, eax
lea eax, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 4]
call esi
pop ebx
mov esi, dword [ebp - 0x10]
jmp 0x40e181
or esi, esi
je 0x40e122
mov ecx, dword [esi - 4]
shr ecx, 1
cmp ecx, dword [ebp - 0x20]
ja 0x40e190
ret
mov ecx, dword [ebp - 0x20]
ret
mov bh, 0
mov esi, eax
mov bl, 0
cmp cl, 0x47
je 0x40e224
mov bl, 1
cmp cl, 0x45
je 0x40e224
mov bl, 2
cmp cl, 0x46
je 0x40e205
mov bl, 3
cmp cl, 0x4e
je 0x40e205
cmp cl, 0x4d
jne case.0x40e009.1
mov bl, 4
mov eax, 0x12
mov edx, dword [ebp - 0x20]
cmp edx, eax
jbe 0x40e236
mov edx, 2
cmp cl, 0x4d
jne 0x40e236
movzx edx, byte [0x52cb5a]
jmp 0x40e236
mov eax, dword [ebp - 0x20]
mov edx, 3
cmp eax, 0x12
jbe 0x40e236
mov eax, 0xf
push ebx
push eax
push edx
lea eax, [ebp - 0xa6]
mov edx, esi
movzx ecx, bh
mov ebx, dword [ebp - 4]
call fcn.0040e384
mov ecx, eax
lea edx, [ebp - 0xa6]
lea eax, [ebp - 0x10]
mov ebx, dword [ebp - 4]
pop ebp
cld
call fcn.00405cb8
mov esi, dword [ebp - 0x10]
or esi, esi
je 0x40e122
mov ecx, dword [esi - 4]
shr ecx, 1
ret
Function at 0x427918
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff1
push ebx
jbe 0x427978
xor edx, edx
mov dword [ebp - 4], edx
xor esi, esi
cmovne ebp, eax
mov eax, dword [eax + 0x30]
mov edx, esi
call fcn.00422d14
mov ebx, eax
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x14]
call fcn.00405ff0
lea edx, [ebp - 8]
mov eax, dword [ebp - 8]
push ebx
adc al, 0xe8
jno 0x427963
std
dec dword [ebp + 0x458bf855]
clc
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebx + 8]
mov dword [ebp - 4], edx
call fcn.00427144
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4279bb
mov eax, dword [ebp - 8]
cmp word [eax + 0x7a], 0
je 0x4279bb
lea eax, [ebp - 0xc]
push eax
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, dword [edi + 0x7c]
call dword [edi + 0x78]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, esi
call fcn.00422d0c
call fcn.0042789b
cmp dword [0x357500f4], 0xffffff8b
ret

Function at 0x4344a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0x10
mov eax, esi
call fcn.00406028
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
je 0x4344fc
mov dword [ebp - 0xc], esi
salc
inc ebp
clc
adc dword [ebp + 0x6a50f445], ecx
add byte [ebx + 0x5291700d], cl
add byte [edx + 0x3e06a101], dh
inc ebx
add al, ch
sbb ebp, edx
std
invalid
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00433f8c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x460104
Capabilities:
Encode data using xor

Disassembly:
inc ebp
mov ecx, ebp
add ebp, 0xfffffff0
mov eax, dword [0x52716c]
call fcn.004234bc
mov dword [ebp - 8], eax
xor eax, edx
xor edi, esp
dec dword [ecx - 0x3dcc07bb]
push ebp
push 0x460182
push dword fs:[eax]
and al, 0x89
and al, 0x8b
inc ebp
stc
mov eax, dword [eax - 0x78]
dec ecx
xchg ebx, eax
clc
add byte [ecx + ebx*2 - 0x75], bh
inc ebp
cld
mov edx, dword [ebp - 3]
mov dword [ebp - 2], eax
loopne 0x460111
sub edi, esp
sti
mov dword [ebp - 0xc], edx
mov eax, dword [0x3c8ea8b4]
mov ebp, 0x74c48cff
xor edi, dword [ebx]
rcl byte [ebp + 0x68], 0x3a
add eax, 0xfe644146
xor byte [ecx + ecx*4 + 0x20], ah
mov eax, dword [ebp - 0xc]
call 0x246028c
xor eax, eax
pop edx
fnstcw word [ecx + 0x74]
lea edx, [eax]
push 0x440181
mov eax, dword [ebp - 0xc]
call 0x40428034
loope 0x460164
cmc
inc eax
cli
invalid
Function at 0x473a44
Capabilities:
Get file attributes

Disassembly:
mov ebx, eax
cmp dword [0x52f1ac], 0
jne 0x473a8b
mov ecx, 0x473b50
call fcn.00412cdc
mov dword [0x52f1ac], eax
cmp dword [0x52f1ac], 0x64000
jb 0x473a6b
push 0x473b6c
call sub.kernel32.dll_GetModuleHandleW_2
mov edi, eax
test edi, edi
je 0x473a8b
push 0x473b88
push edi
call sub.kernel32.dll_GetFileAttributesW
mov dword [0x52f1b0], eax
push 0
mov ecx, esi
mov dl, 1
mov eax, dword [fcn.00420cb4]
call fcn.0042ec4c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x36
cmp eax, dword [edi]
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x52f1b8], 0
je 0x473aed
invalid
mov eax, dword [ebp - 4]
test eax, eax
je 0x473abf
sub ecx, 0xffffffec
push eax
push 1
mov eax, ebx
call 0xfc472924
push eax
call dword [0x852f1b0]
invalid
stc
invalid
mov eax, dword [ebp - 4]
test eax, eax
je 0x473af7
sub eax, 0xffffffec
push eax
mov eax, ebx
call fcn.00472924
jo 0x473ae9
sti
xlatb
sti
inc dword [ebp - 0x74e88b40]
or eax, 0x528b20
mov dl, 1
mov eax, dword [0x61fb48]
call fcn.004121d4
call fcn.00404b54
xor eax, eax
pop edx
pop ecx
pop ecx
in al, 0x89
adc ch, byte [eax + 0x3d]
cmp ecx, dword [edi]
mov eax, dword [ebp + 0x7c]
call fcn.00403d80
ret