joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5423e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x542482.0
jmp dword [ecx*4 + 0x54241b]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x54244d
sub dl, 8
je 0x54245c
jmp case.0x542482.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5420b4
jmp case.0x542482.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x542108
jmp case.0x542482.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x542482.0
movzx ecx, byte [ecx + 0x542489]
jmp dword [ecx*4 + 0x54249a]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5421a8
jmp case.0x542482.0
cmp dl, 3
jne 0x5424c7
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x542200
jmp case.0x542482.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5421bc
jmp case.0x542482.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x542244
jmp case.0x542482.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5424f2
sub dl, 8
je 0x5424fe
jmp case.0x542482.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x542270
jmp case.0x542482.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5422d4
jmp case.0x542482.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x54251d
sub dl, 8
je 0x542529
jmp case.0x542482.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x542384
jmp case.0x542482.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5423ac
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x5425cb
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005415f0
test eax, eax
je 0x5425cb
mov eax, ebx
call fcn.005425d4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x542564
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5425d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x542605
dec al
je 0x542640
dec al
je 0x542685
dec al
je 0x5426ee
jmp 0x542778
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x542778
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x542615
jmp 0x542778
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x542778
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x542650
jmp 0x542778
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x542778
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5426b4
xor ebp, ebp
jmp 0x5426c4
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5426cd
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x542695
jmp 0x542778
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x542778
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x542747
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0053f77c
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x542702
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x549608
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
test byte [esp + 0x10], 0x80
setne al
add esp, 0x100
ret
Function at 0x549624
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
test byte [esp + 0xa2], 0x80
jne 0x549648
test byte [esp + 0xa3], 0x80
jne 0x549648
xor eax, eax
jmp 0x54964a
mov al, 1
add esp, 0x100
ret
Function at 0x402f81
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402f9e
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x402fb0
mov dword [ebp - 0xc], 0x419428
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402fc5
mov ecx, dword [0x42f478]
add ecx, eax
push ecx
call fcn.004031a9
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.00403193
test eax, eax
je 0x403181
test byte [ebp + 0x17], 0x80
je 0x40312c
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
and dword [0x40bd8c], 0
and dword [0x40bd88], 0
and dword [ebp + 0x14], 0x7fffffff
mov dword [ebp - 0x10], eax
mov eax, 0x40d410
mov dword [0x40b870], 8
mov dword [0x415418], eax
mov dword [0x415414], eax
mov eax, dword [ebp + 0x14]
mov dword [0x415410], 0x415410
mov dword [ebp + 8], eax
jle 0x403189
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x40303e
mov esi, dword [ebp + 0x14]
mov edi, 0x415428
push esi
push edi
call fcn.00403193
test eax, eax
je 0x403181
sub dword [ebp + 0x14], esi
mov dword [0x40b860], edi
mov dword [0x40b864], esi
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push 0x40b860
mov dword [0x40b868], edi
mov dword [0x40b86c], eax
call fcn.00406422
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x403124
mov esi, dword [0x40b868]
sub esi, edi
call ebx
test byte [0x42f4d4], 1
mov edi, eax
je 0x4030df
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
ja 0x4030ac
cmp dword [ebp + 0x14], 0
jne 0x4030df
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.0040508c
mov dword [ebp - 0x10], edi
test esi, esi
je 0x403118
cmp dword [ebp + 0x10], 0
jne 0x4030fe
push esi
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00405ba5
test eax, eax
je 0x403128
add dword [ebp - 4], esi
jmp 0x40310c
mov eax, dword [0x40b868]
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 1
jne 0x403061
jmp 0x403189
cmp dword [ebp + 0x14], 0
jg 0x403031
jmp 0x403189
push 0xfffffffffffffffc
jmp 0x403183
push 0xfffffffffffffffe
jmp 0x403183
test edi, edi
jne 0x40316e
cmp dword [ebp + 0x14], edi
jle 0x403189
mov ebx, dword [ebp - 8]
cmp dword [ebp + 0x14], ebx
mov esi, dword [ebp + 0x14]
jl 0x403142
mov esi, ebx
mov edi, 0x415428
push esi
push edi
call fcn.00403193
test eax, eax
je 0x403181
push esi
push edi
push dword [ebp + 0xc]
call fcn.00405ba5
test eax, eax
je 0x403128
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403138
jmp 0x403189
cmp dword [ebp + 0x14], esi
jge 0x403176
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403193
test eax, eax
jne 0x403186
push 0xfffffffffffffffd
pop eax
jmp 0x40318c
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405552
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x408374
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x408364
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4055a3
xor eax, eax
jmp 0x4055ca
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x4055ca
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
jne 0x40559f
call esi
pop esi
leave
ret 4

Function at 0x405604
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42c078], 0x44
push eax
xor eax, eax
push 0x42c078
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405643
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405647
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
ret 4

Function at 0x4056e5
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405ad9
mov edi, eax
cmp edi, 0xffffffff
je 0x405726
test byte [esp + 0x10], 1
push esi
je 0x405708
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x40570e
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405717
xor eax, eax
inc eax
jmp 0x405728
test byte [esp + 0x10], 4
jne 0x405726
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x40572d
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.004059eb
test bl, 8
mov dword [ebp - 0xc], eax
je 0x40576c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42f4a8], eax
jmp 0x4058f6
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405786
test eax, eax
je 0x4058a4
test bl, 2
je 0x4058a4
mov esi, 0x42b878
push edi
push esi
call fcn.00405f65
cmp dword [ebp + 8], 0
je 0x4057a5
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4057ab
push edi
call fcn.00405944
cmp byte [edi], 0
jne 0x4057b9
cmp byte [0x42b878], 0x5c
jne 0x4057c4
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40589a
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405928
cmp byte [eax], 0
je 0x40580a
cmp byte [ebp - 0x1c], 0
je 0x40580a
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405820
mov al, byte [esi + 1]
test al, al
je 0x405879
cmp al, 0x2e
jne 0x405820
cmp byte [esi + 2], 0
je 0x405879
push esi
push ebx
call fcn.00405f65
test byte [ebp - 0x14c], 0x10
je 0x405845
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405879
push dword [ebp + 0xc]
push edi
call fcn.0040572d
jmp 0x405879
push dword [ebp - 4]
push edi
call fcn.004056e5
test eax, eax
jne 0x405871
cmp dword [ebp - 4], eax
je 0x405869
push edi
push 0xfffffffffffffff1
call fcn.0040508c
push 0
push edi
call fcn.00405d44
jmp 0x405879
inc dword [0x42f4a8]
jmp 0x405879
push edi
push 0xfffffffffffffff2
call fcn.0040508c
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4057e8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x4058a4
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4058f6
cmp dword [ebp - 0xc], esi
jne 0x4058b8
inc dword [0x42f4a8]
jmp 0x4058f6
push edi
call fcn.00406268
test eax, eax
je 0x4058f6
push edi
call fcn.004058fd
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004056e5
test eax, eax
jne 0x4058ee
cmp dword [ebp - 4], esi
je 0x4058b0
push edi
push 0xfffffffffffffff1
call fcn.0040508c
push esi
push edi
call fcn.00405d44
jmp 0x4058f6
push edi
push 0xffffffffffffffe5
call fcn.0040508c
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4059eb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42bc78
push esi
call fcn.00405f65
push esi
call fcn.00405996
mov edi, eax
test edi, edi
jne 0x405a0c
xor eax, eax
jmp 0x405a5e
push edi
call fcn.004061cf
test byte [0x42f41c], 0x80
je 0x405a25
mov al, byte [edi]
test al, al
je 0x405a08
cmp al, 0x5c
je 0x405a08
sub edi, esi
jmp 0x405a3d
call fcn.00406268
test eax, eax
je 0x405a37
test byte [eax], 0x10
je 0x405a08
push esi
call fcn.00405944
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405a29
call fcn.004058fd
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ad9
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405af8
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x405afe
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405b2d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a3b4]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405b72
test edi, edi
jne 0x405b38
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405b6c
Function at 0x405bd4
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
test esi, esi
mov dword [0x42c600], 0x4c554e
mov edi, 0x400
mov ebp, 0x42c600
je 0x405c20
push 1
push 0
push esi
call fcn.00405afe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405d3f
cmp eax, edi
jg 0x405d3f
mov esi, 0x42ca00
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405d3f
cmp eax, edi
jg 0x405d3f
push esi
push ebp
push str._s_s_r_n
push 0x42c200
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x42f414]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405f87
push 4
push 0xc0000000
push esi
call fcn.00405afe
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x405d3f
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405d38
push edi
push esi
push ebp
call fcn.00405b76
test eax, eax
je 0x405d38
push str._Rename__r_n
push esi
call fcn.00405a63
test eax, eax
jne 0x405cd6
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405d0b
add eax, 0xa
push 0x40a3b8
push eax
call fcn.00405a63
mov ebp, eax
test ebp, ebp
je 0x405d07
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405cf8
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405cf2
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x405d0d
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x42c200
push eax
call fcn.00405ab9
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00405ba5
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405d44
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x405d67
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405bd4
pop ecx
pop ecx
inc dword [0x42f4b0]
ret 8

Function at 0x405e4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
mov dword [ebp - 4], 0x400
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405deb
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x405ebb
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp + 0xc]
push esi
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and byte [esi + 0x3ff], 0
test edi, edi
pop edi
jne 0x405ebb
cmp dword [ebp + 0xc], 1
je 0x405ebe
cmp dword [ebp + 0xc], 2
je 0x405ebe
and byte [esi], 0
pop esi
leave
ret 0x14
Function at 0x40628f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4062b3
xor eax, eax
test eax, eax
je 0x4062c5
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4062c5
xor ecx, ecx
jmp 0x4062c8
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4063b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42ce04], 0
push esi
jne 0x4063eb
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4063c5
mov dword [ecx*4 + 0x42ce00], eax
inc ecx
cmp ecx, 0x100
jl 0x4063c0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40641c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42ce00]
xor eax, esi
inc ecx
dec edx
jne 0x4063fe
pop edi
not eax
pop esi
ret 0xc

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x536c221a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x66f12d94
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp int.00401219