joyce8/EMBER2024-capa huggingface dataset:
Function at 0x99b2198
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx - 0x314d0411], esi
ret 8
xor eax, 0x6e13b310
lea eax, [eax + edx - 0x4336d827]
xor ebx, eax
lea ecx, [edx + ecx*8 + 0x7730fe29]
dec dl
add esi, eax
rol edx, cl
call fcn.0998c678
and al, cl
mov word [ebp + edx*2 - 0x629a0822], ax
mov dword [esp + edx - 0x314d0411], edx
rol dword [esp + edx*2 - 0x629a081c], 0xe3
jae 0x944ce84
add byte [eax], al
add byte [edi + 0x65], al
je 0x99b2201
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x99b2231
insb byte es:[edi], dx
push esp
imul esi, dword [esp + ebp*2 + 0x65], 0x9fb80041
cmp al, 0xf
pop esi
inc eax
movzx ecx, al
lea edi, [ecx + edi - 0xa4]
cdq
mov eax, dword [edi + eax - 0x5e0f3ca0]
add dl, cl
xor eax, ebx
not ecx
shr ecx, 0x92
dec eax
sal ecx, cl
add cx, 0xc59b
xchg dh, dl
rol eax, 1
jmp 0x9462042
je 0x99b2245
inc ebx
push eax
add byte [edx + 0x72e71238], dl
mov word [0xe0755da9], es
mov es, eax
jmp 0x9dd68970
mov dh, 0x42
test eax, 0xd933881
adc dword [edx], edx
imul edx, dword [eax + 0x76], 0xd
add eax, 0xdd111718
pop edi
xor ax, 0x52ac
call 0xffc3e819
adc eax, 0xba762e10
mov dh, 0xf
push eax
jbe 0x99b2268
jg 0x99b22ba
or dword [ecx], 0x75
scasb al, byte es:[edi]
or dh, byte [esi + 0x15]
pushal
dec dword [ecx + 0x76]
in al, dx
rol byte [edi], cl
sbb dword [ecx + ecx*4 - 0x9e3d0f7], ebx
jp 0x99b22d2
test byte [ebp + 0x76], cl
aad 0x8d
add cl, byte [ecx + edx*4]
mov eax, esp
mov al, byte [0xd9f3417b]
mov bh, 0xe7
jb 0x99b22f7
mov al, 0xc
pop ebp
jne 0x99b22e0
sub eax, eax
jmp 0x3b820d04
add edi, dword [ebx + 0x37]
scasb al, byte es:[edi]
xor dword [eax - 0x2e], edx
jns 0x99b22ba
dec edx
cld
int3
popfd
scasb al, byte es:[edi]
mov dword [esi], ebx
bound eax, qword [esi + 0x7d]
imul byte [eax - 0x4a]
hlt
das
push ecx
out 0xb7, eax
mov dword [0x62016ea5], esi
jbe 0x99b234c
aaa
loop 0x99b22f8
sub al, byte [edx]
pushfd
mov bl, 0x89
lea ebx, [ecx + 0x15bba857]
push edi
inc esi
xchg dword [edx + 0x73], esi
test al, 0xbb
adc eax, 0x72874657
jae 0x99b231a
mov ebx, 0x87465715
jb 0x99b2372
sbb bh, ch
std
cmp eax, 0xa0daff75
jmp 0xc9a3d797
cwde
sti
dec ebx
hlt
aad 0xd4
inc esi
invalid
sub eax, 0xf7ef2489
push esi
jge 0x99b23b7
stc
and dh, byte [ecx + 3]
rcr dword [esi], cl
pop ebx
rol dword [edi + edi*2 + 0x33], 1
dec esi
test dword [eax], eax
invalid
mov al, 0xae
sti
or eax, 0x126a99b7
sbb al, 0x47
xor dword [esi - 0x5b], ecx
mov dl, 0x8d
inc eax
push cs
test cl, bl
or ebx, ebx
invalid
Function at 0x99ecd25
Capabilities:
Authenticate hmac

Disassembly:
inc edx
ror dword [esp + ecx*4 - 0x246], 0x5c
not bp
rol bp, 1
inc esp
sub dh, bh
dec edx
sbb dword [esp + ecx - 0x92], esi
dec ecx
sub esi, ebx
neg bp
inc edx
shr byte [esp + ecx - 0x8f], 0x41
inc edx
sbb dword [esp + ecx - 0x8f], 0xc22bb39
xor bp, 0xd01d
dec eax
lea eax, [edi*8 + 0x7bb3c23d]
add bp, 0xe318
push edx
dec ecx
sal ecx, 0x64
inc sp
xor edi, ebp
dec esi
xor dword [esp + edx*2 - 0x160], edx
dec eax
lea ebp, [esp + ebp + 0x10]
pop ebx
dec eax
cwde
inc si
mov ebx, dword [ebp + edx - 0xb1]
inc eax
shl bh, 5
dec eax
shl eax, 0xf8
dec edi
lea ebp, [edx + ebp - 0xb3]
dec edx
lea ecx, [edx*8 + 0x39b10825]
inc ecx
sbb ebx, ecx
inc di
mov dword [ebp + edx*4 - 0x2c4], ebx
inc ecx
pop esi
jne fcn.0947c99b
mov edi, 0x3ea1bd92
inc ecx
not ebx
inc ecx
neg ebx
dec eax
not dword [esp + edi*2 - 0x7d437b23]
push ebx
inc ecx
bswap ebx
inc ecx
ror ebx, 1
dec esp
lea ecx, [eax + edi*2 + 0x789763b6]
inc ecx
xor ebx, 0x52a3bf1b
inc ebp
lea ebx, [ebx + ebx - 0x5ef85de6]
inc ecx
bswap ebx
inc ecx
not ebx
dec eax
lea eax, [edi*2 - 0x6a7e6dcd]
call fcn.09978bd3
inc cx
xor ebp, edi
inc ecx
ror cl, 0x43
jb 0x95f8845
sar edx, 0xb3
xor ecx, ebx
mul eax
shl edx, 0x1f
not dx
neg ecx
imul eax, dword [esp + edx - 0xffff]
sbb ecx, 0x8f28ac1c
idiv dword [esp + edx - 0xffff]
ror eax, 0x9e
rol ecx, 1
neg eax
lea ecx, [ecx + edx*8 + 0x3993a8da]
mul edx
dec edx
bswap edx
xor ebx, ecx
xadd dword [esp], edx
push eax
mov dword [esp + 4], eax
add esi, ecx
call fcn.095fbfc4
dec ecx
sar edx, 0x3e
sal dl, 0xc6
dec eax
arpl bx, bx
dec esp
adc eax, ebx
inc bp
sub edx, esi
dec eax
mov dword [esp + ebp - 0x65738600], 0xeb327718
inc esp
or bl, byte [esp + ebp - 0x657385fc]
inc edx
movzx ebp, word [ebp - 0x65738600]
dec edx
shl dword [esp + ecx*2 - 0x128], 0x5b
dec edx
inc dword [esp + ecx - 0x94]
dec edi
lea esp, [ecx - 0x92]
inc cx
sar edx, 0xe7
jbe 0x989a040
mov ecx, 0xe1bf359f
sub edi, 4
mov edx, ecx
push ecx
lea eax, [ecx*8 - 0x79c5236f]
mov ecx, dword [edi]
bts eax, 0xa8
jb 0x999f920
rol eax, 1
lea edx, [edx*2 - 0x287858f9]
dec cl
and edx, 0xf80b199
xor ebx, eax
add esi, eax
mov ecx, dword [ebp + edx*2 - 0x13000002]
btr dx, dx
mov eax, dword [ebp + edx - 0x97ffffd]
neg edx
adc ebp, 7
not edx
push edx
mov dword [ecx + edx - 0x9800000], eax
push edx
not edx
dec word [esp + 6]
pop ecx
pop edx
pop eax
jmp esi
Function at 0x402be6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 4]
push ebx
push edi
push eax
mov eax, dword [0x42f1b0]
xor edi, edi
or eax, 8
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402c78
mov ebx, 0x105
jmp 0x402c31
cmp dword [ebp + 0x10], edi
jne 0x402c6c
push edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00402be6
test eax, eax
jne 0x402c47
push ebx
lea eax, [ebp - 0x10c]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x402c18
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.0040603c
test eax, eax
je 0x402c80
push edi
push dword [0x42f1b0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402c78
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x42f1b0], edi
jne 0x402c75
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402c75
mov eax, edi
jmp 0x402c78
Function at 0x402d37
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x50
mov ecx, dword [esp + 0x54]
mov eax, 0x4210f8
push ebx
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, 0x8000
test edi, edi
cmovne ebx, dword [esp + 0x6c]
xor esi, esi
test edi, edi
cmovne eax, edi
mov dword [esp + 0xc], eax
test ecx, ecx
js 0x402d72
mov eax, dword [0x42f118]
add eax, ecx
push eax
call fcn.00402d20
push 4
lea eax, [esp + 0x6c]
push eax
push dword [0x40a010]
call fcn.0040609e
test eax, eax
jne 0x402d90
push 0xfffffffffffffffd
pop eax
jmp 0x402eef
mov eax, dword [esp + 0x68]
push ebp
test eax, eax
jns 0x402f0a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x6c]
and dword [0x40ba64], esi
and dword [0x40ba60], esi
and ecx, 0x7fffffff
mov dword [esp + 0x70], eax
mov eax, 0x40d0e8
mov dword [0x40b548], 8
mov dword [0x4150f0], eax
mov dword [0x4150ec], eax
mov dword [0x4150e8], 0x4150e8
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x14], ecx
jle 0x402eec
mov ebp, 0x4000
cmp ecx, ebp
cmovl ebp, ecx
push ebp
push 0x41d0f8
call fcn.00402d0a
test eax, eax
je 0x402f5e
sub dword [esp + 0x6c], ebp
mov dword [0x40b53c], ebp
mov ebp, dword [esp + 0x10]
mov dword [0x40b538], 0x41d0f8
push 0x40b538
mov dword [0x40b540], ebp
mov dword [0x40b544], ebx
call fcn.004068e8
mov dword [esp + 0x1c], eax
test eax, eax
js 0x402f06
mov eax, dword [0x40b540]
sub eax, ebp
mov dword [esp + 0x64], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x42f1b4], 1
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
je 0x402eb2
sub eax, dword [esp + 0x70]
cmp eax, 0xc8
ja 0x402e76
test ecx, ecx
jne 0x402eb2
mov eax, dword [esp + 0x14]
push eax
push 0x64
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [esp + 0x24]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push 0
call fcn.00405654
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x64]
test eax, eax
je 0x402ef8
test edi, edi
jne 0x402ed3
push eax
push ebp
push dword [esp + 0x70]
call fcn.00406149
test eax, eax
je 0x402f02
mov eax, dword [esp + 0x64]
jmp 0x402edf
mov ebp, dword [0x40b540]
sub ebx, eax
mov dword [esp + 0x10], ebp
add esi, eax
cmp dword [esp + 0x1c], 1
jne 0x402e23
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x50
ret 0x10
test ecx, ecx
jg 0x402dee
jmp 0x402eec
push 0xfffffffffffffffe
jmp 0x402f60
push 0xfffffffffffffffc
jmp 0x402f60
test edi, edi
jne 0x402f4a
test eax, eax
jle 0x402eec
mov ebp, 0x41d0f8
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push ebp
call fcn.00402d0a
test eax, eax
je 0x402f5e
push edi
push ebp
push dword [esp + 0x70]
call fcn.00406149
test eax, eax
je 0x402f02
mov eax, dword [esp + 0x6c]
add esi, edi
sub eax, edi
mov dword [esp + 0x6c], eax
test eax, eax
jg 0x402f17
jmp 0x402eec
mov esi, dword [esp + 0x70]
cmp eax, esi
cmovl esi, eax
push esi
push edi
call fcn.00402d0a
test eax, eax
jne 0x402eec
push 0xfffffffffffffffd
pop eax
jmp 0x402eee
Function at 0x402f63
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x402f82
mov eax, dword [0x40b530]
test eax, eax
je 0x402f7a
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40b530], 0
ret
cmp dword [0x40b530], 0
je 0x402f93
push 0
call fcn.00405ab5
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x42f120]
jbe 0x402fc6
push 0
push 0x40322b
push 0
push 0x6f
push dword [0x42e8b4]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0x40b530], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x405739
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405753
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4

Function at 0x405759
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push 4
pop eax
mov word [ebp - 0x1e], ax
mov eax, 0x4085c0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov word [ebp - 0x20], 1
mov dword [ebp - 0x10], 0x4085b0
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4057c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4057d1
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
je 0x4057cb
xor eax, eax
jmp 0x4057d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret 4
Function at 0x405a46
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
lea eax, [ebp - 0x120]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor ecx, ecx
cmp eax, esi
pop esi
cmova eax, ecx
test eax, eax
je 0x405a7e
cmp byte [ebp + eax - 0x121], 0x5c
mov ecx, 0x4082a0
jne 0x405a83
mov ecx, 0x4082a1
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x120]
add eax, ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esp, ebp
pop ebp
ret 4

Function at 0x405ae5
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x405b08
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405b17
pop ecx
pop ecx
inc dword [0x42f190]
ret 8

Function at 0x405b17
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x408704
mov ebp, 0x42c580
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x18]
mov ebx, 0x400
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
je 0x405b65
push 1
push 0
push esi
call fcn.00406071
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x405c49
cmp eax, ebx
jg 0x405c49
push ebx
mov esi, 0x42c180
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x405c49
cmp eax, ebx
jg 0x405c49
push esi
push ebp
push str._s_s_r_n
push 0x42bd80
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x42f0cc]
add esp, 0x10
mov ebp, eax
mov dword [esp + 0x18], ebp
push dword [ecx + 0x128]
push esi
call fcn.004057d7
push 4
push 0xc0000000
push esi
call fcn.00406071
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405c49
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea ecx, [ebp + 0xa]
add ecx, edi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405c42
push edi
push esi
push ebx
call fcn.0040609e
test eax, eax
je 0x405c42
push str._Rename__r_n
push esi
call fcn.0040626b
test eax, eax
jne 0x405c4e
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
mov ecx, edi
push ebp
push 0x42bd80
lea eax, [ecx + esi]
push eax
call fcn.00405dec
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [edi + ebp]
push eax
push esi
push ebx
call fcn.00406149
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x408710
add eax, 0xa
push eax
call fcn.0040626b
mov ecx, eax
test ecx, ecx
je 0x405c13
lea edx, [esi + edi]
add ebp, edx
cmp edx, ecx
jbe 0x405c77
sub ebp, edx
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x405c6d
mov ebp, dword [esp + 0x18]
sub ecx, esi
inc ecx
jmp 0x405c15
Function at 0x405cc5
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.004062be
mov edi, eax
cmp edi, 0xffffffff
je 0x405d08
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x405cf0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x405cf8
xor eax, eax
inc eax
jmp 0x405d0a
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x405ce7
test byte [ebp + 0xc], 4
jne 0x405d08
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x405d73
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x42b980
push ebx
call fcn.0040624f
push ebx
call fcn.004062e6
mov esi, eax
test esi, esi
jne 0x405d94
xor eax, eax
jmp 0x405de7
push esi
call fcn.004063de
test byte [0x42f0c8], 0x80
je 0x405dad
mov al, byte [esi]
test al, al
je 0x405d90
cmp al, 0x5c
je 0x405d90
sub esi, ebx
jmp 0x405dc5
call fcn.00405d0f
test eax, eax
je 0x405dbf
test byte [eax], 0x10
je 0x405d90
push ebx
call fcn.004063b3
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
cmp eax, esi
jg 0x405db1
call fcn.00405c98
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop esi
pop ebx
ret 4

Function at 0x405e0e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x42b538], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x42b538
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405e4d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x405e53
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x150
push ebx
mov ebx, dword [esp + 0x15c]
push esi
mov esi, dword [esp + 0x15c]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00405d73
mov dword [esp + 0x18], eax
test bl, 8
je 0x405e95
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42f188], eax
jmp 0x406030
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x18], ebp
je 0x405eb2
test eax, eax
je 0x40601f
test bl, 2
je 0x405fe5
push esi
push 0x42b580
call fcn.0040624f
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405ed5
push str..
push 0x42b580
call ebp
jmp 0x405edb
push esi
call fcn.004063b3
cmp byte [esi], 0
jne 0x405ee9
cmp byte [0x42b580], 0x5c
jne 0x405ef1
push 0x4082a0
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebp, [esi + eax]
lea eax, [esp + 0x20]
mov dword [esp + 0x10], ebp
push eax
push 0x42b580
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x405fd6
lea ebp, [esp + 0x4c]
push 0x3f
mov eax, ebp
push eax
call fcn.00405d36
cmp byte [eax], 0
je 0x405f43
cmp byte [esp + 0x150], 0
lea eax, [esp + 0x150]
cmove eax, ebp
mov ebp, eax
cmp byte [ebp], 0x2e
jne 0x405f5a
mov al, byte [ebp + 1]
test al, al
je 0x405fb1
cmp al, 0x2e
jne 0x405f5a
cmp byte [ebp + 2], 0
je 0x405fb1
push ebp
mov ebp, dword [esp + 0x14]
push ebp
call fcn.0040624f
test byte [esp + 0x20], 0x10
je 0x405f7e
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x405fb5
push ebx
push esi
call fcn.00405e53
jmp 0x405fb5
push edi
push esi
call fcn.00405cc5
test eax, eax
jne 0x405fa7
test edi, edi
je 0x405f9f
push esi
push 0xfffffffffffffff1
call fcn.00405654
push 0
push esi
call fcn.00405ae5
jmp 0x405fb5
inc dword [0x42f188]
jmp 0x405fb5
push esi
push 0xfffffffffffffff2
call fcn.00405654
jmp 0x405fb5
mov ebp, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405f1c
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x18], 0
je 0x40602f
mov eax, dword [esp + 0x1c]
mov byte [ebp - 1], 0
test eax, eax
je 0x40601f
push esi
call fcn.00405d0f
test eax, eax
je 0x40602f
push esi
call fcn.00405c98
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00405cc5
test eax, eax
jne 0x406027
test edi, edi
je 0x40601f
push esi
push 0xfffffffffffffff1
call fcn.00405654
push 0
push esi
call fcn.00405ae5
jmp 0x40602f
inc dword [0x42f188]
jmp 0x40602f
push esi
push 0xffffffffffffffe5
call fcn.00405654
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x150
ret 8

Function at 0x406071
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc
Function at 0x4060cf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
mov byte [esi], bl
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406141
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0x400
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406130
cmp dword [ebp + 0x14], 1
je 0x406132
cmp dword [ebp + 0x14], 2
je 0x406132
mov byte [esi], bl
push dword [ebp - 4]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x406196
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add byte [ebp + 0xa], dl
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4061d5
test edi, edi
jne 0x4061a1
mov byte [esi], al
jmp 0x4061d7
mov eax, esi
pop edi
pop esi
pop ebp
ret 8

Function at 0x4062be
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4062e0
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x4064a4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42cac4], 0
push esi
jne 0x4064de
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x4064b5
mov dword [ecx*4 + 0x42cac0], edx
inc ecx
cmp ecx, 0x100
jl 0x4064b0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406508
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x42cac0]
inc esi
sub edx, 1
jne 0x4064f0
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
mov ecx, 0x567002ea
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text
mov ebx, 0x4304d8
nop
mov ecx, 0x509d6f40
nop
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219