joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403970
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x70]
sub esp, 0xbc
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], 0x14
mov dword [esp + 8], esi
mov dword [esp + 4], 0x44d
mov dword [esp], ebx
call sub.user32.dll_LoadStringW
sub esp, 0x10
mov dword [ebp - 0x48], 0x30
mov dword [ebp - 0x44], 0
mov dword [esp + 4], 1
mov dword [esp], ebx
mov dword [ebp - 0x40], 0x402b60
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], ebx
call sub.user32.dll_LoadIconW
sub esp, 8
mov dword [ebp - 0x30], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.user32.dll_LoadCursorW
sub esp, 8
mov dword [ebp - 0x2c], eax
mov dword [esp], 4
call sub.gdi32.dll_GetStockObject
sub esp, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 1
mov dword [esp], 0x32
mov dword [ebp - 0x20], esi
call sub.user32.dll_GetSystemMetrics
sub esp, 4
mov edi, eax
mov dword [esp], 0x31
call sub.user32.dll_GetSystemMetrics
sub esp, 4
mov dword [esp + 0x14], 0x8000
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.user32.dll_LoadImageW
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x48]
sub esp, 0x18
mov dword [esp], eax
call sub.user32.dll_RegisterClassExW
sub esp, 4
test ax, ax
je 0x403bb0
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x80000000
mov dword [esp + 0x18], 0x80000000
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xca0000
mov dword [esp], 0
call sub.user32.dll_CreateWindowExW
sub esp, 0x30
test eax, eax
mov esi, eax
je 0x403bb0
mov eax, dword [ebp + 0x14]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.user32.dll_ShowWindow
sub esp, 8
mov dword [esp], esi
call sub.user32.dll_UpdateWindow
sub esp, 4
mov dword [esp], ebx
mov dword [esp + 4], 0x4b1
lea ebx, [ebp - 0x8c]
call sub.user32.dll_LoadAcceleratorsW
sub esp, 8
mov edi, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x3e8
mov dword [esp + 4], 0x3e8
mov dword [esp], esi
call sub.user32.dll_SetTimer
sub esp, 0x10
jmp 0x403b4b
mov dword [esp], ebx
call sub.user32.dll_DispatchMessageW
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.user32.dll_GetMessageW
sub esp, 0x10
test eax, eax
je 0x403ba0
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.user32.dll_TranslateAcceleratorW
sub esp, 0xc
test eax, eax
jne 0x403b40
mov dword [esp], ebx
call sub.user32.dll_TranslateMessage
sub esp, 4
jmp 0x403b40
mov eax, dword [ebp - 0x84]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp], 1
call sub.kernel32.dll_ExitProcess
Function at 0x403db0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov ebx, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov esi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call 0x403e20
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x403ea6
cmp ax, 9
je 0x403e94
cmp ax, 0x20
je 0x403e94
xor edi, edi
mov dword [ebp - 0x6c], 0
lea esi, [esi]
cmp ax, 0x5c
je 0x403f00
cmp ax, 0x22
je 0x403f10
mov dword [ebp - 0x6c], 0
add ebx, 2
movzx eax, word [ebx]
test ax, ax
je 0x403ea6
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x403e50
test edi, 1
jne 0x403e50
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x403e94
cmp ax, 0x20
je 0x403e94
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.kernel32.dll_GetStartupInfoW
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x403f22
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
mov dword [esp], 0
call sub.kernel32.dll_GetModuleHandleW
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403970
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x6c], 1
jmp 0x403e6b
and dword [ebp - 0x6c], 1
jne 0x403e64
xor edi, 1
jmp 0x403e6b
movzx esi, word [ebp - 0x2c]
jmp 0x403ec8
Function at 0x403e20
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov ebx, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov esi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call 0x403e20
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x403ea6
cmp ax, 9
je 0x403e94
cmp ax, 0x20
je 0x403e94
xor edi, edi
mov dword [ebp - 0x6c], 0
lea esi, [esi]
cmp ax, 0x5c
je 0x403f00
cmp ax, 0x22
je 0x403f10
mov dword [ebp - 0x6c], 0
add ebx, 2
movzx eax, word [ebx]
test ax, ax
je 0x403ea6
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x403e50
test edi, 1
jne 0x403e50
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x403e94
cmp ax, 0x20
je 0x403e94
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.kernel32.dll_GetStartupInfoW
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x403f22
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
mov dword [esp], 0
call sub.kernel32.dll_GetModuleHandleW
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00403970
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x6c], 1
jmp 0x403e6b
and dword [ebp - 0x6c], 1
jne 0x403e64
xor edi, 1
jmp 0x403e6b
movzx esi, word [ebp - 0x2c]
jmp 0x403ec8
Function at 0x40148e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x472eb0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x401523
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x4014e0
cmp dword [ebp + 0x10], ebx
jne 0x401517
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.0040148e
test eax, eax
jne 0x4014f2
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014c7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.004062f8
cmp eax, ebx
je 0x40152a
push ebx
push dword [0x472eb0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401523
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x472eb0], ebx
jne 0x401520
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x401520
jmp 0x401523
Function at 0x4033a6
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
mov dword [ebp - 8], esi
jne 0x4033c6
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
test edi, edi
mov ebx, edi
jne 0x4033d5
mov ebx, 0x423150
mov eax, dword [ebp + 8]
test eax, eax
jl 0x4033ea
mov ecx, dword [0x472e18]
add ecx, eax
push ecx
call fcn.0040338f
push 4
lea eax, [ebp + 0x14]
push eax
call fcn.0040335d
test eax, eax
jne 0x403401
push 0xfffffffffffffffd
pop eax
jmp 0x403560
test dword [ebp + 0x14], 0x80000000
je 0x40353f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x433158
mov dword [ebp - 0xc], eax
call fcn.00407222
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x40355d
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x403441
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x41f150
push edi
call fcn.0040335d
test eax, eax
je 0x4033f9
sub dword [ebp + 0x14], esi
mov dword [0x433170], edi
mov dword [0x433174], esi
mov eax, dword [ebp - 8]
mov ecx, 0x433158
mov dword [0x433178], ebx
mov dword [0x43317c], eax
call fcn.00407242
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x403531
mov esi, dword [0x433178]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x472eb4], 1
mov edi, eax
je 0x4034e5
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x4034ac
cmp dword [ebp + 0x14], 0
jne 0x4034e5
push dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x94]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
push 0
call fcn.00404f7d
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x403526
cmp dword [ebp + 0x10], eax
jne 0x40350e
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403538
cmp dword [ebp - 0x14], esi
jne 0x403538
add dword [ebp - 4], esi
jmp 0x40351a
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x433178]
cmp dword [ebp - 0x10], 1
jne 0x403460
jmp 0x40355d
cmp dword [ebp + 0x14], eax
jg 0x403434
jmp 0x40355d
push 0xfffffffffffffffc
jmp 0x4033fb
push 0xfffffffffffffffe
jmp 0x4033fb
test edi, edi
je 0x4035a6
cmp dword [ebp + 0x14], esi
jge 0x40354b
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.0040335d
test eax, eax
je 0x4033f9
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403572
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x41f150
push edi
call fcn.0040335d
test eax, eax
je 0x4033f9
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403538
cmp esi, dword [ebp + 0x10]
jne 0x403538
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403567
jmp 0x40355d
Function at 0x405c3f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x457278
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x457278], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405c7a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405e2f
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405e4c
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x405e4f
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405e7e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40965c]
mov dword [ebp - 8], eax
mov eax, dword [0x409660]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405ece
test edi, edi
jne 0x405e8b
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405ec8

Function at 0x405ed2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor edi, edi
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push edi
push dword [ebp + 0xc]
mov word [esi], di
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405f46
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x4008
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405f33
cmp dword [ebp + 0x14], 1
je 0x405f36
cmp dword [ebp + 0x14], 2
je 0x405f36
mov word [esi], di
push dword [ebp + 0x18]
mov word [esi + 0x4006], di
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x4060e3
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x40610c
mov eax, dword [0x40b058]
cmp eax, 0xffffffff
je 0x406100
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40b058], 0xffffffff
jmp 0x4061b7
cmp dword [0x461520], ebx
je 0x4061b7
cmp word [0x46a560], bx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x406183
cmp dword [0x40b058], 0xffffffff
jne 0x40618c
mov esi, 0x46a560
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 4
push 0x40000000
push esi
mov dword [ebp + 8], eax
call fcn.00405e4f
cmp eax, 0xffffffff
mov dword [0x40b058], eax
je 0x4061b5
cmp dword [ebp + 8], 0xffffffff
jne 0x406178
push ebx
lea ecx, [ebp - 4]
push ecx
push 2
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [ebp + 8], 0xfeff
call edi
mov eax, dword [0x40b058]
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40b058], 0xffffffff
je 0x4061b5
push 0x409678
mov esi, 0x461540
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp + 8]
push ecx
add eax, eax
push eax
push esi
push dword [0x40b058]
call edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x406770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4572c0
push esi
call fcn.00406005
push esi
call fcn.00405d58
mov edi, eax
test edi, edi
jne 0x406791
xor eax, eax
jmp 0x4067ef
push edi
call fcn.00406034
test byte [0x472e28], 0x80
je 0x4067ae
movzx eax, word [edi]
test ax, ax
je 0x40678d
cmp ax, 0x5c
je 0x40678d
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x4067d0
push esi
call fcn.004062d1
test eax, eax
je 0x4067ca
test byte [eax], 0x10
je 0x4067f4
push esi
call fcn.00406744
push esi
call ebx
cmp eax, edi
jg 0x4067bb
push esi
call fcn.00406715
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4067ee
Function at 0x406a89
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x409888
mov ebx, 0x45b2c8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
cmp edi, ebp
mov esi, 0x400
je 0x406ad7
push 1
push ebp
push edi
call fcn.00405e4f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406c4e
cmp eax, esi
jg 0x406c4e
push esi
mov edi, 0x460920
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406c4e
cmp eax, esi
jg 0x406c4e
push ebp
push ebp
push esi
push 0x45bac8
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x406c4e
push ebp
push ebp
push esi
mov esi, 0x45c118
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x406c4e
push esi
push 0x45bac8
push str._s_s_r_n
push 0x45c518
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x472ddc]
push dword [eax + 0x128]
push edi
call fcn.004067f8
push 4
push 0xc0000000
push edi
call fcn.00405e4f
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x406c4e
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x406c44
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406c44
cmp edi, dword [esp + 0x10]
jne 0x406c44
push str._Rename__r_n
push esi
call fcn.00405db5
cmp eax, ebp
jne 0x406bdb
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x406c0c
push 0x40987c
add eax, 0xa
push eax
call fcn.00405db5
mov ebp, eax
test ebp, ebp
je 0x406c0a
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x406bfd
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x406bf7
sub ebp, esi
inc ebp
mov eax, ebp
xor ebp, ebp
jmp 0x406c0e
xor ebp, ebp
mov eax, edi
push ebx
push 0x45c518
add eax, esi
push eax
call fcn.00405e0b
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4071b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4071ef
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4071c8
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x4071c3
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40721c
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4071fd
not eax
pop ebp
ret 0xc
Function at 0x645de56c
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x3030368
imul ecx, dword [eax + ecx*4 + 0x202e7b7], 0x3036fbc
Function at 0x11c3265
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0xc]
jb 0x11c329f
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 8], ecx
jb 0x11c32c4
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 6]
cmp dword [ebp - 8], ecx
jle 0x11c32b0
mov eax, dword [ebp + 8]
jmp 0x11c32d9
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0x11c3283
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
sub edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x14]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x11d57a5
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
xorpd xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov eax, dword [0x10095fa0]
or eax, dword [0x10095fa4]
jne 0x11d580c
push 0x33
call fcn.011d57d2
mov eax, dword [0x10095fa0]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x10095fa4]
mov dword [ebp - 8], ecx
push 0x33
call fcn.011d5824
Function at 0x11dfa25
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
cmp dword [0x10096060], 0
jne 0x11dfa48
xor eax, eax
xor edx, edx
jmp 0x11dfc14
lea eax, [ebp + 0x14]
mov dword [ebp - 0x48], eax
cmp dword [ebp + 0x10], 0
jle 0x11dfa77
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x54], edx
jmp 0x11dfa80
xorpd xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0x10], 0
jle 0x11dfab5
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x48]
add eax, 8
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x68], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x64], eax
jmp 0x11dfabe
xorpd xmm0, xmm0
movlpd qword [ebp - 0x68], xmm0
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x28], edx
cmp dword [ebp + 0x10], 0
jle 0x11dfaf3
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x48]
add ecx, 8
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0x11dfafc
xorpd xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x38], eax
cmp dword [ebp + 0x10], 0
jle 0x11dfb31
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0x11dfb3a
xorpd xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
xorpd xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
sub eax, 8
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 8], ax
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0xc], esp
and esp, 0xfffffff0
push 0x33
call 0x11dfb95
add dword [esp], 5
retf
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.012226b9
mov esp, ebp
pop ebp
ret