joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458c10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
lea ebx, [edx + ecx]
mov ecx, 1
sub esp, 0x2c
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 0x20], edx
jmp 0x458c5f
mov eax, ebx
mov dword [esp + 4], edi
sub eax, edi
mov dword [esp + 0xc], 0
cmp eax, esi
cmovg eax, esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.ws2_32.dll_recv
sub esp, 0x10
lea ecx, [edi + eax]
test eax, eax
cmovg edi, ecx
test eax, eax
jle 0x458c67
cmp ebx, edi
ja 0x458c30
mov ecx, eax
xor ebx, ebx
test eax, eax
js 0x458cc0
mov dword [esp + 4], 0x127
mov dword [esp], str..._wine_dlls_ws2_32_tests_sock.c
mov dword [ebp - 0x1c], ecx
call fcn.00465a80
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0xc], ebx
mov eax, dword fs:[0x18]
not ecx
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str.do_synchronous_recv___x_:_error__d:_n
shr ecx, 0x1f
mov dword [esp + 8], eax
mov dword [esp], ecx
call fcn.00465cf0
mov eax, edi
sub eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x1c], eax
call sub.ws2_32.dll_WSAGetLastError
mov ecx, dword [ebp - 0x1c]
mov ebx, eax
jmp 0x458c6f

Function at 0x458cd0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0xe2
mov dword [esp], str..._wine_dlls_ws2_32_tests_sock.c
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], 4
call fcn.00465a80
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x7008
mov dword [esp + 4], 0xffff
mov dword [esp], 0xffffffff
call sub.ws2_32.dll_setsockopt
sub esp, 0x14
test eax, eax
sete al
mov dword [esp + 4], str.setting_SO_OPENTYPE_failed_n
movzx eax, al
mov dword [esp], eax
call fcn.00465cf0
mov dword [esp + 4], 0xe5
mov dword [esp], str..._wine_dlls_ws2_32_tests_sock.c
call fcn.00465a80
lea eax, [ebp - 0xc]
mov dword [esp + 8], 0x7008
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xffff
mov dword [esp], 0xffffffff
call sub.ws2_32.dll_getsockopt
sub esp, 0x14
test eax, eax
sete al
mov dword [esp + 4], str.getting_SO_OPENTYPE_failed_n
movzx eax, al
mov dword [esp], eax
call fcn.00465cf0
mov dword [esp + 4], 0xe8
mov dword [esp], str..._wine_dlls_ws2_32_tests_sock.c
call fcn.00465a80
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
mov dword [esp + 4], str.failed_to_set_SO_OPENTYPE_n
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00465cf0
leave
ret
Function at 0x459aa0
Capabilities:
Create udp socket
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [sym.imp.kernel32.dll_LocalAlloc]
mov dword [esp + 4], 0xd4
mov dword [esp], 0x40
mov dword [ebp - 0x20], eax
call eax
sub esp, 8
mov ebx, eax
mov dword [esp + 4], eax
mov eax, dword [0x478498]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [edi]
lea edi, [ebx + 0x14]
sub esp, 8
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], 2
call sub.ws2_32.dll_WSASocketA
sub esp, 0x18
mov dword [ebx], eax
mov dword [esp + 4], 0x162
mov dword [esp], str..._wine_dlls_ws2_32_tests_sock.c
call fcn.00465a80
mov dword [esp + 4], str.Server:_WSASocket_failed_n
xor eax, eax
cmp dword [ebx], 0xffffffff
setne al
mov dword [esp], eax
call fcn.00465cf0
mov eax, 2
mov word [ebx + 4], ax
mov eax, dword [esi + 8]
mov dword [esp], eax
call sub.ws2_32.dll_inet_addr
mov dword [ebx + 8], eax
movzx eax, word [esi + 0xc]
sub esp, 4
rol ax, 8
mov word [ebx + 6], ax
lea eax, [ebx + 0xd4]
mov dword [ebp - 0x1c], eax
mov dword [edi], 0xffffffff
mov eax, dword [esi + 0x14]
add edi, 0x30
imul eax, dword [esi + 0x10]
mov dword [esp], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
call eax
mov dword [edi - 8], 0
mov dword [edi - 0xc], eax
sub esp, 8
mov dword [edi - 4], 0
cmp edi, dword [ebp - 0x1c]
jne 0x459b72
cmp dword [esi], 1
je 0x459bb8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
lea edx, [ebx + 4]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00459890
Function at 0x465800
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], 1
call dword [0x4695ec]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_fflush]
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x4663a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 0x2c], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00466d60
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
and esp, 0xfffffff0
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
leave
shl edx, 5
add eax, edx
ret
Function at 0x1000a578
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
mov dword [0x100227b0], eax
xor eax, eax
mov dword [0x100227b4], eax
mov edi, 0x10022760
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, 0x100227a0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop edi
ret

Function at 0x1000a6f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a72f
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegDeleteValueA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0xc

Function at 0x1000a740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push dword [ebp + 0x14]
pop dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a78f
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x10

Function at 0x1000a7a0
Capabilities:
Check os version
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x1000a7e5
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x1000a7de
cmp dword [ebp - 0x98], 1
jb 0x1000a7de
mov ecx, 0x101
jmp 0x1000a7ea
mov ecx, 1
jmp 0x1000a7ea
mov ecx, 0xf003f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push ecx
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a834
push dword [ebp + 0x14]
call sub.kernel32.dll_lstrlenA
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14

Function at 0x10024e40
Capabilities:
Query or enumerate registry value

Disassembly:
cmp ecx, dword [0x1000e000]
jne 0x10024e4a
repz ret
jmp fcn.100258a1

Function at 0x1002db59
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0x40000000
push 0x1000c944
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [0x1000ee90], eax
ret
Function at 0xee7da8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xee7db2
pushal
call 0xee7db8
pop ebp
sub ebp, 0x10
sub ebp, 0xae7da8
jmp 0xee7dce
mov eax, 0xae7da8
add eax, ebp
add eax, 0x4c
mov ecx, 0x598
mov edx, 0xa6d733fb
xor byte [eax], dl
inc eax
dec ecx
jne 0xee7de5
jmp 0xee7df8
jo 0xee7e30
jo 0xee7e6e
invalid
enter 0x1309, 0xfffffffffffffffe
sti
sti
sti
adc dl, bl
sti
sti
sti
scasb al, byte es:[edi]
jo 0xee7e56
jo 0xee7ebf
sti
sti
sti
jo 0xee7eb5
idiv ebx
sti
sti
jo 0xee7ec3
jmp 0xee7e4a
js 0xee7e91
push dword [edx + 0x40f7ef4]
add al, 4
cmpsb byte [esi], byte es:[edi]
cmp edi, esi
sti
jo 0xee7edd
invalid
invalid
add al, 0x8e
adc ebx, dword [ebp + 0x70fbfbfb]
inc esi
sti
sti
sti
enter 0xffffffffffffc832, 0x29
js 0xee7eb8
invalid
sti
sti
sti
popfd
jo 0xee7e9d
out 0xc2, eax
jnp 0xee7eb9
ret 0x7b
add byte [ebx], dl
hlt
adc esi, esp
jg 0xee7e9e
sti
sti
sti
jnp 0xee7ec2
adc dh, ah
jg 0xee7eb0
hlt
sti
sti
sti
popfd
jp 0xee7ecc
add al, 0xde
hlt
cli
js 0xee7f1a
invalid
cli
sti
sti
sti
inc eax
stc
sti
sti
sti
stc
sub esp, esi
jle 0xee7f26
sti
sti
sti
jno 0xee7f1a
mov ebp, 0x78f429e9
and eax, dword [esp + eax]
add al, 0xf9
sub esp, esi
jle 0xee7f39
sti
sti
sti
jno 0xee7f2d
mov ebp, 0x78f429e9
xchg ecx, eax
sti
sti
sti
enter 0xfffffffffffff93b, 0x29
hlt
Function at 0x401000
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
mov ecx, 0x41
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x10]
push eax
push 0x40f030
push ecx
call fcn.004063fc
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
add esp, 0xc
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.00406340
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x401091
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x114]
mov esi, dword [esp + 0x21c]
rep stosd dword es:[edi], eax
mov ecx, ebx
lea eax, [esp + 0x10]
sub ecx, eax
lea edi, [esp + 0x114]
mov edx, ecx
lea eax, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
mov byte [ebx], 0x7c
jmp 0x401037
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x401440
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
lea edi, [ecx + 4]
mov dword [esp + 0x1c], ecx
mov dword [ecx], 0x40b0d0
xor edx, edx
xor eax, eax
mov ecx, edi
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x40145a
mov byte [edi + 0x100], dl
mov byte [edi + 0x101], dl
mov byte [esp + 0x10], dl
xor esi, esi
mov ebx, edi
mov dword [esp + 0x14], 0x100
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x24]
mov cl, byte [ebx]
and eax, 0xff
xor edx, edx
mov dl, byte [eax + ebp]
mov ebp, ecx
and ebp, 0xff
add esi, edx
add ebp, esi
mov edx, ebp
and edx, 0x800000ff
jns 0x4014b2
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x18], dl
mov esi, dword [esp + 0x18]
and esi, 0xff
inc eax
mov dl, byte [esi + edi]
mov byte [ebx], dl
mov byte [esi + edi], cl
cdq
idiv dword [esp + 0x28]
mov eax, dword [esp + 0x14]
inc ebx
dec eax
mov dword [esp + 0x14], eax
mov byte [esp + 0x10], dl
jne 0x401480
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x401520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov al, byte [ecx + 0x105]
mov dl, byte [ecx + 0x104]
mov byte [esp], al
mov eax, dword [esp + 0x18]
push edi
xor edi, edi
test eax, eax
mov byte [esp + 8], dl
jbe 0x401605
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
and eax, 0xff
and esi, 0xff
lea edx, [eax + 1]
and edx, 0x800000ff
jns 0x40156f
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov eax, dword [esp + 0x14]
and eax, 0xff
mov bl, byte [eax + ecx + 4]
mov byte [esp + 0x1c], bl
and ebx, 0xff
add ebx, esi
and ebx, 0x800000ff
jns 0x40159c
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x10], bl
mov bl, byte [esp + 0x1c]
mov esi, dword [esp + 0x10]
mov byte [esp + 0x18], bl
and esi, 0xff
mov ebp, dword [esp + 0x18]
and ebp, 0xff
mov bl, byte [esi + ecx + 4]
mov byte [eax + ecx + 4], bl
mov bl, byte [esp + 0x18]
mov byte [esi + ecx + 4], bl
xor ebx, ebx
mov bl, byte [eax + ecx + 4]
add ebx, ebp
and ebx, 0x800000ff
jns 0x4015e4
dec ebx
or ebx, 0xffffff00
inc ebx
mov ebp, dword [esp + 0x24]
and ebx, 0xff
mov bl, byte [ebx + ecx + 4]
xor byte [edi + ebp], bl
mov ebx, dword [esp + 0x28]
inc edi
cmp edi, ebx
jb 0x40155c
pop esi
pop ebp
pop ebx
mov byte [ecx + 0x104], dl
mov dl, byte [esp + 4]
mov byte [ecx + 0x105], dl
mov eax, 1
pop edi
add esp, 0x10
ret 8
Function at 0x403d17
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or eax, 0x47b70f5c
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.00403b04
mov word [eax + ebx], fs
mov al, 0x66
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x403d5e
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x403d58
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x403d49
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00403b04
pop ecx
pop esp
daa
mov eax, 0x50a8458d
call fcn.00403b14
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00403ac9
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x403df2
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00403b04
movsb byte es:[edi], byte [esi]
rol dword [esp - 0x73], 1
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x405ca6
Capabilities:
Delete directory
Delete file

Disassembly:
add ebp, 0x24
push esp
call fcn.00403b04
cmp al, 0x72
outsb dx, byte [esi]
test byte [ecx + 0x30], ah
add byte [eax], al
add byte [ebx + 0x708b0c40], cl
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je fcn.00405cc8
xchg esi, eax
lodsd eax, dword [esi]

Function at 0x405cc8
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, dword [eax + 8]
push eax
call fcn.00403b04
sub al, dl
fldcw word [0x478bf88b]
cmp al, 0x8b
push esp
pop es
js 0x405ce2
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.00403b04
in al, 0xfa
aad 0xb0
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x405cf1
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x405cf1
call fcn.00403b04
mov ebp, 0x8bccfad1
pop edx
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00403b04

Function at 0x405d2c
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
xor bh, dh
wait
cmpsb byte [esi], byte es:[edi]
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
call fcn.00404304
test byte cs:[esp + 0x10], 1
push esi
je 0x405d4f
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x405d55
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405d5e
xor eax, eax
inc eax
jmp 0x405d6f
test byte [esp + 0x10], 4
jne 0x405d6d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x45fdec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x45fde8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x45fde8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40ea60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40ea6f
pop dword [ebp - 0x28]
mov eax, 0x5e0639b1
add eax, 0xa23ab0be
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc8a029c7
add dword [ebp - 0x38], 0x85b21b84
mov dword [ebp - 0x34], 0xe8b7fb7a
add dword [ebp - 0x34], 0x497b50cb
mov dword [ebp - 0x30], 0xff9ce500
sub dword [ebp - 0x30], 0xb350a0d2
mov dword [ebp - 0x2c], 0xf0ef8e4
add dword [ebp - 0x2c], 0xf0f1071c
lea eax, [ebp - 0x38]
push eax
mov eax, 0x7b3bc1cb
sub eax, 0x7af99157
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x243d3e38
add dword [ebp - 0x38], 0x50352b1e
mov dword [ebp - 0x34], 0x69048808
sub dword [ebp - 0x34], 0x27982693
mov dword [ebp - 0x30], 0xd3a0b57c
add dword [ebp - 0x30], 0x8fceb6f0
mov dword [ebp - 0x2c], 0x4388683d
sub dword [ebp - 0x2c], 0x4388683d
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x44530a3d
sub eax, 0x4410d919
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x413e3
push 0
call eax
mov ecx, 0xe36c4769
add ecx, 0x1c940ead
xor esi, esi
add esi, eax
mov edi, 0x66894a14
add edi, 0x99b9f9ec
add edi, dword [ebp - 0x28]
mov ebx, 0x83a651f5
add ebx, 0xa07b642c
sub dword [ebp - 4], esi
mov edx, dword [edi]
mov dword [ebp - 0x24], 0x69b82a9e
xor edx, ebx
mov dword [ebp - 0x14], 0x4b77354e
mov dword [esi], edx
add dword [ebp - 0x20], 0x73b512c2
add esi, 0xff4ab74e
sub esi, 0xff4ab74a
add edi, 4
loop 0x40eb93
add eax, 0x31843efc
add eax, 0xce7d0c2f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1f401bc0
add ecx, 0xe0ffe440
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0xff9c90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xab8000]
push edi
jmp 0xff9caa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xff9cb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xff9ca0
mov eax, 1
add ebx, ebx
jne 0xff9cc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xff9cd4
jne 0xff9cf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xff9cf3
dec eax
add ebx, ebx
jne 0xff9ce0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xff9cb8
add ebx, ebx
jne 0xff9cef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xff9d45
xor ecx, ecx
sub eax, 3
jb 0xff9d0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xff9d7a
sar eax, 1
mov ebp, eax
jmp 0xff9d16
add ebx, ebx
jne 0xff9d16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xff9ce4
inc ecx
add ebx, ebx
jne 0xff9d24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xff9ce4
add ebx, ebx
jne 0xff9d31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xff9d26
jne 0xff9d42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xff9d26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xff9d64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xff9d56
jmp 0xff9ca6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xff9d64
add edi, ecx
jmp 0xff9ca6
pop esi
mov edi, esi
mov ecx, 0xfda5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xff9d82
cmp byte [edi], 0x3e
jne 0xff9d82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xff9d87
lea edi, [esi + 0xbf4000]
mov eax, dword [edi]
or eax, eax
je 0xff9dff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc11d74]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc11f18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xff9db4
mov ecx, edi
jns 0xff9de3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc11f20]
or eax, eax
je 0xff9df9
mov dword [ebx], eax
add ebx, 4
jmp 0xff9dd1
call dword [esi + 0xc11f1c]
mov ebp, dword [esi + 0xc11f24]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xff9e33
sub esp, 0xffffff80
jmp 0x6fa54e