joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405550
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x40556c
mov eax, dword [ebp - 4]
jmp 0x405647
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x405622
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov edi, edi
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x417a50]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x417a50]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x417a50]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x417a50]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x417a50]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x417a50]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x417a50]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x417a50]
dec ebp
jne 0x40558c
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x40563e
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x417a50]
dec ecx
jne 0x40562c
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405650
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov edx, 0x400
cmp eax, edx
jae 0x40565f
mov edx, eax
xor eax, eax
test edx, edx
jbe 0x40567b
mov ecx, dword [esp + 4]
lea esp, [esp]
xor byte [eax + ecx], 8
add eax, 1
cmp eax, edx
jb 0x405670
mov eax, 1
ret
Function at 0x405ef0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
sub esp, 0x114
mov eax, dword [0x41c060]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x120]
push esi
add eax, 0xfffffffb
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
test esi, esi
mov dword [esp + 8], esi
je 0x406037
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405f32
sub eax, edx
cmp byte [eax + ebx - 1], 0x5c
push edi
je 0x405f64
mov edi, ebx
add edi, 0xffffffff
lea ebx, [ebx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x405f50
mov cx, word [0x417710]
mov word [edi], cx
mov eax, ebx
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x405f70
mov edx, dword [str.Temp_]
mov dword [eax], edx
mov cx, word [0x417e84]
push ebx
mov word [eax + 4], cx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406034
push 0x104
lea edx, [esp + 0x19]
push 0
push edx
mov byte [esp + 0x20], 0
call fcn.004075f0
mov eax, ebx
add esp, 0xc
xor edi, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405fc0
sub eax, edx
je 0x406034
push ebp
lea ebp, [esp + 0x18]
mov esi, ebx
sub ebp, ebx
cmp byte [esi], 0x5c
jne 0x405ff8
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405ff8
push 0
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dl, byte [esi]
mov byte [esi + ebp], dl
mov eax, ebx
add edi, 1
add esi, 1
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x406008
sub eax, edx
cmp edi, eax
jb 0x405fd6
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.004075d4
add esp, 0x114
ret
mov eax, esi
pop edi
mov ecx, dword [esp + 0x118]
pop esi
pop ebx
xor ecx, esp
call fcn.004075d4
add esp, 0x114
ret
Function at 0x40719a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x41c060]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004070d9
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004075f0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4071e9
cmp dword [ebp - 0x1c], 5
jb 0x407201
jmp 0x4071fd
cmp dword [ebp - 0x10], 1
jne 0x407201
cmp dword [ebp - 0x1c], 4
ja 0x4071fd
jne 0x407201
cmp dword [ebp - 0x18], 0
jbe 0x407201
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x418224
call fcn.00406f6f
test eax, eax
jge 0x407222
mov byte [0x41d65c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004075d4
add ebp, 0x78
leave
ret

Function at 0x4075d4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c060]
jne 0x4075de
repz ret
jmp fcn.00409b48
Function at 0x40f7a3
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x41cd38]
je 0x40f7be
inc edi
cmp edi, 0x17
jb 0x40f7af
cmp edi, 0x17
jae 0x40f93e
push ebp
push 3
call fcn.004129a6
cmp eax, 1
pop ecx
je 0x40f90a
push 3
call fcn.004129a6
test eax, eax
pop ecx
jne 0x40f7f2
cmp dword [0x41c0b0], 1
je 0x40f90a
cmp ebx, 0xfc
je 0x40f93d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x41dc48
push ebp
call fcn.004084e2
add esp, 0xc
test eax, eax
je 0x40f828
push esi
push esi
push esi
push esi
push esi
call fcn.0040a091
add esp, 0x14
push 0x104
mov esi, 0x41dc61
push esi
push 0
mov byte [0x41dd65], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40f86c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004084e2
add esp, 0xc
test eax, eax
je 0x40f86c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040a091
add esp, 0x14
push esi
call fcn.0040c0e0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40f8b1
push esi
call fcn.0040c0e0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x41df5c
push 0x418a8c
sub ecx, eax
push ecx
push eax
call fcn.00411c06
add esp, 0x14
test eax, eax
je 0x40f8b1
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0040a091
add esp, 0x14
jmp 0x40f8b3
xor esi, esi
push 0x418a88
push ebx
push ebp
call fcn.00408547
add esp, 0xc
test eax, eax
je 0x40f8d3
push esi
push esi
push esi
push esi
push esi
call fcn.0040a091
add esp, 0x14
push dword [edi*8 + 0x41cd3c]
push ebx
push ebp
call fcn.00408547
add esp, 0xc
test eax, eax
je 0x40f8f5
push esi
push esi
push esi
push esi
push esi
call fcn.0040a091
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004127e9
add esp, 0xc
jmp 0x40f93d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40f93d
cmp ebp, 0xffffffff
je 0x40f93d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x41cd3c]
push dword [esi]
call fcn.0040c0e0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4127e9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040af97
xor ebx, ebx
cmp dword [0x41e0e4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4128bf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41299f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x419b94
push edi
call esi
cmp eax, ebx
je 0x41299f
push eax
call fcn.0040af29
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41e0e4], eax
call esi
push eax
call fcn.0040af29
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41e0e8], eax
call esi
push eax
call fcn.0040af29
mov dword [0x41e0ec], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040f530
test eax, eax
pop ecx
pop ecx
je 0x41288d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040a091
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4128bf
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040af29
cmp eax, ebx
pop ecx
mov dword [0x41e0f4], eax
je 0x4128bf
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040af29
pop ecx
mov dword [0x41e0f0], eax
mov eax, dword [0x41e0f0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x412944
cmp dword [0x41e0f4], ecx
je 0x412944
push eax
call fcn.0040afa0
push dword [0x41e0f4]
mov esi, eax
call fcn.0040afa0
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x412944
cmp edi, ebx
je 0x412944
call esi
cmp eax, ebx
je 0x412911
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x412911
test byte [ebp - 0x18], 1
jne 0x412944
lea eax, [ebp - 0x10]
push eax
call fcn.0040f567
test eax, eax
pop ecx
je 0x41292c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040a091
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x41293b
or dword [ebp + 0x10], 0x200000
jmp 0x41297f
or dword [ebp + 0x10], 0x40000
jmp 0x41297f
mov eax, dword [0x41e0e8]
cmp eax, dword [ebp - 8]
je 0x41297f
push eax
call fcn.0040afa0
cmp eax, ebx
pop ecx
je 0x41297f
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41297f
mov eax, dword [0x41e0ec]
cmp eax, dword [ebp - 8]
je 0x41297f
push eax
call fcn.0040afa0
cmp eax, ebx
pop ecx
je 0x41297f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41e0e4]
call fcn.0040afa0
cmp eax, ebx
pop ecx
je 0x41299f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4129a1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406810
Capabilities:
Connect socket

Disassembly:
dec eax
mov eax, dword [0x1e518b0e]
mov dword [edx], ebx
mov eax, dword [esi]
add al, byte [eax + 0x34]
add dword [eax], eax
add byte [eax], al
mov edi, dword [0x5148c183]
call 0xc5406010
inc ecx
pop esi
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x1d406682
push esi
mov eax, dword [esi]
fucompi st(0)
sbb edi, dword [ebx + esi*2]
jnp 0x40687c
call fcn.004049e0
add esp, 4
pop esi
imul esi, dword [edx], 0x90900004
nop
nop
nop
nop
std
xchg edi, eax
sbb byte [eax + 0x55909004], dl
mov ebp, esp
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx - 0x80]
test eax, 0x840ffff8
mov ah, 1
add byte [eax], al
mov ecx, dword [ebx + 0x10]
lahf
jp 0x406870
jne 0x4067ec
add dword [eax], eax
add byte [ebx + 0x4e8b1b75], cl
dec esp
lea edx, [esi + 0x28]
push ecx
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x1f4069b8
test dword [edi], esi
add dword [eax], eax
pop ds
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
call esi
test eax, eax
je 0xf3698a
call esi
clc
sbb byte [ebp + 0xa], 0
cmp eax, 0xb2336
jne 0x4069f4
mov edi, dword [ebx + 0x20]
xor dword [ebx + 0x24], esi
dec eax
xbegin 0x5f4ede76
pop esi
mov eax, 0xb23b4
pop ebx
mov esp, ebp
pop ebp
ret 8
pop ds
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1f08

Function at 0x40a352
Capabilities:
Encode data using xor

Disassembly:
add byte [esi + 0x5d], bl
stosd dword es:[edi], eax
add al, 0
nop
nop
push eax
nop
nop
nop
nop
nop
nop
cld
nop
nop
call dword [esi]
arpl ax, ax
inc eax
add byte [ebx], dh
rcr byte [esi + 0x5d], 7
pop dword [eax]
or edx, 1
jne 0x40a370
sbb dword [ecx + 8], eax
push eax
unpckhps xmm6, xmmword [eax]
rol byte [eax], 0xa9
mov byte [ebx - 0x1c8afd84], 0x8b
dec ecx
or dl, dh
call dword [0xde40c066]
cmp dword [edx + eax + 0x75], 0xffffffe3
mov ecx, dword [ecx + 8]
bnd call dword [0xde40c066]
test eax, eax
xor al, 0xd5
jp 0x40a3ba
cwde
shl bh, 0x9d
call esi
test eax, eax
mov cl, 0xf8
push edi
add eax, 0xe7fc80
pop esi
pop ebp
xchg esp, eax
add al, 0xe4
loope 0x40a32d
aad 0x90
sub cl, byte [eax + 0x458bec8b]
or byte [eax - 0x4a], ch
sbb al, 0x40
add byte [0xe8d0daa0], ch
or al, 0xa8
invalid
nop
xor al, 0x4c
nop
nop
mov byte [0xc7f8c09c], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
sub dl, byte [eax - 0x1374aa70]
adc dword [ebp + 8], eax
mov esp, 0xc085f040
sti
xor esi, eax
dec ebp
or al, 0x51
aam 0xff
adc eax, sym.imp.KERNEL32.dll_TerminateProcess
push ds
sal byte [ebp + 0x1e], 0x56
mov esi, dword [0x40c08b]
jnp 0x40a3cb
test eax, eax
jne 0x40a3fe
pop esi
dec ebx
ret 0xbd08
call esi
mov word [edx + 9], fs
or al, byte [eax]
pop esi
mov esp, 0x330008c2
rcr byte [ebp - 0x12], 8
add byte [eax + 0x7996], bh
pop ebp
ret 0xbb
Function at 0x29ccab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1700000]
push edi
or ebp, 0xffffffff
jmp 0x29ccad2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x29ccad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x29ccac8
mov eax, 1
add ebx, ebx
jne 0x29ccaeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x29ccafc
jne 0x29ccb1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x29ccb1b
dec eax
add ebx, ebx
jne 0x29ccb08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x29ccae0
add ebx, ebx
jne 0x29ccb17
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x29ccb6d
xor ecx, ecx
sub eax, 3
jb 0x29ccb33
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x29ccba2
sar eax, 1
mov ebp, eax
jmp 0x29ccb3e
add ebx, ebx
jne 0x29ccb3e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x29ccb0c
inc ecx
add ebx, ebx
jne 0x29ccb4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x29ccb0c
add ebx, ebx
jne 0x29ccb59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x29ccb4e
jne 0x29ccb6a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x29ccb4e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x29ccb8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x29ccb7e
jmp 0x29ccace
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x29ccb8c
add edi, ecx
jmp 0x29ccace
pop esi
mov edi, esi
mov ecx, 0xfbc9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x29ccbaa
cmp byte [edi], 0x27
jne 0x29ccbaa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x29ccbaf
lea edi, [esi + 0x25c8000]
mov eax, dword [edi]
or eax, eax
je 0x29ccc27
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x25ce10c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x25ce274]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x29ccbdc
mov ecx, edi
jns 0x29ccc0b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x25ce278]
or eax, eax
je 0x29ccc21
mov dword [ebx], eax
add ebx, 4
jmp 0x29ccbf9
call dword [esi + 0x25ce288]
mov ebp, dword [esi + 0x25ce27c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x29ccc5b
sub esp, 0xffffff80
jmp 0x5f2723
Function at 0x405e10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x80c9eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4040ec
call fcn.00406a71
push 4
mov dword [esp + 0x18], 0
call fcn.004079dd
mov edi, eax
add esp, 4
test edi, edi
je 0x405e84
push ebx
call fcn.00406949
mov dword [edi], eax
call fcn.00406708
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406a32
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405e78
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406a5a
pop ebx
jmp 0x405e86
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408451
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x810790]
jne 0x40845b
repz ret
jmp fcn.0040c89c
Function at 0x4116f2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x810790]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ae55
and dword [ebp - 0x14], 0
cmp dword [0x815650], 0
mov dword [ebp - 0x18], eax
jne 0x4117a5
push 0x40379c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41184d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403790
push ebx
call edi
test eax, eax
je 0x41184d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403780
push ebx
mov dword [0x815650], eax
call edi
push eax
call esi
push 0x40376c
push ebx
mov dword [0x815654], eax
call edi
push eax
call esi
push 0x403750
push ebx
mov dword [0x815658], eax
call edi
push eax
call esi
mov dword [0x815660], eax
test eax, eax
je 0x4117a5
push 0x403738
push ebx
call edi
push eax
call esi
mov dword [0x81565c], eax
mov eax, dword [0x81565c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4117fe
cmp dword [0x815660], ecx
je 0x4117fe
push eax
call esi
push dword [0x815660]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4117fe
test ebx, ebx
je 0x4117fe
call edi
test eax, eax
je 0x4117f5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4117f5
test byte [ebp - 8], 1
jne 0x4117fe
or dword [ebp + 0x10], 0x200000
jmp 0x411831
mov eax, dword [0x815654]
cmp eax, dword [ebp - 0x18]
je 0x411831
push eax
call esi
test eax, eax
je 0x411831
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411831
mov eax, dword [0x815658]
cmp eax, dword [ebp - 0x18]
je 0x411831
push eax
call esi
test eax, eax
je 0x411831
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x815650]
call esi
test eax, eax
je 0x41184d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41184f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408451
leave
ret
Function at 0x80a8a0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.004120f0
cmp dword [0xb993e4], 0x37
jne 0x80a93a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0xb9a3d8]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x81a434]
mov byte [ecx + esi], al
add esp, 0x100c
ret
Function at 0x80abd0
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0xb993e4]
sub esp, 0xa8c
push ebx
push ebp
push esi
mov esi, dword [0x81a434]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x80ade6
mov dword [esp + 0x30], 0x9e3779b9
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
jmp 0x80ac16
mov esi, dword [esp + 0x24]
xor edi, edi
cmp dword [0xb993e4], 0x1c
jne 0x80ac2d
lea eax, [esp + 0x40]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x8112d0]
mov ebx, dword [0x8112d8]
mov ebp, dword [0x8112dc]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x8112d4]
mov dword [esp + 0x1c], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], 0x20
jmp 0x80ac76
mov eax, dword [esp + 0x1c]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x20], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0xb99354], edi
mov eax, dword [esp + 0x20]
add dword [0xb99354], eax
mov eax, dword [0xb99354]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x3c]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x38]
add dword [esp + 0x10], eax
cmp dword [0xb993e4], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x80ad0d
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x34]
cmp dword [0xb993e4], 0x979
mov dword [0xb99358], 0xff6b3619
mov dword [0xb9935c], 0xffffffff
mov dword [esp + 0x20], eax
jne 0x80ad57
push 0
lea ecx, [esp + 0x29c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
lea edx, [esp + 0x48]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x30]
add dword [esp + 0x18], eax
sub esi, dword [esp + 0x18]
dec dword [esp + 0x2c]
jne 0x80ac70
cmp dword [0xb993e4], 0x8d4
jne 0x80ad9b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp dword [0xb993e4], 0x17
jne 0x80add5
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea edx, [esp + 0x48]
push edx
push 0x403f40
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esi, 8
dec dword [esp + 0x28]
mov dword [esp + 0x24], esi
jne 0x80ac10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8c
ret
Function at 0x405939
Capabilities:
Packed with generic packer

Disassembly:
call dword [0x40723c]
add esi, eax
mov word [ecx - 0x374fb714], 0x42
insb byte es:[edi], dx
insb byte es:[edi], dx
popal
jae 0x4059c3
sub edi, edi
jmp [edx]
push 0
or byte [eax], al
je 0x4059d4
push 0x4092fc
push esi
call 0x52b3604e
jae 0x405a26
jae 0x405a28
push edx
jae 0x405a2a
jae 0x405a2c
jae 0x405a2e
jae 0x405a30
jae 0x405a32
jae 0x4059e2
push ebp
dec esp
add byte [eax], al
add byte [eax], al
add byte [eax], ch
add byte [eax], al
add byte [eax], al
jae fcn.004059fd
add byte [eax], al
je 0x405a66
popal
arpl word [ebp + 0x62], sp
popal
add byte [ebp - 0x7af28a40], al
or eax, 0xd075ff85
and byte [esi], 0
pop edi
pop esi
clc
push dword [edi + ebp*2 + 0x52]
or dword [ecx], ecx
or dword [ecx], ecx
inc eax
jno 0x405a53
add byte [eax], al
jae 0x405a27
add byte [eax], al
add byte [eax], al
or eax, dword [ecx]
or al, 0
insb byte es:[edi], dx
add byte [eax], al
jmp [edx]
add dword [ebx], edx
adc eax, dword [ecx]
invalid
invalid
add dword [edi], ecx
invalid