joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a5fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov edx, dword [ebp - 4]
mov eax, 0x46a664
call fcn.00405050
test eax, eax
jne 0x46a655
mov edx, dword [ebp - 4]
mov eax, 0x46a670
call fcn.00405050
test eax, eax
jne 0x46a655
lea eax, [ebp - 0x10c]
mov edx, dword [ebp - 4]
call fcn.00409770
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x46a655
test byte [ebp - 0xc], 0x10
je 0x46a655
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x46b638
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
movzx eax, word [ebp - 0xa]
dec eax
test eax, eax
jl 0x46b695
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
xor al, byte [ebp - 0x14]
and eax, 0xff
mov eax, dword [eax*4 + 0x47e38c]
mov edx, dword [ebp - 0x14]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x46b664
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret

Function at 0x46b6a4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov al, byte [ebp - 8]
xor al, byte [ebp - 1]
and eax, 0xff
mov eax, dword [eax*4 + 0x47e38c]
mov edx, dword [ebp - 8]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x46c0b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
sub eax, 1
jno 0x46c0da
call fcn.00403c0c
test eax, eax
jl 0x46c116
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x14]
mov edx, dword [ebp - 0x18]
xor al, byte [edx]
and eax, 0xff
mov edx, dword [0x47f814]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
add dword [ebp - 0x18], 1
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x46c0e9
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret
Function at 0x46c8e4
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x46c990
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x20]
and eax, 0xffff
or eax, 2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov edx, dword [ebp - 0x14]
xor edx, 1
imul edx, dword [ebp - 0x14]
shr edx, 8
xor al, dl
mov edx, dword [ebp - 0x18]
mov byte [edx], al
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
call fcn.0046b6a4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
and eax, 0xff
add dword [ebp - 0x24], eax
imul eax, dword [ebp - 0x24], 0x8088405
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
shr eax, 0x18
mov edx, dword [ebp - 0x20]
call fcn.0046b6a4
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x18]
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x46c927
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x10], edx
mov esp, ebp
pop ebp
ret

Function at 0x46c9b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0046ca7c
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
and eax, 0xffff
or eax, 2
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, 1
imul dword [ebp - 0x18]
shr eax, 8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor al, byte [edx + ecx]
mov edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x24], al
mov eax, dword [ebp - 0x14]
mov al, byte [ebp + eax - 0x24]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
call fcn.0046b6a4
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
and eax, 0xff
mov edx, dword [ebp - 4]
add dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 0xc], 0x8088405
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
shr eax, 0x18
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
call fcn.0046b6a4
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc
jne 0x46c9cf
mov al, byte [ebp + 0xb]
cmp al, byte [ebp - 0x19]
sete byte [ebp - 0xd]
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 4
Function at 0x46ca7c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x12345678
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x23456789
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x34567890
mov eax, dword [ebp - 8]
call fcn.00404d14
test eax, eax
jle 0x46cb1b
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
call fcn.0046b6a4
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
and eax, 0xff
mov edx, dword [ebp - 4]
add dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 0xc], 0x8088405
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
shr eax, 0x18
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
call fcn.0046b6a4
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x46cabc
mov esp, ebp
pop ebp
ret
Function at 0x470b74
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
test dl, dl
je 0x470b8f
add esp, 0xfffffff0
call fcn.00404030
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404efc
xor eax, eax
push ebp
push 0x470cc4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00403c9c
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 0xc]
call fcn.0046a0f8
test al, al
je 0x470bf0
mov ax, word [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
push eax
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x46f0a0]
call fcn.0046f83c
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x470c13
mov ax, word [ebp + 8]
push eax
push 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
push eax
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x46f0a0]
call fcn.0046f83c
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x34], edx
mov edx, dword [edx]
mov edx, dword [edx + 0x64]
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x3c], edx
mov edx, dword [edx]
mov edx, dword [edx + 0x1c]
mov dword [eax + 0x38], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x3e], 1
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebp - 0xc]
call fcn.00404ab0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x94], edx
mov edx, dword [edx]
mov edx, dword [edx + 0x34]
mov dword [eax + 0x90], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
mov dx, word [ebp + 8]
mov word [eax + 0x3c], dx
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402bb0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409470
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004723f0
mov eax, dword [ebp - 4]
call fcn.00471bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470ccb
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404a80
ret
Function at 0x47690c
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x4769da
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xc]
or ax, 2
mov word [ebp - 0x12], ax
movzx eax, word [ebp - 0x12]
mov dx, word [ebp - 0x12]
xor dx, 1
movzx edx, dx
imul edx
shr eax, 8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor byte [edx + ecx], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.0046b6a4
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
and eax, 0xff
mov edx, dword [ebp - 4]
add dword [edx + 8], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 8], 0x8088405
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
shr eax, 0x18
mov edx, dword [ebp - 4]
xor al, byte [edx + 0xc]
and eax, 0xff
mov edx, dword [0x47f814]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xc]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x476932
mov esp, ebp
pop ebp
ret
Function at 0x476abc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
call fcn.0041ce44
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xe], 0
jmp 0x476b9a
mov eax, dword [ebp - 4]
call fcn.00476a58
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x10]
mov ecx, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.004769e0
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
xor byte [ecx + edx + 0x10], al
mov eax, dword [ebp - 4]
lea edx, [eax + 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov al, byte [ecx + eax + 0x10]
call fcn.00476bd4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xc
jne 0x476b14
mov eax, dword [ebp - 4]
cmp byte [eax + 0x20], 0
je 0x476b5f
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x1b]
mov edx, dword [ebp - 4]
cmp al, byte [edx + 0x1f]
sete byte [ebp - 0xd]
jmp 0x476b84
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x1b]
mov edx, dword [ebp - 4]
cmp al, byte [edx + 0x1f]
jne 0x476b7b
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x1a]
mov edx, dword [ebp - 4]
cmp al, byte [edx + 0x1e]
je 0x476b7f
xor eax, eax
jmp 0x476b81
mov al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x476b97
mov eax, dword [ebp - 4]
lea edx, [eax + 0x30]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx]
inc byte [ebp - 0xe]
cmp byte [ebp - 0xd], 0
jne 0x476baf
mov al, byte [ebp - 0xe]
mov edx, dword [ebp - 4]
cmp al, byte [edx + 0x34]
jb 0x476ae1
cmp byte [ebp - 0xd], 0
jne 0x476bc6
mov dl, 1
mov eax, dword [0x468710]
call fcn.00469224
call fcn.00404498
mov al, byte [ebp - 0xd]
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476bd4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov al, byte [ebp - 1]
call fcn.0046b6a4
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
mov edx, dword [ebp - 8]
add dword [edx + 4], eax
mov eax, dword [ebp - 8]
imul eax, dword [eax + 4], 0x8088405
inc eax
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
shr eax, 0x18
mov edx, dword [ebp - 8]
mov edx, dword [edx + 8]
call fcn.0046b6a4
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
pop ecx
pop ecx
pop ebp
ret
Function at 0x479428
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x10]
test al, al
je 0x47946d
mov eax, dword [ebp - 4]
add eax, 4
push eax
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xb8]
mov dl, 1
mov eax, dword [0x4767bc]
call fcn.0047682c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4794ae
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xf0]
mov dword [eax + 0x28], ecx
mov ecx, dword [edx + 0xf4]
mov dword [eax + 0x2c], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x30
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xb8]
call fcn.00404ab0
mov eax, dword [ebp - 4]
mov al, byte [eax + 0xbc]
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x34], al
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
lea ecx, [eax + 4]
mov dl, 1
mov eax, dword [0x477830]
call fcn.004778c4
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4795b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00474474
mov edx, dword [ebp - 0x18]
mov byte [edx + 0x20], al
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00474438
mov edx, dword [ebp - 0x18]
mov byte [edx + 0x18], al
mov eax, dword [ebp - 8]
call fcn.0047461c
mov edx, dword [ebp - 0x18]
mov byte [edx + 0x21], al
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x90]
mov dword [eax + 0x28], ecx
mov ecx, dword [edx + 0x94]
mov dword [eax + 0x2c], ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x100]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x104]
mov dword [eax + 0x34], ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x44], 0
je 0x479597
mov eax, dword [ebp - 0x18]
add eax, 0x3c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xc]
call fcn.00404ab0
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xaa]
mov edx, dword [ebp - 0x18]
mov word [edx + 0x44], ax
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x39], 1
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x3c]
mov edx, dword [ebp - 0x18]
mov word [edx + 0x46], ax
mov eax, dword [ebp - 0x18]
call fcn.004779e4
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4795bf
mov eax, dword [ebp - 0x18]
call fcn.00403ccc
ret
Function at 0x47b26c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x47b274
xor eax, eax
push ebp
push 0x47b4cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x348]
call fcn.004400d0
push dword [ebp - 8]
push 0x47b4e0
lea eax, [ebp - 0xc]
mov edx, 0x480ddc
call fcn.00404cb8
push dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404dd4
mov eax, dword [ebp - 4]
call fcn.00404f0c
push eax
push dword [0x47ebb8]
push 0x47b4f0
lea eax, [ebp - 0x14]
mov edx, 0x480ddc
call fcn.00404cb8
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404dd4
mov eax, dword [ebp - 0x10]
call fcn.00404f0c
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x47fbec]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0045dffc
lea edx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x348]
call fcn.004400d0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x34c]
call fcn.004723f0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x34c]
mov edx, 0x47b4fc
call fcn.004713dc
lea edx, [ebp - 0x24]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x348]
call fcn.004400d0
push dword [ebp - 0x24]
push 0x47b4f0
lea eax, [ebp - 0x28]
mov edx, 0x480ddc
call fcn.00404cb8
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404dd4
mov eax, dword [ebp - 0x20]
call fcn.00404f0c
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.00404c4c
mov eax, dword [ebp - 0x1c]
call fcn.00409344
lea edx, [ebp - 0x34]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x348]
call fcn.004400d0
push dword [ebp - 0x34]
push 0x47b4f0
push 0x47b508
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404dd4
mov eax, dword [ebp - 0x30]
call fcn.00404f0c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404c4c
mov eax, dword [ebp - 0x2c]
call fcn.00409344
lea edx, [ebp - 0x40]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x348]
call fcn.004400d0
push dword [ebp - 0x40]
push 0x47b4f0
push 0x47b518
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00404dd4
mov eax, dword [ebp - 0x3c]
call fcn.00404f0c
mov edx, eax
lea eax, [ebp - 0x38]
call fcn.00404c4c
mov eax, dword [ebp - 0x38]
call fcn.00409344
mov eax, dword [0x47fbec]
mov eax, dword [eax]
mov dx, 0xfffe
call fcn.0045dffc
push 0
mov cx, word [0x47b524]
mov dl, 2
mov eax, 0x47b530
call fcn.00439810
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b4d4
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.00404a80
lea eax, [ebp - 0x38]
call fcn.00404a5c
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00404a80
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404a80
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404a80
lea eax, [ebp - 0x1c]
call fcn.00404a5c
lea eax, [ebp - 0x18]
call fcn.00404a5c
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404a80
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a80
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x22be7600
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2744f19
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10026d8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100a024]
cmp eax, 0xffffffff
je 0x1002787
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
mov esi, 0x314
push esi
push 0x100a5a0
push dword [0x100a024]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x100277e
cmp dword [ebp - 4], esi
jne 0x100277e
cmp dword [0x100a5a0], 0x6e776453
jne 0x100277e
test byte [0x100a5ab], 0x80
jne 0x1002785
or byte [0x100a5ab], 0x40
push 0x100a7b0
push 0x103
push 0x100a9e0
mov byte [0x100a7af], bl
mov byte [0x100a8b3], bl
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0xc
cmp dword [0x100a5a4], 0x10000
jne 0x1002785
test dword [0x100a5a8], 0x3fffffec
jne 0x1002785
and byte [0x100a5ab], 0xbf
jmp 0x1002785
or byte [0x100a5ab], 0x80
pop esi
pop ebx
leave
ret

Function at 0x1002789
Capabilities:
Create directory
Delete directory
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x100a028]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_SetErrorMode]
push edi
xor ebx, ebx
push ebx
mov dword [ebp + 0x90], eax
mov dword [ebp - 0x7c], ebx
call esi
mov dword [ebp - 0x80], eax
or eax, 1
push eax
call esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edi, eax
mov dword [ebp - 0x78], ebx
xor edx, edx
mov ecx, 0xf4240
mov eax, edi
div ecx
lea eax, [ebp - 0x74]
push edx
push dword [ebp + 0x9c]
push 0x10021fc
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x10
push ebx
lea eax, [ebp - 0x74]
push eax
inc edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
jne 0x1002816
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x1002838
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], 0x3e8
jl 0x10027c7
jmp 0x1002838
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
jne 0x1002831
push 4
push ebx
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
mov dword [ebp - 0x7c], 1
push dword [ebp - 0x80]
call esi
mov ecx, dword [ebp + 0x90]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
pop ebx
call fcn.01005d91
add ebp, 0x94
leave
ret 4