joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463244
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x15c
xor ebx, ebx
mov edx, dword [esp + 0x174]
mov eax, dword [edx + ebx*4]
mov dword [esp + ebx*4 + 0x1c], eax
inc ebx
cmp ebx, 0xf
jle 0x463257
mov ebx, 0x10
mov eax, dword [esp + ebx*4 - 4]
xor eax, dword [esp + ebx*4 + 0x10]
xor eax, dword [esp + ebx*4 - 0x1c]
xor eax, dword [esp + ebx*4 - 0x24]
rol eax, 1
mov dword [esp + ebx*4 + 0x1c], eax
inc ebx
cmp ebx, 0x4f
jle 0x463269
mov eax, dword [esp + 0x170]
xor ebx, ebx
mov edx, dword [esp + 0x170]
mov eax, dword [eax]
mov esi, dword [edx + 4]
mov edi, dword [edx + 8]
mov dword [esp + 0x10], eax
mov ebp, dword [edx + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp + 0x14], eax
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov edx, esi
mov ecx, esi
not edx
and ecx, edi
and edx, ebp
rol eax, 5
or ecx, edx
add eax, ecx
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add eax, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
add eax, 0x5a827999
cmp ebx, 0x13
mov dword [esp + 0x18], eax
jle 0x4632be
mov ebx, 0x14
mov edx, dword [esp + 0x18]
mov eax, esi
xor eax, edi
xor eax, ebp
rol edx, 5
add edx, eax
add edx, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add edx, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
add edx, 0x6ed9eba1
cmp ebx, 0x27
mov dword [esp + 0x18], edx
jle 0x4632fe
mov ebx, 0x28
mov eax, dword [esp + 0x18]
mov edx, edi
mov ecx, edi
or edx, ebp
and ecx, ebp
and edx, esi
rol eax, 5
or edx, ecx
add eax, edx
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add eax, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
sub eax, 0x70e44324
cmp ebx, 0x3b
mov dword [esp + 0x18], eax
jle 0x463339
mov ebx, 0x3c
mov eax, dword [esp + 0x18]
mov edx, esi
xor edx, edi
xor edx, ebp
rol eax, 5
add eax, edx
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add eax, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
sub eax, 0x359d3e2a
cmp ebx, 0x4f
mov dword [esp + 0x18], eax
jle 0x463379
add eax, dword [esp + 0x10]
mov edx, dword [esp + 0x170]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
add eax, esi
mov dword [edx + 4], eax
mov eax, dword [esp + 8]
add eax, edi
mov dword [edx + 8], eax
mov eax, dword [esp + 4]
add eax, ebp
mov dword [edx + 0xc], eax
mov eax, dword [esp]
add eax, dword [esp + 0x14]
mov dword [edx + 0x10], eax
add esp, 0x15c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4d2cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
push edx
mov ebp, dword [esp + 0x18]
lea esi, [ebp + 2]
movzx eax, byte [ebp]
mov byte [esp + 3], al
movzx edx, byte [ebp + 1]
mov byte [esp + 2], dl
cmp edi, dword [esp + 0x20]
jge 0x4d2d28
inc byte [esp + 3]
movzx ecx, byte [esp + 3]
movzx edx, byte [esi + ecx]
add byte [esp + 2], dl
movzx ebx, byte [esp + 2]
movzx eax, byte [esi + ebx]
mov byte [esi + ecx], al
mov byte [esi + ebx], dl
add dl, byte [esi + ecx]
movzx eax, dl
mov edx, dword [esp + 0x1c]
movzx eax, byte [esi + eax]
xor byte [edx + edi], al
inc edi
jmp 0x4d2cee
movzx eax, byte [esp + 3]
mov byte [ebp], al
movzx edx, byte [esp + 2]
mov byte [ebp + 1], dl
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4031cc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004046c0
test esi, esi
jne 0x403202
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004047b0
jmp 0x403220
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403070
mov edi, eax
test esi, esi
je 0x403220
cmp dword [ebx], 0
je 0x403220
dec esi
jmp 0x403209
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x426020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4038b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403898
xor eax, eax
push ebp
push 0x403891
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4038d4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403898
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x426020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x426020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404540
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x428044], 0
je 0x4045a1
cmp word [0x428218], 0xd7b2
jne 0x404569
cmp dword [0x428220], 0
jbe 0x404569
mov eax, 0x428214
call dword [0x428230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4045c8
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x42602c], 0
jne 0x4045bd
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405988
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405bb8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405a0b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405bb8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405a0b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405bd4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405a94
xor eax, eax
push ebp
push 0x405a8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004057c4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405a72
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405bf4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405a72
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a94
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405bae
cmp byte [ebp - 0xd], 0
jne 0x405adb
cmp byte [ebp - 0x12], 0
je 0x405bae
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405af4
dec ebx
cmp byte [ebx], 0x2e
je 0x405b03
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405af3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405bae
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405b40
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405bae
cmp byte [ebp - 0xd], 0
je 0x405bae
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405bae
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40768c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4076de
test eax, edx
je 0x4076e1
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x4076a1
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4076c7
add ecx, 4
js 0x4076b7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4076c4
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x4076ed
test edx, edx
jne 0x407694
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x407dd4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404b50
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x407ded
test al, 0x10
je 0x407df1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x407df8
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404b50
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
pop ebx
ret

Function at 0x407e0c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404b50
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
jne 0x407e2e
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40a89c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x40a8d5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004047b0
jmp 0x40a8de
mov eax, ebx
mov edx, esi
call fcn.00404714
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a8e8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x40a90a
movzx eax, byte [esp]
jmp 0x40a90c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40af9c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ae14
mov eax, dword [0x42714c]
cmp byte [eax], 0
je 0x40b018
mov eax, dword [0x427068]
call fcn.0040329c
call fcn.00402edc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408040
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b060
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
jmp 0x40b04e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x427040]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x42a7f0]
call fcn.0040576c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x413d0c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x413d72
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404930
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403428
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x413d5c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413d79
lea eax, [ebp - 0x10]
call fcn.004046c0
ret
Function at 0x41493c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4149b3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [esi]
call fcn.004148b0
mov ebx, dword [esi]
mov eax, dword [ebp - 4]
call fcn.00404b50
push eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
call fcn.00404b50
push eax
call sub.KERNEL32.DLL_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [ebp - 4]
call fcn.00407dd4
mov ebx, eax
test bl, bl
je 0x41499d
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4149ba
lea eax, [ebp - 4]
call fcn.004046c0
ret

Function at 0x414c94
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b40
xor eax, eax
push ebp
push 0x414dfd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x18], 0xffffffff
xor eax, eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 5], 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
je 0x414ddf
mov eax, 0x7d1
call fcn.00402d9c
mov ebx, eax
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.0040338c
mov dword [ebp - 0x64], 0x44
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 0x101
mov word [ebp - 0x34], 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b50
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x414db4
push 0x64
mov eax, dword [ebp - 0x74]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
je 0x414d55
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x7d0
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_ReadFile
test esi, esi
je 0x414da7
mov eax, dword [ebp - 0x14]
mov byte [ebx + eax], 0
push ebx
push ebx
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x78]
mov edx, ebx
call fcn.004048b8
mov edx, dword [ebp - 0x78]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp dword [ebp - 0x14], 0x7d0
jae 0x414d67
mov byte [ebp - 5], 1
mov eax, ebx
call fcn.00402dd0
mov eax, dword [ebp - 0x74]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414e04
lea eax, [ebp - 0x78]
call fcn.004046c0
lea eax, [ebp - 4]
call fcn.004046c0
ret
Function at 0x417114
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x41711c
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4172e1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4172af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 4
mov edx, ebx
call fcn.00404714
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00404b50
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], ebx
cmp ebx, 0xffffffff
jne 0x4171c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x18]
mov eax, 0x416af0
call fcn.0040620c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x416af8
call fcn.0040620c
mov eax, dword [ebp - 0x1c]
mov ecx, 1
pop edx
call fcn.00416aac
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], ebx
push 0
push ebx
push 0
push 4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], esi
test esi, esi
jne 0x417242
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x20]
mov eax, 0x416ad8
call fcn.0040620c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x416af8
call fcn.0040620c
mov eax, dword [ebp - 0x24]
mov ecx, 1
pop edx
call fcn.00416aac
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], ebx
test ebx, ebx
jne 0x4172a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x28]
mov eax, 0x416ae0
call fcn.0040620c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x2c]
mov eax, 0x416af8
call fcn.0040620c
mov eax, dword [ebp - 0x2c]
mov ecx, 1
pop edx
call fcn.00416aac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4172c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4172e8
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.004046e4
ret
Function at 0x417470
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 9], cl
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x417595
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.00414a18
mov byte [ebp - 0xa], al
cmp byte [ebp - 0xa], 0
jne 0x41757f
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404758
mov eax, esi
call fcn.00407dd4
mov ebx, eax
movzx eax, byte [ebp - 9]
and al, bl
mov byte [ebp - 9], al
test bl, bl
je 0x4174e8
mov eax, esi
call fcn.00407df8
mov edi, eax
test edi, 1
je 0x4174e8
mov edx, edi
dec edx
mov eax, esi
call fcn.00407e0c
cmp byte [ebp - 9], 0
je 0x4174fe
lea eax, [ebp - 4]
call fcn.0041493c
test al, al
je 0x41757f
mov eax, esi
call fcn.00404b50
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, esi
call fcn.00407dd4
test al, al
jne 0x41754c
mov eax, esi
call fcn.00404b50
push eax
mov eax, dword [ebp - 8]
call fcn.00404b50
push eax
call sub.KERNEL32.DLL_MoveFileA
mov eax, esi
call fcn.00407dd4
test al, al
je 0x417543
mov eax, dword [ebp - 8]
call fcn.00407dd4
test al, al
je 0x417547
xor eax, eax
jmp 0x417549
mov al, 1
mov byte [ebp - 0xa], al
test bl, bl
je 0x417564
mov eax, esi
call fcn.00407dd4
test al, al
je 0x417564
mov edx, edi
mov eax, esi
call fcn.00407e0c
test byte [ebp - 9], bl
je 0x41757f
mov eax, dword [ebp - 4]
call fcn.00407dd4
test al, al
je 0x41757f
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00407e0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41759c
lea eax, [ebp - 4]
call fcn.004046c0
ret
Function at 0x41b688
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
xor ebx, ebx
push ebp
push 0x41b7d4
push dword fs:[ebx]
mov dword fs:[ebx], esp
cmp ecx, 0x40
ja 0x41b6c8
push ebp
lea edx, [ebp - 4]
mov eax, 0x41b4b8
call fcn.0040620c
mov eax, dword [ebp - 4]
call fcn.0041b60c
pop ecx
jmp 0x41b7b9
mov esi, eax
mov ebx, dword [eax + 0x3c]
add esi, ebx
mov dword [edx], esi
cmp word [eax], 0x5a4d
je 0x41b6f4
push ebp
lea edx, [ebp - 8]
mov eax, 0x41b4d8
call fcn.0040620c
mov eax, dword [ebp - 8]
call fcn.0041b60c
pop ecx
jmp 0x41b7b9
add ebx, 0xf8
cmp ecx, ebx
ja 0x41b71a
push ebp
lea edx, [ebp - 0xc]
mov eax, 0x41b4c0
call fcn.0040620c
mov eax, dword [ebp - 0xc]
call fcn.0041b60c
pop ecx
jmp 0x41b7b9
mov ebx, dword [edx]
cmp dword [ebx], 0x4550
je 0x41b768
mov eax, dword [edx]
mov eax, dword [eax]
cmp eax, 0x454e
je 0x41b736
cmp eax, 0x454c
jne 0x41b74f
push ebp
lea edx, [ebp - 0x10]
mov eax, 0x41b4c8
call fcn.0040620c
mov eax, dword [ebp - 0x10]
call fcn.0041b60c
pop ecx
jmp 0x41b7b9
push ebp
lea edx, [ebp - 0x14]
mov eax, 0x41b4c0
call fcn.0040620c
mov eax, dword [ebp - 0x14]
call fcn.0041b60c
pop ecx
jmp 0x41b7b9
mov ebx, dword [edx]
movzx esi, word [ebx + 0x18]
cmp si, 0x10b
je 0x41b77c
cmp si, 0x20b
jne 0x41b7a2
mov eax, dword [eax + 0x3c]
add eax, 0xf8
mov ebx, dword [edx]
movzx ebx, word [ebx + 6]
add ebx, ebx
add ebx, ebx
add ebx, ebx
lea ebx, [ebx + ebx*4]
add eax, ebx
cmp ecx, eax
jb 0x41b7a2
mov eax, dword [edx]
cmp word [eax + 6], 0
jne 0x41b7b9
push ebp
lea edx, [ebp - 0x18]
mov eax, 0x41b4d0
call fcn.0040620c
mov eax, dword [ebp - 0x18]
call fcn.0041b60c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b7db
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004046e4
ret

Function at 0x41c958
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov ebp, 0x8a11
mov eax, esi
call fcn.0041c7b4
mov edi, eax
test edi, edi
jl 0x41c9b5
mov edx, edi
mov eax, esi
call fcn.0041c7ec
mov ebx, eax
test ebx, ebx
je 0x41c9b5
mov edx, edi
mov eax, esi
call fcn.0041c6e4
mov eax, dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jns 0x41c994
add ecx, 3
sar ecx, 2
test ecx, ecx
jle 0x41c9b5
mov esi, 1
mov eax, esi
mov edi, 3
cdq
idiv edi
xor eax, dword [ebx]
add ebp, eax
add ebx, 4
inc esi
dec ecx
jne 0x41c9a0
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, reloc.comdlg32.dll_CommDlgExtendedError
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x406d38
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x406d54
shr eax, 1
xor eax, 0xedb88320
jmp 0x406d56
shr eax, 1
dec edx
jne 0x406d47
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x406d40
pop esi
ret

Function at 0x406d83
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x406d8f
call fcn.00406d38
push 1
push 0x40c558
call fcn.004038a4
mov eax, edi
test esi, esi
je 0x406dba
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x406d95
mov eax, ebx
pop edi
pop esi
pop ebx
ret