joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401810
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x405058]
test esi, esi
jle 0x401930
mov eax, dword [0x40505c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401844
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4018c7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401830
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401957
mov eax, dword [0x40505c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40505c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401937
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4018c0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4018d0
add dword [0x405058], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40505c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4018c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40184e
mov eax, dword [0x40505c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401df0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405074
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40506c]
sub esp, 4
test ebx, ebx
je 0x401e45
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401e3e
test esi, esi
je 0x401e3e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e20
mov dword [esp], 0x405074
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402170
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402195
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4021a0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402195
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4021e8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4021de
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4021ea
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4021d0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x34c44da0
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..pdata
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x5ae20853
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x40894f
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
add edx, edx
call fcn.00408969
xor dword [ecx], edi
inc ecx
cmp ecx, ebx
jne fcn.0040894f
and edx, eax
and edx, edx
ret
Function at 0x402c12
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 4]
push ebx
push edi
push eax
mov eax, dword [0x4521b0]
xor edi, edi
or eax, 8
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402ca4
mov ebx, 0x105
jmp 0x402c5d
cmp dword [ebp + 0x10], edi
jne 0x402c98
push edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00402c12
test eax, eax
jne 0x402c73
push ebx
lea eax, [ebp - 0x10c]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x402c44
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00405ee3
test eax, eax
je 0x402cac
push edi
push dword [0x4521b0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402ca4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x4521b0], edi
jne 0x402ca1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ca1
mov eax, edi
jmp 0x402ca4
Function at 0x402fab
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x402fca
mov eax, dword [0x414130]
test eax, eax
je 0x402fc2
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x414130], 0
ret
cmp dword [0x414130], 0
je 0x402fdb
push 0
call fcn.0040595b
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x4520c0]
jbe 0x40300e
push 0
push 0x403277
push 0
push 0x6f
push dword [0x44e0b4]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0x414130], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x40300f
Capabilities:
Get file size

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x2000
mov esi, 0x489000
add eax, 0x3e8
push esi
push ebx
mov dword [0x4520c0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 3
push 0x80000000
push esi
call fcn.00405f19
mov ebp, eax
mov dword [0x40a010], ebp
cmp ebp, 0xffffffff
jne 0x403068
mov eax, str.Error_launching_installer
jmp 0x40325e
push esi
mov esi, 0x481000
push esi
call fcn.004060c6
push esi
call fcn.0040622c
push eax
push 0x48b000
call fcn.004060c6
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [0x414128], esi
test esi, esi
jle 0x40319c
mov ebx, dword [esp + 0x38]
cmp dword [0x4520c8], 0
mov eax, 0x8000
mov edi, 0x200
cmovne edi, eax
cmp esi, edi
cmovl edi, esi
push edi
push 0x41dcf8
call fcn.00402d36
test eax, eax
je 0x403268
cmp dword [0x4520c8], 0
jne 0x40315c
push 0x1c
push 0x41dcf8
lea eax, [esp + 0x20]
push eax
call fcn.00405c94
test dword [esp + 0x18], 0xfffffff0
jne 0x403169
cmp dword [esp + 0x1c], 0xdeadbeef
jne 0x403169
cmp dword [esp + 0x28], 0x46537349
jne 0x403169
cmp dword [esp + 0x24], 0x65724358
jne 0x403169
cmp dword [esp + 0x20], 0x726f7461
jne 0x403169
mov eax, dword [0x41412c]
or ebx, dword [esp + 0x18]
mov dword [0x4520c8], eax
mov eax, ebx
and eax, 2
or dword [0x4521a0], eax
mov eax, dword [esp + 0x30]
cmp eax, esi
jg 0x403270
test bl, 8
jne 0x40314d
test bl, 4
jne 0x403194
inc dword [esp + 0x10]
lea esi, [eax - 4]
cmp edi, esi
jbe 0x403169
mov edi, esi
jmp 0x403169
test bl, 2
jne 0x403169
push 0
call fcn.00402fab
pop ecx
cmp esi, dword [0x414128]
jge 0x403184
push edi
push 0x41dcf8
push dword [esp + 0x1c]
call fcn.0040631d
mov dword [esp + 0x14], eax
add dword [0x41412c], edi
sub esi, edi
test esi, esi
jg 0x4030a2
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push 1
call fcn.00402fab
cmp dword [0x4520c8], 0
pop ecx
je 0x403270
test ebx, ebx
je 0x4031e4
push dword [0x41412c]
call fcn.00402d4c
push 4
lea eax, [esp + 0x3c]
push eax
push dword [0x40a010]
call fcn.00405f46
test eax, eax
je 0x403270
cmp edi, dword [esp + 0x38]
jne 0x403270
push dword [esp + 0x2c]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [0x4520c8]
mov esi, eax
add ecx, 0x1c
push ecx
call fcn.00402d4c
push dword [esp + 0x2c]
xor ebx, ebx
push esi
push ebx
push 0xffffffffffffffff
call fcn.00402d63
cmp eax, dword [esp + 0x2c]
jne 0x403270
test byte [esp + 0x18], 1
mov dword [0x4520d0], esi
mov eax, dword [esi]
mov dword [0x4520cc], eax
je 0x403230
inc dword [0x4520c4]
push 8
pop ecx
lea eax, [esi + 0x44]
lea eax, [eax - 8]
add dword [eax], esi
dec ecx
jne 0x403236
push 1
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x3c], eax
lea eax, [esi + 4]
push 0x40
push eax
push 0x4520e0
call fcn.00405c94
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
push 1
call fcn.00402fab
pop ecx
mov eax, 0x4082e0
jmp 0x40325e
Function at 0x4059c4
Capabilities:
Get file size
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
push 0x4086f4
push 0x448580
call ebp
mov esi, dword [esp + 0x1c]
mov ebx, 0x400
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
je 0x405a18
push 1
push 0
push esi
call fcn.00405f19
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0x448580
push esi
call edi
test eax, eax
je 0x405b08
cmp eax, ebx
jg 0x405b08
push ebx
mov esi, 0x448180
push esi
push dword [esp + 0x20]
call edi
test eax, eax
je 0x405b08
cmp eax, ebx
jg 0x405b08
push esi
push 0x448580
push str._s_s_r_n
push 0x447d80
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x4520d0]
add esp, 0x10
mov edi, eax
mov dword [esp + 0x1c], edi
push dword [ecx + 0x128]
push esi
call fcn.004056e8
push 4
push 0xc0000000
push esi
call fcn.00405f19
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405b08
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [edi + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x405b01
push esi
push edi
push ebx
call fcn.00405f46
test eax, eax
je 0x405b01
push str._Rename__r_n
push edi
call fcn.004060e2
test eax, eax
jne 0x405b0e
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call ebp
add esi, 0xa
mov ecx, esi
mov ebp, dword [esp + 0x1c]
lea eax, [ecx + edi]
push ebp
push 0x447d80
push eax
call fcn.00405c94
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esi + ebp]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x408700
add eax, 0xa
push eax
call fcn.004060e2
mov ecx, eax
test ecx, ecx
je 0x405ac6
mov ebp, dword [esp + 0x1c]
lea edx, [edi + esi]
add ebp, edx
cmp edx, ecx
jbe 0x405b3b
sub ebp, edx
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x405b31
sub ecx, edi
inc ecx
jmp 0x405ac8

Function at 0x405b6d
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406135
mov edi, eax
cmp edi, 0xffffffff
je 0x405bb0
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x405b98
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x405ba0
xor eax, eax
inc eax
jmp 0x405bb2
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x405b8f
test byte [ebp + 0xc], 4
jne 0x405bb0
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop ebp
ret 8
Function at 0x405c1b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x445d80
push ebx
call fcn.004060c6
push ebx
call fcn.0040615d
mov esi, eax
test esi, esi
jne 0x405c3c
xor eax, eax
jmp 0x405c8f
push esi
call fcn.00406257
test byte [0x4520cc], 0x80
je 0x405c55
mov al, byte [esi]
test al, al
je 0x405c38
cmp al, 0x5c
je 0x405c38
sub esi, ebx
jmp 0x405c6d
call fcn.00405bb7
test eax, eax
je 0x405c67
test byte [eax], 0x10
je 0x405c38
push ebx
call fcn.0040622c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
cmp eax, esi
jg 0x405c59
call fcn.00405b40
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop esi
pop ebx
ret 4

Function at 0x405cb4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x443d38], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x443d38
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405cf3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x405cf9
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x150
push ebx
mov ebx, dword [esp + 0x15c]
push esi
mov esi, dword [esp + 0x15c]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00405c1b
mov dword [esp + 0x10], eax
test bl, 8
je 0x405d3b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x452188], eax
jmp 0x405ed7
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x1c], ebp
je 0x405d58
test eax, eax
je 0x405e88
test bl, 2
je 0x405e88
push esi
push 0x443d80
call fcn.004060c6
test ebp, ebp
je 0x405d79
push str..
push 0x443d80
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x405d7f
push esi
call fcn.0040622c
cmp byte [esi], 0
jne 0x405d8d
cmp byte [0x443d80], 0x5c
jne 0x405d99
push 0x4082a0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push eax
push 0x443d80
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x405e78
lea ebp, [esp + 0x4c]
push 0x3f
mov eax, ebp
push eax
call fcn.00405bde
cmp byte [eax], 0
je 0x405dea
cmp byte [esp + 0x150], 0
lea eax, [esp + 0x150]
cmove eax, ebp
mov ebp, eax
cmp byte [ebp], 0x2e
jne 0x405e01
mov al, byte [ebp + 1]
test al, al
je 0x405e55
cmp al, 0x2e
jne 0x405e01
cmp byte [ebp + 2], 0
je 0x405e55
push ebp
push dword [esp + 0x14]
call fcn.004060c6
test byte [esp + 0x20], 0x10
je 0x405e24
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x405e55
push ebx
push esi
call fcn.00405cf9
jmp 0x405e55
push edi
push esi
call fcn.00405b6d
test eax, eax
jne 0x405e4d
test edi, edi
je 0x405e45
push esi
push 0xfffffffffffffff1
call fcn.00405603
push 0
push esi
call fcn.0040598b
jmp 0x405e55
inc dword [0x452188]
jmp 0x405e55
push esi
push 0xfffffffffffffff2
call fcn.00405603
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405dc3
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x405e84
mov eax, dword [esp + 0x10]
mov byte [eax - 1], 0
mov eax, dword [esp + 0x14]
test ebp, ebp
pop ebp
je 0x405ed7
test eax, eax
je 0x405ec7
push esi
call fcn.00405bb7
test eax, eax
je 0x405ed7
push esi
call fcn.00405b40
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00405b6d
test eax, eax
jne 0x405ecf
test edi, edi
je 0x405ec7
push esi
push 0xfffffffffffffff1
call fcn.00405603
push 0
push esi
call fcn.0040598b
jmp 0x405ed7
inc dword [0x452188]
jmp 0x405ed7
push esi
push 0xffffffffffffffe5
call fcn.00405603
pop edi
pop esi
pop ebx
add esp, 0x150
ret 8

Function at 0x405f19
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc
Function at 0x405f77
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
mov byte [esi], bl
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405fe9
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0x2000
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405fd8
cmp dword [ebp + 0x14], 1
je 0x405fda
cmp dword [ebp + 0x14], 2
je 0x405fda
mov byte [esi], bl
push dword [ebp - 4]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x40600d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add byte [ebp + 0xa], dl
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40604c
test edi, edi
jne 0x406018
mov byte [esi], al
jmp 0x40604e
mov eax, esi
pop edi
pop esi
pop ebp
ret 8

Function at 0x406135
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x406157
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x40631d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x448ac4], 0
push esi
jne 0x406355
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
dec esi
jne 0x40632e
mov dword [ecx*4 + 0x448ac0], edx
inc ecx
cmp ecx, 0x100
jl 0x406329
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x40637f
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x448ac0]
inc esi
dec edx
jne 0x406367
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x156d4d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xeff000]
push edi
or ebp, 0xffffffff
jmp 0x156d4f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x156d4f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156d4e8
mov eax, 1
add ebx, ebx
jne 0x156d50b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x156d51c
jne 0x156d53b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156d53b
dec eax
add ebx, ebx
jne 0x156d528
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x156d500
add ebx, ebx
jne 0x156d537
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x156d58d
xor ecx, ecx
sub eax, 3
jb 0x156d553
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x156d5c2
sar eax, 1
mov ebp, eax
jmp 0x156d55e
add ebx, ebx
jne 0x156d55e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156d52c
inc ecx
add ebx, ebx
jne 0x156d56c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156d52c
add ebx, ebx
jne 0x156d579
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x156d56e
jne 0x156d58a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x156d56e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x156d5ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x156d59e
jmp 0x156d4ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x156d5ac
add edi, ecx
jmp 0x156d4ee
pop esi
mov edi, esi
mov ecx, 0xf2a8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x156d5ca
cmp byte [edi], 0x58
jne 0x156d5ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x156d5cf
lea edi, [esi + 0x1169000]
mov eax, dword [edi]
or eax, eax
je 0x156d63e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1170278]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11703d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x156d5fc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11703dc]
or eax, eax
je 0x156d638
mov dword [ebx], eax
add ebx, 4
jmp 0x156d619
call dword [esi + 0x11703d8]
mov ebp, dword [esi + 0x11703e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x156d672
sub esp, 0xffffff80
jmp 0x5d9a5c
Function at 0x406910
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x815fbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x40483c
call fcn.00407afb
push 4
mov dword [esp + 0x18], 0
call fcn.004093ad
mov edi, eax
add esp, 4
test edi, edi
je 0x406984
push ebx
call fcn.004078f6
mov dword [edi], eax
call fcn.004076b5
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407abc
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406978
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00407ae4
pop ebx
jmp 0x406986
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x409f7b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x819354]
jne 0x409f85
repz ret
jmp fcn.00410a6c