joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418f50
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x418f72
cmp eax, esi
jae 0x418f72
mov eax, 1
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x418f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418f9c
test al, 0x10
jne 0x418f9c
mov eax, 1
ret 4
xor eax, eax
ret 4

Function at 0x419020
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
lea eax, [esp + 4]
push ebx
push ebp
push esi
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
test esi, esi
jbe 0x4190be
mov al, byte [esp + esi + 0xf]
mov ebp, dword [esp + 0x11c]
cmp al, 0x5c
push edi
setne bl
mov byte [esp + 0x10], bl
mov edi, ebp
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
and edx, 0xff
repne scasb al, byte es:[edi]
mov eax, 0x105
pop edi
not ecx
sub eax, edx
dec ecx
sub eax, esi
cmp ecx, eax
jae 0x4190be
test bl, bl
je 0x419081
mov byte [esp + esi + 0x10], 0x5c
sub edx, ebp
mov eax, ebp
add edx, esi
lea edx, [esp + edx + 0x10]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41908b
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
pop esi
mov edx, dword [esp + 0x11c]
pop ebp
test eax, eax
setne cl
mov dword [edx], eax
mov eax, ecx
pop ebx
add esp, 0x10c
ret 8
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 8

Function at 0x419200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
push eax
push ecx
push ebx
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x41925a
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41925a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x419253
mov edx, dword [esp + 0x24]
push esi
push ebx
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, 1
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x419270
Capabilities:
Clear file content

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
lea edx, [esp + 8]
xor ecx, ecx
push 1
xor eax, eax
push edx
push ecx
push eax
push esi
xor edi, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call fcn.00419320
test eax, eax
je 0x419307
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
push edi
push ecx
push edx
push esi
call fcn.00419320
test eax, eax
je 0x419307
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x4192e2
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push edi
push edi
push eax
push ecx
push esi
call fcn.00419320
test eax, eax
je 0x419307
pop edi
mov eax, 1
pop esi
add esp, 8
ret 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, dword [esp + 0xc]
push 0
push 0
push edx
push eax
push esi
call fcn.00419320
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
mov eax, edi
pop edi
pop esi
add esp, 8
ret 0x10

Function at 0x4194e0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call edi
mov esi, dword [esp + 0x30]
cmp esi, ebx
je 0x4195a4
cmp dword [esi], 0x40
jne 0x4195a4
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0x20
rep stosd dword es:[edi], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GlobalMemoryStatusEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x419542
push esi
call eax
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 8], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 4
push 0x57
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret 4
Function at 0x4195c0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1004
call fcn.0042cf10
mov ecx, dword [esp + 0x100c]
lea eax, [esp + 0x1010]
push edi
push eax
push ecx
lea edx, [esp + 0x10]
push 0x1000
push edx
call fcn.0042cf3f
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
mov byte [esp + 0x1007], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
cmp ecx, 0xffffffff
jbe 0x41961a
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esp, 0x1004
ret
mov edx, dword [esp + 0x1008]
lea eax, [esp]
push 0
push eax
push ecx
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x1004
ret

Function at 0x419b10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push ebx
push esi
push edi
push 0x104
xor edi, edi
push eax
push 1
push edi
push edi
push str.afr
call fcn.00418750
mov esi, eax
cmp esi, 0xffffffff
je 0x419bb5
mov ebx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
lea ecx, [esp + 0xc]
push edi
push ecx
push ebx
push edx
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x419bae
cmp ebx, dword [esp + 0xc]
jne 0x419bae
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
call fcn.004198f0
mov esi, eax
cmp esi, edi
je 0x419ba0
push edi
push 0x4000000
push 3
push edi
push 1
lea ecx, [esp + 0x24]
push 0xc0000000
push ecx
call fcn.00418580
push eax
push esi
call fcn.00419bd0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x108
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x108
ret 8

Function at 0x419be0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
push ecx
xor ebp, ebp
push edx
push ebx
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov esi, eax
test esi, esi
je 0x419c5d
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x419c5d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x419c48
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebp
call fcn.00419b10
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov esi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x41a100
Capabilities:
Check http status code

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
push esi
mov dword [esp + 0xc], ebx
call fcn.00419d90
cmp eax, 7
je 0x41a1c0
cmp eax, 0xd
jne 0x41a22d
lea eax, [esp + 0x1c]
push edi
push eax
push 0x13
push esi
mov dword [esp + 0x2c], ebx
call fcn.00419de0
test eax, eax
mov edi, dword [esp + 0x1c]
je 0x41a19d
cmp dword [esp + 0x20], 0x190
jae 0x41a19d
lea ecx, [esp + 0xc]
push ecx
push 5
push esi
call fcn.00419de0
test eax, eax
je 0x41a17a
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov bl, 1
mov dword [edi + 0x20], edx
pop edi
mov dword [eax], ecx
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x1c], 0xa0000004
mov dword [edi + 0x20], edx
pop edi
mov dword [eax], ecx
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x1c], 0xa0000003
mov dword [edi + 0x20], edx
pop edi
mov dword [eax], ecx
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret 0xc
lea eax, [esp + 0x10]
push eax
push esi
call dword [0x4410a0]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41a202
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41a1fe
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
pop esi
mov dword [ecx + 0x1c], 0xa0000004
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov al, bl
pop ebx
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x10], ebx
jne 0x41a222
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 8]
mov bl, 1
mov dword [eax], ecx
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x18]
mov dword [edx + 0x1c], 0xa0000005
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 8]
pop esi
mov dword [eax], ecx
mov al, bl
pop ebx
add esp, 0xc
ret 0xc
Function at 0x41a250
Capabilities:
Download and write a file
Query remote server for available data
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x10]
push ebx
push eax
push edi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
mov esi, dword [esp + 0x14]
je 0x41a365
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41a36c
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x18], eax
cmp eax, ecx
jbe 0x41a295
mov eax, ecx
mov dword [esp + 0x18], eax
mov edx, dword [esi + 0x10]
lea ecx, [esp + 0x18]
push ecx
push eax
push edx
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x41a336
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x10]
mov edx, dword [esp + 0x20]
push eax
push ecx
add eax, ebx
push edx
push eax
push 5
push edi
push esi
call fcn.0041a0c0
test al, al
je 0x41a32d
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x41a316
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
cmp eax, 0xffffffff
je 0x41a308
lea edx, [esp + 0x14]
push 0
push edx
push ecx
mov ecx, dword [esi + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41a324
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp ecx, eax
jne 0x41a324
mov eax, dword [esp + 0xc]
add ebx, ecx
sub eax, ecx
mov dword [esp + 0xc], eax
jmp 0x41a31a
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x41a284
jmp 0x41a345
mov dword [esi + 0x1c], 0xa0000008
jmp 0x41a33d
mov dword [esi + 0x1c], 0xa0000001
jmp 0x41a33d
mov dword [esi + 0x1c], 0xa0000007
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x41a36c
push 0
lea edx, [esp + 0x10]
push 0
push edx
push edi
mov dword [esp + 0x1c], 0
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x41a278
mov dword [esi + 0x1c], 0xa0000007
mov eax, dword [esp + 0x20]
cmp ebx, eax
jne 0x41a3aa
push 0
push 0
push eax
push ebx
push 6
push edi
push esi
call fcn.0041a0c0
test al, al
je 0x41a39a
mov dword [esi + 0x1c], 0x20000000
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0x10
mov dword [esi + 0x1c], 0xa0000001
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0x10
cmp dword [esi + 0x1c], 0xa0ffffff
jne 0x41a3ba
mov dword [esi + 0x1c], 0xa0000009
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0x10
Function at 0x41b120
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push edi
mov edx, dword [esp + 0x4c]
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 8]
mov dword [esp + 4], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x58]
lea eax, [esp + 4]
push eax
mov dword [esp + 0xc], 0x100
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
add esp, 0x3c
ret 0x18

Function at 0x41b960
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x41b9ea
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
cmp eax, 0x102
ja 0x41b9d0
je 0x41b9a7
test eax, eax
je 0x41b99a
cmp eax, 0x80
jne 0x41b9d5
mov ecx, dword [esp + 0x14]
mov al, 1
mov dword [ecx], esi
pop esi
pop ebx
ret 0xc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41b9c7
push 0
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x41b9c7
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x102
call ebx
jmp 0x41b9d6
cmp eax, 0xffffffff
je 0x41b9d6
int3
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
pop edi
mov edx, dword [esp + 0x14]
pop esi
xor al, al
pop ebx
mov dword [edx], 0
ret 0xc

Function at 0x41cb50
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, 0x696e4942
mov cl, byte [edx]
test cl, cl
je 0x41cb74
shl eax, 3
and ecx, 0xff
xor eax, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
not eax
jne 0x41cb5f
ret 4

Function at 0x41e610
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1000
call fcn.0042cf10
mov ecx, dword [esp + 0x1004]
lea eax, [esp + 0x1008]
push eax
push ecx
lea edx, [esp + 8]
push 0x1000
push edx
call fcn.0042cf3f
add esp, 0x10
mov byte [esp + 0xfff], 0
test eax, eax
jle 0x41e65a
cmp eax, 0x1000
jae 0x41e65a
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x1000
ret

Function at 0x41e670
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push ebx
push ecx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41e6aa
mov ebx, dword [ebp + 0xc]
mov esi, 0x439b50
add ecx, ebx
not eax
movzx edi, byte ds:[ebx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword ds:[esi + edi*4]
inc ebx
cmp ebx, ecx
jne 0x41e690
not eax
pop edi
pop esi
pop ecx
pop ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x421120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push esi
push edi
mov edi, 8
mov ecx, dword [eax]
mov edx, dword [eax + 4]
xor eax, eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
xor esi, esi
mov dl, byte [esp + esi + 8]
mov al, 1
mov ecx, esi
shl al, cl
test dl, 0x40
je 0x42115a
or byte [esp + 0x10], al
test dl, 0x10
je 0x421163
or byte [esp + 0x11], al
test dl, 4
je 0x42116c
or byte [esp + 0x12], al
test dl, 1
je 0x421175
or byte [esp + 0x13], al
test dl, dl
jns 0x42117d
or byte [esp + 0x14], al
test dl, 0x20
je 0x421186
or byte [esp + 0x15], al
test dl, 8
je 0x42118f
or byte [esp + 0x16], al
test dl, 2
je 0x421198
or byte [esp + 0x17], al
inc esi
dec edi
jne 0x421147
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
push ebx
xor bl, bl
push ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov byte [esp + 0x18], bl
and edi, 1
mov eax, dword [esp + 0x18]
and eax, 0xff
lea ecx, [eax + eax*2]
lea eax, [esp + 0x10]
lea edx, [ebp + ecx*2]
lea ecx, [esp + 0x2c]
push edx
push eax
push ecx
call fcn.00421290
mov eax, dword [esp + 0x2c]
xor eax, esi
mov esi, dword [esp + 0x10]
test edi, edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], eax
jne 0x4211fc
inc bl
cmp bl, 0x10
mov byte [esp + 0x18], bl
jb 0x4211bb
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x14], esi
pop ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
xor esi, esi
mov edi, 8
pop ebx
mov cl, byte [esp + esi + 8]
mov al, byte [esi + 0x43a0f0]
test cl, 1
je 0x42122a
or byte [esp + 0x10], al
test cl, 2
je 0x421233
or byte [esp + 0x11], al
test cl, 4
je 0x42123c
or byte [esp + 0x12], al
test cl, 8
je 0x421245
or byte [esp + 0x13], al
test cl, 0x10
je 0x42124e
or byte [esp + 0x14], al
test cl, 0x20
je 0x421257
or byte [esp + 0x15], al
test cl, 0x40
je 0x421260
or byte [esp + 0x16], al
test cl, cl
jns 0x421268
or byte [esp + 0x17], al
inc esi
dec edi
jne 0x421217
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [eax], edx
mov dword [eax + 4], ecx
pop esi
add esp, 0x10
ret 0xc
Function at 0x421b10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x10
test al, 1
je 0x421b31
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call fcn.00421120
add esp, 0x10
ret 0xc
mov eax, dword [esp + 0x14]
push esi
push edi
mov edi, 8
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
xor esi, esi
mov dl, byte [esp + esi + 0x10]
mov al, 1
mov ecx, esi
shl al, cl
test dl, 0x40
je 0x421b68
or byte [esp + 8], al
test dl, 0x10
je 0x421b71
or byte [esp + 9], al
test dl, 4
je 0x421b7a
or byte [esp + 0xa], al
test dl, 1
je 0x421b83
or byte [esp + 0xb], al
test dl, dl
jns 0x421b8b
or byte [esp + 0xc], al
test dl, 0x20
je 0x421b94
or byte [esp + 0xd], al
test dl, 8
je 0x421b9d
or byte [esp + 0xe], al
test dl, 2
je 0x421ba6
or byte [esp + 0xf], al
inc esi
dec edi
jne 0x421b55
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 8]
push ebx
push ebp
mov dword [esp + 0x2c], edi
lea ebx, [ecx + 0x5a]
mov ebp, 0x10
lea edx, [esp + 0x2c]
push ebx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.00421290
sub ebx, 6
mov eax, dword [esp + 0x28]
xor eax, esi
mov esi, edi
mov edi, eax
dec ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edi
jne 0x421bc4
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x1c], esi
pop ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
xor esi, esi
mov edi, 8
pop ebx
mov cl, byte [esp + esi + 0x10]
mov al, byte [esi + 0x43a0f0]
test cl, 1
je 0x421c1a
or byte [esp + 8], al
test cl, 2
je 0x421c23
or byte [esp + 9], al
test cl, 4
je 0x421c2c
or byte [esp + 0xa], al
test cl, 8
je 0x421c35
or byte [esp + 0xb], al
test cl, 0x10
je 0x421c3e
or byte [esp + 0xc], al
test cl, 0x20
je 0x421c47
or byte [esp + 0xd], al
test cl, 0x40
je 0x421c50
or byte [esp + 0xe], al
test cl, cl
jns 0x421c58
or byte [esp + 0xf], al
inc esi
dec edi
jne 0x421c07
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop esi
add esp, 0x10
ret 0xc

Function at 0x421f20
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push esi
mov esi, dword [esp + 0x44]
push edi
push 8
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, eax
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [edx + 0x1c]
test eax, eax
je 0x421f8a
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0
mov eax, dword [edx + 0x1c]
push 0
push 0x69
push esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 1
call fcn.0041b870
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 1
push 0x69
push esi
call fcn.0041b870
pop edi
pop esi
add esp, 0x3c
ret 4
Function at 0x423cd0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
ret 4

Function at 0x4257a0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call edi
cmp eax, 0xffffffff
je 0x4257e6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call ebx
test eax, eax
jne 0x4257dc
push 0x1f4
call ebp
push esi
call edi
cmp eax, 0xffffffff
jne 0x4257ce
pop ebp
pop ebx
pop edi
pop esi
ret 4

Function at 0x4259a0
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Terminate process

Disassembly:
sub esp, 0x158
push esi
push edi
push str._UPDATE:
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.0040f100
test eax, eax
je 0x425a8b
lea edx, [eax + 9]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
je 0x425a8b
cmp byte [esi + edx - 1], 1
jne 0x425a8b
cmp esi, 0x104
ja 0x425a8b
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], 0x44
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0x60]
push edx
push eax
call fcn.0040f190
lea ecx, [esp + 0x5c]
mov byte [esp + esi + 0x5b], 0
push ecx
call fcn.004257a0
lea edx, [esp + 0x5c]
push 0
mov eax, dword [esp + 0x168]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x7c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x425a83
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 0x10], 0
call esi
mov eax, dword [esp + 8]
mov dword [esp + 8], 0
push eax
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x164]
push ecx
call fcn.004257a0
pop edi
pop esi
add esp, 0x158
ret 4

Function at 0x425e60
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x800
lea eax, [esp]
push esi
mov esi, dword [esp + 0x808]
push 0x800
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x425ec4
cmp byte [esp + 4], 0x23
jne 0x425ec4
lea ecx, [esp + 4]
push 0x800
push ecx
push 0xa
lea edx, [esp + 0x11]
push 0
push edx
call fcn.0042e531
add esp, 0xc
push eax
mov eax, dword [esp + 0x818]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x425ec4
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
pop esi
add esp, 0x800
ret 8
Function at 0x426960
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
mov ecx, 4
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x43aa58]
xor eax, edx
dec ecx
jne 0x426969
ret