joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432cfa
Capabilities:
Enumerate services

Disassembly:
sub esp, 0x230
push ebx
push ebp
push esi
xor ebx, ebx
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00405a51
mov eax, dword [esp + 0x248]
mov dword [eax + 8], ebx
mov eax, dword [esp + 0x24c]
mov dword [eax + 8], ebx
cmp dword [esp + 0x244], ebx
je 0x432db0
push 4
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [esp + 0x24], esi
test esi, esi
je 0x432db0
mov edi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 3
push 0x30
push esi
call edi
test eax, eax
jne 0x432d7b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xea
jne 0x432da9
mov eax, dword [esp + 0x14]
push 0x449d68
xor edx, edx
push 0x24
pop ebp
div ebp
xor ecx, ecx
inc eax
mul ebp
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004100a8
mov ebp, eax
pop ecx
pop ecx
mov dword [esp + 0x20], ebp
test ebp, ebp
jne 0x432dbf
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x230
ret 0xc
mov eax, dword [esp + 0x14]
push 0x24
pop ecx
xor edx, edx
div ecx
inc eax
imul eax, eax, 0x24
push eax
push ebx
push ebp
call fcn.004127c0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push ebp
push 3
push 0x30
push esi
call edi
test eax, eax
jne 0x432e08
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call fcn.004100a3
pop ecx
jmp 0x432db0
cmp dword [esp + 0x18], ebx
jbe 0x432e7c
mov esi, dword [esp + 0x248]
push 0x24
mov edi, ebp
mov ebp, dword [esp + 0x250]
pop eax
cmp dword [edi], 0
je 0x432e6b
lea eax, [esp + 0x28]
push eax
push dword [edi]
call fcn.00432b75
test al, al
je 0x432e68
mov ecx, dword [esp + 0x244]
call fcn.004078b4
push eax
push dword [esp + 0x248]
lea ecx, [esp + 0x30]
call fcn.0040cc0f
test eax, eax
jne 0x432e68
cmp dword [edi + 0xc], 1
push dword [edi]
mov ecx, ebp
je 0x432e63
mov ecx, esi
call fcn.0040e2f0
push 0x24
pop eax
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x18]
jb 0x432e21
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call fcn.004100a3
xor eax, eax
pop ecx
inc eax
jmp 0x432db2
Function at 0x432e92
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
lea ecx, [ebp - 0x21c]
push ebx
push esi
push edi
call fcn.00405a51
push 0
push 2
xor bl, bl
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x432edf
lea eax, [ebp - 0x44c]
push eax
push esi
mov dword [ebp - 0x44c], 0x22c
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
jne 0x432eea
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor bl, bl
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4
push dword [ebp - 0x444]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
test edi, edi
je 0x432f43
push dword [ebp - 0x210]
push dword [ebp - 0x218]
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x432f38
lea ecx, [ebp - 0x21c]
call fcn.004059e7
push dword [ebp + 8]
lea ecx, [ebp - 0x21c]
call fcn.0040cc3a
test eax, eax
setns bl
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test bl, bl
jne 0x432f55
lea eax, [ebp - 0x44c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x432eea
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x432ee1

Function at 0x43338b
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
push edi
mov edi, ecx
push 0x7f
lea ebp, [edi + 0x20]
push ebp
push dword [edi + 0x324]
call esi
push 0x3f
lea ebx, [edi + 0x220]
push ebx
push dword [edi + 0x56c]
call esi
push 0x3f
lea eax, [edi + 0x2a0]
push eax
push dword [edi + 0x590]
call esi
xor esi, esi
cmp word [ebx], si
je 0x4333f1
lea eax, [edi + 0x2a0]
push eax
push ebx
push 0x441a60
lea eax, [edi + 0x120]
push 0x80
push eax
call fcn.00409cf6
add esp, 0x14
jmp 0x4333fa
xor eax, eax
mov word [edi + 0x120], ax
cmp word [ebp], si
jne 0x433418
push dword [edi + 0x324]
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
xor al, al
jmp 0x43341a
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x433a6d
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x41c
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x206
mov word [esp + 0x224], ax
xor ebx, ebx
lea eax, [esp + 0x226]
push ebx
push eax
mov esi, ecx
call fcn.004127c0
add esp, 0xc
cmp dword [esi + 0x20], ebx
je 0x433c0d
cmp dword [esi + 0x24], 0x400
jb 0x433c0d
lea eax, [esp + 0x220]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x433c0d
lea eax, [esp + 0x220]
push eax
push str._sMetaQuotes
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.00409cf6
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
add esp, 0x10
lea eax, [esp + 0x18]
push eax
call edi
cmp eax, 0xffffffff
jne 0x433b09
push ebx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
lea eax, [esp + 0x18]
push eax
call edi
mov ebp, dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test al, 1
je 0x433b26
push 0x80
lea eax, [esp + 0x1c]
push eax
call ebp
lea eax, [esp + 0x220]
push eax
push str._sMetaQuotesWebInstall
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.00409cf6
add esp, 0x10
lea eax, [esp + 0x18]
push eax
call edi
cmp eax, 0xffffffff
jne 0x433b5d
push ebx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
lea eax, [esp + 0x18]
push eax
call edi
test al, 1
je 0x433b74
push 0x80
lea eax, [esp + 0x1c]
push eax
call ebp
push esi
lea eax, [esp + 0x224]
push eax
push 0x441a7c
lea eax, [esp + 0x24]
push 0x104
or ebp, 0xffffffff
push eax
mov dword [esp + 0x24], 0x43e504
mov dword [esp + 0x28], ebp
call fcn.00409cf6
add esp, 0x10
lea eax, [esp + 0x1c]
push 2
push ecx
push 0x40000000
push eax
lea ecx, [esp + 0x24]
call fcn.00409509
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test al, al
je 0x433bfc
push dword [esi + 0x24]
lea ecx, [esp + 0x14]
push dword [esi + 0x20]
call fcn.004093d4
cmp eax, dword [esi + 0x24]
mov esi, dword [esp + 0x14]
je 0x433bf1
cmp esi, ebp
je 0x433be4
push esi
call edi
mov esi, ebp
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x433c02
cmp esi, ebp
je 0x433c00
push esi
call edi
mov esi, ebp
jmp 0x433c00
mov esi, dword [esp + 0x14]
mov bl, 1
cmp esi, ebp
je 0x433c09
push esi
call edi
mov al, bl
jmp 0x433c0f
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
Function at 0x433c1a
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x440], ax
xor ebx, ebx
lea eax, [ebp - 0x43e]
push ebx
push eax
mov esi, ecx
call fcn.004127c0
add esp, 0xc
xor eax, eax
push 8
pop ecx
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
rep stosd dword es:[edi], eax
cmp dword [esi + 0x20], eax
je 0x433c66
push dword [esi + 0x20]
call fcn.004100a3
pop ecx
mov dword [esi + 0x20], ebx
lea eax, [ebp - 0x440]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x433c83
xor al, al
jmp 0x433d31
push esi
lea eax, [ebp - 0x440]
push eax
push 0x441a7c
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.00409cf6
add esp, 0x14
lea eax, [ebp - 0x30]
push eax
push ebx
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x433c7c
mov eax, dword [esi + 0x24]
sub eax, 0x2b1
cmp dword [ebp - 0x10], eax
je 0x433cd6
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x433c7c
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0x43e504
mov dword [ebp - 4], ebx
call fcn.0040f43a
mov ecx, eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x20], ecx
cmp eax, dword [ebp - 0x10]
jne 0x433d13
test ecx, ecx
je 0x433d13
add dword [esi + 0x24], 0xfffffd4f
mov bl, 1
jmp 0x433d20
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [ebp - 8], 0xffffffff
je 0x433d2f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434c2a
Capabilities:
Terminate thread

Disassembly:
push ecx
cmp dword [esp + 0xc], 0
push ebx
push ebp
push esi
push edi
mov esi, ecx
je 0x434e35
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x434e35
lea ecx, [esi + 0x888]
call fcn.00409673
test al, al
jne 0x434e35
mov ecx, esi
call fcn.00434e3f
cmp dword [esp + 0x1c], 4
sbb eax, eax
neg eax
xor edi, edi
add eax, 4
mov dword [esi + 0x9a8], eax
push edi
cmp dword [esi + 0xc44], edi
jne 0x434ca2
call fcn.00412254
pop ecx
push eax
push dword [esi + 0x9a8]
lea eax, [esi + 0x918]
push str._files_mt_d_cdn.txt__u
push eax
call fcn.0040940c
add esp, 0x10
jmp 0x434cc9
call fcn.00412254
pop ecx
push eax
push dword [esi + 0xc44]
lea eax, [esi + 0x918]
push dword [esi + 0x9a8]
push str._files_mt_d__d_cdn.txt__u
push eax
call fcn.0040940c
add esp, 0x14
mov eax, dword [esp + 0x1c]
push 1
pop ebx
dec eax
je 0x434d35
dec eax
je 0x434d1d
dec eax
je 0x434d05
dec eax
je 0x434cfd
dec eax
je 0x434cf5
dec eax
je 0x434ced
dec eax
jne 0x434d57
push ecx
push str.mt4clwmulti_
jmp 0x434d46
push ecx
push str.mt4clw_mt4clwdata_
jmp 0x434d46
push ecx
push str.mt4man_
jmp 0x434d46
push ecx
push str.mt4adm_
jmp 0x434d46
push ecx
mov edx, 0x80
cmp ebp, ebx
jne 0x434d16
push str.mt5clw_mt5clwdata_mt5clwide_mt5clwtst_
jmp 0x434d4b
push str.mt5clw64_mt5clwdata_mt5clwide64_mt5clwtst64_
jmp 0x434d4b
push ecx
mov edx, 0x80
cmp ebp, ebx
jne 0x434d2e
push str.mt5man_
jmp 0x434d4b
push str.mt5man64_
jmp 0x434d4b
push ecx
cmp ebp, ebx
jne 0x434d41
push str.mt5adm_
jmp 0x434d46
push str.mt5adm64_
mov edx, 0x80
push ecx
lea ecx, [esi + 0xbac]
call fcn.00422f6b
sub esp, 0x10
lea ecx, [esi + 8]
call fcn.0043207f
mov eax, dword [esp + 0x18]
test eax, eax
je 0x434e07
cmp word [eax], di
je 0x434e07
push eax
lea eax, [esi + 0x9ac]
push pe_nt_image_headers32
push eax
call fcn.0041060d
add esp, 0xc
mov ecx, esi
push 0x100000
push esi
push 0x434807
call fcn.0040aae0
push 0x2710
mov ecx, esi
call fcn.0040afe6
test al, al
jne 0x434dc9
cmp dword [esi + 4], edi
je 0x434dc9
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 4], edi
push 0xc58
call fcn.0041019c
pop ecx
test eax, eax
je 0x434df3
push dword [esi + 0xc50]
mov ecx, eax
push dword [esi + 0xc44]
push dword [edi + 0x449c70]
call fcn.00434a15
jmp 0x434df5
xor eax, eax
add edi, 4
mov dword [esi + 0xc50], eax
cmp edi, 0x24
jb 0x434dc9
xor edi, edi
jmp 0x434e19
push 0x100000
push esi
push 0x434807
mov ecx, esi
call fcn.0040aae0
mov ecx, dword [esi + 0xc50]
test ecx, ecx
je 0x434e31
push ebx
push ebp
push dword [esp + 0x24]
push edi
call fcn.00434c2a
mov bl, al
mov al, bl
jmp 0x434e37
xor al, al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x434e3f
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov ecx, esi
call fcn.0043484a
push 0x7d0
mov ecx, esi
call fcn.0040afe6
test al, al
jne 0x434e77
cmp dword [esi + 4], 0
je 0x434e77
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [esi + 4], 0
mov esi, dword [esi + 0xc50]
test esi, esi
jne 0x434e42
pop esi
ret

Function at 0x435220
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x40
lea eax, [ebp - 0x58]
xor ebx, ebx
push eax
mov esi, ecx
mov dword [ebp - 4], ebx
call fcn.004094a8
cmp eax, 0x40
jne 0x43538e
mov eax, 0x5a4d
cmp word [ebp - 0x58], ax
jne 0x43538e
mov eax, dword [ebp - 0x1c]
cdq
push ebx
push edx
push eax
mov ecx, esi
call fcn.00409458
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov edi, edx
cdq
cmp ecx, eax
jne 0x43538e
cmp edi, edx
jne 0x43538e
push 4
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.004094a8
cmp eax, 4
jne 0x43538e
cmp dword [ebp - 4], 0x4550
jne 0x43538e
push 0x14
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.004094a8
cmp eax, 0x14
jne 0x43538e
mov edi, 0x14c
cmp word [ebp - 0x18], di
je 0x4352de
mov eax, 0x8664
cmp word [ebp - 0x18], ax
jne 0x43538e
xor eax, eax
push 0xde
mov word [ebp - 0x138], ax
lea eax, [ebp - 0x136]
push ebx
push eax
call fcn.004127c0
add esp, 0xc
xor eax, eax
push 0xee
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x226]
push ebx
push eax
call fcn.004127c0
add esp, 0xc
mov ecx, esi
push 1
push ebx
push ebx
cmp word [ebp - 0x18], di
jne 0x435359
call fcn.00409458
mov edi, 0xe0
push edi
lea eax, [ebp - 0x138]
push eax
mov ecx, esi
call fcn.004094a8
cmp eax, edi
jne 0x43538e
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xb8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xb4]
mov dword [ecx + 4], eax
jmp 0x43538a
call fcn.00409458
mov edi, 0xf0
push edi
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.004094a8
cmp eax, edi
jne 0x43538e
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x198]
mov dword [edx], ecx
mov ecx, dword [ebp - 0x194]
mov dword [edx + 4], ecx
mov al, 1
jmp 0x435390
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40686f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x4068ad
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406883
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x40687e
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4068da
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068bb
not eax
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0xb8d2685
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x559200fa
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4058a7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x7b9218
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x7b9218], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4058e2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405a29
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405a46
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405a49
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405a78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405abc
test edi, edi
jne 0x405a83
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405ab6

Function at 0x405c95
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x405cba
mov eax, dword [0x40a058]
cmp eax, 0xffffffff
je 0x405cb1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a058], 0xffffffff
jmp 0x405d2f
cmp dword [0x7be3a0], ebx
je 0x405d2f
cmp byte [0x7c2bc0], bl
je 0x405cf9
cmp dword [0x40a058], 0xffffffff
jne 0x405d02
push 4
push 0x40000000
push 0x7c2bc0
call fcn.00405a49
mov dword [0x40a058], eax
cmp eax, 0xffffffff
je 0x405d2f
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a058], 0xffffffff
je 0x405d2f
push esi
push 0x408cc4
mov esi, 0x7be3c0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
lea ecx, [ebp + 8]
push ecx
push eax
push esi
push dword [0x40a058]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4
Function at 0x405f2c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x7b9260
push esi
call fcn.00405bd9
push esi
call fcn.004059b2
mov edi, eax
test edi, edi
jne 0x405f4d
xor eax, eax
jmp 0x405fa5
push edi
call fcn.00405bfb
test byte [0x7c70a8], 0x80
je 0x405f66
mov al, byte [edi]
test al, al
je 0x405f49
cmp al, 0x5c
je 0x405f49
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x405f86
push esi
call fcn.00405e47
test eax, eax
je 0x405f80
test byte [eax], 0x10
je 0x405faa
push esi
call fcn.00405f05
push esi
call ebx
cmp eax, edi
jg 0x405f71
push esi
call fcn.00405ed8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405fa4
Function at 0x40625e
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405e6e
mov esi, dword [esp + 0x18]
test eax, eax
je 0x406282
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x4063bb
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x7bb260], 0x4c554e
mov edi, 0x400
mov ebp, 0x7bb260
test esi, esi
je 0x4062c6
push 1
push 0
push esi
call fcn.00405a49
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4063c1
cmp eax, edi
jg 0x4063c1
push edi
mov esi, 0x7bbba0
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4063c1
cmp eax, edi
jg 0x4063c1
push esi
push ebp
push str._s_s_r_n
push 0x7bb660
call dword [0x40820c]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x7c702c]
push dword [eax + 0x150]
push esi
call fcn.00406004
push 4
push 0xc0000000
push esi
call fcn.00405a49
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, 0xffffffff
je 0x4063bb
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4063b4
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4063b4
cmp edi, dword [esp + 0x18]
jne 0x4063b4
push str._Rename__r_n
push esi
call fcn.00405fae
test eax, eax
jne 0x4063c8
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.00405bd9
add edi, 0xa
mov eax, edi
push ebx
push 0x7bb660
add eax, esi
push eax
call fcn.00405a05
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x7c7110]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x408d70
add eax, 0xa
push eax
call fcn.00405fae
test eax, eax
je 0x40637f
inc eax
lea ecx, [esi + edi]
mov ebp, eax
cmp eax, ecx
jae 0x4063ef
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x4063e4
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x406381
Function at 0x40661b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7bdfa4], 0
jne 0x406659
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40662f
mov dword [ecx*4 + 0x7bdfa0], eax
inc ecx
cmp ecx, 0x100
jl 0x40662a
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406686
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x7bdfa0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406667
not eax
pop ebp
ret 0xc

Function at 0x4b930c
Capabilities:
Encode data using xor

Disassembly:
sub esp, dword [ecx + 0x69]
cli
clc
fnstenv [edi - 0x51b52087]
fidivr word [ebx + 0x10]
push eax
jge 0x4b9385
das
rcl byte [esi], 0xa9
sal dword [eax + 0x4a], cl
jae 0x4b9390
push 0x2c
xchg edi, eax
sub al, 0x97
or esp, dword [ecx - 0x27]
nop
cld
invalid
hlt
je 0x4b9370
dec ebx
dec edi
jecxz 0x4b93f6
push ebp
add ecx, dword [ebp + 0x567686b]
invalid
add eax, 0x6bcf6266
sub dword [eax - 0x5d], edi
salc
std
js 0x4b9325
scasb al, byte es:[edi]
lds ebx, [ecx]
aam 0xd4
pop ebp
shl ecx, 1
invalid
mov al, 0xb4
push 0xffffffffffffffc1
salc
stc
outsd dx, dword [esi]
push ebx
test ebp, ecx
arpl word [eax + 0x21682154], sp
arpl word [edi], cx
sbb al, 9
mov dword [0x755d63bd], eax
and dword [eax], 0x7331eac2
in al, 0xd6
nop
inc dword gs:[ebx + 0x236d1ec7]
popal
xchg esp, eax
or al, 0x59
invalid