joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401443
pop dword [ebp - 0x28]
mov eax, 0x17178016
sub eax, 0x16d76bd3
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc51c4a34
sub dword [ebp - 0x38], 0x76ca04e9
mov dword [ebp - 0x34], 0x4eab2e31
add dword [ebp - 0x34], 0xe3881e14
mov dword [ebp - 0x30], 0xe4f87409
add dword [ebp - 0x30], 0x6753d025
mov dword [ebp - 0x2c], 0xba95b337
add dword [ebp - 0x2c], 0x456a4cc9
lea eax, [ebp - 0x38]
push eax
mov eax, 0x89320baa
sub eax, 0x88f18aa6
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x4956e9e3
sub dword [ebp - 0x38], 0xd4e4808d
mov dword [ebp - 0x34], 0x2f4e535d
add dword [ebp - 0x34], 0x121e0e18
mov dword [ebp - 0x30], 0x7326ef12
sub dword [ebp - 0x30], 0xfb782a6
mov dword [ebp - 0x2c], 0x70b35c47
sub dword [ebp - 0x2c], 0x70b35c47
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3930e
push 0
call eax
mov ecx, 0x7e986c4
sub ecx, 0x7e93b2a
mov edx, eax
mov esi, 0x80678aa8
sub esi, 0x8020a6a8
add esi, dword [ebp - 0x28]
mov ebx, 0x5560795b
xor dword [ebp - 0xc], ecx
mov edi, dword [esi]
mov dword [ebp - 0x24], 0x8051e697
sub edi, ebx
sub dword [ebp - 0xc], 0x86c1bb7e
mov dword [edx], edi
sub dword [ebp - 0x14], esi
add edx, 4
add esi, 0xbcf38e43
add esi, 0x430c71c1
loop 0x40155a
add eax, 0x1213b
xor ebx, ebx
add ebx, eax
add eax, 0x745f392b
sub eax, 0x745f3926
mov ecx, 0xa674bf3b
sub ecx, 0xa634bf3b
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401443
pop dword [ebp - 0x24]
mov eax, 0x29436fed
add eax, 0xd6fca456
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xe88492eb
sub dword [ebp - 0x34], 0x9a324da0
mov dword [ebp - 0x30], 0xa37ad225
add dword [ebp - 0x30], 0x8eb87a20
mov dword [ebp - 0x2c], 0xf041dc2a
sub dword [ebp - 0x2c], 0xa3f597fc
mov dword [ebp - 0x28], 0xff9daa8b
add dword [ebp - 0x28], 0x625575
lea eax, [ebp - 0x34]
push eax
mov eax, 0x746e8fb
add eax, 0xf8f99809
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x6e45dc32
add dword [ebp - 0x34], 0x62c8d24
mov dword [ebp - 0x30], 0x91ef2847
add dword [ebp - 0x30], 0xaf7d392e
mov dword [ebp - 0x2c], 0xa2db8845
add dword [ebp - 0x2c], 0xc093e427
mov dword [ebp - 0x28], 0x865a9b4c
sub dword [ebp - 0x28], 0x865a9b4c
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x38e63bc7
add eax, 0xc75a4539
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x38fa6
push 0
call eax
mov ecx, 0xa128f316
sub ecx, 0xa128a856
mov edi, eax
mov edx, 0x46e400
add edx, dword [ebp - 0x24]
mov esi, 0x77ef8de6
add esi, 0xb7e4218f
add dword [ebp - 0x20], 0x62559beb
mov ebx, dword [edx]
sub dword [ebp - 0x18], 0xdb0e8120
sub ebx, esi
xor dword [ebp - 4], 0x55f2499
mov dword [edi], ebx
sub dword [ebp - 0x14], 0xee134f
add edi, 0x18fefeaa
sub edi, 0x18fefea6
add edx, 4
loop 0x40155f
add eax, 0x531b0d5c
sub eax, 0x5319ef89
mov ebx, eax
add eax, 0xac21fce1
sub eax, 0xac21fcdc
mov ecx, 0x14f1918
sub ecx, 0x10f1918
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401c66
pop dword [ebp - 0x14]
mov eax, 0x64cb3f3d
sub eax, 0x648b22d7
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xdb3da1be
sub dword [ebp - 0x24], 0x8ceb5c73
mov dword [ebp - 0x20], 0xbb5cd5b4
add dword [ebp - 0x20], 0x76d67691
mov dword [ebp - 0x1c], 0x1d5bc2dd
add dword [ebp - 0x1c], 0x2ef08151
mov dword [ebp - 0x18], 0x24e65312
sub dword [ebp - 0x18], 0x24e65312
lea eax, [ebp - 0x24]
push eax
mov eax, 0xd0d373f8
sub eax, 0xd09343a4
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xe6676ac6
sub dword [ebp - 0x24], 0x71f50170
mov dword [ebp - 0x20], 0xfd6bb36c
add dword [ebp - 0x20], 0x4400ae09
mov dword [ebp - 0x1c], 0x32e92e9d
sub dword [ebp - 0x1c], 0xcf79c231
mov dword [ebp - 0x18], 0xba66502e
add dword [ebp - 0x18], 0x4599afd2
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x906b0308
add eax, 0x6fd52d24
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x33b52
push 0
call eax
mov ecx, 0x9f11ecf0
sub ecx, 0x9f11b008
mov edx, eax
mov esi, 0xe2c356e2
add esi, 0x1d7d191e
add esi, dword [ebp - 0x14]
mov ebx, 0x660be112
sub ebx, 0x12d82532
sub dword [ebp - 8], eax
mov edi, dword [esi]
xor dword [ebp - 8], ebx
xor edi, ebx
mov dword [edx], edi
add edx, 0x91117cdb
sub edx, 0x91117cd7
add esi, 0xa2fe5c5d
sub esi, 0xa2fe5c59
loop 0x401d88
add eax, 0xf27f96c4
sub eax, 0xf27eb051
mov ebx, eax
add eax, 0x326107d
add eax, 0xfcd9ef88
mov ecx, 0xe9286581
add ecx, 0x17179a7f
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1003c33a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1003c349
pop dword [ebp - 0x14]
mov eax, 0x1003c349
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xc148791a
add dword [ebp - 0x24], 0x8d09cc31
mov dword [ebp - 0x20], 0xb94c5f0c
add dword [ebp - 0x20], 0x78e6ed39
mov dword [ebp - 0x1c], 0xd1510ba2
add dword [ebp - 0x1c], 0x7afb388c
mov dword [ebp - 0x18], 0xbc3d3c7d
add dword [ebp - 0x18], 0x43c2c383
lea eax, [ebp - 0x24]
push eax
mov eax, 0xa62165f
add eax, 0x5a1ca1d
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x82416a8c
add dword [ebp - 0x24], 0xf230feca
mov dword [ebp - 0x20], 0x88b66db8
sub dword [ebp - 0x20], 0x474a0c43
mov dword [ebp - 0x1c], 0x13a2a43e
sub dword [ebp - 0x1c], 0xb03337d2
mov dword [ebp - 0x18], 0x466efebd
add dword [ebp - 0x18], 0xb9910143
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x8d42b82a
add eax, 0x82c1285a
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x40e92
push 0
call eax
mov ecx, 0x48ad374c
add ecx, 0xb7531de7
xor edx, edx
add edx, eax
mov esi, 0xb77d62cb
add esi, 0x5889af35
add esi, dword [ebp - 0x14]
mov ebx, 0xeedd48d6
add ebx, 0x78f68d80
sub dword [ebp - 4], 0x4c2e2d43
mov edi, dword [esi]
add dword [ebp - 0x10], 0x4c3c59f8
add edi, ebx
xor dword [ebp - 4], ecx
mov dword [edx], edi
xor dword [ebp - 0x10], ebx
add edx, 0x7b0db70f
add edx, 0x84f248f5
add esi, 0xec328852
add esi, 0x13cd77b2
loop 0x1003c468
add eax, 0x14410a8c
add eax, 0xebc03d13
xor ebx, ebx
add ebx, eax
add eax, 0xed9fa1a1
sub eax, 0xed9fa19c
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
movzx ecx, word [eax + 0x14]
xor edx, edx
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 8], 0
cmp dx, word [eax + 6]
jae 0x4010a7
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x401062
mov eax, dword [esp + 0x1c]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x40108b
mov ecx, dword [esi - 4]
push 4
push 0x1000
push edi
add ecx, ebx
push ecx
call ebp
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.0040fae0
jmp 0x401088
mov edx, dword [esi - 4]
push 4
push 0x1000
push eax
add edx, ebx
push edx
call ebp
mov ecx, dword [esi + 4]
add ecx, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esi]
push eax
push ecx
push edi
call fcn.00412d30
mov dword [esi - 8], edi
add esp, 0xc
mov edx, dword [esp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esp + 0x10]
movzx edx, word [ecx + 6]
inc eax
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x401033
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x4010b0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [eax]
movzx ecx, word [ebx + 0x14]
push ebp
xor edx, edx
xor ebp, ebp
lea eax, [ecx + ebx + 0x18]
cmp dx, word [ebx + 6]
jae 0x401165
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401107
mov eax, dword [edi - 0x14]
mov ecx, dword [edi - 0x1c]
push 0x4000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40114d
lea edx, [edx + ecx*2]
lea ecx, [esi + edx*2]
mov edx, dword [ecx*4 + 0x437650]
test eax, 0x4000000
je 0x401121
or edx, 0x200
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x40113a
test al, 0x40
je 0x401131
mov ecx, dword [ebx + 0x20]
jmp 0x401138
test al, al
jns 0x40114d
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x40114d
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx]
movzx eax, word [ebx + 6]
inc ebp
add edi, 0x28
cmp ebp, eax
jl 0x4010d4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40e5f7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x428c80]
jne 0x40e601
repz ret
jmp fcn.00411f4f

Function at 0x4197da
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413107
and dword [ebp - 4], 0
cmp dword [0x439f84], 0
mov ebx, eax
jne 0x41988b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41993c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x422e20
push edi
call esi
test eax, eax
je 0x41993c
push eax
call fcn.00413095
mov dword [esp], 0x422e10
push edi
mov dword [0x439f84], eax
call esi
push eax
call fcn.00413095
mov dword [esp], 0x422dfc
push edi
mov dword [0x439f88], eax
call esi
push eax
call fcn.00413095
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x439f8c], eax
call esi
push eax
call fcn.00413095
pop ecx
mov dword [0x439f94], eax
test eax, eax
je 0x41988b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00413095
pop ecx
mov dword [0x439f90], eax
mov eax, dword [0x439f90]
cmp eax, ebx
je 0x4198e3
cmp dword [0x439f94], ebx
je 0x4198e3
push eax
call fcn.00413110
push dword [0x439f94]
mov esi, eax
call fcn.00413110
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4198e3
test edi, edi
je 0x4198e3
call esi
test eax, eax
je 0x4198da
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4198da
test byte [ebp - 0xc], 1
jne 0x4198e3
or dword [ebp + 0x10], 0x200000
jmp 0x41991c
mov eax, dword [0x439f88]
cmp eax, ebx
je 0x41991c
push eax
call fcn.00413110
pop ecx
test eax, eax
je 0x41991c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41991c
mov eax, dword [0x439f8c]
cmp eax, ebx
je 0x41991c
push eax
call fcn.00413110
pop ecx
test eax, eax
je 0x41991c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x439f84]
call fcn.00413110
pop ecx
test eax, eax
je 0x41993c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41993e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4111d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
push edi
push 0x431bfc
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 0x200
call esi
test eax, eax
jne 0x411235
lea eax, [ebp - 8]
push eax
push str.EnableJavaUpdate
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call main
add esp, 0xc
test eax, eax
je 0x411227
cmp dword [ebp - 8], ebx
je 0x41122a
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x411243
push str.ISAUDisabled__:_Error_opening_HKLM_Policy_key_for_reading
call main
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], edi
jne 0x4112d5
call fcn.00410107
test eax, eax
jne 0x4112d2
call main
test eax, eax
je 0x4112d2
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push 0x431c74
push 0x80000001
call esi
test eax, eax
jne 0x4112d5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push 0x431c9c
push dword [ebp - 0xc]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp esi, edi
jne 0x4112d5
mov dword [ebp - 8], edi
call fcn.0040feb9
test eax, eax
je 0x4112c7
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x210]
push eax
call fcn.0040ff5d
mov eax, dword [ebp - 8]
add esp, 0x10
jmp 0x4112cd
mov eax, dword [ebp - 0x210]
cmp eax, 0x64
jne 0x4112d5
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x413c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x413c4f
pop dword [ebp - 0x50]
mov eax, 0x413c4f
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x40f2a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xe538e58c
sub ecx, 0xe538a029
mov ebx, eax
mov esi, 0x9013721a
add esi, 0x703095e6
add esi, dword [ebp - 0x50]
mov edi, 0xb129bbca
sub edi, 0x4e209630
sub dword [ebp - 0x14], ecx
mov edx, dword [esi]
add dword [ebp - 0x38], ecx
sub edx, edi
xor dword [ebp - 0x44], 0xf44b56f4
mov dword [ebx], edx
xor dword [ebp - 0x3c], eax
add ebx, 0x8458001e
sub ebx, 0x8458001a
add esi, 4
loop 0x413ca4
add eax, 0x281ed1d8
sub eax, 0x281dc979
mov ebx, eax
add eax, 0x7de1fe9b
sub eax, 0x7de1fe96
mov ecx, 0xed57ef6d
add ecx, 0x12e81093
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x4187e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a210]
jne 0x4187ee
repz ret
jmp fcn.00420617
Function at 0x1001ca50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001caeb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001caa2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001caa2
cmp esi, ebx
jge 0x1001caa2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001cae5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001cae5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e0]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e0]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001cafd
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x1001cd20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
mov eax, dword [ebp + 8]
je 0x1001cd48
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cd62
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022ac0
leave
ret 4

Function at 0x1001cf30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cf66
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cfc5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022ac0
leave
ret 0x10
Function at 0x1001cfe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d00c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d03d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d03b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d03d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022ac0
leave
ret 8

Function at 0x80b4a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x80b4c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x80b4c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x80b4b8
mov eax, 1
add ebx, ebx
jne 0x80b4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x80b4d0
jne 0x80b4ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80b4d0
xor ecx, ecx
sub eax, 3
jb 0x80b500
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x80b572
mov ebp, eax
add ebx, ebx
jne 0x80b50b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x80b518
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x80b53c
inc ecx
add ebx, ebx
jne 0x80b528
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x80b51d
jne 0x80b539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80b51d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x80b55c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x80b54d
jmp 0x80b4be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x80b55c
add edi, ecx
jmp 0x80b4be
pop esi
mov edi, esi
mov ecx, 0x147
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x80b57a
cmp byte [edi], 1
jne 0x80b57a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x80b57f
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x80b5f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb514]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb58c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x80b5ac
mov ecx, edi
jns 0x80b5db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb590]
or eax, eax
je 0x80b5f1
mov dword [ebx], eax
add ebx, 4
jmp 0x80b5c9
call dword [esi + 0xb594]
popal
jmp 0x802d68