joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412294
Capabilities:
Delete file
Set environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x41229c
push ebx
push esi
push edi
mov eax, 0x411674
call fcn.00405a14
xor eax, eax
push ebp
push 0x412461
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x413a88]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x14]
call fcn.00410e04
mov edx, dword [ebp - 0x14]
mov eax, 0x418aa4
call fcn.004042f4
lea edx, [ebp - 0x18]
mov eax, dword [0x418aa4]
call fcn.00410d18
mov edx, dword [ebp - 0x18]
mov eax, 0x418aa4
call fcn.004042f4
mov bl, 1
xor eax, eax
push ebp
push 0x41239e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40f5a4]
call fcn.004036d4
mov esi, eax
mov edx, esi
mov eax, 0x412478
call fcn.00411570
mov edx, 0x418a98
mov ecx, 0xc
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, esi
call fcn.0041066c
mov edx, esi
mov eax, 0x412484
call fcn.00411570
lea eax, [ebp - 0x20]
mov edx, 0x418a98
call fcn.00404504
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
mov eax, dword [0x418aa4]
call fcn.004113cc
mov edx, dword [ebp - 0x1c]
mov eax, 0x418aa8
call fcn.004042f4
mov edx, dword [0x418aa8]
mov eax, esi
call fcn.004105e8
mov eax, esi
call fcn.00403704
push 2
mov eax, dword [0x418aa8]
call fcn.004046b4
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4123aa
test bl, bl
je 0x412446
lea eax, [ebp - 0x24]
call fcn.00410f14
mov eax, dword [ebp - 0x24]
call fcn.004046b4
push eax
push 0x41248c
call sub.kernel32.dll_SetEnvironmentVariableA
push 0x41249c
push dword [0x418aa8]
push 0x4124b4
lea eax, [ebp - 0x28]
mov edx, dword [0x413bb0]
mov edx, dword [edx]
call fcn.00404498
push dword [ebp - 0x28]
push 0x4124c0
mov eax, 0x418aac
mov edx, 5
call fcn.00404610
cmp dword [0x418aa0], 0x8000
jne 0x412423
push 0x30
push 0x4124c4
push 0x4124d4
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, dword [0x418aac]
call fcn.00411490
mov ebx, eax
mov eax, dword [0x418aa8]
call fcn.004046b4
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x413a88]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412468
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.004042c4
ret
Function at 0x406840
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd3000210
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 4]
cmp eax, 0xfffffff1
rol dword [esp + edx*4 - 0x74ffff44], 0x4b
adc byte [ebp + 0x45e0fd7], al
add dword [edx], esi
mov edx, dword [esp + ecx - 0x72ebbb75]
mov byte [0x50525128], al
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
adc dword [ebp - 0x1afffec9], eax
mov esi, dword [0x43c1c0]
call esi
add eax, 0xf9840f
add byte [eax], al
call esi
xlatb
cmp ah, 0xa
add byte [0xb23b3], bh
jne 0x4069f4
mov edi, dword [ebx + 0x20]
mov esi, dword [ebx + 0x24]
push eax
invalid
jbe 0x406a54
mov esp, ebp
pop ebp
ret 0xe6fc
mov dword [ebp + 0x4dae9014], ecx

Function at 0x409dd0
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x409dd2
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x77cf7a18
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6311554f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x30421787
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x50d95cd0
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x40193e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401951
push esp
mov dword [ebp - 0x24], 0x4016b5
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019f0
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019d1
pop ebp
ret 0x10
Function at 0x401497
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
jmp loc.0053a448
Function at 0x402e9e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
jmp loc.00540d18
Function at 0x40311b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x2004
mov esi, 0x4e80d8
push esi
add eax, 0x3e8
push ebx
mov dword [0x47b300], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 3
push 0x80000000
push esi
call fcn.004058fe
mov edi, eax
mov dword [ebp - 0xc], edi
mov dword [0x40a010], edi
cmp edi, 0xffffffff
jne 0x403175
mov eax, str.Error_launching_installer
jmp 0x40334a
push esi
mov esi, 0x4d80b8
push esi
call fcn.00405ab8
push esi
call fcn.00406015
push eax
push 0x4ec0e0
call fcn.00405ab8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [0x43bd38], eax
mov esi, eax
jle 0x403290
mov ebx, 0x42a178
mov eax, dword [0x47b30c]
neg eax
sbb eax, eax
and eax, 0x7e00
add eax, 0x200
cmp esi, eax
mov edi, esi
jl 0x4031c9
mov edi, eax
push edi
push ebx
call fcn.00402e9e
test eax, eax
je 0x403351
jmp 0x53962c
push 1
call fcn.00402e3a
pop ecx
cmp dword [0x47b30c], ebx
je 0x403359
cmp dword [ebp - 4], ebx
je 0x4032d3
push dword [0x42a174]
call fcn.00402ed0
push 4
lea eax, [ebp + 8]
push eax
call fcn.00402e9e
test eax, eax
je 0x403359
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x403359
push dword [ebp - 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov eax, dword [0x47b30c]
add eax, 0x1c
push eax
call fcn.00402ed0
push dword [ebp - 0x14]
push esi
push ebx
push 0xffffffffffffffff
call fcn.00402ee7
cmp eax, dword [ebp - 0x14]
jne 0x403359
test byte [ebp - 0x28], 1
mov dword [0x47b2bc], esi
mov eax, dword [esi]
mov dword [0x47b308], eax
je 0x403318
inc dword [0x47b304]
push 8
pop ecx
lea eax, [esi + 0x44]
sub eax, 8
add dword [eax], esi
dec ecx
cmp ecx, ebx
jne 0x40331e
push 1
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x3c], eax
push 0x40
add esi, 4
push esi
push 0x47b2c0
call fcn.004058ba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push 1
call fcn.00402e3a
pop ecx
mov eax, str.Installer_integrity_check_has_failed._Common_causes_include_nincomplete_download_and_damaged_media._Contact_the_ninstallers_author_to_obtain_a_new_copy._n_nMore_information_at:_nhttp:__nsis.sf.net_NSIS_Error
jmp 0x40334a

Function at 0x403360
Capabilities:
Create directory

Disassembly:
push esi
mov esi, 0x4e00c8
push esi
call fcn.00405ae7
push esi
call fcn.004057d2
test eax, eax
jne 0x403378
pop esi
ret
push esi
jmp loc.0053f6ec
Function at 0x4058de
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4058fb
and eax, 0xfffffffe
jmp loc.0053debc
ret 4

Function at 0x4058fe
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
jmp loc.0053f2e4

Function at 0x405981
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4059fa
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x4008
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4059e3
cmp dword [ebp + 0x14], 1
je 0x4059e8
jmp loc.0053be7c
xor eax, eax
mov word [esi], ax
push dword [ebp + 0x18]
xor eax, eax
mov word [esi + 0x4006], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 0x14
Function at 0x406042
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x45fe18
push esi
call fcn.00405ab8
push esi
call fcn.00405807
mov edi, eax
test edi, edi
jne 0x406063
xor eax, eax
jmp 0x4060c1
push edi
call fcn.00405ae7
test byte [0x47b308], 0x80
je 0x406080
movzx eax, word [edi]
test ax, ax
je 0x40605f
cmp ax, 0x5c
je 0x40605f
sub edi, esi
jmp 0x538204
pop edi
pop esi
ret 4
Function at 0x4060ca
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
test eax, eax
jge 0x4060e8
mov ecx, dword [0x473288]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x47b2d8]
lea ecx, [ecx + eax*2]
mov eax, 0x46b220
push edi
mov edi, eax
cmp dword [ebp + 8], eax
jb 0x406114
mov edx, dword [ebp + 8]
sub edx, eax
sar edx, 1
cmp edx, 0x4008
jae 0x406114
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
movzx edx, word [ecx]
test dx, dx
je 0x406343
push ebx
push esi
mov esi, edi
sub esi, eax
and esi, 0xfffffffe
cmp esi, 0x4008
jge 0x406341
movzx edx, dx
inc ecx
mov esi, 0xe000
inc ecx
mov dword [ebp + 0xc], edx
test esi, edx
je 0x40631f
mov ebx, esi
cmp dx, bx
jbe 0x40631f
movzx eax, word [ecx]
mov ebx, eax
mov esi, eax
shr eax, 8
and ebx, 0xff
mov dword [ebp - 0xc], eax
or eax, 0x8000
mov edx, ebx
or edx, 0x8000
and esi, 0x7fff
inc ecx
mov dword [ebp - 0x10], eax
inc ecx
mov eax, 0xe002
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], ecx
cmp word [ebp + 0xc], ax
jne 0x4062b2
push 2
pop esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x4061c1
mov ecx, 0x5a04
cmp ax, cx
je 0x4061c1
cmp dword [ebp - 0xc], 0x23
je 0x4061c1
cmp dword [ebp - 0xc], 0x2e
je 0x4061c1
and dword [ebp + 0xc], 0
jmp 0x4061c8
mov dword [ebp + 0xc], 1
cmp dword [0x47b364], 0
je 0x4061d4
push 4
pop esi
test bl, bl
jns 0x406212
mov eax, ebx
and eax, 0x40
push eax
mov eax, dword [0x47b2d8]
push edi
and ebx, 0x3f
lea eax, [eax + ebx*2]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405981
cmp word [edi], 0
jne 0x40629e
push dword [ebp - 0xc]
push edi
call fcn.004060ca
jmp 0x406298
jmp 0x53ae5c
cmp word [edi], 0
je 0x4062ec
cmp dword [ebp - 0xc], 0x1a
jne 0x4062ec
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x4062ec
mov eax, 0xe001
cmp word [ebp + 0xc], ax
jne 0x4062f4
cmp esi, 0x1d
jne 0x4062d0
push dword [0x47b2b4]
push edi
call fcn.004059ff
jmp 0x4062e4
mov eax, esi
imul eax, eax, 0x4008
add eax, section..ndata
push eax
push edi
call fcn.00405ab8
add esi, 0xffffffeb
cmp esi, 7
jae 0x40630b
push edi
call fcn.00405ae7
jmp 0x40630b
mov eax, 0xe003
cmp word [ebp + 0xc], ax
jne 0x40630b
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.004060ca
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 8]
lea edi, [edi + eax*2]
mov eax, 0x46b220
jmp 0x406335
cmp dx, si
jne 0x406330
mov dx, word [ecx]
mov word [edi], dx
inc edi
inc edi
inc ecx
inc ecx
jmp 0x406335
mov word [edi], dx
inc edi
inc edi
movzx edx, word [ecx]
test dx, dx
jne 0x406122
pop esi
pop ebx
xor ecx, ecx
mov word [edi], cx
pop edi
cmp dword [ebp + 8], ecx
je 0x406357
push eax
push dword [ebp + 8]
call fcn.00405ab8
leave
ret 8
Function at 0x40635b
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x4089ac
mov ebx, 0x463e20
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov esi, 0x400
cmp edi, ebp
je 0x4063a9
push 1
push ebp
push edi
call fcn.004058fe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406520
cmp eax, esi
jg 0x406520
push esi
mov edi, 0x469478
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406520
cmp eax, esi
jg 0x406520
push ebp
push ebp
push esi
push 0x464620
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x406520
push ebp
push ebp
push esi
mov esi, 0x464c70
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x406520
push esi
push 0x464620
push str._s_s_r_n
push 0x465070
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x47b2bc]
push dword [eax + 0x128]
push edi
call fcn.004060ca
push 4
push 0xc0000000
push edi
call fcn.004058fe
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x406520
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x406516
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406516
cmp edi, dword [esp + 0x10]
jne 0x406516
push str._Rename__r_n
push esi
call fcn.00405864
cmp eax, ebp
jne 0x4064ad
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x4064de
push 0x4089a0
add eax, 0xa
push eax
call fcn.00405864
mov ebp, eax
test ebp, ebp
je 0x4064dc
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x4064cf
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x4064c9
sub ebp, esi
inc ebp
mov eax, ebp
xor ebp, ebp
jmp 0x4064e0
xor ebp, ebp
mov eax, edi
push ebx
push 0x465070
add eax, esi
push eax
call fcn.004058ba
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
jmp 0x541324
Function at 0x406559
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00406042
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
test cl, 8
je 0x40658e
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x47b368], eax
jmp 0x406734
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x4065a9
test eax, eax
je 0x4066df
test cl, 2
je 0x4066df
push edi
push ebx
mov esi, 0x465470
push esi
call fcn.00405ab8
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x4065cc
push str..
push esi
call edi
jmp 0x4065d2
push ebx
call fcn.00406015
cmp word [ebx], 0
jne 0x4065e2
cmp word [0x465470], 0x5c
jne 0x4065ea
push 0x4082c8
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebx + eax*2]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4066ce
lea esi, [ebp - 0x230]
push 0x3f
mov eax, esi
push eax
call fcn.004057b3
xor edi, edi
cmp word [eax], di
je 0x406631
cmp word [ebp - 0x28], di
je 0x406631
lea esi, [ebp - 0x28]
cmp word [esi], 0x2e
jne 0x40664c
movzx eax, word [esi + 2]
cmp ax, di
je 0x4066ab
cmp ax, 0x2e
jne 0x40664c
cmp word [esi + 4], di
je 0x4066ab
push esi
push dword [ebp - 4]
call fcn.00405ab8
test byte [ebp - 0x25c], 0x10
je 0x406673
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4066ab
push dword [ebp + 0xc]
push ebx
call fcn.00406559
jmp 0x4066ab
push ebx
call fcn.004058de
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4066a3
test byte [ebp + 0xc], 4
je 0x40669b
push ebx
push 0xfffffffffffffff1
call fcn.00404a73
push edi
push ebx
call fcn.00406526
jmp 0x4066ab
inc dword [0x47b368]
jmp 0x4066ab
push ebx
push 0xfffffffffffffff2
call fcn.00404a73
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x538810
xor edi, edi
cmp dword [ebp + 8], edi
pop edi
je 0x4066df
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [ecx - 2], ax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406733
cmp dword [ebp - 0xc], esi
je 0x406723
push ebx
call fcn.00405b98
test eax, eax
je 0x406733
push ebx
call fcn.00405fe6
push ebx
call fcn.004058de
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40672b
test byte [ebp + 0xc], 4
je 0x406723
push ebx
push 0xfffffffffffffff1
call fcn.00404a73
push esi
push ebx
call fcn.00406526
jmp 0x406733
inc dword [0x47b368]
jmp 0x406733
push ebx
push 0xffffffffffffffe5
call fcn.00404a73
pop esi
pop ebx
leave
ret 8
Function at 0x406739
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x469c7c], 0
jne 0x406777
xor ecx, ecx
push esi
jmp loc.00541d38
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4067a4
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x469c78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406785
not eax
pop ebp
ret 0xc
Function at 0x4011e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x405d79
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x40b224]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x7c], 0
jne 0x401296
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_316]
push 0x104
push 0x104
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call dword [sym.imp.mfc90.dll_Ordinal_2691]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_5835]
push str.winhlp32.exe
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_945]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401285
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x401285
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x7c], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4012b0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret 8

Function at 0x403040
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x40b224]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push edi
mov esi, ecx
push 0x1fc
xor edi, edi
lea eax, [esi + 0x55]
push edi
push eax
call sub.MSVCR90.dll_memset
push 0x90
lea ecx, [esp + 0x1c]
push edi
push ecx
mov dword [esi + 0x254], edi
mov dword [esi + 0x258], 1
mov dword [esi + 0x25c], 1
mov dword [esi + 0x29c], edi
mov dword [esi + 0x2a0], 1
mov dword [esi + 0x260], edi
mov dword [esi + 0x280], edi
mov dword [esi + 0x298], edi
mov dword [esi + 0x268], edi
mov dword [esi + 0x2a4], edi
mov dword [esp + 0x20], 0x94
call sub.MSVCR90.dll_memset
add esp, 0x18
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x18], 2
jne 0x403107
cmp dword [esp + 0xc], 5
jb 0x403107
mov eax, 1
pop edi
mov dword [esi + 0x264], eax
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00405250
add esp, 0x98
ret
mov ecx, dword [esp + 0x9c]
mov dword [esi + 0x264], edi
pop edi
pop esi
xor ecx, esp
call fcn.00405250
add esp, 0x98
ret

Function at 0x405250
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b224]
jne 0x40525a
repz ret
jmp fcn.004057b1
Function at 0x404000
Capabilities:
Check if file exists
Create thread
Terminate process

Disassembly:
call dword [sym.imp.comctl32.dll_InitCommonControls]
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov dword [0x4012c8], eax
push 0
push 0x40402d
push 0
push 1
push eax
call dword [sym.imp.user32.dll_DialogBoxParamW]
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x406dc2
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
call dword [sym.imp.kernel32.dll_GetProcessHeap]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x1000
push 8
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov esi, eax
xor ebx, ebx
lodsw ax, word [esi]
or al, al
je 0x406e71
cmp ax, 0x22
je 0x406e52
cmp ebx, 1
je 0x406e1c
cmp ax, 0x20
je 0x406e27
cmp ax, 9
je 0x406e27
stosw word es:[edi], ax
mov dword [ebp - 4], 1
jmp 0x406dff
mov al, 0
stosw word es:[edi], ax
inc dword [ebp - 8]
mov dword [ebp - 4], 0
lodsw ax, word [esi]
or ax, ax
je 0x406e71
cmp ax, 0x22
je 0x406e56
cmp ax, 0x20
je 0x406e35
cmp ax, 9
je 0x406e35
dec esi
dec esi
jmp 0x406dff
or ebx, ebx
jne 0x406e65
cmp dword [ebp + 0xc], 1
jne 0x406e5e
stosw word es:[edi], ax
mov ebx, 1
jmp 0x406dff
cmp dword [ebp + 0xc], 1
jne 0x406e6d
stosw word es:[edi], ax
xor ebx, ebx
jmp 0x406e27
xor eax, eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
mov ecx, edi
sub ecx, dword [ebp - 0xc]
push ecx
push ecx
push 8
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_HeapAlloc]
pop ecx
mov edi, eax
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 0xc]
push 0
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov dword [eax], ebx
mov eax, dword [ebp - 8]
shl eax, 2
push eax
push 8
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
mov esi, dword [eax + 8]
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
or eax, eax
je 0x406ee5
mov dword [edi], esi
add edi, 4
shl eax, 1
add esi, eax
inc esi
inc esi
jmp 0x406ecd
popal
leave
ret 8