joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424cfd
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp dword [ebp + 0x20], 8
push esi
mov dword [ebp - 0xc], ebx
jae 0x424d20
lea eax, [ebp + 0xc]
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 8]
push edx
push eax
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x424d5e
mov eax, dword [ebp - 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x424d39
sub eax, edx
sar eax, 1
add eax, eax
push eax
push ebx
push dword [ebp - 8]
call fcn.00431170
mov eax, dword [ebp + 0x38]
add esp, 0xc
cmp eax, dword [ebp - 0xc]
jbe 0x424d7e
push ebx
push 1
lea esi, [ebp + 8]
call fcn.0042525e
push ebx
push 1
lea esi, [ebp + 0x24]
call fcn.0042525e
mov eax, 0x80004005
jmp 0x424e0d
call fcn.00428e21
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.00428e21
cdq
idiv esi
cmp edx, esi
jg 0x424da1
mov eax, esi
cdq
idiv esi
cmp edx, ebx
je 0x424da6
call fcn.0041f246
cmp dword [ebp + 0x3c], 8
mov ecx, dword [ebp + 0x28]
jae 0x424db2
lea ecx, [ebp + 0x28]
mov edx, dword [ebp - 8]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
cmp ax, bx
jne 0x424db5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x424dd7
dec eax
dec eax
je 0x424dd7
sub eax, 4
jne 0x424df5
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.0041f33e
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
push ebx
push 1
lea esi, [ebp + 8]
call fcn.0042525e
push ebx
push 1
lea esi, [ebp + 0x24]
call fcn.0042525e
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
leave
ret 0x38

Function at 0x425fdd
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.7d27a55126d94c119755
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.1587e01377f52d99e92fa
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x42604e
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.18cf9ae12695fd977a912c878f5
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x426023
test eax, eax
jne 0x42605e
push esi
push str.a541b52561d5d31b741b_d
jmp 0x426064
push eax
push str.fa27c3cfc6c5c677b4838e5552__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x426071
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x4542b0]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
mov esi, edi
call fcn.00402e5f
lea esi, [edi + 0x20]
call fcn.00402e5f
xor esi, esi
xor eax, eax
mov dword [edi + 0x3c], esi
mov dword [edi + 0x40], esi
mov word [edi + 0x1c], ax
call fcn.00428e21
call fcn.00428e21
lea eax, [esp + 8]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x4260cf
dec eax
dec eax
je 0x4260cf
sub eax, 4
jne 0x4260e3
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call fcn.00425da0
call fcn.0040cb42
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
mov eax, edi
call fcn.00428582
add esp, 0x1a0
ret
Function at 0x426b7c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.0803051f188f0ccd37cb658
call fcn.00428d27
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x426bc5
push str.6ed11f5b92df23cfbdeb5ab5cd59
call fcn.00428d27
jmp 0x426bfd
test esi, esi
jbe 0x426bd5
push esi
push 0x61
push edi
call fcn.00431170
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.391195fb532f899f
jne 0x426bf1
mov eax, str.a13129db6c63928f4c
push eax
push str.fc8fedf9c6b993638f11c3d
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x426c02
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431170
add esp, 0xc
xor esi, esi
call fcn.00428e21
push 0x55
cdq
pop ecx
idiv ecx
add dl, 0x1e
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x426c36
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x426cbb
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x426cbb
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428582
leave
ret
Function at 0x426ddc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431170
add esp, 0xc
xor esi, esi
call fcn.00428e21
cdq
mov ecx, 0x9f
idiv ecx
add dl, 0x7c
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x426e10
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x426e97
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x426e97
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428582
leave
ret

Function at 0x426f18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, eax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 8], eax
cmp dword [esi + 0x54], eax
jbe 0x426f6e
push ebx
push edi
mov ecx, dword [esi + 0x14]
mov eax, dword [ebp - 8]
xor edx, edx
div ecx
mov eax, esi
mov edi, edx
call fcn.00408141
mov al, byte [eax]
mov edi, dword [ebp - 8]
mov byte [ebp - 4], al
lea eax, [esi + 0x38]
call fcn.00408141
mov bl, byte [eax]
lea eax, [esi + 0x38]
call fcn.00408141
xor bl, byte [ebp - 4]
inc dword [ebp - 8]
mov byte [eax], bl
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x54]
jb 0x426f2f
pop edi
pop ebx
mov ecx, dword [ebp + 8]
add esi, 0x38
push esi
call fcn.00402e94
mov eax, dword [ebp + 8]
pop esi
leave
ret 4

Function at 0x426f82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
mov esi, eax
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x426fa3
dec eax
dec eax
je 0x426fa3
sub eax, 4
jne 0x426fad
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
mov dword [ebp - 8], edi
cmp dword [esi + 0x54], edi
jbe 0x426ff5
push ebx
mov ecx, dword [esi + 0x30]
mov eax, dword [ebp - 8]
xor edx, edx
div ecx
lea eax, [esi + 0x1c]
mov edi, edx
call fcn.00408141
mov al, byte [eax]
mov edi, dword [ebp - 8]
mov byte [ebp - 4], al
lea eax, [esi + 0x38]
call fcn.00408141
mov bl, byte [eax]
lea eax, [esi + 0x38]
call fcn.00408141
xor bl, byte [ebp - 4]
inc dword [ebp - 8]
mov byte [eax], bl
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x54]
jb 0x426fb6
pop ebx
mov ecx, dword [ebp + 8]
add esi, 0x38
push esi
call fcn.00402e94
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret 4
Function at 0x42700a
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
shr edi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp edi, eax
jbe 0x427041
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
xor eax, eax
inc eax
jmp 0x427043
xor eax, eax
dec eax
jne 0x427050
call fcn.00426af7
call fcn.00426b7c
mov dword [ebp - 8], ebx
cmp dword [esi + 0x54], ebx
jbe 0x4270a8
mov ebx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
test bl, 1
jne 0x42706d
mov ecx, dword [esi + 0x14]
div ecx
mov eax, esi
jmp 0x427075
mov ecx, dword [esi + 0x30]
div ecx
lea eax, [esi + 0x1c]
mov edi, edx
call fcn.00408141
mov al, byte [eax]
mov byte [ebp - 4], al
mov edi, ebx
lea eax, [esi + 0x38]
call fcn.00408141
mov bl, byte [eax]
mov edi, dword [ebp - 8]
lea eax, [esi + 0x38]
call fcn.00408141
xor bl, byte [ebp - 4]
inc dword [ebp - 8]
mov byte [eax], bl
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x54]
jb 0x427058
mov ecx, dword [ebp + 8]
add esi, 0x38
push esi
call fcn.00402e94
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4270be
Capabilities:
Check for time delay via gettickcount
Delete file
Encode data using xor
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x14], 0
push ebx
push esi
mov ebx, ecx
mov esi, dword [ebx + 0x54]
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], eax
shr esi, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0
shr edi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp edi, eax
jbe 0x42710c
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
inc eax
jmp 0x42710e
xor eax, eax
dec eax
jne 0x42711b
call fcn.00426c02
call fcn.00426cc9
cmp esi, dword [ebx + 0x54]
jae 0x427204
xor edx, edx
mov eax, esi
div dword [ebx + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], edx
call edi
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
test eax, eax
jge 0x427146
fadd qword [0x44a9c8]
call fcn.00438ef0
fstp qword [ebp - 0x24]
push 0
call fcn.0042a13f
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
pop ecx
test eax, eax
jge 0x427166
fadd qword [0x44a9c8]
fcomp qword [ebp - 0x24]
fnstsw ax
test ah, 5
jp 0x42717d
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
inc eax
jmp 0x42717f
xor eax, eax
dec eax
jne 0x4271ca
call edi
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call fcn.00428e21
call fcn.00428e21
call fcn.00428e21
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00426d4e
mov edi, dword [ebp - 0x14]
mov eax, ebx
call fcn.00408141
mov al, byte [eax]
mov byte [ebp - 0xc], al
mov edi, esi
lea eax, [ebx + 0x38]
call fcn.00408141
mov bl, byte [eax]
mov eax, dword [ebp - 0x18]
add eax, 0x38
call fcn.00408141
xor bl, byte [ebp - 0xc]
inc esi
mov byte [eax], bl
mov eax, dword [ebp - 0x18]
mov ebx, eax
cmp esi, dword [eax + 0x54]
jb 0x427124
mov esi, dword [ebx + 0x54]
and dword [ebp - 0x10], 0
dec esi
je 0x427249
add ebx, 0x38
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
mov edi, esi
call fcn.00408141
mov al, byte [eax]
mov edi, dword [ebp - 0x10]
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x14]
call fcn.00408141
mov bl, byte [eax]
mov eax, dword [ebp - 0x14]
call fcn.00408141
xor bl, byte [ebp - 0xc]
inc dword [ebp - 0x10]
dec esi
mov byte [eax], bl
cmp dword [ebp - 0x10], esi
jb 0x427214
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add ebx, 0x38
push ebx
call fcn.00402e94
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
leave
ret 4
Function at 0x427269
Capabilities:
Delete file
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
test eax, eax
jge 0x4272a2
fadd qword [0x44a9c8]
call fcn.00438ef0
fstp qword [ebp - 0x24]
push esi
call fcn.0042a13f
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
pop ecx
test eax, eax
jge 0x4272c1
fadd qword [0x44a9c8]
fcomp qword [ebp - 0x24]
fnstsw ax
test ah, 5
jp 0x4272d7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00426ddc
mov eax, dword [ebx + 0x54]
mov esi, eax
shr esi, 1
cmp esi, eax
jae 0x427321
mov ecx, dword [ebx + 0x30]
xor edx, edx
mov eax, esi
div ecx
lea eax, [ebx + 0x1c]
mov edi, edx
call fcn.00408141
mov al, byte [eax]
mov byte [ebp - 0xc], al
mov edi, esi
lea eax, [ebx + 0x38]
call fcn.00408141
mov bl, byte [eax]
mov eax, dword [ebp - 0x18]
add eax, 0x38
call fcn.00408141
xor bl, byte [ebp - 0xc]
inc esi
mov byte [eax], bl
mov eax, dword [ebp - 0x18]
mov ebx, eax
cmp esi, dword [eax + 0x54]
jb 0x4272e2
mov esi, dword [ebx + 0x54]
and dword [ebp - 0x14], 0
dec esi
je 0x427415
add ebx, 0x38
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
mov edi, esi
call fcn.00408141
mov al, byte [eax]
mov edi, dword [ebp - 0x14]
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x20]
call fcn.00408141
mov bl, byte [eax]
mov eax, dword [ebp - 0x20]
call fcn.00408141
xor bl, byte [ebp - 0xc]
mov byte [eax], bl
call fcn.00428e21
push 0xa
pop edi
cdq
mov ecx, edi
idiv ecx
mov ebx, edx
call fcn.00428e21
cdq
mov ecx, edi
idiv ecx
cmp ebx, edx
setl al
test al, al
je 0x427396
movzx eax, al
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
call fcn.00439020
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
jmp 0x4273a3
fldz
call fcn.00438ef0
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
call fcn.00439110
test eax, eax
je 0x427405
call fcn.00409b8b
push 4
pop ecx
push 5
pop edx
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x28], edi
xor eax, eax
add eax, ecx
cmp eax, 0x14
jl 0x4273f3
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
dec edi
jne 0x4273fc
inc dword [ebp - 0x14]
dec esi
cmp dword [ebp - 0x14], esi
jb 0x427335
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add ebx, 0x38
push ebx
call fcn.00402e94
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
leave
ret 4
Function at 0x427435
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
cmp dword [edi + 0x54], esi
jbe 0x4274af
lea eax, [edi + 0x38]
mov dword [ebp - 0x1c], eax
mov edi, dword [edi + 0x14]
xor edx, edx
mov eax, esi
div edi
push 0
mov edi, edx
call fcn.0042a13f
mov eax, dword [ebp - 0x14]
pop ecx
call fcn.00408141
mov al, byte [eax]
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x1c]
mov edi, esi
call fcn.00408141
mov bl, byte [eax]
mov eax, dword [ebp - 0x1c]
call fcn.00408141
xor bl, byte [ebp - 0xc]
push 0
mov byte [eax], bl
call fcn.0042a13f
mov eax, dword [ebp - 0x14]
inc esi
pop ecx
mov edi, eax
cmp esi, dword [eax + 0x54]
jb 0x427463
mov eax, dword [edi + 0x4c]
mov esi, dword [ebp - 0x10]
call fcn.004279a3
lea ebx, [ebp - 0x20]
call fcn.004279e2
mov esi, eax
add edi, 0x38
lea eax, [ebp - 0x18]
mov ecx, edi
call fcn.00403277
mov ebx, eax
lea eax, [ebp - 0x28]
mov ecx, edi
call fcn.0041987d
push dword [esi + 4]
push dword [esi]
push dword [ebx + 4]
push dword [ebx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x30]
call fcn.00427a6c
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
add esp, 0x18
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
leave
ret 4
Function at 0x42750b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov ebx, eax
call fcn.0042a13f
mov dword [ebp - 0x18], ebx
fild dword [ebp - 0x18]
pop ecx
mov dword [ebp - 0x10], eax
test ebx, ebx
jge 0x427546
fadd qword [0x44a9c8]
call fcn.00438ef0
fild dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
test eax, eax
jge 0x42755b
fadd qword [0x44a9c8]
fcompp
fnstsw ax
test ah, 5
jp 0x42756b
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [edi + 0x54], esi
jbe 0x4275b8
lea eax, [edi + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [edi + 0x38]
mov dword [ebp - 0x10], eax
mov edi, dword [edi + 0x30]
xor edx, edx
mov eax, esi
div edi
mov eax, dword [ebp - 0x18]
mov edi, edx
call fcn.00408141
mov al, byte [eax]
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x10]
mov edi, esi
call fcn.00408141
mov bl, byte [eax]
mov eax, dword [ebp - 0x10]
call fcn.00408141
xor bl, byte [ebp - 8]
inc esi
mov byte [eax], bl
mov eax, dword [ebp - 0x20]
mov edi, eax
cmp esi, dword [eax + 0x54]
jb 0x42757c
mov eax, dword [edi + 0x4c]
mov esi, dword [ebp - 0xc]
call fcn.004279a3
lea ebx, [ebp - 0x1c]
call fcn.004279e2
mov esi, eax
add edi, 0x38
lea eax, [ebp - 0x14]
mov ecx, edi
call fcn.00403277
mov ebx, eax
lea eax, [ebp - 0x24]
mov ecx, edi
call fcn.0041987d
push dword [esi + 4]
push dword [esi]
push dword [ebx + 4]
push dword [ebx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x2c]
call fcn.00427a6c
mov eax, dword [ebp - 0xc]
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4276d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x54]
mov esi, eax
shr esi, 1
mov dword [ebp - 0x20], edi
cmp esi, eax
jae 0x427739
lea eax, [edi + 0x38]
mov dword [ebp - 0x18], eax
mov edi, dword [edi + 0x14]
xor edx, edx
mov eax, esi
div edi
mov eax, dword [ebp - 0x20]
mov edi, edx
call fcn.00408141
mov al, byte [eax]
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x18]
mov edi, esi
call fcn.00408141
mov bl, byte [eax]
mov eax, dword [ebp - 0x18]
call fcn.00408141
xor bl, byte [ebp - 8]
inc esi
mov byte [eax], bl
mov eax, dword [ebp - 0x20]
mov edi, eax
cmp esi, dword [eax + 0x54]
jb 0x4276fd
mov esi, dword [edi + 0x54]
and dword [ebp - 0xc], 0
dec esi
je 0x42777e
add edi, 0x38
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x18]
mov edi, esi
call fcn.00408141
mov al, byte [eax]
mov edi, dword [ebp - 0xc]
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x18]
call fcn.00408141
mov bl, byte [eax]
mov eax, dword [ebp - 0x18]
call fcn.00408141
xor bl, byte [ebp - 8]
inc dword [ebp - 0xc]
dec esi
mov byte [eax], bl
cmp dword [ebp - 0xc], esi
jb 0x427749
mov edi, dword [ebp - 0x20]
mov eax, dword [edi + 0x4c]
mov esi, dword [ebp - 0x14]
call fcn.004279a3
lea ebx, [ebp - 0x24]
call fcn.004279e2
mov esi, eax
add edi, 0x38
lea eax, [ebp - 0x10]
mov ecx, edi
call fcn.00403277
mov ebx, eax
lea eax, [ebp - 0x1c]
mov ecx, edi
call fcn.0041987d
push dword [esi + 4]
push dword [esi]
push dword [ebx + 4]
push dword [ebx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x2c]
call fcn.00427a6c
mov eax, dword [ebp - 0x14]
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4277d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x154], 0
push ebx
push esi
push edi
mov edi, ecx
push 0
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x164], eax
call fcn.0042a13f
mov eax, dword [edi + 0x54]
mov esi, eax
shr esi, 1
pop ecx
cmp esi, eax
jae 0x4278cf
lea eax, [edi + 0x1c]
mov dword [ebp - 0x154], eax
lea eax, [edi + 0x38]
mov dword [ebp - 0x15c], eax
mov edi, dword [edi + 0x30]
xor edx, edx
mov eax, esi
div edi
mov edi, edx
call fcn.00428e21
cdq
push 0x14
pop ecx
idiv ecx
mov ebx, edx
inc ebx
call fcn.00428e21
cdq
idiv ebx
cmp edx, ebx
jg 0x427855
mov eax, ebx
cdq
idiv ebx
test edx, edx
je 0x427888
lea eax, [ebp - 0x14c]
push eax
push str.795d54b3bf61d62d26a52a8ba351f
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x427881
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.6e076cc12853ce3fd2efe06be8b9336
call fcn.00428d27
pop ecx
pop ecx
jmp 0x427888
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x154]
call fcn.00408141
mov al, byte [eax]
mov byte [ebp - 0x150], al
mov eax, dword [ebp - 0x15c]
mov edi, esi
call fcn.00408141
mov bl, byte [eax]
mov eax, dword [ebp - 0x15c]
call fcn.00408141
xor bl, byte [ebp - 0x150]
inc esi
mov byte [eax], bl
mov eax, dword [ebp - 0x168]
mov edi, eax
cmp esi, dword [eax + 0x54]
jb 0x427827
mov esi, dword [edi + 0x54]
and dword [ebp - 0x154], 0
dec esi
je 0x427935
add edi, 0x38
mov dword [ebp - 0x15c], edi
mov eax, dword [ebp - 0x15c]
mov edi, esi
call fcn.00408141
mov al, byte [eax]
mov edi, dword [ebp - 0x154]
mov byte [ebp - 0x150], al
mov eax, dword [ebp - 0x15c]
call fcn.00408141
mov bl, byte [eax]
mov eax, dword [ebp - 0x15c]
call fcn.00408141
xor bl, byte [ebp - 0x150]
inc dword [ebp - 0x154]
dec esi
mov byte [eax], bl
cmp dword [ebp - 0x154], esi
jb 0x4278e5
mov edi, dword [ebp - 0x168]
mov eax, dword [edi + 0x4c]
mov esi, dword [ebp - 0x164]
call fcn.004279a3
lea ebx, [ebp - 0x16c]
call fcn.004279e2
mov esi, eax
add edi, 0x38
lea eax, [ebp - 0x158]
mov ecx, edi
call fcn.00403277
mov ebx, eax
lea eax, [ebp - 0x160]
mov ecx, edi
call fcn.0041987d
push dword [esi + 4]
push dword [esi]
push dword [ebx + 4]
push dword [ebx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x174]
call fcn.00427a6c
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x164]
add esp, 0x18
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
leave
ret 4

Function at 0x428582
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4542b0]
jne 0x42858c
repz ret
jmp fcn.0042df54