joyce8/EMBER2024-capa huggingface dataset:
Function at 0x660ff50c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x18]
test byte [esi + 0x15], 8
lea eax, [edi + 0x78]
mov dword [ebp + 8], eax
jne 0x6610698b
mov ebx, dword [esi + 0xc]
mov ax, word [ebx + 0xa]
test ax, ax
je 0x660ff545
movsx eax, ax
mov ecx, ebx
add ecx, eax
lea eax, [esi + 0x5c]
push ecx
push eax
call fcn.66028c46
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0x800a9c68
je 0x6610699a
cmp dword [edi + 0x10], 0
je 0x6610699a
mov ecx, esi
call fcn.66028d2a
push eax
push ebx
call fcn.660ff5ab
cmp dword [esi + 0x20], 0
movzx eax, ax
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x1c]
jne 0x661069ad
nop
test eax, eax
je 0x661069ad
and dword [edi + 0x10], 0
cmp eax, 0xffffffff
jne 0x661069a1
mov eax, dword [esi + 0x48]
push ebx
dec eax
push eax
call fcn.660ff5c4
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor ax, ax
pop esi
ret 8
lea eax, [esi + 0x34]
push eax
call fcn.660fd9ff
mov eax, dword [esi + 0x54]
mov dword [edi + 0x14], eax
xor eax, eax
jmp 0x660ff5a4
mov ecx, dword [esi + 0x48]
dec ecx
mov dword [esi + 0x20], ecx
jmp 0x660ff5a4
mov edx, 0x661049ec
cmp dword [esi + 0x3c], edx
je 0x661069e0
mov esi, dword [esi]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0x20]
test esi, esi
je 0x661069e6
lea ecx, [esi + 0x34]
cmp eax, ecx
jne 0x661069e6
cmp dword [esi + 0x20], 0
mov ecx, dword [esi + 0x1c]
jne 0x661069d7
test ecx, ecx
jne 0x6610699a
cmp dword [esi + 0x3c], edx
je 0x661069e0
mov esi, dword [esi]
jmp 0x661069bc
test byte [esi + 0x15], 0x20
je 0x6610699a
call fcn.66024977
push edi
call fcn.66014435
push eax
call fcn.6602dab8
push eax
push 0x13
call fcn.6601532c
push dword [ebp + 8]
call fcn.6602e749
push 0x9c68
call fcn.66024fdc
movsx ecx, cx
mov si, word [esp + 0xc]
add eax, ecx
mov cx, word [eax]
add eax, 2
dec cx
cmp si, word [eax]
jb 0x660ff5bd
movzx edx, cx
cmp si, word [eax + edx*4]
lea edx, [eax + edx*4]
jb 0x66106a41
mov ax, word [edx + 2]
jmp 0x660ff5c0
push 1
pop edx
cmp cx, dx
jne 0x66106a52
mov ax, word [eax + 2]
jmp 0x660ff5c0
add eax, 4
cmp cx, dx
jbe 0x66106a68
cmp si, word [eax]
jb 0x66106a68
inc edx
add eax, 4
cmp dx, cx
jb 0x66106a5a
mov ax, word [eax - 2]
jmp 0x660ff5c0

Function at 0x660ff5ee
Capabilities:
Packed with generic packer

Disassembly:
sub dword [esp + 4], eax
mov ecx, 0x661049ec
jmp 0x660fd06c
Function at 0x660ff5fc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp byte [0x6610f190], 0
push esi
push edi
jne 0x6610633a
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.660ff65b
push dword [0x6610ee98]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test byte [eax + 0x76], 2
jne 0x66106346
lea eax, [ebp - 0x20]
push eax
push edi
call fcn.6601d35f
cmp byte [0x6610f190], 0
jne 0x6610635e
mov eax, dword [esi]
pop edi
pop esi
leave
ret 0xc
push 0xffffffffffffffed
call fcn.660d772f
jmp 0x660ff611
mov eax, dword [esi]
test eax, eax
je 0x660ff63c
mov ecx, dword [eax]
and dword [esi], 0
push eax
call dword [ecx + 8]
jmp 0x660ff63c
call fcn.660d7d78
jmp 0x660ff653

Function at 0x661073c4
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov eax, dword [edi + 0x10]
lea esi, [edi + 0x10]
cmp eax, ebx
mov dword [esp + 0xc], ebx
jne 0x6610742b
lea eax, [esp + 0xc]
push eax
push 1
call dword [sym.imp.OLEAUT32.dll_SafeArrayAllocData]
test eax, eax
jge 0x661073f4
push 7
call fcn.66024fdc
mov ecx, dword [esp + 0xc]
mov dx, word [edi + 2]
mov dword [ecx + 4], 0x10
mov eax, dword [esp + 0xc]
mov word [eax + 2], dx
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x14], ebx
mov edx, dword [esp + 0xc]
mov dword [edx + 0x10], ebx
mov eax, dword [esp + 0xc]
mov dword [eax + 0xc], ebx
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov ecx, dword [0x6610ee98]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push 1
push 0xc
mov ebp, eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
cmp eax, ebx
mov dword [esp + 0x10], eax
jne 0x66107455
push 7
call fcn.66024fdc
mov ecx, dword [eax + 0x10]
mov edi, dword [edi + 0xc]
mov esi, dword [eax + 0xc]
mov edx, ecx
dec ecx
mov dword [ebp + 0x68], eax
test edx, edx
mov word [ebp + 0x60], 0x200c
je 0x66107485
lea ebx, [ecx + 1]
mov edx, edi
mov ecx, esi
add esi, 0x10
add edi, 0x10
call sym.MSVBVM60.DLL___vbaVarDup
dec ebx
jne 0x66107471
xor ebx, ebx
mov dword [ebp + 0x60], ebx
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x661093d9
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 0x18]
add eax, 0x50
mov dword [ebp - 4], eax
mov ax, word [edi]
test ah, 0x40
je 0x66109471
and eax, 0xbfff
mov esi, eax
cmp si, 0x11
jbe 0x66109425
test si, 0x2000
jne 0x66109421
cmp si, 0x24
je 0x66109421
push 0x1ca
call fcn.66024fdc
push 0xd
jmp 0x6610941c
movzx eax, si
lea eax, [eax + eax*8]
movzx ax, byte [eax*2 + 0x66055950]
cmp si, ax
jne 0x6610943f
cmp si, 0xa
jne 0x66109446
push 0xd
call fcn.66024fdc
push 0
push edi
push dword [ebp + 0x1c]
call fcn.66107494
mov ebx, dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.660e443d
push esi
push ebx
push dword [ebp + 0xc]
call fcn.660e443d
pop edi
pop esi
pop ebx
leave
ret 0x18
mov eax, dword [ebp + 0x10]
cmp word [eax], 9
jne 0x66109504
mov edi, dword [ebp + 8]
xor esi, esi
push edi
push 3
push esi
push esi
push esi
push esi
push dword [eax + 8]
call fcn.660ddd03
mov dword [ebp + 0x10], edi
mov ebx, dword [ebp + 0x14]
cmp word [ebx], 9
jne 0x661094b2
push dword [ebp + 0xc]
push 3
push esi
push esi
push esi
push esi
push dword [ebx + 8]
call fcn.660ddd03
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
cmp word [edi], 9
jne 0x661094cf
push dword [ebp - 4]
push 3
push esi
push esi
push esi
push esi
push dword [edi + 8]
call fcn.660ddd03
mov edi, dword [ebp - 4]
mov cx, word [edi]
mov esi, dword [ebp + 0x10]
cmp cx, 0x11
ja 0x661094e7
cmp word [esi], 0x11
ja 0x661094e7
cmp word [ebx], 0x11
jbe 0x6610950c
mov ax, word [ebx]
or ax, word [esi]
or eax, ecx
test ah, 0x20
jne 0x66109508
cmp ax, 0x24
je 0x66109508
push 0x1ca
call fcn.66024fdc
xor esi, esi
jmp 0x66109495
push 0xd
jmp 0x661094ff
movzx eax, word [edi]
movzx ecx, word [esi]
lea eax, [eax + eax*8]
movzx eax, byte [ecx + eax*2 + 0x66055950]
movzx ecx, word [ebx]
lea eax, [eax + eax*8]
movzx si, byte [ecx + eax*2 + 0x66055950]
cmp si, 1
jne 0x66109539
push 0x5e
call fcn.66024fdc
cmp si, 0xa
jne 0x66109546
push 0xd
call fcn.66024fdc
push esi
push edi
push dword [ebp + 0x18]
call fcn.660e443d
mov edi, dword [ebp - 4]
cmp word [edi], 8
jne 0x66109454
push dword [edi + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
and word [edi], 0
jmp 0x66109454
Function at 0x402b7a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x4292b0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402c0e
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402bcb
cmp dword [ebp + 0x10], ebx
jne 0x402c02
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402b7a
test eax, eax
jne 0x402bdd
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402bb2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004062b2
cmp eax, ebx
je 0x402c15
push ebx
push dword [0x4292b0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402c0e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x4292b0], ebx
jne 0x402c0b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402c0b
jmp 0x402c0e
Function at 0x403062
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
cmp eax, esi
jl 0x40308e
mov ecx, dword [0x429258]
push esi
add eax, ecx
push esi
push eax
mov dword [0x417e94], eax
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.0040317d
cmp eax, esi
jl 0x403177
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40901c]
call fcn.00405c37
test eax, eax
je 0x403163
push dword [ebp + 8]
add dword [0x417e94], 4
call fcn.0040317d
cmp eax, esi
mov dword [ebp - 8], eax
jl 0x403177
cmp dword [ebp + 0x10], esi
jne 0x40313f
cmp dword [ebp + 8], esi
jle 0x403174
mov esi, 0x413e90
cmp dword [ebp + 8], 0x4000
mov edi, dword [ebp + 8]
jl 0x4030f4
mov edi, 0x4000
push edi
push esi
push dword [0x40901c]
mov dword [ebp - 4], edi
call fcn.00405c37
test eax, eax
je 0x403163
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40313b
cmp dword [ebp + 0x14], edi
jne 0x40313b
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x417e94], eax
cmp dword [ebp + 8], 0
jg 0x4030e3
jmp 0x403174
push 0xfffffffffffffffe
jmp 0x403165
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40314a
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403168
push 0xfffffffffffffffd
pop eax
jmp 0x403177
mov eax, dword [ebp - 4]
add dword [0x417e94], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0x10
Function at 0x40317d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x417e94]
sub esi, dword [0x40be00]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x42920c], eax
jle 0x4032e7
push dword [0x41fea4]
call fcn.0040330f
push ebx
push ebx
push dword [0x40be00]
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41fea0], esi
mov dword [0x417e90], ebx
mov ebp, 0x40be90
mov eax, dword [0x417e98]
mov edi, 0x4000
sub eax, dword [0x41fea4]
cmp eax, edi
jg 0x4031f2
mov edi, eax
mov esi, 0x413e90
push edi
push esi
call fcn.004032f9
test eax, eax
je 0x4032d9
add dword [0x41fea4], edi
mov dword [0x40be20], esi
mov dword [0x40be24], edi
cmp dword [0x429210], ebx
je 0x403249
cmp dword [0x4292a0], ebx
jne 0x403249
mov eax, dword [0x41fea0]
push ebx
sub eax, dword [0x417e94]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40be00]
mov dword [0x417e90], eax
call fcn.00402d1a
pop ecx
mov ecx, 0x40be08
mov dword [0x40be28], ebp
mov dword [0x40be2c], 0x8000
call fcn.004063ee
test eax, eax
jl 0x4032e2
mov esi, dword [0x40be28]
sub esi, ebp
je 0x4032a3
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4032de
cmp esi, dword [esp + 0x10]
jne 0x4032de
add dword [0x40be00], esi
cmp dword [0x40be24], ebx
jne 0x403218
jmp 0x4032af
cmp dword [0x40be24], ebx
jne 0x4032e2
cmp edi, ebx
je 0x4032e2
mov eax, dword [0x417e94]
mov ecx, eax
sub ecx, dword [0x40be00]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x4031dc
push ebx
push ebx
push eax
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4032e7
or eax, 0xffffffff
jmp 0x4032f1
push 0xfffffffffffffffe
jmp 0x4032e4
push 0xfffffffffffffffd
pop eax
jmp 0x4032f1
push 1
call fcn.00402d1a
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4056c3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x4256f0], 0x44
push eax
xor eax, eax
push 0x4256f0
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4056fe
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405788
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405b8f
mov edi, eax
cmp edi, 0xffffffff
je 0x4057c9
test byte [esp + 0x10], 1
push esi
je 0x4057ab
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4057b1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4057ba
xor eax, eax
inc eax
jmp 0x4057cb
test byte [esp + 0x10], 4
jne 0x4057c9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x4057d0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405a9b
test bl, 8
mov dword [ebp - 8], eax
je 0x40580f
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x429288], eax
jmp 0x40598c
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405829
test eax, eax
je 0x40593a
test bl, 2
je 0x40593a
mov esi, 0x4246f0
push edi
push esi
call fcn.00405f48
cmp dword [ebp + 8], 0
je 0x405848
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x40584e
push edi
call fcn.004059df
cmp word [edi], 0
jne 0x40585e
cmp word [0x4246f0], 0x5c
jne 0x405869
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40592f
cmp word [ebp - 0x22c], 0x2e
jne 0x4058b3
cmp word [ebp - 0x22a], 0
je 0x405912
cmp word [ebp - 0x22a], 0x2e
jne 0x4058b3
cmp word [ebp - 0x228], 0
je 0x405912
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00405f48
test byte [ebp - 0x258], 0x10
je 0x4058de
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405912
push dword [ebp + 0xc]
push edi
call fcn.004057d0
jmp 0x405912
push dword [ebp - 4]
push edi
call fcn.00405788
test eax, eax
jne 0x40590a
cmp dword [ebp - 4], eax
je 0x405902
push edi
push 0xfffffffffffffff1
call fcn.004051f2
push 0
push edi
call fcn.00405de2
jmp 0x405912
inc dword [0x429288]
jmp 0x405912
push edi
push 0xfffffffffffffff2
call fcn.004051f2
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40588b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40593a
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40598c
cmp dword [ebp - 8], esi
jne 0x40594e
inc dword [0x429288]
jmp 0x40598c
push edi
call fcn.0040628b
test eax, eax
je 0x40598c
push edi
call fcn.00405993
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405788
test eax, eax
jne 0x405984
cmp dword [ebp - 4], esi
je 0x405946
push edi
push 0xfffffffffffffff1
call fcn.004051f2
push esi
push edi
call fcn.00405de2
jmp 0x40598c
push edi
push 0xffffffffffffffe5
call fcn.004051f2
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405a9b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x424ef0
push esi
call fcn.00405f48
push esi
call fcn.00405a3e
mov edi, eax
test edi, edi
jne 0x405abc
xor eax, eax
jmp 0x405b14
push edi
call fcn.004061dc
test byte [0x429218], 0x80
je 0x405ad9
mov ax, word [edi]
test ax, ax
je 0x405ab8
cmp ax, 0x5c
je 0x405ab8
sub edi, esi
sar edi, 1
jmp 0x405af3
call fcn.0040628b
test eax, eax
je 0x405aed
test byte [eax], 0x10
je 0x405ab8
push esi
call fcn.004059df
push esi
call sub.KERNEL32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405adf
call fcn.00405993
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405b8f
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405bae
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405bb4
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405be3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x409558]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40955c]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405c33
test edi, edi
jne 0x405bf0
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405c2d
Function at 0x405c66
Capabilities:
Get file size
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebx, 0x425d88
push 0x40957c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
mov edi, 0x400
je 0x405cb5
push 1
push 0
push esi
call fcn.00405bb4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push esi
call ebp
test eax, eax
je 0x405ddc
cmp eax, edi
jg 0x405ddc
mov esi, 0x426588
push edi
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x405ddc
cmp eax, edi
jg 0x405ddc
push esi
push ebx
push str._ls_ls_r_n
push 0x425988
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x429210]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405f6a
push 4
push 0xc0000000
push esi
call fcn.00405bb4
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
je 0x405ddc
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405dd5
push edi
push esi
push ebp
call fcn.00405c37
test eax, eax
je 0x405dd5
push str._Rename__r_n
push esi
call fcn.00405b19
test eax, eax
jne 0x405d6b
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405da0
add eax, 0xa
push 0x409560
push eax
call fcn.00405b19
mov ebp, eax
test ebp, ebp
je 0x405d9c
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405d8d
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405d87
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x1c]
jmp 0x405da2
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
add eax, esi
push 0x425988
push eax
call fcn.00405b6f
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x405e15
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0x18]
push edi
push eax
mov eax, dword [ebp + 0x18]
xor edi, edi
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov word [esi], di
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405e89
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x800
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405e76
cmp dword [ebp + 0x14], 1
je 0x405e79
cmp dword [ebp + 0x14], 2
je 0x405e79
mov word [esi], di
push dword [ebp + 0x18]
mov word [esi + 0x7fe], di
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x406360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x426d8c], 0
push esi
jne 0x406397
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406371
mov dword [ecx*4 + 0x426d88], eax
inc ecx
cmp ecx, 0x100
jl 0x40636c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4063c8
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x426d88]
xor eax, esi
inc ecx
dec edx
jne 0x4063aa
pop edi
not eax
pop esi
ret 0xc
Function at 0x401000
Capabilities:
Get hostname
Identify system language via api

Disassembly:
sub esp, 0x344
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x407020
push 0x407088
call esi
jmp loc.0040d222

Function at 0x4018c0
Capabilities:
Packed with generic packer

Disassembly:
mov cl, byte [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test cl, cl
je 0x4018df
mov dl, byte [esp + 4]
cmp cl, dl
je 0x4018e3
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4018d3
or eax, 0xffffffff
ret
jmp 0x40cd15

Function at 0x401c64
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407164
push 0x407180
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x407188
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
cmp dword [0x407464], 0
mov dword [ebp - 8], eax
jmp loc.0040ccde

Function at 0x401cd0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x4077d8
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0xc
mov ebx, 0x4074ec
test eax, eax
jmp loc.0040b94a

Function at 0x401e67
Capabilities:
Packed with generic packer
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp + 0xc]
push 4
push eax
push 8
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne fcn.00401eb8
push eax
lea ecx, [ebp + 0xc]
push eax
push ecx
push eax
push eax
lea eax, [ebp - 0xc]
push 0xc
push eax
push 0x98000004
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x2bf20
mov dword [ebp - 4], 0x2710
jmp loc.0040c066