joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a96
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x404610
call fcn.00402ba4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x4064a0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x402835
cmp eax, esi
jne 0x402828
xor esi, esi
inc esi
mov ebx, esi
jmp 0x402838
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40280f
xor esi, esi
inc esi
mov eax, dword [0x40649c]
cmp eax, esi
jne 0x40284b
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40287a
mov eax, dword [0x40649c]
test eax, eax
jne 0x402874
mov dword [0x40649c], esi
push 0x404250
push 0x404248
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40287a
jmp 0x4029a2
mov dword [0x4060d4], esi
mov eax, dword [0x40649c]
cmp eax, esi
jne 0x40289e
push 0x404244
push 0x404230
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40649c], 2
test ebx, ebx
jne 0x4028aa
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x4064ac], 0
je 0x4028ce
push 0x4064ac
call fcn.00402da2
pop ecx
test eax, eax
je 0x4028ce
push 0
push 2
push 0
call dword [0x4064ac]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x40292a
test al, al
je 0x4028e8
cmp dword [ebp - 0x1c], 0
jne 0x40292a
mov al, byte [esi]
test al, al
je 0x4028f8
cmp al, 0x20
ja 0x4028f8
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4028e8
test byte [ebp - 0x3c], 1
je 0x402904
movzx eax, word [ebp - 0x38]
jmp 0x402907
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x4060d0], eax
cmp dword [0x4060c4], 0
jne 0x40297e
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x402939
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x40294c
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x4028d5
cmp dword [0x4060d4], 0
jne 0x40298d
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4060d0]
jmp 0x4029ae
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00402be9
ret
call fcn.004026b1
jmp 0x4027d5
Function at 0x402ff8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x406410], 0
push esi
jne 0x402f6b
call fcn.00402e96
test eax, eax
je 0x402fae
mov eax, dword [0x406410]
cmp eax, 1
jne 0x402f8c
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x402fae
pop esi
ret
push eax
call dword [0x406418]
test eax, eax
jne 0x402ff6
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x402fb2
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x406410]
call dword [0x406418]
mov edi, eax
test edi, edi
je 0x402fd9
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x402ff5
lea edi, [esi + 0xff0]
push esi
push dword [0x406410]
call dword [0x406414]
add esi, 0x10
cmp esi, edi
jb 0x402fdf
mov eax, esi
pop edi
pop esi
ret
jmp 0x402f58

Function at 0x403181
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x40427c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00403116
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4031d0
cmp dword [ebp - 0x1c], 5
jb 0x4031e8
jmp 0x4031e4
cmp dword [ebp - 0x10], 1
jne 0x4031e8
cmp dword [ebp - 0x1c], 4
ja 0x4031e4
jne 0x4031e8
cmp dword [ebp - 0x18], 0
jbe 0x4031e8
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x404330
call fcn.0040302e
test eax, eax
jge 0x403209
mov byte [0x406494], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00402765
add ebp, 0x78
leave
ret
Function at 0x109e4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x109e41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x109e407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109e406a
add dl, dl
jne 0x109e4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109e40dc
xor eax, eax
add dl, dl
jne 0x109e4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109e417d
add dl, dl
jne 0x109e40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109e40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109e40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109e40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x109e40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x109e4075
mov eax, 1
add dl, dl
jne 0x109e40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109e40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x109e40e1
sub eax, ebx
mov ebx, 1
jne 0x109e4128
mov ecx, 1
add dl, dl
jne 0x109e410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x109e4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x109e4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x109e4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x109e413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x109e414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x109e4136
cmp eax, 0x7d00
jae 0x109e416d
cmp eax, 0x500
jb 0x109e4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x109e4075
cmp eax, 0x7f
ja 0x109e4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x109e4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x109e419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x109e4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x27cb2107
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2b860168
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1002920c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x7f69
push 1
lea eax, [ebp + 8]
push eax
push 0xe64
lea eax, [ebp - 0x10]
push eax
call fcn.10028a3c
add esp, 0x14
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10029246
xor eax, eax
jmp 0x10029360
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10029264
xor eax, eax
jmp 0x10029360
push dword [ebp - 8]
push 1
lea eax, [ebp - 0xc]
push eax
push 0x7856
call fcn.10028819
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x10029287
xor eax, eax
jmp 0x10029360
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4186
lea eax, [ebp - 0xc]
push eax
call fcn.100290da
add esp, 0x1c
push dword [ebp - 8]
push dword [ebp + 8]
push 0
push dword [ebp - 4]
push 0x7787
call fcn.10024e6f
add esp, 0x14
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x100292e2
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1002915e
add esp, 0xc
push dword [ebp - 4]
call fcn.10028704
pop ecx
test eax, eax
jne 0x100292f3
xor eax, eax
jmp 0x10029360
push 1
lea eax, [ebp - 4]
push eax
push 0x6047
call fcn.100291c6
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10029348
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10029325
xor eax, eax
jmp 0x10029360
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002933e
xor eax, eax
jmp 0x10029360
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10029359
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002935d
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1006b5b6
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10071330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005aebc
mov dword [ebp - 0x14], eax
cmp dword [0x1065ed5c], esi
jne 0x1006b6a9
push 0x800
push esi
push 0x1000783c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1006b636
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006b789
push esi
push esi
push 0x1000783c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1006b789
push 0x10007854
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006b789
push eax
call ebx
push 0x10007860
push edi
mov dword [0x1065ed5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007870
push edi
mov dword [0x1065ed60], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007884
push edi
mov dword [0x1065ed64], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065ed6c], eax
test eax, eax
je 0x1006b6a6
push 0x100078a0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065ed68], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006b6ce
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006b6c1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1006b6e3
push 4
pop eax
jmp 0x1006b78b
cmp dword [ebp - 0x14], esi
je 0x1006b6e3
push dword [0x1065ed5c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006b6c8
mov eax, dword [0x1065ed68]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006b741
cmp dword [0x1065ed6c], edi
je 0x1006b741
push eax
call ebx
push dword [0x1065ed6c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006b741
test eax, eax
je 0x1006b741
call ecx
test eax, eax
je 0x1006b736
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006b736
test byte [ebp - 8], 1
jne 0x1006b741
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006b771
mov eax, dword [0x1065ed60]
cmp eax, edi
je 0x1006b76e
push eax
call ebx
test eax, eax
je 0x1006b76e
call eax
mov esi, eax
test esi, esi
je 0x1006b76e
mov eax, dword [0x1065ed64]
cmp eax, edi
je 0x1006b76e
push eax
call ebx
test eax, eax
je 0x1006b76e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065ed5c]
call ebx
test eax, eax
je 0x1006b789
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006b78b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x635f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x635ffc
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x636045
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0064f4a0
add esp, 8
test eax, eax
jne 0x636043
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x636047
jmp 0x635ff3
xor eax, eax
mov esp, ebp
pop ebp
Function at 0x63ec8f
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00638667
add esp, 4
and eax, 0xff
test eax, eax
je 0x63ed18
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.00649bc0
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x63ed16
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x63ed16
jmp 0x63ed18
jmp 0x63ec98
mov esp, ebp
pop ebp
ret

Function at 0x63f193
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0x676438]
test eax, eax
jne 0x63f1a7
call fcn.0063f0c4
xor ecx, ecx
mov cl, byte [0x676435]
test ecx, ecx
jne 0x63f22e
xor edx, edx
mov dl, byte [0x676434]
test edx, edx
jne 0x63f22e
cmp dword [0x676640], 0
je 0x63f209
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x180
mov ecx, dword [0x676640]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
push 0x186
mov eax, dword [0x676640]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x676640]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x63f22e
push 0x10001
push 0x676438
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x63f22e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x64233a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x64234a
xor eax, eax
jmp 0x642513
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x6424cb
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x673ef4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x673ef4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x673ef4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x673ef4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x673ef4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x673ef4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x673ef4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x673ef4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x642353
cmp dword [ebp + 0x10], 0
je 0x64250d
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x673ef4]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x6424d1
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
Function at 0x64bd50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x671518
cmp edx, dword [eax]
je 0x64bd72
add eax, 8
inc ecx
cmp eax, 0x6715a8
jl 0x64bd63
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x671518]
jne 0x64bea0
mov eax, dword [0x6766c0]
cmp eax, 1
je 0x64be7a
test eax, eax
jne 0x64bda3
cmp dword [0x671254], 1
je 0x64be7a
cmp edx, 0xfc
je 0x64bea0
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64bdda
lea eax, [ebp - 0x1a4]
push 0x675310
push eax
call fcn.00649d20
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00649ed0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64be1d
lea eax, [ebp - 0x1a4]
push eax
call fcn.00649ed0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x67530c
push edi
call fcn.00649f50
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x6752f0
push eax
call fcn.00649d20
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00649d30
lea eax, [ebp - 0xa0]
push 0x6752ec
push eax
call fcn.00649d30
push dword [esi + 0x67151c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00649d30
push 0x12010
lea eax, [ebp - 0xa0]
push 0x6752c4
push eax
call fcn.0064e318
add esp, 0x2c
pop edi
jmp 0x64bea0
lea eax, [ebp + 8]
lea esi, [esi + 0x67151c]
push 0
push eax
push dword [esi]
call fcn.00649ed0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4036d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4036f7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4036ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
ret
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
ret

Function at 0x403700
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405c70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
test esi, esi
jne 0x40373f
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40376e
mov dword [ebp - 4], 0
push esi
call fcn.004036d0
push esi
call fcn.004033d0
add esp, 8
jmp 0x403767
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40382e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40381a
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov byte [ebp - 0x128], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x127]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 0x16]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x18]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x1a]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x1c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x1e]
and edx, 0xffff
push edx
push esi
push str._s._x_x_x_x_x
push 0x103
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x24
push 3
lea ecx, [ebp - 0x128]
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call esi
push 4
push 0
lea edx, [ebp - 0x128]
push edx
call esi
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret