joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100018a7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
imul esi, ecx, 0x2c
push edi
mov edi, edx
mov dword [ebp - 0x10], edi
add esi, dword [0x10017560]
mov dword [ebp - 8], esi
mov al, byte [esi + 0x14]
mov ebx, dword [esi]
and al, 1
je 0x100018cd
sub ebx, 5
movzx eax, al
lea ecx, [ebp - 4]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100018f4
push 0xa
pop eax
jmp 0x10001974
test edi, edi
je 0x10001915
mov byte [ebx], 0xe9
mov eax, dword [esi + 4]
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
test byte [esi + 0x14], 1
je 0x10001934
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10001934
test byte [esi + 0x14], 1
je 0x10001929
lea esi, [esi + 0xc]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 8]
jmp 0x10001934
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
mov al, byte [esi + 0x10]
mov byte [ebx + 4], al
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [ebp - 0x10]
mov cl, dl
add cl, cl
shl dl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor dl, cl
and dl, 4
xor dl, cl
xor eax, eax
mov byte [esi + 0x14], dl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10001e65
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x10017558]
push esi
xor esi, esi
jmp 0x10001e77
cmp dword [edx + 4], esi
jne 0x10001ec3
mov edx, dword [edx]
test edx, edx
jne 0x10001e70
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x10001ed0
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x10001e9e
mov eax, dword [0x10017558]
pop edi
mov dword [edx], eax
mov dword [0x10017558], edx
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret
xor eax, eax
pop esi
ret

Function at 0x10005957
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10005996
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10005996
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10005996
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10005996
cmp dword [ecx + 0x74], 0xe
jbe 0x10005996
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000861f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100086bc
push ebx
push esi
call fcn.100085e8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000857c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10008669
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100086bb
push edi
push eax
call fcn.100095da
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10008689
call fcn.100070c4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100086ba
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000857c
add esp, 0x20
test eax, eax
jne 0x100086a8
push edi
call fcn.100070c4
jmp 0x100086b0
push ebx
call fcn.100070c4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10008929
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010528
push 0x10010520
push str.FlsAlloc
push 0x1f
call fcn.10008845
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000895d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f150]
call esi
jmp 0x10008963
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100089a7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010538
push 0x10010530
push str.FlsGetValue
push 0x21
call fcn.10008845
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100089de
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100089e6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010540
push 0x10010538
push str.FlsSetValue
push 0x22
call fcn.10008845
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008a20
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000f150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000e0b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e0dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e0dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408e84
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1cda0d14
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2ea224d8
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401782
Capabilities:
Delete internet cache
Enumerate internet cache
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push ebx
push esi
push edi
xor esi, esi
push 0x7a
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov edi, 0x1000
mov dword [ebp - 8], esi
pop ebx
test ebx, ebx
je 0x401843
cmp ebx, 0x7a
je 0x4017c5
cmp ebx, 0x103
jne 0x401894
push 1
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
jmp 0x401819
push esi
call sub.MFC42u.DLL_operatordelete
push edi
call sub.MFC42u.DLL_operatornew
pop ecx
mov esi, eax
pop ecx
xor ebx, ebx
cmp dword [ebp - 8], ebx
lea eax, [ebp - 4]
mov dword [esi], edi
push eax
mov dword [ebp - 4], edi
push esi
jne 0x4017fb
push ebx
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [ebp - 8], eax
mov eax, ecx
jmp 0x401804
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
cmp eax, ebx
jne 0x401813
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 4]
mov ebx, eax
cmp dword [ebp - 0xc], 0
je 0x4017a1
push esi
call sub.MFC42u.DLL_operatordelete
cmp dword [ebp - 8], 0
pop ecx
je 0x40182f
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
cmp dword [ebp - 0xc], 0
je 0x4017a1
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4
test byte [esi + 0xe], 0x10
jne 0x4018a0
lea eax, [ebp - 0x810]
push 0x400
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.MSVCRT.dll__wcslwr]
push dword [ebp + 8]
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 0xc
test eax, eax
jne 0x4018a0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov dword [ebp - 0xc], 1
jmp 0x401819
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
je 0x401808
xor ebx, ebx
jmp 0x401813
Function at 0x4018c0
Capabilities:
Create process on windows
Get comspec environment variable
Print debug messages
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x143c
call fcn.004072d0
push ebx
push esi
push edi
mov ebx, 0x800
xor edi, edi
push ebx
lea eax, [ebp - 0xc3c]
push edi
push eax
call sub.MSVCRT.dll_memset
mov esi, 0x400
lea eax, [ebp - 0x43c]
push esi
push edi
push eax
call sub.MSVCRT.dll_memset
push ebx
lea eax, [ebp - 0x143c]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x24
lea eax, [ebp - 0xc3c]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0xc3c]
push esi
push eax
lea eax, [ebp - 0xc3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [ebp - 0x43c]
push esi
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0xc3c]
push eax
lea eax, [ebp - 0x143c]
push str._C_CHOICE__C_Y__N__D_Y__T_3__DEL___s____nul
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0xc
lea eax, [ebp - 0x143c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x3c
lea eax, [ebp - 0x3c]
pop esi
push esi
push edi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x43c]
add esp, 0xc
test eax, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], str.OPEN
jne 0x401996
mov dword [ebp - 0x2c], edi
jmp 0x4019ce
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.004072d0
mov ebx, esp
push esi
push ebx
lea eax, [ebp - 0x43c]
push 0xffffffffffffffff
push eax
push edi
push edi
mov word [ebx], di
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x2c], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x143c]
push 0x100
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x38], 0x40
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401a40
push 0x40
push dword [ebp - 4]
call esi
push 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
lea eax, [ebp - 0xc3c]
push edi
push eax
push 5
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 1
pop eax
jmp 0x401a57
push 0x20
call ebx
push eax
call esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
lea esp, [ebp - 0x1448]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ba0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407558
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
mov dword [ebp - 0x10], esp
je 0x401c40
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x401c40
lea ecx, [ebp - 0x1c]
call sub.MFC42u.DLL_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
lea eax, [ebp + 8]
push esi
mov dword [ebp - 4], 0
push eax
mov byte [ebp - 4], 1
call fcn.00402760
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 8]
mov esi, eax
call sub.MFC42u.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
call sub.MFC42u.DLL_AfxTryCleanup
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401d40
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4075b0
push eax
mov dword fs:[0], esp
sub esp, 0x44
push esi
mov esi, dword [esp + 0x58]
test esi, esi
jne 0x401d73
xor eax, eax
pop esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x401d80
mov eax, 0x40af10
push edi
push eax
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 8]
push esi
push eax
mov dword [esp + 0x5c], 0
call fcn.00402d40
push 0
lea ecx, [esp + 0x6c]
push esi
push ecx
mov byte [esp + 0x68], 1
call fcn.00402e10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x7c]
add esp, 0x14
neg eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x10]
sbb eax, eax
push ecx
and eax, 5
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0x64]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x5c], eax
je 0x401e3c
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x48]
lea edx, [esp + 0x5c]
push edx
push eax
call esi
mov eax, dword [esp + 0x5c]
cmp eax, 0x103
jne 0x401e3c
call fcn.00401ce0
push 1
call edi
jmp 0x401e1a
lea ecx, [esp + 0x60]
mov esi, eax
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x54], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x4c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x50
ret
Function at 0x403e10
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [ecx + 8]
test esi, esi
je 0x403e69
cmp esi, 0xffffffff
je 0x403e69
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x403e69
lea eax, [esp + 0xc]
push 0
push eax
push 8
push edi
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0xc], 8
jne 0x403e69
cmp byte [edi], 0x52
jne 0x403e69
cmp byte [edi + 1], 0x53
jne 0x403e69
pop edi
mov eax, 1
pop esi
ret 4
pop edi
xor eax, eax
pop esi
ret 4

Function at 0x403e70
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x403eb4
cmp esi, 0xffffffff
je 0x403eb4
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x403eb4
lea eax, [esp + 0xc]
push 0
push eax
add edi, 8
push 8
push edi
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
ret 4
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x404520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4077b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0xffffffff
mov edi, ecx
jne 0x40454f
xor eax, eax
jmp 0x4046c0
xor ebx, ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], ebx
mov dword [ebp + 8], ebx
call fcn.00402f30
mov eax, dword [edi + 0x14]
lea ecx, [ebp - 0x30]
push eax
mov dword [ebp - 4], ebx
call fcn.004030b0
mov ecx, 0xd
xor eax, eax
lea edi, [ebp - 0x64]
push ebx
rep stosd dword es:[edi], eax
lea ecx, [ebp + 8]
lea edx, [ebp - 0x64]
push ecx
push 0x34
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4046ae
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [ebx]
add ecx, eax
mov dword [ebx], ecx
mov ecx, dword [ebp - 0x60]
push ecx
call sub.MFC42u.DLL_operatornew
add esp, 4
mov edi, eax
mov eax, dword [ebp - 0x60]
lea edx, [ebp + 8]
push 0
push edx
push eax
push edi
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4046a1
mov eax, dword [ebp + 8]
mov ecx, dword [ebx]
add ecx, eax
push 5
mov dword [ebx], ecx
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp + 0x10], eax
call fcn.00403040
mov eax, dword [ebp - 0x64]
lea edx, [ebp + 0x10]
push edx
push edi
push eax
lea ecx, [ebp - 0x30]
call fcn.00402fc0
test eax, eax
jne 0x404698
mov eax, dword [ebp - 0x20]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x40463d
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.004072d0
mov ecx, dword [ebp - 0x10]
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, edi
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
push 0x200
push eax
push esi
call sub.MSVCRT.dll_wcsncpy
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x58]
lea eax, [esi + 0x404]
mov dword [esi + 0x400], edx
mov edx, dword [ebp - 0x54]
add esp, 0xc
mov dword [eax], ecx
mov ecx, dword [ebp - 0x50]
add esi, 0x414
mov dword [ebp - 0x10], 1
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x4c]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x44]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x40]
mov dword [esi], eax
mov eax, dword [ebp - 0x3c]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebx]
add eax, ecx
mov dword [ebx], eax
test edi, edi
je 0x4046ae
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.00402f70
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x70]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4046e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4077d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0xffffffff
mov edi, ecx
jne 0x40470f
xor eax, eax
jmp 0x404880
xor ebx, ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], ebx
mov dword [ebp + 8], ebx
call fcn.00402f30
mov eax, dword [edi + 0x14]
lea ecx, [ebp - 0x30]
push eax
mov dword [ebp - 4], ebx
call fcn.004030b0
mov ecx, 0xd
xor eax, eax
lea edi, [ebp - 0x64]
push ebx
rep stosd dword es:[edi], eax
lea ecx, [ebp + 8]
lea edx, [ebp - 0x64]
push ecx
push 0x34
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40486e
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [ebx]
add ecx, eax
mov dword [ebx], ecx
mov ecx, dword [ebp - 0x60]
push ecx
call sub.MFC42u.DLL_operatornew
add esp, 4
mov edi, eax
mov eax, dword [ebp - 0x60]
lea edx, [ebp + 8]
push 0
push edx
push eax
push edi
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404861
mov eax, dword [ebp + 8]
mov ecx, dword [ebx]
add ecx, eax
push 5
mov dword [ebx], ecx
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp + 0x10], eax
call fcn.00403040
mov eax, dword [ebp - 0x64]
lea edx, [ebp + 0x10]
push edx
push edi
push eax
lea ecx, [ebp - 0x30]
call fcn.00402fc0
test eax, eax
jne 0x404858
mov eax, dword [ebp - 0x20]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x4047fd
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.004072d0
mov ecx, dword [ebp - 0x10]
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, edi
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
push 0x200
push eax
push esi
call sub.MSVCRT.dll_wcsncpy
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x58]
lea eax, [esi + 0x804]
mov dword [esi + 0x800], edx
mov edx, dword [ebp - 0x54]
add esp, 0xc
mov dword [eax], ecx
mov ecx, dword [ebp - 0x50]
add esi, 0x814
mov dword [ebp - 0x10], 1
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x4c]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x44]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x40]
mov dword [esi], eax
mov eax, dword [ebp - 0x3c]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebx]
add eax, ecx
mov dword [ebx], eax
test edi, edi
je 0x40486e
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.00402f70
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x70]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406d70
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2000
call fcn.004072d0
push edi
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x200c]
lea eax, [esp + 0x2010]
push eax
push ecx
lea edx, [esp + 0xc]
push 0x1000
push edx
call sub.MSVCRT.dll__vsnwprintf
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
add esp, 0x2000
ret

Function at 0x406dc0
Capabilities:
Create directory

Disassembly:
sub esp, 0x800
push ebx
mov ebx, dword [esp + 0x808]
push ebp
push esi
test ebx, ebx
push edi
jne 0x406de4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x800
ret 4
push 0x5c
push ebx
xor ebp, ebp
call sub.MSVCRT.dll_wcschr
add esp, 8
test eax, eax
je 0x406e4d
sub eax, ebx
mov ecx, 0x200
mov esi, eax
xor eax, eax
lea edi, [esp + 0x10]
sar esi, 1
rep stosd dword es:[edi], eax
push esi
lea eax, [esp + 0x14]
push ebx
push eax
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406e39
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406e39
test ebp, ebp
jne 0x406dd5
lea edx, [ebx + esi*2 + 2]
push 0x5c
push edx
inc ebp
call sub.MSVCRT.dll_wcschr
add esp, 8
test eax, eax
jne 0x406df5
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x800
ret 4

Function at 0x406e60
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
je 0x406eb5
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
lea edi, [ecx + 1]
mov ecx, dword [esp + 0x10]
test esi, esi
mov edx, eax
je 0x406e96
xor ebx, ebx
and edx, 0xff
mov bl, byte [ecx]
xor edx, ebx
mov edx, dword [esi + edx*4]
jmp 0x406ea9
xor ebx, ebx
and edx, 0xff
mov bl, byte [ecx]
xor edx, ebx
mov edx, dword [edx*4 + 0x40aa0c]
shr eax, 8
inc ecx
xor eax, edx
dec edi
jne 0x406e7f
pop edi
pop esi
pop ebx
not eax
ret 0x10
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x28e9535b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x544b37df
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219