joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405640
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ecx
mov eax, ecx
push ebx
push ebp
push esi
lea edx, [eax + 4]
push edi
mov ebp, dword [esp + 0x18]
mov ecx, 0x12
mov esi, 0x4112ec
mov edi, edx
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x4c]
mov ecx, 0x12
mov esi, 0x4112ec
mov dword [esp + 0x10], eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x400
mov esi, 0x411334
lea edi, [eax + 0x94]
test ebp, ebp
rep movsd dword es:[edi], dword [esi]
je 0x405792
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x405792
xor ecx, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 0x12
mov eax, ecx
cdq
idiv ebx
xor eax, eax
inc ecx
mov al, byte [edx + ebp]
mov edi, eax
mov eax, ecx
cdq
idiv ebx
xor eax, eax
shl edi, 8
mov al, byte [edx + ebp]
mov esi, eax
or esi, edi
inc ecx
mov eax, ecx
cdq
idiv ebx
xor eax, eax
shl esi, 8
mov al, byte [edx + ebp]
mov edi, eax
or edi, esi
inc ecx
mov eax, ecx
cdq
idiv ebx
xor eax, eax
shl edi, 8
mov al, byte [edx + ebp]
mov edx, dword [esp + 0x18]
or eax, edi
inc ecx
mov edi, dword [edx]
add edx, 4
xor edi, eax
mov eax, dword [esp + 0x1c]
mov dword [edx - 4], edi
dec eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jne 0x4056a3
mov ecx, dword [esp + 0x10]
xor eax, eax
mov ebx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea esi, [ecx + 4]
lea edi, [ebx + 0x90]
mov ebp, 9
lea edx, [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, ebx
call fcn.00405990
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esi], eax
add esi, 4
sub edi, 4
mov dword [esi], ecx
mov dword [edi + 4], eax
mov dword [edi], ecx
add esi, 4
sub edi, 4
dec ebp
jne 0x40571f
lea esi, [ebx + 0x98]
mov ebp, 4
mov edi, 0x80
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, ebx
call fcn.00405990
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esi - 4], eax
mov dword [esi], ecx
add esi, 8
dec edi
jne 0x405760
dec ebp
jne 0x40575b
pop edi
pop esi
mov byte [ebx], 1
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
mov byte [eax], 0
pop ebx
pop ecx
ret 8
Function at 0x405840
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov dl, byte [eax]
inc eax
mov byte [esp + 0x17], dl
push edi
mov dl, byte [eax]
inc eax
mov byte [esp + 0x1a], dl
mov edi, 8
mov dl, byte [eax]
inc eax
mov byte [esp + 0x19], dl
mov dl, byte [eax]
inc eax
mov byte [esp + 0x18], dl
mov dl, byte [eax]
inc eax
mov byte [esp + 0x13], dl
mov dl, byte [eax]
inc eax
mov byte [esp + 0x12], dl
mov dl, byte [eax]
mov al, byte [eax + 1]
mov byte [esp + 0x11], dl
mov edx, dword [esp + 0x2c]
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov ebp, dword [edx]
add edx, 4
xor eax, ebp
add edx, 4
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x1a]
mov ebp, dword [esp + 0x1b]
and ebx, 0xff
and ebp, 0xff
mov ebx, dword [ecx + ebx*4 + 0x494]
add ebx, dword [ecx + ebp*4 + 0x94]
mov ebp, dword [esp + 0x19]
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x894]
mov ebp, eax
and ebp, 0xff
add ebx, dword [ecx + ebp*4 + 0xc94]
mov ebp, dword [edx - 4]
xor ebx, ebp
xor esi, ebx
mov dword [esp + 0x10], esi
mov ebx, dword [esp + 0x12]
mov ebp, dword [esp + 0x13]
and ebx, 0xff
and ebp, 0xff
mov ebx, dword [ecx + ebx*4 + 0x494]
add ebx, dword [ecx + ebp*4 + 0x94]
mov ebp, dword [esp + 0x11]
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x894]
mov ebp, esi
and ebp, 0xff
add ebx, dword [ecx + ebp*4 + 0xc94]
xor eax, ebx
dec edi
jne 0x405893
mov ecx, dword [edx]
mov ebp, dword [edx + 4]
xor eax, ecx
xor esi, ebp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], esi
inc eax
mov cl, byte [esp + 0x13]
mov dl, byte [esp + 0x12]
mov byte [eax - 1], cl
mov cl, byte [esp + 0x11]
mov byte [eax], dl
mov dl, byte [esp + 0x10]
inc eax
pop edi
pop esi
pop ebp
mov byte [eax], cl
mov cl, byte [esp + 0xf]
inc eax
pop ebx
mov byte [eax], dl
mov dl, byte [esp + 0xa]
inc eax
mov byte [eax], cl
mov cl, byte [esp + 9]
inc eax
mov byte [eax], dl
mov dl, byte [esp + 8]
inc eax
mov byte [eax], cl
mov byte [eax + 1], dl
add esp, 0x10
ret 0xc
Function at 0x405990
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
sub esp, 0x10
mov eax, dword [eax]
mov edx, dword [edx]
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 8]
mov edi, 8
mov ebx, dword [esi - 4]
add esi, 8
xor eax, ebx
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x12]
mov ebp, dword [esp + 0x13]
and ebx, 0xff
and ebp, 0xff
mov ebx, dword [ecx + ebx*4 + 0x494]
add ebx, dword [ecx + ebp*4 + 0x94]
mov ebp, dword [esp + 0x11]
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x894]
mov ebp, eax
and ebp, 0xff
add ebx, dword [ecx + ebp*4 + 0xc94]
xor ebx, edx
mov edx, dword [esi - 8]
xor edx, ebx
mov dword [esp + 0x18], edx
mov ebx, dword [esp + 0x1a]
mov ebp, dword [esp + 0x1b]
and ebx, 0xff
and ebp, 0xff
mov ebx, dword [ecx + ebx*4 + 0x494]
add ebx, dword [ecx + ebp*4 + 0x94]
mov ebp, dword [esp + 0x19]
and ebp, 0xff
xor ebx, dword [ecx + ebp*4 + 0x894]
mov ebp, edx
and ebp, 0xff
add ebx, dword [ecx + ebp*4 + 0xc94]
xor eax, ebx
dec edi
jne 0x4059ab
mov esi, dword [ecx + 0x48]
pop edi
xor esi, edx
mov edx, dword [esp + 0x20]
mov dword [edx], esi
mov ecx, dword [ecx + 0x44]
mov edx, dword [esp + 0x24]
xor ecx, eax
pop esi
pop ebp
mov dword [edx], ecx
pop ebx
add esp, 0x10
ret 8

Function at 0x408c8c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412428
push 0x40c5e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov eax, dword [0x417294]
test eax, eax
je 0x408cd4
mov dword [ebp - 4], 1
call eax
jmp 0x408cd0
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call 0x408cdd
jmp 0x40d3e5
push 0xa
call fcn.0040c6f5
push 0x16
call fcn.0040f089
pop ecx
pop ecx
push 3
call fcn.00407086

Function at 0x408ce2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412440
push 0x40c5e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov eax, dword [fcn.00408c8c]
test eax, eax
je 0x408d2a
mov dword [ebp - 4], 1
call eax
jmp 0x408d26
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call 0x408d33
jmp fcn.00408c8c
Function at 0x402ac5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42ecb0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402b59
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402b16
cmp dword [ebp + 0x10], ebx
jne 0x402b4d
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402ac5
test eax, eax
jne 0x402b28
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405c58
cmp eax, ebx
je 0x402b60
push ebx
push dword [0x42ecb0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402b59
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42ecb0], ebx
jne 0x402b56
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402b56
jmp 0x402b59
Function at 0x4051df
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42c080], 0x44
push eax
xor eax, eax
push 0x42c080
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40521a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4052a4
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00405546
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x4052da
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ec88], eax
jmp 0x40545f
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x4052f5
test eax, eax
je 0x40540a
test cl, 2
je 0x40540a
mov esi, 0x42b080
push ebx
push esi
call fcn.00405972
cmp dword [ebp + 8], 0
je 0x405314
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40531a
push ebx
call fcn.004054ac
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405400
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405490
cmp byte [eax], 0
je 0x40536b
cmp byte [ebp - 0x18], 0
je 0x40536b
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405381
mov al, byte [esi + 1]
test al, al
je 0x4053df
cmp al, 0x2e
jne 0x405381
cmp byte [esi + 2], 0
je 0x4053df
push esi
push edi
call fcn.00405972
test byte [ebp - 0x148], 0x10
je 0x4053a6
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4053df
push dword [ebp + 0xc]
push ebx
call fcn.004052a4
jmp 0x4053df
push ebx
call fcn.0040562a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4053d7
test byte [ebp + 0xc], 4
je 0x4053cf
push ebx
push 0xfffffffffffffff1
call fcn.00404d1d
push 0
push ebx
call fcn.004056c0
jmp 0x4053df
inc dword [0x42ec88]
jmp 0x4053df
push ebx
push 0xfffffffffffffff2
call fcn.00404d1d
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405349
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40540a
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x40545f
cmp dword [ebp - 8], esi
jne 0x40541f
inc dword [0x42ec88]
jmp 0x40545f
push ebx
call fcn.00405c1a
test eax, eax
je 0x40545f
push ebx
call fcn.00405465
push ebx
call fcn.0040562a
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405457
test byte [ebp + 0xc], 4
je 0x405417
push ebx
push 0xfffffffffffffff1
call fcn.00404d1d
push esi
push ebx
call fcn.004056c0
jmp 0x40545f
push ebx
push 0xffffffffffffffe5
call fcn.00404d1d
pop esi
pop ebx
leave
ret 8
Function at 0x405546
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42b480
push esi
call fcn.00405972
push esi
call fcn.004054f9
mov edi, eax
test edi, edi
jne 0x405567
xor eax, eax
jmp 0x4055b9
push edi
call fcn.00405b81
test byte [0x42ec10], 0x80
je 0x405580
mov al, byte [edi]
test al, al
je 0x405563
cmp al, 0x5c
je 0x405563
sub edi, esi
jmp 0x405598
call fcn.00405c1a
test eax, eax
je 0x405592
test byte [eax], 0x10
je 0x405563
push esi
call fcn.004054ac
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405584
call fcn.00405465
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x40562a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405646
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405649
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405678
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4056bc
test edi, edi
jne 0x405683
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4056b6
Function at 0x4056c0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405c58
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4056e4
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40581d
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42c208], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x42c208
je 0x405728
push 1
push 0
push esi
call fcn.00405649
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405823
cmp eax, edi
jg 0x405823
mov esi, 0x42bc80
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405823
cmp eax, edi
jg 0x405823
push esi
push ebp
push str._s_s_r_n
push 0x42b880
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x42ec08]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405994
push 4
push 0xc0000000
push esi
call fcn.00405649
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x40581d
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405816
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405816
cmp edi, dword [esp + 0x18]
jne 0x405816
push str._Rename__r_n
push esi
call fcn.004055be
test eax, eax
jne 0x40582a
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405972
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x42b880
push eax
call fcn.0040560a
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x42ec90]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409388
push eax
call fcn.004055be
test eax, eax
je 0x4057e1
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405851
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405846
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x4057e3
Function at 0x405859
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4058ca
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4058b9
cmp dword [ebp + 0x14], 1
je 0x4058bb
cmp dword [ebp + 0x14], 2
je 0x4058bb
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405994
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jge 0x4059b5
mov ecx, dword [0x42e3dc]
lea eax, [edi*4 + 4]
sub ecx, eax
mov edi, dword [ecx]
mov eax, dword [0x42ec38]
mov ecx, dword [ebp + 8]
add edi, eax
mov eax, 0x42dba0
sub ecx, eax
mov ebx, eax
cmp ecx, 0x800
jae 0x405b5b
mov ebx, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405b5b
mov edx, ebx
sub edx, eax
cmp edx, 0x400
jge 0x405b68
inc edi
cmp cl, 0xfc
jbe 0x405b4e
movsx eax, byte [edi + 1]
movsx ecx, byte [edi]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
or ecx, edx
or eax, edx
inc edi
mov dword [ebp - 0x10], ecx
inc edi
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 8], eax
jne 0x405af9
cmp dword [0x42ec84], 0
push 2
pop esi
je 0x405a40
push 4
pop esi
mov eax, dword [ebp - 0x14]
test al, al
jns 0x405a77
mov ecx, eax
and eax, 0x3f
add eax, dword [0x42ec38]
and ecx, 0x40
push ecx
push ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405859
cmp byte [ebx], 0
jne 0x405ae0
push dword [ebp - 0xc]
push ebx
call fcn.00405994
jmp 0x405adb
cmp eax, 0x25
jne 0x405a8a
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405adb
cmp eax, 0x24
jne 0x405ad7
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor esi, esi
jmp 0x405ad7
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x14]
push dword [0x42ec04]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405ad4
push ebx
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp + 0xc], 0
jne 0x405adb
and byte [ebx], 0
test esi, esi
jne 0x405a9f
cmp byte [ebx], 0
je 0x405af1
cmp dword [ebp - 0xc], 0x1a
jne 0x405af1
push str.MicrosoftInternet_ExplorerQuick_Launch
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call fcn.00405b81
jmp 0x405b3f
cmp byte [ebp + 0xf], 0xfd
jne 0x405b2d
cmp esi, 0x1d
jne 0x405b12
push dword [0x42ec04]
push ebx
call fcn.004058d0
jmp 0x405b23
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push ebx
call fcn.00405972
add esi, 0xffffffeb
cmp esi, 7
jae 0x405b3f
jmp 0x405af1
cmp byte [ebp + 0xf], 0xff
jne 0x405b3f
or eax, 0xffffffff
sub eax, esi
push eax
push ebx
call fcn.00405994
push ebx
call sub.KERNEL32.dll_lstrlenA
add ebx, eax
mov eax, 0x42dba0
jmp 0x405b5b
jne 0x405b58
mov cl, byte [edi]
mov byte [ebx], cl
inc ebx
inc edi
jmp 0x405b5b
mov byte [ebx], cl
inc ebx
mov cl, byte [edi]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x4059e0
and byte [ebx], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405b7d
push eax
push dword [ebp + 8]
call fcn.00405972
leave
ret 8
Function at 0x405cc4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c60c], 0
push esi
jne 0x405cfb
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405cd5
mov dword [ecx*4 + 0x42c608], eax
inc ecx
cmp ecx, 0x100
jl 0x405cd0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d2c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c608]
xor eax, esi
inc ecx
dec edx
jne 0x405d0e
pop edi
not eax
pop esi
ret 0xc
Function at 0x409d08
Capabilities:
Encode data using xor

Disassembly:
inc esi
dec eax
cwde
jbe 0x409d1b
and edi, dword [edi + 0x38]
or esi, dword [ebx]
push ds
mov ds, word [esi + 0x3c]
inc ecx
pop edi
cld
inc esi
invalid
jo 0x409d24
imul edi, dword [esi + 0x78], 0x620e9159
sub eax, 0x93650c73
or eax, 0xecaf976a
in eax, dx
clc
adc byte [ebx], bh
fist word [eax]
xor edi, eax
movsb byte es:[edi], byte [esi]
invalid
Function at 0x574e88
Capabilities:
Encode data using xor

Disassembly:
clc
aaa
sal byte [ecx + 0x37], cl
test al, 0x46
jl 0x574ea1
invalid
or eax, 0x45bcc0b1
mov eax, 0xbc6e2ecb
stosb byte es:[edi], al
add dword [edx], esp
out 0x71, eax
add dword [edx], 0x141e9fc
or al, 0xda
xor edx, ebx
out dx, al
jae 0x574e9e
add bh, ah
jmp 0xda634fe9
xchg edi, eax
bound edi, qword [eax + ecx*4 - 8]
sub eax, 0x6c177772
mov al, 0x52
mov cl, 0x43
in eax, dx
int3

Function at 0x657a1d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6603b8
cmp edx, dword [eax]
je 0x657a3f
add eax, 8
inc ecx
cmp eax, 0x660448
jl 0x657a30
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6603b8]
jne 0x657b6d
mov eax, dword [0xa5cda4]
cmp eax, 1
je 0x657b47
test eax, eax
jne 0x657a70
cmp dword [0x6602e4], 1
je 0x657b47
cmp edx, 0xfc
je 0x657b6d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657aa7
lea eax, [ebp - 0x1a4]
push 0x65ca98
push eax
call fcn.00658400
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658890
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657aea
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658890
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65ca94
push edi
call fcn.0065a760
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ca78
push eax
call fcn.00658400
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658410
lea eax, [ebp - 0xa0]
push 0x65ca74
push eax
call fcn.00658410
push dword [esi + 0x6603bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658410
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65ca4c
push eax
call fcn.0065a6d4
add esp, 0x2c
pop edi
jmp 0x657b6d
lea eax, [ebp + 8]
lea esi, [esi + 0x6603bc]
push 0
push eax
push dword [esi]
call fcn.00658890
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x3c]
add eax, ecx
movzx ecx, word [eax + 0x14]
cmp esi, dword [ecx + eax + 0x2c]
push edi
lea edi, [ecx + eax + 0x18]
jae 0x401018
mov eax, esi
pop edi
ret
push ebx
movzx ebx, word [eax + 6]
xor eax, eax
xor edx, edx
cmp ax, bx
jae 0x401045
movzx eax, dx
lea ecx, [eax + eax*4]
lea eax, [edi + ecx*8]
mov ecx, dword [eax + 0xc]
cmp esi, ecx
jb 0x40103f
mov eax, dword [eax + 0x10]
add eax, ecx
cmp esi, eax
jb 0x40104a
inc edx
cmp dx, bx
jb 0x401026
pop ebx
xor eax, eax
pop edi
ret
movzx eax, dx
lea ecx, [eax + eax*4]
mov eax, dword [edi + ecx*8 + 0x14]
sub eax, dword [edi + ecx*8 + 0xc]
lea ecx, [edi + ecx*8]
pop ebx
add eax, esi
pop edi
ret

Function at 0x401060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x114
mov eax, dword [0x41f050]
xor eax, esp
mov dword [esp + 0x110], eax
push 0x104
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.004100c0
push 0x41c91c
lea ecx, [esp + 0x18]
call fcn.00404480
mov eax, dword [edi + 0x3c]
movzx ecx, word [eax + edi + 0x18]
add eax, edi
mov edx, 0x10b
add esp, 0x10
cmp cx, dx
je 0x4010cb
mov eax, 0x20b
xor eax, eax
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.004089ca
add esp, 0x114
ret
push ebx
push ebp
push esi
mov esi, dword [eax + 0x78]
mov ecx, edi
call fcn.00401000
mov ebp, eax
mov esi, dword [ebp + edi + 0x20]
add ebp, edi
mov ecx, edi
mov dword [esp + 0x10], ebp
call fcn.00401000
mov esi, dword [ebp + 0x24]
mov ebx, eax
mov ecx, edi
add ebx, edi
call fcn.00401000
mov ebp, dword [ebp + 0x18]
add eax, edi
mov dword [esp + 0xc], eax
test ebp, ebp
je 0x401130
mov esi, dword [ebx]
mov ecx, edi
dec ebp
call fcn.00401000
add eax, edi
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00408f20
add esp, 8
test eax, eax
jne 0x40114a
add dword [esp + 0xc], 2
add ebx, 4
test ebp, ebp
jne 0x401106
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.004089ca
add esp, 0x114
ret
mov edx, dword [esp + 0x10]
mov esi, dword [edx + 0x1c]
mov ecx, edi
call fcn.00401000
mov ecx, dword [esp + 0xc]
movzx edx, word [ecx]
add eax, edi
mov esi, dword [eax + edx*4]
mov ecx, edi
call fcn.00401000
mov ecx, dword [esp + 0x11c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004089ca
add esp, 0x114
ret