joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64b1b580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x64c09420]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x64b19d6b
je 0x64b19dbe
cmp ebx, 0x20
jbe 0x64b19dc4
cmp ebx, 0x40
jbe 0x64b19e0a
jmp 0x64b19eab
test ebx, ebx
je 0x64b19db4
add eax, 0x10
test ax, 0xff0
je 0x64b19da0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x64b85de0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x64b85ee0]
jmp 0x64b19d88
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x64b19d88
pxor xmm1, xmmword [0x64c09430]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x64c09430]
pxor xmm2, xmmword [0x64c09440]
pxor xmm3, xmmword [0x64c09450]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x64c09430]
pxor xmm2, xmmword [0x64c09440]
pxor xmm3, xmmword [0x64c09450]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x64b19f0a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x64c0914b], 0
je 0x64b1b59a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x64b19d30
jmp fcn.64ac7c80
Function at 0x64b2a260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x64b2a38a
sub esp, 0xc
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x64b2a2e3
mov edx, dword [esp + 0x1c]
cmp ecx, edx
ja 0x64b2a384
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
cmp edx, ebx
je 0x64b2a2ba
nop
mov ebp, ebx
lea esi, [edx + ecx - 1]
cmp esi, ebx
jb 0x64b2a2b8
mov ebx, edx
lea esi, [ebp + ecx - 1]
cmp esi, edx
jae 0x64b2a36c
mov edx, ebx
mov ebx, ebp
jmp 0x64b2a2ba
mov ebx, ebp
mov ebp, dword [esp + 0x10]
movzx esi, byte [ebp + 0x400]
movzx edi, byte [ebp + 0x401]
lea eax, [ecx - 1]
mov ebx, dword [esp + 0x18]
cmp ebx, eax
jbe 0x64b2a365
mov ebx, dword [esp + 0x14]
xor eax, eax
jmp 0x64b2a303
add esp, 0xc
ret
mov edx, dword [esp + 0x14]
mov byte [edx + eax], bl
inc eax
mov ebx, dword [esp + 0x20]
movzx esi, byte [esp + 0xb]
movzx edi, byte [esp + 0xa]
mov edx, ebx
mov ebx, dword [esp + 0x14]
cmp ecx, eax
jle 0x64b2a34c
movzx edx, byte [edx + eax]
mov byte [esp + 9], dl
inc esi
xchg esi, eax
mov byte [esp + 0xb], al
xchg esi, eax
xchg esi, eax
movzx eax, al
xchg esi, eax
mov ebx, dword [ebp + esi*4]
add edi, ebx
xchg edi, eax
mov byte [esp + 0xa], al
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
mov edx, dword [ebp + edi*4]
mov dword [ebp + esi*4], edx
mov dword [ebp + edi*4], ebx
add edx, ebx
movzx edx, dl
movzx ebx, byte [esp + 9]
xor ebx, dword [ebp + edx*4]
cmp ecx, eax
ja 0x64b2a2e7
jmp 0x64b2a360
xchg esi, eax
mov byte [ebp + 0x400], al
xchg esi, eax
xchg edi, eax
mov byte [ebp + 0x401], al
xchg edi, eax
add esp, 0xc
ret
call fcn.64b1b760
mov ecx, ebx
call fcn.64b1b760
lea eax, [0x64b5e700]
mov dword [esp], eax
lea eax, [0x64b85a9c]
mov dword [esp + 4], eax
call fcn.64af2a80
call fcn.64b1b7a0
nop
call fcn.64b1a2c0
jmp fcn.64b2a260
Function at 0x64b44a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x1c]
cmp eax, dword [ecx + 8]
jbe 0x64b44c66
sub esp, 0x9c
mov dword [esp + 0x42], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x42], 0x494d4c5c
mov dword [esp + 0x46], 0x72617547
mov dword [esp + 0x4a], 0x6e616964
mov word [esp + 0x4e], 0x4244
lea eax, [esp + 0x70]
mov dword [esp], eax
lea eax, [esp + 0x42]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
call fcn.64b095f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [0x64be4600]
mov ebx, dword [0x64be4604]
test ebx, ebx
jbe 0x64b44c5c
mov dword [esp + 0x94], eax
mov dword [esp + 0x30], ecx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.64b437b0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.64b43d00
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
test eax, eax
jne 0x64b44c3f
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov eax, dword [esp + 0x94]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea edx, [0x64b67e3d]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 4
call fcn.64b093e0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x98], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x34], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.64b446b0
movzx eax, byte [esp + 8]
test al, al
je 0x64b44b5c
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x98]
jmp 0x64b44c2a
mov dword [esp + 0x39], 0
mov dword [esp + 0x3a], 0
mov dword [esp + 0x3e], 0
mov dword [esp + 0x39], 0x494d4c5c
mov dword [esp + 0x3d], 0x72617547
mov byte [esp + 0x41], 0x64
lea eax, [esp + 0x50]
mov dword [esp], eax
lea eax, [esp + 0x39]
mov dword [esp + 4], eax
mov dword [esp + 8], 9
call fcn.64b095f0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x90], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
lea edx, [0x64b681fa]
mov dword [esp], edx
mov dword [esp + 4], 6
call fcn.64b39d40
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x90]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], eax
lea eax, [0x64b67e3d]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 4
call fcn.64b09480
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ecx
add esp, 0x9c
ret
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
add esp, 0x9c
ret
xor eax, eax
mov ecx, eax
call fcn.64b1b760
nop
call fcn.64b1a2c0
jmp fcn.64b44a10
Function at 0x64b452a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [0x64c0cf30], eax
test eax, eax
je 0x64b452e8
mov dword [esp], 0x64c0cf34
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
add esp, 0x1c
ret
mov dword [esp], 2
call dword [0x64b56fbc]
mov dword [esp + 8], 0x3d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x64b45a10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x64c0d2b8]
test esi, esi
jle 0x64b45b20
mov edi, dword [0x64c0d2bc]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x64b45a44
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x64b45ac5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x64b45a30
mov dword [esp], eax
mov ebx, eax
call fcn.64b46160
test eax, eax
mov edi, eax
je 0x64b45b47
mov eax, dword [0x64c0d2bc]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.64b46260
add eax, dword [edi + 0xc]
mov edx, dword [0x64c0d2bc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x64b45b27
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x64b45abe
sub eax, 4
and eax, 0xfffffffb
jne 0x64b45ad0
add dword [0x64c0d2b8], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x64c0d2bc]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x64b45abe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.64b46728
lea esi, [esi]
xor esi, esi
jmp 0x64b45a4e
mov eax, dword [0x64c0d2bc]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.64b46728
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.64b46728
mov esi, esi
lea edi, [edi]
Function at 0x64b45de0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x64c0d2c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x64c0d2c0]
sub esp, 4
test ebx, ebx
je 0x64b45e35
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x64b45e2e
test esi, esi
je 0x64b45e2e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x64b45e10
mov dword [esp], 0x64c0d2c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x64b46728
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.64b46700
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.64b46700
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0xd03d90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x406000]
push edi
or ebp, 0xffffffff
jmp 0xd03db2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xd03db9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd03da8
mov eax, 1
add ebx, ebx
jne 0xd03dcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xd03ddc
jne 0xd03dfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd03dfb
dec eax
add ebx, ebx
jne 0xd03de8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xd03dc0
add ebx, ebx
jne 0xd03df7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xd03e4d
xor ecx, ecx
sub eax, 3
jb 0xd03e13
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xd03e82
sar eax, 1
mov ebp, eax
jmp 0xd03e1e
add ebx, ebx
jne 0xd03e1e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd03dec
inc ecx
add ebx, ebx
jne 0xd03e2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd03dec
add ebx, ebx
jne 0xd03e39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xd03e2e
jne 0xd03e4a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xd03e2e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xd03e6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xd03e5e
jmp 0xd03dae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xd03e6c
add edi, ecx
jmp 0xd03dae
pop esi
mov edi, esi
mov ecx, 0x12b7b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xd03e8a
cmp byte [edi], 0x27
jne 0xd03e8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xd03e8f
lea edi, [esi + 0x8c0000]
mov eax, dword [edi]
or eax, eax
je 0xd03f07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x913f7c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x914144]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xd03ebc
mov ecx, edi
jns 0xd03eeb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x91414c]
or eax, eax
je 0xd03f01
mov dword [ebx], eax
add ebx, 4
jmp 0xd03ed9
call dword [esi + 0x914148]
mov ebp, dword [esi + 0x914150]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xd03f3b
sub esp, 0xffffff80
jmp 0x72ad9c
Function at 0x452017
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00451e8d

Function at 0x53b000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
push edx
push ebx
push ebp
push esi
push edi
call 0x53b00c
pop eax
sub eax, 0x8c80c
mov edi, 0
push eax
Function at 0x401000
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
lea eax, [ebp - 0x458]
push esi
push dword [ebp + 8]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4010c7
test byte [ebp - 0x250], 0x10
je 0x4010ae
push 0x41433c
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4010ae
push 0x414340
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4010ae
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x458]
push str._s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x458]
push eax
call section..text
add esp, 0x14
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401041
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
leave
ret
Function at 0x402d42
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x40262d
push 0
push 0x7d8
push dword [0x41cb38]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x41cf24], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x41cf24]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop ebp
ret

Function at 0x402dd6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x41cf34]
sub esp, 0x104
test eax, eax
jne 0x402e39
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.cabinet.dll
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x41cf34], eax
test eax, eax
jne 0x402e39
push 0x10
push str.ArcDec
push str.CABINET.DLL_not_found.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
leave
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
call esi
push str.FDICopy
push dword [0x41cf34]
mov dword [0x41cf38], eax
call esi
push str.FDIIsCabinet
push dword [0x41cf34]
mov dword [0x41cf40], eax
call esi
push str.FDIDestroy
push dword [0x41cf34]
mov dword [0x41cf3c], eax
call esi
mov ecx, dword [0x41cf38]
mov dword [0x41cf44], eax
pop esi
test ecx, ecx
je 0x402e35
cmp dword [0x41cf40], 0
je 0x402e35
cmp dword [0x41cf3c], 0
je 0x402e35
test eax, eax
je 0x402e35
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ecx
add esp, 0x24
leave
ret
Function at 0x40303f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00408590
mov esi, eax
pop ecx
push 0x5c
pop ebx
movzx eax, word [esi + 2]
lea edi, [esi + 4]
cmp eax, 0x3a
jne 0x40306e
cmp word [edi], bx
jne 0x40306e
mov eax, esi
jmp 0x40309c
cmp word [esi], bx
jne 0x403149
cmp ax, bx
jne 0x403149
push esi
call fcn.00408648
pop ecx
cmp eax, 7
jbe 0x403149
push ebx
push edi
call fcn.004061f9
pop ecx
pop ecx
add eax, 2
push ebx
push eax
call fcn.004061f9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x403149
push esi
call fcn.00408648
pop ecx
cmp word [esi + eax*2 - 2], bx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x4030cb
push 0x41458c
push edi
call ebx
push 0x208
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.00405d90
add esp, 0xc
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x208]
push esi
push eax
call ebx
push 0x41458c
lea eax, [ebp - 0x208]
push eax
call ebx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x403123
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x403149
lea eax, [edi + 2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5c
push esi
call fcn.004061f9
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4030e1
push esi
call fcn.00408920
xor eax, eax
inc eax
jmp 0x403151
push esi
call fcn.00408920
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403454
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004051e0
push esi
push 0x1000
lea eax, [ebp - 0x1004]
xor esi, esi
push eax
push dword [ebp + 8]
call fcn.00403cca
mov edx, eax
add esp, 0xc
cmp edx, 0x200
jl 0x403513
mov eax, 0x5a4d
cmp word [ebp - 0x1004], ax
jne 0x403513
mov ecx, dword [ebp - 0xfc8]
test ecx, ecx
jle 0x403513
lea eax, [edx - 0x138]
cmp ecx, eax
jge 0x403513
lea ecx, [ebp + ecx - 0x1004]
cmp dword [ecx], 0x4550
jne 0x403513
movzx eax, word [ecx + 6]
push ebx
mov dword [ebp - 4], eax
xor ebx, ebx
movzx eax, word [ecx + 0x14]
push edi
lea edi, [ecx + 0x18]
mov ecx, dword [ebp - 4]
add edi, eax
lea eax, [ebp - 0x1004]
sub eax, edi
add edx, eax
inc ebx
sub edx, 0x28
test edx, edx
jle 0x403506
test dword [edi + 0x24], 0x40000040
lea eax, [ebx + 1]
movzx ecx, ax
movzx eax, bx
cmove ecx, eax
add edi, 0x28
movzx eax, cx
mov ecx, dword [ebp - 4]
mov ebx, eax
cmp ax, cx
jb 0x4034dc
cmp bx, cx
jne 0x403511
mov esi, dword [edi + 0x14]
add esi, dword [edi + 0x10]
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret
Function at 0x4041bc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push 8
mov edi, esi
pop ebx
mov edx, edi
mov ecx, edi
shr edx, 1
mov eax, edx
mov edi, edx
xor eax, 0xedb88320
and cl, 1
cmovne edi, eax
sub ebx, 1
jne 0x4041c6
mov dword [esi*4 + 0x41cf50], edi
inc esi
cmp esi, 0x100
jb 0x4041c1
or dword [0x41cf4c], 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x4041fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x404230
mov edx, dword [0x41cf4c]
push edi
mov edi, dword [ebp + 8]
movzx ecx, byte [esi + edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x41cf50]
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x404210
mov dword [0x41cf4c], edx
pop edi
pop esi
pop ebp
ret

Function at 0x4045bd
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x41ea28], 0
jne 0x4046a5
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [ebp + 8]
xor edi, edi
push edi
push dword [0x41cb38]
push 0x3e8
push eax
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 4]
push eax
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
push eax
push dword [ecx + 4]
push dword [ecx]
push 0x56340440
push edi
push str.LISTBOX
push 0x40080
call dword [sym.imp.USER32.dll_CreateWindowExW]
push edi
push dword [ebp + 0xc]
mov dword [0x41ea28], eax
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x41ea34], edi
jne 0x40463b
push 0xfffffffffffffffc
push dword [0x41ea28]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [0x41ea34], eax
push 0x404a30
push 0xfffffffffffffffc
push dword [0x41ea28]
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [0x41ea38], edi
jne 0x4046a4
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push edi
push 0x404b3f
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ebx, 0x3f4
mov dword [0x41ea38], eax
push ebx
push dword [0x41ea2c]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x4046a3
push edi
push ebx
push dword [0x41ea2c]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
pop ebx
pop edi
pop ebp
ret