joyce8/EMBER2024-capa huggingface dataset:
Function at 0x90b490
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], edx
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x10
call fcn.0090b290
xor esi, esi
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
test bl, bl
jne 0x90b56c
xor ecx, ecx
mov cl, byte [eax]
mov ecx, dword [ecx*4 + 0x912530]
movzx edi, byte [eax + 1]
xor ecx, dword [edi*4 + 0x912930]
movzx edi, byte [eax + 2]
xor ecx, dword [edi*4 + 0x912d30]
movzx edi, byte [eax + 3]
xor ecx, dword [edi*4 + 0x913130]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov cl, byte [ebp - 0x18]
mov cl, byte [ecx + 0x9113f8]
lea edi, [esi]
and edi, 0x80000003
jns 0x90b506
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0x10], cl
xor ecx, ecx
mov cl, byte [ebp - 0x17]
mov cl, byte [ecx + 0x9113f8]
lea edi, [esi + 1]
and edi, 0x80000003
jns 0x90b525
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xf], cl
xor ecx, ecx
mov cl, byte [ebp - 0x16]
mov cl, byte [ecx + 0x9113f8]
lea edi, [esi + 2]
and edi, 0x80000003
jns 0x90b544
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xe], cl
xor ecx, ecx
mov cl, byte [ebp - 0x15]
mov cl, byte [ecx + 0x9113f8]
lea edi, [esi + 3]
and edi, 0x80000003
jns 0x90b563
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xd], cl
jmp 0x90b5ed
lea ecx, [esi]
and ecx, 0x80000003
jns 0x90b57b
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4]
mov cl, byte [ecx + 0x9113f8]
mov byte [edx], cl
lea ecx, [esi + 3]
and ecx, 0x80000003
jns 0x90b59a
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 1]
mov cl, byte [ecx + 0x9113f8]
mov byte [edx + 1], cl
lea ecx, [esi + 2]
and ecx, 0x80000003
jns 0x90b5bb
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 2]
mov cl, byte [ecx + 0x9113f8]
mov byte [edx + 2], cl
lea ecx, [esi + 1]
and ecx, 0x80000003
jns 0x90b5dc
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 3]
mov cl, byte [ecx + 0x9113f8]
mov byte [edx + 3], cl
inc esi
add edx, 4
add eax, 4
cmp esi, 4
jne 0x90b4b5
mov eax, dword [ebp - 0x14]
mov edi, eax
lea esi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x90de20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.00901438
mov eax, dword [esi]
call fcn.00901640
mov edi, eax
test edi, edi
jle 0x90de5a
mov ebx, 1
mov eax, esi
call fcn.00901800
mov edx, dword [esi]
mov dl, byte [edx + ebx - 1]
xor dl, 0xec
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x90de42
pop edi
pop esi
pop ebx
ret
Function at 0x90e120
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc64
xor eax, eax
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x398], eax
xor eax, eax
push ebp
push 0x90e2c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x394]
xor ecx, ecx
mov edx, 0x94
call fcn.0090086c
mov dword [ebp - 0x394], 0x94
mov eax, sub.kernel32.dll_GetVersionExA
mov al, byte [eax]
xor al, 0x96
cmp al, 0x57
je 0x90e29a
lea eax, [ebp - 0x394]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x90e29a
cmp dword [ebp - 0x384], 2
jne 0x90e235
mov eax, sub.kernel32.dll_CreateFileW
mov al, byte [eax]
xor al, 0x96
cmp al, 0x57
je 0x90e29a
lea edx, [ebp - 0x398]
mov eax, 0x90e2dc
call fcn.0090de20
mov edx, dword [ebp - 0x398]
lea eax, [ebp - 0x100]
call fcn.00904f9c
push pe_nt_image_headers32
lea eax, [ebp - 0x300]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x100]
push eax
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar_1
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x300]
push eax
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x90e21d
push eax
call sub.kernel32.dll_CloseHandle_1
dec dword [0x9146bc]
dec dword [0x9146c0]
jmp 0x90e2ab
call sub.kernel32.dll_GetLastError_1
cmp eax, 5
je 0x90e29a
dec dword [0x9146bc]
dec dword [0x9146c0]
jmp 0x90e2ab
mov eax, sub.kernel32.dll_CreateFileA_1
mov al, byte [eax]
xor al, 0x96
cmp al, 0x57
je 0x90e29a
lea edx, [ebp - 0x39c]
mov eax, 0x90e2f0
call fcn.0090de20
mov edx, dword [ebp - 0x39c]
lea eax, [ebp - 0x100]
call fcn.00904f9c
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
jne 0x90e294
dec dword [0x9146bc]
dec dword [0x9146c0]
jmp 0x90e2ab
push eax
call sub.kernel32.dll_CloseHandle_1
inc dword [0x9146bc]
inc dword [0x9146c0]
call fcn.0090dfe0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x90e2d0
lea eax, [ebp - 0x39c]
mov edx, 2
call fcn.00901408
ret
Function at 0x90e2fc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc64
xor eax, eax
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x398], eax
xor eax, eax
push ebp
push 0x90e4a5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x394]
xor ecx, ecx
mov edx, 0x94
call fcn.0090086c
mov dword [ebp - 0x394], 0x94
mov eax, sub.kernel32.dll_GetVersionExA
mov al, byte [eax]
xor al, 0x96
cmp al, 0x57
je 0x90e476
lea eax, [ebp - 0x394]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x90e476
cmp dword [ebp - 0x384], 2
jne 0x90e411
mov eax, sub.kernel32.dll_CreateFileW
mov al, byte [eax]
xor al, 0x96
cmp al, 0x57
je 0x90e476
lea edx, [ebp - 0x398]
mov eax, 0x90e4b8
call fcn.0090de20
mov edx, dword [ebp - 0x398]
lea eax, [ebp - 0x100]
call fcn.00904f9c
push pe_nt_image_headers32
lea eax, [ebp - 0x300]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x100]
push eax
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar_1
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x300]
push eax
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x90e3f9
push eax
call sub.kernel32.dll_CloseHandle_1
dec dword [0x9146bc]
dec dword [0x9146c0]
jmp 0x90e487
call sub.kernel32.dll_GetLastError_1
cmp eax, 5
je 0x90e476
dec dword [0x9146bc]
dec dword [0x9146c0]
jmp 0x90e487
mov eax, sub.kernel32.dll_CreateFileA_1
mov al, byte [eax]
xor al, 0x96
cmp al, 0x57
je 0x90e476
lea edx, [ebp - 0x39c]
mov eax, 0x90e4cc
call fcn.0090de20
mov edx, dword [ebp - 0x39c]
lea eax, [ebp - 0x100]
call fcn.00904f9c
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
jne 0x90e470
dec dword [0x9146bc]
dec dword [0x9146c0]
jmp 0x90e487
push eax
call sub.kernel32.dll_CloseHandle_1
inc dword [0x9146bc]
inc dword [0x9146c0]
call fcn.0090dfe0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x90e4ac
lea eax, [ebp - 0x39c]
mov edx, 2
call fcn.00901408
ret
Function at 0x90ea0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x90eb7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.009013e4
lea eax, [ebp - 4]
push eax
push 1
push 0
lea edx, [ebp - 0x210]
mov eax, 0x90eb94
call fcn.0090de20
mov eax, dword [ebp - 0x210]
call fcn.009017f4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x90eadc
mov dword [ebp - 8], 0x201
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x209]
push eax
push 0
push 0
lea edx, [ebp - 0x214]
mov eax, esi
call fcn.0090de20
mov eax, dword [ebp - 0x214]
call fcn.009017f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x90ead3
mov edx, ebx
lea eax, [ebp - 0x209]
call fcn.00905044
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x90eb60
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 4]
push eax
push 1
push 0
lea edx, [ebp - 0x218]
mov eax, 0x90ebc8
call fcn.0090de20
mov eax, dword [ebp - 0x218]
call fcn.009017f4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x90eb60
mov dword [ebp - 8], 0x201
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x209]
push eax
push 0
push 0
lea edx, [ebp - 0x21c]
mov eax, esi
call fcn.0090de20
mov eax, dword [ebp - 0x21c]
call fcn.009017f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x90eb57
mov edx, ebx
lea eax, [ebp - 0x209]
call fcn.00905044
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x90eb85
lea eax, [ebp - 0x21c]
mov edx, 4
call fcn.00901408
ret
Function at 0x90f19c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x90f340
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x28
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.0090086c
lea ecx, [ebp - 0x144]
mov eax, 0x91467c
mov edx, 0x10
call fcn.0090b160
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
lea edx, [ebp - 0x148]
mov eax, 0x90f354
call fcn.0090de20
mov eax, dword [ebp - 0x148]
call fcn.009017f4
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x90f27e
lea edx, [ebp - 0x14c]
lea eax, [ebp - 0x3c]
call fcn.00905044
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x14]
call fcn.0090ec58
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x144]
mov ecx, 0x10
call fcn.0090b1e4
mov edx, 0x9146f0
lea eax, [ebp - 0x14]
mov ecx, 8
call fcn.009006d8
mov edx, 0x9146f8
lea eax, [ebp - 0xc]
mov ecx, 8
call fcn.009006d8
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.0090086c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
lea edx, [ebp - 0x150]
mov eax, 0x90f364
call fcn.0090de20
mov eax, dword [ebp - 0x150]
call fcn.009017f4
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x90f322
lea edx, [ebp - 0x154]
lea eax, [ebp - 0x3c]
call fcn.00905044
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x14]
call fcn.0090ec58
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x144]
mov ecx, 0x10
call fcn.0090b1e4
mov edx, 0x914700
lea eax, [ebp - 0x14]
mov ecx, 4
call fcn.009006d8
mov edx, 0x914704
lea eax, [ebp - 0x10]
mov ecx, 4
call fcn.009006d8
mov edx, 0x914a20
lea eax, [ebp - 0xc]
mov ecx, 8
call fcn.009006d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x90f347
lea eax, [ebp - 0x154]
mov edx, 4
call fcn.00901408
ret
Function at 0x90f36c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov esi, eax
xor eax, eax
push ebp
push 0x90f505
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x28
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 0x10
call fcn.0090086c
lea edx, [ebp - 0x10]
mov eax, 0x9146f0
mov ecx, 8
call fcn.009006d8
lea edx, [ebp - 8]
mov eax, 0x9146f8
mov ecx, 8
call fcn.009006d8
lea ecx, [ebp - 0x140]
mov eax, 0x91467c
mov edx, 0x10
call fcn.0090b160
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x140]
mov ecx, 0x10
call fcn.0090b1e4
lea edx, [ebp - 0x144]
lea eax, [ebp - 0x10]
call fcn.0090ecf0
mov edx, dword [ebp - 0x144]
lea eax, [ebp - 0x38]
call fcn.00904f9c
push ebx
lea eax, [ebp - 0x38]
push eax
push 1
push 0
lea edx, [ebp - 0x148]
mov eax, 0x90f51c
call fcn.0090de20
mov eax, dword [ebp - 0x148]
call fcn.009017f4
push eax
push esi
call sub.advapi32.dll_RegSetValueExA
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 0x10
call fcn.0090086c
lea edx, [ebp - 0x10]
mov eax, 0x914700
mov ecx, 4
call fcn.009006d8
lea edx, [ebp - 0xc]
mov eax, 0x914704
mov ecx, 4
call fcn.009006d8
lea edx, [ebp - 8]
mov eax, 0x914a20
mov ecx, 8
call fcn.009006d8
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x140]
mov ecx, 0x10
call fcn.0090b1e4
lea edx, [ebp - 0x14c]
lea eax, [ebp - 0x10]
call fcn.0090ecf0
mov edx, dword [ebp - 0x14c]
lea eax, [ebp - 0x38]
call fcn.00904f9c
push ebx
lea eax, [ebp - 0x38]
push eax
push 1
push 0
lea edx, [ebp - 0x150]
mov eax, 0x90f52c
call fcn.0090de20
mov eax, dword [ebp - 0x150]
call fcn.009017f4
push eax
push esi
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x90f50c
lea eax, [ebp - 0x150]
mov edx, 4
call fcn.00901408
ret
Function at 0x4b982d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2358
cmp edx, dword [eax]
je 0x4b984f
add eax, 8
inc ecx
cmp eax, 0x4c23e8
jl 0x4b9840
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2358]
jne 0x4b997d
mov eax, dword [0x4c6cdc]
cmp eax, 1
je 0x4b9957
test eax, eax
jne 0x4b9880
cmp dword [0x4c2280], 1
je 0x4b9957
cmp edx, 0xfc
je 0x4b997d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b98b7
lea eax, [ebp - 0x1a4]
push 0x4beb38
push eax
call fcn.004ba210
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba6a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b98fa
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba6a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4beb34
push edi
call fcn.004bc570
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4beb18
push eax
call fcn.004ba210
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004ba220
lea eax, [ebp - 0xa0]
push 0x4beb14
push eax
call fcn.004ba220
push dword [esi + 0x4c235c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004ba220
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4beaec
push eax
call fcn.004bc4e4
add esp, 0x2c
pop edi
jmp 0x4b997d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c235c]
push 0
push eax
push dword [esi]
call fcn.004ba6a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x23a4300
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.023a438f
jae 0x23a430e
xor ecx, ecx
call fcn.023a438f
jae 0x23a433d
xor eax, eax
call fcn.023a438f
jae 0x23a434d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.023a438f
adc al, al
jae 0x23a432f
jne 0x23a4379
stosb byte es:[edi], al
jmp 0x23a4311
call fcn.023a439b
sub ecx, ebx
jne 0x23a4356
call fcn.023a4399
jmp 0x23a4375
lodsb al, byte [esi]
shr eax, 1
je 0x23a4383
adc ecx, ecx
jmp 0x23a4372
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.023a4399
cmp eax, 0x7d00
jae 0x23a4372
cmp ah, 5
jae 0x23a4373
cmp eax, 0x7f
ja 0x23a4374
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x23a4311
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401c66
pop dword [ebp - 0x28]
mov eax, 0xc7b599c5
sub eax, 0xc7757d5f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x909d5cc4
sub dword [ebp - 0x38], 0x424b1779
mov dword [ebp - 0x34], 0x9659af5f
add dword [ebp - 0x34], 0x9bd99ce6
mov dword [ebp - 0x30], 0x4e2b281e
sub dword [ebp - 0x30], 0x1dee3f0
mov dword [ebp - 0x2c], 0x2f44a5
sub dword [ebp - 0x2c], 0x2f44a5
lea eax, [ebp - 0x38]
push eax
mov eax, 0xd1e8e0ac
sub eax, 0xd1a8b058
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x7d95fd2a
sub dword [ebp - 0x38], 0x92393d4
mov dword [ebp - 0x34], 0xea8f52fd
sub dword [ebp - 0x34], 0xa922f188
mov dword [ebp - 0x30], 0x9691d863
add dword [ebp - 0x30], 0xccdd9409
mov dword [ebp - 0x2c], 0x27762d21
add dword [ebp - 0x2c], 0xd889d2df
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x68bc0aa6
add eax, 0x97842586
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x365a6
push 0
call eax
mov ecx, 0x68864e72
add ecx, 0x9779f90b
xor ebx, ebx
add ebx, eax
mov edx, 0xd7e340b6
add edx, 0x285d2f4a
add edx, dword [ebp - 0x28]
mov edi, 0x37344806
sub edi, 0xc3112acc
add dword [ebp - 0x24], ecx
mov esi, dword [edx]
xor dword [ebp - 0x24], ebx
sub esi, edi
add dword [ebp - 0x24], ebx
mov dword [ebx], esi
xor dword [ebp - 0x20], edi
add ebx, 0xd5e38b88
sub ebx, 0xd5e38b84
add edx, 0x63121e8f
add edx, 0x9cede175
loop 0x401d8a
add eax, 0x110c7
xor ebx, ebx
add ebx, eax
add eax, 0x30085e7e
add eax, 0xcff7a187
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4069cb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069ef
xor eax, eax
test eax, eax
je 0x406a02
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a02
xor ecx, ecx
jmp 0x406a05
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b28
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a662c], 0
push esi
jne 0x406b5f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b39
mov dword [ecx*4 + 0x7a6628], eax
inc ecx
cmp ecx, 0x100
jl 0x406b34
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b90
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a6628]
xor eax, esi
inc ecx
dec edx
jne 0x406b72
pop edi
not eax
pop esi
ret 0xc

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x5f0c70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1aa000]
push edi
jmp 0x5f0c8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5f0c91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f0c80
mov eax, 1
add ebx, ebx
jne 0x5f0ca3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5f0cb4
jne 0x5f0cd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f0cd3
dec eax
add ebx, ebx
jne 0x5f0cc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5f0c98
add ebx, ebx
jne 0x5f0ccf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5f0d25
xor ecx, ecx
sub eax, 3
jb 0x5f0ceb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5f0d5a
sar eax, 1
mov ebp, eax
jmp 0x5f0cf6
add ebx, ebx
jne 0x5f0cf6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f0cc4
inc ecx
add ebx, ebx
jne 0x5f0d04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f0cc4
add ebx, ebx
jne 0x5f0d11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5f0d06
jne 0x5f0d22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5f0d06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5f0d44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5f0d36
jmp 0x5f0c86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5f0d44
add edi, ecx
jmp 0x5f0c86
pop esi
mov edi, esi
mov ecx, 0x1205
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5f0d62
cmp byte [edi], 2
jne 0x5f0d62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5f0d67
lea edi, [esi + 0x1ee000]
mov eax, dword [edi]
or eax, eax
je 0x5f0ddf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f0be0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f0c1c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5f0d94
mov ecx, edi
jns 0x5f0dc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f0c24]
or eax, eax
je 0x5f0dd9
mov dword [ebx], eax
add ebx, 4
jmp 0x5f0db1
call dword [esi + 0x1f0c20]
mov ebp, dword [esi + 0x1f0c28]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5f0e13
sub esp, 0xffffff80
jmp 0x4053ec