joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7791c45b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x7791c3a4
add ebx, 0
push ecx
call 0x7791c3b9
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x7323423e
sub ebx, dword [0x73253a7d]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x73253a6d
call fcn.77917e83
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.77917391
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x7791c517
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x7791c517
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x7791c4ce
mov eax, 1
lock xchg dword [0x73253a79], eax
push 0x3dd1fc71
call 0x7791c45b
push esi
add esp, 8
cmp eax, 0
jne 0x7791c444
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x7791c46a
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x7791c47f
cmp ecx, edx
cmp eax, 0
je 0x7791c4a4
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x7791c48e
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.7791c4bd
dec eax
loope 0x7791c4c0
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x73253a79], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x7791c4f4
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x7791c509
jmp 0x7791c514
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x7791c402
Function at 0x7792357c
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x77923852
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x732406f1
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x732376b7
push 0xffffffffffffffff
call fcn.7791a77c
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x779235e6
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.779235fe
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x77923846
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x7792381a
Function at 0x7793304c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x7793306e
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x7793306e
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x7793306e
ret
cmp word [ebx + 4], 0x14c
jne 0x7793306e
test word [ebx + 0x16], 2
je 0x7793306e
test word [ebx + 0x16], 0x100
je 0x7793306e
cmp word [ebx + 0x18], 0x10b
jne 0x7793306e
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x7793306e
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x779330fa
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x7793308e
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.77919fd9
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x7793306e
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x779330fa
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x7793306e
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x7793306e
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x7793306e
ret
cmp word [ebx + 4], 0x14c
jne 0x7793306e
test word [ebx + 0x16], 2
je 0x7793306e
test word [ebx + 0x16], 0x100
je 0x7793306e
cmp word [ebx + 0x18], 0x10b
jne 0x7793306e
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x7793306e
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x779330fa
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x7793308e
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.77919fd9
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x7793306e
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x779331b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x7793320a
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x779331b1
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x779331c0
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x77d38e63
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x77933211
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.7791a087
cmp eax, dword [ebp + 0xc]
pop eax
je 0x779332b0
add edi, 4
add eax, 2
dec ecx
jne 0x779331f6
call 0x7793325d
loope 0x77933253
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x779332ad
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x779332be
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x77933271
cmp eax, ecx
ja 0x77933271
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x779332fb
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x779332f1
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.7791a566
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x779331c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x7793320a
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x779331b1
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x779331c0
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x77d38e63
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x77933211
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.7791a087
cmp eax, dword [ebp + 0xc]
pop eax
je 0x779332b0
add edi, 4
add eax, 2
dec ecx
jne 0x779331f6
call 0x7793325d
loope 0x77933253
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x779332ad
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x779332be
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x77933271
cmp eax, ecx
ja 0x77933271
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x779332fb
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x779332f1
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.7791a566
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x52b280
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd7000]
push edi
or ebp, 0xffffffff
jmp 0x52b2a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52b2a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52b298
mov eax, 1
add ebx, ebx
jne 0x52b2bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52b2cc
jne 0x52b2eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52b2eb
dec eax
add ebx, ebx
jne 0x52b2d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52b2b0
add ebx, ebx
jne 0x52b2e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52b33d
xor ecx, ecx
sub eax, 3
jb 0x52b303
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52b372
sar eax, 1
mov ebp, eax
jmp 0x52b30e
add ebx, ebx
jne 0x52b30e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52b2dc
inc ecx
add ebx, ebx
jne 0x52b31c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52b2dc
add ebx, ebx
jne 0x52b329
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52b31e
jne 0x52b33a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52b31e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52b35c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52b34e
jmp 0x52b29e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52b35c
add edi, ecx
jmp 0x52b29e
pop esi
mov edi, esi
mov ecx, 0x68bb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52b37a
cmp byte [edi], 0x30
jne 0x52b37a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52b37f
lea edi, [esi + 0x128000]
mov eax, dword [edi]
or eax, eax
je 0x52b3ee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x161b8c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x161c6c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52b3ac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x161c74]
or eax, eax
je 0x52b3e8
mov dword [ebx], eax
add ebx, 4
jmp 0x52b3c9
call dword [esi + 0x161c70]
mov ebp, dword [esi + 0x161c78]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52b422
sub esp, 0xffffff80
jmp 0x4d3a74
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x5b3108
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 4], eax
push ebx
cwde
mov eax, 0x456234
push 0x8e9a1eca
pushal
call fcn.005d31b3
add dword [edi - 0x32979fb3], 0x878031a8
inc esp
and al, 0x20
lea eax, [ebx - 0x37814ee5]
not ax
push 0xe8c07c6f
mov eax, 0x4965a1
push dword [esp]
mov eax, dword [eax + 0xea278]
mov byte [esp], ah
pushfd
lea esp, [esp + 0x2c]
call fcn.005aace0
pushfd
pop edi
mov di, si
mov edi, eax
not ax
pushfd
mov eax, dword [esp + 4]
pushfd
mov byte [esp], dh
lea esp, [esp + 0xc]
jmp fcn.0045082e

Function at 0x5b7e8e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
not bh
mov ebx, eax
cwde
not al
mov eax, dword [esp + 4]
mov byte [esp + 4], 0xa6
pushal
push 0x1be9d46a
pushfd
lea esp, [esp + 0x30]
jmp fcn.004a5543
jmp 0x5b742a

Function at 0x5c9c91
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [eax + 0x169a0d]
push 0xd330db7c
call fcn.0057d86c

Function at 0x5c9ca1
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov dword [esp + 0x1c], eax
setl al
lea eax, [edi*8 + 0x2d4a0ef1]
pushal
mov eax, 0x40bc81
call fcn.005bff67

Function at 0x5d4dc3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [eax + 0x1b6a98]
call fcn.005a57d2
fmul qword [ebp - 0x77]
or byte [ecx + 0x42d9a2f5], 0x77
sbb al, 0x9c
inc eax
push ebp
xchg ecx, eax
wait
push edi
inc ecx
test byte [esi + edi*2 - 0x540cd899], dl
invalid
Function at 0x402a47
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x7a27b0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402adb
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a98
cmp dword [ebp + 0x10], ebx
jne 0x402acf
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a47
test eax, eax
jne 0x402aaa
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a7f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405ea2
cmp eax, ebx
je 0x402ae2
push ebx
push dword [0x7a27b0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402adb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x7a27b0], ebx
jne 0x402ad8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ad8
jmp 0x402adb
Function at 0x405347
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x7a0500], 0x44
push eax
xor eax, eax
push 0x7a0500
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405382
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40540c
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405800
mov edi, eax
cmp edi, 0xffffffff
je 0x40544d
test byte [esp + 0x10], 1
push esi
je 0x40542f
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x405435
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40543e
xor eax, eax
inc eax
jmp 0x40544f
test byte [esp + 0x10], 4
jne 0x40544d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405454
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405712
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405493
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7a2788], eax
jmp 0x40561d
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x4054ad
test eax, eax
je 0x4055cb
test bl, 2
je 0x4055cb
mov esi, 0x79fd00
push edi
push esi
call fcn.00405b77
cmp dword [ebp + 8], 0
je 0x4054cc
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4054d2
push edi
call fcn.0040566b
cmp byte [edi], 0
jne 0x4054e0
cmp byte [0x79fd00], 0x5c
jne 0x4054eb
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x4055c1
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.0040564f
cmp byte [eax], 0
je 0x405531
cmp byte [ebp - 0x1c], 0
je 0x405531
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405547
mov al, byte [esi + 1]
test al, al
je 0x4055a0
cmp al, 0x2e
jne 0x405547
cmp byte [esi + 2], 0
je 0x4055a0
push esi
push ebx
call fcn.00405b77
test byte [ebp - 0x14c], 0x10
je 0x40556c
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4055a0
push dword [ebp + 0xc]
push edi
call fcn.00405454
jmp 0x4055a0
push dword [ebp - 4]
push edi
call fcn.0040540c
test eax, eax
jne 0x405598
cmp dword [ebp - 4], eax
je 0x405590
push edi
push 0xfffffffffffffff1
call fcn.00404e84
push 0
push edi
call fcn.00405a2b
jmp 0x4055a0
inc dword [0x7a2788]
jmp 0x4055a0
push edi
push 0xfffffffffffffff2
call fcn.00404e84
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40550f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x4055cb
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40561d
cmp dword [ebp - 0xc], esi
jne 0x4055df
inc dword [0x7a2788]
jmp 0x40561d
push edi
call fcn.00405e7b
test eax, eax
je 0x40561d
push edi
call fcn.00405624
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.0040540c
test eax, eax
jne 0x405615
cmp dword [ebp - 4], esi
je 0x4055d7
push edi
push 0xfffffffffffffff1
call fcn.00404e84
push esi
push edi
call fcn.00405a2b
jmp 0x40561d
push edi
push 0xffffffffffffffe5
call fcn.00404e84
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405712
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x7a0100
push esi
call fcn.00405b77
push esi
call fcn.004056bd
mov edi, eax
test edi, edi
jne 0x405733
xor eax, eax
jmp 0x405785
push edi
call fcn.00405de2
test byte [0x7a2718], 0x80
je 0x40574c
mov al, byte [edi]
test al, al
je 0x40572f
cmp al, 0x5c
je 0x40572f
sub edi, esi
jmp 0x405764
call fcn.00405e7b
test eax, eax
je 0x40575e
test byte [eax], 0x10
je 0x40572f
push esi
call fcn.0040566b
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405750
call fcn.00405624
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405800
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40581f
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x405825
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405854
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x409368]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405899
test edi, edi
jne 0x40585f
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405893
Function at 0x40589d
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x7a0a88
push 0x409384
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
mov ebx, 0x400
je 0x4058ec
push 1
push 0
push esi
call fcn.00405825
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x405a25
cmp eax, ebx
jg 0x405a25
mov esi, 0x7a0e88
push ebx
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x405a25
cmp eax, ebx
jg 0x405a25
push esi
push edi
push str._s_s_r_n
push 0x7a0688
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x7a2710]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405b99
push 4
push 0xc0000000
push esi
call fcn.00405825
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
je 0x405a25
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405a1e
lea eax, [esp + 0x10]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405a1e
cmp edi, dword [esp + 0x10]
jne 0x405a1e
push str._Rename__r_n
push esi
call fcn.0040578a
test eax, eax
jne 0x4059b4
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x4059e9
add eax, 0xa
push 0x40936c
push eax
call fcn.0040578a
mov ebp, eax
test ebp, ebp
je 0x4059e5
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x4059d6
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x4059d0
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x1c]
jmp 0x4059eb
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
add eax, esi
push 0x7a0688
push eax
call fcn.004057e0
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x405a5e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405acf
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405abe
cmp dword [ebp + 0x14], 1
je 0x405ac0
cmp dword [ebp + 0x14], 2
je 0x405ac0
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14