joyce8/EMBER2024-capa huggingface dataset:
Function at 0x601f4c
Capabilities:
Delete file
Move file

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov bl, 1
mov eax, dword [esi + 0x38]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x601f85
inc edi
xor ebp, ebp
test bl, bl
je 0x601f79
mov edx, ebp
mov eax, dword [esi + 0x38]
call fcn.00603174
cmp byte [eax + 0x398], 0
jne 0x601f7d
xor eax, eax
jmp 0x601f7f
mov al, 1
mov ebx, eax
inc ebp
dec edi
jne 0x601f62
test bl, bl
je 0x6020d3
lea eax, [esi + 0x3c]
mov edx, dword [eax]
xor ecx, ecx
mov dword [eax], ecx
mov eax, edx
call fcn.004051ec
xor edx, edx
mov eax, dword [esi + 0x78]
call fcn.004b040c
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x64]
mov dword [esi + 0x6c], eax
mov eax, esi
call fcn.00602f94
cmp byte [esi + 0x41], 0
je 0x601fce
xor ebx, ebx
mov eax, esi
call fcn.00602868
jmp 0x6020a9
mov eax, dword [esi + 0x38]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x602054
inc edi
xor ebp, ebp
test bl, bl
je 0x602048
mov edx, ebp
mov eax, dword [esi + 0x38]
call fcn.00603174
mov edx, dword [eax + 0x394]
mov eax, dword [eax + 0x390]
push edx
push eax
mov edx, ebp
mov eax, dword [esi + 0x38]
call fcn.00603174
mov edx, dword [eax + 0x38c]
mov eax, dword [eax + 0x388]
push edx
push eax
mov edx, ebp
mov eax, dword [esi + 0x38]
call fcn.00603174
mov edx, dword [eax + 0x384]
mov eax, dword [eax + 0x380]
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
add eax, 1
adc edx, 0
cmp edx, dword [esp + 4]
jne 0x602044
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x60204c
jmp 0x602048
pop edx
pop eax
jle 0x60204c
xor eax, eax
jmp 0x60204e
mov al, 1
mov ebx, eax
inc ebp
dec edi
jne 0x601fdc
test bl, bl
je 0x6020a2
mov eax, dword [esi + 0x48]
call fcn.00407d34
push eax
mov eax, dword [esi + 0x4c]
call fcn.00407d34
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x602092
push 1
mov eax, dword [esi + 0x48]
call fcn.00407d34
push eax
mov eax, dword [esi + 0x4c]
call fcn.00407d34
push eax
call sub.kernel32.dll_MoveFileExW
mov eax, dword [esi + 0x50]
call fcn.00407d34
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x6020a9
mov eax, esi
call fcn.00602868
mov eax, dword [esi + 0x38]
call fcn.006034c4
mov byte [esi + 0x41], 0
mov byte [esi + 0x42], 0
cmp word [esi + 0x92], 0
je 0x6020d3
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x94]
call dword [esi + 0x90]
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x60399c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov ebx, ecx
mov esi, edx
mov eax, ebx
call fcn.00406d30
push esp
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x6039df
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x6039df
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00407de8
add esp, 0x210
pop esi
pop ebx
ret
Function at 0x615dac
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x615dbf
add esp, 0xfffffff0
call fcn.00405714
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.005f818c
test esi, esi
je 0x615de9
mov edi, esi
mov dword [ebx + 0x380], edi
lea eax, [ebx + 0x17c]
mov edx, dword [edi]
call fcn.00407110
mov dl, 1
mov eax, dword [0x439294]
call fcn.004051bc
mov dword [ebx + 0x388], eax
mov dword [ebx + 0x2d4], ebx
mov dword [ebx + 0x2d0], 0x615f8c
mov dword [ebx + 0x2dc], ebx
mov dword [ebx + 0x2d8], 0x615fa4
mov dword [ebx + 0x314], ebx
mov dword [ebx + 0x310], 0x616064
mov dword [ebx + 0x32c], ebx
mov dword [ebx + 0x328], 0x616028
mov byte [ebx + 0x181], 1
mov edx, 0x615e8c
mov eax, ebx
call fcn.005ffbec
lea eax, [ebx + 0x114]
mov edx, 0x615ea0
call fcn.00407110
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x615e75
call fcn.0040576c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x618bd0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd40
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406e14
xor eax, eax
push ebp
push 0x618c90
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x110
push ebx
push 0x2b4
lea eax, [ebp - 0x2c0]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00407d34
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x618c7a
mov dl, 1
mov eax, dword [0x439294]
call fcn.004051bc
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x45f9e8]
call fcn.0046aa44
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x2c0]
mov eax, dword [ebp - 8]
call fcn.0046ae44
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0054d450
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 8], edx
call fcn.004051ec
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0xc], edx
call fcn.004051ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618c97
lea eax, [ebp - 4]
call fcn.00406d30
ret
Function at 0x619518
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov edi, eax
xor eax, eax
push ebp
push 0x61963f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x61965c
call fcn.00407110
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 8]
call fcn.004547c0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, dword [0x40b5a0]
call fcn.004093bc
xor ebx, ebx
jmp 0x6195f8
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + ebx*4]
call fcn.00407158
mov eax, dword [ebp - 4]
call fcn.00407d34
mov esi, eax
push esi
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
jne 0x6195f7
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [0x65f7c0]
mov eax, dword [eax]
call eax
test eax, eax
je 0x6195f7
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x24]
jne 0x6195df
cmp eax, dword [ebp - 0x28]
jb 0x6195f7
jmp 0x6195e1
jl 0x6195f7
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004245b8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
inc ebx
mov eax, dword [ebp - 0xc]
call fcn.00409094
cmp ebx, eax
jl 0x619576
lea eax, [ebp - 0xc]
mov edx, dword [0x40b5a0]
call fcn.00409380
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x619646
lea eax, [ebp - 0xc]
mov edx, dword [0x40b5a0]
mov ecx, 2
call fcn.00408748
lea eax, [ebp - 4]
call fcn.00406d30
ret
Function at 0x619664
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x619679
add esp, 0xfffffff0
call fcn.00405714
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406e14
xor eax, eax
push ebp
push 0x6197d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 8]
mov edx, dword [ebp - 4]
call fcn.00407110
push 0
mov ecx, 0x619808
mov dl, 1
mov eax, dword [0x6089ac]
call fcn.0060f410
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
mov dl, 1
call fcn.0041d500
test al, al
je 0x61975e
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [esi + 4]
call fcn.0060f5ac
test eax, eax
jne 0x61975e
mov eax, dword [esi + 8]
call fcn.00407d34
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x619738
call sub.kernel32.dll_GetLastError_1
mov edi, eax
mov eax, dword [esi + 8]
call fcn.00407d34
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x619732
test ah, 4
je 0x619732
test al, 0x10
je 0x619732
mov eax, dword [esi + 8]
call fcn.00407d34
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x619738
push edi
call sub.kernel32.dll_SetLastError
lea eax, [esi + 4]
mov edx, dword [eax]
xor ecx, ecx
mov dword [eax], ecx
mov eax, edx
call fcn.004051ec
push 0
mov ecx, 0x619808
mov dl, 1
mov eax, dword [0x6089ac]
call fcn.0060f410
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
call fcn.0060f5ac
mov edx, 0x619820
mov ecx, dword [eax]
call dword [ecx + 0xbc]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
call fcn.0060f5ac
mov edx, 0x619834
mov ecx, dword [eax]
call dword [ecx + 0xbc]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 4]
call fcn.0060f5ac
mov edx, 0x61984c
mov ecx, dword [eax]
call dword [ecx + 0xbc]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
call fcn.0060f5ac
mov edx, 0x619864
mov ecx, dword [eax]
call dword [ecx + 0xbc]
mov dword [esi + 0x18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6197db
lea eax, [ebp - 4]
call fcn.00406d30
ret
Function at 0x61a7b4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x61a8bc
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00619484
mov eax, dword [eax + 0xc]
call fcn.006198b8
mov edx, eax
mov eax, dword [ebx + 0x3ac]
call fcn.004f0be0
call fcn.00619484
mov eax, dword [eax + 0xc]
call fcn.006199f4
mov edx, eax
mov eax, dword [ebx + 0x3b0]
call fcn.004f0be0
call fcn.00619484
mov eax, dword [eax + 0xc]
call fcn.00619910
mov edx, eax
mov eax, dword [ebx + 0x3b4]
call fcn.004f0be0
call fcn.00619484
mov eax, dword [eax + 0xc]
lea edx, [ebp - 8]
call fcn.00619940
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00407e38
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x3a4]
mov ecx, dword [eax]
call dword [ecx + 0x194]
xor edx, edx
mov eax, dword [ebx + 0x3b8]
call fcn.004f0be0
mov dl, 1
mov eax, dword [0x457a54]
call fcn.0045900c
mov esi, eax
mov edx, 0x80000002
mov eax, esi
call fcn.004590b8
mov edx, 0x61a8d8
mov eax, esi
call fcn.00459334
test al, al
je 0x61a897
mov edx, 0x61a940
mov eax, esi
call fcn.00459d78
mov edx, eax
mov eax, dword [ebx + 0x3b8]
call fcn.004f0be0
mov eax, esi
call fcn.004051ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a8c3
lea eax, [ebp - 8]
call fcn.00406d30
lea eax, [ebp - 4]
call fcn.00406d78
ret
Function at 0x61a954
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x61aaab
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00619484
mov esi, dword [eax + 0xc]
mov eax, dword [ebx + 0x3ac]
movzx edx, byte [eax + 0x269]
mov eax, esi
call fcn.00619a4c
mov eax, dword [ebx + 0x3b0]
movzx edx, byte [eax + 0x269]
mov eax, esi
call fcn.00619b2c
mov eax, dword [ebx + 0x3b4]
movzx edx, byte [eax + 0x269]
mov eax, esi
call fcn.00619ab8
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x3a4]
mov edx, dword [edx + 0x240]
call fcn.00407e24
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00619af0
mov dl, 1
mov eax, dword [0x457a54]
call fcn.0045900c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61aa76
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.004590b8
mov cl, 1
mov edx, 0x61aac8
mov eax, dword [ebp - 4]
call fcn.00459200
test al, al
je 0x61aa6c
mov eax, dword [ebx + 0x3b8]
cmp byte [eax + 0x269], 0
je 0x61aa5f
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00404924
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x61ab30
call fcn.0041edd0
mov ecx, dword [ebp - 0xc]
mov edx, 0x61ab54
mov eax, dword [ebp - 4]
call fcn.00459b14
jmp 0x61aa6c
mov edx, 0x61ab54
mov eax, dword [ebp - 4]
call fcn.004596a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61aa80
mov eax, dword [ebp - 4]
call fcn.004051ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61aab2
lea eax, [ebp - 0x18]
call fcn.00406d30
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00406d90
ret
Function at 0x62b7dc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd40
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406e14
xor eax, eax
push ebp
push 0x62b89c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x110
push ebx
push 0x2b4
lea eax, [ebp - 0x2c0]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00407d34
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x62b886
mov dl, 1
mov eax, dword [0x439294]
call fcn.004051bc
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x45f9e8]
call fcn.0046aa44
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x2c0]
mov eax, dword [ebp - 8]
call fcn.0046ae44
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0054d450
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 8], edx
call fcn.004051ec
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0xc], edx
call fcn.004051ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62b8a3
lea eax, [ebp - 4]
call fcn.00406d30
ret
Function at 0x62e490
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406e14
xor eax, eax
push ebp
push 0x62e5c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x65f7c4]
mov eax, dword [eax]
cmp byte [eax + 0x59], 0
jne 0x62e5a6
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041d500
test al, al
je 0x62e5a6
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0041de30
mov eax, dword [ebp - 8]
call fcn.0062b144
test al, al
je 0x62e519
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407d34
push eax
push 0x62e5d8
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x62e5a6
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
mov eax, 0x62e5f0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x62e608
call fcn.0041edd0
mov ecx, dword [ebp - 0xc]
mov edx, 0x62e664
mov eax, ebx
call fcn.0062f74c
xor edx, edx
push ebp
push 0x62e59c
push dword fs:[edx]
mov dword fs:[edx], esp
sub eax, 6
jne 0x62e592
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x444]
call fcn.005ba3c4
cmp dword [ebp - 0x20], 0
je 0x62e592
mov eax, dword [ebx + 0x444]
mov ecx, 0x62e67c
mov edx, 0x62e6a0
call fcn.005d6724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62e5a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62e5d0
lea eax, [ebp - 0x20]
call fcn.0040a8f8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406d90
ret

Function at 0x62faf8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00406e14
xor eax, eax
push ebp
push 0x62fbbb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x62fb62
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
mov eax, 0x65f4b4
call fcn.0056ba5c
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407d34
push eax
push 0x62fbcc
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62fb9d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62fbc2
lea eax, [ebp - 0xc]
call fcn.00406d30
lea eax, [ebp - 4]
call fcn.00406d30
ret
Function at 0x634d94
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x634ec4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebx + 0x278]
call fcn.0041d500
test al, al
je 0x634de9
push 1
mov eax, dword [ebx + 0x27c]
call fcn.00407d34
push eax
push 0
mov eax, dword [ebx + 0x278]
call fcn.00407d34
push eax
push 0x634ed0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x634eae
push 0
lea eax, [ebp - 4]
mov ecx, 0x634ee8
mov edx, dword [ebx + 0x27c]
call fcn.00407f98
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x270]
mov eax, dword [eax + 0x218]
call fcn.0054d3bc
mov ecx, ebx
mov dl, 1
mov eax, dword [0x600a0c]
call fcn.006020d8
mov esi, eax
mov dword [ebx + 0x274], esi
mov dword [esi + 0x84], ebx
mov dword [esi + 0x80], 0x63508c
mov dword [esi + 0x94], ebx
mov dword [esi + 0x90], 0x634f60
lea eax, [esi + 0x44]
mov edx, dword [ebx + 0x280]
call fcn.00407110
mov edx, dword [ebx + 0x27c]
mov eax, dword [ebx + 0x274]
call fcn.00602acc
mov eax, dword [ebx + 0x274]
call fcn.00602b1c
cmp eax, 0xc8
jne 0x634e9b
xor edx, edx
mov eax, dword [ebx + 0x268]
mov ecx, dword [eax]
call dword [ecx + 0x84]
mov dl, 1
mov eax, dword [ebx + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x84]
jmp 0x634eae
lea eax, [ebx + 0x274]
mov edx, dword [eax]
xor ecx, ecx
mov dword [eax], ecx
mov eax, edx
call fcn.004051ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x634ecb
lea eax, [ebp - 4]
call fcn.00406d30
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x9bee9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], edx
call 0x9beea7
imul ebp, ecx, 0x79
sbb bl, ch
sbb eax, 0xff980a8b
or ah, dl
sub ecx, dword [ecx + reloc.RASAPI32.dll_RasHangUpA]
mov dword [esp], ecx
mov byte [esp], dl
jmp 0x9bee89
invalid
mov dword [esp], ecx
mov byte [esp], dl
jmp 0x9bee89
push dword [esp + 2]
jg 0x9bef13
pop word [esp]
jmp 0x9beeeb
lea esp, [esp]
mov word [esp], bp
mov dword [esp + 4], ebx
jmp 0x9beed5
mov ebx, 0x527b1851
pop word [esp]
lea esp, [esp]
mov word [esp], bp
mov dword [esp + 4], ebx
mov dword [esp], esp

Function at 0x9beea7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], edx
call 0x9beea7
imul ebp, ecx, 0x79
sbb bl, ch
sbb eax, 0xff980a8b
or ah, dl
sub ecx, dword [ecx + reloc.RASAPI32.dll_RasHangUpA]
mov dword [esp], ecx
mov byte [esp], dl
jmp 0x9bee89
invalid
mov dword [esp], ecx
mov byte [esp], dl
jmp 0x9bee89
push dword [esp + 2]
jg 0x9bef13
pop word [esp]
jmp 0x9beeeb
lea esp, [esp]
mov word [esp], bp
mov dword [esp + 4], ebx
jmp 0x9beed5
mov ebx, 0x527b1851
pop word [esp]
lea esp, [esp]
mov word [esp], bp
mov dword [esp + 4], ebx
mov dword [esp], esp

Function at 0x9beef8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
mov dword [esp], ebp
call fcn.009bef32
sub al, 0xac
and al, byte [ebp - 0x4c]
inc eax
cmp bh, byte [ecx + 0x51bb4829]
sbb byte [ebx + 0x52], bh