joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40342f
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x9c
mov ecx, dword [esp + 0xa0]
mov eax, 0x42c1c0
push ebx
push esi
push edi
mov edi, dword [esp + 0xb4]
mov ebx, 0x8000
test edi, edi
cmovne ebx, dword [esp + 0xb8]
xor esi, esi
test edi, edi
cmovne eax, edi
mov dword [esp + 0x18], eax
test ecx, ecx
js 0x403476
mov eax, dword [0x473578]
add eax, ecx
push eax
call fcn.00403418
push 4
lea eax, [esp + 0x10]
push eax
push dword [0x40c010]
call fcn.00406e8b
test eax, eax
jne 0x403494
push 0xfffffffffffffffd
pop eax
jmp 0x4035d1
mov eax, dword [esp + 0xc]
push ebp
test eax, eax
jns 0x4035ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x420138
mov dword [esp + 0x14], eax
call fcn.0040814e
mov ecx, dword [esp + 0x10]
and ecx, 0x7fffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], ecx
jle 0x4035ce
mov ebp, 0x4000
cmp ecx, ebp
cmovl ebp, ecx
push ebp
push 0x4281c0
call fcn.00403402
test eax, eax
je 0x403649
sub dword [esp + 0x10], ebp
mov dword [0x420154], ebp
mov ebp, dword [esp + 0x1c]
mov dword [0x420150], 0x4281c0
mov ecx, 0x420138
mov dword [0x420158], ebp
mov dword [0x42015c], ebx
call fcn.0040738e
mov dword [esp + 0x28], eax
test eax, eax
js 0x4035eb
mov eax, dword [0x420158]
sub eax, ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x473614], 1
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
je 0x403591
sub eax, dword [esp + 0x14]
cmp eax, 0xc8
ja 0x403555
test ecx, ecx
jne 0x403591
mov eax, dword [esp + 0x20]
push eax
push 0x64
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [esp + 0x30]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.00405f72
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4035dd
test edi, edi
jne 0x4035b5
push eax
push ebp
push dword [esp + 0xbc]
call fcn.00406f52
test eax, eax
je 0x4035e7
mov eax, dword [esp + 0x18]
jmp 0x4035c1
mov ebp, dword [0x420158]
sub ebx, eax
mov dword [esp + 0x1c], ebp
add esi, eax
cmp dword [esp + 0x28], 1
jne 0x403502
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x9c
ret 0x10
test ecx, ecx
jg 0x4034cd
jmp 0x4035ce
push 0xfffffffffffffffe
jmp 0x40364b
push 0xfffffffffffffffc
jmp 0x40364b
test edi, edi
jne 0x403632
test eax, eax
jle 0x4035ce
mov ebp, 0x4281c0
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push ebp
call fcn.00403402
test eax, eax
je 0x403649
push edi
push ebp
push dword [esp + 0xbc]
call fcn.00406f52
test eax, eax
je 0x4035e7
mov eax, dword [esp + 0x10]
add esi, edi
sub eax, edi
mov dword [esp + 0x10], eax
test eax, eax
jg 0x4035fc
jmp 0x4035ce
mov esi, dword [esp + 0xbc]
cmp eax, esi
cmovl esi, eax
push esi
push edi
call fcn.00403402
test eax, eax
jne 0x4035ce
push 0xfffffffffffffffd
pop eax
jmp 0x4035d0
Function at 0x40364e
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x40366d
mov eax, dword [0x420130]
test eax, eax
je 0x403665
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x420130], 0
ret
cmp dword [0x420130], 0
je 0x40367e
push 0
call fcn.0040648b
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x473520]
jbe 0x4036b1
push 0
push 0x403916
push 0
push 0x6f
push dword [0x46b518]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x420130], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x406056
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406070
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4

Function at 0x406076
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push 4
pop eax
mov word [ebp - 0x1e], ax
mov eax, 0x40a6ec
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov word [ebp - 0x20], 1
mov dword [ebp - 0x10], 0x40a6dc
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4060e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4060ee
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
je 0x4060e8
xor eax, eax
jmp 0x4060ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret 4
Function at 0x40641a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, esi
pop esi
cmova eax, ecx
test eax, eax
je 0x406453
cmp word [ebp + eax*2 - 0x23e], 0x5c
mov ecx, 0x409aac
jne 0x406458
mov ecx, 0x409aae
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x23c]
lea eax, [ecx + eax*2]
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esp, ebp
pop ebp
ret 4

Function at 0x4064bb
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4064de
push dword [esp + 8]
push dword [esp + 8]
call fcn.0040658c
pop ecx
pop ecx
inc dword [0x4735f0]
ret 8

Function at 0x40658c
Capabilities:
Get file size

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebx, 0x400
mov dword [0x460e48], 0x55004e
mov ebp, 0x460e48
mov dword [0x460e4c], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x4065e3
push 1
push 0
push esi
call fcn.00406e5e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x4066c7
cmp eax, ebx
jg 0x4066c7
push ebx
mov esi, 0x460648
push esi
push dword [esp + 0x20]
call edi
test eax, eax
je 0x4066c7
cmp eax, ebx
jg 0x4066c7
push esi
push ebp
push str._ls_ls_r_n
push 0x460248
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x473530]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.004060f4
push 4
push 0xc0000000
push esi
call fcn.00406e5e
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x4066c7
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4066c0
push esi
push edi
push ebx
call fcn.00406e8b
test eax, eax
je 0x4066c0
push str._Rename__r_n
push edi
call fcn.00407083
test eax, eax
jne 0x4066cd
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x460248
lea eax, [ecx + edi]
push eax
call fcn.00406b99
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.00406f52
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x40a928
add eax, 0xa
push eax
call fcn.00407083
mov ecx, eax
test ecx, ecx
je 0x406691
lea edx, [edi + esi]
lea eax, [edx + ebp]
cmp edx, ecx
jbe 0x406701
sub eax, edx
mov dword [esp + 0x1c], eax
mov ebx, eax
mov al, byte [edx]
mov byte [ebx + edx], al
dec edx
cmp edx, ecx
ja 0x4066f3
mov ebx, dword [esp + 0x10]
sub ecx, edi
inc ecx
jmp 0x406693
Function at 0x4069a6
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.004070d6
mov edi, eax
cmp edi, 0xffffffff
je 0x4069e9
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x4069d1
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4069d9
xor eax, eax
inc eax
jmp 0x4069eb
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4069c8
test byte [ebp + 0xc], 4
jne 0x4069e9
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x406a4f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x45c248
push ebx
call fcn.00407067
push ebx
call fcn.004070fe
mov esi, eax
test esi, esi
jne 0x406a70
xor eax, eax
jmp 0x406ac8
push esi
call fcn.0040722d
test byte [0x47352c], 0x80
je 0x406a8c
movzx eax, word [esi]
test ax, ax
je 0x406a6c
cmp eax, 0x5c
je 0x406a6c
sub esi, ebx
sar esi, 1
jmp 0x406aa6
call fcn.004069f0
test eax, eax
je 0x406aa0
test byte [eax], 0x10
je 0x406a6c
push ebx
call fcn.00407200
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x406a92
call fcn.00406977
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop esi
pop ebx
ret 4

Function at 0x406bbb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x458200], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x458200
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406bfa
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x406c00
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00406a4f
mov dword [esp + 0x14], eax
test bl, 8
je 0x406c42
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4735e8], eax
jmp 0x406e1d
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x406c5f
test eax, eax
je 0x406da8
test bl, 2
je 0x406da4
push esi
push 0x458248
call fcn.00407067
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406c82
push str..
push 0x458248
call ebp
jmp 0x406c88
push esi
call fcn.00407200
xor eax, eax
cmp word [esi], ax
jne 0x406c99
cmp word [0x458248], 0x5c
jne 0x406ca1
push 0x409aac
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x458248
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406d8b
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x406cef
cmp word [esp + 0x4a], 0
je 0x406d6d
cmp word [esp + 0x4a], ax
jne 0x406cef
cmp word [esp + 0x4c], 0
je 0x406d6d
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00407067
test byte [esp + 0x1c], 0x10
je 0x406d16
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x406d6d
push ebx
push esi
call fcn.00406c00
jmp 0x406d6d
push esi
push str.Delete:_DeleteFile___s__
call fcn.00406acd
pop ecx
pop ecx
push edi
push esi
call fcn.004069a6
push esi
test eax, eax
jne 0x406d66
test edi, edi
je 0x406d52
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.00406acd
pop ecx
pop ecx
push esi
push 0xfffffffffffffff1
call fcn.00405f72
xor eax, eax
push eax
push esi
call fcn.004064bb
jmp 0x406d6d
push str.Delete:_DeleteFile_failed___s__
call fcn.00406acd
inc dword [0x4735e8]
pop ecx
pop ecx
jmp 0x406d6d
push 0xfffffffffffffff2
call fcn.00405f72
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x406ccd
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x406e1c
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x406db0
push esi
push str.RMDir:_RemoveDirectory_invalid_input___s__
jmp 0x406e06
push esi
call fcn.004069f0
test eax, eax
je 0x406e1c
push esi
call fcn.00406977
push esi
push str.RMDir:_RemoveDirectory___s__
call fcn.00406acd
pop ecx
pop ecx
mov eax, edi
or eax, 1
push eax
push esi
call fcn.004069a6
push esi
test eax, eax
jne 0x406e15
test edi, edi
je 0x406e01
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.00406acd
pop ecx
pop ecx
push esi
push 0xfffffffffffffff1
call fcn.00405f72
xor eax, eax
push eax
push esi
call fcn.004064bb
jmp 0x406e1c
push str.RMDir:_RemoveDirectory_failed___s__
call fcn.00406acd
inc dword [0x4735e8]
pop ecx
pop ecx
jmp 0x406e1c
push 0xffffffffffffffe5
call fcn.00405f72
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8
Function at 0x406e5e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x406ebc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x4000
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040655e
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406f2e
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x3ffe], ax
pop esi
jne 0x406f2e
cmp dword [ebp + 0x18], 1
je 0x406f33
cmp dword [ebp + 0x18], 2
je 0x406f33
xor eax, eax
mov word [edi], ax
pop edi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x406f3a
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406f9f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a908]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40a90c]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406feb
test edi, edi
jne 0x406fac
mov word [esi], ax
jmp 0x406fed
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4070d6
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4070f8
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x407322
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x46189c], 0
push esi
jne 0x40735c
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x407333
mov dword [ecx*4 + 0x461898], edx
inc ecx
cmp ecx, 0x100
jl 0x40732e
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x407386
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x461898]
inc esi
sub edx, 1
jne 0x40736e
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x43ee50
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x804
mov eax, dword [0x446004]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x837808]
imul eax, eax, 0x343fd
cmp dword [0x839c7c], 0x139e
mov dword [0x837808], eax
jne 0x43ee91
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EraseTape]
mov eax, dword [0x837808]
add eax, 0x269ec3
push esi
mov dword [0x837808], eax
movzx esi, word [0x83780a]
and esi, 0x7fff
cmp dword [0x839c7c], 0x8e7
jne 0x43eec6
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x804]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret

Function at 0x43ef10
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x43ef24
call fcn.0043ee50
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x43ef17
pop esi
cmp ebx, 0x2d
jne 0x43ef3e
mov dword [0x839c88], 0xa62e7790
mov dword [0x839c8c], 0xffffffff
ret

Function at 0x43ef40
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x446db8]
sub esp, 0x14
push ebx
mov ebx, dword [0x839c7c]
push edi
mov edi, dword [0x83780c]
call fcn.0043eee0
cmp dword [0x839c7c], 0x2f
jne 0x43ef9a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0043ef10
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x43f280
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00407bd0
mov eax, dword [0x446004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x43f2a9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe0f4a
jge 0x43f351
cmp dword [0x839c7c], 0xa5f
jne 0x43f2f5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x818]
push edx
push str.xonatoyuhejigoriramadiguyo
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 4], 0x84620b
jne 0x43f31a
mov eax, dword [0x447bd8]
mov dword [0x839c7c], eax
mov ecx, dword [0x839c7c]
add ecx, 0xa231
mov dword [0x839c7c], ecx
cmp dword [0x839c7c], 0x141
jne 0x43f34c
push str.wucusipeyekexe_zelisapecuyozabozecaxufer_miweyumeriwosizupuyubahu_regorekuzet_begazixezibunodumekacefasuhato
lea edx, [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x449180], 0xec58acac
mov dword [0x449184], 0xffffffff
jmp 0x43f2a0
call fcn.0043efb0
jmp dword [0x83780c]
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x586780
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x129000]
push edi
jmp 0x58679a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5867a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x586790
mov eax, 1
add ebx, ebx
jne 0x5867b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5867c4
jne 0x5867e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5867e3
dec eax
add ebx, ebx
jne 0x5867d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5867a8
add ebx, ebx
jne 0x5867df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x586835
xor ecx, ecx
sub eax, 3
jb 0x5867fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58686a
sar eax, 1
mov ebp, eax
jmp 0x586806
add ebx, ebx
jne 0x586806
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5867d4
inc ecx
add ebx, ebx
jne 0x586814
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5867d4
add ebx, ebx
jne 0x586821
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x586816
jne 0x586832
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x586816
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x586854
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x586846
jmp 0x586796
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x586854
add edi, ecx
jmp 0x586796
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x586872
cmp byte [edi], 0x11
jne 0x586872
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x586877
lea edi, [esi + 0x17f000]
mov eax, dword [edi]
or eax, eax
je 0x5868ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x227ce8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x227e64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5868a4
mov ecx, edi
jns 0x5868d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x227e68]
or eax, eax
je 0x5868e9
mov dword [ebx], eax
add ebx, 4
jmp 0x5868c1
call dword [esi + 0x227e78]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x586920
cmp al, 0xef
ja 0x586913
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5868f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x586902
mov ebp, dword [esi + 0x227e6c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x586954
sub esp, 0xffffff80
jmp 0x420577
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x4047e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4047f4
pop dword [ebp - 0x4c]
mov eax, 0xb75370c
sub eax, 0xb34ef18
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x347e4
push 0
mov eax, 0xf8a8e84f
sub eax, 0xf8680777
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x3512
mov ebx, eax
mov edi, str.jnv
add edi, dword [ebp - 0x4c]
mov edx, 0x9ae6e8b5
add edx, 0x5032106d
add dword [ebp - 0x40], 0x6fe0798c
mov esi, dword [edi]
sub dword [ebp - 0x10], ecx
sub esi, edx
sub dword [ebp - 0x10], edx
mov dword [ebx], esi
xor dword [ebp - 0x34], 0x9ce090c4
add ebx, 4
add edi, 0x38420bbd
sub edi, 0x38420bb9
loop 0x404847
add eax, 0xc71b
mov ebx, eax
add eax, 0xdf45994f
sub eax, 0xdf45994a
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x10006990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sal byte [esi + eax - 1], cl
test dword [edi + edi*8 - 1], esi
dec dword [edi]
scasd eax, dword es:[edi]
lea esi, [edi + edi*8 - 1]
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.100066ab
ret
Function at 0x10041218
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005e3c8]
jne 0x10041222
repz ret
jmp fcn.100417b1