joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008aeb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x1008aed0
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
dec dword [esp + 0xc]
jne 0x1008aee0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x1008aed0
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret
Function at 0x1008af40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
mov eax, 4
push edi
mov dword [esp + 0x18], eax
movzx ebp, byte [edx + eax + 0x306a0]
mov ecx, ebp
mov esi, ebp
and esi, 1
shr ecx, 1
dec ecx
or esi, 2
shl esi, cl
mov edi, eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], 0
sub edi, esi
mov ebx, 1
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x1008afd1
jmp 0x1008af94
mov ebp, dword [esp + 0x1c]
mov ecx, ebx
sub ecx, ebp
mov eax, edi
and eax, 1
add ecx, esi
movzx ecx, word [edx + ecx*2 + 0x32b0e]
mov ebp, eax
neg ebp
sar ebp, 4
shr ecx, 4
and ebp, 0x7f
xor ecx, ebp
mov ecx, dword [edx + ecx*4 + 0x30ea0]
add dword [esp + 0x10], ecx
add ebx, ebx
shr edi, 1
or ebx, eax
dec dword [esp + 0x14]
jne 0x1008af90
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20], ecx
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x80
jb 0x1008af53
lea eax, [edx + 0x32910]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
sub eax, edx
lea ebp, [edx + 0x31d58]
sub eax, 0x31d50
lea edi, [edx + 0x31950]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 4
lea ebx, [ebx]
xor ebx, ebx
cmp dword [edx + 0x32594], ebx
jbe 0x1008b07b
lea ebx, [ebx]
mov eax, ebx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0x1008b06f
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add esi, dword [edx + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x1008b040
mov ebp, dword [esp + 0x18]
mov dword [edi + ebx*4], esi
inc ebx
cmp ebx, dword [edx + 0x32594]
jb 0x1008b030
mov eax, 0xe
cmp dword [edx + 0x32594], eax
jbe 0x1008b09e
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [edx + 0x32594]
jb 0x1008b088
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebp], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp + 4], ecx
mov eax, 4
lea ecx, [ebp + 8]
lea ecx, [ecx]
movzx esi, byte [edx + eax + 0x306a0]
mov esi, dword [edi + esi*4]
mov ebx, dword [esp + 0x14]
add esi, dword [ebx + ecx]
inc eax
mov dword [ecx], esi
add ecx, 4
cmp eax, 0x80
jb 0x1008b0c0
sub dword [esp + 0x10], 0xffffff80
sub dword [esp + 0x14], 0x200
add ebp, 0x200
add edi, 0x100
dec dword [esp + 0x1c]
mov dword [esp + 0x18], ebp
jne 0x1008b020
pop edi
pop esi
pop ebp
mov dword [edx + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret

Function at 0x10090560
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret
Function at 0x10090e50
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x10090e78
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10090e87
mov eax, 1
ret 4

Function at 0x10091360
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test edx, edx
je 0x1009139b
push esi
push edi
mov edi, dword [esp + 0x10]
mov edi, edi
movzx esi, byte [ecx]
xor esi, eax
shrd eax, edi, 8
and esi, 0xff
xor eax, dword [esi*8 + 0x100be060]
shr edi, 8
xor edi, dword [esi*8 + 0x100be064]
inc ecx
dec edx
jne 0x10091370
mov edx, edi
pop edi
pop esi
ret 8
mov edx, dword [esp + 8]
ret 8
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4014f3
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x14c
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [0x426b38]
mov dword [ebp - 0x130], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], edx
or eax, 8
mov dword [esp + 0xc], eax
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x40156c
jmp 0x401607
cmp dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x1c]
je 0x40155d
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, 1
push ecx
jmp 0x401607
xor ecx, ecx
mov edx, edi
call fcn.004014f3
test eax, eax
je 0x40157d
jmp 0x4015a4
mov eax, dword [sym.imp.ADVAPI32.DLL_RegEnumKeyA]
lea edi, [ebp - 0x121]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x12c]
sub esp, 0x10
test eax, eax
je 0x40153d
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push edi
mov dword [esp], 2
call fcn.00407ef3
test eax, eax
push edx
je 0x4015e2
mov edx, dword [0x426b38]
mov dword [esp + 0xc], 0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], edx
call eax
sub esp, 0x10
jmp 0x401607
cmp dword [0x426b38], 0
mov eax, 1
jne 0x401607
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.DLL_RegDeleteKeyA]
test eax, eax
push ecx
setne al
push ecx
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40399a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
cmp dword [ebp + 8], 0
je 0x4039c9
mov eax, dword [0x40ec4c]
test eax, eax
je 0x4039ba
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ebx
mov dword [0x40ec4c], 0
jmp 0x403a80
cmp dword [0x40ec4c], 0
je 0x4039e4
mov dword [esp], 0
call fcn.00408494
push ecx
jmp 0x403a80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x426b8c]
jbe 0x403a80
cmp dword [0x426ba0], 0
je 0x403a37
test byte [0x426b3c], 1
je 0x403a80
call fcn.004038c8
lea ebx, [ebp - 0x48]
mov dword [esp], ebx
mov dword [esp + 4], str....__d__
mov dword [esp + 8], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00406db2
jmp 0x403a7e
mov eax, dword [0x426ba4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4038fa
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x40ec4c], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edx
push edx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x403a85
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [0x40a014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
sub esp, 0x14
test eax, eax
je 0x403ac8
xor edx, edx
cmp dword [ebp - 0xc], ebx
sete dl
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x403b03
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x4c
mov ebx, dword [0x416ce0]
add ebx, eax
sub ebx, dword [0x41ace4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
test ebx, ebx
mov dword [0x426b8c], eax
jle 0x403cc9
mov eax, dword [0x416cd8]
lea edi, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00403ad1
mov eax, dword [0x41ace4]
push ecx
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x40ec44], ebx
mov dword [0x40ec48], 0
sub esp, 0x10
mov ebx, dword [0x416cdc]
mov eax, 0x4000
sub ebx, dword [0x416cd8]
mov dword [esp], 0x416ce4
cmp ebx, 0x4000
cmovg ebx, eax
mov dword [esp + 4], ebx
call fcn.00403a85
test eax, eax
push edx
push edx
je 0x403cd9
add dword [0x416cd8], ebx
mov dword [0x416c68], 0x416ce4
mov dword [0x416c6c], ebx
cmp dword [0x426b48], 0
je 0x403bff
cmp dword [0x426b28], 0
jne 0x403bff
mov eax, dword [0x41ace4]
sub eax, dword [0x416ce0]
mov dword [esp], 0
sub eax, esi
add eax, dword [0x40ec44]
mov dword [0x40ec48], eax
call fcn.0040399a
mov ecx, 0x416c50
mov dword [0x416c70], 0x41ace8
mov dword [0x416c74], 0x8000
call fcn.00408582
test eax, eax
js 0x403ce5
mov edx, dword [0x416c70]
sub edx, 0x41ace8
je 0x403c80
mov eax, dword [0x40a010]
mov dword [esp + 8], edx
mov dword [ebp - 0x2c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x41ace8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
je 0x403cde
cmp edx, dword [ebp - 0x1c]
jne 0x403cde
add dword [0x41ace4], edx
cmp dword [0x416c6c], 0
jne 0x403bc9
jmp 0x403c8d
test ebx, ebx
je 0x403ce5
cmp dword [0x416c6c], 0
jne 0x403ce5
mov eax, dword [0x416ce0]
mov edx, eax
sub edx, dword [0x41ace4]
add edx, esi
test edx, edx
jg 0x403b7f
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp], 1
call fcn.0040399a
xor eax, eax
jmp 0x403cea
or eax, 0xffffffff
jmp 0x403cea
mov eax, 0xfffffffe
jmp 0x403cea
mov eax, 0xfffffffd
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403cf2
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
test eax, eax
js 0x403d32
add eax, dword [0x426b84]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [0x416ce0], eax
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov eax, 4
call fcn.00403b03
test eax, eax
mov ebx, eax
js 0x403e9b
lea eax, [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, 0xfffffffd
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
lea edi, [ebp - 0x24]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 4
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
je 0x403e9b
cmp dword [ebp - 0x24], 4
jne 0x403e9b
mov eax, dword [ebp - 0x20]
add dword [0x416ce0], 4
call fcn.00403b03
test eax, eax
mov ebx, eax
js 0x403e9b
cmp dword [ebp + 0x10], 0
jne 0x403e4d
jmp 0x403e3d
cmp eax, 0x4000
mov esi, 0x4000
cmovle esi, eax
mov eax, dword [0x40a010]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0x416ce4
mov dword [esp], eax
call dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
je 0x403e8f
cmp esi, dword [ebp - 0x24]
jne 0x403e8f
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0x416ce4
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x403e96
cmp dword [ebp - 0x1c], esi
jne 0x403e96
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x20], eax
add dword [0x416ce0], eax
add ebx, eax
jmp 0x403e40
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x20]
test eax, eax
jg 0x403db6
jmp 0x403e9b
mov eax, dword [ebp - 0x20]
mov ebx, 0xfffffffd
cmp dword [ebp + 0x14], eax
cmovle eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [0x40a010]
mov dword [esp + 0xc], edi
mov dword [esp + 4], edx
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
je 0x403e9b
mov ebx, dword [ebp - 0x24]
add dword [0x416ce0], ebx
jmp 0x403e9b
mov ebx, 0xfffffffd
jmp 0x403e9b
mov ebx, 0xfffffffe
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x407478
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [0x42514c], 0x44
mov dword [esp + 0x20], 0x42514c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
sub esp, 0x28
test eax, eax
je 0x4074f4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push eax
mov eax, edx
leave
ret 4

Function at 0x4077a4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
je 0x4077cf
and eax, 0xfffffffe
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push ebx
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4077d6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, 0
cmp eax, 0xffffffff
push ecx
cmove eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc

Function at 0x407832
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x65
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x1c]
jmp 0x407890
mov dword [ebp - 0x1c], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [ebp - 0x2c], eax
div ecx
mov dword [ebp - 0x30], edx
mov cl, byte [ebp - 0x30]
add ecx, 0x61
mov byte [ebp - 0x1a], cl
mov ecx, dword [ebp + 0xc]
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
jne 0x407898
dec esi
jne 0x407848
mov byte [ebx], 0
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4078a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x14]
cmp dword [ebp + 0x18], 1
lea edx, [ebp - 0x14]
sbb eax, eax
xor al, al
add eax, 0x20119
mov byte [ebx], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x407946
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0x400
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x40792f
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
jbe 0x407932
mov byte [ebx], 0
mov eax, dword [ebp - 0x14]
mov byte [ebx + 0x3ff], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push ebx
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x407e3c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], 0x425590
mov dword [esp + 4], eax
call fcn.00407a11
push ebx
push ebx
mov dword [esp], 0x425590
call fcn.0040768c
mov ebx, eax
xor eax, eax
test ebx, ebx
push esi
je 0x407eea
mov dword [esp], ebx
call fcn.00407a4f
test byte [0x426b90], 0x80
push ecx
je 0x407eaa
mov al, byte [ebx]
cmp al, 0x5c
je 0x407ee8
test al, al
jne 0x407eaa
jmp 0x407ee8
call fcn.00407e04
test eax, eax
push edx
je 0x407e9b
test byte [eax], 0x10
je 0x407ee8
mov dword [esp], 0x425590
call fcn.00407620
push ecx
jmp 0x407eb6
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub ebx, 0x425590
mov dword [esp], 0x425590
call esi
cmp eax, ebx
push edx
mov dword [esp], 0x425590
jg 0x407e8c
call fcn.004075aa
push ecx
mov dword [esp], 0x425590
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
setne al
push ebx
movzx eax, al
jmp 0x407eea
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x4084e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x4266d4], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408525
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x408502
mov dword [edx*4 + 0x4266d0], eax
inc edx
cmp edx, 0x100
jne 0x4084fb
mov eax, dword [ebp + 8]
not eax
jmp 0x40853f
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x4266d0]
test ebx, ebx
jne 0x40852c
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x1a1350ef
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x645429dc
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x6ef2618a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x52bc5ef1
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x123d370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x123d38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x1266074
push ecx
mov edi, eax
call fcn.01251198
mov esi, eax
add esp, 8
test esi, esi
jne 0x123d3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0125102e
push esi
call fcn.01250fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret