joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424b50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
xor bl, bl
push dword [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424baf
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x424ca0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x424d42
test ebx, ebx
jne 0x424d07
call fcn.00412470
mov ecx, eax
call fcn.004124f0
mov ebx, eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x424d2d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x424d42
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.004314a6
mov esp, ebp
pop ebp
ret 0x10

Function at 0x424d60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
push esi
movq qword [ebp - 0x21c], xmm0
mov eax, 0x614
mov word [ebp - 0x21c], ax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
movq qword [ebp - 0x22c], xmm0
mov dword [ebp - 0x214], 0
mov word [ebp - 0x210], 0
push eax
mov esi, ecx
movq qword [ebp - 0x224], xmm0
mov dword [ebp - 0x216], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x212], 0
call sub.MSVCR110.dll_memset
push esi
push 0x44a694
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.00401000
lea eax, [ebp - 0x20c]
add esp, 0x1c
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x22c]
push eax
mov dword [ebp - 0x228], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
test eax, eax
sete al
xor ecx, ebp
pop esi
call fcn.004314a6
mov esp, ebp
pop ebp
ret
Function at 0x424e40
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x424e99
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
je 0x424e99
mov eax, dword [0x457bd8]
test al, 1
jne 0x424e82
or eax, 1
push 0x436ff0
mov dword [0x457bd8], eax
mov dword [0x457bd4], 0
call fcn.00431596
add esp, 4
push esi
push str.Failed_to_create_directory_:__s
push 0x457bd4
call fcn.0042ab50
add esp, 0xc
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x424ea0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov edi, ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push str.main
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x424f23
lea eax, [ebp - 0x20c]
push eax
push 0x208
push esi
call fcn.004078a0
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret 8
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push str...configmain
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x424f8c
lea eax, [ebp - 0x414]
push eax
push 0x208
push esi
call fcn.004078a0
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor al, al
pop esi
call fcn.004314a6
mov esp, ebp
pop ebp
ret 8

Function at 0x4252c0
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x425325
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x425307
mov eax, dword [ebp - 0x28]
and eax, 0xffffff7f
test al, 1
je 0x425307
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x425325
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.004314a6
mov esp, ebp
pop ebp
ret 4
Function at 0x425560
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
push str.RtlGetVersion
push str.ntdll
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4255b5
lea ecx, [ebp - 0x120]
push ecx
call eax
test eax, eax
je 0x4255ca
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x425719
cmp dword [ebp - 0x110], 2
jne 0x425719
mov eax, dword [ebp - 0x11c]
cmp eax, 4
ja 0x4255f5
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x42564b
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x425617
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x42562f
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x425719
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x4256f2
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x425676
cmp byte [ebp - 6], 1
setne al
add eax, 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x425695
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 7
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x4256ad
mov eax, 9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x4256c5
mov eax, 0xa
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
cmp eax, 4
jne 0x4256dd
mov eax, 0xb
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
jbe 0x425719
mov eax, 0x64
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x425714
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x4256df
mov eax, 0xb
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
cmp eax, 7
jae 0x4256df
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004314a6
mov esp, ebp
pop ebp
ret
Function at 0x425ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x80
mov eax, dword [0x455070]
xor eax, esp
mov dword [esp + 0x7c], eax
push esi
push edi
push ecx
lea eax, [esp + 0x1c]
push eax
mov esi, 0x409
mov dword [esp + 0x10], 0
call fcn.00412470
mov ecx, eax
call fcn.0041fb80
lea ecx, [esp + 8]
push ecx
mov ecx, eax
call fcn.004059f0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [esp + 0x18]
call fcn.00405b70
mov eax, dword [esp + 8]
test eax, eax
je 0x425bd0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
push ecx
push 0
push str.language
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x24], 4
call edi
test eax, eax
jne 0x425b7b
mov esi, dword [esp + 0x14]
jmp 0x425c43
xor eax, eax
push 0x4e
push eax
mov word [esp + 0x38], ax
lea eax, [esp + 0x3a]
push eax
mov dword [esp + 0x18], 0x28
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push str.language
push dword [esp + 0x1c]
call edi
test eax, eax
jne 0x425c43
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.MSVCR110.dll__wtoi]
add esp, 4
mov esi, eax
jmp 0x425c43
push ecx
lea eax, [esp + 0x1c]
push eax
call fcn.00412470
mov ecx, eax
call fcn.0041fb80
lea ecx, [esp + 8]
push ecx
mov ecx, eax
call fcn.004059f0
push eax
push SysReAllocString
call edi
lea ecx, [esp + 0x18]
call fcn.00405b70
mov eax, dword [esp + 8]
test eax, eax
je 0x425c4d
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
push 0
push str.language
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 4
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
cmove esi, dword [esp + 0x10]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x84]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.004314a6
mov esp, ebp
pop ebp
ret

Function at 0x428d00
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x428d31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 8], esi
call fcn.00432ed0
mov dword [esp + 0xc], eax
test esi, esi
jne 0x428d39
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x44ac08
lea ecx, [esp + 8]
call fcn.00428bb0
int3
Function at 0x428f70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435aa0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x455070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_class_std::exception_const__]
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push eax
lea ecx, [esi + 0x14]
call fcn.00406610
mov dword [ebp - 4], 1
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x428fe6
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x429cb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435ac8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x455070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_class_std::exception_const__]
mov dword [ebp - 4], 0
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push eax
lea ecx, [edi + 0x14]
call fcn.00406610
mov dword [edi + 0x2c], vtable.boost::exception.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42a850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
push esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
test eax, eax
je 0x42a929
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x42a929
push edi
push 0x100
call fcn.00431374
mov edx, dword [ebp + 0xc]
mov edi, eax
push edi
call fcn.0042a930
add esp, 8
test eax, eax
jne 0x42a895
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
push ebx
xor ebx, ebx
xor ecx, ecx
test eax, eax
jle 0x42a90d
sub dword [ebp - 4], esi
mov dword [ebp - 8], eax
inc ebx
and ebx, 0x800000ff
jns 0x42a8b8
dec ebx
or ebx, 0xffffff00
inc ebx
mov dl, byte [ebx + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x42a8d0
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ecx + edi]
mov byte [ebx + edi], al
mov dword [ebp - 0x10], ecx
mov byte [ecx + edi], dl
movzx ecx, byte [ebx + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x42a8f6
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ecx + edi]
mov ecx, dword [ebp - 4]
inc esi
xor al, byte [ecx + esi - 1]
dec dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov byte [esi - 1], al
jne 0x42a8a7
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
push edi
mov dword [eax], edx
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
add esp, 4
or eax, 0xffffffff
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42a930
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov ecx, edx
xor eax, eax
mov dword [ebp - 8], ecx
test esi, esi
je 0x42a9a4
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x42a945
push ebx
push edi
mov dword [ebp - 4], 0
xor edi, edi
jmp 0x42a960
mov eax, edi
cdq
idiv ecx
mov bl, byte [edi + esi]
movzx ecx, bl
movzx eax, byte [edx + str._______UDPARC4KEYFORHARDKORE1.0.0PACKET1234567890Talkwithfriends_family_orteammatesoverafastandclearconnectionAbilitytousetextchatforanyonewithoutamicrophoneNativeclientandserversupportforall3majorplatformsAutomaticmicrophonevolumenormalizationAd]
add eax, dword [ebp - 4]
add ecx, eax
and ecx, 0x800000ff
jns 0x42a987
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov dword [ebp - 4], ecx
mov byte [ecx + esi], bl
mov ecx, dword [ebp - 8]
cmp edi, 0x100
jl 0x42a960
pop edi
or eax, 0xffffffff
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42aa80
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x435c48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x455070]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x455070]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push 0x44adb8
lea ecx, [esp + 0x14]
call fcn.004065b0
mov dword [esp + 0x38], 0
call fcn.00412470
mov ecx, eax
call fcn.004124f0
push eax
lea ecx, [esp + 0x14]
call fcn.0040e930
lea ecx, [esp + 0x10]
call fcn.004059f0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [esp + 0x10]
setne bl
mov dword [esp + 0x38], 0xffffffff
call fcn.00405b70
push esi
test bl, bl
je 0x42ab1b
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x42ab30
mov eax, dword [edi]
test eax, eax
je 0x42ab2a
push 0xffffffffffffffff
call eax
add esp, 8
jmp 0x42ab30
push ecx
call fcn.0042aef0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004314a6
mov esp, ebp
pop ebp
ret 4

Function at 0x42ac00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
test dword [0x457230], 0x40000000
je 0x42ac1f
push dword [ebp + 8]
call fcn.0042abc0
add esp, 4
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret
Function at 0x42ac40
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [0x457234]
test ecx, ecx
je 0x42adb2
cmp eax, ecx
jbe 0x42adb2
mov edx, dword [0x457238]
push ebx
push esi
test edx, edx
je 0x42ad5b
cmp edx, ecx
jae 0x42ad5b
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
sub eax, edx
push eax
push edi
call esi
push dword [0x457238]
call fcn.00431374
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x42acb2
push 2
push eax
push eax
push edi
call esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x457238]
xor esi, esi
test eax, eax
je 0x42ace4
lea ecx, [ecx]
push 0
lea ecx, [ebp - 4]
push ecx
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42ad34
add esi, dword [ebp - 4]
mov eax, dword [0x457238]
cmp esi, eax
jb 0x42acc0
mov eax, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push edi
call eax
push 2
lea edx, [ebp - 8]
mov ecx, edi
mov dword [ebp - 8], 0xfeff
call fcn.0042ac00
add esp, 4
lea eax, [ebp - 4]
push 0
push eax
push dword [0x457238]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
cmp esi, dword [0x457238]
jae 0x42ace4
push ebx
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
mov eax, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 4
push 2
push 0
push 0
push edi
call eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test dword [0x457230], 0x40000000
mov dword [ebp - 4], 0xfeff
je 0x42ad8f
mov al, byte [ebp - 3]
mov byte [ebp - 4], 0xa5
test al, al
je 0x42ad8f
cmp al, 0x5a
je 0x42ad8f
xor al, 0x5a
mov byte [ebp - 3], al
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42adc0
Capabilities:
Get file size
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x457228], 0
push edi
mov edi, edx
je 0x42aee3
push esi
push 0x80
push 0x457264
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push 0x457264
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42aee2
mov ecx, dword [0x457230]
and ecx, 4
test cl, 7
je 0x42ae24
mov ecx, esi
call fcn.0042ac40
push ebx
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42ae82
test dword [0x457230], 0x40000000
mov dword [ebp - 4], 0xfeff
je 0x42ae6c
mov al, byte [ebp - 3]
mov byte [ebp - 4], 0xa5
test al, al
je 0x42ae6c
cmp al, 0x5a
je 0x42ae6c
xor al, 0x5a
mov byte [ebp - 3], al
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 8], 0
call ebx
test edi, edi
jne 0x42ae8a
xor ecx, ecx
jmp 0x42aea1
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ae90
sub ecx, edx
sar ecx, 1
add ecx, ecx
test dword [0x457230], 0x40000000
je 0x42aec8
push ecx
mov edx, edi
mov ecx, esi
call fcn.0042abc0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edi
push esi
mov dword [ebp - 8], 0
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1e18656a
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3cc30f6d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219