joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451c98
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x461bb4]
cmp dword [eax + 0x30], 0
je 0x451d42
cmp dword [ebx + 0x94], 0
jne 0x451d3c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x451c28
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x451d3c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x451d02
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x451d3c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00416dbc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x451d11
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4528a4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4528d9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404034
jmp 0x4528e6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403f98
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x453938
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x453979
mov eax, esi
call fcn.0043a100
test al, al
je 0x453979
mov eax, dword [ebx + 0x84]
call fcn.00439dfc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x453979
push 0
mov eax, dword [ebx + 0x84]
call fcn.00439dfc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4248a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e46c
and dword [ebp - 4], 0
cmp dword [0x44c388], 0
mov ebx, eax
jne 0x424956
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424a07
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x424a07
push eax
call fcn.0041e3fa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44c388], eax
call esi
push eax
call fcn.0041e3fa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44c38c], eax
call esi
push eax
call fcn.0041e3fa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44c390], eax
call esi
push eax
call fcn.0041e3fa
pop ecx
mov dword [0x44c398], eax
test eax, eax
je 0x424956
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e3fa
pop ecx
mov dword [0x44c394], eax
mov eax, dword [0x44c394]
cmp eax, ebx
je 0x4249ae
cmp dword [0x44c398], ebx
je 0x4249ae
push eax
call fcn.0041e475
push dword [0x44c398]
mov esi, eax
call fcn.0041e475
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4249ae
test edi, edi
je 0x4249ae
call esi
test eax, eax
je 0x4249a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4249a5
test byte [ebp - 0xc], 1
jne 0x4249ae
or dword [ebp + 0x10], 0x200000
jmp 0x4249e7
mov eax, dword [0x44c38c]
cmp eax, ebx
je 0x4249e7
push eax
call fcn.0041e475
pop ecx
test eax, eax
je 0x4249e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4249e7
mov eax, dword [0x44c390]
cmp eax, ebx
je 0x4249e7
push eax
call fcn.0041e475
pop ecx
test eax, eax
je 0x4249e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44c388]
call fcn.0041e475
pop ecx
test eax, eax
je 0x424a07
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424a09
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x44e9b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404914
mov edi, dword [ebp + 8]
add edi, 0xffffff00
xor eax, eax
push ebp
push 0x44ead1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x46
xor ebx, ebx
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.00404724
test eax, eax
jle 0x44eaa0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
add eax, 0xba
xor edx, edx
push edx
push eax
lea eax, [ebx + 1]
cdq
call fcn.00405250
mov ebx, eax
mov eax, dword [ebp - 0x18]
add eax, 0xba
xor edx, edx
push edx
push eax
xor eax, eax
mov al, byte [edi + ebx]
add eax, esi
cdq
call fcn.00405250
mov esi, eax
mov al, byte [edi + ebx]
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
mov byte [edi + esi], al
xor eax, eax
mov al, byte [edi + ebx]
xor edx, edx
mov dl, byte [edi + esi]
add eax, edx
mov edx, dword [ebp - 0x18]
add edx, 0xba
mov ecx, edx
xor edx, edx
div ecx
mov al, byte [edi + edx]
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dl, byte [edx + ecx - 1]
mov cl, byte [ebp - 0xd]
xor dl, cl
call fcn.0040464c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
call fcn.0040472c
inc dword [ebp - 0xc]
dec dword [ebp - 0x1c]
jne 0x44ea13
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004044b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ead8
lea eax, [ebp - 0x20]
call fcn.00404464
lea eax, [ebp - 0x14]
call fcn.00404464
lea eax, [ebp - 4]
call fcn.00404464
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, 0x60664a1b
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x4d81433d
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40388f
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x218
mov ebx, dword [esp + 0x234]
mov edi, dword [esp + 0x230]
mov esi, ebx
and esi, 0x300
lea eax, [esi + 9]
mov ecx, esp
push ecx
push eax
push edi
push dword [esp + 0x238]
call fcn.00407e82
test eax, eax
jne 0x40397e
mov dword [esp + 4], esi
test bl, 2
je 0x40390a
xor eax, eax
lea ecx, [esp + 8]
mov dword [ecx], eax
mov edx, dword [esp]
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x2e]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x403960
lea ebp, [esp + 0xe]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x105
push ebp
push 0
push dword [esp + 0xc]
call esi
test eax, eax
jne 0x40393a
test bl, 1
jne 0x403960
push ebx
push ebp
push dword [esp + 8]
call fcn.0040388f
test eax, eax
je 0x403914
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406f3d
test eax, eax
je 0x403970
push 0
push dword [esp + 8]
push edi
push dword [esp + 0x238]
call eax
jmp 0x40397e
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x40397e
push edi
push dword [esp + 0x230]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x403e4e
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
test eax, eax
js 0x403e79
add eax, dword [0x434280]
mov dword [0x434244], eax
xor ecx, ecx
push ecx
push ecx
push eax
push dword [0x418014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403f61
test eax, eax
js 0x403eed
mov eax, esp
push 4
push eax
push dword [0x418014]
call fcn.00407847
test eax, eax
je 0x403f45
add dword [0x434244], 4
push dword [esp]
call fcn.00403f61
test eax, eax
js 0x403eed
mov eax, dword [esp + 0x24]
test eax, eax
je 0x403ef1
mov ecx, dword [esp + 0x28]
mov edx, dword [esp]
cmp edx, ecx
cmovl ecx, edx
lea edx, [esp + 4]
push 0
push edx
push ecx
push eax
push dword [0x418014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, 0xfffffffd
test eax, eax
je 0x403f4a
mov esi, dword [esp + 4]
add dword [0x434244], esi
jmp 0x403f4a
mov esi, eax
jmp 0x403f4a
mov edi, dword [esp]
test edi, edi
jle 0x403f56
mov ebx, dword [esp + 0x20]
xor esi, esi
mov ebp, 0x4000
cmp edi, ebp
cmovge edi, ebp
push edi
push 0x434288
push dword [0x418014]
call fcn.00407847
test eax, eax
je 0x403f45
push edi
push 0x434288
push ebx
call fcn.00407879
test eax, eax
je 0x403f5a
add esi, edi
mov eax, dword [esp]
add dword [0x434244], edi
sub eax, edi
mov dword [esp], eax
mov edi, eax
test eax, eax
jg 0x403f03
jmp 0x403f4a
mov esi, 0xfffffffd
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
xor esi, esi
jmp 0x403f4a
mov esi, 0xfffffffe
jmp 0x403f4a
Function at 0x406e88
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
lea ebx, [esp + 0xc]
mov dword [ebx], 0x40001
mov eax, 0x40b540
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
xor esi, esi
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], 0x40b530
mov eax, esp
mov dword [eax], 0xc
mov dword [eax + 4], ebx
mov dword [eax + 8], esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406efa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0xb7
jne 0x406efa
push ebx
push 0x80000007
push edi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
mov esi, 0
test eax, eax
jne 0x406efa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret 4

Function at 0x406f76
Capabilities:
Create process on windows

Disassembly:
push esi
sub esp, 0x38
mov eax, dword [esp + 0x40]
mov dword [0x46c328], 0x44
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], ecx
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
movaps xmm0, xmmword [0x40b4d0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 0x20], 0x46c328
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x406fd6
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov esi, dword [esp + 0x28]
mov eax, esi
add esp, 0x38
pop esi
ret 4

Function at 0x406fdf
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x40708b
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
push ebx
call fcn.004070dc
xor esi, esi
cmp eax, 0xffffffff
je 0x4070d3
mov edi, eax
mov eax, dword [esp + 0x18]
mov ebp, eax
test al, 1
jne 0x4070b5
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4070bc
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4070c5
xor esi, esi
inc esi
jmp 0x4070d3
mov eax, ebp
test al, 4
jne 0x4070d3
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4070dc
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
je 0x4070fd
mov eax, esi
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
pop edi
ret 4
Function at 0x407397
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, 0x47036c
push 0x2000
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call fcn.004075ae
xor ebx, ebx
test eax, eax
je 0x407429
mov esi, eax
push eax
call fcn.00407623
mov eax, dword [0x40b4b8]
test byte [eax], 0x80
je 0x4073da
movzx eax, word [esi]
test eax, eax
je 0x407429
cmp eax, 0x5c
je 0x407429
mov edi, 0x47036c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub esi, edi
sar esi, 1
cmp eax, esi
jle 0x407414
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x47036c
call fcn.004074f3
test eax, eax
je 0x407407
test byte [eax], 0x10
je 0x407429
push edi
call fcn.0040744e
push edi
call ebp
cmp eax, esi
jg 0x4073f4
push edi
call fcn.0040751b
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4074c4
Capabilities:
Move file

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4074e6
push edi
push esi
call fcn.0040794e
add esp, 8
mov eax, dword [0x40b114]
inc dword [eax + 0x10]
pop esi
pop edi
ret 8

Function at 0x4077a7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
push ecx
push eax
push ebx
push ecx
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop esi
pop edi
pop ebx
ret 0xc

Function at 0x4077d9
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x1c]
mov ebx, 0xffffff9b
mov ebp, esp
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc ebx
je 0x407834
mov dword [esp + 4], 0x61
mov dword [esp], 0x73006e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov edx, 0x4ec4ec4f
mul edx
shr edx, 3
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
add eax, edx
sub ecx, eax
add word [esp + 4], cx
push esi
push 0
push ebp
push dword [esp + 0x2c]
call edi
test eax, eax
je 0x4077f1
jmp 0x40783b
mov word [esi], 0
xor esi, esi
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x407847
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov edi, esp
push 0
push edi
push esi
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
cmp dword [edi], esi
sete cl
and cl, al
movzx eax, cl
add esp, 4
pop esi
pop edi
ret 0xc
Function at 0x407879
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov edi, esp
push 0
push edi
push esi
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
cmp dword [edi], esi
sete cl
and cl, al
movzx eax, cl
add esp, 4
pop esi
pop edi
ret 0xc

Function at 0x4078ab
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x1c]
xor ebx, ebx
push 1
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor esi, esi
inc esi
test eax, eax
jne 0x40791d
lea eax, [esp + 4]
lea ecx, [esp + 2]
push 0
push eax
push 2
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4078f9
cmp dword [esp + 4], 2
jne 0x4078f9
movzx eax, word [esp + 2]
cmp eax, 0xfeff
jne 0x4078f9
mov esi, ebx
jmp 0x40791d
cmp dword [esp + 0x20], 0
je 0x407911
xor ebx, ebx
push 1
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x407928
xor eax, eax
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
ret 8
lea esi, [esp + 8]
push ebx
push esi
push 2
push 0x40b750
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esi], 2
mov ecx, 0x80004005
cmovne ebx, ecx
test eax, eax
cmove ebx, ecx
jmp 0x4078f5
Function at 0x40794e
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x20]
mov dword [0x474f74], 0x4c
mov dword [0x474f70], 0x55004e
test esi, esi
je 0x4079cf
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
sub esp, 0x1c
mov dword [esp + 0x14], ecx
movaps xmm0, xmmword [0x40b4e0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 0x474f70
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x407b3c
cmp eax, 0x400
jg 0x407b3c
push 0x400
push 0x47476c
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x407b3c
cmp eax, 0x400
jg 0x407b3c
mov esi, 0x47476c
push esi
push 0x474f70
push str._ls_ls_r_n
push 0x47436c
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edi, eax
mov eax, dword [0x40a004]
mov eax, dword [eax]
push dword [eax + 0x128]
push esi
call fcn.00407b44
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
sub esp, 0x1c
mov dword [esp + 0x14], ecx
movaps xmm0, xmmword [0x40b4f0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x407b3c
mov esi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
add eax, edi
add eax, 0xa
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x407b35
mov ebx, eax
mov eax, esp
push 0
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407b35
cmp dword [esp], ebp
jne 0x407b35
push str._Rename__r_n
push ebx
call fcn.00407718
test eax, eax
je 0x407ae5
add eax, 0xa
push 0x40b767
push eax
call fcn.00407718
test eax, eax
je 0x407af7
mov ecx, ebp
add ecx, ebx
cmp ecx, eax
jbe 0x407ae0
mov dl, byte [ecx]
mov byte [ecx + edi], dl
lea edx, [ecx - 1]
mov ecx, edx
cmp edx, eax
ja 0x407ad2
sub eax, ebx
inc eax
jmp 0x407af9
lea eax, [ebx + ebp]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add ebp, 0xa
mov eax, ebp
test edi, edi
je 0x407b11
mov ecx, ebx
add ecx, eax
xor eax, eax
mov dl, byte [eax + 0x47436c]
mov byte [ecx + eax], dl
inc eax
cmp edi, eax
jne 0x407b03
add ebp, edi
xor edi, edi
push edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 4]
push edi
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407eeb
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp dword [esp + 0x28], 0
mov dword [esp + 8], 0x4000
setne dl
shl edx, 8
or edx, 0x20019
mov esi, esp
push esi
push edx
push ecx
push eax
call fcn.00407e82
test eax, eax
jne 0x407f65
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push edi
push ecx
push 0
push dword [esp + 0x30]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [edi + 0x3ffe], 0
test esi, esi
jne 0x407f65
mov eax, dword [esp + 4]
add eax, 0xfffffffd
cmp eax, 0xfffffffd
ja 0x407f6a
mov word [edi], 0
add esp, 0xc
pop esi
pop edi
ret 0x14

Function at 0x40804d
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push edi
push esi
push eax
cmp dword [esp + 0x10], 0
je 0x40807a
mov eax, dword [0x418044]
cmp eax, 0xffffffff
je 0x408068
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x418044], 0xffffffff
add esp, 4
pop esi
pop edi
ret 4
cmp dword [0x47d770], 0
je 0x408072
cmp word [0x47d774], 0
mov eax, dword [0x418044]
je 0x4080e9
cmp eax, 0xffffffff
jne 0x4080e9
mov edi, 0x47d774
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
cmove eax, esi
sub esp, 0x1c
mov dword [esp + 0x14], eax
movaps xmm0, xmmword [0x40b500]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x418044], eax
cmp eax, 0xffffffff
je 0x408072
push 2
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [0x418044]
cmp eax, 0xffffffff
je 0x408072
mov esi, 0x47df74
push 0x40b82a
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [0x418044]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, esp
push 0
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x408072

Function at 0x4082da
Capabilities:
Get common file path

Disassembly:
push edi
push esi
sub esp, 0x23c
mov edi, dword [esp + 0x248]
mov esi, esp
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, 0x105
cmovb ecx, eax
test ecx, ecx
je 0x408312
xor eax, eax
cmp word [esp + ecx*2 - 2], 0x5c
sete al
jmp 0x408315
xor eax, eax
inc eax
lea ecx, [esp + ecx*2]
lea eax, [eax*2 + 0x40b56e]
push edi
push eax
push str._s_S.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x23c
pop esi
pop edi
ret 4
Function at 0x408414
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
cmp dword [0x47f1c8], 0
jne 0x408450
xor eax, eax
mov edx, 8
mov esi, eax
mov edi, esi
shr edi, 1
and esi, 1
neg esi
and esi, 0xedb88320
xor esi, edi
dec edx
jne 0x40842d
mov dword [eax*4 + 0x47f1c4], esi
inc eax
cmp eax, 0x100
jne 0x408426
mov eax, dword [esp + 0x10]
test ecx, ecx
je 0x408479
mov edx, dword [esp + 0x14]
not eax
xor esi, esi
mov bl, byte [edx + esi]
xor bl, al
movzx edi, bl
shr eax, 8
xor eax, dword [edi*4 + 0x47f1c4]
inc esi
cmp ecx, esi
jne 0x408460
not eax
pop esi
pop edi
pop ebx
ret 0xc