joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428390
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x434598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push esi
push edi
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x3c]
call fcn.00403cb0
mov esi, 0x4352bc
mov dword [esp + 0x34], esi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x94], edi
call fcn.00403cb0
mov dword [esp + 0x44], esi
lea ecx, [esp + 0x54]
mov byte [esp + 0x8c], 1
call fcn.00404570
lea ecx, [esp + 0x64]
mov byte [esp + 0x8c], 2
call fcn.00404570
lea ecx, [esp + 0x74]
mov byte [esp + 0x8c], 3
call fcn.00404570
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x30]
push eax
mov byte [esp + 0x90], 4
mov dword [esp + 0x34], 0x43626c
call fcn.0042d5c0
lea ecx, [esp + 0x20]
mov dword [esp + 0x8c], 5
push ecx
lea ecx, [esp + 0x34]
call fcn.004285d0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x90], 6
call dword [eax + 4]
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
call esi
test eax, eax
jne 0x428561
mov eax, dword [esp + 0x28]
cmp eax, edi
jle 0x4284b5
mov ecx, dword [esp + 0x24]
mov dl, byte [ecx + eax - 1]
push edx
push 0x43ea18
call fcn.00406350
add esp, 8
test al, al
mov eax, dword [esp + 0x28]
je 0x4284b5
dec eax
cmp eax, edi
mov dword [esp + 0x28], eax
jg 0x42848e
push ebx
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x28]
call dword [eax + 4]
mov ecx, dword [esp + 0x2c]
mov bl, byte [0x4362ac]
push 1
push ecx
lea ecx, [esp + 0x2c]
call fcn.00404670
mov byte [eax], bl
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
push edx
lea ecx, [esp + 0x28]
call dword [eax + 4]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x14]
push eax
push ecx
push edx
call esi
test eax, eax
pop ebx
jne 0x428561
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], 0x4352ac
cmp eax, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
je 0x42852f
push eax
call fcn.00415ab8
add esp, 4
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0x4352a8
mov dword [esp + 0x8c], 0xffffffff
call fcn.0042d500
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
add esp, 0x88
ret
mov esi, dword [esp + 8]
mov eax, dword [esp + 0x24]
imul esi, dword [esp + 0xc]
imul esi, dword [esp + 0x10]
cmp eax, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], 0x4352ac
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
je 0x428598
push eax
call fcn.00415ab8
add esp, 4
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0x4352a8
mov dword [esp + 0x8c], 0xffffffff
call fcn.0042d500
mov ecx, dword [esp + 0x84]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x88
ret
Function at 0x428690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
push 0
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x4286a9
pop esi
xor al, al
pop ebp
ret
push ebx
push edi
push esi
call fcn.00416b6a
add esp, 4
mov edi, eax
mov bl, 1
push edi
push esi
call ebp
test eax, eax
jne 0x4286d2
push edi
xor bl, bl
call fcn.004162f6
add esp, 4
mov al, bl
pop edi
pop ebx
pop esi
pop ebp
ret
mov ecx, dword [esp + 0x14]
push edi
call fcn.00423d90
push edi
call fcn.004162f6
add esp, 4
mov al, bl
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x4286f0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x4287a0
Capabilities:
Access peb ldr_data
Get disk information
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x434608
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push esi
push edi
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x28]
call fcn.00403cb0
mov esi, 0x4352bc
mov dword [esp + 0x20], esi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x38]
mov dword [esp + 0x80], edi
call fcn.00403cb0
mov dword [esp + 0x30], esi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x48]
mov byte [esp + 0x80], 1
call fcn.00403cb0
mov dword [esp + 0x40], esi
lea ecx, [esp + 0x50]
mov byte [esp + 0x78], 2
call fcn.00404570
lea ecx, [esp + 0x60]
mov byte [esp + 0x78], 3
call fcn.00404570
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0x1c]
push eax
mov byte [esp + 0x7c], 4
mov dword [esp + 0x20], 0x43626c
call fcn.0042d5c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x78], 5
push ecx
lea ecx, [esp + 0x20]
call fcn.004285d0
mov esi, eax
mov eax, dword [esi + 8]
mov edx, dword [esi]
push eax
mov ecx, esi
mov byte [esp + 0x7c], 6
call dword [edx + 4]
mov esi, dword [esi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
mov eax, dword [esp + 0x10]
sete bl
cmp eax, edi
mov dword [esp + 0xc], 0x4352ac
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
je 0x428898
push eax
call fcn.00415ab8
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], 0x4352a8
mov dword [esp + 0x78], 0xffffffff
call fcn.0042d500
mov ecx, dword [esp + 0x70]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x70
ret
Function at 0x4288d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x434658
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push esi
xor esi, esi
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x24]
call fcn.00403cb0
mov dword [esp + 0x1c], 0x4352bc
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x34]
mov dword [esp + 0x7c], esi
call fcn.00403cb0
mov dword [esp + 0x2c], 0x4352bc
lea ecx, [esp + 0x3c]
mov byte [esp + 0x74], 1
call fcn.00404570
lea ecx, [esp + 0x4c]
mov byte [esp + 0x74], 2
call fcn.00404570
lea ecx, [esp + 0x5c]
mov byte [esp + 0x74], 3
call fcn.00404570
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x18]
push eax
mov byte [esp + 0x78], 4
mov dword [esp + 0x1c], 0x43626c
call fcn.0042d5c0
lea ecx, [esp + 8]
mov dword [esp + 0x74], 5
push ecx
lea ecx, [esp + 0x1c]
call fcn.004285d0
mov eax, dword [esp + 0x10]
mov byte [esp + 0x74], 6
cmp eax, esi
jle 0x4289a7
mov edx, dword [esp + 0xc]
mov al, byte [edx + eax - 1]
push eax
push 0x43ea18
call fcn.00406350
add esp, 8
test al, al
mov eax, dword [esp + 0x10]
je 0x4289a7
dec eax
cmp eax, esi
mov dword [esp + 0x10], eax
jg 0x428980
mov edx, dword [esp + 8]
push eax
lea ecx, [esp + 0xc]
call dword [edx + 4]
mov eax, dword [esp + 0x10]
mov bl, byte [0x4362ac]
push 1
push eax
lea ecx, [esp + 0x10]
call fcn.00404670
mov byte [eax], bl
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
push ecx
lea ecx, [esp + 0xc]
call dword [edx + 4]
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelA]
test eax, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 8], 0x4352ac
setne bl
cmp eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
je 0x428a18
push eax
call fcn.00415ab8
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 8], 0x4352a8
mov dword [esp + 0x74], 0xffffffff
call fcn.0042d500
mov ecx, dword [esp + 0x6c]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x70
ret

Function at 0x428a60
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x428a83
mov al, byte [esp + 0xc]
test al, al
je 0x428a87
push esi
push 0x71
call fcn.00422570
add esp, 8
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x428a90
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x428ab8
mov al, byte [esp + 0x10]
test al, al
je 0x428abc
push esi
push 0x72
call fcn.00422570
add esp, 8
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x42aa80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x434686
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x30]
call fcn.004244b0
xor edi, edi
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], edi
call fcn.004244b0
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.004244b0
mov dword [esi], 0x436270
mov ax, word [0x442524]
mov cl, byte [0x442526]
mov dx, word [0x442520]
mov word [0x442519], ax
mov al, byte [0x442522]
mov byte [0x44251b], cl
mov ecx, dword [esp + 0xc]
mov word [0x44251d], dx
mov byte [0x44251f], al
mov dword [esi + 0x24], edi
mov word [esi + 0x10], di
mov word [esi + 0x12], di
mov word [esi + 8], di
mov dword [esi + 0x2c], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov word [esi + 0x28], di
mov word [esi + 0x2a], di
mov word [esi + 0xe], 8
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x430195
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4301b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041cf34
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4301d8
test byte [esp + 8], 2
je 0x4301d8
call fcn.0041cfa7
mov dword [eax], 0xd
call fcn.0041cfb0
mov dword [eax], 5
jmp 0x4301b1
xor eax, eax
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp int.00401219
Function at 0x4026a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402740
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402720
xor eax, eax
push ebp
push 0x402719
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40275c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402720
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x40367c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x403838
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4036dd
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x403854
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40374f
xor eax, eax
push ebp
push 0x403748
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004034d4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x403731
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x403874
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40374f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x403830
cmp byte [ebp - 0xd], 0
jne 0x403791
cmp byte [ebp - 0x12], 0
je 0x403830
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4037aa
dec ebx
cmp byte [ebx], 0x2e
je 0x4037b9
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4037a9
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x403830
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4037e6
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x403830
cmp byte [ebp - 0xd], 0
je 0x403830
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x403830
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4047d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
movzx eax, word [0x40b99c]
cmp eax, dword [0x40b9a0]
jb 0x40484c
mov eax, dword [0x40a2ac]
mov eax, dword [eax]
mov edx, 0x8000
call fcn.00405a00
mov edx, eax
mov eax, dword [0x40b994]
call fcn.00405b28
mov dword [0x40b9a0], eax
mov eax, dword [0x40a318]
mov ax, word [eax + 8]
and ax, 1
cmp ax, 1
jne 0x404843
mov esi, dword [0x40b9a0]
dec esi
test esi, esi
jl 0x404843
inc esi
xor ebx, ebx
call fcn.00407348
mov edx, dword [0x40b994]
xor byte [edx + ebx], al
mov eax, dword [0x40b994]
mov al, byte [eax + ebx]
call fcn.00407270
inc ebx
dec esi
jne 0x404824
mov word [0x40b99c], 0
cmp dword [0x40b9a0], 0
jne 0x40486d
mov eax, dword [0x40a2ac]
xor edx, edx
mov dword [eax], edx
mov word [0x40b99c], 0
or eax, 0xffffffff
pop esi
pop ebx
ret
movzx eax, word [0x40b99c]
mov edx, dword [0x40b994]
movzx eax, byte [edx + eax]
inc word [0x40b99c]
pop esi
pop ebx
ret

Function at 0x4048d4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, esp
mov ebp, 0x40b998
mov eax, dword [0x40b98c]
mov dword [edi], eax
mov ax, word [0x40b990]
mov word [esp + 4], ax
mov bx, word [0x40b9a4]
mov si, word [esp + 4]
and si, 7
lea ecx, [esp + 4]
mov edx, edi
mov eax, esi
call fcn.004048c8
lea ecx, [esp + 4]
mov edx, edi
mov ax, 0x10
call fcn.004048a4
mov si, word [edi]
and si, 0xffff
lea ecx, [esp + 4]
mov edx, edi
mov ax, 0x10
call fcn.004048c8
lea ecx, [esp + 4]
mov edx, edi
mov ax, 0x10
call fcn.004048a4
mov ax, word [edi]
not ax
and ax, 0xffff
cmp si, ax
je 0x40495e
mov word [0x40b9a4], 0
lea ecx, [esp + 4]
mov edx, edi
mov ax, 0x10
call fcn.004048c8
test si, si
je 0x4049d8
dec esi
lea ecx, [esp + 4]
mov edx, edi
mov ax, 8
call fcn.004048a4
movzx eax, bx
mov edx, dword [ebp]
mov cl, byte [edi]
mov byte [edx + eax], cl
inc ebx
cmp bx, 0x8000
jne 0x4049c4
push 0
lea eax, [esp + 0xc]
push eax
movzx eax, bx
push eax
mov eax, dword [ebp]
push eax
mov eax, dword [0x40a2d8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
mov ecx, dword [0x40a2a0]
movzx edx, bx
mov eax, dword [ebp]
call fcn.004059dc
xor ebx, ebx
lea ecx, [esp + 4]
mov edx, edi
mov ax, 8
call fcn.004048c8
test si, si
jne 0x404972
mov word [0x40b9a4], bx
mov eax, dword [edi]
mov dword [0x40b98c], eax
mov ax, word [esp + 4]
mov word [0x40b990], ax
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x405818
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, 0x40b988
mov word [0x40b99c], 0
xor eax, eax
mov dword [0x40b9a0], eax
mov word [0x40b9a4], 0
mov word [0x40b990], 0
xor eax, eax
mov dword [0x40b98c], eax
xor ebx, ebx
xor eax, eax
mov dword [0x40b994], eax
xor eax, eax
mov dword [0x40b998], eax
mov eax, 0x8002
call fcn.004024a4
mov dword [0x40b994], eax
mov eax, 0x8002
call fcn.004024a4
mov dword [0x40b998], eax
xor eax, eax
push ebp
push 0x405935
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x405909
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [esi], 0
lea eax, [ebp - 4]
call fcn.00405778
cmp bx, word [esi]
jae 0x4058ae
mov bx, word [esi]
cmp dword [ebp - 4], 0
je 0x405899
cmp word [0x40b9a4], 0
jbe 0x4058ff
push 0
lea eax, [ebp - 8]
push eax
movzx eax, word [0x40b9a4]
push eax
mov eax, dword [0x40b998]
push eax
mov eax, dword [0x40a2d8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
mov ecx, dword [0x40a2a0]
movzx edx, word [0x40b9a4]
mov eax, dword [0x40b998]
call fcn.004059dc
mov word [0x40b9a4], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x405913
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40593c
mov eax, dword [0x40b994]
call fcn.004024bc
mov eax, dword [0x40b998]
call fcn.004024bc
ret

Function at 0x405a08
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [0x40a2ac]
mov eax, dword [edi]
mov edx, 0x8000
call fcn.00405a00
add eax, 2
call fcn.004024a4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x405aee
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jle 0x405ad8
mov eax, dword [edi]
mov edx, 0x8000
call fcn.00405a00
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00405b28
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [edi], eax
mov eax, dword [0x40a318]
mov ax, word [eax + 8]
and ax, 1
cmp ax, 1
jne 0x405aa3
mov esi, dword [ebp - 4]
dec esi
test esi, esi
jb 0x405aa3
inc esi
xor ebx, ebx
call fcn.00407348
mov edx, dword [ebp - 8]
mov dl, byte [edx + ebx]
xor al, dl
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
mov eax, dword [ebp - 8]
mov al, byte [eax + ebx]
call fcn.00407270
inc ebx
dec esi
jne 0x405a81
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x40a2d8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
mov ecx, dword [0x40a2a0]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004059dc
cmp dword [edi], 0
jg 0x405a45
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405af5
mov eax, dword [ebp - 8]
call fcn.004024bc
ret

Function at 0x405c10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004031e8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x405c29
test al, 0x10
jne 0x405c2d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x405c34
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004031e8
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
setne al
pop ebx
ret

Function at 0x405eb4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], 0xffffffff
mov byte [ebp - 0xd], 0
push 0
mov eax, dword [0x40a2f8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
mov eax, dword [0x40a2cc]
sub ebx, dword [eax]
cmp ebx, 0x10016
jbe 0x405eed
mov ebx, 0x10016
cmp ebx, 0x16
jbe 0x405fad
mov eax, ebx
call fcn.004024a4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x405fa6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dx, 1
xor eax, eax
call fcn.00405afc
mov edi, eax
mov eax, ebx
neg eax
mov dx, 2
call fcn.00405afc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00405b28
mov esi, eax
xor edx, edx
mov eax, edi
call fcn.00405afc
cmp ebx, esi
jne 0x405f90
mov edi, ebx
sub edi, 0x16
test edi, edi
jb 0x405f90
inc edi
xor ebx, ebx
mov esi, dword [ebp - 0xc]
add esi, ebx
mov eax, dword [esi]
mov edx, dword [0x40a2e0]
cmp eax, dword [edx]
jne 0x405f8c
push 0
mov eax, dword [0x40a2f8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetFileSize_1
movzx edx, word [esi + 0x14]
add edx, dword [ebp - 8]
add edx, ebx
add edx, 0x16
cmp eax, edx
jne 0x405f8c
mov byte [ebp - 0xd], 1
add ebx, dword [ebp - 8]
mov dword [ebp - 4], ebx
jmp 0x405f90
inc ebx
dec edi
jne 0x405f50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405fad
mov eax, dword [ebp - 0xc]
call fcn.004024bc
ret
cmp byte [ebp - 0xd], 0
jne 0x405fbd
mov eax, 0x405fd0
call fcn.00408050
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406950
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40699d
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x4069b4
call fcn.00403070
mov eax, dword [ebp - 4]
call fcn.004031e8
push eax
call sub.kernel32.dll_WinExec
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4069a4
lea eax, [ebp - 4]
call fcn.00402ea8
ret

Function at 0x406a80
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x406b9e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00406924
test al, al
je 0x406ac3
push 0x406bb4
mov eax, dword [0x40a324]
push dword [eax]
push 0x406bdc
lea eax, [ebp - 4]
mov edx, 3
call fcn.004030e4
jmp 0x406ae1
push 0x406bf0
mov eax, dword [0x40a324]
push dword [eax]
push 0x406c1c
lea eax, [ebp - 4]
mov edx, 3
call fcn.004030e4
lea eax, [ebp - 8]
push eax
push 0x406c24
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
test eax, eax
jne 0x406b35
mov eax, dword [ebp - 4]
call fcn.00403024
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004031e8
push eax
push 1
push 0
mov eax, dword [0x40a324]
mov eax, dword [eax]
call fcn.004031e8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x406b37
xor ebx, ebx
test bl, bl
jne 0x406b88
lea eax, [ebp - 8]
push eax
push 0x406c24
push 0x80000001
call sub.advapi32.dll_RegCreateKeyA
test eax, eax
jne 0x406b88
mov eax, dword [ebp - 4]
call fcn.00403024
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004031e8
push eax
push 1
push 0
mov eax, dword [0x40a324]
mov eax, dword [eax]
call fcn.004031e8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ba5
lea eax, [ebp - 4]
call fcn.00402ea8
ret