joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d920fc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x6da1db80]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x6d91f76b
je 0x6d91f7be
cmp ebx, 0x20
jbe 0x6d91f7c4
cmp ebx, 0x40
jbe 0x6d91f80a
jmp 0x6d91f8ab
test ebx, ebx
je 0x6d91f7b4
add eax, 0x10
test ax, 0xff0
je 0x6d91f7a0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x6d97ef20]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x6d97f020]
jmp 0x6d91f788
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x6d91f788
pxor xmm1, xmmword [0x6da1db90]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6da1db90]
pxor xmm2, xmmword [0x6da1dba0]
pxor xmm3, xmmword [0x6da1dbb0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6da1db90]
pxor xmm2, xmmword [0x6da1dba0]
pxor xmm3, xmmword [0x6da1dbb0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x6d91f90a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x6da1d867], 0
je 0x6d920fda
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x6d91f730
jmp fcn.6d8c92e0
Function at 0x6d92ccc0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x6da1d974]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d92cd66
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x6d92cd19
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x6d92cd50
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.6d91fd10
jmp fcn.6d92ccc0
Function at 0x6d9388b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x6da1d974]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d938a9a
sub esp, 0x48
mov eax, dword [0x6d948ce8]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.6d935590
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.6d9217fe
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.6d9217fe
call fcn.6d934d80
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.6d91c380
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x6d938987
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x6d9389a1
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x6d938a18
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x6d9389ee
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x6d9389ea
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x6d9389e3
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x6d9389f0
mov ebx, 0x1d
jmp 0x6d938a0e
mov ebp, eax
jmp 0x6d9389f0
mov ebp, eax
cmp ebp, 0xd
jae 0x6d938a8d
lea eax, [ebp - 1]
lea edx, [0x6d9464e0]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x6d938a83
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x6d938a18
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x6d938a4a
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x6d938a52
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call fcn.6d9211a0
mov eax, ebp
mov ecx, 0xd
call fcn.6d9211a0
nop
call fcn.6d91fd10
jmp fcn.6d9388b0
Function at 0x6d942490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x6da1d974]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d942624
sub esp, 0x7c
mov eax, 0
mov dword [esp + 0x78], eax
mov byte [esp + 0x4d], 0
lea eax, [0x6d96102b]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.6d942b40
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6d9424de
jne 0x6d942607
jmp 0x6d94260a
mov eax, dword [esp + 8]
mov dword [esp + 0x6c], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x58], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x4e], 0x42703249
mov dword [esp + 0x50], 0x39584270
mov dword [esp + 0x54], 0x6839686c
lea ebx, [esp + 0x4e]
mov dword [esp], ebx
mov dword [esp + 4], 0xa
mov dword [esp + 8], 0xa
call fcn.6d92d210
lea edi, [esp + 0x2d]
lea esi, [esp + 0xc]
call fcn.6d9217e0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], eax
lea eax, [esp + 0x2d]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x20
call fcn.6d942730
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], ebx
test eax, eax
jne 0x6d9425f6
lea eax, [0x6d962b82]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.6d942250
mov eax, dword [esp + 8]
nop
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
lea ecx, [0x6d9426d0]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], eax
lea ecx, [esp + 0x70]
mov dword [esp + 0x78], ecx
mov byte [esp + 0x4d], 1
lea ecx, [esp + 0x60]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6d942630
mov byte [esp + 0x4d], 0
mov edx, dword [esp + 0x78]
mov eax, dword [edx]
call eax
add esp, 0x7c
ret
je 0x6d9425fb
mov eax, dword [eax + 4]
mov dword [esp], eax
mov dword [esp + 4], ebp
call fcn.6d8f4560
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.6d8f4560
nop
call fcn.6d8f4280
add esp, 0x7c
ret
call fcn.6d91fd10
jmp fcn.6d942490
Function at 0x6d9443a0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x6d944397
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
sub esp, 0x1c
mov ebx, dword [esp + 0x2c]
mov dword [esp], 2
call dword [0x6d94c0bc]
mov dword [esp + 4], str.Erro:__s_n
mov dword [esp + 8], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
add esp, 0x38
pop ebx
ret
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.6d943fb0
test eax, eax
je 0x6d9443e0
mov dword [esp + 4], esi
mov ebx, eax
mov dword [esp], eax
call fcn.6d9434e0
test eax, eax
je 0x6d944420
add esp, 0x14
pop ebx
pop esi
jmp eax
mov dword [esp], 2
call dword [0x6d94c0bc]
mov dword [esp + 8], 0x24
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Erro_ao_carregar_a_DLL_em_memria._n
call sub.msvcrt.dll_fwrite
add esp, 0x14
pop ebx
pop esi
jmp 0x6d944310
mov dword [esp], 2
call dword [0x6d94c0bc]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Erro_ao_obter_o_endereo_da_funo__s._n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
call 0x6d944310
mov dword [esp + 0x20], ebx
add esp, 0x14
pop ebx
pop esi
jmp fcn.6d943630

Function at 0x6d944490
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [0x6da231c8], eax
test eax, eax
je 0x6d9444d8
mov dword [esp], 0x6da231cc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
add esp, 0x1c
ret
mov dword [esp], 2
call dword [0x6d94c0bc]
mov dword [esp + 8], 0x3d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x6d944c80
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6da23558]
test esi, esi
jle 0x6d944d90
mov edi, dword [0x6da2355c]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6d944cb4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6d944d35
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x6d944ca0
mov dword [esp], eax
mov ebx, eax
call fcn.6d9453d0
test eax, eax
mov edi, eax
je 0x6d944db7
mov eax, dword [0x6da2355c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6d9454d0
add eax, dword [edi + 0xc]
mov edx, dword [0x6da2355c]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6d944d97
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6d944d2e
sub eax, 4
and eax, 0xfffffffb
jne 0x6d944d40
add dword [0x6da23558], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x6da2355c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6d944d2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6d945a10
lea esi, [esi]
xor esi, esi
jmp 0x6d944cbe
mov eax, dword [0x6da2355c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6d945a10
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6d945a10
mov esi, esi
lea edi, [edi]

Function at 0x6d945050
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6da23568
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6da23560]
sub esp, 4
test ebx, ebx
je 0x6d9450a5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6d94509e
test esi, esi
je 0x6d94509e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6d945080
mov dword [esp], 0x6da23568
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6d945a10
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6d9459f0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6d9459f0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.6d8c13e0
Function at 0x402eb5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x4308f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402f49
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402f06
cmp dword [ebp + 0x10], ebx
jne 0x402f3d
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402eb5
test eax, eax
jne 0x402f18
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402eed
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00406614
cmp eax, ebx
je 0x402f50
push ebx
push dword [0x4308f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402f49
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x4308f0], ebx
jne 0x402f46
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402f46
jmp 0x402f49
Function at 0x40589a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42c8a0], 0x44
push eax
xor eax, eax
push 0x42c8a0
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4058d5
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40595f
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405da8
mov edi, eax
cmp edi, 0xffffffff
je 0x4059a0
test byte [esp + 0x10], 1
push esi
je 0x405982
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x405988
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405991
xor eax, eax
inc eax
jmp 0x4059a2
test byte [esp + 0x10], 4
jne 0x4059a0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405cba
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42c4a0
push esi
call fcn.0040613c
push esi
call fcn.00405c65
mov edi, eax
test edi, edi
jne 0x405cdb
xor eax, eax
jmp 0x405d2d
push edi
call fcn.004063a7
test byte [0x430858], 0x80
je 0x405cf4
mov al, byte [edi]
test al, al
je 0x405cd7
cmp al, 0x5c
je 0x405cd7
sub edi, esi
jmp 0x405d0c
call fcn.004065ed
test eax, eax
je 0x405d06
test byte [eax], 0x10
je 0x405cd7
push esi
call fcn.00405c13
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405cf8
call fcn.00405bcc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405da8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405dc7
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x405dcd
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405dfc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40ab38]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405e41
test edi, edi
jne 0x405e07
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405e3b
Function at 0x405e74
Capabilities:
Get file size
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x42ce28
push 0x40ab54
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
mov ebx, 0x400
je 0x405ec3
push 1
push 0
push esi
call fcn.00405dcd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x405fea
cmp eax, ebx
jg 0x405fea
mov esi, 0x42d228
push ebx
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x405fea
cmp eax, ebx
jg 0x405fea
push esi
push edi
push str._s_s_r_n
push 0x42ca28
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x430850]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.0040615e
push 4
push 0xc0000000
push esi
call fcn.00405dcd
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
je 0x405fea
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405fe3
push edi
push esi
push ebp
call fcn.00405e45
test eax, eax
je 0x405fe3
push str._Rename__r_n
push esi
call fcn.00405d32
test eax, eax
jne 0x405f79
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405fae
add eax, 0xa
push 0x40ab3c
push eax
call fcn.00405d32
mov ebp, eax
test ebp, ebp
je 0x405faa
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405f9b
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405f95
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x1c]
jmp 0x405fb0
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
add eax, esi
push 0x42ca28
push eax
call fcn.00405d88
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x406023
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406094
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406083
cmp dword [ebp + 0x14], 1
je 0x406085
cmp dword [ebp + 0x14], 2
je 0x406085
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x406440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406465
mov eax, dword [0x40a908]
cmp eax, 0xffffffff
je 0x40645c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a908], 0xffffffff
jmp 0x4064d8
cmp dword [0x42efc0], ebx
je 0x4064d8
cmp byte [0x42ebc0], bl
je 0x4064a4
cmp dword [0x40a908], 0xffffffff
jne 0x4064ad
push 4
push 0x40000000
push 0x42ebc0
call fcn.00405dcd
cmp eax, 0xffffffff
mov dword [0x40a908], eax
je 0x4064d8
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a908], 0xffffffff
je 0x4064d8
push esi
mov esi, 0x42f7e0
push 0x40ab64
push esi
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp + 8]
push ebx
push eax
push esi
call sub.KERNEL32.dll_lstrlenA
push eax
push esi
push dword [0x40a908]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x406686
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42d62c], 0
push esi
jne 0x4066bd
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406697
mov dword [ecx*4 + 0x42d628], eax
inc ecx
cmp ecx, 0x100
jl 0x406692
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4066ee
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42d628]
xor eax, esi
inc ecx
dec edx
jne 0x4066d0
pop edi
not eax
pop esi
ret 0xc