joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4848d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b2750]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b2750]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4b2750]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4b2750]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4b26d4]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x4b2750]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b2750]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4b2750]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4b2750]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x484923
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x48a9b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x48a9de
cmp dword [ebx + 0x64], 0
jne 0x48a9de
cmp dword [ebx + 0x6c], 0
jne 0x48a9de
mov edi, esi
jmp 0x48aa65
cmp edi, 0xffffffff
jne 0x48a9e6
dec edi
jmp 0x48aa65
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x48aa65
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00489db0
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48aa33
mov cx, word [esp]
sub cx, si
jmp 0x48aa35
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48aa1c
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48aa5b
mov cx, word [esp]
sub cx, si
jmp 0x48aa5d
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48aa44
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x48aac2
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.0048a750
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x48aaad
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x48aac2
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x48a9be
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x490d28
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4b6e94
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x490d4a
shr eax, 1
xor eax, 0xedb88320
jmp 0x490d4c
shr eax, 1
dec edx
jne 0x490d38
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x490d31
mov byte [0x4b7294], 1
pop esi
pop ebx
ret

Function at 0x490d68
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4b7294], 0
jne 0x490d7f
call fcn.00490d28
mov eax, edi
dec eax
test eax, eax
jl 0x490da8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b6e94]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x490d89
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x493600
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x493631
dec al
je 0x49366d
dec al
je 0x4936b1
dec al
je 0x49371c
jmp 0x4937a6
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4937a6
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x493641
jmp 0x4937a6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4937a6
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49367d
jmp 0x4937a6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4937a6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4936df
xor ebp, ebp
jmp 0x4936f0
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4936f9
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4936c1
jmp 0x4937a6
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4937a6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x493774
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00490db0
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x493730
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ab0b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4ab1c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ab19d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004a9974
mov edx, dword [0x4b5a60]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4ab1dc
call fcn.0040459c
mov eax, dword [ebp - 4]
call fcn.00409040
test al, al
je 0x4ab193
mov dl, 1
mov eax, dword [0x4167f8]
call fcn.004034f0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ab18c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x48], 0
jne 0x4ab138
lea eax, [ebp - 0xc]
mov edx, 0x4ab1f0
call fcn.00404328
jmp 0x4ab143
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x48]
call fcn.00404328
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00460e44
test al, al
je 0x4ab160
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 8]
call fcn.004aae70
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
call dword [edx + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab193
mov eax, dword [ebp - 8]
call fcn.00403520
mov eax, dword [ebp - 4]
call fcn.00404750
push eax
call sub.kernel32.dll_DeleteFileA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ab1a7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab1cc
lea eax, [ebp - 0xc]
call fcn.00404290
lea eax, [ebp - 4]
call fcn.00404290
ret

Function at 0x4ab438
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ab525
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ab505
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004a9974
mov edx, dword [0x4b5a60]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4ab53c
call fcn.0040459c
mov eax, dword [ebp - 4]
call fcn.00409040
test al, al
je 0x4ab4fb
mov dl, 1
mov eax, dword [0x4167f8]
call fcn.004034f0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ab4f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 8]
mov edx, 0x4ab550
mov eax, dword [ebp - 4]
call fcn.00460e44
test al, al
je 0x4ab4c8
mov eax, dword [ebx + 0x14]
mov edx, dword [ebp - 8]
call fcn.004ab1f8
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
call dword [edx + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab4fb
mov eax, dword [ebp - 8]
call fcn.00403520
mov eax, dword [ebp - 4]
call fcn.00404750
push eax
call sub.kernel32.dll_DeleteFileA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ab50f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab52c
lea eax, [ebp - 4]
call fcn.00404290
ret
Function at 0x4ab778
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4ab876
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ab84e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004a9974
mov edx, dword [0x4b5a60]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4ab88c
call fcn.0040459c
mov eax, dword [ebp - 4]
call fcn.00409040
test al, al
je 0x4ab844
lea eax, [ebp - 0xc]
mov edx, 0x4ab8a0
call fcn.00404328
mov dl, 1
mov eax, dword [0x4167f8]
call fcn.004034f0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ab83d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00460e44
test al, al
je 0x4ab811
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp - 8]
call fcn.004ab55c
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
call dword [edx + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab844
mov eax, dword [ebp - 8]
call fcn.00403520
mov eax, dword [ebp - 4]
call fcn.00404750
push eax
call sub.kernel32.dll_DeleteFileA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ab858
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab87d
lea eax, [ebp - 0xc]
call fcn.00404290
lea eax, [ebp - 4]
call fcn.00404290
ret
Function at 0x4abea0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ac044
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ac01d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x4abef4
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 8]
cmp eax, 0x493e0
ja 0x4abef4
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x4ac009
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
lea eax, [ebp - 0xc]
call fcn.00404290
lea eax, [ebp - 0xc]
call fcn.00404290
mov ecx, eax
mov edx, 0x4ac05c
mov eax, dword [ebp - 4]
call fcn.004a9f34
test al, al
jne 0x4abf54
lea eax, [ebp - 0xc]
call fcn.00404290
mov ecx, eax
mov edx, 0x4ac098
mov eax, dword [ebp - 4]
call fcn.004a9f34
test al, al
jne 0x4abf54
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac029
cmp dword [ebp - 0xc], 0
je 0x4ac009
mov dl, 1
mov eax, dword [0x4167f8]
call fcn.004034f0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ac002
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4abfc4
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004086fc
cmp dword [ebp - 0xc], 0
jne 0x4abfbe
mov edx, ebx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebx
cmp ebx, 0xffffffff
jne 0x4abf96
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.00402f14
mov edx, eax
lea ecx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.004042e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac009
mov eax, dword [ebp - 8]
call fcn.00403520
ret
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac029
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac04b
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004042b4
ret
Function at 0x4ac780
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4ac87e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ac856
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004a9974
mov edx, dword [0x4b5a60]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4ac894
call fcn.0040459c
mov eax, dword [ebp - 4]
call fcn.00409040
test al, al
je 0x4ac84c
lea eax, [ebp - 0xc]
mov edx, 0x4ac8a8
call fcn.00404328
mov dl, 1
mov eax, dword [0x4167f8]
call fcn.004034f0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ac845
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00460e44
test al, al
je 0x4ac819
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebp - 8]
call fcn.004ac540
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
call dword [edx + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac84c
mov eax, dword [ebp - 8]
call fcn.00403520
mov eax, dword [ebp - 4]
call fcn.00404750
push eax
call sub.kernel32.dll_DeleteFileA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac860
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac885
lea eax, [ebp - 0xc]
call fcn.00404290
lea eax, [ebp - 4]
call fcn.00404290
ret

Function at 0x4acad8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4acbc5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4acba5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004a9974
mov edx, dword [0x4b5a60]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4acbdc
call fcn.0040459c
mov eax, dword [ebp - 4]
call fcn.00409040
test al, al
je 0x4acb9b
mov dl, 1
mov eax, dword [0x4167f8]
call fcn.004034f0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4acb94
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 8]
mov edx, 0x4acbf0
mov eax, dword [ebp - 4]
call fcn.00460e44
test al, al
je 0x4acb68
mov eax, dword [ebx + 0x58]
mov edx, dword [ebp - 8]
call fcn.004ac8b0
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
call dword [edx + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acb9b
mov eax, dword [ebp - 8]
call fcn.00403520
mov eax, dword [ebp - 4]
call fcn.00404750
push eax
call sub.kernel32.dll_DeleteFileA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4acbaf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acbcc
lea eax, [ebp - 4]
call fcn.00404290
ret
Function at 0x40cb94
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ecx
mov eax, dword [0x4177f0]
push ebx
dec eax
push esi
neg eax
sbb eax, eax
push 0x12c
add eax, 0x75fa
movzx eax, ax
push eax
push dword [0x417bd4]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40cc68
push esi
push dword [0x417bd4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov dword [esp + 0xc], eax
push dword [0x417bd4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40cc68
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x40cc60
mov esi, dword [esp + 0x14]
push edi
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x5c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x40cc24
push 0x4140ec
push esi
call edi
cmp dword [0x4177f0], 0
jne 0x40cc34
push str._MSSETUP.EXE
jmp 0x40cc39
push str._MSRSTRT.EXE
push esi
call edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll__lcreat]
mov esi, eax
pop edi
cmp esi, 0xffffffff
je 0x40cc60
push dword [esp + 0xc]
push ebp
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
jmp 0x4502ed
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x140
mov eax, dword [0x498368]
xor eax, ebp
mov dword [ebp + 0x64], eax
fld qword [ebp + 0x78]
push esi
push edi
fstp qword [ebp - 0xd8]
push 0x49ee18
push 0x64
pop edi
lea eax, [ebp - 0x64]
push edi
push eax
call fcn.00458dab
push str.programD_NameSm.txt
lea eax, [ebp - 0x64]
push edi
push eax
call fcn.00458716
mov esi, 0x48531c
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00459214
add esp, 0x24
test eax, eax
je 0x450366
push 0x40
push 0x486620
push 0x487290
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.004582bc
push dword [ebp - 0xd0]
lea eax, [ebp]
push edi
push eax
call fcn.00459faa
lea eax, [ebp]
push eax
lea eax, [ebp - 0xc8]
push edi
push eax
call fcn.00458dab
push dword [ebp - 0xd0]
call fcn.00458e83
push esi
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.00459214
add esp, 0x28
test eax, eax
je 0x4503bb
push 0x40
push 0x486620
push 0x48724c
jmp 0x450357
push dword [ebp - 0xcc]
lea eax, [ebp]
push edi
push eax
call fcn.00459faa
add esp, 0xc
test eax, eax
je 0x45044a
mov esi, 0x486860
lea eax, [ebp]
push esi
push eax
call fcn.0045a6a0
test eax, eax
pop ecx
pop ecx
jne 0x4503f5
push esi
lea eax, [ebp]
push edi
push eax
call fcn.00458716
add esp, 0xc
fldz
lea eax, [ebp]
push eax
sub esp, 0x20
fstp qword [esp + 0x18]
fld qword [0x484f40]
fstp qword [esp + 0x10]
fld qword [ebp - 0xd8]
fstp qword [esp + 8]
fld qword [ebp + 0x70]
fstp qword [esp]
call fcn.004011c2
push dword [ebp - 0xcc]
fld qword [ebp - 0xd8]
fsub qword [0x485080]
lea eax, [ebp]
push edi
push eax
fstp qword [ebp - 0xd8]
call fcn.00459faa
add esp, 0x30
test eax, eax
jne 0x4503d7
push dword [ebp - 0xcc]
call fcn.00458e83
pop ecx
mov ecx, dword [ebp + 0x64]
pop edi
xor ecx, ebp
pop esi
call fcn.00458348
add ebp, 0x68
leave
ret