joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40167f
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
pushal
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
mov eax, 0x74ebec70
call eax
cmp eax, 0xffffffff
je 0x401803
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push dword [ebp - 4]
mov eax, 0x74e9db60
call eax
or eax, eax
je 0x4017fa
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 6
push dword [ebp - 8]
mov eax, 0x74e65be0
call eax
or eax, eax
je 0x4017f1
mov dword [ebp - 0xc], eax
mov esi, eax
cmp word [esi], 0x5a4d
je 0x4016f8
jmp 0x4017e7
cmp word [esi + 0x18], 0x40
je 0x401704
jmp 0x4017e7
add esi, dword [esi + 0x3c]
cmp dword [esi], 0x4550
je 0x401714
jmp 0x4017e7
cmp word [esi + 0x5c], 2
je 0x401720
jmp 0x4017e7
cmp word [esi + 0x1a], 0x815
jne 0x40172d
jmp 0x4017e7
mov eax, dword [esi + 0x28]
add eax, dword [esi + 0x34]
mov dword [ebx + 0x40564f], eax
movzx eax, word [esi + 6]
mov ecx, 0x28
mul ecx
lea edi, [esi]
sub edi, dword [ebp - 0xc]
add eax, edi
add eax, 0x18
movzx edi, word [esi + 0x14]
add eax, edi
mov edi, eax
add edi, dword [ebp - 0xc]
add eax, 0x28
cmp eax, dword [esi + 0x54]
jbe 0x401766
jmp 0x4017e7
inc word [esi + 6]
mov dword [edi], 0x736a78
push dword [esi + 0x50]
pop dword [edi + 0xc]
mov eax, 0x1a54
mov dword [edi + 8], eax
mov ecx, dword [esi + 0x3c]
div ecx
inc eax
mul ecx
mov dword [edi + 0x10], eax
lea eax, [edi - 0x14]
mov eax, dword [eax]
lea ecx, [edi - 0x18]
mov ecx, dword [ecx]
add eax, ecx
mov dword [edi + 0x14], eax
mov dword [edi + 0x24], 0xe0000020
mov eax, dword [edi + 8]
mov ecx, dword [esi + 0x38]
div ecx
inc eax
mul ecx
add eax, dword [esi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x28], eax
mov word [esi + 0x1a], 0x815
push 0
push 0
push dword [edi + 0x14]
push dword [ebp - 4]
mov eax, 0x74ebf090
call eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0x10]
lea eax, [ebx + 0x404000]
push eax
push dword [ebp - 4]
mov eax, 0x74ebf0f0
call eax
push dword [ebp - 0xc]
mov eax, 0x74e668f0
call eax
push dword [ebp - 8]
call dword [ebx + 0x405592]
push dword [ebp - 4]
call dword [ebx + 0x405592]
popal
leave
ret 4
Function at 0x402560
Capabilities:
Get number of processors

Disassembly:
call 0x402574
inc edi
je 0x4025b9
jb 0x4025da
arpl word [ecx + 0x64], ax
jb 0x4025d6
jae 0x4025e6
add byte [edx], ch
push 1
mov eax, 0x74e9e030
call eax
xchg esi, eax
or esi, esi
jne 0x402588
jmp 0x40259a
push esi
mov eax, 0x74ebeb90
call eax
push esi
mov eax, 0x74ebea20
call eax
jmp 0x4025da
insb byte es:[edi], dx
ljmp 0xa183:0x8dd0ff74

Function at 0x402574
Capabilities:
Get number of processors

Disassembly:
call 0x402574
inc edi
je 0x4025b9
jb 0x4025da
arpl word [ecx + 0x64], ax
jb 0x4025d6
jae 0x4025e6
add byte [edx], ch
push 1
mov eax, 0x74e9e030
call eax
xchg esi, eax
or esi, esi
jne 0x402588
jmp 0x40259a
push esi
mov eax, 0x74ebeb90
call eax
push esi
mov eax, 0x74ebea20
call eax
jmp 0x4025da
insb byte es:[edi], dx
ljmp 0xa183:0x8dd0ff74
Function at 0x3c4346
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3c02d0
push 0x3c4030
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x35
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.003c4220
add esp, 4
test eax, eax
je 0x3c438a
mov ecx, eax
call fcn.003c5680
mov dword [ebp - 0x1c], eax
jmp 0x3c4391
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x24], eax
call fcn.003c55e0
test eax, eax
je 0x3c43d2
cmp dword [ebp - 0x1c], 0
je 0x3c43c8
mov ecx, dword [ebp - 0x1c]
call fcn.003c56f0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.003c4230
add esp, 4
mov eax, 0x7895
jmp 0x3c4505
wait
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.003c4d70
mov ecx, dword [ebp - 0x1c]
call fcn.003c4870
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
call fcn.003c4be0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0x3c4430
mov esi, eax
test esi, esi
je 0x3c441e
mov ecx, esi
call fcn.003c56f0
push esi
call fcn.003c4230
add esp, 4
mov eax, 0x7895
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x3c4505
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0x3c444c
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.003c4640
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0x3c4490
mov esi, eax
test esi, esi
je 0x3c4481
mov ecx, esi
call fcn.003c56f0
push esi
call fcn.003c4230
add esp, 4
mov eax, 0x7895
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x3c4505
cmp dword [ebp - 0x2c], 0
jne 0x3c449c
mov eax, dword ds:[0]
mov ecx, dword [ebp - 0x1c]
call fcn.003c4a50
xor dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x7895
wait
jmp 0x3c44d4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x3c44e8
mov dword [ebp - 0x20], 0x7895
cmp dword [ebp - 0x1c], 0
je 0x3c4502
mov ecx, dword [ebp - 0x1c]
call fcn.003c56f0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.003c4230
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x3c4520
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov dword [ecx + 0xc], 0x45f479d7
mov dword [ecx], 0
mov esi, ecx
mov dword [ecx + 0x18], 0xf3cb3e57
mov dword [esi + 0x1c], 0x40092ee0
mov dword [esi + 8], 0x75bbf938
mov dword [esi + 0x10], 0xfd3371b0
mov dword [esi + 0x20], 0x8a4406c7
mov dword [esi + 0x24], 0x2cc8e4f
mov dword [esi + 0x28], 0xd12c3bc9
mov dword [esi + 0x30], 0xebcc478b
mov dword [esi + 0x34], 0x489225be
mov dword [esi + 0x38], 0xafda13f8
mov dword [esi + 0x10], 0x3f4cdc6c
mov dword [esi + 0x28], 0xea71e659
mov dword [esi + 8], 0x1d6efe4e
mov dword [esi + 0x30], 0x5a92a305
mov dword [esi + 0x34], 0x412b44f5
xor eax, eax
mov ecx, eax
inc eax
xor ecx, 0x3c2d1e0f
cmp eax, 0x1e
not ecx
mov dword [esi + eax*4 + 0x38], ecx
jl 0x3c459c
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x38]
mov ecx, dword [esi + 0x28]
mov edx, eax
or edx, edi
and eax, edi
and edx, dword [esi + 0x10]
or edx, eax
mov eax, ecx
shl eax, 5
shr ecx, 0x1b
or eax, ecx
add edx, eax
mov eax, edi
shr eax, 2
add edx, dword [esi + 0x24]
shl edi, 0x1e
add edx, 0x5a837999
or eax, edi
add dword [esi + 0x20], edx
mov dword [esi + 0x38], eax
call fcn.003c4310
mov edi, dword [esi + 0x28]
mov ecx, dword [esi + 8]
xor ecx, dword [esi + 0x38]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x20]
xor ecx, edi
mov edx, eax
shl edx, 5
shr eax, 0x1b
or edx, eax
mov eax, edi
shr eax, 2
add ecx, edx
shl edi, 0x1e
add ecx, dword [esi + 0x24]
add ecx, 0x5a837999
or eax, edi
pop edi
add dword [esi + 0x10], ecx
mov dword [esi + 0x28], eax
mov eax, esi
pop esi
ret

Function at 0x3c4c80
Capabilities:
Resolve function by hash

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x1c]
push edi
push 0xec0e4e8e
call fcn.003c4930
mov ecx, dword [esi + 0x14]
push edi
push 0xffd97fb
mov dword [ecx], eax
call fcn.003c4930
mov ecx, dword [esi + 0x14]
push edi
push 0x7c0017a5
mov dword [ecx + 4], eax
call fcn.003c4930
mov ecx, dword [esi + 0x14]
push edi
push 0x4dc9d5a0
mov dword [ecx + 8], eax
call fcn.003c4930
mov ecx, dword [esi + 0x14]
push edi
push 0x753a4fc
mov dword [ecx + 0xc], eax
call fcn.003c4930
mov edi, dword [0x3be980]
mov ecx, 0x3be97c
lea edx, [esp + 8]
mov dword [0x3be940], eax
mov eax, dword [ecx]
push edx
mov dword [edx], eax
mov eax, dword [ecx + 8]
mov cl, byte [ecx + 0xc]
mov dword [edx + 4], edi
mov dword [edx + 8], eax
mov byte [edx + 0xc], cl
mov ecx, esi
call fcn.003c4b90
mov ecx, dword [esi + 0x14]
lea eax, [esp + 8]
push eax
mov edx, dword [ecx]
mov dword [0x3be948], edx
call fcn.003c4a30
mov dword [esi], eax
test eax, eax
je 0x3c4d5a
push eax
push 0xa84aeb81
call fcn.003c4930
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [esi]
push eax
push 0xfcba95ab
call fcn.003c4930
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov edx, dword [esi]
push edx
push 0x35e273e6
call fcn.003c4930
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x3c5716
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3c0338
push 0x3c4030
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x3459fe
mov dword [ebp - 0x28], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.003c4220
add esp, 4
test eax, eax
je 0x3c5761
mov ecx, eax
call fcn.003c5680
mov dword [ebp - 0x1c], eax
jmp 0x3c5768
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x20], eax
call fcn.003c55e0
test eax, eax
je 0x3c57a2
cmp dword [ebp - 0x1c], 0
je 0x3c5798
mov ecx, dword [ebp - 0x1c]
call fcn.003c56f0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.003c4230
add esp, 4
mov eax, 0x2a
jmp 0x3c58ce
wait
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.003c4be0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0x3c57d1
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.003c4d70
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0x3c5814
mov esi, eax
test esi, esi
je 0x3c5802
mov ecx, esi
call fcn.003c56f0
push esi
call fcn.003c4230
add esp, 4
mov eax, 0x926
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x3c58ce
mov ecx, dword [ebp - 0x20]
call fcn.003c5020
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x2c], 0
jne 0x3c585c
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0x3c5856
mov esi, eax
test esi, esi
je 0x3c5847
mov ecx, esi
call fcn.003c56f0
push esi
call fcn.003c4230
add esp, 4
mov eax, 0xc3
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x3c58ce
mov eax, dword ds:[0]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.003c4780
mov ecx, dword [ebp - 0x20]
call fcn.003c5180
xor dword [ebp - 0x24], eax
wait
jmp 0x3c589d
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x3c58be
mov ecx, dword [ebp - 0x1c]
call fcn.003c56f0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.003c4230
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x3c58cb
mov dword [ebp - 0x24], 0x4e6
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x3c83a0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x3c94a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [esp + 0xc]
push ebp
mov eax, ecx
push edi
sub eax, 0x80
je 0x3c94cf
sub eax, 0x40
je 0x3c94c8
sub eax, 0x40
je 0x3c94c1
pop edi
mov eax, 0xfffffffe
pop ebp
ret
mov edi, 8
jmp 0x3c94d4
mov edi, 6
jmp 0x3c94d4
mov edi, 4
mov eax, dword [esp + 0x10]
cmp eax, ecx
jge 0x3c94de
mov eax, ecx
sub eax, 0x80
je 0x3c9505
sub eax, 0x40
je 0x3c94fe
sub eax, 0x40
je 0x3c94f7
pop edi
mov eax, 0xfffffffd
pop ebp
ret
mov ebp, 0xe
jmp 0x3c950a
mov ebp, 0xc
jmp 0x3c950a
mov ebp, 0xa
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebx
push esi
call fcn.003c95a0
add esp, 0xc
cmp ebp, 1
jle 0x3c9567
lea eax, [ebp - 1]
add ebx, 0x20
mov dword [esp + 0x1c], eax
push edi
push 0x3c0044
push esi
call fcn.003c9680
push edi
push 0
push esi
call fcn.003c95f0
push edi
push esi
call fcn.003c96c0
push edi
push ebx
push esi
call fcn.003c95a0
mov eax, dword [esp + 0x48]
add esp, 0x2c
add ebx, 0x20
dec eax
mov dword [esp + 0x1c], eax
jne 0x3c952e
mov ebx, dword [esp + 0x20]
push edi
push 0x3c0044
push esi
call fcn.003c9680
push edi
push 0
push esi
call fcn.003c95f0
shl ebp, 5
add ebp, ebx
push edi
push ebp
push esi
call fcn.003c95a0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x3c95a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
and edi, 0xff
mov ebp, edx
mov dword [esp + 0x1c], 4
test edi, edi
jle 0x3c95d3
mov ecx, dword [esp + 0x18]
mov eax, ebp
sub ecx, edx
mov esi, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec esi
jne 0x3c95ca
mov eax, dword [esp + 0x1c]
add ebp, 8
dec eax
mov dword [esp + 0x1c], eax
jne 0x3c95bc
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4014c0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x45604c]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea ecx, [ebx - 1]
cmp ecx, 0x100
ja 0x401647
cmp word [esi + ebx*2 - 2], 0x5c
je 0x40150d
mov eax, 0x5c
mov word [esi + ebx*2], ax
inc ebx
lea eax, [esi + ebx*2]
xor ecx, ecx
mov dword [eax], 0x2a
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4015a4
test byte [esp + 0x18], 0x10
je 0x401589
push 0x45006c
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x401585
push 0x450070
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x401585
mov eax, 0x104
sub eax, ebx
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esi + ebx*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
push esi
mov dl, 1
xor cl, cl
call fcn.004014c0
add esp, 8
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x401531
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esi + ebx*2]
mov dword [eax], 0x2a
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x401628
test byte [esp + 0x18], 0x10
jne 0x40160b
mov eax, 0x104
sub eax, ebx
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esi + ebx*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4015fd
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
je 0x40160b
test eax, eax
jne 0x40160b
push 4
push eax
push esi
call edi
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4015c2
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
xor ecx, ecx
push esi
mov word [eax - 2], cx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x401647
test edi, edi
je 0x401647
push 4
push eax
push esi
call edi
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00408f56
mov esp, ebp
pop ebp
ret
Function at 0x401990
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x45604c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
xor eax, eax
mov dword [ebp - 0x210], edi
push str.shell32.dll
mov word [edi], ax
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x401b72
cmp esi, 0xffffffff
je 0x401b72
push str.SHGetSpecialFolderPathW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401b6b
push 0
push 0x1c
push edi
push 0
call eax
test eax, eax
je 0x401b6b
push str.Rescue
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.Applet
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401a31
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401b6b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401a40
sub ecx, edx
sar ecx, 1
je 0x401b72
cmp ecx, 0x103
ja 0x401b72
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, ebx
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401a70
sub esi, ecx
sar esi, 1
cmp word [ebx + esi*2 - 2], 0x5c
je 0x401a97
mov eax, 0x5c
mov word [ebx + esi*2], ax
inc esi
xor eax, eax
mov word [ebx + esi*2], ax
push 0x4500bc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea esi, [esi + 3]
mov edi, 1
lea esi, [ebx + esi*2]
nop
push edi
push str._04X.tmp
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esi - 6]
inc edi
call fcn.004012a0
test al, al
jne 0x401ae7
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401b05
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401aef
cmp edi, 0xffff
jl 0x401ab0
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f56
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
call esi
test eax, eax
jne 0x401b58
push dword [ebp - 0x210]
call esi
push 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x20c]
push eax
call fcn.004014c0
add esp, 8
mov eax, 3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f56
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f56
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408f56
mov esp, ebp
pop ebp
ret
Function at 0x45eec0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x450015
lea edi, [esi - 0x4f015]
push edi
or ebp, 0xffffffff
jmp 0x45eee2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45eee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45eed8
mov eax, 1
add ebx, ebx
jne 0x45eefb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45eef0
jne 0x45ef0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45eef0
xor ecx, ecx
sub eax, 3
jb 0x45ef20
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45ef92
mov ebp, eax
add ebx, ebx
jne 0x45ef2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45ef38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45ef5c
inc ecx
add ebx, ebx
jne 0x45ef48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45ef3d
jne 0x45ef59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45ef3d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45ef7c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45ef6d
jmp 0x45eede
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45ef7c
add edi, ecx
jmp 0x45eede
pop esi
mov edi, esi
mov ecx, 0x2b4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45ef9a
cmp byte [edi], 0
jne 0x45ef9a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45ef9f
lea edi, [esi + 0x5c000]
mov eax, dword [edi]
or eax, eax
je 0x45f00e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x62d74]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62e2c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45efcc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62e34]
or eax, eax
je 0x45f008
mov dword [ebx], eax
add ebx, 4
jmp 0x45efe9
call dword [esi + 0x62e30]
mov ebp, dword [esi + 0x62e38]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45f042
sub esp, 0xffffff80
jmp 0x4043e6
Function at 0x4063f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x47b47b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4042f4
call fcn.004075db
push 4
mov dword [esp + 0x18], 0
call fcn.004085c8
mov edi, eax
add esp, 4
test edi, edi
je 0x406464
push ebx
call fcn.004073d6
mov dword [edi], eax
call fcn.00407195
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.0040759c
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406458
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.004075c4
pop ebx
jmp 0x406466
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40919b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47e354]
jne 0x4091a5
repz ret
jmp fcn.0040d42c