joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401172
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
adc dword [ebp - 0x22], edi
mov dword [ebp - 0x39], 7
pop eax
and dword [ebp - 0x46], esi
sub dword [ebp - 0x2f], esi
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
sbb dword [ebp - 0x17], 0x5b
mov ebx, dword [ebp - 0x36]
add dword [ebp - 0x58], 0x46
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
or dword [ebp - 0x29], esi
sub dword [ebp - 0x2a], 0x3c
call fcn.00402439
sub eax, 0x38
mov bh, ah
mov ecx, 0xffffffdd
mov edx, dword [0x405212]
Function at 0x4014ba
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
mov edx, dword [ebp - 5]
sub ah, dh
pop edi
sbb dword [0x40521d], eax
mov ecx, edx
sub dword [ebp - 0x4f], edx
or dword [ebp - 0x36], edx
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
sbb dword [ebp - 0x3a], 0x46
sbb bh, byte [ebp - 0x55]
or esi, 0xffffffdc
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
xor dword [ebp - 0x28], 0xffffff80
and edi, dword [ebp - 0x50]
call 0x40179e
add esi, dword [ebp - 0x33]
sub dword [ebp - 0x41], eax
sub eax, dword [ebp - 0x4b]
sbb ebx, 0x44
mov dword [ebp - 0x28], 0x25
mov edx, dword [ebp - 0xe]
add esp, 4
mov ebx, 0xffffffa1
adc dword [ebp - 0x57], 0x14
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
xor dword [ebp - 0x5b], 0xffffffcc
mov edx, 0xffffff81
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
mov dword [ebp - 0x2b], edi
sbb edi, 0xffffffd0
sbb edi, dword [ebp - 5]
and dword [ebp - 0x33], 0x5f
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
add dword [ebp - 0xe], 0x50
sbb byte [0x4051f8], al
xor dword [ebp - 0x58], 0x1a
sub dword [0x4051c1], esi
lea edx, [0x40544e]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
and dword [ebp - 8], 0xffffffb7
mov ecx, eax
adc dword [ebp - 0x2d], 0xffffffa2
call fcn.00402439
add ebx, dword [0x40527f]
sbb dword [ebp - 0x39], 0xfffffffc
add byte [ebp - 0x2d], ah
xor dword [ebp - 0xe], eax
Function at 0x401532
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
mov edx, dword [ebp - 5]
sub ah, dh
pop edi
sbb dword [0x40521d], eax
mov ecx, edx
sub dword [ebp - 0x4f], edx
or dword [ebp - 0x36], edx
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
sbb dword [ebp - 0x3a], 0x46
sbb bh, byte [ebp - 0x55]
or esi, 0xffffffdc
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
xor dword [ebp - 0x28], 0xffffff80
and edi, dword [ebp - 0x50]
call 0x40179e
add esi, dword [ebp - 0x33]
sub dword [ebp - 0x41], eax
sub eax, dword [ebp - 0x4b]
sbb ebx, 0x44
mov dword [ebp - 0x28], 0x25
mov edx, dword [ebp - 0xe]
add esp, 4
mov ebx, 0xffffffa1
adc dword [ebp - 0x57], 0x14
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
xor dword [ebp - 0x5b], 0xffffffcc
mov edx, 0xffffff81
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
mov dword [ebp - 0x2b], edi
sbb edi, 0xffffffd0
sbb edi, dword [ebp - 5]
and dword [ebp - 0x33], 0x5f
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
add dword [ebp - 0xe], 0x50
sbb byte [0x4051f8], al
xor dword [ebp - 0x58], 0x1a
sub dword [0x4051c1], esi
lea edx, [0x40544e]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
and dword [ebp - 8], 0xffffffb7
mov ecx, eax
adc dword [ebp - 0x2d], 0xffffffa2
call fcn.00402439
add ebx, dword [0x40527f]
sbb dword [ebp - 0x39], 0xfffffffc
add byte [ebp - 0x2d], ah
xor dword [ebp - 0xe], eax
Function at 0x40161b
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
and dword [ebp - 0x4b], 0xffffffd7
sub edi, dword [ebp - 0x49]
sub esp, 0xfffffffc
sbb dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x50]
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, 0
jne fcn.00402439
mov edx, esi
sbb dword [ebp - 0x50], edx
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne fcn.00402439
or ebx, dword [ebp - 0x38]
add dword [ebp - 9], eax
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
sub bl, 0x11
and ebx, 0xffffffcd
and dword [ebp - 0x2a], ebx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
xchg esi, ebx
sbb dword [ebp - 0x49], eax
call fcn.00402439
adc dword [ebp - 0x41], 0xffffffaf
sub dword [ebp - 0x23], eax
sbb dword [ebp - 8], eax
xor ah, byte [ebp - 3]
add esi, dword [0x40527e]
sbb ah, 0x6e
mov edx, dword [ebp - 0x35]
or esi, esi
sub esp, 0xfffffffc
xor dword [ebp - 1], 0xfffffffa
and edx, dword [ebp - 1]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
mov edx, dword [ebp - 0x3b]
or dword [ebp - 0x37], eax
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
mov dword [ebp - 0x15], esi
sbb dword [ebp - 0x55], 0x34
sbb esi, dword [ebp - 0x2d]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
sub dword [ebp - 0x1e], ebx
mov dword [ebp - 0x3c], 0xfb
and ebx, 0x5e
mov edx, dword [ebp - 0x56]
call 0x403786
or dword [ebp - 0x38], ebx
sbb dword [ebp - 1], esi
adc al, 0xe4
mov ecx, 0x66
mov ecx, dword [ebp - 0x2b]
xor esi, dword [ebp - 0x50]
pop ecx
and dword [ebp - 0x58], 0x40
xor ah, 0xdf
add edi, 1
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp eax, 0
jne fcn.00402439
add edi, eax
mov edx, 0x2b
sbb dword [ebp - 8], ebx
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
sbb dword [ebp - 0x56], edi
mov ecx, ebx
xchg ebx, eax
call 0x40195c
or dword [ebp - 0x27], 0x1f
mov edx, ebx
Function at 0x40179e
Capabilities:
Get disk information
Move file

Disassembly:
and dword [ebp - 0x4b], 0xffffffd7
sub edi, dword [ebp - 0x49]
sub esp, 0xfffffffc
sbb dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x50]
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, 0
jne fcn.00402439
mov edx, esi
sbb dword [ebp - 0x50], edx
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne fcn.00402439
or ebx, dword [ebp - 0x38]
add dword [ebp - 9], eax
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
sub bl, 0x11
and ebx, 0xffffffcd
and dword [ebp - 0x2a], ebx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
xchg esi, ebx
sbb dword [ebp - 0x49], eax
call fcn.00402439
adc dword [ebp - 0x41], 0xffffffaf
sub dword [ebp - 0x23], eax
sbb dword [ebp - 8], eax
xor ah, byte [ebp - 3]
add esi, dword [0x40527e]
sbb ah, 0x6e
mov edx, dword [ebp - 0x35]
or esi, esi
sub esp, 0xfffffffc
xor dword [ebp - 1], 0xfffffffa
and edx, dword [ebp - 1]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
mov edx, dword [ebp - 0x3b]
or dword [ebp - 0x37], eax
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
mov dword [ebp - 0x15], esi
sbb dword [ebp - 0x55], 0x34
sbb esi, dword [ebp - 0x2d]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
sub dword [ebp - 0x1e], ebx
mov dword [ebp - 0x3c], 0xfb
and ebx, 0x5e
mov edx, dword [ebp - 0x56]
call 0x403786
or dword [ebp - 0x38], ebx
sbb dword [ebp - 1], esi
adc al, 0xe4
mov ecx, 0x66
mov ecx, dword [ebp - 0x2b]
xor esi, dword [ebp - 0x50]
pop ecx
and dword [ebp - 0x58], 0x40
xor ah, 0xdf
add edi, 1
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp eax, 0
jne fcn.00402439
add edi, eax
mov edx, 0x2b
sbb dword [ebp - 8], ebx
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
sbb dword [ebp - 0x56], edi
mov ecx, ebx
xchg ebx, eax
call 0x40195c
or dword [ebp - 0x27], 0x1f
mov edx, ebx
Function at 0x401e1d
Capabilities:
Get disk information
Read .ini file

Disassembly:
and al, al
or edi, 0x70
and bh, 0x16
pop esi
mov dword [ebp - 0x3f], esi
and dword [ebp - 0x4c], 0x50
lea eax, [0x40544e]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
sbb al, al
sub dword [ebp - 0x58], ebx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
adc byte [ebp - 0x5a], bh
sbb dword [0x4051b1], 0xffffffe3
adc dword [ebp - 0x2a], 0x62
push 0x1c
push 0x405415
lea ebx, [0x405411]
push dword [ebx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor edi, eax
mov eax, edi
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne fcn.00402439
sub dword [ebp - 0x34], edi
adc ebx, edi
call fcn.00402439
mov ecx, ebx
sub edi, ecx
mov edx, edi
adc dword [ebp - 0x3c], eax
and edi, edi
adc dword [ebp - 0x37], 8
sub dword [ebp - 4], 0x5d
add esp, 4
mov ecx, dword [ebp - 0x3d]
sbb dword [ebp - 0x33], ecx
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
adc esi, 0xffffffcb
or dword [ebp - 0x45], edi
mov edx, dword [ebp - 0x35]
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x403414
mov dword [ebp - 0x14], 0x3d
or dword [ebp - 0x25], 0x14
sbb dword [ebp - 0x26], edi
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne 0x403414
add ebx, 0x77
mov edx, eax
and dword [ebp - 0x30], esi
call fcn.0040431c
mov dword [ebp - 8], 0x8b
mov ecx, 0xffffffc2
mov dword [ebp - 0x2f], esi
adc dword [ebp - 0x5b], esi
sub esp, 0xfffffffc
mov edx, 0x34
xchg edx, eax
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
add bh, byte [ebp - 0x39]
add ebx, ebx
mov esi, ebx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
mov edx, esi
sbb dword [ebp - 0x55], esi
xor ebx, 0x30
adc dword [ebp - 0x25], ebx
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, 0
jne fcn.00402439
sbb dword [ebp - 0x4a], ebx
sbb dword [ebp - 0x40], edi
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne fcn.00402439
add bh, 0xa6
adc dword [ebp - 0x3a], esi
and dword [ebp - 0x33], 0x28
call 0x4018bd
sub eax, dword [ebp - 0x43]
xor edi, 0x7c
Function at 0x401ebd
Capabilities:
Authenticate hmac
Get disk information
Move file
Parse pe header
Read .ini file

Disassembly:
and al, al
or edi, 0x70
and bh, 0x16
pop esi
mov dword [ebp - 0x3f], esi
and dword [ebp - 0x4c], 0x50
lea eax, [0x40544e]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
sbb al, al
sub dword [ebp - 0x58], ebx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
adc byte [ebp - 0x5a], bh
sbb dword [0x4051b1], 0xffffffe3
adc dword [ebp - 0x2a], 0x62
push 0x1c
push 0x405415
lea ebx, [0x405411]
push dword [ebx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor edi, eax
mov eax, edi
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne fcn.00402439
sub dword [ebp - 0x34], edi
adc ebx, edi
call fcn.00402439
mov ecx, ebx
sub edi, ecx
mov edx, edi
adc dword [ebp - 0x3c], eax
and edi, edi
adc dword [ebp - 0x37], 8
sub dword [ebp - 4], 0x5d
add esp, 4
mov ecx, dword [ebp - 0x3d]
sbb dword [ebp - 0x33], ecx
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
adc esi, 0xffffffcb
or dword [ebp - 0x45], edi
mov edx, dword [ebp - 0x35]
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x403414
mov dword [ebp - 0x14], 0x3d
or dword [ebp - 0x25], 0x14
sbb dword [ebp - 0x26], edi
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne 0x403414
add ebx, 0x77
mov edx, eax
and dword [ebp - 0x30], esi
call fcn.0040431c
mov dword [ebp - 8], 0x8b
mov ecx, 0xffffffc2
mov dword [ebp - 0x2f], esi
adc dword [ebp - 0x5b], esi
sub esp, 0xfffffffc
mov edx, 0x34
xchg edx, eax
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
add bh, byte [ebp - 0x39]
add ebx, ebx
mov esi, ebx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
mov edx, esi
sbb dword [ebp - 0x55], esi
xor ebx, 0x30
adc dword [ebp - 0x25], ebx
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, 0
jne fcn.00402439
sbb dword [ebp - 0x4a], ebx
sbb dword [ebp - 0x40], edi
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne fcn.00402439
add bh, 0xa6
adc dword [ebp - 0x3a], esi
and dword [ebp - 0x33], 0x28
call 0x4018bd
sub eax, dword [ebp - 0x43]
xor edi, 0x7c
Function at 0x4021f0
Capabilities:
Authenticate hmac
Get disk information
Move file
Read .ini file

Disassembly:
or ebx, 0x65
sbb dword [ebp - 0x1c], eax
sub esp, 0xfffffffc
add eax, dword [ebp - 0x50]
adc dword [ebp - 0x36], 0xffffffd7
xor dword [ebp - 0x31], edi
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne 0x4044ea
sub dword [ebp - 0x15], eax
adc dword [ebp - 0x32], 0x58
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
add dword [ebp - 0x17], ebx
add dword [ebp - 0xa], 0xffffff8c
sbb dword [ebp - 0x44], 0x39
adc bh, 0x7f
call 0x403c1e
or ebx, 0xd
adc dword [ebp - 0x56], eax
and dword [0x40513a], 0x41
sbb dword [ebp - 0x1c], 0x73
mov edx, 0xffffff94
add eax, dword [ebp - 0x1b]
add esp, 4
adc ebx, 2
add edi, 0xffffff8a
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
test eax, eax
jne fcn.00402439
sub esi, dword [ebp - 0x46]
sbb bh, byte [ebp - 0xc]
and edi, 0x32
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne fcn.00402439
and dword [ebp - 0x59], esi
sbb dword [ebp - 0xb], esi
call fcn.00402b7d
sub ah, byte [ebp - 0x45]
and dword [0x405156], 0xffffffe7
xor eax, 0x16

Function at 0x40227b
Capabilities:
Authenticate hmac
Get disk information
Move file
Read .ini file

Disassembly:
xor dword [ebp - 0x39], esi
and dword [0x40518f], ebx
mov dword [0x405197], 5
add esp, 4
or dword [0x405163], eax
sbb dword [ebp - 0x35], edi
add dword [ebp - 0xd], eax
xor ebx, 0xfffffffa
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne 0x401cc1
mov esi, dword [ebp - 0x19]
mov edx, 0xfffffff1
or esi, 0xffffff8e
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
test eax, eax
jne 0x401cc1
mov ecx, ebx
xor esi, ecx
call 0x401ebd
sbb dword [ebp - 0x1b], ecx
sbb edi, 0x2d
mov dword [ebp - 0x42], edi

Function at 0x40243d
Capabilities:
Get disk information

Disassembly:
mov dword [ebp - 0x57], 0xff
mov eax, esi
add dword [ebp - 7], esi
pop edi
adc ebx, 0x41
sbb esi, edi
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
xor dword [ebp], esi
and edi, dword [ebp - 0x26]
mov ecx, dword [ebp - 0x3f]
adc edi, dword [ebp - 0x27]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
adc esi, ebx
xor ebx, 0x53
mov eax, esi
xor eax, 0x1d
call fcn.0040370f
mov edx, 0x46
sub dword [ebp - 0x3a], eax
add eax, dword [0x4052ae]
or eax, dword [ebp - 0x23]
Function at 0x4024b3
Capabilities:
Authenticate hmac
Get disk information
Move file
Parse pe header
Read .ini file

Disassembly:
xor dword [ebp - 0x3b], 0xffffff9a
sub dword [ebp - 0x40], esi
pop ecx
adc eax, dword [ebp - 0x37]
sbb dword [ebp - 0x55], 0xffffff94
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, 0
jne fcn.00402439
or ebx, esi
mov ecx, 0x6d
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
adc ebx, 0xfffffffa
mov eax, 0x38
or dword [ebp - 0x45], ebx
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
adc ebx, 0xffffff94
or esi, 0x4d
mov ecx, 0xffffffb7
call fcn.0040415e
xor eax, dword [ebp - 0x56]
mov edx, eax
or esi, 0x74
sbb al, 0x34
sbb dword [ebp - 0xc], ebx
sub ebx, esi
sub esp, 0xfffffffc
add dword [ebp - 3], esi
mov ecx, dword [ebp - 5]
sbb dword [ebp - 0x52], ebx
or eax, dword [ebp - 0x2f]
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 0
jne 0x4010dd
sbb eax, eax
xchg edi, eax
sub esi, edi
adc esi, 0x2e
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp eax, 0
jne 0x4010dd
mov ecx, 0x49
xor dword [ebp - 3], ebx
xor ebx, eax
adc dword [ebp - 0x24], 0xffffffbf
call fcn.00403ade
add ebx, 0xffffffeb
mov edx, esi
add dword [ebp - 0x3c], ecx

Function at 0x40253e
Capabilities:
Move file
Read .ini file

Disassembly:
and edi, 0xffffffee
or byte [ebp - 0x13], ah
xchg ebx, esi
add esp, 4
and dword [ebp - 0x3f], 0xffffffd0
mov edx, 0x6f
adc dword [ebp - 0x58], 0x73
sub dword [ebp - 0x4c], ebx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
mov dword [ebp - 0x43], edi
sub dword [ebp - 0x22], ebx
lea ecx, [0x40544e]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
and dword [ebp - 0x22], 0xffffffc3
adc esi, 0xffffffb5
mov dword [ebp - 0x3b], ebx
sub dword [ebp - 0x41], esi
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne fcn.00402439
sbb dword [ebp - 0x49], 0xffffffa8
add ebx, dword [ebp - 0x2d]
adc bh, byte [ebp - 0x22]
and dword [ebp - 0x3c], edi
call 0x4025eb
add edi, dword [0x40528d]
sbb bh, byte [ebp - 0x56]
mov ebx, esi
mov eax, 0xffffffd0
pop esi
adc eax, edi
sub esi, esi
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
xor edi, dword [ebp - 0x21]
xor edi, 0xfffffff0
or esi, esi
mov edx, dword [ebp - 0xe]
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
mov ecx, 0xffffff82
mov edx, 0x68
mov eax, 0xffffffdb
or eax, eax
lea edi, [0x40544e]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x405176], ebx
sbb bh, bl
or al, al
or ebx, ebx
call fcn.00402439
add ah, 0xd
xor esi, dword [0x4051e1]
add dword [ebp - 7], esi
xor dword [ebp - 0x43], esi
Function at 0x4025eb
Capabilities:
Move file
Read .ini file

Disassembly:
and edi, 0xffffffee
or byte [ebp - 0x13], ah
xchg ebx, esi
add esp, 4
and dword [ebp - 0x3f], 0xffffffd0
mov edx, 0x6f
adc dword [ebp - 0x58], 0x73
sub dword [ebp - 0x4c], ebx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
mov dword [ebp - 0x43], edi
sub dword [ebp - 0x22], ebx
lea ecx, [0x40544e]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
and dword [ebp - 0x22], 0xffffffc3
adc esi, 0xffffffb5
mov dword [ebp - 0x3b], ebx
sub dword [ebp - 0x41], esi
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne fcn.00402439
sbb dword [ebp - 0x49], 0xffffffa8
add ebx, dword [ebp - 0x2d]
adc bh, byte [ebp - 0x22]
and dword [ebp - 0x3c], edi
call 0x4025eb
add edi, dword [0x40528d]
sbb bh, byte [ebp - 0x56]
mov ebx, esi
mov eax, 0xffffffd0
pop esi
adc eax, edi
sub esi, esi
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
xor edi, dword [ebp - 0x21]
xor edi, 0xfffffff0
or esi, esi
mov edx, dword [ebp - 0xe]
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
mov ecx, 0xffffff82
mov edx, 0x68
mov eax, 0xffffffdb
or eax, eax
lea edi, [0x40544e]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x405176], ebx
sbb bh, bl
or al, al
or ebx, ebx
call fcn.00402439
add ah, 0xd
xor esi, dword [0x4051e1]
add dword [ebp - 7], esi
xor dword [ebp - 0x43], esi

Function at 0x4027ab
Capabilities:
Move file
Read .ini file

Disassembly:
or dword [ebp - 0x50], edi
adc dword [0x405261], 0x6b
xor dword [ebp - 0x1a], edi
sub esp, 0xfffffffc
mov edx, 0xffffffbf
add byte [ebp - 0x3f], dl
sbb ebx, edx
or dword [ebp - 0x21], 0xffffffcb
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne fcn.00402439
and ebx, dword [ebp - 0x3f]
mov esi, esi
mov edx, dword [ebp - 0x11]
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
add dword [ebp - 0x4a], esi
mov edx, 0x52
call 0x403d1d
sbb eax, dword [ebp - 0x15]
or ebx, dword [ebp - 0x54]
and esi, dword [ebp - 0x4c]