joyce8/EMBER2024-capa huggingface dataset:
Function at 0x632a10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd10
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea esi, [ebp - 0x2e4]
mov ebx, 0x742430
xor eax, eax
push ebp
push 0x632cab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x632cc8
call fcn.004093ec
lea eax, [ebx + 4]
mov edx, 0x632ce0
call fcn.004093ec
lea eax, [ebx + 8]
mov edx, 0x632cfc
call fcn.004093ec
lea eax, [ebx + 0xc]
mov edx, 0x632d14
call fcn.004093ec
lea eax, [ebx + 0x10]
mov edx, 0x632d2c
call fcn.004093ec
lea eax, [ebx + 0x14]
mov edx, 0x632d44
call fcn.004093ec
lea eax, [ebx + 0x18]
mov edx, 0x632d5c
call fcn.004093ec
lea eax, [ebx + 0x1c]
mov edx, 0x632d78
call fcn.004093ec
lea eax, [ebx + 0x20]
mov edx, 0x632d90
call fcn.004093ec
lea edx, [ebp - 0x2e8]
mov eax, dword [0x682c74]
mov eax, dword [eax]
mov eax, dword [eax + 0x398]
mov ecx, dword [eax]
call dword [ecx + 0x144]
mov edx, dword [ebp - 0x2e8]
xor ecx, ecx
mov eax, esi
call fcn.004050f4
lea edx, [ebp - 0x2ec]
mov eax, dword [0x682c74]
mov eax, dword [eax]
mov eax, dword [eax + 0x398]
mov ecx, dword [eax]
call dword [ecx + 0x144]
mov edx, dword [ebp - 0x2ec]
mov eax, 0x74201c
call fcn.004093ec
lea edx, [ebp - 0x2f0]
mov eax, dword [0x74201c]
call fcn.004235e0
mov edx, dword [ebp - 0x2f0]
mov eax, 0x742018
call fcn.004093ec
mov eax, esi
call fcn.00404da8
mov dword [0x7ae114], 1
jmp 0x632c43
lea edx, [ebp - 4]
mov eax, esi
call fcn.00405d60
mov eax, esi
call fcn.00405f5c
mov edx, dword [ebp - 4]
mov eax, 0x632da8
call fcn.0040a464
test eax, eax
jle 0x632b78
mov bx, 0x61
jmp 0x632c80
mov edx, dword [ebp - 4]
mov eax, 0x632dcc
call fcn.0040a464
test eax, eax
jle 0x632b99
mov bx, 0x63
mov eax, esi
call fcn.004051f4
jmp 0x632c80
mov edx, dword [ebp - 4]
mov eax, 0x632df0
call fcn.0040a464
test eax, eax
jle 0x632bba
mov bx, 0x78
mov eax, esi
call fcn.004051f4
jmp 0x632c80
mov edx, dword [ebp - 4]
mov eax, 0x632e08
call fcn.0040a464
test eax, eax
jle 0x632bdb
mov bx, 0x6b
mov eax, esi
call fcn.004051f4
jmp 0x632c80
lea eax, [ebp - 8]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a2b8
mov eax, dword [ebp - 8]
mov edx, 0x632e34
call fcn.0040a280
jne 0x632c43
lea edx, [ebp - 4]
mov eax, esi
call fcn.00405d60
mov eax, esi
call fcn.00405f5c
lea eax, [ebp - 8]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a2b8
mov eax, dword [ebp - 8]
mov edx, 0x632e48
call fcn.0040a280
jne 0x632c43
mov bx, 0x6e
mov eax, esi
call fcn.004051f4
jmp 0x632c80
mov eax, esi
call fcn.0040524c
test al, al
je 0x632b4d
mov bx, 0x30
mov eax, dword [0x682c74]
mov eax, dword [eax]
mov eax, dword [eax + 0x39c]
mov edx, dword [eax]
call dword [edx + 0x104]
mov eax, dword [0x682c74]
mov eax, dword [eax]
mov eax, dword [eax + 0x3a0]
mov edx, dword [eax]
call dword [edx + 0x104]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x632cb2
lea eax, [ebp - 0x2f0]
mov edx, 3
call fcn.0040906c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040906c
ret
Function at 0x64b67c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x64b694
add esp, 0xfffffff0
call fcn.0040799c
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x64b7ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.0040459c
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x64b798
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004b92e8
xor eax, eax
push ebp
push 0x64b785
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004b92e8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00409f74
jmp 0x64b756
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.0040a300
mov eax, dword [ebx + 4]
call fcn.004094fc
dec eax
jle 0x64b76a
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x64b744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b78c
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b7b5
lea eax, [ebp - 4]
call fcn.00409054
ret

Function at 0x664288
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6642f7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [0x84ceb0]
call fcn.00409434
push 1
lea eax, [ebp - 8]
call fcn.004095c4
push eax
lea eax, [ebp - 4]
call fcn.004095c4
push eax
mov eax, 0x84ceb8
call fcn.004095c4
push eax
push 0
mov eax, ebx
call fcn.00493d8c
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6642fe
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040906c
ret
Function at 0x665f38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x665fdf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x84cf7c]
mov edx, 0x665ff8
call fcn.0040a280
jne 0x665f70
mov eax, dword [0x682344]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x120]
jmp 0x665fc9
lea eax, [ebp - 4]
mov edx, dword [0x84cea4]
call fcn.00409434
mov eax, dword [0x682758]
mov eax, dword [eax]
mov edx, 0x666008
call fcn.0040a280
jne 0x665f9f
lea eax, [ebp - 4]
mov edx, dword [0x84ceb4]
call fcn.00409434
push 1
lea eax, [ebp - 4]
call fcn.004095c4
push eax
mov eax, dword [0x682758]
call fcn.004095c4
push eax
push 0x666028
push 0
mov eax, ebx
call fcn.00493d8c
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x665fe6
lea eax, [ebp - 4]
call fcn.0040900c
ret

Function at 0x667efc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x667fd3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [0x84ceb0]
call fcn.00409434
mov edx, dword [0x681e04]
mov edx, dword [edx]
mov eax, 0x667fec
call fcn.0040a464
test eax, eax
jle 0x667f59
push dword [0x84ceb0]
mov eax, dword [0x682758]
push dword [eax]
push 0x667ffc
mov eax, dword [0x681e04]
mov edx, 3
call fcn.0040a170
mov eax, dword [0x681e04]
push dword [eax]
push 0x66800c
mov eax, dword [0x682758]
push dword [eax]
push 0x668028
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a170
push 1
lea eax, [ebp - 8]
call fcn.004095c4
push eax
push 0x668034
lea eax, [ebp - 4]
call fcn.004095c4
push eax
push 0
mov eax, ebx
call fcn.00493d8c
push eax
call sub.shell32.dll_ShellExecuteW
mov edx, dword [0x682758]
mov edx, dword [edx]
mov eax, dword [0x84cea0]
call fcn.0048acf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x667fda
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040906c
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x7ba82cb7
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x70e92226
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4014f3
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x14c
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [0x4327ec]
mov dword [ebp - 0x130], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], edx
or eax, 8
mov dword [esp + 0xc], eax
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x40156c
jmp 0x401607
cmp dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x1c]
je 0x40155d
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
push ecx
jmp 0x401607
xor ecx, ecx
mov edx, edi
call fcn.004014f3
test eax, eax
je 0x40157d
jmp 0x4015a4
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea edi, [ebp - 0x121]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x12c]
sub esp, 0x10
test eax, eax
je 0x40153d
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov dword [esp], 2
call fcn.00407cfb
test eax, eax
push edx
je 0x4015e2
mov edx, dword [0x4327ec]
mov dword [esp + 0xc], 0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], edx
call eax
sub esp, 0x10
jmp 0x401607
cmp dword [0x4327ec], 0
mov eax, 1
jne 0x401607
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
push ecx
setne al
push ecx
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40397d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x4039a8
mov eax, dword [0x40fc4c]
test eax, eax
je 0x40399c
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push eax
mov dword [0x40fc4c], 0
jmp 0x403a17
cmp dword [0x40fc4c], 0
je 0x4039c0
mov dword [esp], 0
call fcn.0040829c
push ecx
jmp 0x403a17
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x432840]
jbe 0x403a17
mov eax, dword [0x432858]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4038c8
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x40fc4c], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edx
push edx
leave
ret

Function at 0x403a19
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
sub esp, 0x14
test eax, eax
je 0x403a5c
xor edx, edx
cmp dword [ebp - 0xc], ebx
sete dl
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x407280
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [0x42fc74], 0x44
mov dword [esp + 0x20], 0x42fc74
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
sub esp, 0x28
test eax, eax
je 0x4072fc
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push eax
mov eax, edx
leave
ret 4

Function at 0x4075ac
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
je 0x4075d7
and eax, 0xfffffffe
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push ebx
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4075de
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, 0
cmp eax, 0xffffffff
push ecx
cmove eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc

Function at 0x40763a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x65
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x1c]
jmp 0x407698
mov dword [ebp - 0x1c], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [ebp - 0x2c], eax
div ecx
mov dword [ebp - 0x30], edx
mov cl, byte [ebp - 0x30]
add ecx, 0x61
mov byte [ebp - 0x1a], cl
mov ecx, dword [ebp + 0xc]
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
jne 0x4076a0
dec esi
jne 0x407650
mov byte [ebx], 0
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4076ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x14]
cmp dword [ebp + 0x18], 1
lea edx, [ebp - 0x14]
sbb eax, eax
xor al, al
add eax, 0x20119
mov byte [ebx], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x40774e
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0x400
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x407737
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
jbe 0x40773a
mov byte [ebx], 0
mov eax, dword [ebp - 0x14]
mov byte [ebx + 0x3ff], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x407c44
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], 0x4300b8
mov dword [esp + 4], eax
call fcn.00407819
push ebx
push ebx
mov dword [esp], 0x4300b8
call fcn.00407494
mov ebx, eax
xor eax, eax
test ebx, ebx
push esi
je 0x407cf2
mov dword [esp], ebx
call fcn.00407857
test byte [0x432844], 0x80
push ecx
je 0x407cb2
mov al, byte [ebx]
cmp al, 0x5c
je 0x407cf0
test al, al
jne 0x407cb2
jmp 0x407cf0
call fcn.00407c0c
test eax, eax
push edx
je 0x407ca3
test byte [eax], 0x10
je 0x407cf0
mov dword [esp], 0x4300b8
call fcn.00407428
push ecx
jmp 0x407cbe
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub ebx, 0x4300b8
mov dword [esp], 0x4300b8
call esi
cmp eax, ebx
push edx
mov dword [esp], 0x4300b8
jg 0x407c94
call fcn.004073b2
push ecx
mov dword [esp], 0x4300b8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
setne al
push ebx
movzx eax, al
jmp 0x407cf2
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x4082ec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x4311fc], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x40832d
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x40830a
mov dword [edx*4 + 0x4311f8], eax
inc edx
cmp edx, 0x100
jne 0x408303
mov eax, dword [ebp + 8]
not eax
jmp 0x408347
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x4311f8]
test ebx, ebx
jne 0x408334
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x4064d8
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
cmp eax, 8
ja case.0x4064ea.1
jmp dword [eax*4 + 0x4065d0]
push dword [ebp + 0xc]
call fcn.004065f9
and dword [0x42c16c], 0
jmp case.0x4064ea.1
mov eax, dword [0x42c16c]
xor ecx, ecx
cmp ecx, dword [ebp + 0x14]
ja case.0x4064ea.1
mov esi, dword [ebp + 0x10]
jb 0x406522
cmp eax, esi
jae case.0x4064ea.1
call fcn.004069b0
add dword [0x42c16c], 0x100000
xor eax, eax
cmp eax, dword [ebp + 0x14]
jb 0x406522
ja case.0x4064ea.1
cmp dword [0x42c16c], esi
jb 0x406522
jmp case.0x4064ea.1
push dword [ebp + 0xc]
call fcn.004065f9
call fcn.004069b0
jmp case.0x4064ea.1
call fcn.004069b0
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 0xc]
call fcn.004066ae
mov esi, eax
test esi, esi
jns case.0x4064ea.1
push 0x403c70
jmp 0x4065c0
mov eax, dword [0x42c16c]
xor ecx, ecx
cmp ecx, dword [ebp + 0x14]
ja case.0x4064ea.1
mov esi, dword [ebp + 0x10]
jb 0x406590
cmp eax, esi
jae case.0x4064ea.1
call fcn.004069b0
add dword [0x42c16c], 0x80000
xor eax, eax
cmp eax, dword [ebp + 0x14]
jb 0x406590
ja case.0x4064ea.1
cmp dword [0x42c16c], esi
jb 0x406590
call fcn.004069e3
mov esi, eax
test esi, esi
jns 0x4065c8
push 0x403bf8
push esi
call fcn.0040854a
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
ret 0x14
Function at 0x40676f
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [0x42c108], esi
je 0x40678d
mov eax, 0x8000ffff
jmp 0x4068f1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
push ebx
xor ebx, ebx
inc ebx
push edi
mov dword [0x42c114], eax
cmp eax, esi
jne 0x40689b
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1f4
mov dword [0x42c0f0], eax
push eax
mov eax, 0x42c104
call fcn.00409166
push 0x42bf10
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
push esi
push esi
push esi
mov dword [0x42c0fc], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x42c100], eax
cmp eax, esi
jne 0x406812
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, esi
jle 0x4067ff
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jl 0x40680b
mov dword [ebp - 4], 0x80004005
push 0x403d10
jmp 0x406856
push esi
push esi
push esi
push 0x406a1b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x42c0f4], eax
cmp eax, esi
jne 0x406862
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, esi
jle 0x406845
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jl 0x406851
mov dword [ebp - 4], 0x80004005
push 0x403d4c
push dword [ebp - 4]
call fcn.0040854a
pop ecx
pop ecx
jmp 0x4068a1
push 0xffffffffffffffff
push dword [0x42c100]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, word [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
shl eax, 0x10
push eax
push esi
push 0x401
push dword [0x42c0f8]
call edi
push esi
push ebx
push 0x404
push dword [0x42c0f8]
call edi
mov dword [0x42c108], ebx
cmp dword [ebp - 4], esi
jge 0x4068ec
cmp dword [0x42c0fc], esi
je 0x4068bf
push 0x42bf10
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [0x42c0fc], esi
mov eax, dword [0x42c104]
cmp eax, esi
je 0x4068ce
push eax
call fcn.00408e6f
mov eax, dword [0x42c0f4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, esi
je 0x4068e0
push eax
call edi
mov eax, dword [0x42c100]
cmp eax, esi
je 0x4068ec
push eax
call edi
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x40751d
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x24], eax
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xf0000000
xor ebx, ebx
stosd dword es:[edi], eax
push 1
push ebx
stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x20]
push eax
xor esi, esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40758d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x40757c
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x407583
mov esi, 0x80004005
push 0x4042bc
jmp 0x40764f
lea eax, [ebp - 0x14]
push eax
push 0x10
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4075cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x4075ba
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x4075c1
mov esi, 0x80004005
push 0x4042e0
jmp 0x40764f
mov bl, byte [ebp - 0x14]
mov edi, dword [ebp - 0x24]
and bl, 7
add bl, 9
add bl, bl
mov dword [edi], esi
mov byte [ebp - 0x15], 0
je 0x407657
movzx eax, byte [ebp - 0x15]
and dword [ebp - 0x1c], 0
shr eax, 1
movzx eax, byte [ebp + eax - 0x14]
push eax
lea eax, [ebp - 0x1c]
push 0x404304
push eax
call fcn.00408b7e
mov esi, eax
add esp, 0xc
test esi, esi
js 0x407643
cmp dword [edi], 0
jne 0x407614
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
jmp 0x407634
push 0
push dword [ebp - 0x1c]
mov eax, edi
call fcn.00408abb
mov esi, eax
test esi, esi
js 0x40764a
cmp dword [ebp - 0x1c], 0
je 0x407634
push dword [ebp - 0x1c]
call fcn.00408e6f
add byte [ebp - 0x15], 2
and dword [ebp - 0x1c], 0
cmp byte [ebp - 0x15], bl
jb 0x4075e1
jmp 0x407657
push 0x404310
jmp 0x40764f
push 0x404350
push esi
call fcn.0040854a
pop ecx
pop ecx
xor edi, edi
cmp dword [ebp - 0x20], edi
je 0x407668
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x1c], edi
je 0x407675
push dword [ebp - 0x1c]
call fcn.00408e6f
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004191d5
leave
ret 4
Function at 0x40768d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x42a050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
mov ax, word [ecx]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 8], ax
mov word [ebp - 0x80c], ax
lea eax, [ebp - 0x80a]
push eax
call fcn.0041de40
add esp, 0xc
mov esi, 0x400
push esi
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x4076f9
xor al, al
jmp 0x407737
lea eax, [ebp - 0x80c]
push esi
push eax
call fcn.00419522
lea eax, [ebp - 0x80c]
push 0x404390
push eax
call fcn.0041953e
add esp, 0x10
test eax, eax
jne 0x407735
lea eax, [ebp - 0x80c]
push 0x4043a4
push eax
call fcn.0041953e
pop ecx
pop ecx
test eax, eax
je 0x4076f5
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004191d5
leave
ret