joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405553
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
je 0x405663
mov eax, dword [esi + 0xc]
test eax, eax
je 0x405580
dec eax
je 0x405575
dec eax
jne 0x405580
push 0xfffffffffffffff4
jmp 0x405577
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x4055cf
cmp dword [ebp + 0xc], edi
jbe 0x4055ea
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov eax, 0x4000
cmp ecx, eax
jae 0x4055a7
mov eax, ecx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
je 0x4055ea
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x405597
jmp 0x4055e6
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
test al, al
jne 0x40565d
cmp byte [esi + 0x14], 0
je 0x40565d
cmp dword [esi + 0xc], 0
jne 0x40565d
push 0
lea eax, [esi + 0x418]
push eax
lea eax, [esi + 0x17]
mov edi, 0x414e7c
push eax
mov ecx, edi
call fcn.0040334a
test al, al
je 0x405647
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x405588
test eax, eax
jbe 0x405588
push 0
mov ecx, esi
call fcn.00404f95
mov ecx, dword [ebp - 4]
xor edi, edi
sub eax, ecx
sbb edx, edi
push edx
push eax
mov ecx, esi
call fcn.004054b4
jmp 0x405588
lea eax, [esi + 0x418]
push eax
lea eax, [esi + 0x17]
push eax
push 0
push 0
mov ecx, edi
call fcn.004035d4
pop edi
mov byte [esi + 8], 1
pop ebx
pop esi
leave
ret 8

Function at 0x405753
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00406c2c
test eax, eax
je 0x40577d
mov eax, dword [esp + 8]
test eax, eax
je 0x40577d
cmp word [eax], 0
je 0x40577d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x40579a
cmp dword [esp + 4], 0
je 0x405798
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405798
xor eax, eax
inc eax
jmp 0x40579a
xor eax, eax
ret 8

Function at 0x4057c8
Capabilities:
Get file attributes

Disassembly:
call fcn.00406c2c
test eax, eax
je 0x4057e8
mov eax, dword [esp + 8]
test eax, eax
je 0x4057e8
cmp word [eax], 0
je 0x4057e8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4057f2
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x4057f5
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
call fcn.00406c2c
test eax, eax
je 0x40581a
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40581a
cmp word [eax], 0
je 0x40581a
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x40582c
cmp dword [ebp + 8], 0
je 0x405833
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
jmp 0x405835
xor al, al
pop ebp
ret 0xc
Function at 0x40586b
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call fcn.00406c2c
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test eax, eax
je 0x405891
cmp esi, ebx
je 0x405891
cmp word [esi], bx
je 0x405891
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4058a0
cmp dword [ebp + 8], ebx
je 0x4058ce
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, ebx
je 0x4058b9
cmp byte [ebp + 0x10], bl
je 0x4058b5
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.004057f5
xor eax, eax
jmp 0x4058d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4058ce
cmp eax, 3
je 0x4058ce
xor eax, eax
inc eax
jmp 0x4058d1
push 2
pop eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40646f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
test eax, eax
jl 0x4064a1
cmp dword [ebp - 4], edi
jne 0x4064e2
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x2710
ja 0x4064e2
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40648e
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40648e
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
mov esi, eax
cmp esi, edi
jl 0x406538
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x412acc
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jl 0x40652f
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
cmp esi, edi
jl 0x406526
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
cmp esi, edi
pop edi
pop esi
setge al
pop ebx
leave
ret 8
Function at 0x40a7c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x4140b0], 0
push ebx
push esi
push edi
mov edi, 0x400
jne 0x40a813
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x426a50], ax
xor eax, eax
mov word [0x426a52], ax
mov dword [0x4140b0], 0x426a50
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040dcb5
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
push ebx
push esi
xor eax, eax
push 0x4140a0
mov word [esi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
pop edi
mov word [esi + ebx*2 - 2], ax
pop esi
pop ebx
leave
ret 0x10

Function at 0x40ab92
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x68
push dword [0x420a00]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x421b14], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [ebp - 4], edi
mov ebx, 0xb1
jne 0x40abf4
mov ecx, dword [0x41a0d4]
call fcn.00406458
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push ebx
push edi
call esi
push 0x41267c
push 0
push 0xc2
push edi
call esi
mov byte [0x421b14], 1
mov edi, 0x5f5e100
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0x43a
push dword [ebp - 4]
mov dword [ebp - 0x60], 0x5c
call esi
xor eax, eax
inc eax
cmp byte [ebp + 8], 0
mov byte [ebp - 0x47], 0
mov dword [ebp - 0x5c], eax
je 0x40ac44
mov ecx, dword [ebp - 0x58]
and ecx, 0xbfffffff
or ecx, eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x4c], 0xa0
mov dword [ebp - 0x5c], 0x40000001
lea ecx, [ebp - 0x60]
push ecx
push eax
push 0x444
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push 0
push 0xc2
push dword [ebp - 4]
call esi
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
cmp byte [ebp + 8], 0
je 0x40ac8e
mov eax, dword [ebp - 0x58]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 1
push 0x444
push dword [ebp - 4]
call esi
push 0x4126a0
push 0
push 0xc2
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40b414
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00401200
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x40b42f
mov byte [ebx], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40b439
mov byte [eax], 0
test edi, edi
je 0x40b4e2
movzx eax, word [edi]
test ax, ax
je 0x40b4e2
push esi
xor esi, esi
xor ecx, ecx
movzx eax, ax
inc edi
inc edi
cmp ax, 0x3d
jne 0x40b472
cmp dword [ebp + 0xc], 0
je 0x40b47e
test esi, esi
jne 0x40b47e
test ebx, ebx
je 0x40b46e
mov byte [ebx], 1
mov esi, edx
jmp 0x40b48d
cmp ax, 0xd
je 0x40b4a0
cmp ax, 0xa
je 0x40b4a2
mov word [edx], ax
mov eax, dword [ebp + 0x14]
inc edx
add eax, 0xfffffffe
inc edx
cmp ecx, eax
jg 0x40b498
movzx eax, word [edi]
inc ecx
test ax, ax
jne 0x40b452
jmp 0x40b4a2
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x40b4a2
inc edi
inc edi
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov word [edx], ax
test ebx, ebx
je 0x40b4dd
mov word [ebx], ax
test esi, esi
je 0x40b4dd
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0x14]
lea eax, [ebp - 0x2000]
push eax
push ebx
call fcn.0040dc35
xor eax, eax
mov word [esi], ax
mov eax, edi
pop esi
jmp 0x40b4e4
xor eax, eax
pop edi
pop ebx
leave
ret 0x10

Function at 0x40b529
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push 0x400
lea eax, [ebp - 0x820]
push eax
call fcn.004117e6
cmp byte [0x421b15], 0
jne 0x40b5b7
push 6
push dword [0x41409c]
lea eax, [ebp - 0x820]
push eax
call fcn.004073cf
push eax
call fcn.0040e651
test eax, eax
jne 0x40b5b7
push 0x41271c
call fcn.004117d3
lea eax, [ebp - 0x820]
push eax
call fcn.0040a2ce
xor ecx, ecx
push 0x1e
mov word [ebp + eax*2 - 0x81e], cx
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.00409f4d
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x820]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
leave
ret

Function at 0x40b682
Capabilities:
Delete file

Disassembly:
push ebx
xor ebx, ebx
mov byte [0x4209f1], 1
cmp dword [0x420a00], ebx
je 0x40b6aa
push 0x7d
call fcn.004095b8
push eax
push 2
push dword [0x420a00]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x420a00]
mov dword [0x4209f4], ebx
mov byte [0x4209f0], 1
cmp eax, ebx
je 0x40b70b
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x421b24], ebx
jne 0x40b6d9
cmp byte [0x421b14], bl
je 0x40b6e1
cmp dword [0x4209f8], ebx
jne 0x40b703
push ebx
push 1
push 0x111
push dword [0x420a00]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40b703
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040a789
cmp dword [0x420a00], ebx
jne 0x40b6f7
cmp byte [0x420a08], bl
pop ebx
je 0x40b719
jmp fcn.0040b529
ret
Function at 0x40b755
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
xor ebx, ebx
cmp byte [0x420a10], bl
je 0x40b7d5
cmp word [0x41a0d8], bx
je 0x40b7d5
push esi
push 0x41a0d8
lea esi, [ebp - 0x808]
call fcn.0040b71a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
test eax, eax
jne 0x40b7d5
push dword [ebp + 8]
call fcn.0040a2ce
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x808]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x40b7da
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00401200
cmp byte [0x420a10], 0
je 0x40b881
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x100c]
call fcn.0040b71a
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x40b881
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x100c]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b878
shr dword [ebp - 4], 1
mov eax, 0x3ff
cmp dword [ebp - 4], eax
jae 0x40b85c
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x80c], cx
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 8]
call fcn.0040dc35
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8

Function at 0x40b9a9
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp byte [0x4208e6], 0
mov eax, dword [ebp + 0xc]
mov dword [0x4208e8], eax
mov eax, dword [ebp + 0x10]
mov dword [0x4208ec], eax
mov eax, dword [ebp + 0x14]
mov dword [0x4208e0], eax
je 0x40b9d9
xor eax, eax
inc eax
jmp 0x40ba02
cmp byte [0x4208e7], 0
je 0x40b9e7
push 2
pop eax
jmp 0x40ba02
push dword [ebp + 8]
push 0x40ad62
push dword [0x420a00]
push str.REPLACEFILEDLG
push dword [0x414e74]
call esi
dec eax
je 0x40ba54
dec eax
je 0x40ba66
dec eax
je 0x40ba4d
dec eax
jne 0x40ba31
push dword [ebp + 8]
push 0x40b0ae
push dword [0x420a00]
push str.RENAMEDLG
push dword [0x414e74]
call esi
test eax, eax
je 0x40b9b3
mov al, 0x52
jmp 0x40ba61
dec eax
je 0x40ba42
dec eax
mov al, 0x4e
jne 0x40ba61
mov byte [0x4208e7], 1
jmp 0x40ba61
mov byte [0x4209f2], 1
mov al, 0x43
jmp 0x40ba61
mov byte [0x4208e6], 1
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 0x59
pop esi
pop ebp
ret 0x10
mov al, 0x4e
jmp 0x40ba61
Function at 0x40d3cd
Capabilities:
Accept command line arguments
Read file via mapping
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 1
call fcn.0040e028
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, 0x4294c0
call fcn.0040e74e
mov esi, 0x5800
push esi
push ebx
mov edi, 0x41b0e0
push edi
call fcn.00409f4d
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40d47b
push eax
call fcn.0040b2ef
cmp byte [0x420a11], bl
je 0x40d46d
push str.winrarsfxmappingfile.tmp
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40d462
push esi
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40d459
push esi
push eax
push edi
call fcn.00409f7a
push edi
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d47b
push dword [ebp - 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x400
mov esi, 0x41a8e0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push str.sfxname
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0x64
push edi
mov dword [0x414e74], edi
mov dword [0x414e78], edi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x65
push dword [0x414e78]
mov dword [0x41a8dc], eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
lea ecx, [ebp - 0xc]
mov dword [0x41a8d8], eax
call fcn.00411856
push esi
mov ecx, 0x414e88
call fcn.004095a1
lea ecx, [ebp - 0x5c]
call fcn.00406407
lea ecx, [ebp - 0x34]
call fcn.00406407
push 0x64
call fcn.0040aa92
push 0x64
mov dword [ebp - 0x40], eax
call fcn.0040aa92
push ebx
push 0x40cb6b
mov dword [ebp - 0x18], eax
push ebx
lea eax, [ebp - 0x5c]
mov dword [0x41a0d4], eax
push str.STARTDLG
lea eax, [ebp - 0x34]
push edi
mov dword [0x41a0d0], eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea ecx, [ebp - 0x34]
mov dword [0x41a0d0], ebx
mov dword [0x41a0d4], ebx
call fcn.00406429
lea ecx, [ebp - 0x5c]
call fcn.00406429
lea ecx, [ebp - 0xc]
call fcn.004118b0
cmp byte [0x420a08], bl
je 0x40d55a
call fcn.0040b529
push 0x100
push ebx
push 0x4208f0
call fcn.00409f4d
cmp dword [0x421b24], ebx
jbe 0x40d57d
push dword [0x421b18]
call fcn.00409ec9
push dword [0x41a8dc]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
mov eax, dword [0x41a8d8]
cmp eax, ebx
je 0x40d597
push eax
call esi
cmp dword [0x414e7c], ebx
jne 0x40d5b6
cmp byte [0x4209f2], bl
je 0x40d5b6
push 0xff
mov ecx, 0x414e7c
call fcn.0040326b
mov eax, dword [0x421b30]
mov byte [0x4209f2], 1
cmp eax, ebx
je 0x40d5cc
push eax
call fcn.0040b4ea
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [0x421b2c]
cmp eax, ebx
ja 0x40d5e0
mov eax, dword [0x414e7c]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d945
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x4116fb
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x412abc
push 1
xor ebx, ebx
push ebx
push 0x412b6c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4117cc
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x412b5c
push eax
call dword [ecx]
test eax, eax
jl 0x4117c3
cmp byte [ebp + 8], bl
je 0x41174e
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x41176b
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x41177d
push 0x41267c
jmp 0x411780
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x411795
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x4117a6
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x4117ba
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x4117e6
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x401341
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc]
mov ebx, str.360Safetray
push eax
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push ebx
mov esi, 0x80000002
push edi
mov dword [ebp - 4], ecx
push esi
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0x208
call dword [0x434558]
cmp dword [ebp + 8], 0
mov dword [ebp - 8], eax
jne 0x4013a1
test eax, eax
jne 0x40141e
push ebx
push edi
push esi
call dword [0x43454c]
jmp 0x40141e
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.004010ce
test eax, eax
je 0x401423
lea eax, [ebp - 0x218]
push str.safemon360tray.exe
push eax
call dword [0x434560]
lea eax, [ebp - 0x218]
push str.__start
push eax
call dword [0x434550]
cmp dword [ebp - 8], 0
jne 0x4013fd
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [0x434464]
pop ecx
test eax, eax
pop ecx
je 0x40141e
lea eax, [ebp - 0x218]
push eax
call dword [0x434468]
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push ebx
push edi
push esi
call dword [0x434554]
push 1
pop eax
jmp 0x401425
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x406bfc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00432596
mov ebx, dword [0x434428]
mov edi, eax
lea eax, [edi + 1]
push eax
call ebx
pop ecx
mov dword [ebp + 8], eax
test eax, eax
pop ecx
je 0x406c71
test edi, edi
jle 0x406c36
sub esi, eax
mov ecx, edi
mov dl, byte [esi + eax]
xor dl, 0x13
mov byte [eax], dl
inc eax
dec ecx
jne 0x406c2a
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
call ebx
mov ebx, eax
lea eax, [esi + 1]
push eax
push 0
push ebx
call fcn.0043254c
add esp, 0x10
test ebx, ebx
je 0x406c65
push ebx
push edi
push dword [ebp + 8]
call fcn.00406b70
add esp, 0xc
and byte [esi + ebx], 0
push dword [ebp + 8]
call dword [0x434418]
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x406c76
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00432596
mov edi, eax
push esi
push edi
push esi
call fcn.00406bb1
mov eax, edi
add esp, 0x10
cdq
sub eax, edx
xor ecx, ecx
sar eax, 1
test eax, eax
jle 0x406ca5
xor byte [ecx + esi], 0x13
inc ecx
cmp ecx, eax
jl 0x406c9c
and byte [eax + esi], 0
pop edi
pop esi
ret

Function at 0x409082
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x4685b8
push 8
mov eax, edx
pop esi
test al, 1
je 0x40909c
shr eax, 1
xor eax, 0xedb88320
jmp 0x40909e
shr eax, 1
dec esi
jne 0x40908f
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x4689b8
jl 0x40908a
pop esi
ret

Function at 0x40a58e
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x411e29
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x411e37
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x411f18
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x435d10]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x435d10]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x435d10]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x435d10]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x435d10]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x435d10]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x435d10]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x435d10]
xor eax, esi
inc edx
dec edi
jne 0x411e54
pop ebx
cmp dword [ebp + 0x10], 0
je 0x411f39
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x435d10]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x411f1e
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x431352
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
lea esi, [ecx + 0x5c]
push 0x40
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.00431df9
mov byte [esi], 0x80
pop esi
ret