joyce8/EMBER2024-capa huggingface dataset:
Function at 0x552290
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, 0x5df130
call fcn.0040e7c0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00552280
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x34]
mov edx, 0
call fcn.00408bb0
mov eax, dword [ebp - 0xc]
mov edx, fcn.004de8b0
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dx, 0
call fcn.00409500
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x30]
call fcn.00408bb0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00550200
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00552920
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
je 0x552395
jmp 0x5523b4
mov eax, dword [ebp - 4]
call fcn.00500ce0
test al, al
je 0x5523a3
jmp 0x5523b4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00552280
mov esp, ebp
pop ebp
ret
Function at 0x570a40
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret
Function at 0x105b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push edi
jb 0x105c5
jae 0x105c5
call 0x375510c
inc ebx
dec ebx
je 0x105cc
jne 0x105cc
call 0x65844f11
rol byte [eax], 1
inc ecx
dec ecx
and dword [ebp - 0x30], 0
mov dword [ebp - 0xc], 0x80
mov eax, dword [ebp - 0xc]
add eax, 0x1a
mov dword [ebp - 8], eax
je 0x105e7
jne 0x105e7
call 0x65844f2c
cld
add byte [ebx + eax + 0x75], dh
add eax, ebp
inc ecx
dec ecx
and dword [ebp - 4], 0
je 0x105f2
jne 0x105f2
call 0x44694f37
imul esp, dword fs:[eax], 0xffffffff
jne 0x105f4
inc ecx
dec ecx
push 0x206b6444
push dword [ebp - 8]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10617
mov eax, 0xc0000022
jmp 0x1079e
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x2c], 0x18
and dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x40
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x2c]
push eax
push 0xf003f
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [ebp - 0x30], eax
je 0x1065f
jne 0x1065f
call 0x7d844fa4
rol byte [eax], 1
inc ecx
dec ecx
cmp dword [ebp - 0x30], 0
jge 0x1067d
mov eax, dword [ebp - 0x30]
jmp 0x1079e
mov ecx, dword [ebp - 8]
xor eax, eax
mov edi, dword [ebp - 4]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push 1
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x80000005
je 0x106db
cmp dword [ebp - 0x38], 0
je 0x1074e
jmp 0x10781
push 0
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
js 0x106f4
jns 0x106f4
nop
call 0x83f54c83
rcr byte [edx], 0x89
inc ebp
clc
mov eax, dword [ebp - 0xc]
add eax, 0x1a
mov dword [ebp - 8], eax
je 0x10702
jne 0x10702
call 0x44695047
imul esp, dword fs:[eax], 0xffffffff
jne 0x10704
inc ecx
dec ecx
push 0x206b6444
push dword [ebp - 8]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 4], eax
jo 0x1071c
jno 0x1071c
call 0x50f54cad
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push 1
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 0x30], eax
jb 0x1073d
jae 0x1073d
call 0x7d845284
rol byte [eax], 1
inc ebx
dec ebx
cmp dword [ebp - 0x30], 0
jge 0x1074e
jmp 0x10781
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 8]
push ecx
push dword [ebp + 0x10]
call dword [sym.imp.ntoskrnl.exe_wcscpy]
pop ecx
pop ecx
jb 0x10771
jae 0x10771
nop
call 0x82101660
or byte [eax], al
add byte [eax], al
jae 0x10781
jmp 0x10781
nop
call 0x760007ef
cld
push 0
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
jmp 0x1079e
pop edi
pop ebx
leave
ret 0xc
Function at 0x109f6
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
js 0x10a0b
jns 0x10a0b
nop
call 0x98a1e
add byte [eax], al
jo 0x10a19
jno 0x10a19
nop
call 0x98c2c
add byte [eax], al
jb 0x10a27
jae 0x10a27
nop
call 0x987ae
cmp dword [ebp + 8], 0
je 0x10a33
cmp dword [ebp + 0xc], 0
jne 0x10a41
xor eax, eax
jmp 0x10b5c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10a5b
xor eax, eax
jmp 0x10b5c
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x18], ecx
jb 0x10a75
jae 0x10a75
nop
call 0x81e95004
cmp byte [eax + 0x45], dl
add byte [eax], al
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0x4550
je 0x10a87
xor eax, eax
jmp 0x10b5c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
and dword [ebp - 0x10], 0
jmp 0x10aa0
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x18]
jae 0x10b5a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jb 0x10ad8
jae 0x10ad8
add al, byte [eax]
add byte [eax], al
nop
call 0xff0d80db
jne 0x10ad2
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x10b55
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ax, word [ecx + eax*2]
mov word [ebp - 4], ax
jb 0x10b09
jae 0x10b09
call 0x458c5650
clc
inc ebx
dec ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push ecx
call 0x10b20
mov dword [eax + eax + 0x1e959], 0x83e90000
ror dword [edx], 0x51
ret
jmp 0x10a99
xor eax, eax
pop ebx
leave
ret 8

Function at 0x111a8
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x111c0
mov eax, dword [esp + 4]
add eax, ecx
xor byte [eax], 0x9d
inc ecx
cmp ecx, dword [esp + 8]
jb 0x111b0
push ebx
jb 0x111c6
jae 0x111c6
call 0xc25c5d0d
or byte [eax], al
inc ebx
dec ebx
pop ebx
ret 8
Function at 0x11220
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
and dword [ebp - 0x18], 0
and dword [ebp - 0x10], 0
js 0x1123f
jns 0x1123f
nop
call 0xed77c6
and dword [ebp - 0x14], 0
jo 0x11251
jno 0x11251
nop
call 0xf977d8
and dword [ebp - 8], 0
jb 0x11263
jae 0x11263
nop
call 0xf577ea
and dword [ebp - 0xc], 0
jo 0x1126c
jno 0x1126c
call 0xfd77f3
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0xf8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 6]
dec eax
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x10]
movzx ecx, word [ecx + 6]
dec ecx
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + eax + 0x14]
mov edx, dword [ebp - 0x14]
add eax, dword [edx + ecx + 0x10]
mov dword [ebp - 8], eax
jb 0x112b9
jae 0x112b9
call 0x458c5e00
or byte [ebx], al
inc ebp
clc
inc ebx
dec ebx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ecx], eax
push 0x206b6444
mov eax, dword [ebp + 0xc]
push dword [eax]
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0xc], eax
jo 0x112e2
jno 0x112e2
call 0xf59069
cmp dword [ebp - 0xc], 0
jne 0x112ec
xor eax, eax
jmp 0x1133a
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
lea esi, [edx + eax + 4]
mov edi, dword [ebp - 0xc]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jo 0x1131a
jno 0x1131a
add byte [eax], al
nop
call 0xff0d58a9
xor bh, bh
jne 0x11316
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp - 0xc]
call fcn.000111a8
mov eax, dword [ebp - 0xc]
jmp 0x1133a
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x21913f73
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x177b4228
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4042a0
Capabilities:
Get common file path
Get disk information
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x458588]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [0x45858c]
push esi
mov dword [ebp - 0x14], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], edx
call fcn.00404290
mov edi, dword [ebp - 0xc]
mov ecx, dword [0x458590]
mov edx, dword [0x458594]
add edi, 0x23f
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], 0x20
lea esp, [esp]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x45fd1c]
shl esi, 4
add esi, dword [ebp - 0x18]
cmp eax, 0xfa9
jne 0x40432c
mov dword [0x45fd18], 0xedeb2e40
jmp 0x404347
cmp eax, 0x3eb
jne 0x404347
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [0x45f7a8], 0
mov eax, dword [ebp - 8]
lea ecx, [edi + eax]
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x45fd1c], 0x9e6
mov dword [0x45fd14], 0xf4ea3dee
jne 0x404380
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x45fd1c], 0x213
jne 0x40440e
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
lea eax, [ebp - 0x4c0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
lea ecx, [ebp - 0x8c0]
push ecx
push 0
push 0x403f68
push 0x403fb8
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
lea edx, [ebp - 0x28]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub ebx, dword [ebp - 4]
cmp dword [0x45fd1c], 0xc
jne 0x404422
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov edx, ebx
shr edx, 5
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 4], eax
mov eax, ebx
shl eax, 4
add eax, dword [ebp - 0x1c]
lea ecx, [edi + ebx]
xor eax, ecx
xor eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub dword [ebp - 8], eax
add edi, 0x61c88647
sub dword [ebp - 0x10], 1
jne 0x404300
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax + 4], ebx
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404470
Capabilities:
Clear file content
Connect pipe
Get thread local storage value
Read pipe
Set file attributes
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0040a8c0
mov eax, dword [0x45fd1c]
mov ecx, dword [0x45f7ac]
shr eax, 3
test eax, eax
jbe 0x404562
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edi, edi
cmp dword [0x45fd1c], 0x959
jne 0x404548
push 0
push 0
push 0
call edi
push 0
lea eax, [ebp - 0x808]
push eax
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
lea ecx, [ebp - 0x1008]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [ebp - 4]
push edx
call fcn.004042a0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x4044b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407780
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x457668]
jne 0x40778a
repz ret
jmp fcn.0040c81e

Function at 0x40c445
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408a7b
and dword [ebp - 4], 0
cmp dword [0x45d798], 0
mov ebx, eax
jne 0x40c4f6
push 0x401d44
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c5a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401d38
push edi
call esi
test eax, eax
je 0x40c5a7
push eax
call fcn.00408a09
mov dword [esp], 0x401d28
push edi
mov dword [0x45d798], eax
call esi
push eax
call fcn.00408a09
mov dword [esp], 0x401d14
push edi
mov dword [0x45d79c], eax
call esi
push eax
call fcn.00408a09
mov dword [esp], 0x401cf8
push edi
mov dword [0x45d7a0], eax
call esi
push eax
call fcn.00408a09
pop ecx
mov dword [0x45d7a8], eax
test eax, eax
je 0x40c4f6
push 0x401ce0
push edi
call esi
push eax
call fcn.00408a09
pop ecx
mov dword [0x45d7a4], eax
mov eax, dword [0x45d7a4]
cmp eax, ebx
je 0x40c54e
cmp dword [0x45d7a8], ebx
je 0x40c54e
push eax
call fcn.00408a84
push dword [0x45d7a8]
mov esi, eax
call fcn.00408a84
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c54e
test edi, edi
je 0x40c54e
call esi
test eax, eax
je 0x40c545
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c545
test byte [ebp - 0xc], 1
jne 0x40c54e
or dword [ebp + 0x10], 0x200000
jmp 0x40c587
mov eax, dword [0x45d79c]
cmp eax, ebx
je 0x40c587
push eax
call fcn.00408a84
pop ecx
test eax, eax
je 0x40c587
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c587
mov eax, dword [0x45d7a0]
cmp eax, ebx
je 0x40c587
push eax
call fcn.00408a84
pop ecx
test eax, eax
je 0x40c587
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45d798]
call fcn.00408a84
pop ecx
test eax, eax
je 0x40c5a7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c5a9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418d50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x420b80], ecx
inc edx
cmp edx, 0x100
jb 0x418d52
cmp edx, 0x800
jae 0x418e29
lea esp, [esp]
mov eax, dword [edx*4 + 0x420780]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x420b80]
inc edx
mov dword [edx*4 + 0x420b7c], eax
cmp edx, 0x800
jb 0x418e00
mov eax, 0x419630
mov dword [0x420b74], eax
mov dword [0x422b80], eax
mov dword [0x420b70], 0x419550
call fcn.00419060
test eax, eax
jne 0x418e55
mov dword [0x422b80], 0x419550
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x7a8179
Capabilities:
Parse pe header

Disassembly:
push ebp
test bx, 0xadd
mov ebp, esp
cmp ax, sp
lea esp, [esp - 0x114]
push edi
bsf di, sp
sar edi, 0xd7
mov edi, dword [ebp + 8]
cmp dh, 0xb7
test edi, edi
jmp 0x7caabf
Function at 0x1003518
Capabilities:
Query environment variable
Set environment variable
Write file on windows

Disassembly:
push ecx
push ebx
xor ebx, ebx
push ebx
push ebx
push 0x1002388
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x10035e3
push esi
mov esi, 0x100afa0
push esi
push 0x1002378
push 0x100ad60
call fcn.01002a1f
push ebx
push 0x4000002
push 1
push ebx
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, eax
cmp edx, 0xffffffff
mov dword [0x100a024], edx
je 0x10035e2
push ebp
push edi
mov ebp, 0x100a5a0
xor eax, eax
push ebx
mov ecx, 0xc5
mov edi, ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
mov edi, 0x314
push edi
push ebp
push edx
mov dword [0x100a5a0], 0x6e776453
mov dword [0x100a5a4], 0x10000
mov dword [0x100a5a8], 0xc0000013
mov byte [0x100a7b0], bl
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10035cd
cmp dword [esp + 0x10], edi
jne 0x10035cd
push esi
push 0x1002388
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x10035e0
push dword [0x100a024]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x100a024], 0xffffffff
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x10035e6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x1003600
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [0x101b0c0], 0
jne 0x1003661
lea eax, [ebp - 0x280]
push eax
push 0x200
push esi
call fcn.01002b42
lea eax, [ebp - 0x280]
push eax
call fcn.0112a000
push 0x80
lea eax, [ebp - 0x80]
push eax
push 0x20000003
push dword [0x100a05c]
mov byte [ebp - 0x80], 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x10010
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x280]
push eax
push dword [0x100aae4]
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.01002baa
test esi, esi
jne 0x100366b
inc esi
cmp dword [0x100a060], 0
je 0x1003686
push 0x100ad40
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and dword [0x100a060], 0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]