joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c056
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x44c26e
call fcn.0041492c
mov ebx, ecx
and dword [ebp - 0x18], 0
cmp dword [ebx], 0
je 0x40c133
cmp dword [ebx], 0xffffffff
je 0x40c133
push 0x40
pop esi
push esi
lea ecx, [ebp - 0x24]
call fcn.0040c215
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x40c097
mov ecx, dword [eax]
jmp 0x40c099
mov ecx, eax
mov edi, dword [ebp - 0x24]
lea eax, [esi + esi]
mov dword [ebp - 0x14], eax
xor esi, esi
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push esi
push ecx
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c0ed
cmp dword [ebp - 0x10], 1
je 0x40c0cc
cmp dword [ebp - 0x10], 2
je 0x40c0cc
push 0xd
pop eax
jmp 0x40c0ed
test edi, edi
je 0x40c0eb
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40c0e6
test al, 1
jne 0x40c0c7
shr eax, 1
cmp word [edi + eax*2 - 2], si
je 0x40c0eb
jmp 0x40c0c7
xor eax, eax
mov word [edi], ax
mov eax, esi
mov dword [ebx + 0xc], eax
cmp eax, 0xea
jne 0x40c10a
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
sub esi, edi
and esi, 0xfffffffe
push esi
call fcn.0040c1b4
jmp 0x40c08a
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
cmp dword [ebx + 0xc], esi
je 0x40c12b
push dword [ebp + 0x10]
call fcn.00404943
lea ecx, [ebp - 0x24]
call fcn.0040c24e
jmp 0x40c13e
push edi
call fcn.00401a86
jmp 0x40c121
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
call fcn.00404943
mov eax, dword [ebp + 8]
call fcn.004148f5
ret 0xc

Function at 0x40c149
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x40c1af
cmp dword [edi], 0xffffffff
je 0x40c1af
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
jb 0x40c164
mov ecx, dword [ecx]
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x40c170
mov esi, dword [esi]
test ecx, ecx
jne 0x40c179
push 0xd
pop eax
jmp 0x40c1ab
and dword [ebp + 0xc], 0
mov edx, ecx
push ebx
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp + 0xc]
jne 0x40c183
sub edx, ebx
sar edx, 1
lea eax, [edx*2 + 2]
push eax
push ecx
push 1
xor eax, eax
push eax
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebx
mov dword [edi + 0xc], eax
pop esi
pop edi
pop ebp
ret 8

Function at 0x40c719
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x40c721
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c734
shr eax, 4
and eax, 1
ret
xor al, al
ret
Function at 0x40c737
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x1c
mov eax, 0x44b658
call fcn.00414960
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x40c74f
mov edi, dword [esi]
jmp 0x40c751
mov edi, esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c764
shr al, 4
and al, 1
jmp 0x40c7e2
push ecx
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.0040e87e
pop ecx
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
jb 0x40c77e
mov eax, dword [esi]
jmp 0x40c780
mov eax, esi
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push dword [esi + 0x10]
cmovae ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
push eax
call fcn.00405326
pop ecx
pop ecx
test eax, eax
je 0x40c7d2
lea ecx, [ebp - 0x28]
call fcn.0040c737
test al, al
je 0x40c7d2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40c7ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c7d2
mov ecx, esi
call fcn.0040c719
test al, al
je 0x40c7d2
mov bl, 1
jmp 0x40c7d4
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401ab7
mov al, bl
call fcn.0041490a
ret
Function at 0x40c838
Capabilities:
Create directory

Disassembly:
push 0x50
mov eax, 0x44c2d9
call fcn.00414960
mov eax, edx
mov dword [ebp - 0x5c], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
xor ecx, ecx
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
and dword [ebp - 4], ecx
xor esi, esi
and dword [ebp - 0x30], 0
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], cx
push 0xffffffffffffffff
push ecx
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00401c28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.0040f461
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00402044
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00401ab7
push 0x5f
lea ecx, [ebp - 0x40]
call fcn.00406d01
mov edx, 0x7fff
call fcn.0040f4ba
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.0040f461
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00402044
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00401ab7
push ebx
lea ecx, [ebp - 0x58]
call fcn.00404943
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.00402044
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x40c922
push 0xffffffffffffffff
push 0
push eax
call fcn.00401c28
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00401ab7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40c969
push eax
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], al
call fcn.00401ab7
mov eax, dword [ebp - 0x5c]
inc esi
cmp esi, 0x32
jl 0x40c864
xor bl, bl
jmp 0x40c98a
lea eax, [ebp - 0x28]
cmp edi, eax
je 0x40c97c
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.00401c28
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00401ab7
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401ab7
mov al, bl
call fcn.0041490a
ret

Function at 0x40c99e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ecx + 0x14], 8
push edi
mov edi, edx
jb 0x40c9b1
mov ecx, dword [ecx]
push 0x45c2ec
push ecx
lea eax, [ebp - 4]
push eax
call fcn.00431e54
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x40c9d2
call fcn.00432933
mov eax, dword [eax]
jmp 0x40ca24
push esi
push 2
push 0
push dword [ebp - 4]
call fcn.00432271
push dword [ebp - 4]
call fcn.00431a74
add esp, 0x10
mov esi, eax
push dword [ebp - 4]
test esi, esi
jne 0x40c9fb
call fcn.00431f1c
pop ecx
jmp 0x40ca21
call fcn.0043255c
pop ecx
push esi
mov ecx, edi
call fcn.0040b9e6
push dword [ebp - 4]
push esi
push 1
push dword [edi]
call fcn.00432ec3
push dword [ebp - 4]
call fcn.00431f1c
add esp, 0x14
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40d0d8
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x44c3b7
call fcn.00414960
mov esi, ecx
mov dword [ebp - 0x30], esi
mov ecx, dword [ebp + 8]
or ebx, 0xffffffff
cmp ecx, ebx
sete al
test al, al
je 0x40d104
xor eax, eax
cmp ecx, ebx
cmovne eax, ecx
jmp 0x40d268
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x40d132
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40d132
mov eax, dword [ebp + 8]
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x40d268
cmp dword [esi + 0x4c], 0
je 0x40d266
mov ecx, esi
call fcn.0040d85e
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x40d166
push dword [esi + 0x4c]
movsx eax, al
push eax
call fcn.00431aa8
cmp eax, ebx
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
jmp 0x40d266
push ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov byte [ebp - 0x29], al
mov dword [ebp - 0x14], 0xf
call fcn.0040d810
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edi, 0x10
lea edx, [ebp - 0x28]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x29]
push eax
push dword [ebp - 0x34]
call dword [edi + 0x1c]
test eax, eax
js 0x40d25a
cmp eax, 1
jg 0x40d23d
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x3c], edx
je 0x40d20e
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.00432862
mov edx, dword [ebp - 0x3c]
add esp, 0x10
cmp edx, eax
jne 0x40d25a
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x29]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x40], eax
jne 0x40d238
test edx, edx
jne 0x40d18e
cmp dword [ebp - 0x18], 0x20
jae 0x40d25a
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.0040c479
jmp 0x40d18b
mov ebx, dword [ebp + 8]
jmp 0x40d25a
cmp eax, 3
jne 0x40d25a
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
movsx eax, byte [ebp - 0x29]
push eax
call fcn.00431aa8
cmp eax, ebx
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040a435
mov eax, ebx
call fcn.0041490a
ret 4
Function at 0x40d8e6
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x44be1d
call fcn.00414960
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40d9e6
cmp byte [ebx + 0x3d], 0
je 0x40d9e6
push 0xffffffffffffffff
call fcn.0040d0d8
cmp eax, 0xffffffff
sete al
test al, al
je 0x40d920
xor al, al
jmp 0x40d9e8
xor eax, eax
mov dword [ebp - 0x18], 0xf
push eax
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.0040d810
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x30]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40d97e
sub eax, 1
je 0x40d982
dec eax
sub eax, 1
je 0x40d9d4
xor bl, bl
jmp 0x40d9d6
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, edx
sub esi, eax
je 0x40d9ba
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00432862
add esp, 0x10
cmp esi, eax
jne 0x40d97a
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [ebx + 0x3d], 0
je 0x40d9d4
test esi, esi
jne 0x40d944
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040c479
jmp 0x40d93e
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040a435
mov al, bl
jmp 0x40d9e8
mov al, 1
call fcn.0041490a
ret

Function at 0x40e2ed
Capabilities:
Create process on windows

Disassembly:
push 0x7c
mov eax, 0x44c51e
call fcn.00414960
mov edi, edx
mov esi, ecx
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x84]
push ebx
push eax
call fcn.0042d090
add esp, 0xc
mov dword [ebp - 0x88], 0x44
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], ebx
push esi
lea ecx, [ebp - 0x28]
movups xmmword [ebp - 0x3c], xmm0
call fcn.00404943
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x88]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40e373
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x2c], esi
jmp 0x40e376
mov esi, dword [ebp - 0x2c]
test esi, esi
jne 0x40e39d
cmp byte [edi], 0
je 0x40e39d
call fcn.0040c3c8
push ecx
push dword [ebp - 0x3c]
call fcn.0040c386
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, dword [ebp - 0x2c]
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00401ab7
mov eax, esi
call fcn.0041490a
ret
Function at 0x40e3b0
Capabilities:
Create process on windows

Disassembly:
push 0x74
mov eax, 0x44c54e
call fcn.00414960
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x7c]
push 0x40
push 0
push eax
call fcn.0042d090
add esp, 0xc
mov dword [ebp - 0x80], 0x44
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xorps xmm0, xmm0
lea ecx, [ebp - 0x28]
push 1
mov edx, edi
movups xmmword [ebp - 0x38], xmm0
call fcn.00405c47
and dword [ebp - 4], 0
mov dword [esp], 0x45bf6c
call fcn.004011c0
pop ecx
push eax
push 0x45bf6c
lea ecx, [ebp - 0x28]
call fcn.00401fa0
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
call fcn.00402044
xor edx, edx
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov esi, edx
cmovae eax, dword [ebp - 0x28]
cmp dword [edi + 0x14], 8
jb 0x40e43a
mov edi, dword [edi]
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push edx
push edx
push edx
push edx
push edx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40e460
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40e480
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x40e480
call fcn.0040c3c8
push ecx
push dword [ebp - 0x38]
call fcn.0040c386
push ebx
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401ab7
mov eax, esi
call fcn.0041490a
ret

Function at 0x40ec28
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40ecc8
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x40ec61
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x40ecc8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x40ec78
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x40ecc7
push edi
lea ecx, [ebp - 0xc]
call fcn.0040ba31
push edi
mov edi, dword [ebp - 0xc]
push ebx
push edi
call fcn.0042cb10
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xc]
add esp, 0xc
cmp edx, eax
je 0x40ecb8
mov eax, dword [edx]
mov dword [edx], edi
mov ecx, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov ecx, dword [edx + 8]
mov dword [edx + 8], eax
mov dword [ebp - 4], ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0xc]
call fcn.0040bac9
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40f1b5
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push 0x4c
mov eax, 0x44c776
call fcn.00414960
mov bl, cl
lea ecx, [ebp - 0x28]
call fcn.0040e632
and dword [ebp - 4], 0
mov esi, str.miniloadertmp_
push esi
call fcn.004011c0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401fa0
mov edx, 0x7fff
call fcn.0040f4ba
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.0040f461
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00402044
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.00401ab7
push 8
pop edi
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40f243
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dl, 1
lea ecx, [ebp - 0x40]
call fcn.0040e6f7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], edi
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
test eax, eax
je 0x40f287
cmp dword [ebp - 0x2c], edi
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
jmp 0x40f291
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
test bl, bl
je 0x40f2bf
push ecx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.0040e87e
pop ecx
cmp dword [eax + 0x14], edi
jb 0x40f2ac
mov eax, dword [eax]
push 4
push 0
push eax
call esi
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00401ab7
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00401ab7
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401ab7
call fcn.0041490a
ret
Function at 0x40f4ba
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c7f1
mov eax, dword fs:[0]
push eax
mov eax, 0x13a4
call fcn.00415110
mov eax, dword [0x465070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push 0x45c078
lea ecx, [ebp - 0x28]
call fcn.00409702
and dword [ebp - 4], 0
call fcn.00412d2e
xor esi, esi
lea ecx, [ebp - 0x28]
push 0
inc esi
or ebx, 0xffffffff
push esi
mov dword [ebp - 4], ebx
call fcn.0040a435
call fcn.00412d2e
mov dword [ebp - 0x2c], ebx
mov edx, 0x270
mov dword [ebp - 0x13ac], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
mov dword [ebp + esi*4 - 0x13ac], eax
inc esi
cmp esi, edx
jl 0x40f52b
mov dword [ebp - 0x13b0], edx
lea eax, [ebp - 0x13b0]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x14], ebx
cmp edi, ebx
jne 0x40f574
lea ecx, [ebp - 0x13b0]
call fcn.0040f6e8
cmp eax, ebx
ja 0x40f563
jmp 0x40f580
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040f678
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413e8b
mov esp, ebp
pop ebp
ret

Function at 0x40f6e8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x40f730
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x40f6f8
jmp 0x40f73d
cmp dword [esi], 0x4e0
jb 0x40f73d
call fcn.0040f777
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret
Function at 0x40f777
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x40f787
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x40f7c7
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebx
ret

Function at 0x40f837
Capabilities:
Create directory

Disassembly:
push 0x24
mov eax, 0x44c83a
call fcn.00414960
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
mov esi, dword [ebp + 8]
lea ecx, [ebx + 4]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x30], ebx
mov dword [ebx], 0x45c694
call fcn.00410a08
and dword [ebp - 4], 0
lea ecx, [ebx + 0x18]
and dword [ebx + 0x14], 0
push esi
call fcn.00404943
push edi
lea esi, [ebx + 0x30]
mov byte [ebp - 4], 1
push esi
call fcn.0040f97f
push ecx
mov edx, esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.0040e87e
pop ecx
cmp dword [eax + 0x14], 8
jb 0x40f896
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401ab7
mov eax, ebx
call fcn.0041490a
ret 8

Function at 0x40f8d7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b34a
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x465070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x30]
mov dword [edi], 0x45c694
cmp dword [esi + 0x14], 8
jb 0x40f917
mov eax, dword [esi]
jmp 0x40f919
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call ebx
push ecx
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.0040e87e
pop ecx
cmp dword [eax + 0x14], 8
jb 0x40f936
mov eax, dword [eax]
push eax
call ebx
xor ebx, ebx
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00401ab7
push ebx
push 1
mov ecx, esi
call fcn.00401ab7
push ebx
push 1
lea ecx, [edi + 0x18]
call fcn.00401ab7
lea ecx, [edi + 4]
call fcn.00410b07
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413e8b
mov esp, ebp
pop ebp
ret
Function at 0x415b45
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x43dde4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043dc63

Function at 0x4437d8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00443498
Function at 0x41c4c0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret