joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003f75
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov ecx, dword [0x110103e8]
xor edx, edx
mov eax, dword [0x11010414]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x28]
push edi
div dword [ecx + ebp*4]
mov ecx, dword [0x11010428]
movzx eax, dx
mov dword [esp + 0x20], eax
mov eax, dword [0x11010410]
xor eax, 0x18cd
mov edx, dword [0x110103ec]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], edx
movzx ebx, word [eax + 0x3928]
mov ax, word [0x110103f8]
or ebx, 0xd71
inc ax
mov word [0x110103f8], ax
movzx eax, ax
mov dword [esp + 0x1c], eax
mov eax, dword [0x11010404]
movzx ecx, word [ecx + eax*4]
mov eax, dword [0x11010424]
or ecx, dword [esi + eax*4]
mov eax, 0x10e2
mov dword [esp + 0x10], ecx
imul ecx, edx, 0xc
xor edx, edx
div dword [ecx + esi]
inc ebp
mov ecx, eax
mov dword [esp + 0x38], ebp
imul eax, ebp, 0xc
mov dword [esp + 0x2c], ecx
mov edi, dword [eax + esi]
movzx esi, word [ecx + ecx + 0x107c]
sub edi, ebp
movzx ebp, word [esp + 0x28]
cmp esi, ebp
ja 0x1000408e
mov eax, dword [esp + 0x18]
xor edx, edx
div ebx
mov ecx, dword [0x11010400]
and edi, 0xcf3
mov dword [esp + 0x28], eax
mov edx, dword [0x1101042c]
dec ecx
mov eax, ecx
mov dword [0x11010400], ecx
sub eax, dword [esp + 0x10]
sub eax, 0x1441
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
movzx eax, byte [edx + eax*4]
add eax, dword [esp + 0x28]
imul eax, ebx
add eax, edi
mov dword [0x110103e4], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x2254]
xor eax, 0x1a8c
cdq
idiv esi
or dword [esp + 0x2c], edx
inc esi
cmp esi, ebp
jle 0x1000403d
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
xor ebp, dword [esp + 0x38]
imul ecx, ecx, 6
mov eax, ebp
mov byte [0x110103e0], dl
xor edx, edx
movzx ecx, word [ecx + edi]
add ecx, 0xab2
mov dword [ebx*4 + 0x268c], ecx
mov esi, dword [0x110103ec]
movzx ecx, word [edi + esi*4]
div ecx
mov eax, dword [esp + 0x30]
mov word [edi + esi*4], dx
mov edx, dword [0x11010400]
movzx ecx, byte [0x110103e1]
xor edx, 0x1a9c
sub edx, dword [esp + 0x14]
pop edi
pop esi
mov word [eax + ecx*2], dx
mov ecx, dword [0x110103f4]
dec byte [0x110103e1]
mov edx, dword [esp + 0x18]
pop ebp
mov word [eax + ecx*2], dx
mov eax, ebx
pop ebx
add esp, 0x14
ret
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x84], 0
call fcn.0040186f
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
lea eax, [0x40438d]
lea edx, [fcn.004018ec]
sub eax, edx
push eax
push fcn.004018ec
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x401337
push edi
call fcn.0040177b
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.004017c5
mov eax, edi
add eax, 0x1ca00
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x88]
mov edx, edi
dec edx
and eax, edx
push eax
lea eax, [0x4060e4]
lea ecx, [0x4060e4]
mov esi, edi
shl esi, cl
mov ebx, eax
add ebx, esi
push ebx
call fcn.004018ec
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40186f
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x118], 0
xor edi, edi
push 0
push 0
call sub.USER32.DLL_GetWindow
mov dword [ebp - 0x114], 0xa
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10e]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringA
movsx edi, byte [ebp - 0x10e]
sub edi, 0x41
lea eax, [ebp - 0x120]
push eax
call sub.USER32.DLL_GetCursorPos
call sub.KERNEL32.dll_GetLastError
mov eax, edi
pop edi
leave
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403cf8
nop
nop
sub eax, 0x403c9e
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401207
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x41a1e8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [0x41a1ec]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0xc], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], 0x9e3779b9
mov dword [ebp - 0x18], eax
call fcn.00401200
add dword [ebp - 0xc], 0x23f
cmp dword [0x311122c], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x854]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov ecx, dword [str.q_aJ_9Q]
mov edx, dword [0x41a1f4]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov eax, esi
mov dword [ebp - 8], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x311122c], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x3111228]
cmove eax, dword [ebp - 8]
and dword [ebp - 8], 0
cmp dword [0x311122c], 0x3eb
mov dword [0x3111228], eax
mov eax, dword [0x311117c]
cmove eax, dword [ebp - 8]
mov dword [0x311117c], eax
mov eax, dword [ebp - 0xc]
add eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
add dword [ebp - 0x10], edx
and dword [ebp - 8], 0
mov dword [0x3111224], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor ecx, eax
cmp dword [0x311122c], 0x213
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
jne 0x401359
lea eax, [ebp - 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea eax, [ebp - 0x854]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov ecx, dword [ebp - 0x10]
sub ebx, ecx
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0xc]
shr edx, cl
add eax, ebx
mov ecx, dword [ebp - 4]
add edx, edi
xor ecx, eax
mov dword [ebp - 0x10], edx
cmp dword [0x311122c], 0xb03
mov dword [ebp - 4], ecx
jne 0x40139c
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
xor ecx, edx
sub esi, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
jne 0x40127f
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bb37
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419c10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00406d87
mov dword [ebp - 0x14], eax
cmp dword [0x817908], esi
jne 0x40bc2a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40bbb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40bd0a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40bd0a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40bd0a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x817908], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x81790c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x817910], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x817918], eax
test eax, eax
je 0x40bc27
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x817914], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40bc4f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40bc42
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40bc64
push 4
pop eax
jmp 0x40bd0c
cmp dword [ebp - 0x14], esi
je 0x40bc64
push dword [0x817908]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40bc49
mov eax, dword [0x817914]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40bcc2
cmp dword [0x817918], edi
je 0x40bcc2
push eax
call ebx
push dword [0x817918]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40bcc2
test eax, eax
je 0x40bcc2
call ecx
test eax, eax
je 0x40bcb7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40bcb7
test byte [ebp - 8], 1
jne 0x40bcc2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40bcf2
mov eax, dword [0x81790c]
cmp eax, edi
je 0x40bcef
push eax
call ebx
test eax, eax
je 0x40bcef
call eax
mov esi, eax
test esi, esi
je 0x40bcef
mov eax, dword [0x817910]
cmp eax, edi
je 0x40bcef
push eax
call ebx
test eax, eax
je 0x40bcef
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x817908]
call ebx
test eax, eax
je 0x40bd0a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40bd0c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040397d
mov esp, ebp
pop ebp
ret
Function at 0x40d650
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004098c0
xor eax, eax
push ebp
push 0x40d712
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040a2c4
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a474
mov eax, dword [ebx]
call fcn.0040d4f8
test al, al
jne 0x40d6ed
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040a2c4
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a474
mov eax, dword [ebx]
call fcn.0040d4f8
test al, al
jne 0x40d6ed
mov eax, ebx
call fcn.004097dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d719
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040983c
lea eax, [ebp - 4]
call fcn.004097dc
pop eax
jmp eax

Function at 0x40efcc
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x4130c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.004130a8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41e2fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41e355
test eax, edx
je 0x41e358
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41e313
movzx eax, word [eax]
sub eax, ecx
jmp 0x41e33a
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41e33b
add ecx, 4
js 0x41e32b
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41e338
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41e33a
xor eax, eax
ret
test eax, eax
je 0x41e364
test edx, edx
jne 0x41e304
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x422b5c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x422b95
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00409964
jmp 0x422b9e
mov eax, ebx
mov edx, esi
call fcn.00409bbc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x422ba8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x422bca
movzx eax, word [esp]
jmp 0x422bcc
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x423be0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x423d07
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004239e8
mov esi, eax
mov eax, dword [0x4c4e58]
cmp byte [eax], 0
je 0x423cad
mov eax, dword [0x4c4cb4]
call fcn.004074e8
call fcn.00407208
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x423bb0]
call fcn.0040c1f0
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x423d20
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x423ce9
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4c4c88]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c8634]
call fcn.0040c5e0
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423d0e
lea eax, [ebp - 4]
mov edx, dword [0x423bb0]
call fcn.0040c314
pop eax
jmp eax
Function at 0x424b40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x424c44
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409c04
lea eax, [ebp - 4]
call fcn.00409d6c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a224
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x424c2c
mov eax, ebx
call fcn.00407024
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x424c25
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a224
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x424c0d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x424c58
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x424c0d
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424c2c
mov eax, dword [ebp - 0x10]
call fcn.00407040
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424c4b
lea eax, [ebp - 4]
call fcn.004097dc
pop eax
jmp eax

Function at 0x427974
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4279bc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00427900
mov eax, dword [ebp - 4]
call fcn.0040a224
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4279c3
lea eax, [ebp - 4]
call fcn.004097dc
pop eax
jmp eax

Function at 0x427bec
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x427c83
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x427c37
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00409964
jmp 0x427c6b
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
cmp word [ebx], 0
jne 0x427c4e
lea eax, [ebp - 4]
call fcn.004097dc
jmp 0x427c61
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00427aa4
mov ebx, eax
test esi, esi
je 0x427c61
dec esi
jmp 0x427c3e
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00409bbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427c8a
lea eax, [ebp - 4]
call fcn.004097dc
pop eax
jmp eax
Function at 0x427c94
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.0041f394
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427cfc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.0041f394
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427e64
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x427f9c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x427f84
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x427ec1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x427f84
cmp dword [ebp - 0x14], 0
jne 0x427ed6
mov eax, dword [ebp - 0xc]
call fcn.004097dc
mov bl, 1
jmp 0x427f84
cmp dword [ebp - 0x14], 0x70000000
jb 0x427ee4
call fcn.00423d44
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00409964
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00409d5c
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
je 0x427e8a
test eax, eax
jne 0x427f84
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x427f32
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x427f84
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x427f3a
dec esi
test esi, esi
je 0x427f49
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x427f39
cmp dword [ebp - 0x10], 7
jne 0x427f54
test esi, esi
je 0x427f54
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040a39c
cmp dword [ebp - 0x10], 7
jne 0x427f77
test esi, esi
je 0x427f77
lea eax, [ebp - 4]
call fcn.00409d5c
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00409bbc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427fa3
lea eax, [ebp - 4]
call fcn.004097dc
pop eax
jmp eax

Function at 0x429698
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4ccf5c
mov eax, esi
mov edx, 8
test al, 1
je 0x4296b4
shr eax, 1
xor eax, 0xedb88320
jmp 0x4296b6
shr eax, 1
dec edx
jne 0x4296a7
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4296a0
pop esi
ret
Function at 0x4296cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4ccf58], 0
jne 0x4296f9
call fcn.00429698
mov dword [ebp - 4], 0x4ccf58
mov edx, dword [ebp - 4]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x429723
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4ccf5c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4296ff
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x42c2b8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0042c264
test al, al
jne 0x42c2d9
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x42c327
xor eax, eax
push ebp
push 0x42c317
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040a224
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c31e
lea eax, [ebp - 0xc]
call fcn.0042c2a4
pop eax
jmp eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret