joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x100013d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0xc]
add ebx, 0x24
mov ebx, dword [ebx + 4]
movzx eax, byte [ebx]
or eax, 0x5c3a00
mov dword [ebp - 8], eax
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
lea eax, [ebp - 8]
push eax
call fcn.100033f8
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x100015ce
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x1bc558ea
push eax
call fcn.10002ac0
mov dword [0x6233588], eax
call fcn.100033e6
mov dword [0x6233584], eax
call fcn.100013d0
mov dword [0x623356c], eax
mov dword [0x6233578], 0x6231fbd
mov dword [0x623357c], 0x6231374
mov dword [ebp - 0xa4], 0x94
lea eax, [ebp - 0xa4]
push eax
call fcn.100033f2
mov eax, dword [ebp - 0xa0]
rol eax, 8
add eax, dword [ebp - 0x9c]
mov dword [0x6233570], eax
push 0x6233590
push 0xffffffffffffffff
call fcn.1000340a
mov dword [0x6233640], 0xffffffff
mov dword [ebp - 0x10], 0xfe363c80
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.100033a4
push 4
push 0x1000
push 0x8000
push 0
call fcn.1000341c
mov dword [ebp - 4], eax
test eax, eax
je 0x100017d8
push 0x8000
push dword [ebp - 4]
push 0x6231176
call fcn.100033da
test eax, eax
je 0x100017d8
push 0
push 0x623117e
call fcn.10003410
push 0x8000
push dword [ebp - 4]
push dword [ebp - 4]
call fcn.100033ec
call fcn.10002377
push dword [0x623356c]
push 0x6231186
lea eax, [ebp - 0x10]
push eax
call fcn.10003506
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0
push 0
call fcn.100033bc
mov dword [0x6233564], eax
call fcn.100033e0
cmp eax, 0xb7
je 0x100017c1
push dword [ebp - 4]
call fcn.100024a7
push dword [ebp - 4]
call fcn.100033c8
push 0x8000
push 0
push dword [ebp - 4]
call fcn.10003422
lea eax, [ebp - 0x236]
push eax
push 0x202
call fcn.100034b8
call fcn.10001d0c
bswap eax
mov dword [0x6233574], eax
push 0
push 0
push 1
push 0
call fcn.100033b6
mov dword [ebp - 0xa8], eax
xor ecx, ecx
push ecx
push ecx
push dword [ebp - 0xa8]
push 0x62329c0
push ecx
push ecx
call fcn.100033c2
push eax
call fcn.100033b0
xor eax, eax
push eax
push eax
push dword [ebp - 0xa8]
push 0x6231410
push eax
push eax
call fcn.100033c2
push eax
push 0x2710
push eax
call fcn.10003428
call fcn.100033b0
xor edx, edx
mov eax, 0x23c34600
mul dword [0x6231140]
not eax
not edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.100033a4
jmp 0x10001776
push dword [ebp - 4]
call fcn.100033c8
push 0x8000
push 0
push dword [ebp - 4]
call fcn.10003422
push 0
call fcn.100033ce
Function at 0x10001c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push esi
xor eax, eax
xor edx, edx
dec edx
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, dl
shr edx, 8
xor edx, dword [eax*4 + 0x6231800]
loop 0x10001c11
mov eax, edx
not eax
pop esi
pop edx
pop ecx
leave
ret 8
Function at 0x10002e60
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
pushal
mov ecx, 0x40
lea edi, [ebp - 4]
mov eax, 0xfffefdfc
std
stosd dword es:[edi], eax
sub eax, 0x4040404
loop 0x10002e78
cld
xor eax, eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dl, byte ss:[ecx + ebp - 0x100]
add al, dl
add al, byte [ebx + esi]
mov dh, byte ss:[eax + ebp - 0x100]
mov byte ss:[ecx + ebp - 0x100], dh
mov byte ss:[eax + ebp - 0x100], dl
inc cl
je 0x10002eb9
inc ebx
cmp ebx, dword [ebp + 0xc]
je 0x10002e86
jmp 0x10002e88
xor eax, eax
xor ebx, ebx
xor ecx, ecx
xor edx, edx
mov edi, dword [ebp + 0x10]
inc al
mov dl, byte ss:[eax + ebp - 0x100]
add bl, dl
mov dh, byte ss:[ebx + ebp - 0x100]
mov byte ss:[eax + ebp - 0x100], dh
mov byte ss:[ebx + ebp - 0x100], dl
add dl, dh
and edx, 0xff
mov dl, byte ss:[edx + ebp - 0x100]
xor byte [ecx + edi], dl
inc ecx
cmp ecx, dword [ebp + 0x14]
jne 0x10002ec4
popal
leave
ret 0x10
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x7d8c5758
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x3fc453d3
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4068fb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40691f
xor eax, eax
test eax, eax
je 0x406932
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406932
xor ecx, ecx
jmp 0x406935
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a58
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43110c], 0
push esi
jne 0x406a8f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a69
mov dword [ecx*4 + 0x431108], eax
inc ecx
cmp ecx, 0x100
jl 0x406a64
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406ac0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431108]
xor eax, esi
inc ecx
dec edx
jne 0x406aa2
pop edi
not eax
pop esi
ret 0xc

Function at 0x408922
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
sub edi, 0xf4c4412e
call fcn.00408959
sub edi, edx
xor dword [eax], esi
add edx, 0x5b55d323
mov edx, 0xdb1423d0
add eax, 1
add edi, 1
cmp eax, ecx
jne fcn.00408922
add edi, 0xfcfd6289
ret
Function at 0x40316b
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
lea eax, [ebp - 4]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or al, 9
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040650f
xor ebx, ebx
cmp eax, ebx
jne 0x40324e
test byte [ebp + 0x10], 2
je 0x4031cc
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 8], ebx
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x403233
lea eax, [ebp - 0x110]
push 0x105
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x403208
test edi, edi
jne 0x403233
push dword [ebp + 0x10]
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 4]
call fcn.0040316b
test eax, eax
jne 0x403211
lea eax, [ebp - 0x110]
push 0x105
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x4031e1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406cdc
test eax, eax
jne 0x403243
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40324e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x40324e
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x403573
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x403590
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x40359f
mov ebx, 0x4181f8
mov eax, dword [ebp + 8]
test eax, eax
jl 0x4035b4
mov ecx, dword [0x425cd8]
add ecx, eax
push ecx
call fcn.00403765
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.0040374f
test eax, eax
je 0x403706
test byte [ebp + 0x17], 0x80
je 0x4036ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40c168
mov dword [ebp - 0xc], eax
call fcn.00406e01
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x403745
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x403604
mov esi, dword [ebp + 0x14]
mov edi, 0x4141f8
push esi
push edi
call fcn.0040374f
test eax, eax
je 0x403706
sub dword [ebp + 0x14], esi
mov dword [0x40c180], edi
mov dword [0x40c184], esi
mov eax, dword [ebp - 8]
mov ecx, 0x40c168
mov dword [0x40c188], ebx
mov dword [0x40c18c], eax
call fcn.00406e21
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x4036e7
mov esi, dword [0x40c188]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x425d34], 1
mov edi, eax
je 0x4036a6
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x403673
cmp dword [ebp + 0x14], 0
jne 0x4036a6
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x50]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push 0
call fcn.00405726
mov dword [ebp - 0xc], edi
test esi, esi
je 0x4036db
cmp dword [ebp + 0x10], 0
jne 0x4036c3
push esi
push ebx
push dword [ebp + 0xc]
call fcn.004062c9
test eax, eax
je 0x4036eb
add dword [ebp - 4], esi
jmp 0x4036cf
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x40c188]
cmp dword [ebp - 0x10], 1
jne 0x403627
jmp 0x403745
cmp dword [ebp + 0x14], 0
jg 0x4035f7
jmp 0x403745
push 0xfffffffffffffffc
jmp 0x403708
push 0xfffffffffffffffe
jmp 0x403708
test edi, edi
je 0x40373a
cmp dword [ebp + 0x14], esi
jge 0x4036fb
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.0040374f
test eax, eax
jne 0x403742
push 0xfffffffffffffffd
pop eax
jmp 0x403748
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403716
mov esi, dword [ebp + 0x14]
mov edi, 0x4141f8
push esi
push edi
call fcn.0040374f
test eax, eax
je 0x403706
push esi
push edi
push dword [ebp + 0xc]
call fcn.004062c9
test eax, eax
je 0x4036eb
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x40370b
jmp 0x403745
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403d97
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [0x425c74]
push edi
push 2
call fcn.00406cdc
xor ebx, ebx
cmp eax, ebx
je 0x403dc3
call eax
movzx eax, ax
push eax
push 0x42c000
call fcn.004065e7
jmp 0x403e17
mov edi, 0x421638
push ebx
push edi
push ebx
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov byte [0x42c000], 0x30
mov byte [0x42c001], 0x78
mov byte [0x42c002], bl
call fcn.00406570
cmp byte [0x421638], bl
jne 0x403e0c
push ebx
push edi
push 0x408372
push str..DEFAULTControl_PanelInternational
push 0x80000003
call fcn.00406570
push edi
push 0x42c000
call sub.KERNEL32.dll_lstrcatA
call 0x40407c
mov eax, dword [0x425c7c]
mov ebp, 0x42b400
and eax, 0x20
push ebp
mov dword [0x425d00], eax
mov dword [0x425d1c], 0x10000
call fcn.0040610f
test eax, eax
jne 0x403ec7
mov ecx, dword [esi + 0x48]
cmp ecx, ebx
je 0x403ec7
mov edx, dword [esi + 0x4c]
mov eax, dword [0x425cb8]
mov edi, 0x424400
push ebx
add edx, eax
push edi
add ecx, eax
push edx
push ecx
push dword [esi + 0x44]
call fcn.00406570
mov al, byte [0x424400]
cmp al, bl
je 0x403ec7
cmp al, 0x22
jne 0x403e86
mov edi, 0x424401
push 0x22
push edi
call fcn.0040604c
mov byte [eax], bl
push edi
call sub.KERNEL32.dll_lstrlenA
lea eax, [eax + edi - 4]
cmp eax, edi
jbe 0x403eba
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403eba
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403eb4
test al, 0x10
jne 0x403eba
push edi
call fcn.00406068
push edi
call fcn.00406021
push eax
push ebp
call fcn.00406689
push ebp
call fcn.0040610f
test eax, eax
jne 0x403edd
push dword [esi + 0x118]
push ebp
call fcn.0040671c
test byte [0x425c7c], 0x10
je 0x403efd
cmp dword [0x425c80], ebx
jne 0x403efd
call fcn.00403d76
mov dword [0x4243e0], 1
push 0x8040
push ebx
push ebx
push 1
push 0x67
push dword [0x425c60]
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [0x425448], eax
cmp dword [esi + 0x50], 0xffffffff
mov edi, 0x425400
je 0x403fa3
mov ecx, dword [0x425c60]
mov esi, 0x40a8b8
push edi
mov dword [0x425404], 0x401000
mov dword [0x425410], ecx
mov dword [0x425414], eax
mov dword [0x425424], esi
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x404072
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
push dword [0x425c60]
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
push ebx
push ebx
push eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
push eax
push dword [ebp + edx*2 - 0x75]
push ebp
mov ebp, esp
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x404077
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x404088
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x404092
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40406d
xor eax, eax
pop edi
pop esi
ret
Function at 0x405d2e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
and dh, al
test dword [esi - 8], ebx
invalid
invalid
cmp al, 0xc6
test dword [edi - 8], ebx
invalid
push dword [esi - 0x3a]
test dword [eax - 8], esp
invalid
invalid
jle 0x405d2d
test dword [ecx - 8], esp
invalid
invalid
jle 0x405d34
test dword [edx - 8], esp
invalid
call dword [edx]
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.00404025
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00403f86
add esp, 0xc
jmp 0x405f8d
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.00404015
pop ss
xchg edx, eax
mov ebp, 0x60b5ffb6
cld
invalid

Function at 0x406021
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x40605f
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
xchg ebp, eax
sar al, 1
invalid
invalid
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x406064
jmp 0x4059b7
invalid
movsd dword es:[edi], dword [esi]
test ah, bh

Function at 0x4061dd
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
call fcn.00404015
xor eax, 0x8b951ed9
clc

Function at 0x4061fd
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00404015
call dword [ebx]
cwde
push ebp
sbb ecx, dword [ecx - 0x75]
call dword [ebx]
cwde
push ebp
sbb ecx, dword [ecx - 0x75]
dec ecx
mov esi, dword [ebx + ecx*4]
xor al, 0x8b
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x406202
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x406202
call fcn.00404015
jne 0x4061e8

Function at 0x406222
Capabilities:
Get common file path

Disassembly:
mov edi, 0x245a8bad
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00404015
push edx
insb byte es:[edi], dx
inc esi
aaa
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
call fcn.00404815
or al, 0

Function at 0x406251
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40abdc]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x406296
test edi, edi
jne 0x40625c
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x406290
Function at 0x4062f8
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
test esi, esi
mov dword [0x4233c8], 0x4c554e
mov edi, 0x400
mov ebp, 0x4233c8
je 0x406344
push 1
push 0
push esi
call fcn.00406222
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406463
cmp eax, edi
jg 0x406463
mov esi, 0x4237c8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406463
cmp eax, edi
jg 0x406463
push esi
push ebp
push str._s_s_r_n
push 0x422fc8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x425c74]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.0040671c
push 4
push 0xc0000000
push esi
call fcn.00406222
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x406463
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40645c
push edi
push esi
push ebp
call fcn.0040629a
test eax, eax
je 0x40645c
push str._Rename__r_n
push esi
call 0x406187
test eax, eax
jne 0x4063fa
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x40642f
add eax, 0xa
push 0x40abe0
push eax
call 0x406187
mov ebp, eax
test ebp, ebp
je 0x40642b
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x40641c
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x406416
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x406431
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x422fc8
push eax
call fcn.004061dd
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.004062c9
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x406468
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x40648b
push dword [esp + 8]
push dword [esp + 8]
call fcn.004062f8
pop ecx
pop ecx
inc dword [0x425d10]
ret 8

Function at 0x406570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
mov dword [ebp - 4], 0x400
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040650f
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x4065df
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp + 0xc]
push esi
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and byte [esi + 0x3ff], 0
test edi, edi
pop edi
jne 0x4065df
cmp dword [ebp + 0xc], 1
je 0x4065e2
cmp dword [ebp + 0xc], 2
je 0x4065e2
and byte [esi], 0
pop esi
leave
ret 0x14
Function at 0x406c6e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406c92
xor eax, eax
test eax, eax
je 0x406ca4
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406ca4
xor ecx, ecx
jmp 0x406ca7
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a2b4]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406d93
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x423bcc], 0
push esi
jne 0x406dca
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406da4
mov dword [ecx*4 + 0x423bc8], eax
inc ecx
cmp ecx, 0x100
jl 0x406d9f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406dfb
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x423bc8]
xor eax, esi
inc ecx
dec edx
jne 0x406ddd
pop edi
not eax
pop esi
ret 0xc