joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1231
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049abe6
add esp, 0xc
nop
jg 0x4b1254
jl 0x4b1269
pushf
neg eax
neg eax
popf
xchg esi, edi
xchg esi, edi
jl 0x4b1264
je 0x4b1266
jge 0x4b1269
mov esp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
test esi, ebx
jge 0x4b1316
ror ecx, 0x18
ror ecx, 8
je 0x4b1335
pushf
rol ebx, 0xe
ror ebx, 0xe
js 0x4b1328
inc eax
dec eax
popf
jnp 0x4b132e
jo 0x4b1330
jne 0x4b1332
jne 0x4b1335
mov eax, 0xff78a0e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.004a8bda
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b134a
xor eax, eax
jmp 0x4b13d9
jne 0x4b134c
cmp esi, 0x2f3f
jp 0x4b135d
jmp 0x4b1356
jnp 0x4b1358
nop
jnp 0x4b135d
jmp 0xe8a0a0ae
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0049918d
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0049abe6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4b1387
xor eax, eax
jmp 0x4b13d9
mov esp, esp
jb 0x4b138b
xchg edi, eax
xchg edi, eax
jge 0x4b138f
jle 0x4b13b1
pushf
inc edx
dec edx
jnp 0x4b1397
push ecx
add ecx, 0x3245
ror ecx, 0x19
pop ecx
sub edx, 0
popf
jae 0x4b13a9
lea esp, [esp]
jns 0x4b13ae
jg 0x4b13b1
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004a26e9
add esp, 4
jns 0x4b13bf
or esp, 0
jbe 0x4b13ce
js 0x4b13c6
jns 0x4b13c8
jle 0x4b13ca
ja 0x4b13ce
sub eax, 0xc458b28
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b384b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0049abe6
add esp, 0xc
push 0x21
push 0x48ee20
lea ecx, [ebp - 0x138]
push ecx
call fcn.00495b6c
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4b3953
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0049abe6
add esp, 0xc
push 0xb
push 0x48ee44
lea edx, [ebp - 0x138]
push edx
call fcn.00495b6c
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4b3946
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00495b6c
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4b3955
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4b5655
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049abe6
add esp, 0xc
lea edi, [edi]
test esi, 0x446
shr edx, 0
jb 0x4b567b
jbe 0x4b5696
pushf
std
cld
and edx, edx
call 0x4b5688
lea esp, [esp + 4]
popf
js 0x4b5690
lea esp, [esp]
ja 0x4b5696
add eax, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
mov edi, edi
and edx, edx
shr esp, 0
jb 0x4b56f2
pushf
jp 0x4b56db
cmp ecx, 0x584f
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
ror esp, 0
popf
nop
jae 0x4b56f2
jmp 0x8133a480
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.004a0ab0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b5778
xor eax, eax
jmp 0x4b57ff
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0049918d
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0049abe6
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4b57fd
cmp ebx, dword [esp]
shr esp, 0
rol edi, 8
ror edi, 8
lea ecx, [ecx + 0x75d2]
lea ecx, [ecx - 0x75d2]
je 0x4b57c2
jbe 0x4b57ba
mov esp, esp
nop
jnp 0x4b57bf
jne 0x4b57c2
mov eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004a26e9
add esp, 4
sub esp, 0
jae 0x4b57d3
xor edi, 0
add esp, 0
jg 0x4b57e8
pushf
not esi
not esi
popf
jp 0x4b57e5
jle 0x4b57e8
mov edx, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x4b57ff
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b826b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0049abe6
add esp, 0xc
shr esi, 0
jbe 0x4b829d
nop
lea edx, [edx + 0x5721]
lea edx, [edx - 0x5721]
jnp 0x4b8298
jg 0x4b829a
ja 0x4b829d
sub eax, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
sub edx, 0
ror ebx, 0x1b
ror ebx, 5
je 0x4b82d0
neg esi
neg esi
jl 0x4b82ec
jne 0x4b82d8
lea esi, [esi + 0x7913]
lea esi, [esi - 0x7913]
xchg esi, eax
xchg esi, eax
jne 0x4b82e8
jge 0x4b82ec
mov ebp, 0xf04d8aea
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.004a0ab0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b834c
xor eax, eax
jmp 0x4b83c6
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0049918d
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0049abe6
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x4b83c4
ror esi, 0x15
ror esi, 0xb
jge 0x4b837a
jp 0x4b8396
pushf
or eax, 0
popf
lea ecx, [ecx + 0x224d]
lea ecx, [ecx - 0x224d]
je 0x4b8391
mov ecx, ecx
jnp 0x4b8396
sub eax, 0x51ec4d8b
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004a26e9
add esp, 4
test dword [esp + 4], edx
jle 0x4b83b7
pushf
and edx, 0xffffffff
cmc
jp 0x4b83b0
popf
jg 0x4b83b4
jg 0x4b83b7
mov esi, 0x520c558b
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x4b83c6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b8d49
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x48ec50], 1
jne 0x4b8e7e
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049abe6
add esp, 0xc
cmc
clc
jp 0x4b8d7b
je 0x4b8d75
jl 0x4b8d77
jnp 0x4b8d7b
mov ebx, 0xe845c670
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
call 0x4b8dac
lea esp, [esp + 4]
jne 0x4b8db2
jp 0x4b8db4
jle 0x4b8dbb
jo 0x4b8db8
jg 0x4b8dbb
call 0x8133db49
jmp 0xe89915c5
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov eax, dword [0x48ec50]
mov dword [ebp - 8], eax
Function at 0x4b92d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049abe6
add esp, 0xc
or ecx, ecx
sub esp, 0
jb 0x4b92f7
js 0x4b92f2
nop
jae 0x4b92f7
xor eax, 0xec45c65a
dec edx
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
xchg ecx, edx
xchg ecx, edx
jno 0x4b933d
xor ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0xc]
jg 0x4b9359
pushf
je 0x4b934b
and edi, 0xffffffff
std
cld
popf
jnp 0x4b9354
jge 0x4b9356
jle 0x4b9359
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.004a0ab0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b93ed
xor eax, eax
jmp 0x4b9454
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0049918d
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049abe6
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x4b9452
not ebx
not ebx
jle 0x4b9419
jnp 0x4b9432
pushf
jbe 0x4b941f
popf
lea ebx, [ebx + 0x145f]
lea ebx, [ebx - 0x145f]
xchg ebx, ebx
jp 0x4b9432
mov eax, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004a26e9
add esp, 4
inc edx
dec edx
jle 0x4b9449
nop
xchg ecx, ecx
jg 0x4b9449
xor eax, 0x8558ba4
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x4b9454
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4b9470
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 8
lea eax, [esp]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401026
xor al, al
add esp, 8
ret
push esi
push 0x400
mov dword [esp + 0xc], 0x400
call fcn.00405dba
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add esp, 4
lea ecx, [esp + 8]
push ecx
push eax
push 0
push 0
mov dword [esi], eax
mov eax, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov dword [esp + 8], eax
je 0x401087
mov ecx, dword [esi]
push ecx
call fcn.00405d10
mov edx, dword [esp + 8]
add esp, 4
push edx
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
add esp, 8
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
add esp, 8
ret

Function at 0x401140
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x40114d
xor al, al
pop esi
ret
push ebx
push ebp
push edi
push 0x5c
push esi
call fcn.00405f30
add esp, 8
test eax, eax
jne 0x40117f
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call edi
cmp eax, 0xffffffff
je 0x401178
push esi
call edi
test al, 0x10
jne 0x40121f
pop edi
pop ebp
pop ebx
xor al, al
pop esi
ret
cmp byte [esi], 0x5c
jne 0x40118f
cmp byte [esi + 1], 0x5c
jne 0x40118f
lea eax, [esi + 2]
jmp 0x401190
inc eax
push 0x5c
push eax
call fcn.00405f30
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, eax
add esp, 8
test edi, edi
je 0x4011e2
lea ecx, [ecx]
push esi
mov byte [edi], 0
call ebp
cmp eax, 0xffffffff
je 0x4011c2
push esi
call ebp
test al, 0x10
jne 0x4011cb
push 0
push esi
call ebx
test eax, eax
je 0x401178
lea ecx, [edi + 1]
push 0x5c
push ecx
call fcn.00405f30
add esp, 8
test eax, eax
mov byte [edi], 0x5c
mov edi, eax
jne 0x4011b0
mov al, byte [esp + 0x18]
test al, al
je 0x40121f
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4011f0
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
je 0x40121f
push esi
call ebp
cmp eax, 0xffffffff
je 0x40120f
push esi
call ebp
test al, 0x10
jne 0x40121f
push 0
push esi
call ebx
test eax, eax
jne 0x40121f
pop edi
pop ebp
pop ebx
xor al, al
pop esi
ret
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
ret
Function at 0x401230
Capabilities:
Timestomp file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x28
push esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x1c]
push ecx
mov esi, eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0xc]
push ecx
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x28
ret

Function at 0x4015c0
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0
push ecx
push 0x401590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
pop ecx
ret
Function at 0x402810
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x40281b
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
cmp esi, 8
not eax
jb 0x402910
push ebx
push edi
mov edi, esi
shr edi, 3
xor edx, edx
mov dl, byte [ecx]
mov ebx, eax
shr ebx, 8
sub esi, 8
xor edx, eax
and edx, 0xff
mov eax, dword [edx*4 + 0x40eb08]
xor eax, ebx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x40eb08]
shr eax, 8
xor edx, eax
xor eax, eax
mov al, byte [ecx + 1]
inc ecx
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x40eb08]
shr edx, 8
xor eax, edx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x40eb08]
shr eax, 8
xor edx, eax
xor eax, eax
mov al, byte [ecx + 1]
inc ecx
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x40eb08]
shr edx, 8
xor eax, edx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x40eb08]
shr eax, 8
xor edx, eax
xor eax, eax
mov al, byte [ecx + 1]
inc ecx
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x40eb08]
shr edx, 8
xor eax, edx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x40eb08]
shr eax, 8
xor eax, edx
inc ecx
dec edi
jne 0x402836
pop edi
pop ebx
test esi, esi
je 0x402930
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x40eb08]
shr eax, 8
xor eax, edx
inc ecx
dec esi
jne 0x402914
not eax
pop esi
ret
Function at 0x406636
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x40f428
call fcn.00409aec
mov edi, 0x94
mov eax, edi
call fcn.00409b40
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x413c34], ecx
mov eax, dword [esi + 4]
mov dword [0x413c40], eax
mov edx, dword [esi + 8]
mov dword [0x413c44], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x413c38], esi
cmp ecx, 2
je 0x406696
or esi, 0x8000
mov dword [0x413c38], esi
shl eax, 8
add eax, edx
mov dword [0x413c3c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4066d1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4066d1
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4066e9
cmp eax, 0x20b
je 0x4066d6
mov dword [ebp - 0x1c], esi
jmp 0x4066fd
cmp dword [ecx + 0x84], 0xe
jbe 0x4066d1
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4066f7
cmp dword [ecx + 0x74], 0xe
jbe 0x4066d1
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00406829
pop ecx
test eax, eax
jne 0x406729
cmp dword [0x413c1c], 1
jne 0x406716
call fcn.00409457
push 0x1c
call fcn.004092e0
push 0xff
call fcn.00408545
pop ecx
pop ecx
call fcn.00409a61
mov dword [ebp - 4], esi
call fcn.00409040
test eax, eax
jge 0x406742
push 0x1b
call fcn.00406611
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4151f4], eax
call fcn.0040993f
mov dword [0x413c14], eax
call fcn.0040989d
test eax, eax
jge 0x406768
push 8
call fcn.00406611
pop ecx
call fcn.0040966a
test eax, eax
jge 0x406779
push 9
call fcn.00406611
pop ecx
call fcn.00408575
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x40678c
push eax
call fcn.00406611
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00409601
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x4067ad
movzx eax, word [ebp - 0x34]
jmp 0x4067b0
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00401f80
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4067ce
push edi
call fcn.0040869c
call fcn.004086be
jmp 0x406800
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00409b27
ret
Function at 0x407edd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x412768]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x4150a4]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
jae 0x40806d
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x4150c0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x18], ebx
je 0x40806d
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
jne 0x407f3c
xor eax, eax
jmp 0x408081
test al, 0x20
je 0x407f4d
push 2
push edi
push edi
push ecx
call fcn.0040a3d6
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x408009
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp + 8], edi
jbe 0x408041
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
cmp ecx, dword [ebp + 0x10]
jae 0x407fa3
mov edx, dword [ebp - 8]
inc dword [ebp - 8]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x407f94
inc dword [ebp - 0x14]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x18]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x407f79
mov edi, eax
lea eax, [ebp - 0x41c]
sub edi, eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407fe3
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
cmp eax, edi
jl 0x407fec
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x407f6d
jmp 0x407fee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
cmp eax, edi
jne 0x408068
cmp dword [ebp + 8], edi
je 0x408041
push 5
pop eax
cmp dword [ebp + 8], eax
jne 0x408036
mov dword [0x413c2c], eax
jmp 0x408074
push edi
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40802b
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], edi
mov dword [ebp - 0xc], eax
jmp 0x407fee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x407fee
push dword [ebp + 8]
call fcn.00408bac
pop ecx
jmp 0x40807e
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x408056
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
je 0x407f35
mov dword [0x413c28], 0x1c
mov dword [0x413c2c], edi
jmp 0x40807e
sub eax, dword [ebp - 0x14]
jmp 0x408081
and dword [0x413c2c], 0
mov dword [0x413c28], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.0040a112
leave
ret