joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40154b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, dword [0x471390]
xor ebx, ebx
push edi
mov dword [esp + 0x10], edx
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
add eax, esi
mov dword [esp + 0x18], eax
mov edi, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
add edi, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4015bb
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.004016dc
lea ecx, [esp + 0x1c]
call fcn.00401317
cmp eax, dword [esp + 0x10]
je 0x4015d2
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.004016b9
inc ebx
cmp ebx, dword [esp + 0x14]
jb 0x40158b
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401a14
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.004016b9
jmp 0x4015bd

Function at 0x401659
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ecx
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x471390], eax
push 0x27
mov esi, 0x470330
mov edx, 0x547
push 0x41b900
mov ecx, esi
call fcn.00401112
pop ecx
pop ecx
mov edx, 0x8aafdc01
call fcn.0040154b
lea ecx, [esp + 8]
push ecx
push 0x40
push 0x4e4
push esi
call eax
pop edi
pop esi
test eax, eax
je 0x4016b3
call fcn.004015f4
xor eax, eax
pop ecx
ret 0x10

Function at 0x4022c3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402302
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402302
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402302
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402302
cmp dword [ecx + 0x74], 0xe
jbe 0x402302
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4082d4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4155a8
push 0x4155a0
push str.FlsAlloc
push 0x1e
call fcn.004081f2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408308
push dword [ebp + 8]
mov ecx, esi
call dword [0x414108]
call esi
jmp 0x40830e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408352
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4155b8
push 0x4155b0
push str.FlsGetValue
push 0x20
call fcn.004081f2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408389
push dword [ebp + 8]
mov ecx, esi
call dword [0x414108]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4011c6
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call fcn.0040114f
call section..text
movzx eax, al
cmp eax, 1
jne 0x4011e9
push 5
pop eax
jmp 0x4013b8
and dword [ebp - 0x40], 0
and dword [ebp - 0xc], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x44], 0
and dword [ebp - 8], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0x330
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, eax
add ebx, 0xc
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x30]
mov ecx, 0x18
xor esi, esi
xor ebx, ebx
add bl, byte [edi + ecx - 1]
add esi, ebx
loop 0x401234
cmp esi, dword [ebp - 0x2c]
je 0x401249
mov eax, dword [eax]
cmp eax, ebx
jne 0x40122a
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
nop
popal
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x41124c
push dword [0x411228]
push 0x41122c
push dword [0x41124c]
push 0x411250
call fcn.0040102b
add esp, 0x14
push 0x411250
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
push 0x41126c
push dword [0x411228]
push 0x41122c
push dword [0x41126c]
push 0x411270
call fcn.0040102b
add esp, 0x14
push 0x411270
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x41128c
push dword [0x411228]
push 0x41122c
push dword [0x41128c]
push 0x411290
call fcn.0040102b
add esp, 0x14
push 0x411290
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [0x404030]
mov dword [ebp - 0x10], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0
call dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x404038
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10]
push eax
push dword [section..data]
push 0x404004
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 4], eax
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push 0x20
push dword [0x404030]
push dword [ebp - 4]
call dword [ebp - 0x24]
push 0x404704
push dword [0x404034]
push 0x4046d8
push dword [0x404704]
push 0x404708
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [0x4112dc], eax
and dword [ebp - 0x28], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
push dword [ebp - 0x28]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call dword [0x4112dc]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
test byte [ebp + 0xc], 2
push dword [ebp + 8]
je 0x4012b6
push dword [edx + 8]
push str.error:_option_____s___s_n
jmp 0x4012c0
movsx eax, byte [edx + 4]
push eax
push str.error:_option____c___s_n
push 2
call fcn.00404497
add esp, 4
push eax
call fcn.00401270
add esp, 0x10
push 1
call fcn.0040428c
int3

Function at 0x401560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, [edx - 1]
mov edx, dword [ebp + 8]
push edi
mov edi, dword [esi]
mov dword [esi + 0x14], eax
lea eax, [edx + 4]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
mov eax, dword [edi]
test eax, eax
je 0x4015ab
js 0x401588
cmp eax, 6
jle 0x4015a1
push eax
push str.wrong_option_type:__d
push 2
call fcn.00404497
add esp, 4
push eax
call fcn.00401270
add esp, 0xc
mov eax, dword [edi + 0x20]
add edi, 0x20
test eax, eax
jne 0x401581
cmp dword [esi + 0x14], 0
je 0x4016be
mov eax, dword [esi + 0x18]
mov edx, dword [eax]
cmp byte [edx], 0x2d
jne 0x401692
mov al, byte [edx + 1]
lea ecx, [edx + 1]
test al, al
je 0x401692
cmp al, 0x2d
je 0x40167c
mov edx, dword [esi]
mov dword [esi + 0x24], ecx
cmp dword [edx], 0
je 0x4016f4
mov al, byte [ecx]
nop dword [eax]
cmp byte [edx + 4], al
je 0x401602
add edx, 0x20
cmp dword [edx], 0
jne 0x4015f0
jmp 0x4016f4
lea eax, [ecx + 1]
xor ecx, ecx
cmp byte [eax], cl
push 0
cmovne ecx, eax
mov dword [esi + 0x24], ecx
mov ecx, esi
call fcn.004012e0
add esp, 4
cmp eax, 0xfffffffe
je 0x4016f4
cmp dword [esi + 0x24], 0
je 0x4016a4
nop word [eax + eax]
mov edx, dword [esi]
cmp dword [edx], 0
je 0x4016f4
mov ecx, dword [esi + 0x24]
mov al, byte [ecx]
cmp byte [edx + 4], al
je 0x401652
add edx, 0x20
cmp dword [edx], 0
jne 0x401640
jmp 0x4016f4
lea eax, [ecx + 1]
xor ecx, ecx
cmp byte [eax], cl
push 0
cmovne ecx, eax
mov dword [esi + 0x24], ecx
mov ecx, esi
call fcn.004012e0
add esp, 4
cmp eax, 0xfffffffe
je 0x4016f4
cmp dword [esi + 0x24], 0
jne 0x401630
jmp 0x4016a4
cmp byte [edx + 2], 0
je 0x4016b7
mov edx, dword [esi]
mov ecx, esi
call fcn.00401440
cmp eax, 0xfffffffe
je 0x4016f4
jmp 0x4016a4
test byte [esi + 8], 1
jne 0x4016be
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
mov dword [eax + ecx*4], edx
inc dword [esi + 0x20]
dec dword [esi + 0x14]
add dword [esi + 0x18], 4
cmp dword [esi + 0x14], 0
jne 0x4015b5
jmp 0x4016be
dec dword [esi + 0x14]
add dword [esi + 0x18], 4
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x20]
shl eax, 2
push eax
mov eax, dword [esi + 0x1c]
push dword [esi + 0x18]
lea eax, [eax + ecx*4]
push eax
call fcn.00402e50
mov ecx, dword [esi + 0x20]
add esp, 0xc
add ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x1c]
pop edi
mov dword [eax + ecx*4], 0
mov eax, dword [esi + 0x20]
add eax, dword [esi + 0x14]
pop esi
pop ebp
ret
mov eax, dword [esi + 0x18]
push dword [eax]
push str.error:_unknown_option___s__n
push 2
call fcn.00404497
add esp, 4
push eax
call fcn.00401270
add esp, 0xc
mov ecx, esi
call fcn.00401720
push 1
call fcn.0040428c
int3
Function at 0x401bf0
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41a004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
mov esi, ecx
push 0
push eax
call fcn.00403750
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00403750
add esp, 0x18
mov dword [ebp - 0x210], 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x401c62
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040237e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x401c51
push 0x104
push 0
push esi
call fcn.00403750
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push str._s_s
push 0x104
push esi
call fcn.00402350
mov ecx, dword [ebp - 4]
add esp, 0x20
xor ecx, ebp
mov al, 1
pop esi
call fcn.0040237e
mov esp, ebp
pop ebp
ret
Function at 0x40af66
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040ac26
Function at 0x41aa20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
inc word [0x44d028]
mov ax, word [0x44d028]
movsx ecx, ax
add ecx, 0x3b546d05
sub esp, 8
cmp ecx, 0x518f88fd
jge 0x41aa58
movzx edx, word [0x44d2fc]
add edx, 0x62f2eb1
mov word [0x44d2fc], dx
call fcn.00437dd0
fld dword [0x44d274]
fsubr qword [0x447820]
mov eax, dword [0x44d114]
mov dword [ebp - 4], eax
fisub dword [ebp - 4]
fld qword [0x44d3b0]
fucompp
fnstsw ax
fld qword [0x44d3b0]
fld1
fsub st(1), st(0)
fxch st(1)
fstp qword [0x44d3b0]
dec dword [0x44d114]
fld dword [0x44d274]
fsub st(1)
fstp dword [0x44d274]
test ah, 0x44
jp 0x41ab09
fld qword [0x44d108]
mov ecx, dword [0x44d0f8]
mov edx, 0x19950685
sub edx, ecx
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fcompp
fnstsw ax
fsubr qword [0x44d108]
fstp qword [0x44d108]
test ah, 1
jne 0x41ab0b
mov eax, dword [0x44d1f0]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fld dword [0x44d2f0]
mov cx, word [0x44d0a4]
movsx edx, cx
mov dword [ebp - 4], edx
fild dword [ebp - 4]
faddp st(1)
fsubp st(1)
fistp qword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [0x44d1f0], eax
jmp 0x41ab0b
fstp st(0)
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x427340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [0x44d198]
fstp qword [0x44d558]
fld dword [0x44d198]
mov dword [ebp - 4], 0
fld1
fadd st(1), st(0)
fxch st(1)
fstp dword [0x44d198]
fld qword [0x44d558]
fadd st(1)
fstp qword [0x44d558]
fld qword [0x44d558]
fld qword [0x44d290]
fadd qword [0x44d578]
fadd qword [0x44d3e0]
fucompp
fnstsw ax
fld qword [0x44d3e0]
fsub st(1)
fstp qword [0x44d3e0]
test ah, 0x44
jnp 0x4273bc
mov ax, word [0x44d234]
mov ecx, dword [0x44d130]
cwde
imul ecx, eax
mov dword [0x44d130], ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
imul esi, dword [ebp + 0x10]
test esi, esi
jne 0x4274b0
fld qword [0x44d128]
fadd qword [0x44d3e0]
mov edx, dword [0x44d1f8]
dec dword [0x44d1f8]
mov dword [ebp + 0xc], edx
fild dword [ebp + 0xc]
fsubp st(1)
fcomp qword [0x446a80]
fnstsw ax
fld qword [0x44d128]
fadd st(1)
fstp qword [0x44d128]
fld qword [0x44d3e0]
fsub st(1)
fstp qword [0x44d3e0]
test ah, 0x44
jnp 0x4274a6
mov ax, word [0x44d3cc]
movsx ecx, ax
mov dword [ebp + 0xc], ecx
fild dword [ebp + 0xc]
fsub qword [0x44d1a8]
mov edx, dword [0x44d584]
add edx, 0x77c4f377
mov dword [ebp + 0xc], edx
fsub qword [0x446a78]
fild dword [ebp + 0xc]
fcompp
fnstsw ax
fld qword [0x44d1a8]
fsub st(1)
fstp qword [0x44d1a8]
test ah, 1
jne 0x42747c
fstp st(0)
pop edi
fld dword [0x44d3f4]
xor eax, eax
fmul qword [0x446a70]
pop esi
fstp dword [0x44d3f4]
mov esp, ebp
pop ebp
ret
fsubr qword [0x44d098]
pop edi
pop esi
fstp qword [0x44d098]
fld qword [0x44d098]
mov ax, word [0x44d3cc]
fstp st(0)
xor eax, eax
fld qword [0x44d020]
fstp st(0)
mov esp, ebp
pop ebp
ret
pop edi
fstp st(0)
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
inc dword [0x44d410]
mov ecx, dword [0x44d410]
mov dword [ebp + 0xc], ecx
fild dword [ebp + 0xc]
fadd qword [0x44d418]
fsub qword [0x44d2c0]
mov dx, word [0x44d178]
inc word [0x44d178]
movsx eax, dx
sub eax, 0x6ba2ad2
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
fucompp
fnstsw ax
fadd qword [0x44d418]
fstp qword [0x44d418]
test ah, 0x44
jnp 0x427511
mov ecx, dword [0x44d1f8]
mov dword [0x44d114], ecx
dec dword [0x44d1f8]
mov ecx, dword [ebp + 0x14]
call fcn.00438f20
dec dword [0x44d264]
mov edx, dword [0x44d264]
push 0
sub edx, 0x25425179
lea ecx, [ebp - 4]
push ecx
mov word [0x44d364], dx
mov edx, dword [ebp + 8]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
fld qword [0x44d140]
fadd qword [0x445f20]
xor edx, edx
fstp qword [0x44d140]
inc dword [0x44d410]
fld qword [0x44d140]
mov eax, dword [0x44d410]
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
mov eax, dword [ebp - 4]
div edi
faddp st(1)
fstp dword [0x44d0a8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x439d30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [0x44d468]
sub esp, 8
push esi
sub eax, 0x68644053
push edi
mov word [0x44d468], ax
call fcn.00437d60
mov esi, 1
add word [0x44d090], si
mov cx, word [0x44d35c]
mov dx, word [0x44d090]
add word [0x44d35c], si
movsx eax, cx
movsx ecx, dx
add eax, 0xbb104443
cmp eax, ecx
jle 0x439d91
fld qword [0x44d118]
fadd qword [0x44bc98]
fstp qword [0x44d118]
call fcn.00423e30
fld dword [0x44d470]
fld1
fsub st(1), st(0)
fxch st(1)
fstp dword [0x44d470]
mov edx, dword [0x44d4bc]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fld dword [0x44d470]
fadd qword [0x44bc90]
fsubp st(1)
fcomp qword [0x44bc88]
fnstsw ax
test ah, 0x44
jp 0x439e30
mov ax, word [0x44d0d0]
movsx ecx, ax
sub ecx, 0x755d6c2b
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
fld dword [0x44d4e0]
fadd qword [0x44bc80]
fucompp
fnstsw ax
fadd dword [0x44d4e0]
fstp dword [0x44d4e0]
test ah, 0x44
jp 0x439e32
mov dx, word [0x44d328]
movsx eax, dx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fsub dword [0x44d494]
fmul dword [0x44d318]
fstp dword [0x44d318]
dec word [0x44d328]
jmp 0x439e32
fstp st(0)
push 0x442124
push 0x44211c
call fcn.00434930
mov ecx, dword [0x44d500]
add dword [0x44d500], esi
add esp, 8
cmp ecx, 0x753fc7a3
jle 0x439e7c
fld dword [0x44d248]
fadd qword [0x44d478]
fstp dword [0x44d248]
fld qword [0x44d478]
fadd qword [0x445f20]
fstp qword [0x44d478]
call fcn.0040ae90
mov edx, dword [0x44d354]
mov cx, word [0x44d324]
add word [0x44d324], si
mov edi, eax
mov eax, 0x1f9b3465
sub eax, edx
movsx edx, cx
cmp eax, edx
jle 0x439eca
fld qword [0x44d3e0]
mov eax, dword [0x44d0ac]
fadd qword [0x44bc78]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
faddp st(1)
fistp qword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [0x44d0ac], ecx
call fcn.00437dd0
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x43c520
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [0x44d2ac]
add eax, 0x35512e4
mov word [0x44d2ac], ax
mov dword [ecx], 0
fld dword [0x44d350]
fld1
fadd st(1), st(0)
fxch st(1)
fstp dword [0x44d350]
fld qword [0x44d2c0]
fsub qword [0x4462e8]
fsub qword [0x4462e0]
fld dword [0x44d350]
fcompp
fnstsw ax
fld qword [0x44d2c0]
fadd st(1)
fstp qword [0x44d2c0]
test ah, 5
jp 0x43c5a7
fld dword [0x44d0dc]
mov dx, word [0x44d324]
fsubr qword [0x4462d8]
movsx eax, dx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fsubp st(1)
fadd qword [0x44d148]
fstp qword [0x44d148]
mov dword [ecx + 4], 0
mov dx, word [0x44d1b8]
movsx eax, dx
sub eax, 0x3c2fd03
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fld qword [0x44d440]
fsubr qword [0x4462d0]
fucompp
fnstsw ax
fld qword [0x44d440]
fsub st(1)
fstp qword [0x44d440]
test ah, 0x44
jp 0x43c5f8
fld dword [0x44d4e0]
fsub qword [0x4462c8]
fstp qword [0x44d160]
mov dword [ecx + 8], 0x67452301
mov edx, dword [0x44d3c8]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fadd qword [0x44d2a0]
fstp qword [0x44d2a0]
mov dword [ecx + 0xc], 0xefcdab89
fadd dword [0x44d0d4]
fstp dword [0x44d0d4]
fld dword [0x44d0d4]
movzx eax, word [0x44d0b0]
movsx edx, ax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
faddp st(1)
fadd dword [0x44d21c]
fstp dword [0x44d4a8]
mov dword [ecx + 0x10], 0x98badcfe
fld qword [0x44d2c8]
fsub qword [0x4462c0]
fstp qword [0x44d2c8]
mov dword [ecx + 0x14], 0x10325476
movzx eax, word [0x44d1ec]
add eax, 0x3310391d
mov word [0x44d1ec], ax
mov esp, ebp
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0xac6091e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x702f2de5
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4014be
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x128
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x42f918]
lea edi, [ebp - 0x115]
mov dword [ebp - 0x120], ecx
or eax, 8
push eax
push 0
push edx
push esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
je 0x40152a
jmp 0x401586
cmp dword [ebp - 0x120], 0
je 0x40151a
sub esp, 0xc
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 1
add esp, 0xc
jmp 0x401586
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, edi
call fcn.004014be
test eax, eax
jne 0x40153e
push 0x105
push edi
push 0
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
je 0x4014fc
sub esp, 0xc
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
push 2
call fcn.004060ee
add esp, 0xc
test eax, eax
je 0x401565
push 0
push dword [0x42f918]
push ebx
push esi
call eax
jmp 0x401586
cmp dword [0x42f918], 0
mov eax, 1
jne 0x401586
push edi
push edi
push ebx
push esi
call sub.ADVAPI32.DLL_RegDeleteKeyA
pop ebx
pop esi
test eax, eax
setne al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0xc]
push 0
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [0x409010]
call sub.KERNEL32.dll_ReadFile
xor edx, edx
add esp, 0xc
test eax, eax
je 0x403140
xor edx, edx
cmp dword [ebp - 8], ebx
sete dl
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x4033b9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0x4033e6
mov eax, dword [0x420c60]
test eax, eax
je 0x4033da
sub esp, 0xc
push eax
call sub.USER32.dll_DestroyWindow
add esp, 0xc
mov dword [0x420c60], 0
jmp 0x403437
cmp dword [0x420c60], 0
je 0x4033fe
sub esp, 0xc
push 0
call fcn.004060b3
add esp, 0xc
jmp 0x403437
call sub.KERNEL32.dll_GetTickCount
cmp eax, dword [0x42f998]
jbe 0x403437
sub esp, 0xc
push 0
push 0x4036f9
push 0
push 0x6f
push dword [0x42f9f8]
call sub.USER32.dll_CreateDialogParamA
sub esp, 0xc
push 5
push eax
mov dword [0x420c60], eax
call sub.USER32.dll_ShowWindow
add esp, 0x18
leave
ret
Function at 0x4037b5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x439400
call fcn.00406205
push 0x439400
call fcn.00405fb8
xor edx, edx
add esp, 0xc
test eax, eax
je 0x403808
sub esp, 0xc
push 0x439400
call fcn.00406320
sub esp, 0xc
push 0
push 0x439400
call sub.KERNEL32.dll_CreateDirectoryA
push 0x439400
push 0x439000
call fcn.004066e2
mov edx, eax
add esp, 0x18
mov eax, edx
leave
ret
Function at 0x406394
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0x14]
lea edx, [ebp - 8]
mov byte [ebx], 0
cmp dword [ebp + 0x18], 1
push edx
sbb eax, eax
xor al, al
add eax, 0x20119
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x40640d
push eax
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x400
call sub.ADVAPI32.DLL_RegQueryValueExA
pop edx
pop ecx
test eax, eax
jne 0x4063f5
mov eax, dword [ebp - 0x10]
dec eax
cmp eax, 1
jbe 0x4063f8
mov byte [ebx], 0
mov byte [ebx + 0x3ff], 0
sub esp, 0xc
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x4066e2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x64
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
jmp 0x406725
mov dword [ebp - 0x10], 0x61736e
mov bl, byte [ebp - 0xe]
call sub.KERNEL32.dll_GetTickCount
mov ecx, 0x1a
xor edx, edx
push esi
push 0
div ecx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
add ebx, edx
mov byte [ebp - 0xe], bl
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
jne 0x406730
dec edi
cmp edi, 0xffffffff
jne 0x4066f5
mov byte [esi], 0
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x40673c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
push 0x400
push dword [ebp + 8]
push 0x42daa8
call sub.KERNEL32.dll_lstrcpynA
push ebx
push ebx
push 0x42daa8
call fcn.0040619c
add esp, 0xc
test eax, eax
mov ebx, eax
je 0x4067f7
sub esp, 0xc
push eax
call fcn.00406205
add esp, 0xc
cmp byte [0x42f9a8], 0
jns 0x4067ba
mov al, byte [ebx]
test al, al
je 0x4067f7
cmp al, 0x5c
jne 0x4067ba
jmp 0x4067f7
sub esp, 0xc
push 0x42daa8
call fcn.0040613d
add esp, 0xc
test eax, eax
je 0x4067a8
test byte [eax], 0x10
je 0x4067f7
sub esp, 0xc
push 0x42daa8
call fcn.004062eb
add esp, 0xc
jmp 0x4067c0
sub ebx, 0x42daa8
sub esp, 0xc
push 0x42daa8
call sub.KERNEL32.dll_lstrlenA
add esp, 0xc
cmp eax, ebx
jg 0x40678f
sub esp, 0xc
push 0x42daa8
call fcn.00406320
push 0x42daa8
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
inc eax
setne al
movzx eax, al
jmp 0x4067f9
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x406800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
pop edx
xor edx, edx
pop ecx
cmp eax, 0xffffffff
setne dl
neg edx
push 0
and edx, eax
push edx
push dword [ebp + 0x10]
push 0
push 1
push dword [ebp + 0xc]
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x406838
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x40685e
push edx
and eax, 0xfffffffe
push edx
push eax
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
pop ebx
pop eax
mov ebx, dword [ebp - 4]
leave
ret 4