joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40671e
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.0040663b
mov dword [esp + 0x14], eax
test bl, 8
je 0x406760
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4295e8], eax
jmp 0x4068df
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x40677d
test eax, eax
je 0x4068ce
test bl, 2
je 0x406897
push esi
push 0x424a68
call fcn.00406b1f
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x4067a0
push str..
push 0x424a68
call ebp
jmp 0x4067a6
push esi
call fcn.00406d15
xor eax, eax
cmp word [esi], ax
jne 0x4067b7
cmp word [0x424a68], 0x5c
jne 0x4067bf
push 0x4082a8
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x424a68
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406880
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x406809
cmp word [esp + 0x4a], 0
je 0x406862
cmp word [esp + 0x4a], ax
jne 0x406809
cmp word [esp + 0x4c], 0
je 0x406862
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406b1f
test byte [esp + 0x1c], 0x10
je 0x406830
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x406862
push ebx
push esi
call fcn.0040671e
jmp 0x406862
push edi
push esi
call fcn.00406588
test eax, eax
jne 0x40685a
test edi, edi
je 0x406852
push esi
push 0xfffffffffffffff1
call fcn.00405d55
xor eax, eax
push eax
push esi
call fcn.00406240
jmp 0x406862
inc dword [0x4295e8]
jmp 0x406862
push esi
push 0xfffffffffffffff2
call fcn.00405d55
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4067eb
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x4068de
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x4068ce
push esi
call fcn.004065d2
test eax, eax
je 0x4068de
push esi
call fcn.00406559
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00406588
test eax, eax
jne 0x4068d6
test edi, edi
je 0x4068ce
push esi
push 0xfffffffffffffff1
call fcn.00405d55
xor eax, eax
push eax
push esi
call fcn.00406240
jmp 0x4068de
inc dword [0x4295e8]
jmp 0x4068de
push esi
push 0xffffffffffffffe5
call fcn.00405d55
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x406920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x40697c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004062db
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x4069ee
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x4069ee
cmp dword [ebp + 0x18], 1
je 0x4069f3
cmp dword [ebp + 0x18], 2
je 0x4069f3
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x4069f8
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406a5b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406aa5
test edi, edi
jne 0x406a68
mov word [esi], ax
jmp 0x406aa7
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406ba2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406bc4
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406e3f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4270bc], 0
push esi
jne 0x406e79
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406e50
mov dword [ecx*4 + 0x4270b8], edx
inc ecx
cmp ecx, 0x100
jl 0x406e4b
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406ea3
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4270b8]
inc esi
sub edx, 1
jne 0x406e8b
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x41ba5996
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0xecb5b59
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg esi, eax
sal dword [esi + esi*8 + 0x7c797d09], cl
sbb ebx, ebp
or ebx, dword [ebp + edx*8 - 0x6a8ad9f]
dec ecx
or al, 0xd
pop esi
sub al, 0x20
inc ebx
push ss
cmc
sub bl, al
sal byte [ecx + 0xbe66a55], 1
jo 0x401e76
Function at 0x4066e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x32]
mov eax, dword [esi + 4]
mov ebx, dword [0x502974ff]
call dword [sym.imp.WSOCK32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x406711
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
call esi
mov ch, 0xc0
je 0x406730
call esi
add eax, 0xafc80
sub dword [eax - 0x3d], eax
ret
mov dword [esi + 4], 0xffffdcff
mov ebp, dword [ecx]
inc eax
xor dword [edi + 0x74], esi
pop es
mov eax, dword [ecx + 0x15ff5010]
je 0x406710
inc eax
add bh, al
pop ecx
jo 0x40672d
mov ah, 0
add byte [ebx], dh
rcr byte [esi + 0x5d], 0xc3
add edx, dword [eax - 0x39fb6f70]
nop
nop
nop
adc dl, byte [eax - 0x741374ab]
inc ebp
adc byte [ebx - 0x74a94abe], cl
jmp 0x406755
xor eax, eax
pop esi
pop ebp
ret
add byte [edi + 0x52], dl
mov ecx, edi
or byte [ecx + 0x6de80cc3], cl
push es
add cl, bh
mov eax, ebx
cli
mov edx, 0xe8502f00
popfd
push es
add byte [eax], al
add esp, 0x18
pop edi
invalid

Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
or eax, 0xc0a02c46
je 0x99b3a1
jle 0x40b333
dec eax
xor eax, eax
push ebx
inc esp
stc
add dword [edi - 0x77], edx
inc ebp
in al, 0x89
adc al, 8
jne 0x7baa95
mov edi, dword [esi + 0x3c]
cmp edi, dword [ecx]
je 0x1c40ed95
mov ebx, dword [esi + 0x38]
cmp edi, 0xffffffff
jbe 0x40b366
dec eax
imul esp, dword [esi + eax - 0x743874fe], 0x2f
add al, 0x8d
test dword [ebx], edi
ror eax, 0x51
push eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xchg ebx, eax
xchg byte [edi + ebp - 0x75], dh
inc ebp
cld
mov edx, dword [esi + 0x50]
mov ecx, dword [esi - 0x78]
add edx, eax
adc ecx, 0
sub edi, eax
rol byte [ebx - 0x7d4ff2f], 1
add ebx, eax
mov dword [esi + 0x50], edx
test edi, edi
mov dword [esi + 0x54], ecx
ffreep st(2)
mov edx, ebx
or byte [edx], ah
mov dword [esi + 0x3c], 0
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
or bl, ch
or bh, bh
xlatb
add eax, 0xafc80
mov byte cs:[eax], cl
mov eax, dword [ebp + 0x5056f7fc]
mov ecx, dword [esi + 0x54]
sub edx, 0xffffff8b
inc ebp
or byte [ecx - 0x2e7cafaa], cl
add byte [ebp + 0x33aa93c0], al
jne 0x40b395
mov dword [esi + 0x3c], 0x1a000000
mov eax, dword [ebp + 8]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
hlt
Function at 0x10018a50
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10018c1d
pushal
mov esi, 0x49b6000
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x10018a7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10018a81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10018a70
mov eax, 1
add ebx, ebx
jne 0x10018a93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10018a88
jne 0x10018aa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10018a88
xor ecx, ecx
sub eax, 3
jb 0x10018ab8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10018b2a
mov ebp, eax
add ebx, ebx
jne 0x10018ac3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10018ad0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10018af4
inc ecx
add ebx, ebx
jne 0x10018ae0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10018ad5
jne 0x10018af1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10018ad5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10018b14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10018b05
jmp 0x10018a76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10018b14
add edi, ecx
jmp 0x10018a76
pop esi
mov edi, esi
mov ecx, 0x1f1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10018b32
cmp byte [edi], 1
jne 0x10018b32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10018b37
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x10018baf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x180b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10018b64
mov ecx, edi
jns 0x10018b93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x180b8]
or eax, eax
je 0x10018ba9
mov dword [ebx], eax
add ebx, 4
jmp 0x10018b81
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10018be0
cmp al, 0xef
ja 0x10018bd3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10018bb5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10018bc2
mov ebp, dword [esi + 0x180bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10018c14
sub esp, 0xffffff80
jmp 0x10003b70
Function at 0x1009294
Capabilities:
Create directory
Delete directory
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1011040]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x218], 0
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10093ae
push esi
push edi
lea eax, [ebp - 0x214]
push eax
mov edi, 0x105
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1009303
call esi
push eax
push 0x100376c
push dword [0x101135c]
call fcn.0100a43e
add esp, 0xc
push 0x1002130
push edi
lea eax, [ebp - 0x214]
push eax
call fcn.01004e0f
lea eax, [ebp - 0x10c]
push eax
xor edi, edi
push edi
push 0x10023bc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x100932d
call esi
push eax
push 0x100373c
jmp 0x100935a
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x218], eax
cmp eax, edi
jne 0x100936a
call esi
push eax
push 0x1003708
push dword [0x101135c]
call fcn.0100a43e
add esp, 0xc
jmp 0x10093ac
push 0x100
push edi
push edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.01004e49
cmp eax, edi
jge 0x10093ac
push eax
push 0x10036d8
push dword [0x101135c]
call fcn.0100a43e
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x218], edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
pop ebx
call fcn.010096ed
leave
ret 8

Function at 0x100ba2d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x100ba6e
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x100ba47
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x100ba8c
dec esi
je 0x100ba83
dec esi
jne 0x100ba91
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0xc4286a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7bb50215
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x405ab0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x405ac6
mov eax, dword [edi]
jmp 0x405ac8
mov eax, edi
mov esi, dword [edi + 0x10]
add esi, eax
cmp ecx, 0x10
jb 0x405ad4
mov edi, dword [edi]
xor eax, eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov eax, esi
sub eax, edi
mov dword [ebp - 0x1c], 0
cmp eax, 7
je 0x405b17
push 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407be0
test al, al
je 0x405b17
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
cmovae eax, dword [ebp - 0x2c]
xor ecx, ecx
mov word [eax], cx
push dword [ebp - 4]
lea ecx, [ebp - 0x2c]
push esi
push edi
call fcn.00408f80
push 0x44
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00415770
add esp, 0xc
mov dword [ebp - 0x78], 0x44
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x2c]
xorps xmm0, xmm0
cmovae eax, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405b82
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
xor esi, esi
jmp 0x405b87
mov esi, 1
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x405b9c
inc ecx
push ecx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.00407b80
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
push ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xc], esi
call fcn.004095a0
push ecx
lea ecx, [ebp - 0x18]
call fcn.004095a0
mov eax, dword [ebp - 0x24]
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [ebp - 8], eax
cmp dword [edi + 0x14], 0x10
jb 0x40945d
mov eax, dword [edi]
mov dword [ebp - 4], eax
jmp 0x409460
mov dword [ebp - 4], edi
xor edx, edx
mov esi, dword [ebp - 4]
mov eax, ebx
add ecx, ebx
div dword [edi + 0x10]
mov al, byte [edx + esi]
mov edx, dword [ebp - 8]
mov byte [edx + ecx], al
mov byte [ecx], bl
inc ebx
mov ecx, dword [ebp - 0x18]
cmp ebx, 0x100
jl 0x409450
mov esi, dword [ebp - 0xc]
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], 0x100
mov edx, ebx
mov eax, dword [ebp - 8]
movzx ecx, byte [edx]
movzx eax, byte [edx + eax]
add eax, ecx
add edi, eax
and edi, 0x800000ff
jns 0x4094b1
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebx + edi]
mov byte [edx], al
inc edx
sub dword [ebp - 4], 1
mov byte [ebx + edi], cl
jne 0x409493
mov ebx, dword [ebp + 8]
mov ecx, dword [esi + 0x10]
mov eax, dword [ebx + 0x10]
cmp eax, ecx
ja 0x4094e6
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 0x10
jb 0x4094de
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x4094f2
mov ecx, esi
mov byte [ecx + eax], 0
jmp 0x4094f2
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00407e40
xor eax, eax
xor edi, edi
xor edx, edx
cmp dword [ebx + 0x10], eax
jbe 0x40957f
inc edx
and edx, 0x800000ff
jns 0x409512
dec edx
or edx, 0xffffff00
inc edx
mov ecx, dword [ebp - 0x18]
mov dword [ebp + 8], edx
movzx edx, byte [ecx + edx]
add eax, edx
and eax, 0x800000ff
jns 0x40952c
dec eax
or eax, 0xffffff00
inc eax
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov al, byte [ecx + eax]
mov byte [ecx + esi], al
mov eax, dword [ebp - 8]
mov byte [ecx + eax], dl
mov eax, esi
movzx ecx, byte [ecx + eax]
add ecx, edx
cmp dword [ebx + 0x14], 0x10
movzx eax, cl
mov ecx, dword [ebp - 0x18]
movzx edx, byte [eax + ecx]
jb 0x40955a
mov eax, dword [ebx]
jmp 0x40955c
mov eax, ebx
mov esi, dword [ebp - 0xc]
cmp dword [esi + 0x14], 0x10
jb 0x409569
mov ecx, dword [esi]
jmp 0x40956b
mov ecx, esi
mov al, byte [eax + edi]
xor al, dl
mov edx, dword [ebp + 8]
mov byte [ecx + edi], al
inc edi
mov eax, dword [ebp - 8]
cmp edi, dword [ebx + 0x10]
jb 0x409501
lea ecx, [ebp - 0x18]
call fcn.00407040
lea ecx, [ebp - 0x24]
call fcn.00407040
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a160
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
push 0
push 0
mov esi, ecx
mov byte [ebp - 1], 0
mov cl, 0x4d
mov dword [ebp - 0xc], 0
push 0
mov al, 0xe
mov byte [ebp - 5], cl
xor al, cl
mov byte [ebp - 1], 0
push 0
mov byte [ebp - 4], al
mov dl, 0x77
lea eax, [ebp - 0xc]
mov bl, 0x11
push eax
push 0
push 0
lea eax, [ebp - 4]
xor dl, cl
xor bl, cl
mov byte [ebp - 3], dl
push eax
mov byte [ebp - 2], bl
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
sub esp, 8
lea ecx, [ebp - 0xa8]
call fcn.0040a5b0
push dword [ebp - 0xc]
lea ecx, [ebp - 0xa8]
call fcn.0040abe0
push esi
lea ecx, [ebp - 0xa4]
call fcn.0040ba60
lea ecx, [ebp - 0x58]
call fcn.0040a530
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], vtable.std::ios_base.0
push eax
call fcn.0041170a
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a200
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
movaps xmm0, xmmword [0x43ba40]
movups xmmword [ebp - 0x26], xmm0
push esi
movaps xmm0, xmmword [0x43ba60]
mov esi, ecx
mov dword [ebp - 0x2c], 0x80
xor ecx, ecx
movups xmmword [ebp - 0x16], xmm0
mov word [ebp - 6], 0x49
mov al, byte [ebp - 0x26]
xor byte [ebp + ecx - 0x25], al
inc ecx
cmp ecx, 0x20
jb 0x40a231
lea eax, [ebp - 4]
mov byte [ebp - 5], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x25]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a2aa
movaps xmm0, xmmword [0x43b970]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x352225
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x12
jb 0x40a274
lea eax, [ebp - 0x2c]
mov byte [ebp - 5], 0
push eax
lea eax, [ebp - 0xac]
push eax
push 0
push 0
lea eax, [ebp - 0x17]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0xac], 0
jne 0x40a2dc
xor ecx, ecx
lea eax, [ebp - 0xac]
push ecx
push eax
mov ecx, esi
call fcn.00407390
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xac]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a2e5
sub ecx, edx
lea eax, [ebp - 0xac]
push ecx
push eax
mov ecx, esi
call fcn.00407390
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret