joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..retplne
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2603160f
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..reloc
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x648ee
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10055b1
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001700
call fcn.01005864
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x10055ec
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10055ec
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1005604
cmp eax, 0x20b
je 0x10055f1
mov dword [ebp - 0x1c], edi
jmp 0x1005618
cmp dword [ecx + 0x84], 0xe
jbe 0x10055ec
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1005612
cmp dword [ecx + 0x74], 0xe
jbe 0x10055ec
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1007068], 0xffffffff
or dword [0x100706c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1007064]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1007060]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1007070], eax
call fcn.0100585c
cmp dword [0x1007030], edi
jne 0x1005673
push fcn.0100585c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01005845
push 0x1007010
push 0x100700c
call sub.msvcrt.dll__initterm
mov eax, dword [0x100705c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1007058]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x1007008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100239a
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x10056ea
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100571f
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100589f
ret

Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4
Function at 0x407648
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d020]
jne 0x407652
repz ret
jmp fcn.00407a76

Function at 0x10004fc2
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x2dd41dbf], al
lds ebx, [ecx + 0x6c]
mov edx, 0x1f392d12
push ecx
adc dword [edx - 0x16e18be0], 0x4b
aad 0xd
jp 0x10004fa8
xor al, 0x66
ret

Function at 0x104c6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104c61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104c607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104c606a
add dl, dl
jne 0x104c6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104c60dc
xor eax, eax
add dl, dl
jne 0x104c6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104c617d
add dl, dl
jne 0x104c60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104c60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104c60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104c60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104c60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104c6075
mov eax, 1
add dl, dl
jne 0x104c60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104c60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104c60e1
sub eax, ebx
mov ebx, 1
jne 0x104c6128
mov ecx, 1
add dl, dl
jne 0x104c610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104c6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104c6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104c6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104c613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104c614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104c6136
cmp eax, 0x7d00
jae 0x104c616d
cmp eax, 0x500
jb 0x104c6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104c6075
cmp eax, 0x7f
ja 0x104c6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104c6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104c619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104c6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401488
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x42a5d0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40151d
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x4014da
cmp dword [ebp + 0x10], ebx
jne 0x401511
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.00401488
test eax, eax
jne 0x4014ec
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014c1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405a06
cmp eax, ebx
je 0x401524
push ebx
push dword [0x42a5d0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x40151d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a5d0], ebx
jne 0x40151a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40151a
jmp 0x40151d
Function at 0x402eb3
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
mov dword [ebp - 8], esi
jne 0x402ed3
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
test edi, edi
mov ebx, edi
jne 0x402ee2
mov ebx, 0x410908
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402ef7
mov ecx, dword [0x42a538]
add ecx, eax
push ecx
call fcn.00402e9c
push 4
lea eax, [ebp + 0x14]
push eax
call fcn.00402e6a
test eax, eax
jne 0x402f0e
push 0xfffffffffffffffd
pop eax
jmp 0x403073
test dword [ebp + 0x14], 0x80000000
je 0x403052
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x420910
mov dword [ebp - 0xc], eax
call fcn.004065ca
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x403070
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402f4e
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x40c908
push edi
call fcn.00402e6a
test eax, eax
je 0x402f06
sub dword [ebp + 0x14], esi
mov dword [0x420928], edi
mov dword [0x42092c], esi
mov eax, dword [ebp - 8]
mov ecx, 0x420910
mov dword [0x420930], ebx
mov dword [0x420934], eax
call fcn.004065ea
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x403044
mov esi, dword [0x420930]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x42a5d4], 1
mov edi, eax
je 0x402ff2
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402fb9
cmp dword [ebp + 0x14], 0
jne 0x402ff2
push dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x94]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
push 0
call fcn.004048e2
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x403039
cmp dword [ebp + 0x10], eax
jne 0x40301b
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40304b
cmp dword [ebp - 0x14], esi
jne 0x40304b
add dword [ebp - 4], esi
jmp 0x40302d
sub dword [ebp - 8], esi
add dword [ebp - 4], esi
cmp dword [ebp - 8], 1
mov ebx, dword [0x420930]
jl 0x403070
cmp dword [ebp - 0x10], 1
jne 0x402f6d
jmp 0x403070
cmp dword [ebp + 0x14], eax
jg 0x402f41
jmp 0x403070
push 0xfffffffffffffffc
jmp 0x402f08
push 0xfffffffffffffffe
jmp 0x402f08
test edi, edi
je 0x4030b9
cmp dword [ebp + 0x14], esi
jge 0x40305e
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00402e6a
test eax, eax
je 0x402f06
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403085
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x40c908
push edi
call fcn.00402e6a
test eax, eax
je 0x402f06
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40304b
cmp esi, dword [ebp + 0x10]
jne 0x40304b
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x40307a
jmp 0x403070
Function at 0x40553b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x4251e0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x4251e0], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405576
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40572b
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405748
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x40574b
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x40577a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x408994]
mov dword [ebp - 8], eax
mov eax, dword [0x408998]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4057ca
test edi, edi
jne 0x405787
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x4057c4

Function at 0x4057ce
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor edi, edi
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push edi
push dword [ebp + 0xc]
mov word [esi], di
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405842
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x800
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40582f
cmp dword [ebp + 0x14], 1
je 0x405832
cmp dword [ebp + 0x14], 2
je 0x405832
mov word [esi], di
push dword [ebp + 0x18]
mov word [esi + 0x7fe], di
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x405e79
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425228
push esi
call fcn.00405901
push esi
call fcn.00405654
mov edi, eax
test edi, edi
jne 0x405e9a
xor eax, eax
jmp 0x405ef8
push edi
call fcn.00405930
test byte [0x42a548], 0x80
je 0x405eb7
movzx eax, word [edi]
test ax, ax
je 0x405e96
cmp ax, 0x5c
je 0x405e96
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x405ed9
push esi
call fcn.004059df
test eax, eax
je 0x405ed3
test byte [eax], 0x10
je 0x405efd
push esi
call fcn.00405e4d
push esi
call ebx
cmp eax, edi
jg 0x405ec4
push esi
call fcn.00405e1e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405ef7
Function at 0x40618f
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x408a7c
mov ebx, 0x425a28
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
cmp edi, ebp
mov esi, 0x400
je 0x4061dd
push 1
push ebp
push edi
call fcn.0040574b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406354
cmp eax, esi
jg 0x406354
push esi
mov edi, 0x427878
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406354
cmp eax, esi
jg 0x406354
push ebp
push ebp
push esi
push 0x426228
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x406354
push ebp
push ebp
push esi
mov esi, 0x426878
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x406354
push esi
push 0x426228
push str._s_s_r_n
push 0x426c78
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x42a4ec]
push dword [eax + 0x128]
push edi
call fcn.00405f01
push 4
push 0xc0000000
push edi
call fcn.0040574b
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x406354
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x40634a
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40634a
cmp edi, dword [esp + 0x10]
jne 0x40634a
push str._Rename__r_n
push esi
call fcn.004056b1
cmp eax, ebp
jne 0x4062e1
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x406312
push 0x408a70
add eax, 0xa
push eax
call fcn.004056b1
mov ebp, eax
test ebp, ebp
je 0x406310
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x406303
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x4062fd
sub ebp, esi
inc ebp
mov eax, ebp
xor ebp, ebp
jmp 0x406314
xor ebp, ebp
mov eax, edi
push ebx
push 0x426c78
add eax, esi
push eax
call fcn.00405707
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40638d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405e79
mov ecx, dword [ebp + 0xc]
test cl, 8
mov dword [ebp - 0xc], eax
je 0x4063c2
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x42a5a8], eax
jmp 0x406557
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x4063dd
test eax, eax
je 0x406502
test cl, 2
je 0x406502
push edi
push ebx
mov esi, 0x427078
push esi
call fcn.00405901
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406400
push str..
push esi
call edi
jmp 0x406406
push ebx
call fcn.00405e4d
push 0x4082c8
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebx + eax*2]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x4064f2
lea esi, [ebp - 0x230]
push 0x3f
mov eax, esi
push eax
call fcn.00405600
xor edi, edi
cmp word [eax], di
je 0x406455
cmp word [ebp - 0x28], di
je 0x406455
lea esi, [ebp - 0x28]
cmp word [esi], 0x2e
jne 0x406470
movzx eax, word [esi + 2]
cmp ax, di
je 0x4064cf
cmp ax, 0x2e
jne 0x406470
cmp word [esi + 4], di
je 0x4064cf
push esi
push dword [ebp - 4]
call fcn.00405901
test byte [ebp - 0x25c], 0x10
je 0x406497
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4064cf
push dword [ebp + 0xc]
push ebx
call fcn.0040638d
jmp 0x4064cf
push ebx
call fcn.0040572b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4064c7
test byte [ebp + 0xc], 4
je 0x4064bf
push ebx
push 0xfffffffffffffff1
call fcn.004048e2
push edi
push ebx
call fcn.0040635a
jmp 0x4064cf
inc dword [0x42a5a8]
jmp 0x4064cf
push ebx
push 0xfffffffffffffff2
call fcn.004048e2
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406435
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4064f4
xor edi, edi
cmp dword [ebp + 8], edi
pop edi
je 0x406502
mov eax, dword [ebp - 4]
and word [eax - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406556
cmp dword [ebp - 0xc], esi
je 0x406546
push ebx
call fcn.004059df
test eax, eax
je 0x406556
push ebx
call fcn.00405e1e
push ebx
call fcn.0040572b
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40654e
test byte [ebp + 0xc], 4
je 0x406546
push ebx
push 0xfffffffffffffff1
call fcn.004048e2
push esi
push ebx
call fcn.0040635a
jmp 0x406556
inc dword [0x42a5a8]
jmp 0x406556
push ebx
push 0xffffffffffffffe5
call fcn.004048e2
pop esi
pop ebx
leave
ret 8
Function at 0x40655c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42807c], 0
jne 0x406597
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406570
mov dword [ecx*4 + 0x428078], eax
inc ecx
cmp ecx, 0x100
jl 0x40656b
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4065c4
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x428078]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4065a5
not eax
pop ebp
ret 0xc
Function at 0x1001609
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push edx
mov edi, 0x30
mov esi, dword fs:[edi]
push eax
mov eax, dword [esi + 8]

Function at 0x1001618
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esi, 0xc
mov edx, dword [esi]
mov esi, dword [edx + 0xc]
push ecx
mov edx, esi
add edx, 0x18
mov edi, dword [edx]
test edi, edi
je 0x100164d
mov edx, dword [esi + 0x30]
mov ecx, dword [edx]
and ecx, 0xdf00df
mov edx, dword [edx + 0xb]
add edx, ecx
shr edx, 2
sub edx, 0xc914cd2
test edx, edx
je 0x1001653
mov edx, dword [esi]
lea esi, [edx]
jmp 0x1001621
mov esi, dword [edi + 0x3c]
add esi, edi
mov edx, dword [esi + 0x78]
add edx, edi
push ebx
mov ecx, dword [edx + 0x20]
add ecx, edi
mov ebx, dword [ecx]
add ebx, edi
mov esi, dword [ebx + 0xb]
sub esi, 0x746365
test esi, esi
jne 0x1001679
jmp 0x100167f
inc ecx
inc ecx
inc ecx
inc ecx
jmp 0x1001663
mov esi, dword [edx + 0x20]
sub ecx, edi
sub ecx, esi
shr ecx, 1
add dword [ebx - 0xefcdb8e], ecx
add esi, edi
mov ecx, dword [esi]
mov esi, dword [edx + 0x1c]
and ecx, 0xffff
shl ecx, 2
add esi, ecx
add esi, edi
mov ecx, dword [esi]
mov ebx, 0x40
push edi
add ecx, edi
lea esi, [0x28000]
mov edx, 0x44000
push eax
push esi
add edx, eax
push esp
push ebx
push esi
push edx
call ecx
pop ecx
pop eax
push ebx
lea edx, [0x12f24]
lea edi, [0x1085]
mov esi, 0x44000
add esi, eax
lea ecx, [4]
imul edi, ecx
add edi, eax
add edi, 0x600
call 0x100170a
lea esi, [0x59000]
mov edi, 0x17814
add esi, eax
add edi, eax
mov edx, 0x291c
call 0x100170a
cmp edi, esi
jne 0x1001730
add ecx, esi
mov ecx, dword [edi]
test edx, esi
xor ecx, 0x2ef7257e
cmp esi, ecx
mov dword [esi], ecx
lea ecx, [edi]
add esi, 4
add edi, 4
invalid
Function at 0x100170a
Capabilities:
Encode data using xor

Disassembly:
add esi, 0xc
mov edx, dword [esi]
mov esi, dword [edx + 0xc]
push ecx
mov edx, esi
add edx, 0x18
mov edi, dword [edx]
test edi, edi
je 0x100164d
mov edx, dword [esi + 0x30]
mov ecx, dword [edx]
and ecx, 0xdf00df
mov edx, dword [edx + 0xb]
add edx, ecx
shr edx, 2
sub edx, 0xc914cd2
test edx, edx
je 0x1001653
mov edx, dword [esi]
lea esi, [edx]
jmp 0x1001621
mov esi, dword [edi + 0x3c]
add esi, edi
mov edx, dword [esi + 0x78]
add edx, edi
push ebx
mov ecx, dword [edx + 0x20]
add ecx, edi
mov ebx, dword [ecx]
add ebx, edi
mov esi, dword [ebx + 0xb]
sub esi, 0x746365
test esi, esi
jne 0x1001679
jmp 0x100167f
inc ecx
inc ecx
inc ecx
inc ecx
jmp 0x1001663
mov esi, dword [edx + 0x20]
sub ecx, edi
sub ecx, esi
shr ecx, 1
add dword [ebx - 0xefcdb8e], ecx
add esi, edi
mov ecx, dword [esi]
mov esi, dword [edx + 0x1c]
and ecx, 0xffff
shl ecx, 2
add esi, ecx
add esi, edi
mov ecx, dword [esi]
mov ebx, 0x40
push edi
add ecx, edi
lea esi, [0x28000]
mov edx, 0x44000
push eax
push esi
add edx, eax
push esp
push ebx
push esi
push edx
call ecx
pop ecx
pop eax
push ebx
lea edx, [0x12f24]
lea edi, [0x1085]
mov esi, 0x44000
add esi, eax
lea ecx, [4]
imul edi, ecx
add edi, eax
add edi, 0x600
call 0x100170a
lea esi, [0x59000]
mov edi, 0x17814
add esi, eax
add edi, eax
mov edx, 0x291c
call 0x100170a
cmp edi, esi
jne 0x1001730
add ecx, esi
mov ecx, dword [edi]
test edx, esi
xor ecx, 0x2ef7257e
cmp esi, ecx
mov dword [esi], ecx
lea ecx, [edi]
add esi, 4
add edi, 4
invalid