joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50cce0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x50cd0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x50cd0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x511a1e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0050d180
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0040cf51
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x511a60
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x511bbc
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0050cfd0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x57db60]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00411604
mov ecx, dword [esi*4 + 0x57db60]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x511bb5
cmp eax, dword [ecx + edi + 0x24]
jne 0x511bb5
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x511bb5
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00411604
add esp, 0x14
test edx, edx
jl 0x511bb5
jg 0x511b2b
test eax, eax
jb 0x511bb5
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x511bb5
jl 0x511b45
cmp dword [ebp - 0x1008], eax
ja 0x511bb5
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x511b63
test ebx, ebx
je 0x511b9c
cmp ecx, edi
jae 0x511b9c
mov al, byte [ecx]
cmp al, 0xd
jne 0x511b7d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x511b89
cmp byte [ecx + 1], 0xa
jne 0x511b89
inc ecx
jmp 0x511b89
movzx eax, al
movsx eax, byte [eax + 0x5667d8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x511b63
cmp edx, ebx
jne 0x511b63
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x511bba
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00401033
leave
ret
Function at 0x5c5d20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
je 0x5c5dd8
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push 0
call fcn.005c5ca0
add esp, 4
push str.GetStockObject
push str.gdi32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5c850c], eax
push str.444f
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x5c5e0e
xor eax, eax
jmp 0x5c5e78
push str.RegOpenKeyA
push 0x5c71a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push 0x5c8504
mov ecx, dword [str.InterfacEb196b287_bab4_101a_b69c_00aa00341d07]
push ecx
mov edx, dword [0x5c7130]
sub edx, 2
push edx
call dword [ebp - 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5c5e55
mov eax, 1
test eax, eax
je 0x5c5e55
jmp 0x5c5e4a
push 0x5c71b4
push str.advapi32
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5c8508], eax
mov eax, 0x5c5990
call eax
mov esp, ebp
pop ebp
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x22e27f58
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x19f71ab0
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401ce6
Capabilities:
Create thread

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
cmp dword [esi + 0x14], edi
jne 0x401d14
lea eax, [esp + 0x10]
push eax
push edi
push esi
push 0x401bb2
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x14], eax
jne 0x401d1e
push 0xfffffffffffffffc
pop eax
jmp 0x401d64
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x48], edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x401d32
push edi
call ebx
cmp dword [esi + 0x48], edi
je 0x401d2a
lea ebp, [esi + 0x28]
mov dword [esi + 0x44], edi
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x44], 1
cmp dword [esi + 0x48], edi
je 0x401d50
push edi
call ebx
jmp 0x401d46
cmp dword [esi + 0x4c], edi
pop ebx
je 0x401d62
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x50]
jmp 0x401d64
xor eax, eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x401f11
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4093ac], esi
push edi
jne 0x401f4b
mov ecx, 0x4093a8
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x401f27
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x4097a8
jl 0x401f22
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x401f80
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4093a8]
xor eax, esi
inc ecx
dec edx
jne 0x401f63
pop edi
pop esi
not eax
ret 0xc
Function at 0x403848
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4038d4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4038bf
cmp dword [ebp + 0x10], ebx
jne 0x4038b1
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00403848
test eax, eax
jne 0x4038bf
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
jmp 0x403884
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x4038d4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x403d16
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x403d43
mov ecx, dword [0x423f10]
push edi
add eax, ecx
push edi
push eax
mov dword [0x417490], eax
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403e41
cmp eax, edi
jl 0x403e3a
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409094]
call ebx
test eax, eax
je 0x403e37
cmp dword [ebp - 4], esi
jne 0x403e37
push dword [ebp + 8]
add dword [0x417490], esi
call fcn.00403e41
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403e3a
cmp dword [ebp + 0x10], edi
jne 0x403e06
cmp dword [ebp + 8], edi
jle 0x403e32
mov esi, 0x41344c
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x403db6
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409094]
call ebx
test eax, eax
je 0x403e37
cmp edi, dword [ebp - 4]
jne 0x403e37
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403e02
cmp dword [ebp + 0x14], edi
jne 0x403e02
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x417490], eax
cmp dword [ebp + 8], 0
jg 0x403da9
jmp 0x403e32
push 0xfffffffffffffffe
jmp 0x403e39
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403e11
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409094]
call ebx
test eax, eax
je 0x403e37
mov eax, dword [ebp - 4]
add dword [0x417490], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403e3a
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403e41
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x417490]
mov ebx, eax
sub esi, dword [0x40b3f4]
add ebx, 0x1f4
add esi, dword [esp + 0x38]
cmp esi, edi
jle 0x404028
push dword [0x41f49c]
call fcn.0040406b
push edi
push edi
push dword [0x40b3f4]
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f498], esi
mov dword [0x41748c], edi
mov eax, dword [0x417494]
mov ebp, 0x4000
sub eax, dword [0x41f49c]
cmp eax, ebp
jg 0x403eb5
mov ebp, eax
mov esi, 0x41344c
push ebp
push esi
call fcn.00404039
test eax, eax
je 0x404000
add dword [0x41f49c], ebp
mov dword [0x40b410], esi
mov dword [0x40b414], ebp
cmp dword [0x423ec8], edi
je 0x403f73
cmp dword [0x423f3c], edi
jne 0x403f73
cmp dword [esp + 0x10], edi
je 0x403f40
mov eax, dword [0x41f498]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
sub eax, dword [0x417490]
push 1
push edi
push edi
sub eax, dword [esp + 0x44]
push edi
add eax, dword [0x40b3f4]
mov dword [0x41748c], eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x403f73
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push edi
push edi
lea eax, [esp + 0x24]
push edi
push eax
jmp 0x403f23
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
jbe 0x403f73
mov eax, dword [0x423ec4]
neg eax
sbb eax, eax
not eax
and eax, 0x40921c
push eax
push 0x403938
push edi
push 0x6f
push dword [0x423ec0]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
push 0x40b3f8
mov dword [0x40b418], 0x40b44c
mov dword [0x40b41c], 0x8000
call fcn.00401ce6
test eax, eax
jl 0x404034
mov esi, dword [0x40b418]
mov eax, 0x40b44c
sub esi, eax
je 0x403fda
lea ecx, [esp + 0x14]
push edi
push ecx
push esi
push eax
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404005
cmp esi, dword [esp + 0x14]
jne 0x404005
add dword [0x40b3f4], esi
cmp dword [0x40b414], edi
jne 0x403edb
jmp 0x403fe6
cmp dword [0x40b414], edi
jne 0x404034
cmp ebp, edi
je 0x404034
mov eax, dword [0x417490]
mov ecx, eax
sub ecx, dword [0x40b3f4]
add ecx, dword [esp + 0x38]
test ecx, ecx
jle 0x404009
jmp 0x403e9f
or eax, 0xffffffff
jmp 0x40402a
push 0xfffffffffffffffe
jmp 0x404036
push edi
push edi
push eax
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x10], edi
je 0x404028
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
push 0xfffffffffffffffd
pop eax
jmp 0x40402a
Function at 0x404642
Capabilities:
Identify system language via api

Disassembly:
push ecx
cmp byte [0x42a000], 0
push ebx
push ebp
push esi
push edi
mov ebx, 0xffff
mov ebp, 0x42a000
je 0x404662
push ebp
call fcn.004069db
jmp 0x404668
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [esp + 0x10], eax
xor edi, edi
mov esi, dword [0x423f04]
mov eax, esi
dec esi
test eax, eax
je 0x4046c4
mov eax, dword [0x423ec8]
mov ecx, dword [eax + 0x5c]
mov edx, ecx
imul ecx, esi
neg edx
add ecx, dword [0x423f00]
mov ax, word [esp + 0x10]
mov edi, ecx
xor ax, word [ecx]
and eax, ebx
test ax, ax
je 0x4046ac
mov eax, esi
dec esi
add ecx, edx
test eax, eax
jne 0x404690
jmp 0x4046c4
mov eax, dword [edi + 2]
mov dword [0x4236a0], eax
mov eax, dword [edi + 6]
mov dword [0x423f44], eax
lea eax, [edi + 0xa]
mov dword [0x42369c], eax
cmp dword [0x42369c], 0
jne 0x4046df
cmp bx, 0xffff
jne 0x4046db
mov ebx, 0x3ff
jmp 0x40466e
xor ebx, ebx
jmp 0x40466e
movzx eax, word [edi]
push eax
push ebp
call fcn.004069c2
push 0xfffffffffffffffe
push 0x4236c0
call fcn.00406a83
push eax
push dword [0x4208b0]
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x406410
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x4220d8], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x406434
test al, 0x10
jne 0x406437
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x4220d8
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x406462
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x4064f1
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00406646
test eax, eax
je 0x406556
test byte [ebp + 0xc], 1
je 0x40653e
mov eax, dword [0x423ec4]
push esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
call fcn.00406a76
and byte [eax + esi + 1], 0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], esi
push eax
mov word [ebp - 0x10], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
jmp 0x406556
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x406556
test byte [ebp + 0xc], 2
je 0x406556
push eax
push esi
call fcn.004067a1
pop esi
leave
ret 8
Function at 0x406646
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421cd8
push esi
call fcn.00406a65
push esi
call fcn.004065f5
test eax, eax
jne 0x406665
xor eax, eax
jmp 0x4066ae
test byte [0x423ed0], 0x80
je 0x406679
mov cl, byte [eax]
test cl, cl
je 0x406661
cmp cl, 0x5c
je 0x406661
mov edi, eax
sub edi, esi
push esi
call fcn.00406a76
cmp eax, edi
push esi
jle 0x40669e
call fcn.00406d7a
test eax, eax
je 0x406696
test byte [eax], 0x10
je 0x406661
push esi
call fcn.004065a3
jmp 0x40667d
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x406729
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x406758
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40679d
mov eax, edi
dec edi
test eax, eax
jne 0x406763
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x406797
Function at 0x4067a1
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4067d9
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4067d9
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40691e
mov eax, dword [0x4092ec]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
mov dword [0x422a60], eax
mov edi, 0x400
mov ebp, 0x422a60
je 0x40681d
push 1
push 0
push esi
call fcn.00406729
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406924
cmp eax, edi
jg 0x406924
mov esi, 0x422660
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406924
cmp eax, edi
jg 0x406924
push esi
push ebp
push str._s_s_r_n
push 0x422260
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40691e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x406906
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x4068fa
push str._Rename__r_n
push edi
call fcn.004066b3
test eax, eax
jne 0x40692b
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call fcn.00406a65
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x422260
push eax
call fcn.004066ff
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x423f30]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x4092c4
push eax
call fcn.004066b3
test eax, eax
je 0x4068e1
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x406954
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x406947
sub eax, edi
jmp 0x4068e3
Function at 0x406958
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4069bc
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4069ab
cmp dword [ebp + 0x14], 1
je 0x4069ad
cmp dword [ebp + 0x14], 2
je 0x4069ad
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x402530
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4026cd
mov esi, dword [ebp + 8]
test esi, esi
je 0x4026cd
mov dword [esi + 0xf0], 0xa
mov ecx, dword [edi]
mov eax, ecx
rol ecx, 8
and ecx, 0xff00ff
ror eax, 8
and eax, 0xff00ff00
or eax, ecx
mov dword [esi], eax
lea eax, [esi + 4]
mov edx, dword [edi + 4]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [eax], ecx
mov edx, dword [edi + 8]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0xc]
mov edi, 0x602774
push ebx
mov ebx, ecx
rol ecx, 8
and ecx, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, ecx
mov ecx, ebx
mov dword [esi + 0xc], ebx
shr ecx, 0x10
and ecx, 0xff
mov edx, dword [ecx*4 + 0x603ca0]
mov ecx, ebx
shr ecx, 8
xor edx, 0x1000000
and ecx, 0xff
and edx, 0xff000000
mov ecx, dword [ecx*4 + 0x6038a0]
and ecx, 0xff0000
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x6040a0]
xor edx, ecx
movzx ecx, bl
mov ecx, dword [ecx*4 + 0x6044a0]
and ecx, 0xff00
xor edx, ecx
mov ecx, dword [eax]
xor edx, dword [esi]
xor ecx, edx
mov dword [esi + 0x10], edx
mov edx, dword [esi + 8]
xor edx, ecx
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov dword [esi + 0x18], edx
xor ecx, edx
mov dword [esi + 0x1c], ecx
pop ebx
mov edi, edi
mov edx, dword [eax + 0x18]
lea eax, [eax + 0x10]
mov ecx, edx
shr ecx, 8
and ecx, 0xff
mov esi, dword [ecx*4 + 0x6038a0]
mov ecx, edx
shr ecx, 0x10
and esi, 0xff0000
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x603ca0]
and ecx, 0xff000000
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x6040a0]
xor esi, ecx
movzx ecx, dl
mov ecx, dword [ecx*4 + 0x6044a0]
and ecx, 0xff00
xor esi, ecx
xor esi, dword [eax - 4]
xor esi, dword [edi]
add edi, 4
mov dword [eax + 0xc], esi
mov ecx, dword [eax]
xor ecx, esi
mov dword [eax + 0x10], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
cmp edi, 0x602798
jne 0x402640
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret