joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ad00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x1002fcc8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003d020]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x1001ad39
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x1001ad46
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x1001adad
jmp 0x1001ad7c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x1001adea
test edi, edi
jne 0x1001adf0
push 0x1001a6a0
push 0x1003ffec
call fcn.1001a3e0
mov eax, dword [section..data]
add esp, 8
cmp eax, 0xffffffff
je 0x1001adad
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x1001add6
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1001add6
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x1001ae28
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x1001ae19
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x1001adf0
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x1001ad70
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x1001ae87
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x1001ae6c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x1001ae87
jmp 0x1001ae60
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x1001ae60
jmp 0x1001ae87
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x1001ae85
cmp esi, dword [eax + 8]
jne 0x1001ae85
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x1001ae75
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x1001ae9b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x1001ae9b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.1000d819
cmp esi, ebx
jne 0x1001ae40
mov ebp, dword [esp + 0x14]
jmp 0x1001ad70
Function at 0x1001aec0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x18]
push eax
push 4
push edx
push 0x1001af30
push 0
push 0
call fcn.1001c3d1
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x1001aee9
pop esi
xor al, al
pop ebx
ret
mov ecx, dword [esi]
mov eax, 1
push edi
add ecx, 4
lock xadd dword [ecx], eax
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x1001af0d
cmp eax, 0xffffffff
je 0x1001af0d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x412e87
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
nop dword [eax]
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x4d
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xf7
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xeb
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xe3
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x50
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x84
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x12
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xca
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x33
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x35
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xbe
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xbf
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xc6
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xfe
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xe3
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xf3
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x77
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x2b
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x8d
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x93
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xcf
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x45
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xe8
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x89
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xd7
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x56
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x34
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x25
inc edi
cmp edi, ebx
jb 0x412d20
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451c59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451c6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405902
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b112
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b123
pop esi
ret
push ebx
push edi
push esi
call fcn.0049aff9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fd5
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b14b
push ebx
push esi
push edi
call fcn.004056f5
add esp, 0xc
push 0
call fcn.0040623f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40b640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x40b754
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
sub eax, 0xffffff80
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xc]
lea esi, [ecx + 2]
sub ecx, eax
add ecx, 0xfffffffe
lea edx, [eax + 2]
mov dword [esp + 0x18], ecx
lea eax, [edi - 1]
mov dword [esp + 0x10], edx
shr eax, 3
inc eax
mov dword [esp + 0x14], eax
movzx eax, byte [edx - 2]
add ecx, edx
push ecx
mov byte [ecx], al
movzx eax, byte [edx - 1]
mov byte [esi - 1], al
movzx eax, byte [edx]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
mov edi, dword [edx - 2]
mov ebx, dword [edx + 2]
mov edx, ecx
mov ecx, dword [esp + 0x20]
call fcn.0040ad00
mov ecx, dword [ebp + 8]
lea esi, [esi + 8]
mov edx, dword [esp + 0x14]
add esp, 4
movzx eax, byte [ecx + 0x100]
mov ecx, dword [esp + 0x18]
xor byte [edx + ecx], al
add edx, 8
mov ecx, dword [ebp + 8]
mov dword [esp + 0x10], edx
movzx eax, byte [ecx + 0x101]
xor byte [esi - 9], al
movzx eax, byte [ecx + 0x102]
xor byte [esi - 8], al
movzx eax, byte [ecx + 0x103]
xor byte [esi - 7], al
movzx eax, byte [ecx + 0x104]
xor byte [esi - 6], al
movzx eax, byte [ecx + 0x105]
xor byte [esi - 5], al
movzx eax, byte [ecx + 0x106]
xor byte [esi - 4], al
movzx eax, byte [ecx + 0x107]
xor byte [esi - 3], al
sub dword [esp + 0x14], 1
mov dword [ecx + 0x100], edi
mov dword [ecx + 0x104], ebx
mov ecx, dword [esp + 0x18]
jne 0x40b685
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413040
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x413055
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413060
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x413090
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x4130a9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4130b5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4130b0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4130f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x62b0b8]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
or eax, 0x2001f
push esi
push edi
push eax
push edx
push dword [ecx]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.00412f90
mov esi, eax
test esi, esi
jne 0x4131e7
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x4131b9
nop dword [eax]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.004130f0
mov esi, eax
test esi, esi
jne 0x4131e7
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x413180
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4131d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0
call fcn.00412e30
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4131f6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00433ee3
mov esp, ebp
pop ebp
ret 4
Function at 0x4136e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1006
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x62b0b8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x41378c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x41378c
call fcn.00412b10
mov esi, eax
jmp 0x41387c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4137af
call fcn.00412b10
jmp 0x41386f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4137cd
call fcn.00412b10
jmp 0x41386f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4137ee
mov esi, 0x8007000e
jmp 0x413871
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004154d0
jmp 0x413818
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x41382f
mov esi, 0x8007000e
jmp 0x413871
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x41384f
call fcn.00412b10
jmp 0x41386f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00414540
mov esi, eax
test edi, edi
je 0x41387c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4138a0
lea ecx, [ebp - 0x418]
call fcn.00415650
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00433ee3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x415a90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1163
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x62b0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x62fee4
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x62fee4
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x61f774
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00417760
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41c1e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x634560], ecx
inc eax
cmp eax, 0x100
jb 0x41c1e2
cmp eax, 0x800
jae 0x41c2b3
nop
mov edx, dword [eax*4 + 0x634160]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x634560]
mov dword [eax*4 + 0x634560], edx
inc eax
cmp eax, 0x800
jb 0x41c290
mov dword [0x62fef0], 0x41d050
call fcn.0041ce80
mov ecx, dword [0x62fef0]
test eax, eax
mov edx, 0x41d0f0
cmove ecx, edx
mov dword [0x62fef0], ecx
ret
Function at 0x41d3d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x41d3f0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x41d422
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x41d41f
inc esi
cmp esi, edx
jb 0x41d410
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x41d54c
cmp ecx, 3
jbe 0x41d462
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x41d4a0
cmp cl, 0xff
je 0x41d4a0
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x41d404
dec ecx
shl eax, cl
and eax, 7
je 0x41d43a
movzx ecx, byte [eax + 0x5a5ec8]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x5a5ec0], 0
mov cl, byte [edx + 4]
je 0x41d48a
test cl, cl
je 0x41d48a
cmp cl, 0xff
jne 0x41d43a
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x41d404
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x41d4ce
lea edx, [edi + ebx]
add edx, esi
jmp 0x41d4d4
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x41d512
movzx edi, byte [eax + 0x5a5ec8]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x41d4fe
cmp cl, 0xff
jne 0x41d512
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x41d4c1
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x41d404
pop edi
pop esi
cmp ecx, 3
jbe 0x41d561
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42198d
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x62b0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x61c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x208
mov dword [ebp - 0x628], esi
push edi
push 0
push eax
mov dword [ebp - 0x620], ebx
call fcn.00445350
push edi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00445350
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.00452fd9
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00452fd9
lea eax, [ebp - 0x61c]
push eax
call fcn.0045372e
lea eax, [ebp - 0x414]
push eax
call fcn.0045372e
add esp, 0x30
call fcn.0043a446
test al, al
je 0x421a26
test eax, 0x19c1d5c4
wait
xchg ecx, eax
int3
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.00453520
pop ecx
pop ecx
test eax, eax
je 0x421bd5
call fcn.0043a8db
test al, al
je 0x421a69
mov ecx, 0x48994e9
fmul dword [eax + 0x31371408]
cmp byte [ebp - 0x62], bh
pop ebp
lodsb al, byte [esi]
pop edi
idiv byte [esi + 0x1d]
xor edi, esp
cmp eax, 0xeea19c97
test dword [edx], edx
call fcn.0043a9ef
test al, al
je 0x421a90
cmc
lodsd eax, dword [esi]
push edx
mov ebx, 0x761c80b1
fadd qword [ecx]
cdq
movsb byte es:[edi], byte [esi]
popal
sub byte [ecx - 0x605e24ec], dh
packssdw mm1, mm5
cmpsb byte [esi], byte es:[edi]
inc ebp
retf 0xccbb
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x624], ebx
push 0
push eax
call fcn.00445350
add esp, 0xc
lea eax, [ebp - 0x20c]
test ebx, ebx
jne 0x421ace
push dword [ebp - 0x620]
push str._s.bak
push eax
call fcn.00407470
add esp, 0xc
jmp 0x421ae3
push ebx
push dword [ebp - 0x620]
push str._s.bak_d
push eax
call fcn.00407470
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421b01
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0043a446
test al, al
je 0x421b1a
push eax
push eax
sbb dword [ebx], 0x540407a6
mov edx, 0xcf654598
inc edx
mov eax, dword [0xe0b58b6c]
stc
invalid
mov esi, dword [ebp - 0x620]
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.00453d34
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push esi
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x421bc4
call fcn.0043a8db
test al, al
je 0x421b7b
add eax, 0xb72002d6
pushal
salc
jnp 0x421b7a
sti
push edi
retf 0xe4d2
invalid
call fcn.0043a9ef
test al, al
je 0x421ba8
jp 0x421bc4
jmp 0x1db44e6d
push 5
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp ebx, 0xa
jge 0x421bd5
inc ebx
jmp 0x421a92
push 5
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00433ee3
mov esp, ebp
pop ebp
ret
Function at 0x4228c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
xor ebx, ebx
inc ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
jne 0x4228f6
xor eax, eax
jmp 0x4229a7
call fcn.0043a9aa
test al, al
je 0x422917
push eax
adc eax, 0x7cd7750c
xchg edx, eax
dec ecx
scasd eax, dword es:[edi]
adc byte [edi + 0x78], 0x4e
pop eax
push ss
push 0x24
ljmp 0x43db
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0043a8db
test al, al
je 0x42295c
int1
loopne 0x42297c
or byte [edi], ch
push ebp
test dword [edi + 1], 0xfb6c0949
cmp eax, 0xfe333d8a
cmpsb byte [esi], byte es:[edi]
invalid
call fcn.0043a73d
test al, al
je 0x42297a
adc ecx, dword [ebx]
and al, 0xec
jae 0x42292e
ret 0xb518
call fcn.0043a896
jg 0x42297f
add byte [eax + eax*8 - 0x4fa1ed8c], al
mov dword [eax + ecx*2], esp
test al, al
je 0x422995
pop esi
mov al, 0x89
and al, 0x48
fiadd word [esi + edi*4 - 0xb]
add eax, 0x15d9dca0
invalid
cmp dword [ebp - 8], 0
je 0x4229a3
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
je 0x4229a5
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42331e
Capabilities:
Encode data using xor

Disassembly:
push 0x40
mov eax, 0x5a1c09
call fcn.004348d9
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00401870
and dword [ebp - 4], 0
mov esi, 0x620760
push esi
call fcn.004532f1
pop ecx
push eax
push 0
push esi
lea ecx, [ebp - 0x28]
call fcn.00405320
mov dword [ebp - 0x48], eax
call fcn.0043a6f8
test al, al
je 0x423383
and dl, byte [ebp - 0x1e]
lcall 0xbe63, 0xf23df09a
nop
lcall 0x90be, 0x63f23df0
and edi, dword [edi - 0x3c]
add ch, byte [0x832f0999]
push es
xor dword [edx], edx
fnsave dword [ebp - 0x38]
jno 0x42336c
call fcn.0043a59f
pop ss
jb 0x423388
add byte [eax + eax*8 - 0x66f0e18c], al
mov dword [ebx], eax
sti
xor eax, 0x884fda79
test al, al
je 0x4233aa
setns byte [ecx + 0x7935fb03]
fimul dword [edi - 0x78]
int 0xd0
pushfd
ret
mov eax, dword [ebp - 0x48]
cmp eax, 0xffffffff
jle 0x4233db
push eax
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004216e6
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
push eax
call fcn.00408f80
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.004019a0
jmp 0x4233e8
mov ecx, dword [ebp - 0x44]
push 0x61f778
call fcn.00401870
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004019a0
mov eax, dword [ebp - 0x44]
call fcn.00434894
ret