joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb319b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..PCL
lea edi, [esi - 0x6e5000]
push edi
or ebp, 0xffffffff
jmp 0xb319d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xb319d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb319c8
mov eax, 1
add ebx, ebx
jne 0xb319eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xb319fc
jne 0xb31a0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb31a0c
dec eax
add ebx, ebx
jne 0xb31a08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xb319e0
xor ecx, ecx
sub eax, 3
jb 0xb31a24
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xb31a96
sar eax, 1
mov ebp, eax
jmp 0xb31a2f
add ebx, ebx
jne 0xb31a2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xb31a3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xb31a60
inc ecx
add ebx, ebx
jne 0xb31a4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xb31a41
jne 0xb31a5d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xb31a41
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xb31a80
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xb31a71
jmp 0xb319ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xb31a80
add edi, ecx
jmp 0xb319ce
pop esi
mov edi, esi
mov ecx, 0x5498
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xb31a9e
cmp byte [edi], 0x14
jne 0xb31a9e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0xb31aa3
lea edi, [esi + 0x72d000]
mov eax, dword [edi]
or eax, eax
je 0xb31b12
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x738148]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x738210]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xb31ad0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x738214]
or eax, eax
je 0xb31b0c
mov dword [ebx], eax
add ebx, 4
jmp 0xb31aed
call dword [esi + 0x738218]
popal
jmp 0x4a5504
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7ff62572
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x761e78b1
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x9b74c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x66400d
lea edi, [esi - 0x26300d]
push edi
or ebp, 0xffffffff
jmp 0x9b74e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9b74e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9b74d8
mov eax, 1
add ebx, ebx
jne 0x9b74fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9b74f0
jne 0x9b750c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b74f0
xor ecx, ecx
sub eax, 3
jb 0x9b7520
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9b7592
mov ebp, eax
add ebx, ebx
jne 0x9b752b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x9b7538
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x9b755c
inc ecx
add ebx, ebx
jne 0x9b7548
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9b753d
jne 0x9b7559
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b753d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9b757c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9b756d
jmp 0x9b74de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9b757c
add edi, ecx
jmp 0x9b74de
pop esi
mov edi, esi
mov ecx, 0x18a9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9b759a
cmp byte [edi], 0x11
jne 0x9b759a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9b759f
lea edi, [esi + 0x5b3000]
mov eax, dword [edi]
or eax, eax
je 0x9b760e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5ba02c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5ba084]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9b75cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5ba08c]
or eax, eax
je 0x9b7608
mov dword [ebx], eax
add ebx, 4
jmp 0x9b75e9
call dword [esi + 0x5ba088]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x9b763f
cmp al, 0xef
ja 0x9b7632
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x9b7614
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x9b7621
mov ebp, dword [esi + 0x5ba090]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9b7673
sub esp, 0xffffff80
jmp 0x40efbc
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x406739
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x469c7c], 0
jne 0x406777
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40674d
mov dword [ecx*4 + 0x469c78], eax
inc ecx
cmp ecx, 0x100
jl 0x406748
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4067a4
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x469c78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406785
not eax
pop ebp
ret 0xc

Function at 0x432000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x7c22405e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x290e74dc
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5aa04e43
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x48d32511
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x417c50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x417c72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417c79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417c68
mov eax, 1
add ebx, ebx
jne 0x417c8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417c80
jne 0x417c9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417c80
xor ecx, ecx
sub eax, 3
jb 0x417cb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417d22
mov ebp, eax
add ebx, ebx
jne 0x417cbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417cc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417cec
inc ecx
add ebx, ebx
jne 0x417cd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417ccd
jne 0x417ce9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417ccd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417d0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417cfd
jmp 0x417c6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417d0c
add edi, ecx
jmp 0x417c6e
pop esi
mov edi, esi
mov ecx, 0xde
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x417d2a
cmp byte [edi], 6
jne 0x417d2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x417d2f
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x417da7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x177c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417d5c
mov ecx, edi
jns 0x417d8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1784c]
or eax, eax
je 0x417da1
mov dword [ebx], eax
add ebx, 4
jmp 0x417d79
call dword [esi + 0x17848]
mov ebp, dword [esi + 0x17850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x417ddb
sub esp, 0xffffff80
jmp 0x4017d4
Function at 0x40d840
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [edi + reloc.USER32.dll_PeekMessageA]
test eax, eax
je 0x40d88a
push 0
lea ecx, [ebp + 0xc]
push ecx
push 0x10
push ebx
push 0
push 0
push 0
push 0x10
push esi
push eax
call dword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
jns 0x40d8c1
push eax
push str.BCryptDecrypt_x_n
call fcn.0041d060
add esp, 8
mov ecx, edi
call fcn.0040d7e0
lea eax, [esi + 0x10]
mov dword [ebp + 0xc], eax
cmp esi, eax
jae 0x40d8c1
lea ecx, [edi + 0xf0]
sub ebx, esi
nop dword [eax]
mov edx, dword [edi + reloc.USER32.dll_PeekMessageA]
lea eax, [ebx + esi]
push eax
push esi
call fcn.0040d0a0
add esi, 0x10
lea ecx, [edi + 0xf0]
add esp, 8
cmp esi, dword [ebp + 0xc]
jb 0x40d8a0
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40d8d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
add eax, 0xfffffff1
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
add eax, edi
mov dword [ebp - 0x18], eax
cmp edi, eax
jae 0x40d959
nop word [eax + eax]
movups xmm0, xmmword [edi]
push ecx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
push edi
movups xmmword [ebp - 0x28], xmm0
call fcn.0040d840
mov ecx, dword [ebx + reloc.USER32.dll_PeekMessageA]
add edi, 0x10
mov eax, dword [ebx + reloc.USER32.dll_PeekMessageA]
xor ecx, dword [ebp - 0x14]
xor eax, dword [ebp - 0x10]
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov ecx, dword [ebx + reloc.USER32.dll_PeekMessageA]
mov eax, dword [ebx + reloc.USER32.dll_PeekMessageA]
xor ecx, dword [ebp - 0xc]
xor eax, dword [ebp - 8]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
add esi, 0x10
movups xmmword [ebx + 0x1e4], xmm0
cmp edi, dword [ebp - 0x18]
jb 0x40d900
movzx ecx, byte [esi - 1]
mov eax, dword [ebp + 0x10]
sub eax, ecx
pop edi
lea edx, [ecx - 1]
mov ecx, dword [ebp - 4]
cmp edx, 0xf
pop esi
cmova eax, dword [ebp + 0x10]
xor ecx, ebp
pop ebx
call fcn.0043c755
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ed60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0x23
mov ebx, ecx
mov esi, edx
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ecx
push 0x4726e8
xor edx, edx
mov ecx, ebx
call fcn.0041f690
add esp, 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x220], xmm0
cmp esi, 4
je 0x40edcc
cmp esi, 2
jne 0x40edba
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004200d0
jmp 0x40edd7
cmp esi, 3
jne 0x40edcc
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004202a0
jmp 0x40edd7
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00420440
push 0x208
lea eax, reloc.USER32.dll_PeekMessageA
push 0
push eax
call fcn.0043ffb0
add esp, 0xc
lea eax, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
push eax
call fcn.0041f790
add esp, 4
cmp esi, 4
jne 0x40ee23
lea edi, reloc.USER32.dll_PeekMessageA
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x40ee10
mov eax, dword [str.fsbfb]
jmp 0x40ee71
cmp esi, 1
jne 0x40ee44
lea edi, reloc.USER32.dll_PeekMessageA
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x40ee31
mov eax, dword [0x472718]
jmp 0x40ee71
cmp esi, 2
je 0x40ee4e
cmp esi, 3
jne 0x40ee73
lea edi, reloc.USER32.dll_PeekMessageA
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x40ee60
mov eax, dword [0x47271c]
mov dword [edi], eax
push ecx
lea eax, reloc.USER32.dll_PeekMessageA
xor edx, edx
push eax
mov ecx, ebx
call fcn.0041f690
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0043c755
mov esp, ebp
pop ebp
ret

Function at 0x40f160
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, dword [ebp + 8]
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0040ed60
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x40f1c0
cmp esi, reloc.USER32.dll_PeekMessageA
je 0x40f1c0
push 0
push edi
push dword [edi]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
jmp 0x40f1c2
xor edi, edi
test esi, esi
je 0x40f1d2
cmp esi, reloc.USER32.dll_PeekMessageA
je 0x40f1d2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c755
mov esp, ebp
pop ebp
ret
Function at 0x411b70
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b54b
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x80000001
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422000
push ecx
push 0x473828
lea ecx, reloc.USER32.dll_PeekMessageA
mov dword [ebp - 4], 0
call fcn.004221c0
test eax, eax
je 0x411c43
push 0x208
lea eax, reloc.USER32.dll_PeekMessageA
push 0
push eax
call fcn.0043ffb0
add esp, 8
lea eax, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
push eax
push 0x47386c
call fcn.00422510
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call fcn.004472ca
mov dword [esi + 0x48], eax
lea ecx, reloc.USER32.dll_PeekMessageA
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push 0x473878
call fcn.00422510
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call fcn.004472ca
add esp, 4
mov dword [esi + 0x4c], eax
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004222e0
mov esi, 1
jmp 0x411c45
xor esi, esi
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422040
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c755
mov esp, ebp
pop ebp
ret

Function at 0x411dd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b54b
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
lea eax, reloc.USER32.dll_PeekMessageA
push 0
push eax
call fcn.0043ffb0
add esp, 0xc
lea eax, reloc.USER32.dll_PeekMessageA
push 0
push 0x28
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x411e47
push ecx
push 0x473894
lea ecx, reloc.USER32.dll_PeekMessageA
lea edx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
add esp, 8
jmp 0x411ec1
push 1
push 0x80000002
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422000
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersion
lea ecx, reloc.USER32.dll_PeekMessageA
mov dword [ebp - 4], 0
call fcn.004221c0
test eax, eax
je 0x411eb6
push ecx
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push str.ProgramFilesDir
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422510
test eax, eax
je 0x411eab
push ecx
push 0x4738e4
lea ecx, reloc.USER32.dll_PeekMessageA
lea edx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
add esp, 8
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004222e0
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c755
mov esp, ebp
pop ebp
ret
Function at 0x4127e0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + reloc.USER32.dll_PeekMessageA]
test ecx, ecx
je 0x4128cf
call fcn.00414c00
xor eax, eax
mov ecx, 5
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 1
cmove eax, ecx
mov ecx, esi
push eax
push 0x72
call fcn.00425b50
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
jne 0x41288a
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 1
je 0x412837
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
jne 0x412837
xor eax, eax
jmp 0x41283c
mov eax, 1
push eax
push 1
mov ecx, esi
call fcn.00425b50
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
je 0x412876
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 1
jne 0x412876
mov eax, dword [esi + 0xd8]
lea ecx, [esi + 0xd8]
mov edx, 5
push edx
call dword [eax + 0xc]
pop esi
ret
mov eax, dword [esi + 0xd8]
lea ecx, [esi + 0xd8]
xor edx, edx
push edx
call dword [eax + 0xc]
pop esi
ret
mov eax, dword [esi + reloc.USER32.dll_PeekMessageA]
test eax, eax
jns 0x4128be
mov ecx, dword [esi + reloc.USER32.dll_PeekMessageA]
test ecx, ecx
jne 0x4128b3
xor eax, eax
mov ecx, esi
push eax
push 1
call fcn.00425b50
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop esi
ret
call fcn.0040fe80
mov dword [esi + reloc.USER32.dll_PeekMessageA], eax
push eax
push 1
mov ecx, esi
call fcn.00425b50
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop esi
ret
Function at 0x4148e0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
push eax
mov dword [ebp - reloc.USER32.dll_PeekMessageA], eax
lea eax, reloc.USER32.dll_PeekMessageA
push str._s.
push eax
call fcn.00410120
add esp, 0xc
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, reloc.USER32.dll_PeekMessageA
jne 0x414950
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c755
mov esp, ebp
pop ebp
ret 8
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push dword [ebp - 0x874]
lea eax, reloc.USER32.dll_PeekMessageA
push str._s_s
push eax
call fcn.00410120
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004147e0
add esp, 0x14
test eax, eax
je 0x414a00
cmp word [ebp - 0x620], 0
jne 0x414a00
lea ecx, reloc.USER32.dll_PeekMessageA
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4149a0
sub ecx, edx
sar ecx, 1
cmp ecx, 0xc
jle 0x414a00
push 0xc
lea eax, reloc.USER32.dll_PeekMessageA
push str.FastCopy.exe
push eax
call fcn.00449b1d
add esp, 0xc
test eax, eax
jne 0x414a00
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test esi, esi
je 0x414a00
lea ecx, reloc.USER32.dll_PeekMessageA
mov edx, esi
mov eax, ecx
sub edx, eax
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4149f0
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x414950
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c755
mov esp, ebp
pop ebp
ret 8