joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40206c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x42dbb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x42dc61
test eax, edx
je 0x42dc64
push 0
push 0
cmp word [eax - 0xa], 2
je 0x42dbe1
push edx
mov edx, eax
mov eax, esp
call fcn.00445d8c
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x42dbf7
push eax
lea eax, [esp + 8]
call fcn.00445d8c
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x42dc06
movzx eax, word [eax]
sub eax, ecx
jmp 0x42dc2d
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x42dc47
add ecx, 4
js 0x42dc1e
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x42dc44
push eax
mov eax, ecx
mov edx, 2
call fcn.00445158
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x42dc2b
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x42dc2d
xor eax, eax
ret
test eax, eax
je 0x42dc74
test edx, edx
jne 0x42dbc8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x435128
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0044548c
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.004c8ed2
mov edi, eax
cmp edi, 0x104
jbe 0x4350d2
mov eax, edi
add eax, eax
call fcn.00443324
mov esi, eax
jmp 0x4350d4
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.004c8ed2
push edi
push esi
call fcn.004c92de
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x43510d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4350f7
mov eax, esp
cmp esi, eax
je 0x43511a
mov eax, esi
call fcn.00443340
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x435154
cmp bl, 0
je 0x435150
cmp bl, 0x41
jl 0x43514b
cmp bl, 0x5a
jg 0x43514b
or bl, 0x20
xor al, bl
inc esi
jmp 0x43512f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x435094
Function at 0x4665e4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4665ea
ret

Function at 0x5409ff
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [esp + 4]
lea ebp, [ecx*8 - 0x4acbd259]
mov al, 1
call fcn.00dffea3
xor ch, cl
dec ebx
lodsb al, byte [esi]
test byte [0x385560b6], dl
xor dword [ecx - 0x3c7d718b], ebp
jae 0x540a11
push 0x65
cmp dword [esi + 0x1a], edi
sbb eax, 0x1d902a04
inc esp
push 0xffffffffffffffb2
loope 0x540a34
imul ecx, edx, 0x70
add edi, dword [ebp + 0x49]
jo 0x540a39
jge 0x540a81
cmp word [ebx + 0x410370ef], bx
cmp dword [ebx + 0x410370ef], ebx
fimul word [edx - 0x3f]
xchg esp, eax
mov ah, byte [ecx + 0x2955ca1a]
retf 0x2d26
inc esi
invalid
stosb byte es:[edi], al
rcr byte [esi - 0x61], 1
aad 0x60
fadd qword [ebp - 0x2f]
jmp 0x540a69

Function at 0xe32781
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov esp, esi
pushal
push 0x34c8839a
lea esp, [esp + 0x24]
jmp 0xe481ca

Function at 0xe328ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
lea esp, [esp + 0xc]
jne 0xe4aee8
lahf
mov byte [edi - 1], 0
call fcn.00e3e84c
daa
xchg dword [0xb6a4a386], esp
cmp ch, byte [esp + edi*4 - 0x7bb8c4a8]
cmp cl, al
mov edx, 0xe53566ca
mov byte [ecx + edi*4], bh
int 0x12
pop es
cmp edi, dword [ebx + 0x6d]
les edi, [ecx + 0x251984b0]
push edx
ret
Function at 0xe337a5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test edx, edx
push ebp
lea esp, [esp + 8]
je fcn.00e481c5
bswap cx
movzx cx, cl
sal ecx, cl
add edx, eax
movsx cx, cl
call fcn.00e4b6f2
aas
xchg edi, eax
xor eax, 0xb6a4a896
dec ebp
mov dword [0x3e850950], eax
push edx
sti
out dx, eax
cmp byte [ecx - 0x2b], 0x51
push eax
add al, 0x7d
xchg ecx, eax
sbb bl, byte cs:[edi]
xor esi, dword [ebp + ecx*4 - 0xb]
loope 0xe32e57
add al, 0x2a
cmp esp, 0x15
jg 0xe32e5f
jae 0xe32e5c
outsb dx, byte [esi]
dec eax
imul eax, dword [edi + 0x42], 0x7c70bb16
fcmove st(0), st(7)
fidiv dword [ecx - 0x30]
nop
stosd dword es:[edi], eax
dec esi
pushal
test al, 0x8b
mov esp, 0x8abddb8f
fstp xword [ebp - 0x4bb3f76]
dec ebx
rcl dword [edx]
add al, 0xa7
rol byte [ebx + edi*8 + 0x4b], 0xd1
adc al, byte [edi]
imul edi, edx, 0xffffffb0
cmpsd dword [esi], dword es:[edi]
xor ch, bh
ja 0xe32e22
cmp al, 0x64
mov byte [0xc5bf7c14], al
jae 0xe32e85
ja 0xe32ed8
invalid
wait
cmp ch, byte [0x93c2adab]
in al, 0x22
inc edi
loopne 0xe32eb0
scasd eax, dword es:[edi]
test al, 0x1c
and esp, dword [edx]
dec edx
cmpsb byte [esi], byte es:[edi]
inc ebp
cmp al, 0x72
pop es
mov al, byte [0xdd0b1174]
xlatb
xchg ecx, eax
stosd dword es:[edi], eax
jno 0xe32e31
aas
mov ch, 0xaa
stosb byte es:[edi], al
sub dword [ecx + 0x3e], ecx
dec esi
push 0x1c224c12
adc cl, byte [edx + 0x1c]
fidivr word [ebx + edx*8 + 0x6e]
int3
in al, 0x8a
aaa
jae 0xe32f4f
ret 0x2d59
iretd
int 0x2c
mov al, 0xaa
push esp
mov fs, word [eax - 0x6e]
loop 0xe32f7a
stosb byte es:[edi], al
fimul dword [ebx - 0x20]
cdq
pop eax
push edi
nop
xor byte [eax - 0x77], 5
dec edx
jp 0xe32f40
fisubr dword [ebp - 0x283d84be]
pushal
nop
mov cl, 7
mov esp, 0x35d95a80
or al, 0xae
inc ebp
cmp al, 0x37
dec edi
jns 0xe32f8a
mov al, byte [0xe6565d0]
xchg edx, eax
xlatb
invalid
invalid
dec ebx
mov eax, dword [0xfb78dd3a]
jbe 0xe32f87
jmp 0xe44bf1
cwde
bsr ax, bx
push ebp
rcl eax, 0x14
mov ebp, esp
pushfd
cmc
test dx, 0x6351
sub esp, 0xc
bsf eax, esi
cmp esp, 0xb9a240f7
daa
lea eax, [esi + 0x98005ce]
push esi
inc ax
pushal
dec eax
movzx ax, dl
mov dword [esp + 0x1c], edi
mov ah, bh
lahf
btr ax, bp
mov dword [esp + 0x18], ebx
bts ax, 3
rcr eax, cl
sal ah, 6
mov dword [esp + 0x14], edx
add eax, 0xd8ff7097
bsf ax, bx
movsx ax, dl
mov eax, dword [ebp + 8]
bt dx, 0xf
test eax, eax
mov word [esp], 0x63e4
pushal
push esp
lea esp, [esp + 0x38]
je fcn.00e481c5
jmp 0xe4035d
inc esi
cmp dx, bp
xor si, 0x66b
mov esi, dword [eax + 0x3c]
or dh, al
movzx dx, bl
bt bx, ax
rcl dl, 5
add esi, eax
sub dx, di
push ecx
neg dx
or dl, bh
mov edx, dword [esi + 0x78]
test dl, dl
stc
jmp 0xe32dfa
mov dword [esp + 0x30], 0xe40e09
jmp 0xe46a71
push dword [esp + 8]
push dword [eax]
pop dword [esp + 0x30]
push 0xe5dad7da
pushfd
push dword [esp + 0x38]
ret 0x3c
Function at 0xe37767
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
call fcn.00e51d46
cmc
pushal
add edx, eax
mov byte [esp], ah
mov byte [esp + 4], 1
push ebx
lea esp, [esp + 0x48]
jmp 0xe31bf5
cmp edx, 0x2d5041d8
shl al, cl
cmc
add edi, 1
rcr al, cl
clc
mov al, byte [edi]
cmc
test al, al
pushal
push eax
lea esp, [esp + 0x24]
je 0xe44adb
cmc
cmp cl, 0x45
sub al, 0x30
pushfd
cmp al, 9
push dword [esp]
lea esp, [esp + 8]
ja 0xe4aee8
stc
imul edx, edx, 0xa
push 0x7dd170d2
push dword [esp]
pushfd
cmp dh, ah
add edx, eax
pushal
pushfd
lea esp, [esp + 0x30]
jmp 0xe31bf5
pushfd
lea esp, [esp + 0x34]
je fcn.00e481c5
jmp 0xe31441
add al, 0x92
cmc
pushfd
clc
not al
cmc
test ah, ah
test al, 0xec
xor al, 0x21
jmp 0xe43288
mov word [esp + 0xc], 0x19e8
neg al
clc
bt bp, 0xf
clc
clc
ror al, 5
test cl, 0x1f
mov byte [esp + 4], al
push 0x889b7aee
pushfd
mov byte [ecx], al
bt esp, ecx
pushfd
add ecx, 1
call fcn.00e3b72d
fistp dword [edi - 0x58]
imul ebp, dword [ebp - 0x265be04a], 0x15
lodsb al, byte [esi]
rcl byte [ebp - 0x1b], 0x88
cmp al, 0xd9
dec ecx
mov ah, 0x50
jmp 0xe432cd
jmp [eax + 0xc39bd61]
bts di, 0xc
mov al, ah
mov edi, edx
rcl al, cl
mov al, 0x7b
btc cx, 0xa
mov ecx, edi
pushal
ror al, cl
cmc
mov al, byte [ecx]
stc
mov ah, al
lea esp, [esp + 0x20]
jnp 0xe52afa
not al
stc
rol al, 7
pushal
push 0x1b06cd78
jmp 0xe42b60
cmc
stc
cmc
not al
clc
clc
bt sp, 5
stc
rol al, 7
bt ax, cx
test ebp, edi
clc
add al, 0x92
cmc
not al
call fcn.00e32df4
aas
mov edi, 0xa6a5cb08
mov dh, 0x82
fdiv dword [ebp + 0x49]
imul byte [edi - 0x766ff8ed]
std
nop
mov ebp, edi
shr dword [edx - 0x3a], 1
mov ebp, 0x314a0e96
cmp eax, 0x8e2e5c62
xor byte [0x49481cdb], 0x5d
xor eax, 0x49481cdb
pop ebp
adc al, dh
pop es
sbb ebp, dword [eax - 0xafb84f9]
adc dword [ecx - 0x4f6dffe5], eax
movsd dword es:[edi], dword [esi]
mov byte [edi + 0xe], bl
push cs
mov cl, byte [0x89b4ba1b]
bound eax, qword [edi - 0x66a70d39]
loopne 0xe52b69
into
arpl ax, si
sub dword [esi], ebx
adc al, 0x2a
loope 0xe52b9a
sub ah, cl
inc ebp
inc ebp
sal byte [eax - 0xf], cl
je 0xe52b2a
inc esi
jp 0xe52bb3
xor al, 0xd3
outsb dx, byte [esi]
jnp 0xe52b3b
aam 0x19
push cs
jecxz 0xe52b78
xchg ebp, eax
push edi
jmp 0xe52b77
xchg byte [ebx], al
cli
cmp ah, ah
shr dh, 0xd5
fld dword [eax - 6]
and al, 0xa6
pop ebx
jae 0xe52bf2
push 0x6ea551d
inc ebp
sal eax, 1
dec eax
cmp eax, 0xcb05e365
retf
sub dword [esi - 0x3be8bc56], esi
add bl, dh
in eax, dx
stosb byte es:[edi], al
inc ebx
pop ss
les eax, [eax]
in eax, dx
wait
nop
mov eax, 0x80b8c436
sbb eax, dword [eax]
jb 0xe52be9
test esp, esp
sti
or al, 0x1b
cmp dword [ebx], esi
and al, 0x62
xchg dword [esi + 0x71], eax
pop edi
pop esi
pop ds
mov ch, 0xcc
jns 0xe52be7
fldcw word [edi + 0xe9e129]
popfd
push es
jmp 0xfd2be42c

Function at 0xe3cef1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 8], eax
pushfd
pushfd
push 0x59aeb987
push dword [esp + 0x14]
ret 0x18
setnp ah
mov byte [edi - 1], 0
bswap ax
not al
bswap ax
mov ax, 0x80e8
push ebx
push ebp
cwde
movsx ax, al
lea eax, [0xe4dec0]
mov byte [esp], 0xb5
pushfd
push edi
push dword [esp]
mov dword [esp + 0xc], 0xe4ccf8
jmp 0xe379ac
lea esp, [esp + 0xc]
jne 0xe4aee8
jmp 0xe387ac
Function at 0xe3d843
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0xe50201
push 0x7dcc8561
jmp 0xe449d9
mov dword [esp], ebx
lea eax, [0x48ce08d1]
bswap eax
pushfd
pushal
lea eax, [0xe4dec0]
push 0x457868b6
jmp 0xe4598a
jmp 0xe49517
mov dword [esp + 0x24], 0xe44eba
pushal
mov dword [esp + 0x40], eax
push 0x219a5973
push dword [esp + 0x44]
ret 0x48
push 0x8b0633b9
lea esp, [esp + 0x48]
jne 0xe4aee8
cwde
mov byte [edi - 1], 0
setns al
jmp 0xe41ecf

Function at 0xe3d877
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x14]
jb 0xe481ca
jmp 0xe3ca18

Function at 0xe40999
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
lea esp, [esp + 0x28]
jne fcn.00e481c5
rcl cl, 3
cmp bp, 0x74d3
mov ecx, edi
pushfd
rcr si, cl
sub ecx, ebx
cmp si, 0xc21f
not si
or esi, ebx
jmp 0xe3bdfa
lea esi, [esp + 4]
sub esp, 0xfffffffc
push dword [esp + 4]
mov word [esp], ax
lea esp, [esp + 0x2c]
jae 0xe481ca
adc cl, 0x6a
ror ebx, 0xc
mov ebx, eax
shr ch, cl
mov edi, eax
sbb ch, dl
sub cx, bp
rcr ch, cl
mov ecx, 0x104
push edx
clc
jmp 0xe49c64
sub al, al
bt ebx, 0x11
repne scasb al, byte es:[edi]
pushfd
jmp 0xe36cc3

Function at 0xe41032
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x28]
jae fcn.00e481c5
pushal
pushfd
pushfd
push 0x945502b3
lea esp, [esp + 0x2c]
jmp 0xe4d57d

Function at 0xe4247e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec ebp
sti
mov ebx, dword [edx + 0x20]
bsf cx, bp
ror cx, cl
rol ch, cl
add ch, bh
add ebx, eax
ror ch, cl
btr ecx, ebx
mov dword [ebp - 8], 0
shl cx, 8
mov ecx, dword [edx + 0x18]
sub esp, 0xfffffff8

Function at 0xe454af
Capabilities:
Check for software breakpoints

Disassembly:
mov word [esp], si
lea esp, [esp + 4]
jne 0xe31bd8
jmp 0xe48842
push 0xf8b618ed
bswap eax
bswap ax
mov eax, dword [edx + 8]
push ecx
pushfd
mov word [esp + 4], di
lea esp, [esp + 0xc]
jmp 0xe4008f

Function at 0xe46ce5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x24]
ja 0xe4aee8
call fcn.00e4f1ce
adc edi, dword [edx + ebx - 0x495a1985]
das
pushfd
dec ecx
test dword [eax + ebp*2 - 0x57], edx
ret 0xa226

Function at 0xe4d9db
Capabilities:
Check for software breakpoints

Disassembly:
pushal
lea esp, [esp + 0x28]
jne 0xe31bd8
bswap eax
cwde
cwde
mov eax, dword [edx + 8]
pushfd
pushal
mov byte [esp + 0x10], al
lea esp, [esp + 0x24]
jmp 0xe4008f
Function at 0xe51a4d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0x537c4934
jmp 0xe34eb9
shl byte [ebx - 0x32352a7c], 1
invalid
bt dx, 7
push dword [edi]
pop dword [esp]
call fcn.00e3de7a
outsd dx, dword [esi]
jbe 0xe34f43
pop dword [eax]
add byte [edi + 0x76], ch
js 0xe34e73
cmpsd dword [esi], dword es:[edi]
enter 0xffffffffffffb6a4, 0x5b
push eax
and edi, dword [edi - 0x24d8546e]
jo 0xe34ec5
xchg dword [ebx + 0x61ad0450], ebx
out dx, al
jle 0xe34ef7
jmp 0xbaa92d69
inc edx
invalid
cmp eax, 0x1b7edbbe
rol dword [ebp - 0x47], cl
jo 0xe34f35
add dword [ecx + ecx*4 + 0x55], ebx
jbe 0xe34f79
mov dword [ebp + 0x76], edx
jb 0xe34f47
aas
dec ebx
lodsb al, byte [esi]
inc edi
and byte [esi + 0x6c], bh
test cl, bl
in eax, 0x48
movsb byte es:[edi], byte [esi]
dec ecx
sub eax, 0xe092dc18
sub byte [esi], dh
jb 0xe34f18
loopne 0xe34f42
jb 0xe34f18
pop es
ljmp 0x6ab3
sub dh, cl
cwde
mov es, edi
cdq
add al, 0xc0
ror ebp, 0x2e
aaa
enter 0xffffffffffffcce7, 0xffffffffffffff9d
out 0xcc, eax
popfd
push edi
xlatb
cmp cl, byte [ebx]
jns 0xe34eee
pop ecx
jae 0xe34f03
stosd dword es:[edi], eax
push ecx
xor eax, 0xdc6a0c6d
in al, dx
adc byte [ecx - 0x6e], dl
push eax
push edx
cmpsd dword [esi], dword es:[edi]
rcr byte [edi + 0x61f80162], 1
inc esp
or byte [edi + 5], bl
dec ecx
fadd st(4)
sbb dh, byte [edi + 0x7d21846d]
adc al, 0x4e
mov bh, 0x6d
test byte [ecx], ah
jge 0xe34f85
dec esi
clc
inc edx
mov ah, 0xde
push esp
sub dword [ebp + 0x74], edx
add dl, bl
movsb byte es:[edi], byte [esi]
pop ecx
insd dword es:[edi], dx
inc edx
jp 0xe34fd6
je 0xe34f7b
fisub dword [ecx + ebx*2 + 0x547a426d]
adc ch, byte [esi]
mov ebx, 0x28d5e583
mov edx, 0x327cbc0
test eax, 0xbb26444a
jg 0xe34fe3
mov ch, 0xfa
mov eax, 0xb6a4ca19
shl byte [esi], 1
mov dword [0x39ba2a3f], eax
sub eax, 0xb73bb2be
mov edx, 0x28e0076e
les esi, [edi + 0x15052c8b]
jp 0xe34f45
cmp esi, dword [edi - 0x1ff89146]
sub ah, al
mov bh, 0x8b
sub al, 5
adc eax, 0x378e7a2e
aaa
aam 0x9f
lds edi, [0xc7acf117]
xchg ebp, eax
rcr esp, 0x60
adc eax, 0xce763451
xchg edx, eax
xchg edi, edi
fldpi
pop edx
pop ebx
invalid
jno 0xe34fa7
push esp
cmp dword [eax + eax*2 + 0x4f], 0xb2439a4b
xchg ecx, eax
or al, 0xaa
or al, 0xaa
arpl word [eax], si
jno 0xe34f6b
out 0xf, ax
loop 0xe34ffb
aad 0xf2
shl ebx, 0x35
sub eax, 0xa4af36e0
push 0x14fd07e7
lea ecx, [ecx + 0x42]
std
adc al, 0x8d
dec ecx
inc edx
mov es, word [esi + 0x6bc00425]
jecxz 0xe34fb7
call 0x9aaff2a8
int 0x80
stosd dword es:[edi], eax
or dh, byte [ebx - 0x1ffd4bdc]
mov edi, 0x9fc37727
int 0xac
cmp eax, 0x9bbc20a3
invalid
lea esp, [esp + 0x30]
jne fcn.00e481c5
sal esi, 0x1b
setbe cl
sar si, cl
mov ecx, edi
bsf si, di
sub ecx, ebx
adc si, sp
mov esi, esp
test si, dx
push esi
sub edi, 4
jmp 0xe33b25
pushal
test dl, ch
repne scasb al, byte es:[edi]
pushfd
pushfd
jmp 0xe4f83c

Function at 0xe52edf
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, dword [edx + 8]
push 0xca89207e
pushal
pushfd
pushfd
lea esp, [esp + 0x2c]
jmp 0xe4008f
lea esp, [esp + 0x2c]
jne 0xe31bd8
mov ah, ah
jmp 0xe5234b
Function at 0x402a30
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x423ff0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402ac4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a81
cmp dword [ebp + 0x10], ebx
jne 0x402ab8
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a30
test eax, eax
jne 0x402a93
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a68
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405d6f
cmp eax, ebx
je 0x402acb
push ebx
push dword [0x423ff0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402ac4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x423ff0], ebx
jne 0x402ac1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ac1
jmp 0x402ac4
Function at 0x402edc
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f09
mov ecx, dword [0x423f98]
push edi
add eax, ecx
push edi
push eax
mov dword [0x4170ec], eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403007
cmp eax, edi
jl 0x403000
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409018]
call ebx
test eax, eax
je 0x402ffd
cmp dword [ebp - 4], esi
jne 0x402ffd
push dword [ebp + 8]
add dword [0x4170ec], esi
call fcn.00403007
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403000
cmp dword [ebp + 0x10], edi
jne 0x402fcc
cmp dword [ebp + 8], edi
jle 0x402ff8
mov esi, 0x4130a8
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402f7c
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409018]
call ebx
test eax, eax
je 0x402ffd
cmp edi, dword [ebp - 4]
jne 0x402ffd
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402fc8
cmp dword [ebp + 0x14], edi
jne 0x402fc8
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x4170ec], eax
cmp dword [ebp + 8], 0
jg 0x402f6f
jmp 0x402ff8
push 0xfffffffffffffffe
jmp 0x402fff
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x402fd7
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409018]
call ebx
test eax, eax
je 0x402ffd
mov eax, dword [ebp - 4]
add dword [0x4170ec], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403000
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403007
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x4170ec]
mov edi, eax
sub esi, dword [0x40b01c]
add edi, 0x1f4
add esi, dword [esp + 0x1c]
cmp esi, ebp
jle 0x4031dd
push dword [0x41f0fc]
call fcn.0040321a
push ebp
push ebp
push dword [0x40b01c]
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f0f8], esi
mov dword [0x4170e8], ebp
mov eax, dword [0x4170f0]
mov ebx, 0x4000
sub eax, dword [0x41f0fc]
cmp eax, ebx
jg 0x40307a
mov ebx, eax
mov esi, 0x4130a8
push ebx
push esi
call fcn.004031e8
test eax, eax
je 0x4031a8
add dword [0x41f0fc], ebx
mov dword [0x40b038], esi
mov dword [0x40b03c], ebx
cmp dword [0x423f4c], ebp
je 0x40310b
cmp dword [0x423fe0], ebp
jne 0x40310b
cmp dword [esp + 0x10], ebp
je 0x4030d8
mov eax, dword [0x41f0f8]
push ebp
sub eax, dword [0x4170ec]
sub eax, dword [esp + 0x20]
add eax, dword [0x40b01c]
mov dword [0x4170e8], eax
call fcn.00405da8
jmp 0x40310b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x40310b
mov eax, dword [0x423f48]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x402b35
push ebp
push 0x6f
push dword [0x423f40]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
mov ecx, 0x40b020
mov dword [0x40b040], 0x40b0a8
mov dword [0x40b044], 0x8000
call fcn.00405e69
test eax, eax
jl 0x4031b1
mov esi, dword [0x40b040]
mov eax, 0x40b0a8
sub esi, eax
je 0x403172
lea ecx, [esp + 0x14]
push ebp
push ecx
push esi
push eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4031ad
cmp esi, dword [esp + 0x14]
jne 0x4031ad
add dword [0x40b01c], esi
cmp dword [0x40b03c], ebp
jne 0x4030a0
jmp 0x40317e
cmp dword [0x40b03c], ebp
jne 0x4031b1
cmp ebx, ebp
je 0x4031b1
mov eax, dword [0x4170ec]
mov ecx, eax
sub ecx, dword [0x40b01c]
add ecx, dword [esp + 0x1c]
test ecx, ecx
jg 0x403064
push ebp
push ebp
push eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4031b6
or eax, 0xffffffff
jmp 0x4031df
push 0xfffffffffffffffe
jmp 0x4031b3
push 0xfffffffffffffffd
pop eax
jmp 0x4031df
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x4031dd
mov eax, dword [0x41f0f8]
push ebp
push ebp
push 0x113
push esi
mov dword [0x4170e8], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x4052e3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422550], 0x44
push eax
xor eax, eax
push 0x422550
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40531e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4053a8
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.0040564a
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x4053de
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423fc8], eax
jmp 0x405563
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x4053f9
test eax, eax
je 0x40550e
test cl, 2
je 0x40550e
mov esi, 0x421550
push ebx
push esi
call fcn.00405a76
cmp dword [ebp + 8], 0
je 0x405418
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40541e
push ebx
call fcn.004055b0
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405504
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405594
cmp byte [eax], 0
je 0x40546f
cmp byte [ebp - 0x18], 0
je 0x40546f
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405485
mov al, byte [esi + 1]
test al, al
je 0x4054e3
cmp al, 0x2e
jne 0x405485
cmp byte [esi + 2], 0
je 0x4054e3
push esi
push edi
call fcn.00405a76
test byte [ebp - 0x148], 0x10
je 0x4054aa
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4054e3
push dword [ebp + 0xc]
push ebx
call fcn.004053a8
jmp 0x4054e3
push ebx
call fcn.0040572e
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4054db
test byte [ebp + 0xc], 4
je 0x4054d3
push ebx
push 0xfffffffffffffff1
call fcn.00404e21
push 0
push ebx
call fcn.004057c4
jmp 0x4054e3
inc dword [0x423fc8]
jmp 0x4054e3
push ebx
push 0xfffffffffffffff2
call fcn.00404e21
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40544d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40550e
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x405563
cmp dword [ebp - 8], esi
jne 0x405523
inc dword [0x423fc8]
jmp 0x405563
push ebx
call fcn.00405d48
test eax, eax
je 0x405563
push ebx
call fcn.00405569
push ebx
call fcn.0040572e
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40555b
test byte [ebp + 0xc], 4
je 0x40551b
push ebx
push 0xfffffffffffffff1
call fcn.00404e21
push esi
push ebx
call fcn.004057c4
jmp 0x405563
push ebx
push 0xffffffffffffffe5
call fcn.00404e21
pop esi
pop ebx
leave
ret 8