joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1851870
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x112c000]
push edi
or ebp, 0xffffffff
jmp 0x1851892
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1851899
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1851888
mov eax, 1
add ebx, ebx
jne 0x18518ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x18518bc
jne 0x18518cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x18518cc
dec eax
add ebx, ebx
jne 0x18518c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x18518a0
xor ecx, ecx
sub eax, 3
jb 0x18518e4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1851956
sar eax, 1
mov ebp, eax
jmp 0x18518ef
add ebx, ebx
jne 0x18518ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x18518fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1851920
inc ecx
add ebx, ebx
jne 0x185190c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1851901
jne 0x185191d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1851901
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1851940
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1851931
jmp 0x185188e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1851940
add edi, ecx
jmp 0x185188e
pop esi
mov edi, esi
mov ecx, 0x28b81
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x185195e
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x1851963
lea edi, [esi + 0x144d000]
mov eax, dword [edi]
or eax, eax
je 0x18519cb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x145c55c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x145c674]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1851989
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x145c678]
or eax, eax
je 0x18519c5
mov dword [ebx], eax
add ebx, 4
jmp 0x18519a6
call dword [esi + 0x145c67c]
popal
jmp 0x95e020

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x2228135f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, str._v__t_
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x254b74db
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x6cf20072
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e3d0
mov ecx, 0x4b9341e9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x6fd819c1
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x1a3f248b
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x41cc37
Capabilities:
Encode data using xor

Disassembly:
and eax, ecx
adc dl, 0x9a
rol eax, 0xc4
setae al
sbb cl, 2
rol dl, 1
sal eax, 0x2f
xor cl, ch
not dl
shr ax, cl
btr ax, ax
xor bl, dl
add edx, esp
shr eax, 0xd3
xor al, byte [edx + eax]
lea edx, [ecx + ecx*8 - 0x6948c148]
lea ebp, [ebp + ecx - 0x56778085]
mov word [ebp + ecx - 0x56778083], ax
inc dl
lea esi, [esi + ecx - 0x56778087]
rol edx, cl
mov eax, 0x5bf5eb0
jb 0x4166f0
sub esi, 4
mov ecx, 0xa9a34629
mov edx, dword [esi]
movsx eax, cx
xor edx, ebx
neg cl
ror cl, 6
and ecx, ecx
sbb edx, 0xc7a7fd27
add ecx, eax
add cl, ch
sbb ecx, eax
neg edx
dec eax
add eax, eax
shl ecx, cl
lea edx, [edx + eax*4 - 0x71679de]
not edx
xadd ecx, eax
rol edx, 1
xor ebx, edx
bt ecx, ecx
or ax, cx
imul cx, cx
add edi, edx
imul ecx
btr edx, eax
mov eax, dword [ebp + edx - 0x33934bf4]
adc cl, byte [edx + ebp - 0x33934bf0]
sar edx, 0xc4
shr dl, 1
sbb edx, edx
adc ebp, 5
xor dx, dx
not edx
mov byte ss:[eax + edx*2 - 0x1fffe], cl
bt edx, edx
rol dl, 0xc1
jmp edi
neg dword [esp + edx - 0x189dfca5]
lea eax, [esp + eax + 0xc]
push edx
sbb ecx, 0xc1336d35
sal ecx, 0xa4
mov edx, dword [eax + ecx*4 - 0x16c33ec0]
mov eax, ecx
mov dword [esp + eax*2 - 0xb619f5c], 0x9a38b120
btr eax, 0x35
lea ebp, [ebp + ecx - 0x5b0cfb4]
bswap eax
mov dword [ebp + ecx*2 - 0xb619f60], edx
setb cl
call fcn.00409edd
mov eax, 0x1ab3bc00
lea esi, [eax + esi - 0x1ab3bc01]
rol eax, 0x45
lea ecx, [eax + 0x39af36b6]
inc eax
movzx edx, byte [esi + eax - 0x56778004]
xor ecx, ecx
xor dl, bl
lea ecx, [eax + eax + 0x4928399d]
add dl, 0xa3
xadd eax, ecx
sub eax, eax
btr ecx, eax
not dl
inc ecx
jae 0x4121e2
push eax
invalid
Function at 0x437830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x24000]
push edi
or ebp, 0xffffffff
jmp 0x437852
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x437859
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x437848
mov eax, 1
add ebx, ebx
jne 0x43786b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x437860
jne 0x43787c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x437860
xor ecx, ecx
sub eax, 3
jb 0x437890
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x437902
mov ebp, eax
add ebx, ebx
jne 0x43789b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4378a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4378cc
inc ecx
add ebx, ebx
jne 0x4378b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4378ad
jne 0x4378c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4378ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4378ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4378dd
jmp 0x43784e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4378ec
add edi, ecx
jmp 0x43784e
pop esi
mov edi, esi
mov ecx, 0x7d0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43790a
cmp byte [edi], 7
jne 0x43790a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43790f
lea edi, [esi + 0x35000]
mov eax, dword [edi]
or eax, eax
je 0x43797e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x371dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3722c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43793c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x37234]
or eax, eax
je 0x437978
mov dword [ebx], eax
add ebx, 4
jmp 0x437959
call dword [esi + 0x37230]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4379af
cmp al, 0xef
ja 0x4379a2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x437984
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x437991
mov ebp, dword [esi + 0x37238]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4379e3
sub esp, 0xffffff80
jmp 0x41d4d9
Function at 0x40f3f0
Capabilities:
Get user security identifier
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [0x441064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x410
mov dword [ebp - 0xc40], eax
lea eax, [ebp - 0x414]
push ebx
push eax
mov dword [ebp - 0xc3c], ebx
mov dword [ebp - 0xc38], ebx
call fcn.00412cd0
push esi
push edi
push str._s_s
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.00409270
lea eax, [ebp - 0x414]
push eax
push str.Resolve__:_szAccountName___s_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00409270
add esp, 0x30
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xc38]
push eax
push ebx
lea eax, [ebp - 0xc3c]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov eax, dword [ebp - 0xc3c]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x40f4b2
push eax
push 8
call esi
push eax
call edi
mov ebx, eax
mov ecx, dword [ebp - 0xc38]
test ecx, ecx
je 0x40f4ca
add ecx, ecx
push ecx
push 8
call esi
push eax
call edi
mov edi, eax
jmp 0x40f4cc
xor edi, edi
test ebx, ebx
je 0x40f55a
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xc38]
push eax
push edi
lea eax, [ebp - 0xc3c]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x40f51c
push dword [ebp - 0xc40]
push ebx
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
jne 0x40f54a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSidFromEnumSess__:_ConvertSidToStringSid___err___d_n
jmp 0x40f528
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UserByExplorer__:_LookupAccountNameW___err___d_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00409270
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call eax
push ebx
push 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call ebx
jmp 0x40f560
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x40f56c
push edi
push 0
call esi
push eax
call ebx
mov ebx, dword [ebp - 0xc40]
lea eax, [ebp - 0xc34]
push dword [ebx]
push str.Resolve__:_lpszSid___s_n
push 0x410
push eax
call fcn.00409270
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebx], eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00410b68
mov esp, ebp
pop ebp
ret

Function at 0x1067a000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x1067a00a
jmp 0x1067c00f
jmp fcn.104121b8
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1596459
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x11961f70
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x407ba0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x401306
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x4012b8
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
xor edi, edi
mov edx, 0x403840
mov ecx, 0x409058
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
call esi
mov edx, 0x402c6c
mov ecx, 0x409060
call esi
mov eax, dword [0x409060]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov ecx, dword [0x409058]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push 0x40905c
push 0x20006
push edi
lea edx, [ebp - 0x28]
push ecx
push edx
mov dword [0x409064], eax
call esi
push eax
push 0x80000002
call fcn.00402f5c
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
call edi
mov eax, dword [ebp - 0x28]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
push eax
push 0x409058
call ebx
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov ecx, dword [0x409064]
mov edx, dword [0x409060]
push ecx
lea eax, [ebp - 0x2c]
push edx
push eax
call esi
push eax
push 1
push 0
lea ecx, [ebp - 0x28]
push 0x4038a0
push ecx
call esi
mov edx, dword [0x40905c]
push eax
push edx
call fcn.00402fa4
call edi
mov eax, dword [ebp - 0x2c]
push eax
push 0x409060
call ebx
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x28]
push ecx
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
mov eax, dword [0x40905c]
add esp, 0xc
push eax
call fcn.00402fe8
call edi
push 0x407cd7
jmp 0x407cd6
ret
Function at 0x402a3f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x446770]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402ad3
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a90
cmp dword [ebp + 0x10], ebx
jne 0x402ac7
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a3f
test eax, eax
jne 0x402aa2
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a77
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405e92
cmp eax, ebx
je 0x402ada
push ebx
push dword [0x446770]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402ad3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x446770], ebx
jne 0x402ad0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ad0
jmp 0x402ad3
Function at 0x402e64
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402e81
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402e90
mov ebx, 0x417470
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402ea5
mov ecx, dword [0x446718]
add ecx, eax
push ecx
call fcn.0040306d
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.00403057
test eax, eax
je 0x403002
test byte [ebp + 0x17], 0x80
je 0x402feb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x4133e0
mov dword [ebp - 0xc], eax
call fcn.00405f72
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x40304d
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402ef5
mov esi, dword [ebp + 0x14]
mov edi, 0x413470
push esi
push edi
call fcn.00403057
test eax, eax
je 0x403002
sub dword [ebp + 0x14], esi
mov dword [0x4133f8], edi
mov dword [0x4133fc], esi
mov eax, dword [ebp - 8]
mov ecx, 0x4133e0
mov dword [0x413400], ebx
mov dword [0x413404], eax
call fcn.00405f92
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x402fe3
mov esi, dword [0x413400]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x446774], 1
mov edi, eax
je 0x402f97
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402f64
cmp dword [ebp + 0x14], 0
jne 0x402f97
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.00404e52
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x402fd8
cmp dword [ebp + 0x10], eax
jne 0x402fc0
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402fe7
cmp dword [ebp - 0x10], esi
jne 0x402fe7
add dword [ebp - 4], esi
jmp 0x402fcc
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x413400]
cmp dword [ebp - 0x14], 1
jne 0x402f18
jmp 0x40304d
cmp dword [ebp + 0x14], eax
jg 0x402ee8
jmp 0x40304d
push 0xfffffffffffffffc
jmp 0x403004
push 0xfffffffffffffffe
jmp 0x403004
test edi, edi
je 0x403042
cmp dword [ebp + 0x14], esi
jge 0x402ff7
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403057
test eax, eax
jne 0x40304a
push 0xfffffffffffffffd
pop eax
jmp 0x403050
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403012
mov esi, dword [ebp + 0x14]
mov edi, 0x413470
push esi
push edi
call fcn.00403057
test eax, eax
je 0x403002
lea eax, [ebp + 0x10]
push 0
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402fe7
cmp esi, dword [ebp + 0x10]
jne 0x402fe7
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403007
jmp 0x40304d
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40531a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x43d4c8], 0x44
push eax
xor eax, eax
push 0x43d4c8
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405355
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4053df
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.004057d3
mov edi, eax
cmp edi, 0xffffffff
je 0x405420
test byte [esp + 0x10], 1
push esi
je 0x405402
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x405408
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405411
xor eax, eax
inc eax
jmp 0x405422
test byte [esp + 0x10], 4
jne 0x405420
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405427
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.004056e5
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405466
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x446748], eax
jmp 0x4055f0
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405480
test eax, eax
je 0x40559e
test bl, 2
je 0x40559e
mov esi, 0x4394c8
push edi
push esi
call fcn.00405b67
cmp dword [ebp + 8], 0
je 0x40549f
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4054a5
push edi
call fcn.0040563e
cmp byte [edi], 0
jne 0x4054b3
cmp byte [0x4394c8], 0x5c
jne 0x4054be
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405594
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405622
cmp byte [eax], 0
je 0x405504
cmp byte [ebp - 0x1c], 0
je 0x405504
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x40551a
mov al, byte [esi + 1]
test al, al
je 0x405573
cmp al, 0x2e
jne 0x40551a
cmp byte [esi + 2], 0
je 0x405573
push esi
push ebx
call fcn.00405b67
test byte [ebp - 0x14c], 0x10
je 0x40553f
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405573
push dword [ebp + 0xc]
push edi
call fcn.00405427
jmp 0x405573
push dword [ebp - 4]
push edi
call fcn.004053df
test eax, eax
jne 0x40556b
cmp dword [ebp - 4], eax
je 0x405563
push edi
push 0xfffffffffffffff1
call fcn.00404e52
push 0
push edi
call fcn.00405a1b
jmp 0x405573
inc dword [0x446748]
jmp 0x405573
push edi
push 0xfffffffffffffff2
call fcn.00404e52
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4054e2
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40559e
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4055f0
cmp dword [ebp - 0xc], esi
jne 0x4055b2
inc dword [0x446748]
jmp 0x4055f0
push edi
call fcn.00405e6b
test eax, eax
je 0x4055f0
push edi
call fcn.004055f7
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004053df
test eax, eax
jne 0x4055e8
cmp dword [ebp - 4], esi
je 0x4055aa
push edi
push 0xfffffffffffffff1
call fcn.00404e52
push esi
push edi
call fcn.00405a1b
jmp 0x4055f0
push edi
push 0xffffffffffffffe5
call fcn.00404e52
pop edi
pop esi
pop ebx
leave
ret 8