joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x405b32
pop dword [ebp - 0x48]
mov eax, 0x8be7e788
sub eax, 0x8ba78c56
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x6764646f
sub dword [ebp - 0x58], 0x19121f24
mov dword [ebp - 0x54], 0xf2c51caa
sub dword [ebp - 0x54], 0xc091d065
mov dword [ebp - 0x50], 0xa77c42db
sub dword [ebp - 0x50], 0x5b2ffead
mov dword [ebp - 0x4c], 0xc05ee5ed
sub dword [ebp - 0x4c], 0xc05ee5ed
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xd98152f6
sub dword [ebp - 0x58], 0x650ee9a0
mov dword [ebp - 0x54], 0x532eb6cb
add dword [ebp - 0x54], 0xee3daaaa
mov dword [ebp - 0x50], 0x57eeed82
add dword [ebp - 0x50], 0xb807eea
mov dword [ebp - 0x4c], 0x712c716c
sub dword [ebp - 0x4c], 0x712c716c
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x68caff2f
add eax, 0x9775814d
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x369e0
push 0
call eax
mov ecx, 0x484198d5
add ecx, 0xb7bead99
xor ebx, ebx
add ebx, eax
mov edx, 0x474c0235
add edx, 0xb8f911cb
add edx, dword [ebp - 0x48]
mov edi, 0xf894ea02
add edi, 0x89f5c5a3
xor dword [ebp - 0x34], 0xe8fe3ec0
mov esi, dword [edx]
sub dword [ebp - 0x38], 0xae1711ae
xor esi, edi
add dword [ebp - 0x44], 0x2b5fa592
mov dword [ebx], esi
sub dword [ebp - 0x18], edi
add ebx, 4
add edx, 0x5d9f8811
add edx, 0xa26077f3
loop 0x405c51
add eax, 0xcab7a5ea
add eax, 0x354966a1
mov ebx, eax
add eax, 0xe85c911d
add eax, 0x17a36ee8
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4250c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x4250d0
or eax, 0xffffffff
jmp 0x4250e9
mov eax, dword [0x4677e4]
push eax
push 1
push 0x2710
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044805c
add esp, 0x10
pop ebp
ret

Function at 0x439770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00448409
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0044805c
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4411a0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x4660c0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1ac], ecx
mov word [ebp - 0x198], 0
push 0x18e
push 0
lea eax, [ebp - 0x196]
push eax
call fcn.00447990
add esp, 0xc
mov word [ebp - 4], 2
lea ecx, [ebp - 0x198]
push ecx
mov dx, word [ebp - 4]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 0x1ac]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1ac]
cmp dword [edx + 4], 0xffffffff
jne 0x441230
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Server_socket_is_INVALID_SOCKET__d__n
call fcn.00445a00
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x441318
mov word [ebp - 0x1a8], 0
xor eax, eax
mov dword [ebp - 0x1a6], eax
mov dword [ebp - 0x1a2], eax
mov dword [ebp - 0x19e], eax
mov word [ebp - 0x19a], ax
cmp dword [ebp + 8], 0
je 0x441260
cmp dword [ebp + 0xc], 0
jne 0x441287
mov word [ebp - 0x1a8], 2
push 0x22b8
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1a6], ax
mov dword [ebp - 0x1a4], 0
jmp 0x4412ad
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x1a8], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1a4], eax
mov edx, dword [ecx + 8]
mov dword [ebp - 0x1a0], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x19c], eax
push 0x10
lea ecx, [ebp - 0x1a8]
push ecx
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4412e7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Server_bind_is_SOCKET_ERROR__d__n
call fcn.00445a00
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x441318
push 5
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x441318
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Server_listen_is_SOCKET_ERROR__d__n
call fcn.00445a00
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00447a0a
mov esp, ebp
pop ebp
ret 8
Function at 0x4413e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x441426
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Server_send_is_SOCKET_ERROR__d__n
call fcn.00445a00
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x441430
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x441471
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jg 0x441471
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [edx], eax
jmp 0x4414cd
cmp dword [ebp - 4], 0
jne 0x441486
push str.Server_recv:the_connection_has_been_gracefully_closed_n
call fcn.00445a00
add esp, 4
jmp 0x4414be
cmp dword [ebp - 4], 0xffffffff
jne 0x4414a2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Server_recv:SOCKET_ERROR__d__n
call fcn.00445a00
add esp, 8
jmp 0x4414be
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov edx, dword [ebp - 4]
push edx
push str.Server_recv_unknown_Error__d__d__s__n
call fcn.00445a00
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x447a0a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4660c0]
jne 0x447a14
repz ret
jmp fcn.0044b1e8
Function at 0x447dc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x447dfd
cmp dword [ebp + 0x14], edi
je 0x447dfd
cmp ecx, edi
jne 0x447e04
call fcn.0044be41
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0044bde2
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x447e18
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x447e39
cmp ebx, 0xffffffff
je 0x447e28
push ebx
push edi
push ecx
call fcn.00447990
add esp, 0xc
cmp esi, edi
je 0x447de5
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x447de5
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x447e55
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x447e5c
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x447f4d
test word [esi + 0xc], 0x10c
je 0x447eb0
mov eax, dword [esi + 4]
test eax, eax
je 0x447eb0
jl 0x447fae
cmp ebx, eax
mov edi, ebx
jb 0x447e81
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x447f55
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0044bc61
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x447f45
cmp ebx, dword [ebp - 0xc]
jb 0x447f1d
cmp dword [ebp - 0xc], 0
je 0x447eda
mov ecx, accept
xor edx, edx
cmp ebx, ecx
jbe 0x447ecf
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x447ed6
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x447ee5
mov eax, accept
cmp ebx, eax
ja 0x447ee5
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x447f81
push eax
push dword [ebp - 8]
push esi
call fcn.0044bc34
pop ecx
push eax
call fcn.0044bb37
add esp, 0xc
test eax, eax
je 0x447fc0
cmp eax, 0xffffffff
je 0x447fae
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x447f45
push esi
call fcn.0044b456
cmp eax, 0xffffffff
pop ecx
je 0x447fb2
cmp dword [ebp - 4], 0
je 0x447f81
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x447e64
mov eax, dword [ebp + 0x14]
jmp 0x447dff
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x447f6c
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00447990
add esp, 0xc
call fcn.0044be41
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x447df5
cmp dword [ebp + 0xc], 0xffffffff
je 0x447f97
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00447990
add esp, 0xc
call fcn.0044be41
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x447df5
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x447dff
or dword [esi + 0xc], 0x10
jmp 0x447fb2
Function at 0x44d29d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x466748]
je 0x44d2b8
inc edi
cmp edi, 0x17
jb 0x44d2a9
cmp edi, 0x17
jae 0x44d438
push ebp
push 3
call fcn.0045546f
cmp eax, 1
pop ecx
je 0x44d404
push 3
call fcn.0045546f
test eax, eax
pop ecx
jne 0x44d2ec
cmp dword [0x466120], 1
je 0x44d404
cmp ebx, 0xfc
je 0x44d437
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x467e48
push ebp
call fcn.0045540a
add esp, 0xc
test eax, eax
je 0x44d322
push esi
push esi
push esi
push esi
push esi
call fcn.0044bce6
add esp, 0x14
push 0x104
mov esi, 0x467e61
push esi
push 0
mov byte [0x467f65], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44d366
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0045540a
add esp, 0xc
test eax, eax
je 0x44d366
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0044bce6
add esp, 0x14
push esi
call fcn.00448220
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x44d3ab
push esi
call fcn.00448220
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x46815c
push 0x45ce4c
sub ecx, eax
push ecx
push eax
call fcn.00455357
add esp, 0x14
test eax, eax
je 0x44d3ab
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0044bce6
add esp, 0x14
jmp 0x44d3ad
xor esi, esi
push 0x45ce48
push ebx
push ebp
call fcn.004552e6
add esp, 0xc
test eax, eax
je 0x44d3cd
push esi
push esi
push esi
push esi
push esi
call fcn.0044bce6
add esp, 0x14
push dword [edi*8 + 0x46674c]
push ebx
push ebp
call fcn.004552e6
add esp, 0xc
test eax, eax
je 0x44d3ef
push esi
push esi
push esi
push esi
push esi
call fcn.0044bce6
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00455129
add esp, 0xc
jmp 0x44d437
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x44d437
cmp ebp, 0xffffffff
je 0x44d437
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x46674c]
push dword [esi]
call fcn.00448220
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x455129
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0045112d
xor ebx, ebx
cmp dword [0x468300], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4551ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4552df
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4552df
push eax
call fcn.004510bf
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x468300], eax
call esi
push eax
call fcn.004510bf
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x468304], eax
call esi
push eax
call fcn.004510bf
mov dword [0x468308], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0044d02a
test eax, eax
pop ecx
pop ecx
je 0x4551cd
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044bce6
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4551ff
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004510bf
cmp eax, ebx
pop ecx
mov dword [0x468310], eax
je 0x4551ff
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004510bf
pop ecx
mov dword [0x46830c], eax
mov eax, dword [0x46830c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x455284
cmp dword [0x468310], ecx
je 0x455284
push eax
call fcn.00451136
push dword [0x468310]
mov esi, eax
call fcn.00451136
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x455284
cmp edi, ebx
je 0x455284
call esi
cmp eax, ebx
je 0x455251
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x455251
test byte [ebp - 0x18], 1
jne 0x455284
lea eax, [ebp - 0x10]
push eax
call fcn.0044d061
test eax, eax
pop ecx
je 0x45526c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044bce6
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x45527b
or dword [ebp + 0x10], 0x200000
jmp 0x4552bf
or dword [ebp + 0x10], 0x40000
jmp 0x4552bf
mov eax, dword [0x468304]
cmp eax, dword [ebp - 8]
je 0x4552bf
push eax
call fcn.00451136
cmp eax, ebx
pop ecx
je 0x4552bf
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4552bf
mov eax, dword [0x468308]
cmp eax, dword [ebp - 8]
je 0x4552bf
push eax
call fcn.00451136
cmp eax, ebx
pop ecx
je 0x4552bf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x468300]
call fcn.00451136
cmp eax, ebx
pop ecx
je 0x4552df
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4552e1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401140
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40406e], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.timecraft
push str.named
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401188
xor eax, eax
jmp 0x4011a3
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40c630
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40c652
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c659
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c648
mov eax, 1
add ebx, ebx
jne 0x40c66b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c660
jne 0x40c67c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c660
xor ecx, ecx
sub eax, 3
jb 0x40c690
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c702
mov ebp, eax
add ebx, ebx
jne 0x40c69b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c6a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c6cc
inc ecx
add ebx, ebx
jne 0x40c6b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c6ad
jne 0x40c6c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c6ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c6ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c6dd
jmp 0x40c64e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c6ec
add edi, ecx
jmp 0x40c64e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c74b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc03c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c709
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc040]
or eax, eax
je 0x40c745
mov dword [ebx], eax
add ebx, 4
jmp 0x40c726
call dword [esi + 0xc050]
mov ebp, dword [esi + 0xc044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c77f
sub esp, 0xffffff80
jmp 0x40a71c
Function at 0x42dea0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49e73b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048ee92
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42df22
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048c910
mov eax, dword [eax]
push 0x4ec204
push eax
call fcn.0047f474
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048f11d
test bl, bl
je 0x42df22
push 0x4ec204
lea ecx, [esp + 0xc]
call fcn.0048f4f9
push 0x4efd7c
lea ecx, [esp + 0xc]
call fcn.0048f4f9
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42df5e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048f11d
jmp 0x42e029
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42dfe2
lea edx, [esp + 0x7c]
push 0x4efd78
push edx
call fcn.0047f474
add esp, 8
test eax, eax
je 0x42dfe2
lea eax, [esp + 0x7c]
push 0x4efd74
push eax
call fcn.0047f474
add esp, 8
test eax, eax
je 0x42dfe2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42df72
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048f11d
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42e820
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42e882
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc