joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3eec
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
call fcn.00406ec4
xor eax, eax
push ebp
push 0x4c3f93
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0x4c3fac
mov eax, dword [ebp + 8]
push eax
call fcn.004440e8
test al, al
je 0x4c3f6d
lea eax, [ebp - 4]
push eax
mov ecx, 0x32
mov edx, 0xb
mov eax, dword [ebp + 8]
call fcn.00406f54
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004c40bc
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4d5ff0]
add eax, 8
mov ecx, 0
call fcn.0040775c
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x444ed0
push 0
push 0
call sub.kernel32.dll_CreateThread_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3f9a
lea eax, [ebp - 0xc]
call fcn.00407510
lea eax, [ebp - 4]
call fcn.004066e0
lea eax, [ebp + 8]
call fcn.004066e0
ret

Function at 0x4c3fb4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
call fcn.00406ec4
xor eax, eax
push ebp
push 0x4c405b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x10]
mov edx, 0x4c4074
call fcn.00406e50
je 0x4c3fff
mov eax, dword [ebp + 0x10]
mov edx, 0x4c4090
call fcn.00406e50
je 0x4c3fff
mov eax, dword [ebp + 0x10]
mov edx, 0x4c40ac
call fcn.00406e50
jne 0x4c4045
cmp dword [ebx], 0xe
jne 0x4c402e
push ebx
call fcn.004c3e68
test al, al
je 0x4c402e
mov eax, dword [0x4d5fe0]
cmp byte [eax], 0
je 0x4c402e
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x444ed0
push 0
push 0
call sub.kernel32.dll_CreateThread_1
cmp dword [ebx], 0xf
jne 0x4c4045
push ebx
call fcn.004c3e68
test al, al
je 0x4c4045
mov eax, dword [0x4d5fe0]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4062
lea eax, [ebp + 0x10]
call fcn.004066e0
ret

Function at 0x4c5bc8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004c5bac
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
cmp word [edi], 0x5a4d
jne 0x4c5c54
mov eax, dword [edi + 0x3c]
mov ecx, edi
add eax, ecx
test eax, eax
je 0x4c5c54
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, ecx
add edx, dword [eax + 4]
mov dword [ebp - 0xc], edx
test esi, esi
je 0x4c5c54
jmp 0x4c5c4e
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0xc]
ja 0x4c5c54
cmp dword [esi + 0x10], 0
je 0x4c5c4b
mov ebx, edi
add ebx, dword [esi + 0x10]
jmp 0x4c5c46
mov eax, dword [ebx]
cmp eax, dword [ebp + 0xc]
jne 0x4c5c43
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4c5c43
mov eax, dword [ebp + 0x10]
mov dword [ebx], eax
add ebx, 4
cmp dword [ebx], 0
jne 0x4c5c25
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x4c5c10
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c618c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407508
xor eax, eax
push ebp
push 0x4c61ed
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
mov ecx, ebx
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00413e58
mov eax, dword [ebp - 8]
call fcn.004075ac
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c61f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407518
ret

Function at 0x4c61fc
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c639c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c637f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
call sub.ws2_32.dll_getpeername
test eax, eax
jne 0x4c6371
movzx eax, word [ebp - 0x2e]
push eax
call sub.ws2_32.dll_ntohs
movzx edi, ax
push dword [ebp - 0x2c]
call sub.ws2_32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 4]
call fcn.004076ac
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x40]
push eax
push esi
call sub.ws2_32.dll_getsockname
test eax, eax
jne 0x4c6371
movzx eax, word [ebp - 0x3e]
push eax
call sub.ws2_32.dll_ntohs
movzx eax, ax
mov dword [ebp - 0x1c], eax
cmp edi, 0x50
je 0x4c6371
mov eax, dword [0x4dc76c]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4c6371
inc eax
mov dword [ebp - 0x20], eax
xor ebx, ebx
mov edx, ebx
mov eax, dword [0x4dc76c]
call fcn.004ce24c
cmp edi, dword [eax + 4]
jne 0x4c6367
mov edx, ebx
mov eax, dword [0x4dc76c]
call fcn.004ce24c
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00407c90
jne 0x4c6367
mov edx, ebx
mov eax, dword [0x4dc76c]
call fcn.004ce24c
cmp esi, dword [eax + 0x10]
jne 0x4c6367
mov edx, ebx
mov eax, dword [0x4dc76c]
call fcn.004ce24c
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x1c]
jne 0x4c6367
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x64], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0x11
mov dword [ebp - 0x58], edi
mov byte [ebp - 0x54], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
lea edx, [ebp - 0x68]
mov ecx, 4
mov eax, 0x4c63b8
call fcn.004c618c
push 1
mov edx, ebx
mov eax, dword [0x4dc76c]
call fcn.004ce24c
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
call fcn.004c4bfc
jmp 0x4c6371
inc ebx
dec dword [ebp - 0x20]
jne 0x4c62b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6386
ret
Function at 0x4c640c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c65a9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c658c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
call sub.ws2_32.dll_getpeername
test eax, eax
jne 0x4c657e
movzx eax, word [ebp - 0x26]
push eax
call sub.ws2_32.dll_ntohs
movzx edi, ax
push dword [ebp - 0x24]
call sub.ws2_32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 4]
call fcn.004076ac
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
push esi
call sub.ws2_32.dll_getsockname
test eax, eax
jne 0x4c657e
movzx eax, word [ebp - 0x36]
push eax
call sub.ws2_32.dll_ntohs
movzx eax, ax
mov dword [ebp - 0x14], eax
cmp edi, 0x50
je 0x4c657e
mov eax, dword [0x4dc76c]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4c657e
inc eax
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov edx, ebx
mov eax, dword [0x4dc76c]
call fcn.004ce24c
cmp edi, dword [eax + 4]
jne 0x4c6574
mov edx, ebx
mov eax, dword [0x4dc76c]
call fcn.004ce24c
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00407c90
jne 0x4c6574
mov edx, ebx
mov eax, dword [0x4dc76c]
call fcn.004ce24c
cmp esi, dword [eax + 0x10]
jne 0x4c6574
mov edx, ebx
mov eax, dword [0x4dc76c]
call fcn.004ce24c
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x14]
jne 0x4c6574
mov dword [ebp - 0x60], ebx
mov byte [ebp - 0x5c], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0x11
mov dword [ebp - 0x50], edi
mov byte [ebp - 0x4c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea edx, [ebp - 0x60]
mov ecx, 4
mov eax, 0x4c65c4
call fcn.004c618c
push 0
mov edx, ebx
mov eax, dword [0x4dc76c]
call fcn.004ce24c
mov edx, dword [ebp - 8]
mov ecx, dword [edx]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
call fcn.004c4bfc
jmp 0x4c657e
inc ebx
dec dword [ebp - 0x18]
jne 0x4c64bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6593
ret
Function at 0x4c660c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c66ef
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 2]
push eax
call sub.ws2_32.dll_ntohs
movzx ebx, ax
push dword [esi + 4]
call sub.ws2_32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 4]
call fcn.004076ac
cmp ebx, 0x50
je 0x4c66d9
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ws2_32.dll_getsockname
test eax, eax
jne 0x4c66d9
movzx eax, word [ebp - 0x1a]
push eax
call sub.ws2_32.dll_ntohs
movzx edi, ax
mov dl, 1
mov eax, dword [0x4c425c]
call fcn.004c4748
mov esi, eax
mov dword [esi + 4], ebx
lea eax, [esi + 0xc]
mov edx, dword [ebp - 4]
call fcn.00407520
mov eax, dword [ebp - 8]
mov dword [esi + 0x10], eax
mov dword [esi + 8], edi
mov edx, esi
mov eax, dword [0x4dc76c]
call fcn.004ce544
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x34]
mov ecx, 2
mov eax, 0x4c670c
call fcn.004c618c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c66f6
lea eax, [ebp - 4]
call fcn.00407510
ret
Function at 0x401488
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x42f9d0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40151d
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014da
cmp dword [ebp + 0x10], ebx
jne 0x401511
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401488
test eax, eax
jne 0x4014ec
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014c1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.004059f1
cmp eax, ebx
je 0x401524
push ebx
push dword [0x42f9d0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x40151d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42f9d0], ebx
jne 0x40151a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x40151a
jmp 0x40151d
Function at 0x4055e7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x42bd38
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x42bd38], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405622
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40575e
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40577b
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x40577e
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4057ad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4057f1
test edi, edi
jne 0x4057b8
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4057eb

Function at 0x4057f5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405866
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x400
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405855
cmp dword [ebp + 0x14], 1
je 0x405857
cmp dword [ebp + 0x14], 2
je 0x405857
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405aaf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42bd80
push esi
call fcn.0040590e
push esi
call fcn.004056ed
mov edi, eax
test edi, edi
jne 0x405ad0
xor eax, eax
jmp 0x405b28
push edi
call fcn.00405930
test byte [0x42f948], 0x80
je 0x405ae9
mov al, byte [edi]
test al, al
je 0x405acc
cmp al, 0x5c
je 0x405acc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x405b09
push esi
call fcn.004059ca
test eax, eax
je 0x405b03
test byte [eax], 0x10
je 0x405b2d
push esi
call fcn.00405a88
push esi
call ebx
cmp eax, edi
jg 0x405af4
push esi
call fcn.00405a5b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405b27
Function at 0x405ddd
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.004059f1
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405e01
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405f3a
test esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42c180], 0x4c554e
mov edi, 0x400
mov ebp, 0x42c180
je 0x405e45
push 1
push 0
push esi
call fcn.0040577e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405f40
cmp eax, edi
jg 0x405f40
push edi
mov esi, 0x42cac0
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405f40
cmp eax, edi
jg 0x405f40
push esi
push ebp
push str._s_s_r_n
push 0x42c580
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x42f8f0]
push dword [eax + 0x128]
push esi
call fcn.00405b87
push 4
push 0xc0000000
push esi
call fcn.0040577e
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405f3a
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405f33
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405f33
cmp edi, dword [esp + 0x18]
jne 0x405f33
push str._Rename__r_n
push esi
call fcn.00405b31
test eax, eax
jne 0x405f47
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.0040590e
add edi, 0xa
mov eax, edi
push ebx
push 0x42c580
add eax, esi
push eax
call fcn.0040573a
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x42f9b0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x4086bc
add eax, 0xa
push eax
call fcn.00405b31
test eax, eax
je 0x405efe
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405f6e
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405f63
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405f00
Function at 0x405f76
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405aaf
mov ecx, dword [ebp + 0xc]
test cl, 8
mov dword [ebp - 8], eax
je 0x405fab
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42f9a8], eax
jmp 0x40613d
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x405fc6
test eax, eax
je 0x4060e8
test cl, 2
je 0x4060e8
push edi
push ebx
mov esi, 0x42cec0
push esi
call fcn.0040590e
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405fe9
push str..
push esi
call edi
jmp 0x405fef
push ebx
call fcn.00405a88
cmp byte [ebx], 0
jne 0x405ffd
cmp byte [0x42cec0], 0x5c
jne 0x406005
push 0x408290
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4060dd
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.004056ac
cmp byte [eax], 0
je 0x406048
cmp byte [ebp - 0x18], 0
je 0x406048
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40605e
mov al, byte [esi + 1]
test al, al
je 0x4060bc
cmp al, 0x2e
jne 0x40605e
cmp byte [esi + 2], 0
je 0x4060bc
push esi
push edi
call fcn.0040590e
test byte [ebp - 0x148], 0x10
je 0x406083
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4060bc
push dword [ebp + 0xc]
push ebx
call fcn.00405f76
jmp 0x4060bc
push ebx
call fcn.0040575e
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4060b4
test byte [ebp + 0xc], 4
je 0x4060ac
push ebx
push 0xfffffffffffffff1
call fcn.0040496a
push 0
push ebx
call fcn.00405ddd
jmp 0x4060bc
inc dword [0x42f9a8]
jmp 0x4060bc
push ebx
push 0xfffffffffffffff2
call fcn.0040496a
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40602a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x4060e7
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40613c
cmp dword [ebp - 8], esi
je 0x40612c
push ebx
call fcn.004059ca
test eax, eax
je 0x40613c
push ebx
call fcn.00405a5b
push ebx
call fcn.0040575e
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x406134
test byte [ebp + 0xc], 4
je 0x40612c
push ebx
push 0xfffffffffffffff1
call fcn.0040496a
push esi
push ebx
call fcn.00405ddd
jmp 0x40613c
inc dword [0x42f9a8]
jmp 0x40613c
push ebx
push 0xffffffffffffffe5
call fcn.0040496a
pop esi
pop ebx
leave
ret 8
Function at 0x406142
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42d2c4], 0
jne 0x40617d
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406156
mov dword [ecx*4 + 0x42d2c0], eax
inc ecx
cmp ecx, 0x100
jl 0x406151
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4061aa
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42d2c0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40618b
not eax
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x58e64e28
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x109f70cd
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x438c94
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
add ebx, 0xa8ccb350
call fcn.00438cc9
push edi
pop edi
xor dword [eax], esi
add ebx, edi
inc eax
add ebx, 0x70f1197c
cmp eax, edx
jne fcn.00438c94
and ebx, edi
sub edi, ebx
mov edi, ebx
ret
Function at 0x401000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42b2bb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x438ddc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], vtable.ActiveScriptSite.0
mov dword [esi + 4], vtable.ActiveScriptSite.1.0
xor edi, edi
mov dword [esi + 8], vtable.CArray_class_ExposedObject___class_ExposedObject__.0
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x1c]
mov dword [esp + 0x14], edi
call fcn.00409b08
mov eax, 1
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x401cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401d09
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401d44
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401d40
lea ebx, [ebx]
cmp esi, eax
jae 0x401d44
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401d30
cmp esi, eax
jb 0x401d4a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret