joyce8/EMBER2024-capa huggingface dataset:
Function at 0x690bdf80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x690be131
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 8]
call fcn.6900c1b0
test al, al
jne 0x690bdfee
mov eax, dword [ebx + 8]
call fcn.6900c1d4
test al, al
jne 0x690bdfee
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.690816c4
and eax, 0x7f
imul eax, eax, 0x4b
mov edx, dword [0x6915d990]
mov ecx, dword [edx + eax*4 + 0x104]
mov dl, 1
mov eax, dword [0x690bdde4]
call fcn.69010660
call fcn.69004b04
xor edx, edx
mov eax, dword [ebx + 0xc]
call fcn.6900b5bc
test al, al
je 0x690be025
call fcn.690816c4
and eax, 0x7f
imul eax, eax, 0x4b
mov edx, dword [0x6915d990]
mov ecx, dword [edx + eax*4 + 0x10c]
mov dl, 1
mov eax, dword [0x690bdde4]
call fcn.69010624
call fcn.69004b04
mov eax, dword [ebx + 4]
call fcn.6900c168
test al, al
jne 0x690be095
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebx + 4]
call fcn.690056a4
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x690be08f
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.690816c4
and eax, 0x7f
imul eax, eax, 0x4b
mov edx, dword [0x6915d990]
mov ecx, dword [edx + eax*4 + 0x110]
mov dl, 1
mov eax, dword [0x690bdde4]
call fcn.69010660
call fcn.69004b04
push eax
call sub.kernel32.dll_CloseHandle
movzx edx, byte [0x690be140]
mov eax, dword [ebx + 4]
call fcn.690aa1e4
lea edx, [ebp - 4]
mov eax, dword [ebx + 8]
call fcn.69081db4
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.690056a4
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x690be10f
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.690816c4
and eax, 0x7f
imul eax, eax, 0x4b
mov edx, dword [0x6915d990]
mov ecx, dword [edx + eax*4 + 0x110]
mov dl, 1
mov eax, dword [0x690bdde4]
call fcn.69010660
call fcn.69004b04
push eax
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x690be138
lea eax, [ebp - 4]
call fcn.69005214
ret
Function at 0x690be48c
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
xor edx, edx
call fcn.6900bf0c
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x20], ebx
inc ebx
jne 0x690be4ea
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x1c]
push eax
push 0
call fcn.690816c4
and eax, 0x7f
imul eax, eax, 0x4b
mov edx, dword [0x6915d990]
mov ecx, dword [edx + eax*4 + 0x120]
mov dl, 1
mov eax, dword [0x690bdde4]
call fcn.69010660
call fcn.69004b04
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov ecx, 2
xor edx, edx
call fcn.6900bfbc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
xor ecx, ecx
xor edx, edx
call fcn.6900bfbc
mov eax, dword [ebp - 8]
inc eax
call fcn.69003298
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x690be598
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [ebp - 8]
call fcn.6900bf64
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
xor ecx, ecx
xor edx, edx
call fcn.6900bfbc
mov edx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0xc]
call fcn.6900bf90
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_SetEndOfFile
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
mov dword [eax + 0x20], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x690be59f
mov eax, dword [ebp - 0x14]
call fcn.690032cc
ret

Function at 0x690be7c4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x690be865
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
test eax, eax
jle 0x690be7ed
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebx + 0x20]
test eax, eax
jle 0x690be7fa
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebx + 0x18]
test eax, eax
jle 0x690be807
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebx + 0x1c]
call fcn.690056a4
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
call fcn.690816c4
and eax, 0x7f
imul eax, eax, 0x4b
mov edx, dword [0x6915d990]
mov eax, dword [edx + eax*4 + 0x11c]
xor ecx, ecx
pop edx
call fcn.6900d00c
mov eax, dword [ebp - 4]
call fcn.6904e594
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x690be86c
lea eax, [ebp - 4]
call fcn.69005214
ret
Function at 0x690bf840
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x690bf863
and ecx, ecx
jle 0x690bf863
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x690bf869]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x690bf853
pop edi
pop ebx
ret
Function at 0x690d2678
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x690d27d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 2]
mov ecx, 2
mov eax, esi
call fcn.6903a0b8
lea edx, [ebx + 0x88]
mov ecx, 4
mov eax, esi
call fcn.6903a0b8
lea edx, [ebp - 8]
mov ecx, 4
mov eax, esi
call fcn.6903a0b8
lea edx, [ebx + 0x60]
mov ecx, 2
mov eax, esi
call fcn.6903a0b8
cmp word [ebp - 2], 5
jne 0x690d2703
cmp edi, dword [ebx + 0x88]
je 0x690d26f0
cmp edi, 0xffffffff
jne 0x690d2703
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x88]
call fcn.690cca64
cmp eax, dword [ebp - 8]
je 0x690d272c
call fcn.690816c4
and eax, 0x7f
imul eax, eax, 0x4b
mov edx, dword [0x6915d990]
mov ecx, dword [edx + eax*4 + 0xc4]
mov dl, 1
mov eax, dword [0x690c7de8]
call fcn.69010624
call fcn.69004b04
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.6903a17c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x64]
call fcn.69005268
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.6903a17c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x48]
call fcn.69005b58
mov edx, esi
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, esi
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, esi
mov eax, dword [ebx + 0x50]
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, esi
mov eax, dword [ebx + 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, esi
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, esi
mov eax, dword [ebx + 0x80]
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, esi
mov eax, dword [ebx + 0x90]
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov eax, ebx
call fcn.690d174c
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0xd8]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x690d27db
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.69005238
ret
Function at 0x690d3c84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
je 0x690d3cd0
mov edi, dword [esi + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
jmp 0x690d3cb2
dec ebx
test ebx, ebx
jl 0x690d3cc7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
cmp edi, eax
jne 0x690d3cb1
test ebx, ebx
setl al
mov ebx, eax
jmp 0x690d3d4f
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
jl 0x690d3cee
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc]
movsx eax, ax
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0xc]
setne bl
jmp 0x690d3d4f
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
je 0x690d3d45
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0xffffffff
je 0x690d3d45
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
sub eax, 0xfffffffb
je 0x690d3d20
dec eax
je 0x690d3d1c
dec eax
je 0x690d3d18
dec eax
jne 0x690d3d24
mov bl, 0x40
jmp 0x690d3d26
mov bl, 1
jmp 0x690d3d26
mov bl, 4
jmp 0x690d3d26
mov bl, 2
jmp 0x690d3d26
xor ebx, ebx
movzx eax, word [ebp - 4]
push eax
push ebx
mov ecx, dword [esi + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov edx, esi
mov ebx, dword [eax]
call dword [ebx + 0x254]
xor al, 1
mov ebx, eax
jmp 0x690d3d4f
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0xffffffff
setne bl
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x18]
movzx eax, ax
mov edx, dword [ebp + 8]
and eax, dword [edx + 0x14]
jne 0x690d3d64
add bl, 2
xor edi, edi
jmp 0x690d3d69
inc edi
cmp edi, 0x10
jge 0x690d3d85
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x18]
movzx eax, ax
mov ecx, edi
mov edx, 1
shl edx, cl
and eax, edx
je 0x690d3d68
mov eax, dword [ebp - 8]
shl eax, 0x10
shl edi, 0xa
add eax, edi
movzx edx, bl
shl edx, 8
add eax, edx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x690f3d94
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x690f3e93
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0xd4], 0
jbe 0x690f3dca
mov eax, esi
mov edx, dword [ebx + 0xd4]
call fcn.69005268
jmp 0x690f3e05
lea edx, [ebp - 4]
mov eax, ebx
call fcn.690f41b8
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
call fcn.690059f4
push eax
push ebx
mov eax, dword [ebx]
call dword [eax + 0xc0]
call fcn.6900733c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.6900549c
mov eax, dword [ebp - 8]
mov ecx, esi
pop edx
call fcn.6900c47c
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x690f3e16
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jl 0x690f3e68
mov ebx, 3
jmp 0x690f3e23
inc ebx
mov eax, dword [esi]
call fcn.690054d4
cmp ebx, eax
jge 0x690f3e37
mov eax, dword [esi]
cmp byte [eax + ebx - 1], 0x5c
jne 0x690f3e22
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi]
mov ecx, ebx
mov edx, 1
call fcn.6900570c
mov eax, dword [ebp - 0x14]
call fcn.690056a4
push eax
call sub.kernel32.dll_GetDriveTypeA
sub al, 2
je 0x690f3e61
add al, 0xfd
sub al, 2
jae 0x690f3e68
mov eax, esi
call fcn.69005214
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x690f3e9a
lea eax, [ebp - 0x14]
call fcn.69005214
lea eax, [ebp - 0xc]
call fcn.690059f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.69005238
ret

Function at 0x69103754
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
mov bl, 1
mov byte [esp], 0
jmp 0x691037b4
movzx eax, bl
and eax, 1
mov ecx, 1
sub ecx, eax
movzx eax, byte [esi + edi - 1]
sub al, 0x30
shl al, cl
mov byte [esp + 1], al
cmp byte [esp + 1], 9
jbe 0x691037ab
movzx ebp, byte [esp + 1]
mov eax, ebp
mov ecx, 0xa
xor edx, edx
div ecx
mov ecx, edx
add cl, byte [esp]
mov eax, ebp
mov edi, 0xa
xor edx, edx
div edi
add cl, al
mov byte [esp], cl
jmp 0x691037b3
movzx eax, byte [esp + 1]
add byte [esp], al
inc ebx
mov eax, esi
call fcn.690054d4
movzx edi, bl
cmp eax, edi
jg 0x69103763
movzx eax, byte [esp]
mov ecx, 0xa
xor edx, edx
div ecx
mov eax, 0xa
sub eax, edx
mov ecx, 0xa
cdq
idiv ecx
mov byte [esp], dl
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402574
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4025a3
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00402bb8
jmp 0x4025c1
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004024a4
mov edi, eax
test ebx, ebx
je 0x4025c1
cmp dword [esi], 0
je 0x4025c1
dec ebx
jmp 0x4025aa
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4039e8
Capabilities:
Get file attributes

Disassembly:
push ebx
add esp, 0xfffffefc
cmp byte [0x409080], 0
je 0x403a00
push eax
call sub.kernel32.dll_GetFileAttributesW
jmp 0x403a13
mov edx, esp
mov ecx, 0x103
xchg edx, eax
call fcn.004040c0
push esp
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x403a29
mov ebx, eax
call fcn.00402b30
xor edx, edx
mov dword [eax + 8], edx
jmp 0x403a3f
xor ebx, ebx
call fcn.00402b30
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
mov eax, ebx
add esp, 0x104
pop ebx
ret

Function at 0x403a80
Capabilities:
Create directory

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
cmp byte [0x409080], 0
jne 0x403ad5
mov eax, esp
mov ecx, 0x103
mov edx, ebx
call fcn.004040c0
push 0
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
je 0x403abf
call fcn.00402b30
xor edx, edx
mov dword [eax + 8], edx
jmp 0x403b04
call fcn.00402b30
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
jmp 0x403b04
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
je 0x403af0
call fcn.00402b30
xor edx, edx
mov dword [eax + 8], edx
jmp 0x403b04
call fcn.00402b30
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
add esp, 0x104
pop ebx
ret

Function at 0x403b0c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov ebx, edx
mov esi, eax
test bx, bx
jne 0x403b21
mov bx, 0x80
cmp byte [0x409080], 0
je 0x403b5d
movzx eax, bx
push eax
push esi
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x403b47
call fcn.00402b30
xor edx, edx
mov dword [eax + 8], edx
jmp 0x403ba0
call fcn.00402b30
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
jmp 0x403ba0
mov eax, esp
mov ecx, 0x103
mov edx, esi
call fcn.004040c0
movzx eax, bx
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x403b8c
call fcn.00402b30
xor edx, edx
mov dword [eax + 8], edx
jmp 0x403ba0
call fcn.00402b30
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x403bac
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff600
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp byte [0x409080], 0
jne 0x403be9
lea eax, [ebp - 0x200]
mov ecx, 0x1ff
mov edx, esi
call fcn.004040c0
lea eax, [ebp - 0x200]
mov edx, ebx
call fcn.0040402c
jmp 0x403c8b
mov eax, esi
call fcn.00403748
cmp eax, 0x103
jle 0x403c0e
mov edx, 0x403c94
lea eax, [ebp - 0xa00]
mov ecx, 0x3ff
call fcn.00403904
jmp 0x403c17
mov word [ebp - 0xa00], 0
lea eax, [ebp - 0xa00]
mov ecx, 0x3fe
mov edx, esi
call fcn.00403994
xor eax, eax
push ebp
push 0x403c74
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xa00]
push eax
call sub.kernel32.dll_DeleteFileW
test eax, eax
je 0x403c56
call fcn.00402b30
xor edx, edx
mov dword [eax + 8], edx
jmp 0x403c6a
call fcn.00402b30
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x403c8b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40402c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x4040a1
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.kernel32.dll_DeleteFileA
test eax, eax
je 0x40405d
call fcn.00402b30
xor edx, edx
mov dword [eax + 8], edx
jmp 0x404097
call fcn.00402b30
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
test bl, bl
je 0x404097
call fcn.00402b30
cmp dword [eax + 8], 2
jne 0x404097
call fcn.00402b30
xor edx, edx
mov dword [eax + 8], edx
mov byte [0x409090], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4040b8
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4044c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
push edi
push esi
push ebx
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea esi, [0x40a48c]
mov ecx, dword [ebp - 0xc]
or ecx, ecx
je 0x4044fa
xor ebx, ebx
mov bl, al
shr eax, 8
xor bl, byte [edi]
inc edi
shl ebx, 2
xor eax, dword [esi + ebx]
dec ecx
jne 0x4044e7
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x404688
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x40a48c
movzx eax, bx
mov dx, 0xfff8
test al, 1
je 0x4046a4
shr eax, 1
xor eax, 0xedb88320
jmp 0x4046a6
shr eax, 1
inc dx
jne 0x404697
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp bx, 0x100
jne 0x404690
pop ebx
ret
Function at 0x406ea0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xfffffdc0
mov edi, edx
mov esi, eax
mov byte [esp], 0
push 0x4070a4
call sub.kernel32.dll_LoadLibraryA
mov ebp, eax
push 0x4070b0
push ebp
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
cmp byte [0x409080], 0
je 0x406efb
push 0x4070cc
push ebp
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 8], eax
push 0x4070e4
push ebp
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 0x10], eax
jmp 0x406f19
push 0x4070f8
push ebp
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 4], eax
push 0x40710c
push ebp
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0x11
push esi
call ebx
test eax, eax
jge 0x406f38
push ebp
call sub.kernel32.dll_FreeLibrary
jmp 0x407095
lea eax, [esp + 0x1220]
xor ecx, ecx
mov edx, 0x20
call fcn.00402600
cmp byte [0x409080], 0
je 0x406f86
mov eax, 1
call fcn.00406e60
mov edx, eax
lea eax, [esp + 0x220]
mov ecx, 0x3ff
call fcn.00403904
lea eax, [esp + 0xa20]
mov ecx, 0x3ff
mov edx, edi
call fcn.00403904
jmp 0x406fb3
mov eax, 1
call fcn.00406e3c
mov edx, eax
lea eax, [esp + 0x18]
mov ecx, 0x103
call fcn.004035e4
lea eax, [esp + 0x11c]
mov ecx, 0x103
mov edx, edi
call fcn.004040c0
mov dword [esp + 0x1220], esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1224], eax
cmp byte [0x409080], 0
je 0x406fec
lea eax, [esp + 0xa20]
mov dword [esp + 0x1228], eax
lea eax, [esp + 0x220]
mov dword [esp + 0x122c], eax
jmp 0x407005
lea eax, [esp + 0x11c]
mov dword [esp + 0x1228], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x122c], eax
mov dword [esp + 0x1230], 1
cmp byte [0x409080], 0
je 0x407055
lea eax, [esp + 0x1220]
push eax
call dword [esp + 0x14]
mov esi, eax
test esi, esi
je 0x40708f
lea eax, [esp + 0xa20]
push eax
push esi
call dword [esp + 0x10]
test eax, eax
je 0x40708f
lea edx, [esp + 0xa20]
mov ecx, 0x3ff
mov eax, edi
call fcn.00403904
mov byte [esp], 1
jmp 0x40708f
lea eax, [esp + 0x1220]
push eax
call dword [esp + 0x10]
mov esi, eax
test esi, esi
je 0x40708f
lea eax, [esp + 0x11c]
push eax
push esi
call dword [esp + 0xc]
test eax, eax
je 0x40708f
lea edx, [esp + 0x11c]
mov ecx, 0x3ff
mov eax, edi
call fcn.004040dc
mov byte [esp], 1
push ebp
call sub.kernel32.dll_FreeLibrary
mov al, byte [esp]
add esp, 0x1240
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x407650
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x40766c
shr eax, 1
xor eax, 0xedb88320
jmp 0x40766e
shr eax, 1
dec edx
jne 0x40765f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407658
pop esi
ret

Function at 0x40769b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40b558], 0
jne 0x4076a7
call fcn.00407650
push 1
push 0x40b558
call fcn.004043fc
mov eax, edi
test esi, esi
je 0x4076d2
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4076ad
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x465d06c1
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x14593e34
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219