joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404fd0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x4050ab
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x405004
cmp dword [esi + 0x40], edi
jae 0x405004
push eax
call fcn.004065dc
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x40501b
lea eax, [edi + edi]
push eax
call fcn.00406577
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.0040cad0
add esp, 0xc
cmp edi, ebp
jbe 0x4050a7
lea ecx, [ecx]
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x413f60]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x413f60]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x405030
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x4050e4
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x4050cc
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.0040cad0
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x405105
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8

Function at 0x4053b0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esi + 0x84]
push edi
test ecx, ecx
je 0x4053fe
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x40543b
sub edi, eax
cmp edi, edx
jbe 0x4053d4
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call fcn.0040cad0
mov eax, dword [esi + 0x78]
add dword [esi + 0x8c], edi
add dword [esi + 0x74], edi
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.00404a00
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop ecx
ret
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x405434
push 0
lea ecx, [esp + 8]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40543b
mov edi, dword [esp + 4]
mov eax, dword [esi + 0x78]
add dword [esi + 0x74], edi
mov edx, edi
mov ecx, ebx
call fcn.00404a00
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop ecx
ret
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop ecx
ret
Function at 0x40603f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x416044]
jne 0x406049
repz ret
jmp fcn.004068f4

Function at 0x40dfbc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040903e
and dword [ebp - 4], 0
cmp dword [0x417a20], 0
mov ebx, eax
jne 0x40e06d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40e11e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40e11e
push eax
call fcn.00408fcc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x417a20], eax
call esi
push eax
call fcn.00408fcc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x417a24], eax
call esi
push eax
call fcn.00408fcc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x417a28], eax
call esi
push eax
call fcn.00408fcc
pop ecx
mov dword [0x417a30], eax
test eax, eax
je 0x40e06d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00408fcc
pop ecx
mov dword [0x417a2c], eax
mov eax, dword [0x417a2c]
cmp eax, ebx
je 0x40e0c5
cmp dword [0x417a30], ebx
je 0x40e0c5
push eax
call fcn.00409047
push dword [0x417a30]
mov esi, eax
call fcn.00409047
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40e0c5
test edi, edi
je 0x40e0c5
call esi
test eax, eax
je 0x40e0bc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40e0bc
test byte [ebp - 0xc], 1
jne 0x40e0c5
or dword [ebp + 0x10], 0x200000
jmp 0x40e0fe
mov eax, dword [0x417a24]
cmp eax, ebx
je 0x40e0fe
push eax
call fcn.00409047
pop ecx
test eax, eax
je 0x40e0fe
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40e0fe
mov eax, dword [0x417a28]
cmp eax, ebx
je 0x40e0fe
push eax
call fcn.00409047
pop ecx
test eax, eax
je 0x40e0fe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x417a20]
call fcn.00409047
pop ecx
test eax, eax
je 0x40e11e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40e120
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x3210555
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x5ab4761f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401497
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x7b24f0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40152c
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014e9
cmp dword [ebp + 0x10], ebx
jne 0x401520
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401497
test eax, eax
jne 0x4014fb
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405a38
cmp eax, ebx
je 0x401533
push ebx
push dword [0x7b24f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x40152c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x7b24f0], ebx
jne 0x401529
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x401529
jmp 0x40152c
Function at 0x402d89
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x7a21b8]
sub esi, dword [0x7a21c4]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
xor ebx, ebx
mov dword [0x7b2460], eax
cmp esi, ebx
jle 0x402ee7
push dword [0x7a21c0]
call fcn.00402d72
push ebx
push ebx
push dword [0x7a21c4]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x7961b4], esi
mov dword [0x40f8ec], ebx
mov ebp, 0x7961b8
mov eax, dword [0x7a21bc]
sub eax, dword [0x7a21c0]
mov edi, 0x4000
cmp eax, edi
jg 0x402dfe
mov edi, eax
push edi
mov esi, 0x79e1b8
push esi
call fcn.00402d40
test eax, eax
je 0x402ef9
add dword [0x7a21c0], edi
mov dword [0x4178f0], esi
mov dword [0x4178f4], edi
cmp dword [0x7b240c], ebx
je 0x402e55
cmp dword [0x7b24e0], ebx
jne 0x402e55
mov eax, dword [0x7961b4]
sub eax, dword [0x7a21b8]
push ebx
sub eax, dword [esp + 0x1c]
add eax, dword [0x7a21c4]
mov dword [0x40f8ec], eax
call fcn.00402ca1
pop ecx
push 0x4178f0
mov dword [0x4178f8], ebp
mov dword [0x4178fc], 0x8000
call fcn.00406acb
test eax, eax
js 0x402efe
mov esi, dword [0x4178f8]
sub esi, ebp
je 0x402eb3
push ebx
lea eax, [esp + 0x14]
push eax
push esi
push ebp
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402f03
cmp esi, dword [esp + 0x10]
jne 0x402f03
add dword [0x7a21c4], esi
cmp dword [0x4178f4], ebx
jne 0x402e24
jmp 0x402ebf
cmp dword [0x4178f4], ebx
jne 0x402efe
cmp edi, ebx
je 0x402efe
mov eax, dword [0x7a21b8]
mov ecx, eax
sub ecx, dword [0x7a21c4]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x402de8
push ebx
push ebx
push eax
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
call fcn.00402ca1
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
or eax, 0xffffffff
jmp 0x402ef1
push 0xfffffffffffffffd
pop eax
jmp 0x402ef1
push 0xfffffffffffffffe
jmp 0x402f00
Function at 0x402f07
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f31
add eax, dword [0x7b2458]
push edi
push edi
push eax
push dword [0x40a014]
mov dword [0x7a21b8], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00402d89
cmp eax, edi
jl 0x40302a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call ebx
test eax, eax
je 0x403026
cmp dword [ebp - 4], esi
jne 0x403026
push dword [ebp + 8]
add dword [0x7a21b8], esi
call fcn.00402d89
mov dword [ebp - 8], eax
cmp eax, edi
jl 0x403029
cmp dword [ebp + 0x10], edi
jne 0x402ff5
cmp dword [ebp + 8], edi
jle 0x403021
mov esi, 0x79e1b8
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402fa5
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x40a014]
call ebx
test eax, eax
je 0x403026
cmp edi, dword [ebp - 4]
jne 0x403026
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402ff1
cmp dword [ebp + 0x14], edi
jne 0x402ff1
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x7a21b8], eax
cmp dword [ebp + 8], 0
jg 0x402f98
jmp 0x403021
push 0xfffffffffffffffe
jmp 0x403028
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403000
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call ebx
test eax, eax
je 0x403026
mov eax, dword [ebp - 4]
add dword [0x7a21b8], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403029
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x4055bd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x7ab210
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x7ab210], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4055f8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405799
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4057b6
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x4057b9
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4057e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40582c
test edi, edi
jne 0x4057f3
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405826

Function at 0x405830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4058a1
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x1000
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405890
cmp dword [ebp + 0x14], 1
je 0x405892
cmp dword [ebp + 0x14], 2
je 0x405892
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0xfff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405f05
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x7ab258
push esi
call fcn.00405947
push esi
call fcn.004056ca
mov edi, eax
test edi, edi
jne 0x405f26
xor eax, eax
jmp 0x405f7e
push edi
call fcn.00405976
test byte [0x7b2468], 0x80
je 0x405f3f
mov al, byte [edi]
test al, al
je 0x405f22
cmp al, 0x5c
je 0x405f22
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x405f5f
push esi
call fcn.00405a11
test eax, eax
je 0x405f59
test byte [eax], 0x10
je 0x405f83
push esi
call fcn.00405ede
push esi
call ebx
cmp eax, edi
jg 0x405f4a
push esi
call fcn.00405eb1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405f7d
Function at 0x4061df
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x408724
mov edi, 0x7ac258
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov ebx, 0x400
test esi, esi
je 0x40622e
push 1
push 0
push esi
call fcn.004057b9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x40636b
cmp eax, ebx
jg 0x40636b
push ebx
mov esi, 0x7adb98
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x40636b
cmp eax, ebx
jg 0x40636b
push esi
push edi
push str._s_s_r_n
push 0x7ac798
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x7b240c]
push dword [eax + 0x128]
push esi
call fcn.00405f87
push 4
push 0xc0000000
push esi
call fcn.004057b9
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, 0xffffffff
je 0x40636b
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x406364
push 0
lea eax, [esp + 0x14]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406364
cmp edi, dword [esp + 0x10]
jne 0x406364
push str._Rename__r_n
push esi
call fcn.0040571f
test eax, eax
jne 0x4062f6
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x40632f
push 0x408718
add eax, 0xa
push eax
call fcn.0040571f
mov ebp, eax
test ebp, ebp
je 0x40632b
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
cmp ecx, ebp
jbe 0x406320
sub eax, ecx
mov dl, byte [ecx]
mov byte [eax + ecx], dl
dec ecx
cmp ecx, ebp
ja 0x406316
sub ebp, esi
lea eax, [ebp + 1]
mov ebp, dword [esp + 0x1c]
jmp 0x406331
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
push 0x7ac798
add eax, esi
push eax
call fcn.00405775
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4063a4
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405f05
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x4063d9
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7b24c8], eax
jmp 0x40656a
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x4063f4
test eax, eax
je 0x406515
test cl, 2
je 0x406515
push edi
push ebx
mov esi, 0x7acb98
push esi
call fcn.00405947
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x406417
push str..
push esi
call edi
jmp 0x40641d
push ebx
call fcn.00405ede
cmp byte [ebx], 0
jne 0x40642b
cmp byte [0x7acb98], 0x5c
jne 0x406433
push 0x4082a8
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebx + eax]
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40650a
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.00405684
cmp byte [eax], 0
je 0x406475
cmp byte [ebp - 0x18], 0
je 0x406475
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40648b
mov al, byte [esi + 1]
test al, al
je 0x4064e9
cmp al, 0x2e
jne 0x40648b
cmp byte [esi + 2], 0
je 0x4064e9
push esi
push edi
call fcn.00405947
test byte [ebp - 0x148], 0x10
je 0x4064b0
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4064e9
push dword [ebp + 0xc]
push ebx
call fcn.004063a4
jmp 0x4064e9
push ebx
call fcn.00405799
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4064e1
test byte [ebp + 0xc], 4
je 0x4064d9
push ebx
push 0xfffffffffffffff1
call fcn.0040497b
push 0
push ebx
call fcn.00406371
jmp 0x4064e9
inc dword [0x7b24c8]
jmp 0x4064e9
push ebx
push 0xfffffffffffffff2
call fcn.0040497b
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406457
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x406514
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406569
cmp dword [ebp - 8], esi
je 0x406559
push ebx
call fcn.00405a11
test eax, eax
je 0x406569
push ebx
call fcn.00405eb1
push ebx
call fcn.00405799
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x406561
test byte [ebp + 0xc], 4
je 0x406559
push ebx
push 0xfffffffffffffff1
call fcn.0040497b
push esi
push ebx
call fcn.00406371
jmp 0x406569
inc dword [0x7b24c8]
jmp 0x406569
push ebx
push 0xffffffffffffffe5
call fcn.0040497b
pop esi
pop ebx
leave
ret 8
Function at 0x406917
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7adf9c], 0
jne 0x406955
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40692b
mov dword [ecx*4 + 0x7adf98], eax
inc ecx
cmp ecx, 0x100
jl 0x406926
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406982
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x7adf98]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406963
not eax
pop ebp
ret 0xc
Function at 0x1002046
Capabilities:
Check if file exists
Check os version
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1007034]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x110], eax
call fcn.01002471
cmp al, 1
jne 0x100207b
xor eax, eax
jmp 0x10021eb
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
cmp ecx, 5
movzx eax, ah
ja 0x100213c
jne 0x100209e
cmp eax, 1
jae 0x100213c
cmp ecx, 4
ja 0x10020b1
jne 0x10020aa
cmp eax, 0xa
jae 0x10020b1
xor eax, eax
jmp 0x10021e8
push 0x104
lea eax, [ebp - 0x108]
push eax
mov ebx, 0x10011cc
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10020f4
push 0x10011c0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10020f4
mov ebx, 0x10011a4
mov esi, 0x1001198
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10021df
mov esi, 0x1001184
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1002126
push esi
call fcn.01001fc3
or esi, 0xffffffff
jmp 0x1002136
push dword [ebp + 0x14]
push ebx
push dword [ebp - 0x10c]
push 0
call eax
mov esi, eax
push edi
jmp 0x10021d5
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x108], 0
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jae 0x1002195
push 0x1001174
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0100200e
test eax, eax
jl 0x1002195
lea eax, [ebp - 0x108]
push eax
call edi
mov ebx, eax
test ebx, ebx
jne 0x10021a3
mov esi, 0x1001168
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10021df
mov esi, 0x1001154
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10021bf
push esi
call fcn.01001fc3
or esi, 0xffffffff
jmp 0x10021d4
push dword [ebp + 0x14]
push dword [ebp - 0x110]
push dword [ebp - 0x10c]
push 0
call eax
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x10021e8
push esi
call fcn.01001fc3
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.01002558
leave
ret 0x10