joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a1b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x425208
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x425208], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405a56
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405c0d
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405c2a
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x405c2d
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405c5c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x4088fc]
mov dword [ebp - 8], eax
mov eax, dword [0x408900]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405cac
test edi, edi
jne 0x405c69
mov word [esi], ax
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405ca6

Function at 0x405cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405d29
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x800
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405d12
cmp dword [ebp + 0x14], 1
je 0x405d17
cmp dword [ebp + 0x14], 2
je 0x405d17
xor eax, eax
mov word [esi], ax
push dword [ebp + 0x18]
xor eax, eax
mov word [esi + 0x7fe], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 0x14
Function at 0x406371
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, str.C:UsersADMINI1AppDataLocalTemp_nsn5ACF.tmp
push esi
call fcn.00405de7
push esi
call fcn.00405b36
mov edi, eax
test edi, edi
jne 0x406392
xor eax, eax
jmp 0x4063f0
push edi
call fcn.00405e16
test byte [0x42a588], 0x80
je 0x4063af
movzx eax, word [edi]
test ax, ax
je 0x40638e
cmp ax, 0x5c
je 0x40638e
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x4063d1
push esi
call fcn.00405ec7
test eax, eax
je 0x4063cb
test byte [eax], 0x10
je 0x4063f5
push esi
call fcn.00406344
push esi
call ebx
cmp eax, edi
jg 0x4063bc
push esi
call fcn.00406315
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4063ef
Function at 0x406687
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x4089e4
mov ebx, 0x425a50
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov esi, 0x400
cmp edi, ebp
je 0x4066d5
push 1
push ebp
push edi
call fcn.00405c2d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x40684c
cmp eax, esi
jg 0x40684c
push esi
mov edi, 0x4278a0
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x40684c
cmp eax, esi
jg 0x40684c
push ebp
push ebp
push esi
push 0x426250
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x40684c
push ebp
push ebp
push esi
mov esi, 0x4268a0
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x40684c
push esi
push 0x426250
push str._s_s_r_n
push 0x426ca0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x42a52c]
push dword [eax + 0x128]
push edi
call fcn.004063f9
push 4
push 0xc0000000
push edi
call fcn.00405c2d
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x40684c
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x406842
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406842
cmp edi, dword [esp + 0x10]
jne 0x406842
push str._Rename__r_n
push esi
call fcn.00405b93
cmp eax, ebp
jne 0x4067d9
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x40680a
push 0x4089d8
add eax, 0xa
push eax
call fcn.00405b93
mov ebp, eax
test ebp, ebp
je 0x406808
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x4067fb
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x4067f5
sub ebp, esi
inc ebp
mov eax, ebp
xor ebp, ebp
jmp 0x40680c
xor ebp, ebp
mov eax, edi
push ebx
push 0x426ca0
add eax, esi
push eax
call fcn.00405be9
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x406885
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00406371
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
test cl, 8
je 0x4068ba
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x42a5e8], eax
jmp 0x406a60
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x4068d5
test eax, eax
je 0x406a0b
test cl, 2
je 0x406a0b
push edi
push ebx
mov esi, 0x4270a0
push esi
call fcn.00405de7
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x4068f8
push str..
push esi
call edi
jmp 0x4068fe
push ebx
call fcn.00406344
cmp word [ebx], 0
jne 0x40690e
cmp word [0x4270a0], 0x5c
jne 0x406916
push 0x4082c8
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebx + eax*2]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4069fa
lea esi, [ebp - 0x230]
push 0x3f
mov eax, esi
push eax
call fcn.00405ae2
xor edi, edi
cmp word [eax], di
je 0x40695d
cmp word [ebp - 0x28], di
je 0x40695d
lea esi, [ebp - 0x28]
cmp word [esi], 0x2e
jne 0x406978
movzx eax, word [esi + 2]
cmp ax, di
je 0x4069d7
cmp ax, 0x2e
jne 0x406978
cmp word [esi + 4], di
je 0x4069d7
push esi
push dword [ebp - 4]
call fcn.00405de7
test byte [ebp - 0x25c], 0x10
je 0x40699f
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4069d7
push dword [ebp + 0xc]
push ebx
call fcn.00406885
jmp 0x4069d7
push ebx
call fcn.00405c0d
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4069cf
test byte [ebp + 0xc], 4
je 0x4069c7
push ebx
push 0xfffffffffffffff1
call fcn.00404da2
push edi
push ebx
call fcn.00406852
jmp 0x4069d7
inc dword [0x42a5e8]
jmp 0x4069d7
push ebx
push 0xfffffffffffffff2
call fcn.00404da2
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40693d
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4069fc
xor edi, edi
cmp dword [ebp + 8], edi
pop edi
je 0x406a0b
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [ecx - 2], ax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406a5f
cmp dword [ebp - 0xc], esi
je 0x406a4f
push ebx
call fcn.00405ec7
test eax, eax
je 0x406a5f
push ebx
call fcn.00406315
push ebx
call fcn.00405c0d
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x406a57
test byte [ebp + 0xc], 4
je 0x406a4f
push ebx
push 0xfffffffffffffff1
call fcn.00404da2
push esi
push ebx
call fcn.00406852
jmp 0x406a5f
inc dword [0x42a5e8]
jmp 0x406a5f
push ebx
push 0xffffffffffffffe5
call fcn.00404da2
pop esi
pop ebx
leave
ret 8
Function at 0x406a65
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4280a4], 0
jne 0x406aa3
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a79
mov dword [ecx*4 + 0x4280a0], eax
inc ecx
cmp ecx, 0x100
jl 0x406a74
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406ad0
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4280a0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ab1
not eax
pop ebp
ret 0xc

Function at 0x407599
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x4075b2
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x4075d5
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x4075da
inc edi
cmp edi, dword [ebp - 4]
jb 0x4075cc
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x4076d2
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x407631
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x407605
cmp cl, 0xff
jne 0x40765c
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x40766a
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x407671
dec ecx
shl edx, cl
and edx, 7
je 0x4075f6
movzx ecx, byte [edx + 0x408a00]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x4089f8], 0
mov cl, byte [ebx + 4]
je 0x407659
test cl, cl
je 0x407659
cmp cl, 0xff
jne 0x4075f6
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x4075c7
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x4076a5
movzx esi, byte [edx + 0x408a00]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x407690
cmp al, 0xff
jne 0x4076a2
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x407623
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x4075c7
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x412726
Capabilities:
Encode data using xor

Disassembly:
test edx, 0x11ab8fe
or dword [edx - 0x5d], ebp
add ebp, ecx
inc edx
cld
sub al, 0xbd
add dword [ebx], 0x269ec743
adc ecx, dword [esi]
hlt
cmp eax, 0x9db9a65c
out dx, eax
jecxz 0x4126fe
iretd
leave
xor eax, 0xdce8ed69
loope 0x41272e
frstor dword [esi + 0x1c47c499]
xchg esp, eax
or dword [ecx - 0x2a], ecx
add dword [ebx - 0x117b219a], edi
inc ecx
add byte cs:[0x7c518632], bl
mov al, 0x2c
pushfd
push ss
arpl word [edi - 0x79cf4b6f], di
add dword [0x77d7f476], 0xffffff80
test dword [esi + 8], ebx
xchg ecx, eax
stosb byte es:[edi], al
fist word [eax + 0x74]
push es
add al, 0xb1
cmpsb byte [esi], byte es:[edi]
popal
xchg edi, eax
push 0x99570ec7
test eax, 0xb0fe9a1d
dec cx
mov edi, 0x3117719e
or al, 0xf4
or cl, dl
imul esi, dword [eax], 0x39
dec ecx
xchg edx, eax
mov bl, 0xda
push edx
sbb byte [edi], cl
pop ecx
pushal
add esi, edx
fnsave dword [ebx - 0x73]
xor byte [edx + 0x3fa27324], ah
sub byte [esi + 0x75b0237b], bh
pop es
salc
wait
pop edi
ret

Function at 0x417c10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417c36
mov eax, dword [0x6357f0]
test eax, eax
je 0x417c2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6357f0], eax
test eax, eax
pop ebx
je 0x417cd1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6357f0]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x6357ec], eax
call esi
mov ecx, dword [0x6357ec]
mov dword [0x6357f4], eax
test ecx, ecx
je 0x417cc7
test eax, eax
je 0x417cc7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x6357f0], 0
xor eax, eax
pop esi
add esp, 0x50
ret

Function at 0x438b64
Capabilities:
Encode data using xor

Disassembly:
jnp 0x438b6a
mov edx, 0x10d70110
xchg ebp, eax
test dword [ebp - 0x5e4cfd61], esp
adc byte [ebp + 0x29fa585], dl
mov bl, 0xa1
imul ecx, ecx, 0xd0eef262
mov edi, 0x153f82b6
Function at 0x43d3cc
Capabilities:
Encode data using xor

Disassembly:
ret 0xc80b
mov edi, 0x7abf9230
bound esi, qword [ecx + 0x5e]
das
xor eax, 0xf2176916
push ebp
jns 0x43d387
sahf
push esp
popfd
aaa
xchg ebp, eax
xor dword [esi + edi*4 - 0xf], ebx
inc ebx
insb byte es:[edi], dx
sub dl, byte [esi + 0x62]
aaa
loopne 0x43d3df
push esi
cmp edi, esi
bound ecx, qword [edi + 0x5e]
adc dword [eax - 0x77], edi
test eax, 0xdbddd7c0
mov eax, dword [0x61ae1b1c]
sbb al, 0x1b
scasb al, byte es:[edi]
popal
insb byte es:[edi], dx
shufps xmm5, xmmword [edi - 0x4c], 0xa9
push eax
popal
fmul qword [edx + 0x5ba1435d]
and eax, 0xec930660
xor byte [ebx + 0x63], al
adc byte [esi + 0x4e9a0972], cl
adc ecx, ecx
xchg ebp, eax
scasb al, byte es:[edi]
pop esp
or byte [esi - 0x786e61a7], 0xd4
jmp 0x43d497
invalid
pop ds
pop edx
mov ah, byte [edi + 8]
aaa
in eax, dx
popfd
and esi, ebp
and dword [edx + 0x4f67d94a], esi
dec eax
lodsb al, byte [esi]
mov al, byte [0x31b7e256]
xchg edi, eax
sub byte [edx], dh
ja 0x43d3fd
push 0xcc7361f8
salc
popal
cmc
inc ebx
jb 0x43d4a9
jp 0x66e53281
jecxz 0x43d403
sub esi, eax
pop ebp
loope 0x43d4ab
dec ecx
adc dh, 0x39
push 0xffffffffffffffb9
inc ecx
add eax, 0xed2d2f5e
aaa
mov byte [0x6132c266], al
loopne 0x43d461
ja 0x43d4c8
adc al, 0xf6
or al, 0x59
xor dword [0xf07700e6], ecx
and esi, dword [edx + 0x726a20c7]
in eax, 0x3b
retf 0x57e0
dec esp
mov dh, 0x3c
outsd dx, dword [esi]
les ecx, [edx + 0x78]
jg 0x43d42e
adc edx, ecx
cmp al, 0xc1
add dword [eax], ebp
or bl, byte [ecx - 0x45bf1974]
in eax, dx
mov ch, bl
popal
out 0x40, al
mov edx, 0x61dd88ed
pop ebp
mov bh, 0x56
and dword [ebx + 0x7a1238c], edx
inc esp
sub dword [eax + ebp*8], ebp
stc
in al, dx
jae 0x43d537
mov byte [0x240975c5], al
lds eax, [ebx]
push esi
adc ecx, ebp
dec ebx
das
retf 0x7378
push 0x50e37c7b

Function at 0x45c20c
Capabilities:
Encode data using xor

Disassembly:
in al, dx
push edx
and dword [esi + 0x65225ec5], ebp
mov eax, dword [0xffc1b91e]
Function at 0x6291a1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323c8
cmp edx, dword [eax]
je 0x6291c3
add eax, 8
inc ecx
cmp eax, 0x632458
jl 0x6291b4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323c8]
jne 0x6292f1
mov eax, dword [0x636d9c]
cmp eax, 1
je 0x6292cb
test eax, eax
jne 0x6291f4
cmp dword [0x6322f0], 1
je 0x6292cb
cmp edx, 0xfc
je 0x6292f1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62922b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629b80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a010
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62926e
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a010
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ec64
push edi
call fcn.0062bee0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629b80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629b90
lea eax, [ebp - 0xa0]
push 0x62ec44
push eax
call fcn.00629b90
push dword [esi + 0x6323cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629b90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062be54
add esp, 0x2c
pop edi
jmp 0x6292f1
lea eax, [ebp + 8]
lea esi, [esi + 0x6323cc]
push 0
push eax
push dword [esi]
call fcn.0062a010
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x230b3144
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3bd500ad
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401030
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push 1
push str.ServicesActive
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x40109b
push esi
push edi
xor edi, edi
cmp edi, 0x18
jae 0x401092
mov eax, dword [edi + 0x408020]
push 4
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40108b
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x401084
cmp dword [esp + 0x14], 4
jne 0x401084
mov bl, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add edi, 4
test bl, bl
je 0x401050
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x1c
ret
Function at 0x433001
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219