joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e3e0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, edx
push esi
xor esi, esi
push ebx
mov ebx, eax
mov byte [eax], 0
mov eax, dword [0x445430]
cmp dword [0x445420], eax
jl 0x41e429
push dword [0x4453d0]
mov dword [0x445420], 0
push dword [0x43eec0]
push 1
push 0x445440
call sub.msvcrt.dll_fread
mov dword [0x445430], eax
add esp, 0x10
xor edx, edx
test eax, eax
jle 0x41e43b
mov eax, dword [0x445420]
movsx edx, byte [eax + 0x445440]
inc eax
mov dword [0x445420], eax
movsx edx, dl
test edx, edx
je 0x41e456
cmp edx, 0xa
je 0x41e469
cmp edx, 0xd
je 0x41e3ec
xor ecx, ecx
test dl, dl
je 0x41e3ec
cmp esi, edi
jl 0x41e45a
xor eax, eax
jmp 0x41e472
mov byte [esi + ebx], dl
inc ecx
inc esi
shr edx, 8
cmp ecx, 3
jg 0x41e3ec
jmp 0x41e44e
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
pop edi
ret

Function at 0x41e476
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.KERNEL32.dll_GetFileAttributesA
xor edx, edx
cmp eax, 0xffffffff
je 0x41e48d
test al, 0x10
mov eax, 1
cmovne edx, eax
mov eax, edx
ret

Function at 0x41e755
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x16c
lea ebx, [esp + 0x11c]
push 0x42
push str.SOFTWAREClientsStartMenuInternet_firefox.exe_shellopencommand
push ebx
call sub.msvcrt.dll_memcpy
movzx eax, byte [0x43eec9]
mov byte [esp + 0x18], al
lea eax, [esp + 0x19]
push 0x103
push 0
push eax
call sub.msvcrt.dll_memset
mov dword [esp + 0x1c], 0x104
lea eax, [esp + 0x20]
push eax
push 0x20019
push 0
push ebx
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0x18
xor edx, edx
test eax, eax
jne 0x41e888
lea eax, [esp + 4]
push eax
lea ebx, [esp + 0x10]
push ebx
lea eax, [esp + 8]
push eax
push 0
push 0
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x41e7ea
cmp dword [esp + 4], 0
je 0x41e7ea
cmp byte [esp + 0xc], 0
jne 0x41e801
push dword [esp + 8]
call sub.ADVAPI32.DLL_RegCloseKey
xor edx, edx
jmp 0x41e888
mov byte [esp + eax + 0xc], 0
jmp 0x41e864
push dword [esp + 8]
call sub.ADVAPI32.DLL_RegCloseKey
cmp byte [esp + 0xc], 0x22
jne 0x41e843
cld
or ecx, 0xffffffff
xor eax, eax
mov edi, ebx
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
sub ecx, 2
cmp esi, ecx
jae 0x41e843
movzx eax, byte [esp + edx + 0xd]
or ecx, 0xffffffff
mov edi, ebx
cld
mov byte [esp + edx + 0xc], al
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
sub ecx, 2
cmp edx, ecx
jmp 0x41e824
cld
xor eax, eax
lea ebx, [esp + 0xc]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 2]
test eax, eax
jle 0x41e864
cmp byte [esp + eax + 0xc], 0x5c
je 0x41e7fa
dec eax
jmp 0x41e856
cld
xor eax, eax
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
push ecx
call sub.msvcrt.dll_malloc
mov esi, eax
test esi, esi
pop eax
je 0x41e886
push ebx
push esi
call sub.msvcrt.dll_strcpy
pop ebx
pop edi
mov edx, esi
add esp, 0x16c
mov eax, edx
pop ebx
pop esi
pop edi
ret
Function at 0x41eb28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
sub esp, 0x3c
lea ebx, [esp + 0xc]
push 0x21
push str.SOFTWAREMozillaMozilla_Firefox
push ebx
call sub.msvcrt.dll_memcpy
mov dword [esp + 0x10], 0x104
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push ebx
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x41eb8b
lea eax, [esp + 4]
push eax
push 0x43bd60
lea eax, [esp + 8]
push eax
push 0
push str.CurrentVersion
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [esp + 8]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x3c
xor eax, eax
pop ebx
ret

Function at 0x41eef4
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x1148
call fcn.00434ad0
mov eax, dword [esp + 0x1148]
mov ebp, edx
mov edi, ebp
mov dword [esp + 8], eax
push 0x800
lea esi, [esp + 0x810]
push esi
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push ebp
push ebp
push dword [esp + 0x10]
push str._s_s_s.exe
lea ebx, [esp + 0x1c]
push ebx
call sub.msvcrt.dll_sprintf
push 0
push ebx
or ebx, 0xffffffff
push esi
call sub.KERNEL32.dll_CopyFileA
cld
xor eax, eax
mov ecx, ebx
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x1c]
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub ecx, edx
push ecx
call sub.msvcrt.dll_malloc
mov dword [esp + 0x18], eax
push ebp
push dword [esp + 0x24]
push str._s_s
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x28
lea eax, [esp + 0x100c]
push eax
push dword [esp + 4]
call sub.KERNEL32.dll_FindFirstFileA
mov dword [esp + 4], eax
test eax, eax
je 0x41f07b
inc eax
je 0x41f07b
push 0x440157
lea eax, [esp + 0x103c]
push eax
call sub.msvcrt.dll_strcmp
pop ebx
test eax, eax
pop esi
je 0x41f059
push 0x440159
lea ecx, [esp + 0x103c]
push ecx
call sub.msvcrt.dll_strcmp
pop edx
test eax, eax
pop ecx
je 0x41f059
test byte [esp + 0x100c], 0x10
je 0x41f059
cld
xor edx, edx
or esi, 0xffffffff
mov al, dl
mov ecx, esi
mov edi, ebp
repne scasb al, byte es:[edi]
mov edi, dword [esp + 8]
mov ebx, ecx
mov ecx, esi
not ebx
repne scasb al, byte es:[edi]
not ecx
add ecx, ebx
push ecx
call sub.msvcrt.dll_malloc
push ebp
mov esi, eax
push dword [esp + 0x10]
push str._s_s_
push eax
call sub.msvcrt.dll_sprintf
lea eax, [esp + 0x104c]
push eax
push ebp
push dword [esp + 0x24]
push str._s_s_s.exe
lea ebx, [esp + 0x30]
push ebx
call sub.msvcrt.dll_sprintf
add esp, 0x28
push 0
push ebx
lea eax, [esp + 0x814]
push eax
call sub.KERNEL32.dll_CopyFileA
lea edx, [esp + 0x1038]
mov eax, esi
call fcn.0041eef4
push esi
call fcn.0043aa78
pop eax
lea eax, [esp + 0x100c]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x41ef9d
push dword [esp + 4]
call sub.KERNEL32.dll_FindClose
push dword [esp]
call fcn.0043aa78
add esp, 0x1150
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41f114
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, esp
push eax
push 0x20019
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x41f153
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x41f153
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
pop edx
ret

Function at 0x41f207
Capabilities:
Set registry value

Disassembly:
push edi
push eax
mov eax, esp
push eax
push 0x20006
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x41f262
cld
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push dword [esp + 0x1c]
push 1
push 0
push dword [esp + 0x24]
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
mov edi, eax
je 0x41f258
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, edi
jmp 0x41f262
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
pop edi
pop edi
ret

Function at 0x41f265
Capabilities:
Delete registry value

Disassembly:
push ecx
mov eax, esp
push eax
push 2
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x41f299
push dword [esp + 0x10]
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
test eax, eax
jne 0x41f299
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
pop edx
ret

Function at 0x41f820
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
lea eax, [ebx - 1]
cmp eax, 8
jbe 0x41f83d
push str.bad_pack_level
call fcn.0042162d
pop eax
push 0x10000
push 0
push 0x488528
mov dword [0x447cc0], ebx
call sub.msvcrt.dll_memset
movzx eax, word [ebx*8 + 0x43bea2]
add esp, 0xc
cmp ebx, 1
mov dword [0x447cb0], eax
movzx eax, word [ebx*8 + 0x43bea0]
mov dword [0x44b958], eax
movzx eax, word [ebx*8 + 0x43bea4]
mov dword [0x44b978], eax
movzx eax, word [ebx*8 + 0x43bea6]
mov dword [0x44b948], eax
jne 0x41f898
movzx eax, word [esi]
or eax, 4
jmp 0x41f8a3
cmp ebx, 9
jne 0x41f8a6
movzx eax, word [esi]
or eax, 2
mov word [esi], ax
push 0x10000
push 0x458268
mov dword [0x44b928], 0
mov dword [0x44b968], 0
call dword [0x44b908]
pop ebx
mov ecx, eax
test eax, eax
mov dword [0x447ca0], eax
sete al
cmp ecx, 0xffffffff
pop esi
sete dl
or eax, edx
test al, 1
je 0x41f8fa
mov dword [0x447c90], 1
mov dword [0x447ca0], 0
jmp 0x41f952
mov dword [0x447c90], 0
cmp ecx, 0x105
ja 0x41f926
call fcn.0041f71c
cmp dword [0x447ca0], 0x105
ja 0x41f926
cmp dword [0x447c90], 0
je 0x41f90c
mov dword [0x447c80], 0
xor ecx, ecx
xor edx, edx
movzx eax, byte [ecx + 0x458268]
shl edx, 5
inc ecx
xor edx, eax
and edx, 0x7fff
cmp ecx, 1
jbe 0x41f934
mov dword [0x447c80], edx
pop ebx
pop esi
ret
Function at 0x421500
Capabilities:
Hash data with crc32

Disassembly:
push ebx
or edx, 0xffffffff
mov ebx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test ebx, ebx
je 0x421530
mov edx, dword [0x43c620]
test ecx, ecx
je 0x421530
movzx eax, byte [ebx]
inc ebx
xor al, dl
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x43c220]
dec ecx
jmp 0x421518
pop ebx
mov dword [0x43c620], edx
not edx
mov eax, edx
ret

Function at 0x424e08
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, eax
push ebx
cmp dword [eax + 0x14], 0xcc
je 0x424e2d
mov eax, dword [eax + 0x180]
push esi
call dword [eax]
pop ebx
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
je 0x424e99
mov ecx, dword [esi + 0x60]
cmp dword [esi + 0x78], ecx
jae 0x424e7b
mov edx, dword [esi + 8]
test edx, edx
je 0x424e55
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x78]
mov dword [edx + 4], eax
push esi
call dword [edx]
pop ecx
push 0
lea eax, [esi + 0x78]
mov edx, dword [esi + 0x184]
push eax
mov ebx, dword [esi + 0x78]
push 0
push esi
call dword [edx + 4]
mov eax, dword [esi + 0x78]
add esp, 0x10
cmp eax, ebx
je 0x424ea6
mov ecx, dword [esi + 0x60]
cmp eax, ecx
jmp 0x424e3f
push esi
mov eax, dword [esi + 0x180]
call dword [eax + 4]
push esi
mov eax, dword [esi + 0x180]
call dword [eax]
pop eax
mov dword [esi + 0x78], 0
pop edx
jmp 0x424e2d
cmp byte [esi + 0x41], 0
mov eax, 0xce
jne 0x424eaf
jmp 0x424eaa
xor eax, eax
jmp 0x424eb7
mov eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
pop ebx
pop esi
ret

Function at 0x424eba
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp dword [ebx + 0x14], 0xca
jne 0x424eed
push ebx
call fcn.0042c7c4
cmp byte [ebx + 0x40], 0
pop eax
je 0x424ee6
mov dword [ebx + 0x14], 0xcf
mov eax, 1
jmp 0x424f88
mov dword [ebx + 0x14], 0xcb
mov eax, dword [ebx + 0x14]
cmp eax, 0xcb
jne 0x424f62
mov eax, dword [ebx + 0x190]
cmp byte [eax + 0x10], 0
je 0x424f53
mov eax, dword [ebx + 8]
test eax, eax
je 0x424f0e
push ebx
call dword [eax]
pop eax
mov eax, dword [ebx + 0x190]
push ebx
call dword [eax]
mov edx, eax
test edx, edx
pop eax
je 0x424f5e
cmp edx, 2
je 0x424f53
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x424f03
cmp edx, 3
sete al
dec edx
sete dl
or eax, edx
test al, 1
je 0x424f03
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
inc eax
mov dword [ecx + 4], eax
cmp eax, edx
jl 0x424f03
add edx, dword [ebx + 0x11c]
mov dword [ecx + 8], edx
jmp 0x424f03
mov eax, dword [ebx + 0x7c]
mov dword [ebx + 0x84], eax
jmp 0x424f7e
xor eax, eax
jmp 0x424f88
cmp eax, 0xcc
je 0x424f7e
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, dword [ebx]
push ebx
call dword [eax]
pop eax
mov eax, ebx
call fcn.00424e08
movzx eax, al
pop ebx
ret
Function at 0x425b92
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
push ecx
push ecx
mov esi, dword [esp + 0x14]
mov dword [esi + 4], 0
push esi
call fcn.00425db2
mov dword [esp + 4], eax
push 0x54
push esi
call fcn.00425d6c
add esp, 0xc
test eax, eax
mov ebx, eax
jne 0x425bd9
push esi
call fcn.00425db5
mov eax, dword [esi]
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0x36
mov eax, dword [esi]
push esi
call dword [eax]
pop eax
pop edx
mov dword [ebx + 0x30], 0x3b9aca00
mov eax, dword [esp]
mov dword [esi + 4], ebx
mov dword [ebx], fcn.0042519b
mov dword [ebx + 4], fcn.004252b7
mov dword [ebx + 8], fcn.0042534c
mov dword [ebx + 0xc], fcn.004253dd
mov dword [ebx + 0x10], 0x42547f
mov dword [ebx + 0x14], 0x4254e7
mov dword [ebx + 0x18], 0x42554f
mov dword [ebx + 0x1c], 0x42581a
mov dword [ebx + 0x20], 0x42594c
mov dword [ebx + 0x24], fcn.00425a75
mov dword [ebx + 0x28], 0x425b5b
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0x54
push str.JPEGMEM
call sub.msvcrt.dll_getenv
pop esi
test eax, eax
mov edx, eax
je 0x425cc1
mov byte [esp + 7], 0x78
lea eax, [esp + 7]
push eax
lea eax, [esp + 4]
push eax
push str._ld_c
push edx
call sub.msvcrt.dll_sscanf
add esp, 0x10
test eax, eax
jle 0x425cc1
movzx eax, byte [esp + 7]
cmp al, 0x6d
sete dl
cmp al, 0x4d
sete al
or eax, edx
test al, 1
je 0x425cb7
imul eax, dword [esp], 0x3e8
mov dword [esp], eax
imul eax, dword [esp], 0x3e8
mov dword [ebx + 0x2c], eax
pop ecx
pop ebx
pop ebx
pop esi
ret
Function at 0x431def
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov edi, dword [eax + 0x1a8]
cmp dword [eax + 0x4c], 1
jne 0x431e12
mov dword [esp + 8], 0x1fe
mov byte [edi + 0x1c], 1
jmp 0x431e1e
mov dword [esp + 8], 0
mov byte [edi + 0x1c], 0
push dword [esi + 0x64]
mov eax, dword [esi + 4]
mov edx, dword [esp + 0xc]
add edx, 0x100
push edx
push 1
push esi
call dword [eax + 8]
mov dword [esp + 0x28], 0
mov dword [edi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x20], eax
add esp, 0x10
mov edx, dword [esp + 0x18]
cmp edx, dword [esi + 0x64]
jge 0x431f2f
mov eax, dword [esp + 0x18]
mov eax, dword [edi + eax*4 + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
cdq
idiv dword [esp + 0x14]
cmp dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
je 0x431e89
mov eax, dword [edi + 0x18]
mov edx, dword [esp + 0x18]
add dword [eax + edx*4], 0xff
mov dword [esp + 0xc], 0
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x18]
mov ebp, dword [eax + edx*4]
mov eax, dword [esp + 0x14]
dec eax
push eax
mov eax, esi
push 0
mov edx, dword [esp + 0x20]
call fcn.00431dd4
pop ebx
xor ebx, ebx
pop edx
mov dword [esp], 0
cmp ebx, eax
jle 0x431ee1
inc dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 4]
add dword [esp], edx
dec eax
push eax
mov eax, esi
push dword [esp + 0x10]
mov edx, dword [esp + 0x20]
call fcn.00431dd4
pop edx
pop ecx
jmp 0x431eb9
movzx edx, byte [esp]
mov byte [ebp + ebx], dl
inc ebx
cmp ebx, 0xff
jle 0x431eb9
cmp dword [esp + 8], 0
je 0x431f1f
mov ebx, 1
lea edx, [ebp - 1]
movzx eax, byte [ebp]
mov byte [edx], al
dec edx
movzx eax, byte [ebp + 0xff]
mov byte [ebp + ebx + 0xff], al
inc ebx
cmp ebx, 0xff
jle 0x431f01
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, dword [esi + 0x64]
jmp 0x431e51
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x434240
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00434ad0
call fcn.004343f0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x434278
jmp 0x434314
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x434277
cmp cl, 0x22
je 0x4342d0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test edx, eax
je 0x4342f0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x4342f0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test edx, eax
jne 0x4342b0
jmp 0x4342f0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test edx, eax
jne 0x4342d0
cmp cl, 0x22
je 0x434350
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x43430e
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
sete dl
cmp al, 9
sete al
or eax, edx
test al, 1
jne 0x434300
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x434332
movzx edx, word [ebp - 0x28]
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041b694
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x4342f0

Function at 0x434410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov edx, 0x17
mov ebp, esp
push ebx
sub esp, 0x14
lea ebx, [ebp + 0xc]
mov dword [esp + 8], edx
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], str.Mingw_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x434470
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov ebx, eax
test edi, edi
mov dword [ebp - 8], esi
mov esi, edx
jne 0x434497
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], ebx
mov eax, 0x1c
mov dword [esp + 8], eax
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x434545
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
setne dl
cmp eax, 4
setne al
movzx eax, al
test eax, edx
jne 0x43451e
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
setne dl
cmp eax, 4
setne al
movzx eax, al
test eax, edx
je 0x43448a
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x43448a
lea eax, [ebp - 0x3c]
mov ecx, 0x40
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x4344d0
mov dword [esp + 8], ebx
mov ebx, 0x1c
mov dword [esp + 4], ebx
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00434410
nop
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x24f66dd3
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x6c887fd7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x10002b57
Capabilities:
Get common file path

Disassembly:
inc esi
add al, 0xeb
pop ss
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edi + 8]
mov dword [ecx + 4], eax
adc byte [esi - 0x18], dl
xchg dword [eax], eax
add byte [eax], al
add esp, 0xc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
push dword [sym.imp.KERNEL32.dll_GetVersionExA]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
pop esi
pop ebp
ret 0x10

Function at 0x100043b1
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x1c]
add ecx, 4
cmp ecx, dword [esi + 0xac]
mov dword [ebp - 0x1c], ecx
jne 0x100055ec
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x34]
call fcn.10006e29
mov ecx, dword [ebp - 0xc]
Function at 0x1000466c
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
push 0x1000bc07
push dword [ebp - 0x14]
call edi
cmp eax, 0xffffffff
jne 0x100046a2
push esi
push esi
mov dword [ebp - 0x48], eax
push 0xffffffffffffffa1
call fcn.1000315f
cmp dword [ebp - 0x6c], 1
je 0x100046cf
mov eax, dword [ebp + 8]
and dword [eax], 0
xor eax, eax
push edi
cmp dword [ebp - 4], eax
inc eax
mov dword [esi + 0xa4], eax
mov eax, dword [edi]
call dword [eax + 8]
pop edi
mov eax, ebx
pop esi
pop ebx
mov ebx, dword [ebp - 0x64]
xor dword [ebp - 0x7c], esi
pop dword [ebx]
push dword [ebp - 0x30]
call fcn.1000324f
sub esi, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x64]
lea ebx, [ebp - 0x30]
or word [ebp - 0x40], 0xe0c
push ebx
Function at 0x10004a17
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
pop ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
dec eax
push 2
mov dword [ebp - 0xc], eax
lea eax, [ecx - 1]
mov dword [ebp - 8], eax
pop ebx
mov edi, 0x1000bac7
movzx ax, byte [ecx]
movzx edx, al
inc ecx
inc dword [ebp - 8]
test byte [edx + 0x47dd01], 4
mov dword [ebp + 8], ecx
je 0x10004ab6
cmp byte [ecx], 0

Function at 0x10004a95
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0x1000b38c
push dword [ebp - 0x14]
call edi
cmp dword [ebp - 0x20], ebx
jne 0x10004a4d
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x1c], eax
jne 0x10004ab0
push ebx