joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4284dc
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x428645
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.0040418c
mov eax, dword [ebp - 0x10]
call fcn.0042812c
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x42852e
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404654
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00428c34
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x428603
xor eax, eax
push ebp
push 0x4285fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004282d8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00428674
test al, al
je 0x4285da
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004041e4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4285da
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004045b4
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4285d4
mov eax, dword [ebp - 0x14]
call fcn.004045b4
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004042ec
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004284dc
dec ebx
cmp ebx, 0xffffffff
jne 0x42858d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428603
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004282d8
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.004045b4
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.004282c4
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42864c
lea eax, [ebp - 0x3c]
call fcn.004040f4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404118
ret

Function at 0x428674
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402d2c
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x45ff00]
cmp byte [edx + 0xc], 0
je 0x4286d8
mov edx, dword [0x45fee4]
cmp dword [edx], 2
jne 0x4286d8
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x4286dc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x428794
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00428674
test al, al
je 0x428776
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004041e4
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x428776
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004045b4
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.004045b4
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004042ec
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x42872f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42879b
lea eax, [ebp - 0x2c]
call fcn.004040f4
lea eax, [ebp - 0xc]
call fcn.004040f4
ret

Function at 0x4287a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x42885c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00428674
test al, al
je 0x42883e
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004041e4
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x42883e
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004045b4
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.004045b4
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004042ec
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4287f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428863
lea eax, [ebp - 0x2c]
call fcn.004040f4
lea eax, [ebp - 0xc]
call fcn.004040f4
ret
Function at 0x428b48
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00428140
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004045b4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x428ba6
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x45fc14]
mov dl, 1
mov eax, dword [0x427f14]
call fcn.0040bcd8
call fcn.00403ab0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x428bb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004045b4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x428c08
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x45ff0c]
mov dl, 1
mov eax, dword [0x427f14]
call fcn.0040bcd8
call fcn.00403ab0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00428170
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45b5e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x45b69a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x10]
add dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x20]
mov dl, byte [ebx + 0x30]
mov byte [eax], dl
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
sub esi, eax
test esi, esi
je 0x45b61f
mov edx, dword [ebx + 0x10]
mov ecx, esi
call fcn.004028e8
add esi, dword [ebx + 0x10]
mov dword [ebx + 0x14], esi
mov ecx, dword [ebx + 0x18]
sub ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0xc]
add dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x1c], eax
mov esi, dword [ebx + 0x14]
mov dword [ebx + 0x20], esi
cmp esi, dword [ebx + 0x18]
jne 0x45b676
mov edx, esi
dec edx
mov eax, dword [ebx + 0x10]
call fcn.00415dd0
mov edi, eax
mov dword [ebx + 0x20], edi
cmp edi, dword [ebx + 0x10]
jne 0x45b676
lea edx, [ebp - 4]
mov eax, dword [0x45fc24]
call fcn.0040614c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0045b4ec
mov eax, dword [ebx + 0x20]
mov al, byte [eax]
mov byte [ebx + 0x30], al
mov eax, dword [ebx + 0x20]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b6a1
lea eax, [ebp - 4]
call fcn.004040f4
ret
Function at 0x10033b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10033b3f
pop dword [ebp - 0x24]
mov eax, 0x10033b3f
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xbdcd4bbd
sub dword [ebp - 0x34], 0x6f7b0672
mov dword [ebp - 0x30], 0x7660d9ca
sub dword [ebp - 0x30], 0x442d8d85
mov dword [ebp - 0x2c], 0xbe220b3d
sub dword [ebp - 0x2c], 0x71d5c70f
mov dword [ebp - 0x28], 0xff9286c1
add dword [ebp - 0x28], 0x6d793f
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x6d3f7d3
add dword [ebp - 0x34], 0x6d9e7183
mov dword [ebp - 0x30], 0xf6308c72
add dword [ebp - 0x30], 0x4b3bd503
mov dword [ebp - 0x2c], 0x4b895ca3
sub dword [ebp - 0x2c], 0xe819f037
mov dword [ebp - 0x28], 0x55055426
add dword [ebp - 0x28], 0xaafaabda
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x5aeaed16
sub eax, 0x4ae70c92
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x40343
push 0
call eax
mov ecx, 0x5254
mov ebx, eax
mov edx, 0xa062bc36
add edx, 0x6fa455ca
add edx, dword [ebp - 0x24]
mov edi, 0x4e674e8a
sub dword [ebp - 0x10], eax
mov esi, dword [edx]
sub dword [ebp - 0x20], 0xe41e0055
add esi, edi
sub dword [ebp - 8], 0x23b524b6
mov dword [ebx], esi
xor dword [ebp - 0x18], ecx
add ebx, 4
add edx, 0x2e59152f
add edx, 0xd1a6ead5
loop 0x10033c4b
add eax, 0x618986c0
add eax, 0x9e77b563
xor ebx, ebx
add ebx, eax
add eax, 0xdb2b5abd
sub eax, 0xdb2b5ab8
mov ecx, 0x55f1b7c9
sub ecx, 0x45f1b7c9
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401590
Capabilities:
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00402d20
add esp, 4
and eax, 0xff
test eax, eax
je 0x4015b9
mov eax, 1
jmp 0x4017dc
mov ecx, dword [str.V____Erwq.__]
add ecx, 0x600
mov dword [ebp - 0x324], ecx
mov byte [ebp - 0x31c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x31b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x20c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x104]
push edx
push 0x104
jmp loc.0043cc8e
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x401c70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jb 0x401cab
mov eax, dword [ebp + 0xc]
push eax
call fcn.00402d20
add esp, 4
and eax, 0xff
test eax, eax
jne 0x401cb9
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00403b00
add esp, 4
push 0x42ea34
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004012b0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401cf9
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
push 0x5c
mov eax, dword [ebp - 4]
push eax
call fcn.00402d40
add esp, 8
mov byte [eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x402340
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
push 0x42ea30
push 0x71
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0x274]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x154], eax
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
je 0x4023ad
cmp dword [ebp - 0x264], 0x46
jae 0x4023b2
jmp 0x402530
push 0x104
lea eax, [ebp - 0x258]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x258]
push ecx
call fcn.00401010
add esp, 4
sub eax, 1
mov dword [ebp - 4], eax
push 0x2e
mov edx, dword [ebp - 4]
push edx
call fcn.00402d40
add esp, 8
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
je 0x402401
mov eax, dword [ebp - 0x260]
mov byte [eax], 0
push 0x42ea28
lea ecx, [ebp - 0x258]
push ecx
call fcn.00402fe0
add esp, 8
lea edx, [ebp - 0x150]
push edx
push 0x14a
jmp 0x43c7f6
mov esp, ebp
pop ebp
ret

Function at 0x402c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.00403350
add esp, 8
lea edx, [ebp - 0x104]
push edx
call fcn.00402a20
add esp, 4
push 0x104
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x42e920
call fcn.004017f0
add esp, 4
add eax, 1
push eax
push 0x42e920
mov ecx, dword [ebp + 8]
push ecx
call fcn.004017f0
add esp, 4
mov edx, dword [ebp + 8]
add edx, eax
push edx
call fcn.004010c0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call fcn.004017f0
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004017f0
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.004010c0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
call fcn.004017f0
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004017f0
add esp, 4
mov edx, dword [ebp + 8]
add edx, eax
push edx
call fcn.004010c0
add esp, 0xc
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x402d20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret
Function at 0x403030
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
jmp 0x403048
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4030a2
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
jmp 0x403069
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x403093
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x403089
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 4], ecx
jmp 0x403091
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x403060
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x42ed00], ecx
jmp 0x40303f
mov esp, ebp
pop ebp
ret

Function at 0x403190
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4049b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3d8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x3e4]
push ecx
call fcn.00403350
add esp, 8
lea edx, [ebp - 0x3e4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax + 1]
cmp ecx, 0x3a
jne 0x403214
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movsx edx, byte [ecx]
test edx, edx
je 0x403214
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x403214
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40328f
mov edx, dword [ebp - 0x14]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x403280
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0
lea edx, [ebp - 0x3e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x40326b
push 0
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x403269
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403269
xor al, al
jmp 0x4032af
jmp 0x40327a
mov ecx, dword [ebp - 0x18]
and ecx, 0x10
cmp ecx, 0x10
je 0x40327a
xor al, al
jmp 0x4032af
mov edx, dword [ebp - 0x14]
mov byte [edx], 0x5c
mov eax, dword [ebp - 0x14]
push eax
call dword [0x42ece8]
mov dword [ebp - 0x14], eax
jmp 0x403214
jmp 0x4032a6
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403410
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 1
test eax, eax
je 0x403433
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebp
ret
Function at 0x40137b
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4131b4]
push ebx
push esi
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push str.APP_PACK
push eax
push dword [0x414060]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x401458
push edi
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x40f24c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push dword [0x414060]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push dword [0x414060]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
lea ecx, [ebp - 0x418]
push ecx
push dword [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call fcn.00401350
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.00405525
leave
ret
Function at 0x401467
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x4131b4]
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x401597
push ebx
push dword [ebp + 8]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
call ebx
test eax, eax
je 0x401596
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x664]
push 0x40f274
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ebp - 0x254]
push ecx
mov dword [ebp - 0x668], eax
push eax
jmp 0x40156f
push 0x40f270
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x401562
push 0x40f268
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x401562
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x45c]
push str._s_s
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x45c]
push eax
call ebx
test eax, eax
je 0x401555
cmp dword [ebp + 0x10], 0
je 0x401555
push 1
lea eax, [ebp - 0x45c]
push 1
push eax
call fcn.00401467
add esp, 0xc
jmp 0x401562
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x668]
call edi
test eax, eax
jne 0x4014e6
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0xc], 0
pop edi
pop esi
je 0x401596
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop ebx
mov ecx, dword [ebp - 4]
call fcn.00405525
leave
ret
Function at 0x402d90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x402d9b
xor eax, eax
ret
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
not esi
jb 0x402e93
mov ebp, edi
shr ebp, 3
xor edx, edx
mov dl, byte [ecx]
mov eax, esi
shr eax, 8
sub edi, 8
xor edx, esi
and edx, 0xff
mov esi, dword [edx*4 + 0x40f5d0]
xor edx, edx
mov dl, byte [ecx + 1]
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x40f5d0]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x40f5d0]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x40f5d0]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x40f5d0]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x40f5d0]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x40f5d0]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x40f5d0]
shr eax, 8
xor eax, esi
inc ecx
dec ebp
mov esi, eax
jne 0x402db6
test edi, edi
je 0x402eb2
xor eax, eax
mov al, byte [ecx]
xor eax, esi
and eax, 0xff
mov ebp, dword [eax*4 + 0x40f5d0]
shr esi, 8
xor esi, ebp
inc ecx
dec edi
jne 0x402e97
pop edi
mov eax, esi
pop esi
not eax
pop ebp
ret