joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa50058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a501a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa5007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5006a
add dl, dl
jne 0xa50089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa500dc
xor eax, eax
add dl, dl
jne 0xa50096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5017d
add dl, dl
jne 0xa500a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa500b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa500bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa500c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa500d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa50075
mov eax, 1
add dl, dl
jne 0xa500ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa500f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa500e1
sub eax, ebx
mov ebx, 1
jne 0xa50128
mov ecx, 1
add dl, dl
jne 0xa5010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa50119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa50105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa50075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa5013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa5014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa50136
cmp eax, 0x7d00
jae 0xa5016d
cmp eax, 0x500
jb 0xa50168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa50075
cmp eax, 0x7f
ja 0xa50170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa50075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa5019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa50075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4017a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4017b1
pop dword [ebp - 0x50]
mov eax, 0x98d3cbea
add eax, 0x676c4bc7
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x52919
push 0
mov eax, 0x95420249
sub eax, 0x94fd4f99
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xf6235dc6
add ecx, 0x9dcf41c
xor edx, edx
add edx, eax
mov esi, 0x488e00
add esi, dword [ebp - 0x50]
mov ebx, 0xa4403ac0
add ebx, 0xa91066dc
add dword [ebp - 0x34], edx
mov edi, dword [esi]
mov dword [ebp - 0xc], 0x9c2f4f5f
sub edi, ebx
mov dword [edx], edi
xor dword [ebp - 0x3c], 0xb5cdc3d
add edx, 4
add esi, 0xe6b9bd4a
add esi, 0x194642ba
loop 0x40180c
add eax, 0xd5bdfef2
sub eax, 0xd5bcc497
mov ebx, eax
add eax, 0x8cd0004
sub eax, 0x8ccffff
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x100015d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10001628
cmp byte [esi + ebx - 1], 0xa
je 0x100015fc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10006084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10001b80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x10006094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x10001d40
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x10006094]
movzx eax, al
bt eax, esi
jae 0x10001da0
mov ecx, dword [0x10006084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x10001c45
test byte [0x10003128], 8
jne 0x10001ce0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10003138], 8
jne 0x10001c90
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10001c14
cmp esi, 3
jbe 0x10001c50
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x1000410c]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10001c14
mov ecx, dword [0x10006094]
test ecx, ecx
je 0x10001d80
mov dword [esp], 0x10003138
call dword [0x10006094]
test al, 8
je 0x10001beb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x10001beb
mov ebx, dword [0x10006094]
test ebx, ebx
je 0x10001d60
mov dword [esp], 0x10003128
call dword [0x10006094]
test al, 8
je 0x10001bd6
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x10001bde
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x10001b9d
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x10001cea
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x10001c9e
mov eax, 0xffffffff
jmp 0x10001c45
Function at 0x10001f20
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sym._InitTask16_4
mov edx, dword [ebp + 8]
sub esp, 4
movzx eax, word [edx + 0x94]
mov dword [esp], eax
call sym._K32WOWGlobalLock16_4
sub esp, 4
mov dword [esp], eax
call sym._MapSL_4
mov edi, eax
sub esp, 4
movzx ebx, byte [edi + 0x80]
mov dword [esp + 4], 0
lea esi, [edi + 0x81]
mov eax, dword fs:[0x18]
lea ecx, [ebx + 1]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp + 8]
sub esp, 0xc
cmp ebx, 4
jae 0x10001fd5
test ebx, ebx
jne 0x10001ffa
movzx ecx, word [edx + 0xa8]
mov byte [eax + ebx], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
movzx eax, word [edx + 0xa0]
mov dword [esp + 4], eax
movzx eax, word [edx + 0x9c]
mov dword [esp], eax
call dbg.WinMain16@16
sub esp, 0x10
movzx eax, ax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ExitThread]
mov ecx, dword [edi + 0x81]
lea edi, [eax + 4]
and edi, 0xfffffffc
mov dword [eax], ecx
mov ecx, dword [esi + ebx - 4]
mov dword [eax + ebx - 4], ecx
mov ecx, eax
sub ecx, edi
sub esi, ecx
add ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
jmp 0x10001f99
movzx ecx, byte [edi + 0x81]
mov byte [eax], cl
test bl, 2
je 0x10001f99
movzx ecx, word [esi + ebx - 2]
mov word [eax + ebx - 2], cx
jmp 0x10001f99
Function at 0x456a50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x51000]
push edi
jmp 0x456a6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x456a71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x456a60
mov eax, 1
add ebx, ebx
jne 0x456a83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x456a78
jne 0x456a94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x456a78
xor ecx, ecx
sub eax, 3
jb 0x456aa8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x456b1a
mov ebp, eax
add ebx, ebx
jne 0x456ab3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x456ac0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x456ae4
inc ecx
add ebx, ebx
jne 0x456ad0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x456ac5
jne 0x456ae1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x456ac5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x456b04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x456af5
jmp 0x456a66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x456b04
add edi, ecx
jmp 0x456a66
pop esi
mov edi, esi
mov ecx, 0x280
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x456b22
cmp byte [edi], 0
jne 0x456b22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x456b27
lea edi, [esi + 0x54000]
mov eax, dword [edi]
or eax, eax
je 0x456b9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x694bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x69574]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x456b54
mov ecx, edi
jns 0x456b83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6957c]
or eax, eax
je 0x456b99
mov dword [ebx], eax
add ebx, 4
jmp 0x456b71
call dword [esi + 0x69578]
mov ebp, dword [esi + 0x69580]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x456bd3
sub esp, 0xffffff80
jmp 0x403312
Function at 0x40260d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3528
call fcn.00403150
push esi
push edi
lea edi, [ebp - 0x3528]
mov ecx, 0xd4a
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 0x3528], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x3527]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x2508], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x2507]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x2404], 0
mov dword [ebp - 0x250c], 0
mov dword [ebp - 0x3114], 0
mov dword [ebp - 0x3118], 0
mov dword [ebp - 0x2510], 0
mov byte [ebp - 0x2400], 0
mov ecx, 0x8ff
xor eax, eax
lea edi, [ebp - 0x23ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x3110], 0
mov ecx, 0x2ff
xor eax, eax
lea edi, [ebp - 0x310f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x321c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x321b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x3320], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x331f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x3424], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x3423]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, esp
lea eax, [ebp - 0x3528]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp esi, esp
call fcn.00402b65
push 5
lea ecx, [ebp - 0x2508]
push ecx
jmp loc.0040c908
Function at 0x402a69
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x424010]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402afd
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402aba
cmp dword [ebp + 0x10], ebx
jne 0x402af1
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402acc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402aa1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.004060b1
cmp eax, ebx
je 0x402b04
push ebx
push dword [0x424010]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x424010], ebx
jne 0x402afa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402afa
jmp 0x402afd

Function at 0x402f4b
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f78
mov ecx, dword [0x423fb8]
push edi
add eax, ecx
push edi
push eax
mov dword [0x417104], eax
push dword [0x409018]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403076
cmp eax, edi
jl 0x40306f
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.kernel32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409018]
call ebx
test eax, eax
je 0x40306c
cmp dword [ebp - 4], esi
jne 0x40306c
push dword [ebp + 8]
add dword [0x417104], esi
call fcn.00403076
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x40306f
cmp dword [ebp + 0x10], edi
jne 0x40303b
cmp dword [ebp + 8], edi
jle 0x403067
mov esi, 0x413100
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402feb
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409018]
call ebx
test eax, eax
je 0x40306c
cmp edi, dword [ebp - 4]
jne 0x40306c
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x403037
cmp dword [ebp + 0x14], edi
jne 0x403037
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x417104], eax
cmp dword [ebp + 8], 0
jg 0x402fde
jmp 0x403067
push 0xfffffffffffffffe
jmp 0x40306e
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403046
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409018]
call ebx
test eax, eax
je 0x40306c
mov eax, dword [ebp - 4]
add dword [0x417104], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x40306f
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405646
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004058f5
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x40567a
push edi
call dword [sym.imp.kernel32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423fe8], eax
jmp 0x40580e
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405698
test eax, eax
je 0x4057b9
test byte [ebp + 0xc], 2
je 0x4057b9
mov esi, 0x421568
push edi
push esi
call fcn.00405d21
test ebx, ebx
je 0x4056b5
push 0x4093fc
push esi
call sub.kernel32.dll_lstrcatA
jmp 0x4056bb
push edi
call fcn.0040585b
cmp byte [edi], 0
jne 0x4056c9
cmp byte [0x421568], 0x5c
jne 0x4056d4
push 0x409010
push edi
call sub.kernel32.dll_lstrcatA
push edi
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4057af
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.0040583f
cmp byte [eax], 0
je 0x40571a
cmp byte [ebp - 0x18], 0
je 0x40571a
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405730
mov al, byte [esi + 1]
test al, al
je 0x40578e
cmp al, 0x2e
jne 0x405730
cmp byte [esi + 2], 0
je 0x40578e
push esi
push ebx
call fcn.00405d21
test byte [ebp - 0x148], 0x10
je 0x405755
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x40578e
push dword [ebp + 0xc]
push edi
call fcn.00401434
jmp 0x40578e
push edi
call fcn.004059d9
push edi
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x405786
test byte [ebp + 0xc], 4
je 0x40577e
push edi
push 0xfffffffffffffff1
call fcn.00401434
push 0
push edi
call fcn.00405a6f
jmp 0x40578e
inc dword [0x423fe8]
jmp 0x40578e
push edi
push 0xfffffffffffffff2
call fcn.00401434
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x4056f8
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4057b9
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x40580e
cmp dword [ebp - 8], esi
jne 0x4057ce
inc dword [0x423fe8]
jmp 0x40580e
push edi
call fcn.0040601c
test eax, eax
je 0x40580e
push edi
call fcn.00405814
push edi
call fcn.004059d9
push edi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405806
test byte [ebp + 0xc], 4
je 0x4057c6
push edi
push 0xfffffffffffffff1
call fcn.00401434
push esi
push edi
call fcn.00405a6f
jmp 0x40580e
push edi
push 0xffffffffffffffe5
call fcn.00401434
pop edi
pop esi
leave
ret 8
Function at 0x406120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422af4], 0
push esi
jne 0x406157
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406131
mov dword [ecx*4 + 0x422af0], eax
inc ecx
cmp ecx, 0x100
jl 0x40612c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406188
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422af0]
xor eax, esi
inc ecx
dec edx
jne 0x40616a
pop edi
not eax
pop esi
ret 0xc

Function at 0x427ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1b000]
push edi
jmp 0x427aca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x427ad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x427ac0
mov eax, 1
add ebx, ebx
jne 0x427ae3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x427ad8
jne 0x427af4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427ad8
xor ecx, ecx
sub eax, 3
jb 0x427b08
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x427b7a
mov ebp, eax
add ebx, ebx
jne 0x427b13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x427b20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x427b44
inc ecx
add ebx, ebx
jne 0x427b30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x427b25
jne 0x427b41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427b25
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x427b64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x427b55
jmp 0x427ac6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x427b64
add edi, ecx
jmp 0x427ac6
pop esi
mov edi, esi
mov ecx, 0xa01
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x427b82
cmp byte [edi], 6
jne 0x427b82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x427b87
lea edi, [esi + 0x25000]
mov eax, dword [edi]
or eax, eax
je 0x427bf6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2b708]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2b788]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x427bb4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2b790]
or eax, eax
je 0x427bf0
mov dword [ebx], eax
add ebx, 4
jmp 0x427bd1
call dword [esi + 0x2b78c]
mov ebp, dword [esi + 0x2b794]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x427c2a
sub esp, 0xffffff80
jmp 0x414b28
Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [eax]
push edi
lea edi, [edx + 0x44]
mov dword [ebp - 4], 0x10
lea ecx, [ecx]
xor ecx, dword [edi]
sub edi, 4
movzx eax, cl
mov dword [ebp - 0xc], eax
mov eax, ecx
shr eax, 8
movzx ebx, al
shr eax, 8
mov dword [ebp - 8], ebx
mov ebx, ecx
mov ecx, eax
shr ecx, 8
and ecx, 0xff
mov ecx, dword [edx + ecx*4 + 0x48]
movzx eax, al
add ecx, dword [edx + eax*4 + 0x448]
movzx eax, word [ebp - 8]
xor ecx, dword [edx + eax*4 + 0x848]
movzx eax, word [ebp - 0xc]
add ecx, dword [edx + eax*4 + 0xc48]
xor ecx, esi
dec dword [ebp - 4]
mov esi, ebx
jne 0x10001020
mov eax, dword [edx]
mov esi, dword [ebp + 8]
mov edx, dword [edx + 4]
xor eax, ebx
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
pop edi
xor edx, ecx
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100010f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [eax]
push edi
mov edi, edx
mov dword [ebp - 4], 0x10
lea esp, [esp]
xor ecx, dword [edi]
add edi, 4
movzx eax, cl
mov dword [ebp - 0xc], eax
mov eax, ecx
shr eax, 8
movzx ebx, al
shr eax, 8
mov dword [ebp - 8], ebx
mov ebx, ecx
mov ecx, eax
shr ecx, 8
and ecx, 0xff
mov ecx, dword [edx + ecx*4 + 0x48]
movzx eax, al
add ecx, dword [edx + eax*4 + 0x448]
movzx eax, word [ebp - 8]
xor ecx, dword [edx + eax*4 + 0x848]
movzx eax, word [ebp - 0xc]
add ecx, dword [edx + eax*4 + 0xc48]
xor ecx, esi
dec dword [ebp - 4]
mov esi, ebx
jne 0x10001110
mov eax, dword [edx + 0x44]
mov esi, dword [ebp + 8]
mov edx, dword [edx + 0x40]
xor eax, ebx
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
pop edi
xor edx, ecx
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret