joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409b8f
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
mov edi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x10], esi
je 0x409ce7
cmp dword [ebp + 0xc], esi
je 0x409ce7
push 0xf0000000
push 0x18
push esi
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x409be3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409953
mov esi, eax
jmp 0x409cec
lea eax, [ebp - 4]
push eax
push 1
push 0x6610
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x409bd0
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x409bd0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x409bd0
mov eax, dword [ebp - 0x10]
lea esi, [eax + 0x14]
cmp esi, eax
ja 0x409c43
mov esi, 0x80070216
jmp 0x409cec
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x409c5c
mov esi, 0x8007000e
jmp 0x409cec
xor ecx, ecx
mov dword [edi], esi
inc ecx
mov dword [edi + 8], 0x10000
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0x10]
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [edi + 0x10]
push eax
push 0
push ecx
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x409bd0
mov eax, dword [0x41c390]
test eax, eax
jne 0x409ca0
mov esi, 0x800701e7
jmp 0x409cec
push edi
push esi
push dword [ebp + 8]
call eax
mov esi, eax
test esi, esi
js 0x409cec
cmp dword [ebx + 4], 0
je 0x409cc0
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
and dword [ebx + 4], 0
mov eax, dword [ebp - 4]
and dword [ebp - 4], 0
cmp dword [ebx], 0
mov dword [ebx + 4], eax
je 0x409cdc
push 0
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
and dword [ebx], 0
mov eax, dword [ebp - 8]
and dword [ebp - 8], 0
mov dword [ebx], eax
jmp 0x409cec
mov esi, 0x80070057
cmp dword [ebp - 0xc], 0
je 0x409cfb
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 4], 0
je 0x409d0a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 8], 0
je 0x409d1b
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test edi, edi
je 0x409d26
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c5ab
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor esi, esi
push esi
push esi
push 0x80
push 2
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
call sub.Mso20Win32Client.dll_Ordinal_1196
mov edi, eax
cmp edi, 0xffffffff
je 0x40c67c
push esi
lea eax, [ebp - 8]
mov word [ebp + 8], 0xfeff
push eax
push 2
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40c5fe
mov eax, 0x80004005
jmp 0x40c67e
push str.__xml_version_1.0__encoding_UTF_16____r_n_HeartbeatCache__
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.0040d85d
push esi
mov esi, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40c637
test esi, esi
je 0x40c5f4
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x40c5f4
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4126ac
push eax
push str.HeartbeatAdapter::CreateEmptyCacheFile
push 0x32
push 0x2d
push 0x7a05d8
mov dword [ebp - 0x10], str.Information
mov dword [ebp - 0xc], str.Successfully_created_empty_cache_file
call fcn.00404c87
test esi, esi
je 0x40c67c
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40da9e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x40dab8
xor ecx, ecx
mov dword [0], 1
int 0x29
push esi
push edi
xor edi, edi
push edi
push edi
push 0x80
push 3
push edi
push edi
push Ordinal_1
push dword [ebp + 8]
call sub.Mso20Win32Client.dll_Ordinal_1196
mov esi, eax
cmp esi, 0xffffffff
jne 0x40dae9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x40dbd3
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
push esi
mov dword [ebp - 8], edi
call sub.Mso20Win32Client.dll_Ordinal_1352
pop ecx
pop ecx
test eax, eax
jne 0x40db06
test esi, esi
je 0x40dae2
push esi
jmp 0x40dadc
mov eax, dword [ebp - 8]
push ebx
mov ebx, dword [ebp - 0xc]
cmp eax, edi
jg 0x40dba7
jl 0x40dba7
cmp ebx, 1
jbe 0x40dba7
cmp eax, edi
jl 0x40db2f
jg 0x40dba7
cmp ebx, 0xffffffff
ja 0x40dba7
push ebx
lea ecx, [ebp + 8]
mov dword [ebp + 8], edi
call fcn.0040a5df
test al, al
jne 0x40db49
cmp dword [ebp + 8], edi
je 0x40dba7
push dword [ebp + 8]
jmp 0x40dba1
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40db66
cmp dword [ebp - 4], ebx
je 0x40db6c
test edi, edi
je 0x40dba7
jmp 0x40dba0
cmp byte [edi], 0xff
jne 0x40dba0
cmp byte [edi + 1], 0xfe
jne 0x40dba0
and dword [ebp + 8], 0
lea eax, [ebx - 2]
shr eax, 1
lea ecx, [ebp + 8]
push eax
lea eax, [edi + 2]
push eax
call fcn.0040d832
test eax, eax
jns 0x40dbb6
cmp dword [ebp + 8], 0
je 0x40dba0
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
call sub.Mso20Win32Client.dll_Ordinal_214
pop ecx
test esi, esi
je 0x40dbb2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x40dbd2
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
mov dword [ecx], eax
call sub.Mso20Win32Client.dll_Ordinal_214
pop ecx
test esi, esi
je 0x40dbd0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40dbdb
Capabilities:
Write file on windows

Disassembly:
push 0x28
mov eax, 0x41076b
call fcn.0040ec4b
mov esi, ecx
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.0040e0a2
mov edi, eax
test edi, edi
js 0x40dd2a
mov eax, dword [ebp - 0x14]
mov ecx, 0x4126ac
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x28], ecx
push eax
push str.HeartbeatAdapter::SaveCacheFile
push 0x32
push 0x2d
push 0x7a05d9
mov dword [ebp - 0x24], str.CacheFile
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], str.Information
mov dword [ebp - 0x2c], str.Saving_updated_cache_file
call fcn.00404d79
and dword [ebp - 0x18], 0
mov ecx, dword [esi]
mov byte [ebp - 4], 1
test ecx, ecx
jne 0x40dc5d
mov edi, 0x8007000e
jmp 0x40dd18
mov eax, dword [ecx]
push ecx
call dword [eax + 0x38]
lea edx, [ebp - 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edi, eax
test edi, edi
js 0x40dd18
xor edi, edi
push edi
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp - 0x14]
call sub.Mso20Win32Client.dll_Ordinal_1196
mov esi, eax
cmp esi, 0xffffffff
je 0x40dd0d
push edi
lea eax, [ebp - 0x1c]
mov word [ebp - 0x10], 0xfeff
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40dd08
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push 0
push eax
push edi
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40dd08
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x4126ac
push eax
push str.HeartbeatAdapter::SaveCacheFile
push 0x32
push 0x2d
push 0x7a05da
mov dword [ebp - 0x30], str.Information
mov dword [ebp - 0x2c], str.Successfully_saved_the_updated_cache
call fcn.00404c87
xor edi, edi
jmp 0x40dd0d
mov edi, 0x80004005
test esi, esi
je 0x40dd18
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40dd2a
and dword [ebp - 0x18], 0
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40dd3c
and dword [ebp - 0x14], 0
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.0040ec1c
ret
Function at 0x40e0a2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x418f2c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x448]
push eax
push str.HeartbeatAdapter::GetHeartbeatCacheFile
push 0x32
push 0x2d
push 0x7a05db
mov dword [ebp - 0x448], 0x4126ac
mov dword [ebp - 0x444], str.Information
mov dword [ebp - 0x440], str.Entering
call fcn.00404c87
test ebx, ebx
jne 0x40e0ff
mov eax, 0x80004003
jmp 0x40e2b4
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
xor edi, edi
push esi
push edi
push eax
mov dword [ebx], edi
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [ebp - 0x414]
mov esi, edi
mov dword [ebp - 0x43c], esi
push 1
push 0x23
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40e29e
lea eax, [ebp - 0x414]
push eax
push str._sMicrosoftOfficeHeartbeat
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00409607
add esp, 0x14
lea eax, [ebp - 0x438]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x40e1a0
cmp dword [ebp - 0x438], 0xffffffff
je 0x40e29e
test byte [ebp - 0x438], 0x10
je 0x40e29e
lea eax, [ebp - 0x414]
push eax
push str._sMicrosoftOfficeHeartbeatHeartbeatCache.xml
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00409607
add esp, 0x14
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x43c]
push eax
call fcn.0040d85d
test eax, eax
jns 0x40e1e3
mov esi, dword [ebp - 0x43c]
jmp 0x40e2a3
mov eax, dword [ebp - 0x43c]
mov dword [ebx], eax
mov ebx, 0x4126ac
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x440], eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x454]
mov dword [ebp - 0x444], str.HeartbeatCacheFilePath
push eax
push str.HeartbeatAdapter::GetHeartbeatCacheFile
push 0x32
push 0x2d
push 0x7a05dc
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], str.Information
mov dword [ebp - 0x44c], str.HeartbeatAdapter:_Cache_file_location
call fcn.00404d79
lea eax, [ebp - 0x454]
mov dword [ebp - 0x450], 0x4126e4
push eax
lea eax, [ebp - 0x448]
mov dword [ebp - 0x44c], edi
push eax
push str.HeartbeatAdapter::GetHeartbeatCacheFile
push 0x32
push 0x2d
push 0x7a05dd
mov dword [ebp - 0x454], 0x4126dc
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x444], str.Information
mov dword [ebp - 0x440], str.Exiting
call fcn.00404d79
jmp 0x40e2a5
mov eax, 0x80004005
mov edi, eax
test esi, esi
je 0x40e2b0
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040e557
mov esp, ebp
pop ebp
ret 4
Function at 0x40e565
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x418f2c], eax
je 0x40e587
cmp dword [0x418f2c], ebx
jne 0x40e61b
push edi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edi, dword [ebp - 8]
xor edi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor edi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x418f2c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
test edi, edi
push eax
push dword [ebp - 4]
cmovne ebx, edi
mov edi, 0x418f2c
push 4
push edi
mov dword [0x418f2c], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push edi
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov eax, dword [0x418f2c]
not eax
mov dword [0x41c258], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e84b
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x41a310
call fcn.0040f44c
push 1
call fcn.0040ea1e
pop ecx
test al, al
jne 0x40e6f4
push 7
call fcn.0040f217
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040e9e9
mov byte [ebp - 0x24], al
mov eax, dword [0x41c460]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x40e6ed
test eax, eax
jne 0x40e75e
mov dword [0x41c460], ecx
push 0x411378
push 0x411360
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40e741
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40e845
push 0x41135c
push 0x411344
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x41c460], 2
jmp 0x40e763
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040eb7b
pop ecx
call fcn.0040f20b
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40e793
push esi
call fcn.0040eaee
pop ecx
test al, al
je 0x40e793
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0040f446
call esi
call fcn.0040f211
mov esi, eax
cmp dword [esi], edi
je 0x40e7b1
push esi
call fcn.0040eaee
pop ecx
test al, al
je 0x40e7b1
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.0040f32c
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.0040f35f
test al, al
jne 0x40e7ea
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x40e7f3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040eb98
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40e845
call fcn.0040f492
ret
call fcn.0040e565
jmp 0x40e6d5
Function at 0x40149d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x47eb90]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x401532
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x4014ef
cmp dword [ebp + 0x10], ebx
jne 0x401526
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.0040149d
test eax, eax
jne 0x401501
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014d6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.004062f4
cmp eax, ebx
je 0x401539
push ebx
push dword [0x47eb90]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401532
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x47eb90], ebx
jne 0x40152f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40152f
jmp 0x401532
Function at 0x405c37
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x461dd0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x461dd0], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405c72
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405e28
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405e45
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x405e48
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405e77
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a61c]
mov dword [ebp - 8], eax
mov eax, dword [0x40a620]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405ec7
test edi, edi
jne 0x405e84
mov word [esi], ax
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405ec1

Function at 0x405ecb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405f44
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x4008
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405f2d
cmp dword [ebp + 0x14], 1
je 0x405f32
cmp dword [ebp + 0x14], 2
je 0x405f32
xor eax, eax
mov word [esi], ax
push dword [ebp + 0x18]
xor eax, eax
mov word [esi + 0x4006], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 0x14
Function at 0x4060df
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406108
mov eax, dword [0x40c058]
cmp eax, 0xffffffff
je 0x4060fc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40c058], 0xffffffff
jmp 0x4061b3
cmp dword [0x46d204], ebx
je 0x4061b3
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp word [0x476240], bx
je 0x40617f
cmp dword [0x40c058], 0xffffffff
jne 0x406188
mov esi, 0x476240
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 4
push 0x40000000
push esi
mov dword [ebp + 8], eax
call fcn.00405e48
mov dword [0x40c058], eax
cmp eax, 0xffffffff
je 0x4061b1
cmp dword [ebp + 8], 0xffffffff
jne 0x406174
push ebx
lea ecx, [ebp - 4]
push ecx
push 2
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [ebp + 8], 0xfeff
call edi
mov eax, dword [0x40c058]
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40c058], 0xffffffff
je 0x4061b1
push 0x40a638
mov esi, 0x46d220
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp + 8]
push ecx
add eax, eax
push eax
push esi
push dword [0x40c058]
call edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x406776
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x461e18
push esi
call fcn.00406001
push esi
call fcn.00405d51
mov edi, eax
test edi, edi
jne 0x406797
xor eax, eax
jmp 0x4067f4
push edi
call fcn.00406030
test byte [0x47eb08], 0x80
je 0x4067b3
movzx eax, word [edi]
test ax, ax
je 0x406793
cmp eax, 0x5c
je 0x406793
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x4067d5
push esi
call fcn.004062cd
test eax, eax
je 0x4067cf
test byte [eax], 0x10
je 0x4067f9
push esi
call fcn.00406749
push esi
call ebx
cmp eax, edi
jg 0x4067c0
push esi
call fcn.0040671a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4067f3
Function at 0x406a91
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x40a848
mov ebx, 0x465e20
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov esi, 0x400
cmp edi, ebp
je 0x406adf
push 1
push ebp
push edi
call fcn.00405e48
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406c5a
cmp eax, esi
jg 0x406c5a
push esi
mov edi, 0x46b478
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406c5a
cmp eax, esi
jg 0x406c5a
push ebp
push ebp
push esi
push 0x466620
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x406c5a
push ebp
push ebp
push esi
mov esi, 0x466c70
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x406c5a
push esi
push 0x466620
push str._s_s_r_n
push 0x467070
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x47eabc]
push dword [eax + 0x128]
push edi
call fcn.004067fd
push 4
push 0xc0000000
push edi
call fcn.00405e48
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x406c5a
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x406c50
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406c50
cmp edi, dword [esp + 0x10]
jne 0x406c50
push str._Rename__r_n
push esi
call fcn.00405dae
cmp eax, ebp
jne 0x406be3
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x406c18
push 0x40a83c
add eax, 0xa
push eax
call fcn.00405dae
mov ebp, eax
test ebp, ebp
je 0x406c16
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
cmp ecx, ebp
jbe 0x406c0d
sub eax, ecx
mov dl, byte [ecx]
mov byte [eax + ecx], dl
dec ecx
cmp ecx, ebp
ja 0x406c03
sub ebp, esi
lea eax, [ebp + 1]
xor ebp, ebp
jmp 0x406c1a
xor ebp, ebp
mov eax, edi
push ebx
push 0x467070
add eax, esi
push eax
call fcn.00405e04
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4071ce
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x40720c
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4071e2
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4071dd
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407239
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40721a
not eax
pop ebp
ret 0xc