joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54bb9e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054b7a3

Function at 0x54bba9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054b924

Function at 0x554df5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005545da

Function at 0x554e00
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00554815

Function at 0x555353
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005550da

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x2e405594
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x2dd76c90
nop
nop
nop
nop
nop
test eax, eax
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x18b76c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x66c000]
push edi
or ebp, 0xffffffff
jmp 0x18b76e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x18b76e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x18b76d8
mov eax, 1
add ebx, ebx
jne 0x18b76fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x18b770c
jne 0x18b772b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x18b772b
dec eax
add ebx, ebx
jne 0x18b7718
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x18b76f0
add ebx, ebx
jne 0x18b7727
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x18b777d
xor ecx, ecx
sub eax, 3
jb 0x18b7743
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x18b77b2
sar eax, 1
mov ebp, eax
jmp 0x18b774e
add ebx, ebx
jne 0x18b774e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x18b771c
inc ecx
add ebx, ebx
jne 0x18b775c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x18b771c
add ebx, ebx
jne 0x18b7769
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x18b775e
jne 0x18b777a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x18b775e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x18b779c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x18b778e
jmp 0x18b76de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x18b779c
add edi, ecx
jmp 0x18b76de
pop esi
mov edi, esi
mov ecx, 0x2142d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x18b77ba
cmp byte [edi], 0xb5
jne 0x18b77ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x18b77bf
lea edi, [esi + 0x9b3000]
mov eax, dword [edi]
or eax, eax
je 0x18b782e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa33868]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa33994]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x18b77ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa33998]
or eax, eax
je 0x18b7828
mov dword [ebx], eax
add ebx, 4
jmp 0x18b7809
call dword [esi + 0xa339a8]
mov ebp, dword [esi + 0xa3399c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x18b7862
sub esp, 0xffffff80
jmp 0x131f868
Function at 0x411205
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax - 6], cl
dec eax
inc ebp
add al, byte [ecx + 4]
and al, byte [ecx]
and al, byte [ecx + 0x4e211d24]
xchg dword [eax], eax
sbb byte [edx + 0x1e], al
inc ecx
add al, 0x22
add dword [edx], esp
and dword [ebx + 0x874e21], 0x411e4218
nop
add byte [eax + 0x5109c750], 0x50
xor eax, 0x78093a1f
add eax, 0x2410104
mov ebp, dword [ebp + 0x6f1e0e3e]
loope 0x41119b
sal byte [ecx], cl
sbb al, 0x5a
ljmp 0xddcb
dec ebp
std
inc ebx
add cl, dl
inc ebp
mov edi, 0x5577a9fb
mov bh, 0x9c
idiv byte [ebx + 0x10418c4]
xchg dword [edx], edi
jge 0x4111a2
add al, 0x65
or edi, dword [esi - 0x18]
pop ds
push edi
dec ebx
cmp dh, byte [ebx + 0xc633fec]
mov word [ebx - 0x7ce6fdc9], gs
pop esi
sub eax, eax
lodsb al, byte [esi]
or dword [eax + 0x433854ca], esp
les eax, [eax + 0x866d98a]
cdq
jl 0x41129e
in al, 0x72
sbb dword [ecx + 0x35e9e550], esi
add dword [ebx + 6], eax
mov bl, 0x36
pushal
enter 0x5998, 0xc
push esp
or al, 0xaa
stosb byte es:[edi], al
push edi
std
loopne 0x411253
sbb al, 0xf3
push ebp
and byte [ebp + 0x5e], dh
ror ah, 0x71
std
sbb eax, 0x8218ce01
shr byte [edx - 0x1fd0c535], 1
nop
cmp ch, byte [edi]
loopne 0x4111ff
or edx, dword [edi - 0x5e714ace]
ljmp 0xdd33
add dword [eax - 0x1bde7fc2], eax
loop 0x41126b
cmp ch, byte [esi - 0x7d830af4]
xchg dword [edi], edi
cmp esi, dword [edi - 5]
xchg esi, eax
shr dword [esi], cl
mov ebp, 0x297539a0
shl bh, 0x90
inc esi
push ebp
add byte [edx], al
sub al, 0x9c
add ebx, eax
dec esp
imul esi, dword [ecx + 0x79], 0xffffffe5
mov dword [0xf75d17f3], eax
pop esi
xchg esp, eax
xchg dword [ebp - 0x75e119f6], esp
pop ds
cmc
invalid
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x467f1c66
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x6dd764b1
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x405254
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x42c8b0], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405278
test al, 0x10
jne 0x40527b
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x42c8b0
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4052a6
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x40530e
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.004055af
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x405344
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42f4c8], eax
jmp 0x4054c9
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x40535f
test eax, eax
je 0x405474
test cl, 2
je 0x405474
mov esi, 0x42b8b0
push ebx
push esi
call fcn.004059dc
cmp dword [ebp + 8], 0
je 0x40537e
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405384
push ebx
call fcn.00405516
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x40546a
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.004054fa
cmp byte [eax], 0
je 0x4053d5
cmp byte [ebp - 0x18], 0
je 0x4053d5
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4053eb
mov al, byte [esi + 1]
test al, al
je 0x405449
cmp al, 0x2e
jne 0x4053eb
cmp byte [esi + 2], 0
je 0x405449
push esi
push edi
call fcn.004059dc
test byte [ebp - 0x148], 0x10
je 0x405410
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405449
push dword [ebp + 0xc]
push ebx
call fcn.0040530e
jmp 0x405449
push ebx
call fcn.00405693
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405441
test byte [ebp + 0xc], 4
je 0x405439
push ebx
push 0xfffffffffffffff1
call fcn.00404d70
push 0
push ebx
call fcn.00405729
jmp 0x405449
inc dword [0x42f4c8]
jmp 0x405449
push ebx
push 0xfffffffffffffff2
call fcn.00404d70
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053b3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405474
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x4054c9
cmp dword [ebp - 8], esi
jne 0x405489
inc dword [0x42f4c8]
jmp 0x4054c9
push ebx
call fcn.00405c98
test eax, eax
je 0x4054c9
push ebx
call fcn.004054cf
push ebx
call fcn.00405693
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054c1
test byte [ebp + 0xc], 4
je 0x405481
push ebx
push 0xfffffffffffffff1
call fcn.00404d70
push esi
push ebx
call fcn.00405729
jmp 0x4054c9
push ebx
push 0xffffffffffffffe5
call fcn.00404d70
pop esi
pop ebx
leave
ret 8
Function at 0x4055af
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42bcb0
push esi
call fcn.004059dc
push esi
call fcn.00405562
mov edi, eax
test edi, edi
jne 0x4055d0
xor eax, eax
jmp 0x405622
push edi
call fcn.00405bff
test byte [0x42f450], 0x80
je 0x4055e9
mov al, byte [edi]
test al, al
je 0x4055cc
cmp al, 0x5c
je 0x4055cc
sub edi, esi
jmp 0x405601
call fcn.00405c98
test eax, eax
je 0x4055fb
test byte [eax], 0x10
je 0x4055cc
push esi
call fcn.00405516
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x4055ed
call fcn.004054cf
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405693
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4056af
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x4056b2
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4056e1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405725
test edi, edi
jne 0x4056ec
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x40571f
Function at 0x405729
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00405cd6
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405755
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405894
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42ca38], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x42ca38
je 0x405799
push 1
push 0
push esi
call fcn.004056b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x40589a
cmp eax, edi
jg 0x40589a
mov esi, 0x42c4b0
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x40589a
cmp eax, edi
jg 0x40589a
push esi
push ebp
push str._s_s_r_n
push 0x42c0b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call sub.KERNEL32.dll_lstrcatA
push 4
push 0xc0000000
push esi
call fcn.004056b2
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405894
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40588d
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40588d
cmp edi, dword [esp + 0x18]
jne 0x40588d
push str._Rename__r_n
push esi
call fcn.00405627
test eax, eax
jne 0x4058a1
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.004059dc
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x42c0b0
push eax
call fcn.00405673
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x42f4d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409304
push eax
call fcn.00405627
test eax, eax
je 0x405858
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x4058c8
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x4058bd
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x40585a
Function at 0x4058d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405934
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405923
cmp dword [ebp + 0x14], 1
je 0x405925
cmp dword [ebp + 0x14], 2
je 0x405925
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4059fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jge 0x405a1f
mov ecx, dword [0x42ec1c]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x42f478]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x42e3e0
sub ecx, eax
mov edi, eax
cmp ecx, 0x800
jae 0x405bd9
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405bd9
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405be6
inc ebx
cmp cl, 0xfc
jbe 0x405bcc
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
or ecx, edx
or eax, edx
inc ebx
mov dword [ebp - 0x10], ecx
inc ebx
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 8], eax
jne 0x405b77
cmp dword [0x42f4c4], 0
push 2
pop esi
je 0x405aaa
push 4
pop esi
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x14]
push dword [0x42f444]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405ade
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
call fcn.00405229
cmp dword [ebp + 0xc], 0
jne 0x405ae5
and byte [edi], 0
test esi, esi
jne 0x405aaa
cmp byte [edi], 0
jne 0x405b5e
mov eax, dword [ebp - 0x14]
cmp eax, 0x2b
jne 0x405b09
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058d0
jmp 0x405b59
cmp eax, 0x26
jne 0x405b35
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058d0
cmp byte [edi], 0
jne 0x405b5e
push str.C:Program_Files
push edi
call fcn.004059dc
jmp 0x405b59
cmp eax, 0x25
jne 0x405b48
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405b59
cmp eax, 0x24
jne 0x405b59
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
je 0x405b6f
cmp dword [ebp - 0xc], 0x1a
jne 0x405b6f
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.00405bff
jmp 0x405bbd
cmp byte [ebp + 0xf], 0xfd
jne 0x405bab
cmp esi, 0x1b
jne 0x405b90
push dword [0x42f444]
push edi
call fcn.0040593a
jmp 0x405ba1
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.004059dc
add esi, 0xffffffeb
cmp esi, 6
jae 0x405bbd
jmp 0x405b6f
cmp byte [ebp + 0xf], 0xff
jne 0x405bbd
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.004059fe
push edi
call sub.KERNEL32.dll_lstrlenA
add edi, eax
mov eax, 0x42e3e0
jmp 0x405bd9
jne 0x405bd6
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405bd9
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405a4a
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405bfb
push eax
push dword [ebp + 8]
call fcn.004059dc
leave
ret 8
Function at 0x405d33
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42ce3c], 0
push esi
jne 0x405d6a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d44
mov dword [ecx*4 + 0x42ce38], eax
inc ecx
cmp ecx, 0x100
jl 0x405d3f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d9b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42ce38]
xor eax, esi
inc ecx
dec edx
jne 0x405d7d
pop edi
not eax
pop esi
ret 0xc
Function at 0x405bd0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x405e10
sub esp, 0x20
movzx eax, byte [0x5e08ff]
test al, al
jne 0x405de8
mov eax, dword [0x5e0f60]
mov ecx, dword [esp + 0x2c]
imul eax, ecx
mov edx, dword [esp + 0x28]
add eax, edx
mov ebx, dword [esp + 0x24]
jmp 0x405ca2
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
lea edx, [ebx + 4]
lea ecx, [ebx + 8]
add ebx, 0xc
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
xor eax, edi
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [edx]
xor ebp, edx
imul ebp, ebp, 0xc70f85e1
rol ebp, 0xf
imul ebp, ebp, 0x319bca41
mov ecx, dword [ecx]
xor esi, ecx
imul esi, esi, 0x319bca41
rol esi, 0xf
imul esi, esi, 0x8b421a21
mov edi, dword [ebx]
mov ecx, dword [esp + 0x10]
xor edi, ecx
imul edi, edi, 0x8b421a21
rol edi, 0xf
imul edi, edi, 0xbce2d621
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
mov edx, dword [esp + 0x14]
lea ebx, [edx + 0x10]
mov edx, dword [esp + 0x28]
cmp ecx, 0x10
jae 0x405c14
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x405de1
cmp ecx, 4
jb 0x405daa
je 0x405d95
cmp ecx, 8
jbe 0x405d67
cmp ecx, 0x10
jbe 0x405ce4
mov ebp, dword [0x5e0f64]
imul ebp, edx
mov esi, dword [0x5e0f68]
imul esi, edx
mov edi, dword [0x5e0f6c]
imul edi, edx
jmp 0x405c93
mov edx, ebx
lea ebp, [ebx + 4]
lea esi, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebp]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
mov eax, dword [esi]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, dword [ecx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
mov eax, ecx
shr ecx, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
mov edx, ebx
lea ebx, [ecx + ebx - 4]
mov ecx, dword [edx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
mov eax, dword [ebx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x405d3e
mov ecx, dword [ebx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x405d3e
mov edx, ecx
shr ecx, 1
mov ebp, ebx
lea esi, [ecx + ebx]
lea edx, [edx + ebx - 1]
movzx ecx, byte [ebp]
xor ecx, eax
movzx eax, byte [esi]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
shl eax, 0x10
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x405d3e
mov ecx, eax
jmp 0x405d3e
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.0044b460
mov eax, dword [esp + 0xc]
mov dword [esp + 0x30], eax
add esp, 0x20
ret
call fcn.00449fd0
jmp fcn.00405bd0