joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416e78
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x423d30], ebx
push esi
push edi
jne 0x416ef8
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x416f33
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41e598
push edi
call esi
test eax, eax
mov dword [0x423d30], eax
je 0x416f33
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x423d34], eax
call esi
cmp dword [0x4239c0], 2
mov dword [0x423d38], eax
jne 0x416ef8
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x423d40], eax
je 0x416ef8
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x423d3c], eax
mov eax, dword [0x423d3c]
test eax, eax
je 0x416f3d
call eax
test eax, eax
je 0x416f24
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x423d40]
test eax, eax
je 0x416f24
test byte [ebp - 8], 1
jne 0x416f3d
cmp dword [0x4239cc], 4
jb 0x416f37
or byte [ebp + 0x12], 0x20
jmp 0x416f5c
xor eax, eax
jmp 0x416f6c
or byte [ebp + 0x12], 4
jmp 0x416f5c
mov eax, dword [0x423d34]
test eax, eax
je 0x416f5c
call eax
mov ebx, eax
test ebx, ebx
je 0x416f5c
mov eax, dword [0x423d38]
test eax, eax
je 0x416f5c
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x423d30]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x417189
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040e0e0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41721e
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x4239c0]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x41721e
cmp eax, 1
je 0x417236
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41721e
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x4171f3
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x41721a
xor eax, eax
inc eax
jmp 0x417252
cmp esi, ebx
jae 0x417222
xor eax, eax
jmp 0x417252
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4239c0]
jmp 0x417238
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4173fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], bl
je 0x417427
cmp eax, 1
je 0x417427
jle 0x41742f
cmp eax, 3
jle 0x417427
cmp eax, 4
jne 0x41742f
mov byte [ebp - 1], 1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x41745a
call fcn.0040f4d4
mov dword [eax], 0x16
call fcn.0040f4dd
mov dword [eax], ebx
or eax, 0xffffffff
jmp 0x4175d3
inc eax
cmp byte [eax], bl
jne 0x417449
lea ecx, [eax + 1]
cmp byte [ecx], bl
je 0x41745a
mov byte [eax], 0x20
mov eax, ecx
cmp byte [eax], bl
jne 0x417449
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.00416d60
mov dword [ebp - 0x68], esi
mov esi, dword [0x424080]
add esp, 0xc
cmp esi, ebx
je 0x4174a1
lea ecx, [esi - 1]
mov edx, ecx
mov eax, ecx
sar edx, 5
mov edx, dword [edx*4 + 0x4240a0]
and eax, 0x1f
lea eax, [eax + eax*8]
cmp byte [edx + eax*4 + 4], bl
jne 0x4174a1
dec esi
dec ecx
cmp esi, ebx
jne 0x417481
lea eax, [esi + esi*4 + 4]
mov word [ebp - 0x36], ax
movzx eax, ax
push 1
push eax
call fcn.0041607e
cmp esi, ebx
mov dword [ebp - 0x34], eax
pop ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x34]
pop ecx
mov dword [ebp - 8], ebx
lea ecx, [eax + 4]
lea edx, [eax + esi + 4]
jle 0x417507
mov eax, dword [ebp - 8]
mov edi, eax
sar edi, 5
mov edi, dword [edi*4 + 0x4240a0]
and eax, 0x1f
lea eax, [eax + eax*8]
lea edi, [edi + eax*4]
mov al, byte [edi + 4]
test al, 0x10
jne 0x4174f3
mov byte [ecx], al
mov eax, dword [edi]
mov dword [edx], eax
jmp 0x4174f8
mov byte [ecx], bl
or dword [edx], 0xffffffff
inc dword [ebp - 8]
inc ecx
add edx, 4
cmp dword [ebp - 8], esi
jl 0x4174cc
mov eax, dword [ebp - 0x34]
cmp byte [ebp - 1], bl
je 0x417538
lea ecx, [eax + 4]
xor edx, edx
lea eax, [eax + esi + 4]
cmp esi, 3
jge 0x41751e
mov edi, esi
jmp 0x417521
push 3
pop edi
cmp edx, edi
jge 0x417531
mov byte [ecx], bl
or dword [eax], 0xffffffff
inc edx
inc ecx
add eax, 4
jmp 0x417515
mov dword [ebp - 0xc], 8
call fcn.0040f4d4
mov dword [eax], ebx
call fcn.0040f4dd
mov dword [eax], ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 0xc]
push 1
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x34]
mov edi, eax
call fcn.0040e11d
cmp esi, ebx
pop ecx
jne 0x417588
push edi
call fcn.0040f4e6
pop ecx
or eax, 0xffffffff
jmp 0x4175d1
cmp dword [ebp + 8], 2
jne 0x417594
push ebx
call fcn.00410e00
cmp dword [ebp + 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x4175c1
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x24]
call esi
jmp 0x4175ca
cmp dword [ebp + 8], 4
je 0x4175ba
mov ebx, dword [ebp - 0x24]
push dword [ebp - 0x20]
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417808
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x422ad0]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x417883
push ebx
call fcn.004177d1
test eax, eax
pop ecx
jne 0x417855
call fcn.0040f4dd
mov dword [eax], 0xf
call fcn.0040f4d4
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.004156d3
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x417895
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x417845
inc eax
cmp eax, 0x104
ja 0x417845
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4178cd
cmp eax, dword [ebp + 0x10]
jg 0x4178b0
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040e28d
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x4178e2
call fcn.0040f4d4
mov dword [eax], 0xc
jmp 0x417845
cmp eax, dword [ebp + 0x10]
jle 0x4178e2
call fcn.0040f4d4
mov dword [eax], 0x22
jmp 0x417845
lea eax, [ebp - 0x10c]
push eax
push ecx
call fcn.00415500
pop ecx
pop ecx
jmp 0x417847
Function at 0x10032fc7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10032fd6
pop dword [ebp - 0x44]
mov eax, 0x454ca9e4
sub eax, 0x35497a0e
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xeef67023
add dword [ebp - 0x54], 0x5f5bd528
mov dword [ebp - 0x50], 0xda18c0c6
add dword [ebp - 0x50], 0x581a8b7f
mov dword [ebp - 0x4c], 0x91741a35
add dword [ebp - 0x4c], 0xbad829f9
mov dword [ebp - 0x48], 0x44453eb1
sub dword [ebp - 0x48], 0x44453eb1
lea eax, [ebp - 0x54]
push eax
mov eax, 0xa8e6e95a
sub eax, 0x98e39842
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xf76341e0
sub dword [ebp - 0x54], 0x82f0d88a
mov dword [ebp - 0x50], 0xc7331290
sub dword [ebp - 0x50], 0x85c6b11b
mov dword [ebp - 0x4c], 0xa89a9b34
add dword [ebp - 0x4c], 0xbad4d138
mov dword [ebp - 0x48], 0x2ce154a9
add dword [ebp - 0x48], 0xd31eab57
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x239ee36a
add eax, 0xec646dfa
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x38656
push 0
call eax
mov ecx, 0xa4f112a8
sub ecx, 0xa4f0d568
xor edi, edi
add edi, eax
mov ebx, 0x10088400
add ebx, dword [ebp - 0x44]
mov esi, 0x6eb95884
add esi, 0xd3783b92
mov edx, dword [ebx]
xor dword [ebp - 0x28], 0x2fc9195a
add edx, esi
sub dword [ebp - 0xc], 0xfa31bc69
mov dword [edi], edx
sub dword [ebp - 0x20], eax
add edi, 0xee88468f
sub edi, 0xee88468b
add ebx, 0x6f870903
sub ebx, 0x6f8708ff
loop 0x100330f4
add eax, 0xe7d3
xor ebx, ebx
add ebx, eax
add eax, 0x3de3f57f
add eax, 0xc21c0a86
mov ecx, 0x1041d372
sub ecx, 0x41d372
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x1003384b
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x50]
cmp eax, dword [esi + 0x54]
jae 0x10033862
mov bl, byte [eax]
inc eax
mov dword [esi + 0x50], eax
jmp 0x100338ce
cmp dword [esi + 0x4c], 0
jl 0x100338cc
mov edi, dword [esi + 0x58]
push 0xfa0
push edi
push dword [esi + 0x4c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1003389a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x1003386b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0xb
je 0x1003386b
cmp ebx, 1
jge 0x100338a7
or dword [esi + 0x4c], 0xffffffff
xor bl, bl
jmp 0x100338ec
lea eax, [edi + 1]
mov dword [esi + 0x50], eax
lea eax, [ebx + edi]
mov dword [esi + 0x54], eax
mov bl, byte [edi]
test bl, bl
jne 0x100338ce
push esi
call fcn.100348ff
mov eax, dword [esi + 0x50]
or dword [esi + 0x4c], 0xffffffff
pop ecx
mov dword [esi + 0x54], eax
jmp 0x100338ce
xor bl, bl
cmp bl, 0xa
jne 0x100338e2
mov eax, dword [esp + 0x18]
and dword [eax], 0
mov eax, dword [esp + 0x14]
inc dword [eax]
jmp 0x100338ec
test bl, bl
je 0x100338ec
mov ecx, dword [esp + 0x18]
inc dword [ecx]
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x100347ff
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x50]
cmp eax, dword [esi + 0x54]
jae 0x10034812
mov al, byte [eax]
jmp 0x10034855
cmp dword [esi + 0x4c], 0
jl 0x10034853
mov edi, dword [esi + 0x58]
push 0xfa0
push edi
push dword [esi + 0x4c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1003484a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x1003481b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0xb
je 0x1003481b
cmp ebx, 1
jge 0x10034859
or dword [esi + 0x4c], 0xffffffff
xor al, al
pop edi
pop esi
pop ebx
ret
lea ecx, [ebx + edi]
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], ecx
mov al, byte [edi]
jmp 0x10034855

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4372f5
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43f9d2
call fcn.0043b650
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x445c8c
mov dword [esi + 4], 0x445c74
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402b75
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x58], bl
mov byte [esi + 0x59], bl
mov dword [esi], 0x445c58
mov dword [esi + 4], 0x445c40
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4382a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4382b5
pop dword [ebp - 0x18]
mov eax, 0xd928db0d
sub eax, 0xd8e55858
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3eec0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xa75a973a
sub ecx, 0xa75a407c
xor esi, esi
add esi, eax
mov edi, 0x204fa84
sub edi, 0x1bf8c84
add edi, dword [ebp - 0x18]
mov ebx, 0xe435395d
add ebx, 0xeef52daf
xor dword [ebp - 4], 0x2166c3d8
mov edx, dword [edi]
sub dword [ebp - 0x14], 0xc194f5f3
add edx, ebx
add dword [ebp - 0x10], ebx
mov dword [esi], edx
add esi, 0xc37b767c
add esi, 0x3c848988
add edi, 0x17713f3d
sub edi, 0x17713f39
loop 0x438311
add eax, 0x4a82ded0
sub eax, 0x4a819105
mov ebx, eax
add eax, 0x193153f1
sub eax, 0x193153ec
mov ecx, 0x436fe9a4
add ecx, 0xbcd0165c
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x43b2d0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x43b2f8
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x43b307
mov eax, 1
ret 4

Function at 0x43b310
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 4
mov edi, ecx
mov ecx, dword [esp + 0x14]
push ecx
push edx
push 0
push 0
call sub.msvcrt.dll__beginthreadex
mov esi, eax
add esp, 0x18
mov dword [edi], esi
test esi, esi
je 0x43b356
mov edx, dword [esp + 0x10]
push edx
push esi
xor edi, edi
call dword [sym.imp.kernel32.dll_SetThreadAffinityMask]
push esi
call dword [sym.imp.kernel32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x43b356
mov eax, edi
pop edi
pop esi
ret 8
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x43b351
pop edi
mov eax, 1
pop esi
ret 8
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x401c66
pop dword [ebp - 0x3c]
mov eax, 0x401c66
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xfa618ce0
sub dword [ebp - 0x4c], 0xac0f4795
mov dword [ebp - 0x48], 0xbfb84aea
add dword [ebp - 0x48], 0x727b015b
mov dword [ebp - 0x44], 0x21c93bbf
sub dword [ebp - 0x44], 0xd57cf791
mov dword [ebp - 0x40], 0xc88f76bd
add dword [ebp - 0x40], 0x37708943
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xf6c1d208
sub dword [ebp - 0x4c], 0x824f68b2
mov dword [ebp - 0x48], 0xf912c85b
sub dword [ebp - 0x48], 0xb7a666e6
mov dword [ebp - 0x44], 0x762d7ff0
add dword [ebp - 0x44], 0xed41ec7c
mov dword [ebp - 0x40], 0x37e9bd78
add dword [ebp - 0x40], 0xc8164288
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x77df3781
add eax, 0x8860f8ab
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x320e6
push 0
call eax
mov ecx, 0x5779d4c4
add ecx, 0xa8866189
xor edi, edi
add edi, eax
mov edx, 0x407000
add edx, dword [ebp - 0x3c]
mov esi, 0x5317de30
xor dword [ebp - 0x18], 0x81279d6
mov ebx, dword [edx]
add ebx, esi
add dword [ebp - 0x10], edi
mov dword [edi], ebx
sub dword [ebp - 0x34], 0xf55f19b8
add edi, 4
add edx, 4
loop 0x401d74
add eax, 0xf63d3d81
add eax, 0x9c38e86
mov ebx, eax
add eax, 0x4ad360ba
sub eax, 0x4ad360b5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x414ddf
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [eax], edx
sub esp, 4
mov dword [esp], esi
pop esi
add eax, 4
cmp eax, edi
jne fcn.00414ddf
or ecx, esi
sub esi, 0xaff6a553
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405807
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405e06
test eax, eax
mov esi, dword [esp + 0x18]
je 0x40582b
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405964
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x4225f0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x4225f0
je 0x40586f
push 1
push 0
push esi
call fcn.0040578f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x40596a
cmp eax, edi
jg 0x40596a
mov esi, 0x422068
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x40596a
cmp eax, edi
jg 0x40596a
push esi
push ebp
push str._s_s_r_n
push 0x421c68
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423e70]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405aee
push 4
push 0xc0000000
push esi
call fcn.0040578f
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405964
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40595d
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40595d
cmp edi, dword [esp + 0x18]
jne 0x40595d
push str._Rename__r_n
push esi
call fcn.004056fe
test eax, eax
jne 0x405971
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405aba
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x421c68
push eax
call fcn.0040574a
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x423ef0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409330
push eax
call fcn.004056fe
test eax, eax
je 0x405928
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405998
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x40598d
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x40592a

Function at 0x4059a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405a11
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
Function at 0x406880
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00404530
call sub.kernel32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.kernel32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x4068b6
jmp 0x4068f5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x4068b3
cmp al, 0x20
je 0x4068b3
cmp al, 0x22
jne 0x4068d9
jmp 0x406944
cmp al, 0x20
lea esi, [esi]
je 0x4068e0
test al, al
je 0x4068f5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x4068c7
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x40695a
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x4068e7
cmp al, 0x20
je 0x4068e7
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x406904
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.kernel32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401803
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x40694e
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x406940
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x4068e0
cmp al, 9
je 0x4068e7
jmp 0x4068f5

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403510
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403524
inc dword [0x4ab3e0]
add dword [0x4a78d4], 0xf0
mov edx, dword [0x4a78d4]
push esi
push edi
mov ecx, 0x3c
mov esi, 0x4a9f18
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x403553
push 0
mov eax, 0x4ad2f8
call fcn.004161a0
cmp dword [0x4ab40c], 0
mov dword [0x4ad900], 0
mov dword [0x4ad904], 0
je 0x40357b
push 0x4aba78
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [esp + 0x10], 0
jne 0x4035ff
or ecx, 0xffffffff
cmp byte [esi + 0xce], 0
jne 0x4035aa
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xce], al
test al, al
je 0x4035aa
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4ad90c], 0
je 0x4035bc
cmp dword [0x4ad908], 0
jne 0x4035c5
cmp byte [esi + 0xce], 0
je 0x4035ff
cmp byte [esi + 0xce], 0
mov byte [esi + 0xcc], 0
jne 0x4035ff
cmp dword [0x4ad90c], 0
jge 0x4035e7
pop edi
mov dword [esi + 0xc0], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xbc], eax
mov edx, dword [0x4ad90c]
mov dword [esi + 0xc0], edx
pop edi
pop esi
ret