joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b660
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x56b060]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x469deb
je 0x469e3e
cmp ebx, 0x20
jbe 0x469e44
cmp ebx, 0x40
jbe 0x469e8a
jmp 0x469f2b
test ebx, ebx
je 0x469e34
add eax, 0x10
test ax, 0xff0
je 0x469e20
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4d4d00]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4d4e00]
jmp 0x469e08
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x469e08
pxor xmm1, xmmword [0x56b070]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x56b070]
pxor xmm2, xmmword [0x56b080]
pxor xmm3, xmmword [0x56b090]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x56b070]
pxor xmm2, xmmword [0x56b080]
pxor xmm3, xmmword [0x56b090]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x469f8a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x56ad28], 0
je 0x46b67a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x469db0
jmp fcn.00408840
Function at 0x46b680
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x56ae44]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40367c
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00408840
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0046a3b0
jmp 0x403640
cmp byte [0x56ad28], 0
je 0x46b69b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x469db0
jmp 0x403640

Function at 0x46c4e0
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x46c4fa
mov ecx, 0x14
jmp 0x46c503
shl ecx, 2
add ecx, 0xe10
mov dword [0x56ae44], ecx
ret
Function at 0x4848c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x56ae44]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4849ba
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x484900
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x484939
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.0046fba0
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4848f3
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x484943
inc eax
cmp eax, 4
jge 0x484959
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x4849b3
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.0046fbe0
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x48497c
jmp 0x484942
call fcn.0046a3b0
jmp fcn.004848c0
Function at 0x4015e3
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 8
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x401655
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x40162e
cmp dword [ebp + 0x10], ebx
jne 0x40165c
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.004015e3
test eax, eax
jne 0x401640
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x401615
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x401655
Function at 0x405476
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x42b110], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x40549a
test al, 0x10
jne 0x40549d
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x42b110
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4054c8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x4055e2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4055ff
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405602
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405631
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405675
test edi, edi
jne 0x40563c
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x40566f

Function at 0x405679
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4056dd
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 8], 0x400
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4056cc
cmp dword [ebp + 0x14], 1
je 0x4056ce
cmp dword [ebp + 0x14], 2
je 0x4056ce
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40592f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42b158
push esi
call fcn.00405785
push esi
call fcn.00405571
mov edi, eax
test edi, edi
jne 0x405950
xor eax, eax
jmp 0x4059a8
push edi
call fcn.004057a7
test byte [0x42ed04], 0x80
je 0x405969
mov al, byte [edi]
test al, al
je 0x40594c
cmp al, 0x5c
je 0x40594c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x405989
push esi
call fcn.00405841
test eax, eax
je 0x405983
test byte [eax], 0x10
je 0x4059ad
push esi
call fcn.00405909
push esi
call ebx
cmp eax, edi
jg 0x405974
push esi
call fcn.004058dc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4059a7
Function at 0x405a07
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
push edi
jge 0x405a27
mov ecx, dword [0x42e488]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x42ecd8]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x42dc40
sub ecx, eax
cmp ecx, 0x800
mov edi, eax
jae 0x405a49
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
je 0x405c02
push esi
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405c01
inc ebx
cmp cl, 0xfc
jbe 0x405be7
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
and esi, 0x7f
mov edx, ecx
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, ShowWindow
mov dword [ebp - 0xc], eax
or eax, edx
push 2
mov dword [ebp - 8], eax
pop eax
mov dword [ebp - 0x14], ecx
or ecx, edx
add ebx, eax
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0x10], ecx
jne 0x405b8b
cmp dword [0x42ed24], 0
mov dword [ebp + 0xc], eax
je 0x405abe
mov dword [ebp + 0xc], 4
dec dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push dword [ebp + eax*4 - 0x14]
push dword [0x42eca0]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405af5
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x405afe
cmp dword [ebp + 0xc], 0
mov byte [edi], 0
jne 0x405abe
cmp byte [edi], 0
jne 0x405b77
mov eax, dword [ebp - 0x14]
cmp eax, 0x2b
jne 0x405b22
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405679
jmp 0x405b72
cmp eax, 0x26
jne 0x405b4e
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405679
cmp byte [edi], 0
jne 0x405b77
push str.C:Program_Files
push edi
call fcn.00405785
jmp 0x405b72
cmp eax, 0x25
jne 0x405b61
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405b72
cmp eax, 0x24
jne 0x405b72
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
je 0x405bbd
cmp dword [ebp - 0xc], 0x1a
jne 0x405bbd
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x405bbd
cmp byte [ebp + 0xf], 0xfd
jne 0x405bc5
cmp esi, 0x1b
jne 0x405ba4
push dword [0x42eca0]
push edi
call fcn.004056e3
jmp 0x405bb5
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.00405785
add esi, 0xffffffeb
cmp esi, 6
jae 0x405bd7
push edi
call fcn.004057a7
jmp 0x405bd7
cmp byte [ebp + 0xf], 0xff
jne 0x405bd7
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00405a07
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
mov eax, 0x42dc40
jmp 0x405bf4
jne 0x405bf1
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405bf4
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405a57
pop esi
cmp dword [ebp + 8], 0
mov byte [edi], 0
pop edi
pop ebx
je 0x405c16
push eax
push dword [ebp + 8]
call fcn.00405785
leave
ret 8
Function at 0x405c1a
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push 0x40754c
call fcn.0040587f
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405c46
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405d7f
test esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42b558], 0x4c554e
mov edi, 0x400
mov ebp, 0x42b558
je 0x405c8a
push 1
push 0
push esi
call fcn.00405602
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405d85
cmp eax, edi
jg 0x405d85
push edi
mov esi, 0x42be98
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405d85
cmp eax, edi
jg 0x405d85
push esi
push ebp
push str._s_s_r_n
push 0x42b958
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x42eca8]
push dword [eax + 0x12c]
push esi
call fcn.00405a07
push 4
push 0xc0000000
push esi
call fcn.00405602
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405d7f
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405d78
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405d78
cmp edi, dword [esp + 0x18]
jne 0x405d78
push str._Rename__r_n
push esi
call fcn.004059b1
test eax, eax
jne 0x405d8c
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.00405785
add edi, 0xa
mov eax, edi
push ebx
push 0x42b958
add eax, esi
push eax
call fcn.004055be
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x42ed30]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x40767c
add eax, 0xa
push eax
call fcn.004059b1
test eax, eax
je 0x405d43
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405db3
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405da8
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405d45
Function at 0x405dbb
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.0040592f
mov ecx, dword [ebp + 0xc]
test cl, 8
mov dword [ebp - 8], eax
je 0x405df0
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ed28], eax
jmp 0x405f74
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x405e0b
test eax, eax
je 0x405f1f
test cl, 2
je 0x405f1f
push edi
push ebx
mov esi, 0x42c298
push esi
call fcn.00405785
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405e2e
push str..
push esi
call edi
jmp 0x405e34
push ebx
call fcn.00405909
push 0x4072bc
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405f14
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.00405530
cmp byte [eax], 0
je 0x405e7f
cmp byte [ebp - 0x18], 0
je 0x405e7f
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405e95
mov al, byte [esi + 1]
test al, al
je 0x405ef3
cmp al, 0x2e
jne 0x405e95
cmp byte [esi + 2], 0
je 0x405ef3
push esi
push edi
call fcn.00405785
test byte [ebp - 0x148], 0x10
je 0x405eba
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405ef3
push dword [ebp + 0xc]
push ebx
call fcn.00405dbb
jmp 0x405ef3
push ebx
call fcn.004055e2
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405eeb
test byte [ebp + 0xc], 4
je 0x405ee3
push ebx
push 0xfffffffffffffff1
call fcn.00404831
push 0
push ebx
call fcn.00405c1a
jmp 0x405ef3
inc dword [0x42ed28]
jmp 0x405ef3
push ebx
push 0xfffffffffffffff2
call fcn.00404831
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405e61
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405f1e
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405f73
cmp dword [ebp - 8], esi
je 0x405f63
push ebx
call fcn.00405841
test eax, eax
je 0x405f73
push ebx
call fcn.004058dc
push ebx
call fcn.004055e2
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405f6b
test byte [ebp + 0xc], 4
je 0x405f63
push ebx
push 0xfffffffffffffff1
call fcn.00404831
push esi
push ebx
call fcn.00405c1a
jmp 0x405f73
inc dword [0x42ed28]
jmp 0x405f73
push ebx
push 0xffffffffffffffe5
call fcn.00404831
pop esi
pop ebx
leave
ret 8
Function at 0x405f79
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42c69c], 0
jne 0x405fb4
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f8d
mov dword [ecx*4 + 0x42c698], eax
inc ecx
cmp ecx, 0x100
jl 0x405f88
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x405fe1
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42c698]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x405fc2
not eax
pop ebp
ret 0xc

Function at 0x414b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x414b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b80
mov eax, 1
add ebx, ebx
jne 0x414ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b98
jne 0x414bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b98
xor ecx, ecx
sub eax, 3
jb 0x414bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c3a
mov ebp, eax
add ebx, ebx
jne 0x414bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c04
inc ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414be5
jne 0x414c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c15
jmp 0x414b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c24
add edi, ecx
jmp 0x414b86
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c42
cmp byte [edi], 5
jne 0x414c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c47
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19be8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c74
mov ecx, edi
jns 0x414ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c2c]
or eax, eax
je 0x414cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x414c91
call dword [esi + 0x19c28]
mov ebp, dword [esi + 0x19c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cf3
sub esp, 0xffffff80
jmp 0x401150
Function at 0x402e2c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x450008], 0x8088405
inc edx
mov dword [ebx + 0x450008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40338c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x450010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403424
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403404
xor eax, eax
push ebp
push 0x4033fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403440
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403404
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x450010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x450010], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040ec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x451048], 0
je 0x40414d
cmp word [0x45121c], 0xd7b2
jne 0x404115
cmp dword [0x451224], 0
jbe 0x404115
mov eax, 0x451218
call dword [0x451234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x450058
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404174
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x450020], 0
jne 0x404169
push 0
push 0x450078
push 0x450058
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4042a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402720
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x451049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404268
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc