joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d2261
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100d21dd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100d23d0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100d23d0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100d2385
jg 0x100d22bd
test eax, eax
je 0x100d237b
push 1
push 0x1000
call fcn.100c2c74
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100d22e0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100d2372
push 0x8000
push ebx
call fcn.100d210e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100d2309
jg 0x100d2304
cmp ecx, 0x1000
jb 0x100d2309
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100c40d4
add esp, 0x10
cmp eax, 0xffffffff
je 0x100d234e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100d2304
jl 0x100d2335
test ecx, ecx
jne 0x100d22f6
push dword [ebp - 0xc]
push ebx
call fcn.100d210e
push esi
call fcn.100c2cd1
add esp, 0xc
xor ebx, ebx
jmp 0x100d23de
cmp byte [edi + 0x24], 0
je 0x100d2365
cmp dword [edi + 0x20], 5
jne 0x100d2365
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100d2370
mov ebx, dword [edi + 0x18]
jmp 0x100d2372
xor ebx, ebx
push esi
call fcn.100c2cd1
pop ecx
jmp 0x100d23de
test ecx, ecx
jg 0x100d2347
jl 0x100d2385
test eax, eax
jae 0x100d2347
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100c038a
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100d23a5
cmp byte [edi + 0x1c], 0
je 0x100d2347
jmp 0x100d23d6
push ebx
call fcn.100cb8f6
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100d2347
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100d23de
cmp byte [edi + 0x1c], 0
je 0x100d23db
mov ebx, dword [edi + 0x18]
jmp 0x100d23de
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100c038a
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100d3230
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100d325d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100d325d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403804
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x40382d
cmp al, 0x22
je 0x403825
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403819
cmp byte [esi], 0x22
jne 0x403837
inc esi
jmp 0x403837
cmp al, 0x20
jle 0x403837
inc esi
cmp byte [esi], 0x20
jg 0x403831
mov al, byte [esi]
test al, al
je 0x403841
cmp al, 0x20
jle 0x40382a
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004038af
push 0x405004
push section..data
call fcn.00403895
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x403871
movzx eax, word [ebp - 0x14]
jmp 0x403874
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004038c7
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x407da7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareDeskSoft
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x407dd1
xor al, al
jmp 0x407dff
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop esi
leave
ret

Function at 0x407ea6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwareDeskSoft
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407ef4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call esi
cmp dword [ebp - 4], ebx
jne 0x407efb
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 4]
xor eax, eax
inc eax
push eax
call fcn.00418e1c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x407eeb
lea eax, [ebp - 4]
push eax
push edi
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
je 0x407f2b
push edi
call fcn.00418d70
pop ecx
jmp 0x407eeb
mov esi, dword [ebp + 0xc]
mov eax, 0x530
cmp dword [ebp - 4], eax
cmovb eax, dword [ebp - 4]
push eax
push edi
push esi
call fcn.0040f510
push edi
call fcn.00418d70
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
cmp word [esi], ax
sete al
jmp 0x407ef6

Function at 0x407fb3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
push ebx
push esi
push 0x426bc4
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x408022
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x408021
lea eax, [edi + 1]
push eax
push 1
call fcn.00418e1c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x408021
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408018
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x408018
push edi
push eax
push esi
call fcn.0040f510
add esp, 0xc
jmp 0x408021
push esi
call fcn.00418d70
xor esi, esi
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x10062f62
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x79e7d2af
mov dword [esp + 4], 0xb52a0184
mov dword [esp], 0x8923c1ed
jmp 0x100682f6
pushfd
push 0x1f52625d
mov dword [esp + 8], 0x33f25ada
mov byte [esp + 4], bh
lea esp, [esp + 8]
jmp 0x1007845a
mov word [esp], 0x7831
xchg dword [esp + 0x14], ecx
bswap bx
movsx bx, dl
pushfd
lea ebp, [edi - 0x56db3f15]
xchg dword [esp + 0x14], esi
lea esp, [esp + 0x14]
pushal
xchg dword [esp + 0x1c], ebp
movsx bp, bl
push ecx
mov dword [esp + 0x1c], ebx
movsx bx, bl
jmp 0x10079728
setno bl
mov dword [esp + 0x18], esi
mov bl, byte [esp]
jmp 0x10077c4f

Function at 0x1006300a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x40], 0x30698962
push ebx
push 0xdf5f17ae
lea esp, [esp + 0x48]
jmp 0x10077819
pushfd
mov dword [esp], ebp
jnp 0x1007848d
pushfd
pushfd
mov dword [esp + 4], ebx
push ebp
pushfd
pushfd
pushfd
mov dword [esp + 0x10], esi
jmp 0x10078d3c
mov dword [esp + 0x44], esi
pushfd
pushfd
lea esp, [esp + 0x4c]
jmp 0x10077c6f
pushfd
push esp
jmp 0x10077cf4
jmp 0x10078b17
mov dword [esp + 0x40], ecx
jmp 0x10078471
pushal
mov dword [esp + 0x1c], ebx
pushfd
pushal
pushfd
pushfd
mov dword [esp + 0x44], esi
jmp 0x100788cf
mov dword [esp + 0xc], ecx
pushfd
call fcn.10078706

Function at 0x1007861f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp]
mov dword [esp + 0x28], esi
push 0x914cd076
push dword [esp + 4]
pushfd
mov dword [esp + 4], 0xd692be52
lea esp, [esp + 0x34]
jmp 0x10077c6f
jmp 0x10077e94

Function at 0x10078706
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x10], esi
pushal
push 0x108f2581
mov byte [esp + 4], dh
pushfd
lea esp, [esp + 0x38]
jmp 0x10077c6f

Function at 0x10079638
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec cl
movzx eax, al
bswap ecx
mov ecx, dword [eax*4 + 0x10077fdb]
pushfd
pushfd
inc ecx
pushfd
call fcn.10077d76
Function at 0x10063f34
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x2c]
jne 0x10077a6a
jmp 0x10066a81
mov al, ch
mov al, 0x31
mov byte [edi - 1], 0
mov ax, 0xe712
pushfd
not ax
mov dword [esp], ebx
movzx ax, cl
mov ax, 0xbd8d
lea eax, [eax - 0x5c285a2]
lea eax, [0x10077288]
push 0xd24c8398
push 0xd2e4d8a2
mov dword [esp + 4], 0x100664b6
call fcn.10066c1e
dec edi
jno 0x10066a65
sub al, 0x42
das
lodsb al, byte [esi]
dec edi
jne 0x10066aca
pop esp
dec eax
dec eax
sbb ecx, dword [edx]
aas
push cs
lcall 0xf268, 0xbccd5db0
movsb byte es:[edi], byte [esi]
pop es
mov esp, 0xf6a41628
lodsb al, byte [esi]
loope 0x10066b57
adc eax, 0x5d736a18
jecxz 0x10066aca
sbb byte [ebp + ebp*8 + 0x3b5262cb], al
xlatb
adc dword [ecx - 0x5044db4f], eax
wait
or bh, byte [edi + 0x46]
mov ecx, dword [edx - 0x1964a622]
fcmovne st(0), st(5)
mov al, 0xf2
jl 0x10066acb
and dword [eax + 0x76], ebx
adc dword [eax], edi
mov edi, 0xc7fc49f9
movsd dword es:[edi], dword [esi]
fdiv qword [esi + 0x5080a6a0]
push esp
fmul dword [ebx - 0x90f9d50]
mov ch, 0x76
or byte [edi + 0xc0a7c41], al
sub bh, byte [ebx - 0x6d2acc37]
dec edx
sar al, cl
mov bl, 0xdf
invalid
pop ecx
aad 0xde
xor al, ah
shld ax, sp, cl
pop eax
jmp 0x10064115
Function at 0x401320
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x14f8
push 0x27ee
call fcn.00401090
add esp, 8
mov dword [0x409c78], 0x44
push 0x4b8d
push 0x3bd0
push 0
call dword [0x40996c]
mov dword [0x409978], 0x1003f
push 0x249a
push 0x102a
call section..text
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00401150
add esp, 4
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [0x409c44]
mov dword [ebp - 4], 0
jmp 0x4013a5
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [0x409964]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x401434
push 0x72c2
push 0xadb
call fcn.00401060
add esp, 8
mov edx, dword [0x409eec]
mov eax, dword [edx + 0x3c]
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x28
add ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0xf8]
mov dword [0x409960], edx
push 0x1abb
push 0x1ffe
call section..text
add esp, 8
push 0
mov eax, dword [0x409960]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [0x409960]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [0x409964]
mov edx, dword [ecx + 0x34]
mov eax, dword [0x409960]
add edx, dword [eax + 0xc]
push edx
mov ecx, dword [0x409950]
push ecx
call dword [0x409cd4]
jmp 0x40139c
push 0x48d3
push 0x19b
call fcn.00401090
add esp, 8
call fcn.00401280
push 0x4b3f
push 0x6e54
call fcn.00401030
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x40eb50
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
test ecx, ecx
je 0x40eb97
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 4]
and ecx, 0xff
mov edx, dword [ebp - 4]
shr edx, 8
xor edx, dword [ecx*4 + 0x45ef88]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
jmp 0x40eb5d
mov eax, dword [ebp - 4]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x419162
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x467ff4]
jne 0x41916c
repz ret
jmp fcn.00419587
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x3a074aa2
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0xcc974db
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40b470
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4273d4]
jne 0x40b47a
repz ret
jmp fcn.0041167c

Function at 0x41732c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4273d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040e42f
and dword [ebp - 0x14], 0
cmp dword [0x45eeec], 0
mov dword [ebp - 0x18], eax
jne 0x4173df
push 0x4037ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x417487
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4037e0
push ebx
call edi
test eax, eax
je 0x417487
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4037d0
push ebx
mov dword [0x45eeec], eax
call edi
push eax
call esi
push 0x4037bc
push ebx
mov dword [0x45eef0], eax
call edi
push eax
call esi
push 0x4037a0
push ebx
mov dword [0x45eef4], eax
call edi
push eax
call esi
mov dword [0x45eefc], eax
test eax, eax
je 0x4173df
push 0x403788
push ebx
call edi
push eax
call esi
mov dword [0x45eef8], eax
mov eax, dword [0x45eef8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417438
cmp dword [0x45eefc], ecx
je 0x417438
push eax
call esi
push dword [0x45eefc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417438
test ebx, ebx
je 0x417438
call edi
test eax, eax
je 0x41742f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41742f
test byte [ebp - 8], 1
jne 0x417438
or dword [ebp + 0x10], 0x200000
jmp 0x41746b
mov eax, dword [0x45eef0]
cmp eax, dword [ebp - 0x18]
je 0x41746b
push eax
call esi
test eax, eax
je 0x41746b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41746b
mov eax, dword [0x45eef4]
cmp eax, dword [ebp - 0x18]
je 0x41746b
push eax
call esi
test eax, eax
je 0x41746b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45eeec]
call esi
test eax, eax
je 0x417487
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417489
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b470
leave
ret
Function at 0x41f650
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.0041e800
cmp dword [0x7ffc70], 0x37
jne 0x41f6e1
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x40441c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x404428
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
lea edx, [esp + 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x7ffc74]
mov edx, dword [0x7fc0e0]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret
Function at 0x403060
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x4e2e58]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x40
push 0
lea eax, [ebp - 0x88]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x40
push 0
lea ecx, [ebp - 0x48]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x14
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x88]
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0xc
push 0x14
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x48]
push edx
call sub.MSVCR120.dll_memcpy
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4030cf
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x40
jge 0x403101
mov ecx, dword [ebp - 4]
movzx edx, byte [ebp + ecx - 0x88]
xor edx, 0x36
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x88], dl
mov ecx, dword [ebp - 4]
movzx edx, byte [ebp + ecx - 0x48]
xor edx, 0x5c
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x48], dl
jmp 0x4030c6
lea ecx, [ebp - 0xe8]
push ecx
call fcn.004051d0
add esp, 4
push 0x40
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0xe8]
push eax
call fcn.00405220
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xe8]
push eax
call fcn.00405220
add esp, 0xc
lea ecx, [ebp - 0xe8]
push ecx
call fcn.00406fc0
add esp, 4
push 0x14
lea edx, [ebp - 0xd0]
push edx
mov eax, dword [ebp + 0x14]
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0xe8]
push ecx
call fcn.004051d0
add esp, 4
push 0x40
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0xe8]
push eax
call fcn.00405220
add esp, 0xc
push 0x14
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0xe8]
push edx
call fcn.00405220
add esp, 0xc
lea eax, [ebp - 0xe8]
push eax
call fcn.00406fc0
add esp, 4
push 0x14
lea ecx, [ebp - 0xd0]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call sub.MSVCR120.dll_memcpy
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00499036
mov esp, ebp
pop ebp
ret
Function at 0x403e30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x4b4980]
mov byte [edx], al
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 1]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x4b4980]
mov byte [eax + 1], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 2]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4b4980]
mov byte [ecx + 2], dl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 3]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x4b4980]
mov byte [edx + 3], al
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x4b4980]
mov byte [eax + 4], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 5]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4b4980]
mov byte [ecx + 5], dl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 6]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x4b4980]
mov byte [edx + 6], al
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 7]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x4b4980]
mov byte [eax + 7], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 8]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4b4980]
mov byte [ecx + 8], dl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 9]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x4b4980]
mov byte [edx + 9], al
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xa]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x4b4980]
mov byte [eax + 0xa], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xb]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4b4980]
mov byte [ecx + 0xb], dl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xc]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x4b4980]
mov byte [edx + 0xc], al
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xd]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x4b4980]
mov byte [eax + 0xd], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xe]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x4b4980]
mov byte [ecx + 0xe], dl
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xf]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x4b4980]
mov byte [edx + 0xf], al
pop ebp
ret