joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40905c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x409148
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00406a2c
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov edx, 0x409160
call fcn.0040890c
push 0
mov eax, dword [ebp - 4]
call fcn.00403438
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x409116
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x40907c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408704
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c20
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00406e04
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.004086d4
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x40459c
call fcn.00405838
call fcn.00402eb4
jmp 0x40907c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004031e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40914f
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x409170
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409224
jmp 0x409219
cmp dword [esi + 0x10], 0x1000
jne 0x409205
test byte [esi + 0x15], 1
jne 0x409205
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x4091c4
cmp eax, 2
je 0x4091c4
cmp eax, 0x10
je 0x4091c4
cmp eax, 0x20
jne 0x4091d9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4091d9
mov bl, 1
xor ebp, ebp
jmp 0x4091ea
mov eax, dword [esi]
add eax, ebp
call fcn.00409168
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jl 0x4091dd
test bl, bl
je 0x409205
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409224
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40919c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4033bf
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x4033ec
mov ecx, dword [0x456798]
push edi
add eax, ecx
push edi
push eax
mov dword [0x42af2c], eax
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.004034ea
cmp eax, edi
jl 0x4034e3
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x40a594]
call ebx
test eax, eax
je 0x4034e0
cmp dword [ebp - 4], esi
jne 0x4034e0
push dword [ebp + 8]
add dword [0x42af2c], esi
call fcn.004034ea
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x4034e3
cmp dword [ebp + 0x10], edi
jne 0x4034af
cmp dword [ebp + 8], edi
jle 0x4034db
mov esi, 0x426ee8
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x40345f
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x40a594]
call ebx
test eax, eax
je 0x4034e0
cmp edi, dword [ebp - 4]
jne 0x4034e0
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4034ab
cmp dword [ebp + 0x14], edi
jne 0x4034ab
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x42af2c], eax
cmp dword [ebp + 8], 0
jg 0x403452
jmp 0x4034db
push 0xfffffffffffffffe
jmp 0x4034e2
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x4034ba
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a594]
call ebx
test eax, eax
je 0x4034e0
mov eax, dword [ebp - 4]
add dword [0x42af2c], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4034e3
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4034ea
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x42af2c]
mov ebx, eax
sub esi, dword [0x415324]
add ebx, 0x1f4
add esi, dword [esp + 0x38]
cmp esi, edi
jle 0x4036e8
push dword [0x432f38]
call fcn.0040372b
push edi
push edi
push dword [0x415324]
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x432f34], esi
mov dword [0x42af28], edi
mov eax, dword [0x42af30]
mov ebp, 0x4000
sub eax, dword [0x432f38]
cmp eax, ebp
jg 0x40355e
mov ebp, eax
mov esi, 0x426ee8
push ebp
push esi
call fcn.004036f9
test eax, eax
je 0x4036a9
add dword [0x432f38], ebp
mov dword [0x415328], esi
mov dword [0x41532c], ebp
cmp dword [0x456748], edi
je 0x40361c
cmp dword [0x4567e0], edi
jne 0x40361c
cmp dword [esp + 0x10], edi
je 0x4035e9
mov eax, dword [0x432f34]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
sub eax, dword [0x42af2c]
push 1
push edi
push edi
sub eax, dword [esp + 0x44]
push edi
add eax, dword [0x415324]
mov dword [0x42af28], eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x40361c
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push edi
push edi
lea eax, [esp + 0x24]
push edi
push eax
jmp 0x4035cc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
jbe 0x40361c
mov eax, dword [0x456744]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x402fdb
push edi
push 0x6f
push dword [0x456740]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
push 0x415328
mov dword [0x415330], 0x41eee8
mov dword [0x415334], 0x8000
call fcn.004065c2
test eax, eax
jl 0x4036f4
mov esi, dword [0x415330]
mov eax, 0x41eee8
sub esi, eax
je 0x403683
lea ecx, [esp + 0x14]
push edi
push ecx
push esi
push eax
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4036ae
cmp esi, dword [esp + 0x14]
jne 0x4036ae
add dword [0x415324], esi
cmp dword [0x41532c], edi
jne 0x403584
jmp 0x40368f
cmp dword [0x41532c], edi
jne 0x4036f4
cmp ebp, edi
je 0x4036f4
mov eax, dword [0x42af2c]
mov ecx, eax
sub ecx, dword [0x415324]
add ecx, dword [esp + 0x38]
test ecx, ecx
jle 0x4036b2
jmp 0x403548
or eax, 0xffffffff
jmp 0x4036ea
push 0xfffffffffffffffe
jmp 0x4036f6
push edi
push edi
push eax
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x10]
cmp esi, edi
je 0x4036e8
mov eax, dword [0x432f34]
push edi
push edi
push 0x113
push esi
mov dword [0x42af28], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
push 0xfffffffffffffffd
pop eax
jmp 0x4036ea
Function at 0x403e08
Capabilities:
Identify system language via api

Disassembly:
push ecx
cmp byte [0x487000], 0
push ebx
push ebp
push esi
push edi
mov ebx, pe_overlay
mov ebp, 0x487000
je 0x403e28
push ebp
call fcn.004060c4
jmp 0x403e2e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [esp + 0x10], eax
xor esi, esi
mov edi, dword [0x456784]
mov eax, edi
dec edi
test eax, eax
je 0x403e8a
mov eax, dword [0x456748]
mov ecx, dword [eax + 0x64]
mov edx, ecx
imul ecx, edi
neg edx
add ecx, dword [0x456780]
mov ax, word [esp + 0x10]
mov esi, ecx
xor ax, word [ecx]
and eax, ebx
test ax, ax
je 0x403e72
mov eax, edi
dec edi
add ecx, edx
test eax, eax
jne 0x403e56
jmp 0x403e8a
mov eax, dword [esi + 2]
mov dword [0x452720], eax
mov eax, dword [esi + 6]
mov dword [0x4567e8], eax
lea eax, [esi + 0xa]
mov dword [0x45271c], eax
cmp dword [0x45271c], 0
jne 0x403ea5
cmp bx, 0xffff
jne 0x403ea1
mov ebx, 0x3ff
jmp 0x403e34
xor ebx, ebx
jmp 0x403e34
movzx eax, word [esi]
push eax
push ebp
call fcn.004060ab
push 0xfffffffffffffffe
push 0x452740
call fcn.0040616c
push eax
push dword [0x43ef4c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x45676c]
mov esi, dword [0x456768]
mov ecx, eax
dec eax
test ecx, ecx
je 0x403ef9
lea ebx, [esi + 0x18]
lea ebp, [eax + 1]
mov edi, 0x2018
mov eax, dword [esi]
test eax, eax
je 0x403ef2
push eax
push ebx
call fcn.0040616c
add esi, edi
add ebx, edi
dec ebp
jne 0x403ee5
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x405966
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x443f78], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x40598a
test al, 0x10
jne 0x40598d
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x443f78
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4059b8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x405a47
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405d2d
test byte [ebp + 0xc], 8
mov dword [ebp - 4], eax
je 0x405a7b
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4567c8], eax
jmp 0x405c44
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp + 8], ebx
je 0x405a99
test eax, eax
je 0x405bc8
test byte [ebp + 0xc], 2
je 0x405bc8
mov esi, 0x43ff78
push edi
push esi
call fcn.0040614e
test ebx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405ab9
push str..
push esi
call ebx
jmp 0x405abf
push edi
call fcn.00405c92
push 0x40a228
push edi
call ebx
push edi
call fcn.0040615f
mov ebx, eax
lea eax, [ebp - 0x144]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405bbe
cmp byte [ebp - 0x118], 0x2e
jne 0x405b0d
cmp byte [ebp - 0x117], 0x2e
je 0x405ba1
cmp byte [ebp - 0x117], 0
je 0x405ba1
lea eax, [ebp - 0x118]
push eax
push ebx
call fcn.0040614e
test byte [ebp - 0x144], 0x10
je 0x405b38
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405ba1
push dword [ebp + 0xc]
push edi
call fcn.00405a47
jmp 0x405ba1
push edi
push str.Delete:_DeleteFile___s__
call fcn.004064f2
mov eax, dword [ebp - 0x144]
pop ecx
pop ecx
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405b99
test byte [ebp + 0xc], 4
push edi
je 0x405b85
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.004064f2
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.00405441
push 0
push edi
call fcn.00405e8a
jmp 0x405ba1
push str.Delete:_DeleteFile_failed___s__
call fcn.004064f2
inc dword [0x4567c8]
pop ecx
pop ecx
jmp 0x405ba1
push edi
push 0xfffffffffffffff2
call fcn.00405441
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405aea
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405bc8
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp + 8], esi
je 0x405c44
cmp dword [ebp - 4], esi
push edi
jne 0x405bea
push str.RMDir:_RemoveDirectory_invalid_input___s__
call fcn.004064f2
inc dword [0x4567c8]
pop ecx
pop ecx
jmp 0x405c44
call fcn.0040650e
test eax, eax
je 0x405c44
push edi
call fcn.00405c4a
push edi
push str.RMDir:_RemoveDirectory___s__
call fcn.004064f2
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405c3c
test byte [ebp + 0xc], 4
push edi
je 0x405c35
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.004064f2
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.00405441
push esi
push edi
call fcn.00405e8a
jmp 0x405c44
push str.RMDir:_RemoveDirectory_failed___s__
jmp 0x405bdb
push edi
push 0xffffffffffffffe5
call fcn.00405441
pop edi
pop esi
leave
ret 8
Function at 0x405d2d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x441f78
push esi
call fcn.0040614e
push esi
call fcn.00405cde
test eax, eax
jne 0x405d4c
xor eax, eax
jmp 0x405d9b
test byte [0x456750], 0x80
je 0x405d60
mov cl, byte [eax]
test cl, cl
je 0x405d48
cmp cl, 0x5c
je 0x405d48
mov edi, eax
sub edi, esi
push esi
call fcn.0040615f
cmp eax, edi
push esi
jle 0x405d85
call fcn.0040650e
test eax, eax
je 0x405d7d
test byte [eax], 0x10
je 0x405d48
push esi
call fcn.00405c92
jmp 0x405d64
call fcn.00405c4a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405e12
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405e41
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405e86
mov eax, edi
dec edi
test eax, eax
jne 0x405e4c
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405e80
Function at 0x405e8a
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405ec2
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405ec2
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x406007
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x444900], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x444900
je 0x405f06
push 1
push 0
push esi
call fcn.00405e12
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x40600d
cmp eax, edi
jg 0x40600d
mov esi, 0x444500
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x40600d
cmp eax, edi
jg 0x40600d
push esi
push ebp
push str._s_s_r_n
push 0x444100
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406007
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x405fef
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x405fe3
push str._Rename__r_n
push edi
call fcn.00405da0
test eax, eax
jne 0x406014
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call fcn.0040614e
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x444100
push eax
call fcn.00405dec
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x4567d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40a9d8
push eax
call fcn.00405da0
test eax, eax
je 0x405fca
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x40603d
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x406030
sub eax, edi
jmp 0x405fcc
Function at 0x406041
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4060a5
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406094
cmp dword [ebp + 0x14], 1
je 0x406096
cmp dword [ebp + 0x14], 2
je 0x406096
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x406454
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406479
mov eax, dword [0x40a8d4]
cmp eax, 0xffffffff
je 0x406470
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8d4], 0xffffffff
jmp 0x4064ed
cmp dword [0x4466a0], ebx
je 0x4064ed
cmp byte [0x4462a0], bl
je 0x4064b8
cmp dword [0x40a8d4], 0xffffffff
jne 0x4064c1
push 4
push 0x40000000
push 0x4462a0
call fcn.00405e12
cmp eax, 0xffffffff
mov dword [0x40a8d4], eax
je 0x4064ed
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8d4], 0xffffffff
je 0x4064ed
push esi
mov esi, 0x44a6e0
push 0x40aaa8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.0040615f
push eax
push esi
push dword [0x40a8d4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40654c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x444d04], esi
push edi
jne 0x406586
mov ecx, 0x444d00
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x406562
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x445100
jl 0x40655d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x4065bb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x444d00]
xor eax, esi
inc ecx
dec edx
jne 0x40659e
pop edi
pop esi
not eax
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000697f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
jne 0x100069a2
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
mov dword [eax], 1
mov dword [eax + 4], edi
jmp 0x10006a3f
push esi
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], edi
push eax
push ebx
call fcn.10005e41
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100069c5
push ebx
call fcn.10011f5a
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x10006a1b
mov esi, dword [ebp + 0x10]
xor eax, eax
inc eax
test esi, esi
cmovne eax, esi
push eax
call dword [section..data]
mov dword [ebp - 4], eax
pop ecx
push ebx
test eax, eax
jne 0x100069f0
call fcn.10011f5a
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x10006a1b
push esi
push 1
push eax
call fcn.100121d1
push ebx
mov esi, eax
call fcn.10011f5a
add esp, 0x14
cmp esi, dword [ebp + 0x10]
je 0x10006a24
push dword [ebp - 4]
call dword [0x10036004]
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop ecx
mov dword [eax + 8], edi
mov dword [eax + 4], edi
jmp 0x10006a3e
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call sym.utilities.dll_public:_struct_pugi::xml_parse_result___thiscall_pugi::xml_document::load_buffer_inplace_own_void___unsigned_int__unsigned_int__enum_pugi::xml_encoding_
mov eax, dword [ebp + 8]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001d1da
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001d059

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219