joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459205
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00459181
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x459374
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x459374
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x459329
jg 0x459261
test eax, eax
je 0x45931f
push 1
push 0x1000
call fcn.004510bc
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x459284
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x459316
push 0x8000
push ebx
call fcn.00449b59
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4592ad
jg 0x4592a8
cmp ecx, 0x1000
jb 0x4592ad
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0044fc1f
add esp, 0x10
cmp eax, 0xffffffff
je 0x4592f2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4592a8
jl 0x4592d9
test ecx, ecx
jne 0x45929a
push dword [ebp - 0xc]
push ebx
call fcn.00449b59
push esi
call fcn.0044a588
add esp, 0xc
xor ebx, ebx
jmp 0x459382
cmp byte [edi + 0x24], 0
je 0x459309
cmp dword [edi + 0x20], 5
jne 0x459309
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x459314
mov ebx, dword [edi + 0x18]
jmp 0x459316
xor ebx, ebx
push esi
call fcn.0044a588
pop ecx
jmp 0x459382
test ecx, ecx
jg 0x4592eb
jl 0x459329
test eax, eax
jae 0x4592eb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00455984
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x459349
cmp byte [edi + 0x1c], 0
je 0x4592eb
jmp 0x45937a
push ebx
call fcn.0045349b
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4592eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x459382
cmp byte [edi + 0x1c], 0
je 0x45937f
mov ebx, dword [edi + 0x18]
jmp 0x459382
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00455984
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x459fa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x459fcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x459fcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1001c6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c73b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c6f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c6f2
cmp esi, ebx
jge 0x1001c6f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c74d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x1001c970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001c998
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001c9b2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.100210ae
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022650
leave
ret 4

Function at 0x1001cb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cbb6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cc15
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.100210ae
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.100210ae
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.100210ae
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022650
leave
ret 0x10
Function at 0x1001cc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cc5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cc8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cc8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.100210ae
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cc8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022650
leave
ret 8

Function at 0x100210ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100210bd
pop dword [ebp - 0x40]
mov eax, 0x8c500ae4
add eax, 0x83b205d9
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xec265990
add dword [ebp - 0x50], 0x622bebbb
mov dword [ebp - 0x4c], 0x3fa6bb0f
add dword [ebp - 0x4c], 0xf28c9136
mov dword [ebp - 0x48], 0x5e04b5bc
add dword [ebp - 0x48], 0xee478e72
mov dword [ebp - 0x44], 0xbfdc9c74
add dword [ebp - 0x44], 0x4023638c
lea eax, [ebp - 0x50]
push eax
mov eax, 0x25ae2ce8
add eax, 0xea54239c
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x8b1e8f0
sub dword [ebp - 0x50], 0x943f7f9a
mov dword [ebp - 0x4c], 0x749a8a5c
add dword [ebp - 0x4c], 0xccd1d719
mov dword [ebp - 0x48], 0xf4ee3d64
add dword [ebp - 0x48], 0x6e812f08
mov dword [ebp - 0x44], 0xf12c238e
add dword [ebp - 0x44], 0xed3dc72
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3881e
push 0
call eax
mov ecx, 0x3c14
xor esi, esi
add esi, eax
mov edx, 0x10030c00
add edx, dword [ebp - 0x40]
mov edi, 0x528e5ef0
sub edi, 0x3599d751
mov dword [ebp - 0x14], 0x79154714
mov ebx, dword [edx]
add dword [ebp - 0x18], 0x957f8601
sub ebx, edi
xor dword [ebp - 0xc], esi
mov dword [esi], ebx
sub dword [ebp - 0x14], edx
add esi, 0x12ec2f4a
add esi, 0xed13d0ba
add edx, 4
loop 0x100211d0
add eax, 0xe323
mov ebx, eax
add eax, 0x1ee072f7
add eax, 0xe11f8d0e
mov ecx, 0xf575c2b0
sub ecx, 0xe575c2b0
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x10003bc2
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x1002a034]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.10005d80
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.10013baa
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.10013baa
push 0x10021be8
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.10013baa
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.10005d80
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003c67
sub ecx, edx
cmp ecx, 6
jbe 0x10003c8e
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.10013baa
pop ecx
pop ecx
test eax, eax
jne 0x10003c8e
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10003c95
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x10020533
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.10013baa
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.10005800
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003d0f
mov ax, word [0x10021c14]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004926
add esp, 0x824
ret
Function at 0x41aecd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x41aedc
pop dword [ebp - 0x48]
mov eax, 0x41aedc
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3a3a0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0xf08b5636
sub ecx, 0xf08b0a89
xor ebx, ebx
add ebx, eax
mov edi, 0xdac918bb
sub edi, 0xda8560bb
add edi, dword [ebp - 0x48]
mov edx, 0xcd533790
mov esi, dword [edi]
xor dword [ebp - 0x24], ebx
xor esi, edx
add dword [ebp - 0x20], 0x9d3a7b86
mov dword [ebx], esi
sub dword [ebp - 0xc], 0xf62752a6
add ebx, 4
add edi, 4
loop 0x41af2d
add eax, 0x12187
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xfdd995e5
sub ecx, 0xfd9995e5
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x421730
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.kernel32.dll_GetVersion]
cmp ax, 6
je 0x42176d
push str.SetDefaultDllDirectories
push 0x42c874
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x42176d
push 0xc00
call eax
test eax, eax
jne 0x421806
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x421806
cmp eax, 0x104
ja 0x421806
cmp word [esp + eax*2 + 6], 0x5c
je 0x42179c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x421806
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x4217db
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x4217c7
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x4217bc
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x402c00
pop dword [ebp - 0x3c]
mov eax, 0x3fd4ef1b
sub eax, 0x3f94c31b
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xf65621ff
add dword [ebp - 0x4c], 0x57fc234c
mov dword [ebp - 0x48], 0xa2668efc
sub dword [ebp - 0x48], 0x703342b7
mov dword [ebp - 0x44], 0x22de5cc4
add dword [ebp - 0x44], 0x296de76a
mov dword [ebp - 0x40], 0xeba98509
sub dword [ebp - 0x40], 0xeba98509
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xac53add2
sub eax, 0xac132d46
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xe92b3ac3
add dword [ebp - 0x4c], 0x8b472e93
mov dword [ebp - 0x48], 0xa7fc5b93
add dword [ebp - 0x48], 0x997005e2
mov dword [ebp - 0x44], 0xd02d19c2
sub dword [ebp - 0x44], 0x6cbdad56
mov dword [ebp - 0x40], 0xa7f8547f
sub dword [ebp - 0x40], 0xa7f8547f
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x13c91456
sub eax, 0x13889382
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x392de
push 0
call eax
mov ecx, 0x9a2b34b9
add ecx, 0x65d51d3d
xor edi, edi
add edi, eax
mov edx, 0x996f20c7
sub edx, 0x992e10c7
add edx, dword [ebp - 0x3c]
mov esi, 0x204ac874
add dword [ebp - 0xc], edx
mov ebx, dword [edx]
add ebx, esi
xor dword [ebp - 0x24], ecx
mov dword [edi], ebx
sub dword [ebp - 0x2c], 0x75087df7
add edi, 0x7fc5e238
add edi, 0x803a1dcc
add edx, 4
loop 0x402d1e
add eax, 0x5d94ed46
add eax, 0xa26c4d65
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x405b32
pop dword [ebp - 0x3c]
mov eax, 0x98b1206e
add eax, 0x678f3ac4
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xc4744b6
add dword [ebp - 0x4c], 0x420b0095
mov dword [ebp - 0x48], 0xd5b9e33e
add dword [ebp - 0x48], 0x5c796907
mov dword [ebp - 0x44], 0x7114f762
sub dword [ebp - 0x44], 0x24c8b334
mov dword [ebp - 0x40], 0xddbb44e2
add dword [ebp - 0x40], 0x2244bb1e
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x66bec983
sub dword [ebp - 0x4c], 0xf24c602d
mov dword [ebp - 0x48], 0x88688327
add dword [ebp - 0x48], 0xb903de4e
mov dword [ebp - 0x44], 0xef6a51a7
add dword [ebp - 0x44], 0x74051ac5
mov dword [ebp - 0x40], 0xb3ace79f
sub dword [ebp - 0x40], 0xb3ace79f
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x36a9c
push 0
call eax
mov ecx, 0x86cd4ef4
add ecx, 0x7932f7a9
mov edx, eax
mov ebx, 0x7f47aac1
add ebx, 0x80fdd73f
add ebx, dword [ebp - 0x3c]
mov esi, 0xcf055729
sub esi, 0xeddd4b26
sub dword [ebp - 0x20], edi
mov edi, dword [ebx]
xor edi, esi
sub dword [ebp - 0x28], 0xa95c5f82
mov dword [edx], edi
xor dword [ebp - 0x10], esi
add edx, 4
add ebx, 0x38f946fe
sub ebx, 0x38f946fa
loop 0x405c4a
add eax, 0x10d47
xor ebx, ebx
add ebx, eax
add eax, 0xfe8eff1f
add eax, 0x17100e6
mov ecx, 0xb1dfa96e
add ecx, 0x4e605692
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x10009bdc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10016eb8
call fcn.100165db
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10009c59
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x10009c59
call fcn.1000836f
mov esi, eax
jmp 0x10009d5f
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x10009c7c
call fcn.1000836f
jmp 0x10009d52
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x10009c72
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x10009caf
mov esi, 0x8007000e
jmp 0x10009d54
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x10009d8d
jb 0x10009cca
cmp eax, 0xffffffff
ja 0x10009d8d
cmp eax, 0x400
jbe 0x10009cdf
push eax
lea ecx, [ebp - 0x418]
call fcn.10009d98
jmp 0x10009d01
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x10009d01
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10009ca5
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10009c72
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.10009d98
mov esi, eax
test edi, edi
je 0x10009d5f
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10009d78
lea ecx, [ebp - 0x418]
call fcn.10008337
lea ecx, [ebp - 0x428]
call fcn.10001550
mov eax, esi
call fcn.1001652c
ret 0x10
push 0x80070216
call fcn.10009d98
int3
Function at 0x10009d98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10009da7
pop dword [ebp - 8]
mov eax, 0x251a2ed1
add eax, 0xeae66ed6
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x35e2b
push 0
mov eax, 0xdc718884
sub eax, 0xcc700734
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x39b7
mov edx, eax
mov edi, 0xea21f18
sub edi, 0xfe9f6918
add edi, dword [ebp - 8]
mov esi, 0xc848727f
add esi, 0xbc254b92
sub dword [ebp - 4], 0xc96bb2f9
mov ebx, dword [edi]
xor dword [ebp - 4], ecx
xor ebx, esi
mov dword [ebp - 4], 0xca911ae2
mov dword [edx], ebx
add dword [ebp - 4], 0x16c3e694
add edx, 4
add edi, 0xa04e59f9
sub edi, 0xa04e59f5
loop 0x10009e00
add eax, 0xacb43bc5
add eax, 0x534c9dea
xor ebx, ebx
add ebx, eax
add eax, 0x231c6243
sub eax, 0x231c623e
mov ecx, 0x8700b65a
sub ecx, 0x7700b65a
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x401c66
pop dword [ebp - 0xc]
mov eax, 0xb4a3f5bc
add eax, 0x4b9c26aa
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x964c4974
sub dword [ebp - 0x1c], 0x47fa0429
mov dword [ebp - 0x18], 0x75e3e077
add dword [ebp - 0x18], 0xbc4f6bce
mov dword [ebp - 0x14], 0xb5d97790
add dword [ebp - 0x14], 0x9672cc9e
mov dword [ebp - 0x10], 0x5998c0b9
sub dword [ebp - 0x10], 0x5998c0b9
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x86deb647
sub dword [ebp - 0x1c], 0x126c4cf1
mov dword [ebp - 0x18], 0xab86dbde
add dword [ebp - 0x18], 0x95e58597
mov dword [ebp - 0x14], 0x829d8fe
sub dword [ebp - 0x14], 0xa4ba6c92
mov dword [ebp - 0x10], 0x4b279b23
add dword [ebp - 0x10], 0xb4d864dd
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xa0d030b
sub eax, 0x9ccd2df
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x36dba
push 0
call eax
mov ecx, 0x4982
xor edi, edi
add edi, eax
mov ebx, 0x17ffc291
sub ebx, 0x17bf5291
add ebx, dword [ebp - 0xc]
mov edx, 0xa015c3ef
mov esi, dword [ebx]
sub dword [ebp - 8], 0xb3cbb5e
xor esi, edx
xor dword [ebp - 8], 0x343b26d0
mov dword [edi], esi
add dword [ebp - 8], eax
add edi, 0x7603fb8d
add edi, 0x89fc0477
add ebx, 0x19d6bd67
add ebx, 0xe629429d
loop 0x401d79
add eax, 0xd330421f
sub eax, 0xd32f2944
xor ebx, ebx
add ebx, eax
add eax, 0x45c3b74f
add eax, 0xba3c48b6
mov ecx, 0x267fc0c3
sub ecx, 0x263fc0c3
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret