joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40149d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x472eb0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x401532
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x4014ef
cmp dword [ebp + 0x10], ebx
jne 0x401526
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.0040149d
test eax, eax
jne 0x401501
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014d6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.0040647d
cmp eax, ebx
je 0x401539
push ebx
push dword [0x472eb0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401532
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x472eb0], ebx
jne 0x40152f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40152f
jmp 0x401532
Function at 0x4033f1
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x42f1e4]
sub esi, dword [0x4331f0]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
xor ebx, ebx
mov dword [0x472e20], eax
cmp esi, ebx
jle 0x40354f
push dword [0x4331ec]
call fcn.004033da
push ebx
push ebx
push dword [0x4331f0]
push dword [0x40b014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x42f1e0], esi
mov dword [0x41f154], ebx
mov ebp, 0x4271e0
mov eax, dword [0x4331e8]
sub eax, dword [0x4331ec]
mov edi, 0x4000
cmp eax, edi
jg 0x403466
mov edi, eax
push edi
mov esi, 0x42f1e8
push esi
call fcn.004033a8
test eax, eax
je 0x403561
add dword [0x4331ec], edi
mov dword [0x427170], esi
mov dword [0x427174], edi
cmp dword [0x472ddc], ebx
je 0x4034bd
cmp dword [0x472ea0], ebx
jne 0x4034bd
mov eax, dword [0x42f1e0]
sub eax, dword [0x42f1e4]
push ebx
sub eax, dword [esp + 0x1c]
add eax, dword [0x4331f0]
mov dword [0x41f154], eax
call fcn.00403306
pop ecx
mov ecx, 0x427158
mov dword [0x427178], ebp
mov dword [0x42717c], 0x8000
call fcn.00407493
test eax, eax
js 0x403566
mov esi, dword [0x427178]
sub esi, ebp
je 0x40351b
push ebx
lea eax, [esp + 0x14]
push eax
push esi
push ebp
push dword [0x40b014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40356b
cmp esi, dword [esp + 0x10]
jne 0x40356b
add dword [0x4331f0], esi
cmp dword [0x427174], ebx
jne 0x40348c
jmp 0x403527
cmp dword [0x427174], ebx
jne 0x403566
cmp edi, ebx
je 0x403566
mov eax, dword [0x42f1e4]
mov ecx, eax
sub ecx, dword [0x4331f0]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x403450
push ebx
push ebx
push eax
push dword [0x40b014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
call fcn.00403306
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
or eax, 0xffffffff
jmp 0x403559
push 0xfffffffffffffffd
pop eax
jmp 0x403559
push 0xfffffffffffffffe
jmp 0x403568
Function at 0x40356f
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x403599
add eax, dword [0x472e18]
push edi
push edi
push eax
push dword [0x40b014]
mov dword [0x42f1e4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.004033f1
cmp eax, edi
jl 0x403692
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x40b014]
call ebx
test eax, eax
je 0x40368e
cmp dword [ebp - 4], esi
jne 0x40368e
push dword [ebp + 8]
add dword [0x42f1e4], esi
call fcn.004033f1
mov dword [ebp - 8], eax
cmp eax, edi
jl 0x403691
cmp dword [ebp + 0x10], edi
jne 0x40365d
cmp dword [ebp + 8], edi
jle 0x403689
mov esi, 0x42f1e8
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x40360d
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x40b014]
call ebx
test eax, eax
je 0x40368e
cmp edi, dword [ebp - 4]
jne 0x40368e
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403659
cmp dword [ebp + 0x14], edi
jne 0x403659
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x42f1e4], eax
cmp dword [ebp + 8], 0
jg 0x403600
jmp 0x403689
push 0xfffffffffffffffe
jmp 0x403690
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403668
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40b014]
call ebx
test eax, eax
je 0x40368e
mov eax, dword [ebp - 4]
add dword [0x42f1e4], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403691
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x405dc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x457288
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x457288], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405dfb
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405fb1
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405fce
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x405fd1
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x406000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x4096a4]
mov dword [ebp - 8], eax
mov eax, dword [0x4096a8]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406050
test edi, edi
jne 0x40600d
mov word [esi], ax
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x40604a

Function at 0x406054
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4060cd
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x4008
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4060b6
cmp dword [ebp + 0x14], 1
je 0x4060bb
cmp dword [ebp + 0x14], 2
je 0x4060bb
xor eax, eax
mov word [esi], ax
push dword [ebp + 0x18]
xor eax, eax
mov word [esi + 0x4006], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 0x14
Function at 0x406268
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406291
mov eax, dword [0x40b058]
cmp eax, 0xffffffff
je 0x406285
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40b058], 0xffffffff
jmp 0x40633c
cmp dword [0x461530], ebx
je 0x40633c
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp word [0x46a560], bx
je 0x406308
cmp dword [0x40b058], 0xffffffff
jne 0x406311
mov esi, 0x46a560
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 4
push 0x40000000
push esi
mov dword [ebp + 8], eax
call fcn.00405fd1
mov dword [0x40b058], eax
cmp eax, 0xffffffff
je 0x40633a
cmp dword [ebp + 8], 0xffffffff
jne 0x4062fd
push ebx
lea ecx, [ebp - 4]
push ecx
push 2
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [ebp + 8], 0xfeff
call edi
mov eax, dword [0x40b058]
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40b058], 0xffffffff
je 0x40633a
push 0x4096c0
mov esi, 0x461540
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp + 8]
push ecx
add eax, eax
push eax
push esi
push dword [0x40b058]
call edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4068ff
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4572d0
push esi
call fcn.0040618a
push esi
call fcn.00405eda
mov edi, eax
test edi, edi
jne 0x406920
xor eax, eax
jmp 0x40697d
push edi
call fcn.004061b9
test byte [0x472e28], 0x80
je 0x40693c
movzx eax, word [edi]
test ax, ax
je 0x40691c
cmp eax, 0x5c
je 0x40691c
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x40695e
push esi
call fcn.00406456
test eax, eax
je 0x406958
test byte [eax], 0x10
je 0x406982
push esi
call fcn.004068d2
push esi
call ebx
cmp eax, edi
jg 0x406949
push esi
call fcn.004068a3
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x40697c
Function at 0x406c1a
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x4098d0
mov ebx, 0x45b2d8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov esi, 0x400
cmp edi, ebp
je 0x406c68
push 1
push ebp
push edi
call fcn.00405fd1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406de3
cmp eax, esi
jg 0x406de3
push esi
mov edi, 0x460930
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406de3
cmp eax, esi
jg 0x406de3
push ebp
push ebp
push esi
push 0x45bad8
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x406de3
push ebp
push ebp
push esi
mov esi, 0x45c128
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x406de3
push esi
push 0x45bad8
push str._s_s_r_n
push 0x45c528
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x472ddc]
push dword [eax + 0x128]
push edi
call fcn.00406986
push 4
push 0xc0000000
push edi
call fcn.00405fd1
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x406de3
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x406dd9
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406dd9
cmp edi, dword [esp + 0x10]
jne 0x406dd9
push str._Rename__r_n
push esi
call fcn.00405f37
cmp eax, ebp
jne 0x406d6c
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x406da1
push 0x4098c4
add eax, 0xa
push eax
call fcn.00405f37
mov ebp, eax
test ebp, ebp
je 0x406d9f
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
cmp ecx, ebp
jbe 0x406d96
sub eax, ecx
mov dl, byte [ecx]
mov byte [eax + ecx], dl
dec ecx
cmp ecx, ebp
ja 0x406d8c
sub ebp, esi
lea eax, [ebp + 1]
xor ebp, ebp
jmp 0x406da3
xor ebp, ebp
mov eax, edi
push ebx
push 0x45c528
add eax, esi
push eax
call fcn.00405f8d
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x407402
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407440
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407416
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x407411
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40746d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40744e
not eax
pop ebp
ret 0xc
Function at 0x40b610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [esi - 0x3a]
test dword [ecx + 0x56fffffc], edi
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0040adb4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040ad69
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040adb4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040ad69
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0040adb4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040ad69
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0040ada4
invalid
Function at 0x40c1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x40c1fa
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x40c1a4
call fcn.0040ada4
je 0x40c23d
outsd dx, dword [esi]
popal
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0040ada4
mov cl, 0xaf
add dword [edi - 0x72b7a73], esp
invalid
fdiv st(0), st(0)
invalid

Function at 0x40c750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x40ce4a
invalid
add byte [ebp - 0x22f7b], cl
dec dword [ecx - 0x39f7b]
inc dword [ebx - 0x6fb43]
inc dword [eax]
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x40c91f
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
invalid
invalid
xchg edx, eax
clc
Function at 0x40dfa0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x28
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e006
lea ecx, [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x18]
push ecx
push edx
call eax
test eax, eax
jne 0x40dfde
xor al, al
add esp, 0x28
ret
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
add esp, 0x28
ret
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x34]
lea eax, [esp + 8]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x40e02f
xor al, al
add esp, 0x28
ret
mov eax, dword [esp]
mov ecx, dword [esp + 0x34]
imul eax, dword [esp + 4]
mov edx, eax
imul edx, dword [esp + 8]
imul eax, dword [esp + 0xc]
mov dword [ecx], edx
mov dword [ecx + 4], 0
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov al, 1
add esp, 0x28
ret

Function at 0x40e120
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
mov edi, dword [esp + 0x10]
push 0x4ff
push edi
push 0
push 0
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
call ebx
mov ecx, eax
sub ecx, esi
cmp ecx, edi
jge 0x40e17e
push ebp
mov ebp, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, esi
jge 0x40e15a
mov esi, eax
sub esi, eax
add edi, esi
mov esi, eax
call fcn.0040e0d0
push 0x4ff
push edi
push 0
push 0
push 0
call ebp
call ebx
mov edx, eax
sub edx, esi
cmp edx, edi
jl 0x40e154
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40efd0
Capabilities:
Create directory
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x457579
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebp
push esi
push edi
xor esi, esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x170], esi
call fcn.004466a5
push 0x475960
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], 1
call fcn.0044a84e
mov ecx, dword [esp + 0x178]
lea eax, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x178], 2
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40f050
mov edx, dword [esp + 0x28]
and edx, 0x10
cmp dl, 0x10
jne 0x40f050
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40f178
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x1c]
call fcn.00446738
mov eax, dword [esp + 0x178]
cmp dword [eax - 8], esi
jle 0x40f0d5
mov al, byte [esi + eax]
cmp al, 0x5c
je 0x40f083
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call fcn.0044ab1d
jmp 0x40f0a4
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00446881
push 0x471aa0
lea ecx, [esp + 0x10]
call fcn.0044aaf6
mov eax, dword [esp + 0x178]
mov ecx, dword [eax - 8]
dec ecx
cmp esi, ecx
jne 0x40f0cd
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.00446881
mov eax, dword [esp + 0x178]
mov ecx, dword [eax - 8]
inc esi
cmp esi, ecx
jl 0x40f068
mov ebp, dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call ebp
mov eax, dword [esp + 0x1c]
mov esi, 1
cmp eax, esi
jle 0x40f149
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edx, [esp + 0x10]
push esi
push edx
lea ecx, [esp + 0x1c]
call fcn.0040f210
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x174], 3
call fcn.0044a8c7
lea ecx, [esp + 0x10]
mov byte [esp + 0x170], 2
call fcn.0044a78e
mov eax, dword [esp + 0xc]
push 0
push eax
call edi
test eax, eax
je 0x40f140
mov ecx, dword [esp + 0xc]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jl 0x40f0f1
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x1c]
call fcn.00446738
mov eax, dword [esp + 0x178]
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [esp + 0x28]
push eax
and ecx, 0x10
cmp cl, 0x10
jne 0x40f1b5
call ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x170], 1
call fcn.0044a78e
lea ecx, [esp + 0x14]
mov byte [esp + 0x170], 0
call fcn.004466d8
lea ecx, [esp + 0x178]
mov dword [esp + 0x170], 0xffffffff
call fcn.0044a78e
mov al, 1
jmp 0x40f1f2
call ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x170], 1
call fcn.0044a78e
lea ecx, [esp + 0x14]
mov byte [esp + 0x170], 0
call fcn.004466d8
lea ecx, [esp + 0x178]
mov dword [esp + 0x170], 0xffffffff
call fcn.0044a78e
xor al, al
mov ecx, dword [esp + 0x168]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x168
ret
Function at 0x418d40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x458510
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x30
push esi
push edi
mov esi, ecx
xor edi, edi
cmp eax, edi
mov dword [esi + 0x44], eax
je 0x418e33
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
neg eax
neg ecx
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], vtable.CRgn.0
push 2
lea edx, [esp + 0x24]
push 3
push edx
mov dword [esp + 0x4c], edi
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
push eax
lea ecx, [esp + 0xc]
call fcn.0044e5c7
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
lea ecx, [esp + 8]
mov edi, eax
call fcn.0044e5f4
mov ecx, dword [esi + 0x1c]
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [esp + 8], vtable.CGdiObject.0
lea ecx, [esp + 8]
mov dword [esp + 0x40], 1
call fcn.0044e61e
pop edi
pop esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
push eax
mov eax, dword [esi + 0x1c]
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov ecx, dword [esp + 0x38]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x3c
ret 4