joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4018a3
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x5c]
mov dword [esi], 0x4f19a4
mov eax, dword [edi]
test eax, eax
je 0x4018c2
xor ecx, ecx
cmp word [eax], cx
sete cl
test cl, cl
je 0x4018d7
mov ecx, edi
call fcn.0048ea50
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, edi
call fcn.0048db07
lea ecx, [esi + 0x84]
call fcn.0048e75f
lea ecx, [esi + 0x78]
call fcn.0048e75f
mov ecx, edi
call fcn.0048e75f
lea ecx, [esi + 0x18]
call fcn.0047331e
lea ecx, [esi + 0xc]
call fcn.0048e75f
lea ecx, [esi + 8]
call fcn.0048e75f
pop edi
lea ecx, [esi + 4]
pop esi
jmp fcn.0048e75f

Function at 0x4031d3
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x14], 0
jne 0x40321b
push esi
push 0x7c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x4031f8
push dword [esp + 0xc]
mov ecx, eax
call fcn.00402d26
mov esi, eax
jmp 0x4031fa
xor esi, esi
mov eax, dword [esi + 0x20]
push dword [eax + 4]
mov ecx, esi
push 0x5d8
call fcn.004685b7
push 0
mov dword [edi + 0x14], esi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop edi
ret 4

Function at 0x403b69
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, 0x544f8c
mov dword [ebp - 4], esi
call fcn.0043eb66
xor ebx, ebx
cmp dword [esi + 0x38], ebx
jbe 0x403bf8
add esi, 0x30
push edi
mov eax, dword [esi]
push dword [ebp + 8]
mov edi, ebx
shl edi, 2
mov ecx, dword [edi + eax]
add ecx, 4
call fcn.0048eb58
test al, al
mov eax, dword [esi]
jne 0x403bd7
mov ecx, dword [edi + eax]
add ecx, 8
call fcn.0048ea50
push 0x28
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x403bee
mov eax, dword [esi]
mov ecx, dword [edi + eax]
add ecx, 4
call fcn.0048ea50
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov eax, dword [esi]
mov edi, dword [edi + eax]
push 4
push 1
push ebx
mov ecx, esi
call fcn.0048e6ca
mov ecx, edi
call fcn.004022e4
dec ebx
mov eax, dword [ebp - 4]
inc ebx
cmp ebx, dword [eax + 0x38]
jb 0x403b89
pop edi
mov ecx, 0x544f8c
call fcn.0043ebe4
pop esi
pop ebx
leave
ret 4
Function at 0x40473e
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x10], 0
push ebx
push esi
mov ebx, edx
push edi
mov dword [ebp - 4], ebx
mov esi, ecx
mov edi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
jne 0x40475c
mov edi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov eax, ebx
push 3
shl eax, 2
xor edx, edx
pop ecx
div ecx
mov dword [ebp + 0x10], reloc.WS2_32.dll_accept
mov ecx, eax
add ecx, 5
cmp byte [ebp + 0xc], 0
je 0x40478e
mov eax, ebx
push 0x16
xor edx, edx
pop ebx
div ebx
and dword [ebp + 0x10], 0
mov ebx, dword [ebp - 4]
lea ecx, [ecx + eax + 2]
call fcn.0046b3f1
mov ecx, eax
mov dword [ebp + 0xc], ecx
lea ebx, [esi + ebx - 3]
jmp 0x4047fe
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
add edx, eax
mov eax, edx
shr eax, 0x12
mov al, byte [eax + edi]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + edi]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
mov al, byte [eax + edi]
and edx, 0x3f
mov byte [ecx + 2], al
mov al, byte [edx + edi]
add esi, 3
mov byte [ecx + 3], al
add ecx, 4
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xf
jne 0x4047fe
mov byte [ecx], 0xd
mov byte [ecx + 1], 0xa
inc ecx
inc ecx
and dword [ebp + 0x10], 0
cmp esi, ebx
jbe 0x40479e
lea eax, [ebx + 2]
cmp esi, eax
jne 0x404828
movzx edx, byte [esi]
shl edx, 4
mov eax, edx
shr eax, 6
mov al, byte [eax + edi]
and edx, 0x3f
mov byte [ecx], al
mov al, byte [edx + edi]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
jmp 0x40485d
inc ebx
cmp esi, ebx
jne 0x404867
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
shl edx, 8
add edx, eax
shl edx, 2
mov eax, edx
shr eax, 0xc
mov al, byte [eax + edi]
mov byte [ecx], al
mov eax, edx
shr eax, 6
and eax, 0x3f
mov al, byte [eax + edi]
and edx, 0x3f
mov byte [ecx + 1], al
mov al, byte [edx + edi]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0
pop edi
pop esi
pop ebx
jle 0x404879
mov byte [ecx], 0xd
mov byte [ecx + 1], 0xa
inc ecx
inc ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x404887
mov edx, ecx
sub edx, dword [ebp + 0xc]
mov dword [eax], edx
mov byte [ecx], 0
mov eax, dword [ebp + 0xc]
leave
ret 0xc
Function at 0x41d74c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x14]
call fcn.0048ea4a
lea eax, [ebp - 8]
mov esi, 0x549bcc
push eax
mov ecx, esi
call fcn.00404618
mov ecx, edi
call fcn.0048ea50
mov ecx, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00403c7a
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
test eax, fcn.004448e5
jne 0x41d7db
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.00404618
mov ecx, dword [ebp - 8]
call fcn.004396bb
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.00404618
mov ecx, edi
call fcn.0048ea50
mov ecx, dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00403c7a
push eax
lea ecx, [ebp - 0xc]
call fcn.0041d718
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x41d7db
call fcn.004022e4
mov ecx, edi
call fcn.0048ea50
mov ecx, eax
call fcn.00492025
lea ecx, [ebp - 0x10]
call fcn.0048ea4a
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.00404618
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea esi, [edi + 4]
call fcn.00433686
push eax
mov ecx, esi
call fcn.0048ea50
push eax
lea ecx, [ebp - 0x64]
call fcn.0041f2b0
lea ecx, [ebp - 4]
call fcn.0048ea4a
push eax
lea ecx, [ebp - 0x64]
call fcn.0041f7d2
lea ecx, [ebp - 4]
mov ebx, eax
call fcn.0048e75f
test ebx, ebx
je 0x41d892
push 0x100
lea edx, [ebp - 0x264]
mov ecx, ebx
call fcn.004a48f2
push 0
push 0
push ebx
lea eax, [ebp - 0x264]
push eax
mov ecx, edi
call fcn.0048ea50
push eax
lea eax, [ebp - 4]
push str.The_install_of__s_failed._n__s__d_.
push eax
call fcn.0048f08b
add esp, 0x14
mov ecx, eax
call fcn.0048ea50
push eax
push dword [0x54b004]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 4]
call fcn.0048e75f
mov ecx, esi
call fcn.0048ea50
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test edi, edi
je 0x41d8b2
mov ecx, edi
call fcn.00408591
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
lea ecx, [ebp - 0x64]
call fcn.0041edcb
lea ecx, [ebp - 0x10]
call fcn.0048e75f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x41d8d1
call fcn.004022e4
lea ecx, [ebp - 0x14]
call fcn.0048e75f
leave
ret
Function at 0x41e359
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 4]
call fcn.0048ea4a
lea ecx, [ebp - 0xc]
call fcn.0048ea4a
lea ecx, [esi + 0x2c]
call fcn.0048ea5c
xor ebx, ebx
test eax, eax
jne 0x41e3d8
lea eax, [ebp - 0xc]
lea edi, [esi + 0x3c]
push eax
mov ecx, edi
call fcn.0048ea50
mov edx, eax
lea ecx, [ebp - 8]
call fcn.00403975
mov eax, dword [ebp - 8]
neg eax
sbb eax, eax
test eax, fcn.004448e5
je 0x41e3cc
push 1
lea eax, [esi + 0x20]
push eax
push edi
lea edx, [ebp - 8]
lea ecx, [ebp - 0x10]
call fcn.004b9e7d
push dword [eax]
lea ecx, [ebp - 4]
call fcn.0048ea75
lea ecx, [ebp - 0x10]
call fcn.0048e75f
mov ecx, dword [ebp - 8]
cmp ecx, ebx
je 0x41e3d8
call fcn.004022e4
cmp byte [esi + 0x44], bl
jne 0x41e3ec
lea ecx, [esi + 0x3c]
call fcn.0048ea50
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea ecx, [ebp - 4]
call fcn.0048ea5c
test eax, eax
jne 0x41e44e
mov edi, dword [0x55070c]
lea ecx, [ebp - 0xc]
call fcn.0048ea50
push eax
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.0048f08b
add esp, 0xc
push eax
mov ecx, esi
call fcn.0041dd8b
lea ecx, [ebp - 0x10]
call fcn.0048e75f
push esi
push ebx
push 0x8017
push dword [0x54bccc]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0xc]
call fcn.0048e75f
lea ecx, [ebp - 4]
call fcn.0048e75f
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
lea ecx, [ebp - 4]
call fcn.0048ea50
push eax
mov ecx, esi
call fcn.0041e243
push esi
push ebx
push 0x8018
push dword [0x54bccc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov bl, 1
jmp 0x41e437
Function at 0x4225d1
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, ecx
push esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x422607
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x422607
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
call edi
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x42b0ce
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x58], 0
push edi
je 0x42b0f5
push 0x4298f1
push 0x10
push 0x10
push 3
call fcn.0042afe1
mov dword [esi + 0x4c], eax
push 0x42aeb4
push 9
push 9
push 2
mov ecx, esi
call fcn.0042afe1
mov dword [esi + 0x50], eax
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x42b127
mov word [ebp - 0x208], ax
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x4011
mov ebx, 0x2b4
push ebx
lea eax, [ebp - 0x4bc]
push eax
push 0x10
lea eax, [ebp - 0x208]
push eax
call edi
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x4b8]
push 0x4013
mov dword [esi + 0x5c], eax
push ebx
lea eax, [ebp - 0x4bc]
push eax
push 0x10
lea eax, [ebp - 0x208]
push eax
call edi
mov eax, dword [ebp - 0x4b8]
pop edi
mov dword [esi + 0x60], eax
pop esi
pop ebx
leave
ret

Function at 0x42b34f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 0x3c], ebx
je 0x42b425
mov eax, dword [esi + 4]
mov dword [ebp + 8], eax
test eax, eax
je 0x42b375
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x38]
mov dword [esi + 0x3c], ebx
mov eax, dword [eax + ebx*4]
mov dword [esi + 4], eax
test eax, eax
jne 0x42b3e5
push edi
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
pop ecx
test edi, edi
je 0x42b3af
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
and dword [edi + 8], 0
mov dword [edi + 0xc], esi
mov dword [edi], 0x5033a8
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], eax
jmp 0x42b3b1
xor edi, edi
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x34]
push edi
push fcn.00467842
push eax
mov eax, ebx
shl eax, 4
mov edx, dword [ecx + eax]
mov ecx, dword [0x548878]
call fcn.00468dbc
cmp byte [esi + 0x40], 0
mov dword [esi + 4], eax
pop edi
je 0x42b3e5
mov ecx, eax
call fcn.00468107
mov ecx, dword [esi + 0x30]
mov eax, dword [ecx]
push ebx
push esi
or edx, 0xffffffff
call dword [eax + 0x18]
mov eax, dword [esi + 0x24]
mov edx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x20]
push 0x250
sub edx, eax
push edx
mov edx, dword [esi + 0x28]
sub edx, ecx
push edx
push eax
push ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x42b425
mov edx, dword [ebp + 8]
call fcn.00429c2e
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42e9bc
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp byte [0x547944], 0
je 0x42e9d2
mov al, 1
leave
ret
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x42ea08
mov eax, dword [ebp - 0x190]
cmp al, 2
jne 0x42ea02
shr eax, 8
cmp al, 2
jne 0x42ea02
mov byte [0x547944], 1
jmp 0x42e9ce
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
leave
ret

Function at 0x42ea0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x5c]
push edi
push eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
call sub.MSVCRT.dll_memset
mov ebx, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x5c], esi
cmp ebx, edi
je 0x42ea72
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 2
push 1
push edi
lea eax, [ebp + 0xc]
push eax
call esi
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
je 0x42ea5b
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x30], 0x100
or dword [ebp - 0x30], 1
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 8]
xor eax, eax
push edi
cmp ebx, edi
setne al
push edi
push eax
push edi
push edi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp + 0xc], eax
cmp eax, edi
je 0x42eaba
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x42eab0
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x42eab5
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x14]
call esi
cmp ebx, edi
je 0x42eac3
push dword [ebp - 0x1c]
call esi
xor eax, eax
cmp dword [ebp + 0xc], edi
pop edi
pop esi
setne al
pop ebx
leave
ret 0xc

Function at 0x42edf8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x10], ecx
call fcn.00490034
cmp byte [eax + 0x135], 0
je 0x42ee25
xor ebx, ebx
push esi
inc ebx
push str._AUTOUPDATE___s___1
lea eax, [ebp - 0xc]
jmp 0x42ee31
push 2
pop ebx
push esi
push str._AUTOUPDATE___s_
lea eax, [ebp - 8]
push eax
call fcn.0048f08b
add esp, 0xc
push eax
lea ecx, [ebp - 4]
call fcn.0048f0de
test bl, 2
je 0x42ee53
lea ecx, [ebp - 8]
and ebx, 0xfffffffd
call fcn.0048e75f
test bl, 1
je 0x42ee60
lea ecx, [ebp - 0xc]
call fcn.0048e75f
push 1
push 0
lea ecx, [ebp - 4]
call fcn.0048ea50
push eax
push dword [ebp - 0x10]
push 0x4f6ab4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
lea ecx, [ebp - 4]
setg bl
call fcn.0048e75f
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x42eec2
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push esi
push 0x104
lea eax, [ebp - 0x61c]
push eax
push str.COMSPEC
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
test eax, eax
je 0x42efdb
xor eax, eax
movzx ecx, word [eax + str.ping__n_2_127.0.0.1_r_n]
mov word [ebp + eax - 0x20c], cx
inc eax
inc eax
test cx, cx
jne 0x42eeef
push edi
mov eax, esi
lea ecx, [ebp - 0x20c]
call fcn.004722be
xor edx, edx
xor ecx, ecx
call fcn.00472785
lea edi, [ebp - 0x414]
mov edx, eax
sub edi, eax
movzx esi, word [edx]
mov word [edi + edx], si
inc edx
inc edx
test si, si
jne 0x42ef26
mov dl, 1
mov ecx, eax
call fcn.0046b3e9
mov eax, str..bat
lea ecx, [ebp - 0x414]
call fcn.004722be
push 0
push 0x80
push 7
pop edx
lea ecx, [ebp - 0x414]
call fcn.0047267a
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x42ef6f
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x20c]
call fcn.0048c271
mov ecx, dword [ebp - 4]
mov edx, eax
call fcn.004a3c4b
lea ecx, [ebp - 4]
call fcn.0047230d
mov eax, 0x4f6b28
lea ecx, [ebp - 0x61c]
call fcn.004722be
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x61c]
call fcn.004722be
push 0
lea ecx, [ebp - 0x61c]
call fcn.0048c271
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x1f
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x42efdd
xor al, al
pop esi
leave
ret
Function at 0x42f066
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov byte [ebp - 8], dl
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], 0
test dl, dl
je 0x42f08c
push 0x4f6c44
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x240]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov ebx, 0x1f4
push ebx
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x10], eax
call edi
mov esi, dword [sym.imp.KERNEL32.DLL_CopyFileW]
jmp 0x42f1d1
mov ecx, dword [ebp - 0xc]
call fcn.004a4bf3
test al, al
je 0x42f0eb
push 0
push dword [ebp - 0xc]
lea eax, [ebp - 0x240]
push eax
call esi
test eax, eax
jne 0x42f1e7
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 0x240]
call fcn.004a3982
test al, al
jne 0x42f1e7
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x42f163
cmp byte [ebp - 8], 0
je 0x42f163
call fcn.0045eeac
test al, al
je 0x42f163
call fcn.004b4ade
test al, al
jne 0x42f163
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push dword [ebp - 0xc]
push str._AUTOUPDATE___s___NORUN__d
push eax
call fcn.0048f08b
add esp, 0x10
push 0
push 1
push 1
lea ecx, [ebp - 0x18]
call fcn.0048ea50
mov edx, eax
lea ecx, [ebp - 0x240]
call fcn.00460b1e
test al, al
jne 0x42f234
lea ecx, [ebp - 0x18]
call fcn.0048e75f
dec dword [ebp - 0x10]
jne 0x42f1ce
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push 0x537818
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x42f1b1
call fcn.004b4ade
test al, al
jne 0x42f1be
push dword [0x5521e0]
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 0x35
call fcn.0046960b
pop ecx
pop ecx
cmp eax, 2
je 0x42f225
jmp 0x42f1c7
call fcn.004b4ade
test al, al
je 0x42f276
cmp dword [ebp - 0x14], 0
je 0x42f225
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], 0xa
push ebx
call edi
push 0
push dword [ebp - 0xc]
lea eax, [ebp - 0x240]
push eax
call esi
test eax, eax
je 0x42f0c9
cmp byte [ebp - 8], 0
je 0x42f221
mov ecx, dword [ebp - 0xc]
call fcn.0042f045
test al, al
jne 0x42f225
call fcn.004b4ade
test al, al
jne 0x42f221
push dword [0x5521cc]
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 0x10
call fcn.0046960b
pop ecx
pop ecx
mov byte [ebp - 1], 1
call fcn.0042efe0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 4
mov ecx, dword [ebp - 0xc]
call fcn.0042f045
test al, al
jne 0x42f268
call fcn.004b4ade
test al, al
jne 0x42f268
push dword [0x5521cc]
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 0x10
call fcn.0046960b
pop ecx
pop ecx
mov byte [ebp - 1], 1
lea ecx, [ebp - 0x18]
call fcn.0048e75f
jmp 0x42f225
mov ecx, dword [ebp - 0x10]
push 0x104
lea edx, [ebp - 0x448]
call fcn.004a48f2
lea eax, [ebp - 0x448]
push eax
push dword [0x5521c8]
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 0x30
call fcn.0048f08b
add esp, 0xc
mov ecx, eax
call fcn.0048ea50
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0046960b
pop ecx
pop ecx
lea ecx, [ebp + 8]
jmp 0x42f26f
Function at 0x42f86d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov ecx, edi
mov ebx, edx
call fcn.0048db07
xor edx, edx
xor ecx, ecx
call fcn.00472785
mov esi, eax
lea eax, [ebp - 0x20c]
mov ecx, esi
sub eax, esi
movzx edx, word [ecx]
mov word [eax + ecx], dx
inc ecx
inc ecx
test dx, dx
jne 0x42f89d
mov eax, 0x4f6cb8
lea ecx, [ebp - 0x20c]
call fcn.004722be
mov dl, 1
mov ecx, esi
call fcn.0046b3e9
mov edx, dword [ebp - 4]
push ebx
lea ecx, [ebp - 0x20c]
call fcn.004a4b1e
test al, al
jne 0x42f8e9
push dword [0x5521dc]
mov ecx, edi
call fcn.0048ea75
jmp 0x42fa14
mov edx, dword [ebp + 8]
mov ecx, edx
and ecx, 0xffffefff
mov eax, 0x621682f
cmp ecx, eax
ja 0x42f922
push edx
push eax
push dword [0x5521d8]
lea eax, [ebp + 0xc]
push eax
call fcn.0048f08b
add esp, 0x10
push dword [eax]
mov ecx, edi
call fcn.0048ea75
lea ecx, [ebp + 0xc]
jmp 0x42fa0f
lea ecx, [ebp - 0x20c]
call fcn.004a84d7
test al, al
jne 0x42f939
push dword [0x5521e4]
jmp 0x42f8dd
mov edx, edi
lea ecx, [ebp - 0x20c]
call fcn.00425efa
test eax, eax
je 0x42fa14
xor esi, esi
push esi
mov edx, edi
lea ecx, [ebp - 0x20c]
call fcn.00426207
test al, al
je 0x42fa14
push 0x104
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea edx, [ebp - 0x414]
lea ecx, [ebp - 0x20c]
call fcn.0042edf8
test al, al
jne 0x42f9ac
lea eax, [ebp - 0x20c]
push eax
push dword [0x5521d0]
lea eax, [ebp + 0xc]
push eax
call fcn.0048f08b
add esp, 0xc
jmp 0x42f911
mov ebx, 0x4f6c44
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_OpenMutexA]
mov dword [ebp + 8], 0x12c
mov edi, 0x1f0001
jmp 0x42f9d7
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp + 8]
je 0x42f9e9
push ebx
push 0
push edi
call esi
test eax, eax
je 0x42f9c7
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
jmp 0x42fa23
lea eax, [ebp - 0x20c]
push eax
push dword [0x5521d4]
lea eax, [ebp + 8]
push eax
call fcn.0048f08b
mov ecx, dword [ebp + 0xc]
add esp, 0xc
push dword [eax]
call fcn.0048ea75
lea ecx, [ebp + 8]
call fcn.0048e75f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x432811
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 3
push edi
mov esi, edx
or dword [esi], 0xffffffff
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43283b
xor eax, eax
jmp 0x43286f
push edi
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push 0x2d1080
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x432860
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
cmp dword [esi], 0xffffffff
setne al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x435967
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x43596f
xor al, al
jmp 0x43598a
xor eax, eax
push esi
mov esi, dword [esp + 8]
mov edx, eax
xor edx, 3
mov dl, byte [edx + ecx]
mov byte [eax + esi], dl
inc eax
cmp eax, 0x14
jne 0x435972
mov al, 1
pop esi
ret 4

Function at 0x43598d
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov edx, dword [esp + 8]
mov ecx, eax
xor ecx, 3
mov cl, byte [ecx + edx]
mov edx, dword [esp + 4]
mov byte [eax + edx], cl
inc eax
cmp eax, 0x14
jne 0x43598f
ret 8
Function at 0x4399fc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x439a46
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
test eax, eax
je 0x439a42
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push 0xffffffffffffff9d
push 0xffffffffffffff9d
push 0x14f
call esi
push eax
push str.IO_Error:_d_line:_d_align:_d_pos:_Ld_count:_d_actual:_d
call fcn.0041ffc1
add esp, 0x20
call esi
jmp 0x439a76
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jae 0x439a74
push eax
push dword [ebp + 0xc]
mov esi, 0x490
push 0xffffffffffffffff
push 0xffffffffffffff9d
push 0xffffffffffffff9d
push 0x153
push esi
push str.IO_Error:_d_line:_d_align:_d_pos:_Ld_count:_d_actual:_d
call fcn.0041ffc1
add esp, 0x20
mov eax, esi
jmp 0x439a76
xor eax, eax
pop esi
pop ebp
ret 8