joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc9dfd7
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap esi
clc
mov byte [esp + 0x12], dh
xchg byte [esp + 0x2b], ch
setnp al
xchg word [esp + 0x1e], bx
jmp 0xc9df7b
push dword [esp + 0x21]
xchg edx, esi
jmp 0xc9df91

Function at 0xc9e594
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dx, sp
bt edx, ebp
lea eax, [edx + ebp]
xchg dword [esp], ebx
setae dh
jmp 0xc9e5c3
jmp 0xc9e57e

Function at 0xc9e945
Capabilities:
Execute anti-debugging instructions

Disassembly:
setae ah
mov eax, esi
xchg ch, ah
mov ecx, dword [esp]
xchg bl, bh
cpuid
jmp 0xc9e94d
pop edi
setge al
mov cl, 0x33
jmp 0xc9e92f
cpuid
not bl
lea edx, reloc.MSVCRT.dll_strncpy
mov ecx, dword [esp]
xchg edi, edx
mov bl, byte [esp]
jmp 0xc9ea0e
mov ch, bh
inc dx
bswap ebp
clc
sub esp, 0x1b
pop word [esp + 0xe]
jmp 0xc9e9b9
mov edx, ecx
mov dh, byte [esp]
mov ebp, edi
xchg esi, ebx
cld
lea esi, [ebp*4]
jmp 0xc9e97a
pop dword [esp + 2]
stc
mov word [esp + 1], sp
sub esp, 2
ror ax, cl
jmp 0xc9e9e8
stc
mov ebx, 0x2717a540
pop dword [esp + 6]
push word [esp + 3]
push word [esp + 1]
mov byte [esp], ch
jmp 0xc9e9a3
mov dl, al
xchg byte [esp], bl
mov ebx, 0xc5d60bb7
ror bx, cl
sub esp, 0xb
jmp 0xc9eb02
pop dword [esp + 4]
rdtsc
push di
ror bx, 3
xchg ah, dl
mov di, dx
jmp 0xc9e9d2
sub esp, 0
mov cx, word [esp]
not bx
bswap edi
mov edi, 0x5fdc693c
xchg cl, bl
jmp 0xc9e990
mov esi, 0xf89e983d
neg eax
xor ax, 0x3536
call fcn.00c9ea70
std
bswap edx
call fcn.00c9eb2d
in eax, dx
cmc
pushfd
outsd dx, dword [esi]
invalid
mov al, 0xab
clc
rdtsc
lea ebp, [esi + edi]
pop word [esp + 0xc]
mov edi, 0x1cd721c6
jmp 0xc9eac3

Function at 0xc9ed26
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push sp
lea esp, [esp + 2]
mov dword [esp + 0x1c], esi
pushal
lea esp, [esp + 0x1b]
mov word [esp + 1], dx
jmp 0xc9ecb0
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0x20], ebp
jmp 0xc9ecc6

Function at 0xc9ee41
Capabilities:
Encode data using xor

Disassembly:
push word [esp + 2]
push word [esp]
mov dword [esp + 0x24], esp
call fcn.00c9ed26
dec edx
leave
pop ecx
cmp bl, cl
sub ebp, esp
push 0xfffffffffffffff8
lahf
push 0xffffffffffffff83
push cs
invalid
jmp 0xc9ed57

Function at 0xc9ee81
Capabilities:
Packed with generic packer

Disassembly:
test eax, 0x3bc8a939
fisttp dword [ecx + reloc.MSVCRT.dll_strncpy]
sti
ror byte [ebp - 0x24], cl
das
mov dword [esp], ecx
push edx
pushal
pushfd
mov dword [esp + 0x20], ebx
call fcn.00c9ee41
and al, 0xb4
sub cl, byte [ebp - 0x44]
sbb esi, dword [edx]
mov eax, dword [reloc.MSVCRT.dll_strncpy]
je 0xc9ee80
jo 0xc9eeb7
loop 0xc9eef9
mov dh, 0x27
mov bh, 0xd2
and dword [esi - reloc.MSVCRT.dll_strncpy], eax
pop eax
jmp 0xc9eee4
add byte [eax], al
add byte [eax], al
out 0x7d, eax
in eax, dx
je 0xc9ee70
xor dl, bh
dec esi
fdivr qword [ebx - 0x1cbc2eaa]
jae 0xc9ef0a
in eax, 0x64
cmpsb byte [esi], byte es:[edi]
and al, 0xba
invalid
invalid
Function at 0x40a23c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403dcc
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40a2a5
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00404190
jne 0x40a274
lea eax, [ebx + 0x10]
call fcn.00403dcc
jmp 0x40a2ad
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00404190
jne 0x40a290
lea eax, [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00403e20
cmp dword [ebx + 0x10], 0
jne 0x40a2ad
lea eax, [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00403e20
jmp 0x40a2ad
lea eax, [ebx + 0x10]
call fcn.00403dcc
mov eax, ebx
call fcn.0040a08c
mov eax, dword [0x40b158]
inc dword [eax]
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a307
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a34a
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x75d7
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a38d
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
test edi, edi
je 0x40a3b7
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40a3f0
call fcn.00404090
mov eax, ebx
call fcn.00409f64
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40a251

Function at 0x401000
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 5
push str.H:_amasmcompute01_
push 0
push str.H:_amasmcompute01compute01.exe
push str.open
push 0
call sub.shell32.dll_ShellExecuteA
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 1
push 0x400
call sub.kernel32.dll_OpenProcess
push 0x40309c
push eax
call sub.kernel32.dll_GetExitCodeProcess
push dword [0x40309c]
call 0x401042
jmp dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x402ac5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x451cb0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402b59
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402b16
cmp dword [ebp + 0x10], ebx
jne 0x402b4d
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402ac5
test eax, eax
jne 0x402b28
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405c58
cmp eax, ebx
je 0x402b60
push ebx
push dword [0x451cb0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402b59
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x451cb0], ebx
jne 0x402b56
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402b56
jmp 0x402b59
Function at 0x4051df
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x448080], 0x44
push eax
xor eax, eax
push 0x448080
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40521a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4052a4
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00405546
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x4052da
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x451c88], eax
jmp 0x40545f
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x4052f5
test eax, eax
je 0x40540a
test cl, 2
je 0x40540a
mov esi, 0x443880
push ebx
push esi
call fcn.00405972
cmp dword [ebp + 8], 0
je 0x405314
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40531a
push ebx
call fcn.004054ac
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405400
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405490
cmp byte [eax], 0
je 0x40536b
cmp byte [ebp - 0x18], 0
je 0x40536b
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405381
mov al, byte [esi + 1]
test al, al
je 0x4053df
cmp al, 0x2e
jne 0x405381
cmp byte [esi + 2], 0
je 0x4053df
push esi
push edi
call fcn.00405972
test byte [ebp - 0x148], 0x10
je 0x4053a6
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4053df
push dword [ebp + 0xc]
push ebx
call fcn.004052a4
jmp 0x4053df
push ebx
call fcn.0040562a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4053d7
test byte [ebp + 0xc], 4
je 0x4053cf
push ebx
push 0xfffffffffffffff1
call fcn.00404d1d
push 0
push ebx
call fcn.004056c0
jmp 0x4053df
inc dword [0x451c88]
jmp 0x4053df
push ebx
push 0xfffffffffffffff2
call fcn.00404d1d
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405349
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40540a
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x40545f
cmp dword [ebp - 8], esi
jne 0x40541f
inc dword [0x451c88]
jmp 0x40545f
push ebx
call fcn.00405c1a
test eax, eax
je 0x40545f
push ebx
call fcn.00405465
push ebx
call fcn.0040562a
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405457
test byte [ebp + 0xc], 4
je 0x405417
push ebx
push 0xfffffffffffffff1
call fcn.00404d1d
push esi
push ebx
call fcn.004056c0
jmp 0x40545f
push ebx
push 0xffffffffffffffe5
call fcn.00404d1d
pop esi
pop ebx
leave
ret 8
Function at 0x405546
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x445880
push esi
call fcn.00405972
push esi
call fcn.004054f9
mov edi, eax
test edi, edi
jne 0x405567
xor eax, eax
jmp 0x4055b9
push edi
call fcn.00405b81
test byte [0x451c10], 0x80
je 0x405580
mov al, byte [edi]
test al, al
je 0x405563
cmp al, 0x5c
je 0x405563
sub edi, esi
jmp 0x405598
call fcn.00405c1a
test eax, eax
je 0x405592
test byte [eax], 0x10
je 0x405563
push esi
call fcn.004054ac
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405584
call fcn.00405465
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x40562a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405646
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405649
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405678
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4056bc
test edi, edi
jne 0x405683
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4056b6
Function at 0x4056c0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405c58
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4056e4
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40581d
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x448208], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x448208
je 0x405728
push 1
push 0
push esi
call fcn.00405649
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405823
cmp eax, edi
jg 0x405823
mov esi, 0x447c80
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405823
cmp eax, edi
jg 0x405823
push esi
push ebp
push str._s_s_r_n
push 0x447880
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x451c08]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405994
push 4
push 0xc0000000
push esi
call fcn.00405649
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x40581d
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405816
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405816
cmp edi, dword [esp + 0x18]
jne 0x405816
push str._Rename__r_n
push esi
call fcn.004055be
test eax, eax
jne 0x40582a
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405972
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x447880
push eax
call fcn.0040560a
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x451c90]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409388
push eax
call fcn.004055be
test eax, eax
je 0x4057e1
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405851
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405846
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x4057e3
Function at 0x405859
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4058ca
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4058b9
cmp dword [ebp + 0x14], 1
je 0x4058bb
cmp dword [ebp + 0x14], 2
je 0x4058bb
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405994
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jge 0x4059b5
mov ecx, dword [0x44dbdc]
lea eax, [edi*4 + 4]
sub ecx, eax
mov edi, dword [ecx]
mov eax, dword [0x451c38]
mov ecx, dword [ebp + 8]
add edi, eax
mov eax, 0x449ba0
sub ecx, eax
mov ebx, eax
cmp ecx, 0x4000
jae 0x405b5b
mov ebx, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405b5b
mov edx, ebx
sub edx, eax
cmp edx, 0x2000
jge 0x405b68
inc edi
cmp cl, 0xfc
jbe 0x405b4e
movsx eax, byte [edi + 1]
movsx ecx, byte [edi]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
or ecx, edx
or eax, edx
inc edi
mov dword [ebp - 0x10], ecx
inc edi
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 8], eax
jne 0x405af9
cmp dword [0x451c84], 0
push 2
pop esi
je 0x405a40
push 4
pop esi
mov eax, dword [ebp - 0x14]
test al, al
jns 0x405a77
mov ecx, eax
and eax, 0x3f
add eax, dword [0x451c38]
and ecx, 0x40
push ecx
push ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405859
cmp byte [ebx], 0
jne 0x405ae0
push dword [ebp - 0xc]
push ebx
call fcn.00405994
jmp 0x405adb
cmp eax, 0x25
jne 0x405a8a
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405adb
cmp eax, 0x24
jne 0x405ad7
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor esi, esi
jmp 0x405ad7
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x14]
push dword [0x451c04]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405ad4
push ebx
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp + 0xc], 0
jne 0x405adb
and byte [ebx], 0
test esi, esi
jne 0x405a9f
cmp byte [ebx], 0
je 0x405af1
cmp dword [ebp - 0xc], 0x1a
jne 0x405af1
push str.MicrosoftInternet_ExplorerQuick_Launch
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call fcn.00405b81
jmp 0x405b3f
cmp byte [ebp + 0xf], 0xfd
jne 0x405b2d
cmp esi, 0x1d
jne 0x405b12
push dword [0x451c04]
push ebx
call fcn.004058d0
jmp 0x405b23
mov eax, esi
shl eax, 0xd
add eax, section..ndata
push eax
push ebx
call fcn.00405972
add esi, 0xffffffeb
cmp esi, 7
jae 0x405b3f
jmp 0x405af1
cmp byte [ebp + 0xf], 0xff
jne 0x405b3f
or eax, 0xffffffff
sub eax, esi
push eax
push ebx
call fcn.00405994
push ebx
call sub.KERNEL32.dll_lstrlenA
add ebx, eax
mov eax, 0x449ba0
jmp 0x405b5b
jne 0x405b58
mov cl, byte [edi]
mov byte [ebx], cl
inc ebx
inc edi
jmp 0x405b5b
mov byte [ebx], cl
inc ebx
mov cl, byte [edi]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x4059e0
and byte [ebx], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405b7d
push eax
push dword [ebp + 8]
call fcn.00405972
leave
ret 8
Function at 0x405cc4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x44860c], 0
push esi
jne 0x405cfb
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405cd5
mov dword [ecx*4 + 0x448608], eax
inc ecx
cmp ecx, 0x100
jl 0x405cd0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d2c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x448608]
xor eax, esi
inc ecx
dec edx
jne 0x405d0e
pop edi
not eax
pop esi
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xd1266d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2f405e9e
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x409060
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46592b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045a437
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4090e2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004581ad
mov eax, dword [eax]
push 0x4811c0
push eax
call fcn.0044af84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045a6c2
test bl, bl
je 0x4090e2
push 0x4811c0
lea ecx, [esp + 0xc]
call fcn.0045aa52
push 0x484d3c
lea ecx, [esp + 0xc]
call fcn.0045aa52
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40911e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045a6c2
jmp 0x4091e9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4091a2
lea edx, [esp + 0x7c]
push 0x484d38
push edx
call fcn.0044af84
add esp, 8
test eax, eax
je 0x4091a2
lea eax, [esp + 0x7c]
push 0x484d34
push eax
call fcn.0044af84
add esp, 8
test eax, eax
je 0x4091a2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409132
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045a6c2
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4099e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x409a42
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc