joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415a25
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004159a1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x415b9d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x415b9d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x415b4c
jg 0x415a7e
test eax, eax
je 0x415b42
push 1
push 0x1000
call fcn.0040fbd3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x415aa4
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x415b39
push 0x8000
push ebx
call fcn.0040ce73
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x415ad0
jg 0x415acb
cmp ecx, 0x1000
jb 0x415ad0
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0040f608
add esp, 0x10
cmp eax, 0xffffffff
je 0x415b15
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x415acb
jl 0x415afc
test ecx, ecx
jne 0x415abd
push dword [ebp - 0xc]
push ebx
call fcn.0040ce73
push esi
call fcn.0040de2b
add esp, 0xc
xor edi, edi
jmp 0x415bae
cmp byte [edi + 0x24], 0
je 0x415b2c
cmp dword [edi + 0x20], 5
jne 0x415b2c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x415b37
mov edi, dword [edi + 0x18]
jmp 0x415b39
xor edi, edi
push esi
call fcn.0040de2b
pop ecx
jmp 0x415bae
test ecx, ecx
jg 0x415b0e
jl 0x415b4c
test eax, eax
jae 0x415b0e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004141bb
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x415b6f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x415b0e
jmp 0x415ba6
push ebx
call fcn.0041197e
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x415b0e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x415bae
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x415bab
mov edi, dword [edi + 0x18]
jmp 0x415bae
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004141bb
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x417e80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x417ead
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x417ead
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401d02
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401d41
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401d41
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401d41
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401d41
cmp dword [ecx + 0x74], 0xe
jbe 0x401d41
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4088e1
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43bb90
push 0x43bb88
push str.FlsAlloc
push 0x1e
call fcn.004087a2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408915
push dword [ebp + 8]
mov ecx, esi
call dword [0x412130]
call esi
jmp 0x40891b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40895f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43bba0
push 0x43bb98
push str.FlsGetValue
push 0x20
call fcn.004087a2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408996
push dword [ebp + 8]
mov ecx, esi
call dword [0x412130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40a9eb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40aa88
push ebx
push esi
call fcn.0040a9b4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a8fd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40aa35
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40aa87
push edi
push eax
call fcn.004085a5
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40aa55
call fcn.00406222
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40aa86
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a8fd
add esp, 0x20
test eax, eax
jne 0x40aa74
push edi
call fcn.00406222
jmp 0x40aa7c
push ebx
call fcn.00406222
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40d7a2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x442178]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40d7e2
cmp byte [ebx], 0xa
jne 0x40d7e2
or byte [eax + edi + 0x28], 4
jmp 0x40d7e7
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x40d8e5
mov al, byte [edx]
cmp al, 0x1a
je 0x40d8c7
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x40d816
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x40d83b
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x40d845
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x40d7f8
jmp 0x40d8e5
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d8c2
cmp dword [ebp - 0xc], 0
je 0x40d8c2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x442178]
test byte [eax + edi + 0x28], 0x48
je 0x40d89c
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x40d887
mov byte [esi], dl
jmp 0x40d898
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x442178]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x40d8e5
cmp byte [ebp - 1], 0xa
jne 0x40d8ab
cmp esi, ebx
jne 0x40d8ab
mov byte [esi], 0xa
jmp 0x40d8e4
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040d59b
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x40d8e5
mov byte [esi], 0xd
jmp 0x40d8e4
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x442178]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x40d8e1
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x40d8e5
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40d8ee
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x442178]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40d931
cmp word [esi], dx
jne 0x40d931
or byte [edi + eax + 0x28], 4
jmp 0x40d936
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x40da89
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x40da69
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x40d978
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x40d9ae
cmp eax, edx
jae 0x40d9ba
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x40d950
jmp 0x40da89
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40da65
cmp dword [ebp - 0x14], 0
je 0x40da65
mov eax, dword [ebx*4 + 0x442178]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x40da3d
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x40da06
mov word [esi], cx
jmp 0x40da39
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x442178]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x442178]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x442178]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x40da89
pop ebx
cmp word [ebp - 4], bx
jne 0x40da4e
cmp esi, dword [ebp + 0xc]
jne 0x40da4e
mov word [esi], bx
jmp 0x40da86
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040d59b
add esp, 0x10
cmp word [ebp - 4], bx
je 0x40da89
push 0xd
jmp 0x40da82
mov ecx, dword [ebx*4 + 0x442178]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x40da80
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x40da89
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40f435
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0040f3b1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x40f5ad
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x40f5ad
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x40f55c
jg 0x40f48e
test eax, eax
je 0x40f552
push 1
push 0x1000
call fcn.00409787
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40f4b4
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x40f549
push 0x8000
push ebx
call fcn.004058fb
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x40f4e0
jg 0x40f4db
cmp ecx, 0x1000
jb 0x40f4e0
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00408028
add esp, 0x10
cmp eax, 0xffffffff
je 0x40f525
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x40f4db
jl 0x40f50c
test ecx, ecx
jne 0x40f4cd
push dword [ebp - 0xc]
push ebx
call fcn.004058fb
push esi
call fcn.00406222
add esp, 0xc
xor edi, edi
jmp 0x40f5be
cmp byte [edi + 0x24], 0
je 0x40f53c
cmp dword [edi + 0x20], 5
jne 0x40f53c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x40f547
mov edi, dword [edi + 0x18]
jmp 0x40f549
xor edi, edi
push esi
call fcn.00406222
pop ecx
jmp 0x40f5be
test ecx, ecx
jg 0x40f51e
jl 0x40f55c
test eax, eax
jae 0x40f51e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0040d59b
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40f57f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x40f51e
jmp 0x40f5b6
push ebx
call fcn.0040b2ae
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x40f51e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x40f5be
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x40f5bb
mov edi, dword [edi + 0x18]
jmp 0x40f5be
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0040d59b
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x411890
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4118bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4118bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x25814460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2581446f
pop dword [ebp - 0x48]
mov eax, 0x1ca015d
sub eax, 0xdc48bcee
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x20c94b5
add dword [ebp - 0x58], 0x4c45b096
mov dword [ebp - 0x54], 0xbc9b512b
sub dword [ebp - 0x54], 0x8a6804e6
mov dword [ebp - 0x50], 0x54af7b62
sub dword [ebp - 0x50], 0x8633734
mov dword [ebp - 0x4c], 0x1d8b1cee
add dword [ebp - 0x4c], 0xe274e312
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xdf42d009
add dword [ebp - 0x58], 0x952f994d
mov dword [ebp - 0x54], 0x2a2a7793
add dword [ebp - 0x54], 0x1741e9e2
mov dword [ebp - 0x50], 0x531a250
add dword [ebp - 0x50], 0x5e3dca1c
mov dword [ebp - 0x4c], 0x3d4b9b67
add dword [ebp - 0x4c], 0xc2b46499
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xd3b1d
add eax, 0x25749563
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3f295
push 0
call eax
mov ecx, 0xc66e12a3
add ecx, 0x39923fd1
xor esi, esi
add esi, eax
mov edi, 0x25829600
add edi, dword [ebp - 0x48]
mov edx, 0x3edd6b1d
sub edx, 0x57c1e9a8
mov dword [ebp - 0x3c], 0xffab7c0d
mov ebx, dword [edi]
xor ebx, edx
add dword [ebp - 0xc], edi
mov dword [esi], ebx
xor dword [ebp - 0x28], esi
add esi, 4
add edi, 0x6d6e51b3
sub edi, 0x6d6e51af
loop 0x25814588
add eax, 0x13ca3
xor ebx, ebx
add ebx, eax
add eax, 0x40122711
add eax, 0xbfedd8f4
mov ecx, 0x47e1f0ed
add ecx, 0xdd9e0f13
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x44edd1
Capabilities:
Encode data using xor

Disassembly:
invalid
push ebx
leave
sub eax, 0x88be9e32
stosd dword es:[edi], eax
sti
mov es, ebx
lodsd eax, dword [esi]
loopne 0x44edc9
ret
test byte [edi], al
mov al, byte [0xbece7bfe]
out 0xf3, eax
and dword [edi], edi
loopne 0x44eddb
call 0x3927201f
xor bl, byte [ebx]
sbb eax, eax
dec esi
nop
and ebp, ebx
mov bl, 0xcb
and dl, ch
jmp 0x44ee35
push ebx
neg dword [ebp + 0x3ac1e2d0]
salc
xor dword fs:[ebp + 0xc], ebp
scasd eax, dword es:[edi]
pop ds
mov eax, dword [0x1adfe922]
inc esp
push es
lds esi, [ebx + 0x36]
invalid
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x401c66
pop dword [ebp - 0x48]
mov eax, 0x401c66
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x5ad92267
add dword [ebp - 0x58], 0xf37922e4
mov dword [ebp - 0x54], 0xe03671d1
add dword [ebp - 0x54], 0x51fcda74
mov dword [ebp - 0x50], 0x4fe7427a
add dword [ebp - 0x50], 0xfc6501b4
mov dword [ebp - 0x4c], 0x7c9e20ab
add dword [ebp - 0x4c], 0x8361df55
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xab8e730b
sub dword [ebp - 0x58], 0x371c09b5
mov dword [ebp - 0x54], 0x9f44705d
add dword [ebp - 0x54], 0xa227f118
mov dword [ebp - 0x50], 0xf39e5f7f
add dword [ebp - 0x50], 0x6fd10ced
mov dword [ebp - 0x4c], 0x8a647ac2
sub dword [ebp - 0x4c], 0x8a647ac2
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xeccf0301
sub eax, 0xec8ed2d5
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x33ba6
push 0
call eax
mov ecx, 0x3cb826d0
sub ecx, 0x3cb7e9d3
xor esi, esi
add esi, eax
mov edx, 0x8dd9f89b
sub edx, 0x8d99889b
add edx, dword [ebp - 0x48]
mov ebx, 0x83d82874
add dword [ebp - 0x28], edi
mov edi, dword [edx]
add dword [ebp - 0x38], esi
xor edi, ebx
mov dword [esi], edi
xor dword [ebp - 0x24], 0x6f1953ae
add esi, 0xc7d6785e
sub esi, 0xc7d6785a
add edx, 0x2bf4348e
add edx, 0xd40bcb76
loop 0x401d7a
add eax, 0x5e51d6bb
add eax, 0xa1af100c
xor ebx, ebx
add ebx, eax
add eax, 0x4953e9f4
add eax, 0xb6ac1611
mov ecx, 0xb7a47cbe
add ecx, 0x489b8342
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1000269d
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x100026eb
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x100026fc
push 0xd
pop eax
jmp 0x10002726
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x100026ff
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x10002cb1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1002b19c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.1001dca7
mov ebx, eax
cmp ebx, esi
je 0x10002d24
lea ecx, [ebp - 0x74]
call fcn.1000133f
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c2c7
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x10002d3c
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.10002cb1
cmp eax, esi
jne 0x10002d6e
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x10002d2c
lea ecx, [ebp - 0x74]
call fcn.1000133f
push dword [ebp - 0x78]
mov ecx, edi
call fcn.100025c6
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.1000133f
mov eax, esi
jmp 0x10002d0a
Function at 0x10005086
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8f4]
sub esp, 0x974
mov eax, dword [0x1002b19c]
xor eax, ebp
mov dword [ebp + 0x8f0], eax
push ebx
mov ebx, dword [ebp + 0x914]
push esi
mov esi, dword [ebp + 0x8fc]
push edi
mov edi, 0x400
test ebx, ebx
jne 0x100050d8
push edi
lea eax, [ebp - 0x14]
push eax
push 1
push esi
call fcn.1001dca7
add esp, 0x10
test eax, eax
je 0x100050d8
lea eax, [ebp - 0x14]
push eax
push str._s_ssvagent.exe
jmp 0x100050ee
test esi, esi
jne 0x10005226
test ebx, ebx
je 0x10005226
push ebx
push str._s_bin_ssvagent.exe
lea eax, [ebp + 0x3ec]
push edi
push eax
call fcn.1001dca7
add esp, 0x10
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp + 0x3ec]
push eax
call fcn.1001dca7
pop ecx
pop ecx
test eax, eax
jne 0x10005226
xor edi, edi
mov byte [ebp + 0x7ec], al
mov esi, 0x104
lea eax, [ebp + 0x7ec]
cmp dword [ebp + 0x900], edi
je 0x1000513a
push str.__new
jmp 0x1000513f
push str.__old
push esi
push eax
call fcn.1001dca7
add esp, 0xc
cmp dword [ebp + 0x904], edi
jne 0x10005159
cmp dword [ebp + 0x910], edi
je 0x1000516e
push str.__high
lea eax, [ebp + 0x7ec]
push esi
push eax
call fcn.1001dca7
add esp, 0xc
cmp dword [ebp + 0x90c], edi
je 0x1000518b
push str.__settreatas
lea eax, [ebp + 0x7ec]
push esi
push eax
call fcn.1001dca7
add esp, 0xc
cmp dword [ebp + 0x910], edi
je 0x100051a8
push str.__regdeploy
lea eax, [ebp + 0x7ec]
push esi
push eax
call fcn.1001dca7
add esp, 0xc
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.1000c3a0
add esp, 0xc
lea eax, [ebp + 0x7ec]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x6c], eax
cmp dword [ebp + 0x904], edi
je 0x100051dd
call fcn.1001dca7
test eax, eax
je 0x100051dd
mov dword [ebp - 0x74], str.runas
cmp dword [ebp + 0x908], edi
je 0x100051ec
mov dword [ebp - 0x7c], 0x40
lea eax, [ebp + 0x3ec]
mov dword [ebp - 0x70], eax
xor esi, esi
lea eax, [ebp - 0x80]
inc esi
push eax
mov dword [ebp - 0x64], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x10005226
cmp dword [ebp - 0x48], edi
je 0x10005222
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
jmp 0x10005228
xor eax, eax
mov ecx, dword [ebp + 0x8f0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c2c7
add ebp, 0x8f4
leave
ret
Function at 0x1000533d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8d0]
sub esp, 0x950
mov eax, dword [0x1002b19c]
xor eax, ebp
mov dword [ebp + 0x8cc], eax
mov eax, dword [ebp + 0x8d8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x3ff
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x4cd]
push ebx
push eax
mov byte [ebp + 0x4cc], bl
call fcn.1000c3a0
add esp, 0xc
mov dword [ebp - 0x78], ebx
mov edi, 0x1002b10c
mov esi, 0x400
cmp dword [ebp - 0x78], ebx
jne 0x1000545f
push dword [ebp - 0x80]
lea eax, [ebp + 0xcc]
push esi
push eax
mov byte [ebp + 0xcc], bl
call fcn.1001dca7
push 0x10024474
lea eax, [ebp + 0xcc]
push esi
push eax
call fcn.1001dca7
push dword [edi]
lea eax, [ebp + 0xcc]
push esi
push eax
call fcn.1001dca7
add esp, 0x24
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xcc]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
je 0x10005450
push dword [ebp - 0x80]
lea eax, [ebp + 0x4cc]
push esi
push eax
mov byte [ebp + 0x4cc], bl
call fcn.1001dca7
push 0x10024478
lea eax, [ebp + 0x4cc]
push esi
push eax
call fcn.1001dca7
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x4cc]
push esi
push eax
call fcn.1001dca7
lea eax, [ebp + 0x4cc]
push eax
call fcn.100083c7
add esp, 0x28
test eax, eax
je 0x10005449
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x100053ea
jmp 0x10005450
mov dword [ebp - 0x78], 1
add edi, 4
cmp edi, 0x1002b118
jl 0x1000538e
push dword [ebp - 0x7c]
call dword [sym.imp.kernel32.dll_FindClose]
mov ecx, dword [ebp + 0x8cc]
mov eax, dword [ebp - 0x78]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c2c7
add ebp, 0x8d0
leave
ret