joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40be70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403c54
xor eax, eax
push ebp
push 0x40bfbc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.004037e0
mov eax, dword [ebp - 4]
call fcn.00403a64
mov edi, eax
test edi, edi
je 0x40bfa6
mov eax, esi
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, esi
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, esi
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, esi
mov byte [ebp - 9], al
dec ebx
cmp ebx, 0
jb 0x40bf6d
mov dword [ebp - 8], ebx
mov esi, edi
dec esi
test esi, esi
jbe 0x40bf08
mov ebx, 1
lea eax, [ebp - 4]
call fcn.00403cb4
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, byte [ebp - 0xa]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
sub dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x40bee6
lea eax, [ebp - 4]
call fcn.00403cb4
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
mov cl, byte [ebp - 0xc]
sub dl, cl
mov byte [eax + edi - 1], dl
mov ebx, edi
cmp ebx, 2
jb 0x40bf4c
lea eax, [ebp - 4]
call fcn.00403cb4
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, byte [ebp - 9]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 2]
sub dl, cl
mov byte [eax + ebx - 1], dl
dec ebx
cmp ebx, 1
jne 0x40bf27
lea eax, [ebp - 4]
call fcn.00403cb4
mov edx, dword [ebp - 4]
mov dl, byte [edx]
mov cl, byte [ebp - 0xb]
sub dl, cl
mov byte [eax], dl
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffff
jne 0x40beda
lea eax, [ebp - 4]
call fcn.00403cb4
mov ebx, edi
sub ebx, 4
mov edx, ebx
call fcn.0040bd58
mov esi, eax
lea eax, [ebp - 4]
call fcn.00403cb4
add eax, ebx
cmp esi, dword [eax]
jne 0x40bfa6
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
call fcn.00403834
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.00403cfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bfc3
lea eax, [ebp - 4]
call fcn.004037e0
ret

Function at 0x40c0a8
Capabilities:
Parse pe header

Disassembly:
add esp, 0xfffffff8
xor edx, edx
mov ecx, eax
mov dword [esp], ecx
mov ecx, dword [ecx + 0x3c]
add ecx, eax
mov dword [esp + 4], ecx
mov eax, dword [esp]
cmp word [eax], 0x5a4d
jne 0x40c0e9
mov eax, dword [esp + 4]
cmp dword [eax], 0x4550
jne 0x40c0e9
mov eax, dword [esp + 4]
mov ax, word [eax + 0x16]
test ah, 0x20
je 0x40c0e9
and ax, 2
cmp ax, 2
sete dl
mov eax, edx
pop ecx
pop edx
ret

Function at 0x40c0f0
Capabilities:
Parse pe header

Disassembly:
add esp, 0xfffffff8
xor edx, edx
mov ecx, eax
mov dword [esp], ecx
mov ecx, dword [ecx + 0x3c]
add ecx, eax
mov dword [esp + 4], ecx
mov eax, dword [esp]
cmp word [eax], 0x5a4d
jne 0x40c141
mov eax, dword [esp + 4]
cmp dword [eax], 0x4550
jne 0x40c141
mov eax, dword [esp + 4]
mov ax, word [eax + 0x16]
test ah, 0x20
je 0x40c141
mov ecx, dword [esp + 4]
movzx ecx, word [ecx + 0x14]
cmp ecx, 0xe0
je 0x40c141
and ax, 2
cmp ax, 2
sete dl
mov eax, edx
pop ecx
pop edx
ret
Function at 0x40c148
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esp]
call fcn.0040c0a8
test al, al
je 0x40c27c
mov eax, dword [esp]
call fcn.0040c058
mov ebx, eax
test ebx, ebx
je 0x40c27c
mov eax, dword [esp]
mov eax, dword [eax + 0x3c]
add eax, dword [esp]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add eax, 0x18
mov edx, dword [esp + 8]
movzx edx, word [edx + 0x14]
add eax, edx
mov dword [esp + 0xc], eax
push 0x40
push 0x3000
push ebx
push 0
call fcn.00404b80
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x40c27c
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x14]
mov edx, dword [esp]
mov eax, dword [esp + 0x10]
call fcn.004084e0
mov eax, dword [esp + 8]
movzx edi, word [eax + 6]
dec edi
test edi, edi
jb 0x40c274
inc edi
xor ebx, ebx
lea esi, [ebx + ebx*4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + esi*8 + 0xc]
mov eax, dword [esp + 0x10]
call fcn.0040c00c
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov edx, dword [eax + esi*8 + 0x14]
mov eax, dword [esp]
call fcn.0040c00c
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + esi*8 + 0x10]
test eax, eax
jne 0x40c251
mov edx, dword [esp + 0xc]
mov edx, dword [edx + esi*8 + 0x24]
and edx, 0x40
cmp edx, 0x40
jne 0x40c231
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x20]
jmp 0x40c251
lea edx, [ebx + ebx*4]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + edx*8 + 0x24]
and edx, 0x80
cmp edx, 0x80
jne 0x40c251
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x24]
mov ecx, eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
call fcn.004084e0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov dword [eax + esi*8 + 8], edx
inc ebx
dec edi
jne 0x40c1e0
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x40c994
Capabilities:
Acquire debug privileges

Disassembly:
mov dl, 1
mov eax, 0x40cae4
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cb04
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cb1c
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cb40
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cb68
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cb90
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cbb4
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cbd8
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cbf4
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cc10
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cc30
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cc50
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cc70
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cc98
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40ccb4
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40ccdc
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cd04
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cd28
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cd44
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cd68
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cd88
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cda8
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cdc4
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cde0
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40cdfc
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40ce24
call fcn.0040c8d0
mov dl, 1
mov eax, 0x40ce40
call fcn.0040c8d0
ret

Function at 0x40e3c4
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov ebp, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebp
call fcn.0040e230
inc dword [eax + eax*8 + 0xb6840f]
add byte [eax], al
mov eax, ebp
call fcn.0040e29c
mov ebx, eax
test ebx, ebx
je 0x40e483
mov eax, dword [ebp + 0x3c]
add eax, ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x18
mov edx, dword [esp + 4]
movzx edx, word [edx + 0x14]
add eax, edx
mov dword [esp + 8], eax
push 0x40
push 0x3000
push ebx
push 0
call fcn.004035bc
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x40e483
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x14]
mov edx, ebp
mov eax, dword [esp + 0xc]
call fcn.00407d80
mov eax, dword [esp + 4]
movzx edi, word [eax + 6]
dec edi
test edi, edi
jb 0x40e47c
inc edi
xor ebx, ebx
lea esi, [ebx + ebx*4]
mov eax, dword [esp + 8]
mov edx, dword [eax + esi*8 + 0xc]
mov eax, dword [esp + 0xc]
call fcn.0040e13c
mov dword [esp + 0x10], eax
mov eax, dword [esp + 8]
mov edx, dword [eax + esi*8 + 0x14]
mov eax, ebp
call fcn.0040e13c
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
mov ecx, dword [eax + esi*8 + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
call fcn.00407d80
inc ebx
dec edi
jne 0x40e438
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40fba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, esi
mov edx, ebx
call fcn.00403834
mov eax, ebx
call fcn.00403a64
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40fc8e
mov eax, edi
shr eax, 0x18
mov byte [ebp - 0x10], al
mov eax, edi
shr eax, 0x10
mov byte [ebp - 0xf], al
mov eax, edi
shr eax, 8
mov byte [ebp - 0xe], al
mov eax, edi
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 4]
dec eax
cmp eax, 0
jl 0x40fc8e
mov dword [ebp - 8], eax
mov edi, dword [ebp - 0xc]
dec edi
test edi, edi
jle 0x40fc29
mov ebx, 1
mov eax, esi
call fcn.00403cb4
mov edx, dword [esi]
mov dl, byte [edx + ebx - 1]
xor dl, byte [ebp - 0xe]
mov ecx, dword [esi]
mov cl, byte [ecx + ebx]
sub dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x40fc0a
mov eax, esi
call fcn.00403cb4
mov edx, dword [ebp - 0xc]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0xc]
mov cl, byte [ecx + ebx - 1]
mov bl, byte [ebp - 0x10]
sub cl, bl
mov byte [eax + edx - 1], cl
mov ebx, dword [ebp - 0xc]
cmp ebx, 2
jl 0x40fc6f
mov eax, esi
call fcn.00403cb4
mov edx, dword [esi]
mov dl, byte [edx + ebx - 1]
xor dl, byte [ebp - 0xd]
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 2]
sub dl, cl
mov byte [eax + ebx - 1], dl
dec ebx
cmp ebx, 1
jne 0x40fc4d
mov eax, esi
call fcn.00403cb4
mov edx, dword [esi]
mov dl, byte [edx]
mov cl, byte [ebp - 0xf]
sub dl, cl
mov byte [eax], dl
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffff
jne 0x40fbfd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40801c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x408028
push 0x408024
push 0x408020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x408028]
push dword [0x408024]
push dword [0x408020]
mov dword [0x408014], esp
call fcn.00406384
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x401341
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 8], 0
push 0
push 0
push dword [ebp + 0x14]
push 0
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov edi, dword [ebp + 8]
cmp dword [edi], 0xffffffff
jne 0x40137a
mov eax, 0
jmp 0x40138e
push 0
mov edi, dword [ebp + 8]
push dword [edi]
call sub.KERNEL32.DLL_GetFileSize
mov dword [edi + 8], eax
mov eax, 1
pop edi
pop esi
pop ebp
ret

Function at 0x401392
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
mov edi, dword [ebp + 8]
mov esi, edi
add esi, 4
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi]
call sub.KERNEL32.DLL_WriteFile
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebp
ret

Function at 0x4013b9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
mov edi, dword [ebp + 8]
mov esi, edi
add esi, 4
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi]
call sub.KERNEL32.DLL_ReadFile
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebp
ret
Function at 0x405a88
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x10], 0
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [edi + 0x14], esi
mov edi, dword [ebp + 8]
mov dword [edi + 8], 0
cmp dword [ebp + 0x10], 0
je 0x405b31
push 0
push 0
push 4
push 0
push 1
push 0x80000000
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov edi, dword [ebp + 8]
cmp dword [edi], 0xffffffff
jne 0x405ae0
mov eax, 0
jmp 0x405b85
push 2
push 0
push 0xfffffffffffffffc
mov edi, dword [ebp + 8]
push dword [edi]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edi, [ebp - 8]
push edi
push 4
mov edi, dword [ebp + 8]
mov esi, edi
add esi, 4
push esi
push dword [edi]
call sub.KERNEL32.DLL_ReadFile
mov edi, dword [ebp + 8]
mov edi, dword [edi + 4]
add edi, 4
mov dword [ebp - 4], edi
push 2
push 0
mov edi, dword [ebp - 4]
neg edi
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call sub.KERNEL32.DLL_SetFilePointer
mov edi, dword [ebp + 8]
mov byte [edi + 0xc], 0
jmp 0x405b80
push 0
push 0
push 4
push 0
push 2
push 0x40000000
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov edi, dword [ebp + 8]
cmp dword [edi], 0xffffffff
jne 0x405b5c
mov eax, 0
jmp 0x405b85
mov edi, dword [ebp + 8]
mov dword [edi + 4], 0
mov edi, dword [ebp + 8]
mov dword [edi + 8], 0
push 2
push 0
push 0
mov edi, dword [ebp + 8]
push dword [edi]
call sub.KERNEL32.DLL_SetFilePointer
mov eax, 1
pop edi
pop esi
leave
ret

Function at 0x405b89
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0x10]
call sub.CRTDLL.DLL_free
add esp, 4
mov edi, dword [ebp + 8]
mov dword [edi + 0x10], 0
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0
jne 0x405bfb
push 2
push 0
push 0
mov edi, dword [ebp + 8]
push dword [edi]
call sub.KERNEL32.DLL_SetFilePointer
mov byte [ebp - 1], 1
push 0
lea edi, [ebp - 8]
push edi
push 1
lea edi, [ebp - 1]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call sub.KERNEL32.DLL_WriteFile
mov edi, dword [ebp + 8]
add edi, 4
inc dword [edi]
push 0
lea edi, [ebp - 8]
push edi
push 4
mov edi, dword [ebp + 8]
mov esi, edi
add esi, 4
push esi
push dword [edi]
call sub.KERNEL32.DLL_WriteFile
mov edi, dword [ebp + 8]
push dword [edi]
call sub.KERNEL32.DLL_CloseHandle
mov edi, dword [ebp + 8]
mov dword [edi], 0
pop edi
pop esi
leave
ret
Function at 0x405c12
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0xc], 1
jne 0x405c2a
mov eax, 0
jmp 0x405c94
mov edi, dword [ebp + 8]
mov edi, dword [edi + 8]
add edi, 7
shr edi, 3
shl edi, 3
mov dword [ebp - 8], edi
push 1
push 0
push dword [ebp - 8]
mov edi, dword [ebp + 8]
push dword [edi]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edi, [ebp - 4]
push edi
push 1
mov edi, dword [ebp + 8]
mov esi, edi
add esi, 0xc
push esi
push dword [edi]
call sub.KERNEL32.DLL_ReadFile
push 0
lea edi, [ebp - 4]
push edi
push 4
mov edi, dword [ebp + 8]
mov esi, edi
add esi, 8
push esi
push dword [edi]
call sub.KERNEL32.DLL_ReadFile
mov edi, dword [ebp + 8]
cmp byte [edi + 0xc], 1
je 0x405c8d
mov ebx, 1
jmp 0x405c92
mov ebx, 0
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405c99
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0xc], 1
jne 0x405cb1
mov eax, 0
jmp 0x405d2c
mov edi, dword [ebp + 8]
mov edi, dword [edi + 8]
add edi, 7
shr edi, 3
shl edi, 3
mov dword [ebp - 4], edi
mov edi, dword [ebp - 4]
add edi, 1
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0x10]
call sub.CRTDLL.DLL_realloc
add esp, 8
mov dword [edi + 0x10], eax
mov edi, dword [ebp - 4]
add edi, 1
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0x10]
call sub.KERNEL32.DLL_RtlZeroMemory
push 0
lea edi, [ebp - 0xc]
push edi
push dword [ebp - 4]
mov edi, dword [ebp + 8]
push dword [edi + 0x10]
push dword [edi]
call sub.KERNEL32.DLL_ReadFile
push 1
push dword [ebp - 4]
mov edi, dword [ebp + 8]
push dword [edi + 0x10]
call fcn.0040129c
add esp, 0xc
mov edi, dword [ebp + 8]
mov edi, dword [edi + 8]
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
mov dword [edi + 8], 0
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x405f68
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push pe_nt_image_headers32
push dword [ebp + 0xc]
push section..bss
call fcn.004062e2
add esp, 0xc
push pe_nt_image_headers32
push 0x40f894
push section..bss
push section..bss
call fcn.00406211
add esp, 0x10
cmp byte [ebp + 0x14], 0
jne 0x406008
mov dword [ebp - 4], 0
jmp 0x406000
push 0x20
push dword [0x40fbe0]
push 0x407040
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
imul edi, dword [ebp - 4], 0x30
add edi, dword [ebp + 0x10]
push edi
push dword [0x40fbe0]
call fcn.00406137
add esp, 8
push 0x20
push dword [0x40fbdc]
push dword [0x40fbe0]
call fcn.0040625e
add esp, 0xc
push 0x20
push 0x407040
push dword [0x40fbdc]
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jl 0x405fa7
jmp 0x406070
mov dword [ebp - 4], 0xf
jmp 0x40606a
push 0x20
push dword [0x40fbdc]
push 0x407040
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
imul edi, dword [ebp - 4], 0x30
add edi, dword [ebp + 0x10]
push edi
push dword [0x40fbdc]
call fcn.00406137
add esp, 8
push 0x20
push dword [0x40fbe0]
push dword [0x40fbdc]
call fcn.0040625e
add esp, 0xc
push 0x20
push 0x407040
push dword [0x40fbe0]
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
dec dword [ebp - 4]
cmp dword [ebp - 4], 0
jge 0x406011
push pe_nt_image_headers32
push 0x40f8d4
push section..bss
push section..bss
call fcn.00406211
add esp, 0x10
push pe_nt_image_headers32
push section..bss
push dword [ebp + 8]
call fcn.00406321
add esp, 0xc
pop edi
leave
ret

Function at 0x40609e
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push pe_nt_image_headers32
push dword [ebp + 0xc]
push 0x407060
call fcn.004062e2
add esp, 0xc
push 0x38
push str.91__
push 0x407060
push 0x407060
call fcn.00406211
add esp, 0x10
mov dword [ebp - 4], 0
jmp 0x40612e
mov edi, dword [ebp - 4]
movsx edi, byte [edi + 0x40f9cc]
push edi
push 0x1c
push dword [0x40fbe4]
call fcn.00406294
add esp, 0xc
mov edi, dword [ebp - 4]
movsx edi, byte [edi + 0x40f9cc]
push edi
push 0x1c
push dword [0x40fbe8]
call fcn.00406294
add esp, 0xc
push 0x30
push 0x40f99c
push 0x407060
imul edi, dword [ebp - 4], 0x30
add edi, dword [ebp + 8]
push edi
call fcn.00406211
add esp, 0x10
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jl 0x4060d7
pop edi
leave
ret

Function at 0x406137
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x30
push 0x40f914
push dword [ebp + 8]
push 0x4070a0
call fcn.00406211
add esp, 0x10
push 0x30
push dword [ebp + 0xc]
push 0x4070a0
call fcn.0040625e
add esp, 0xc
push 0x4070a0
push dword [ebp + 8]
call fcn.0040618b
add esp, 8
push 0x20
push 0x40f944
mov edi, dword [ebp + 8]
push edi
push edi
call fcn.00406211
add esp, 0x10
pop edi
pop ebp
ret
Function at 0x406384
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x4063b8
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
or eax, eax
je 0x4063d3
mov edi, eax
inc edi
jmp 0x4063b0
inc edi
cmp byte [edi], 0x20
je 0x4063af
jmp 0x4063d3
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x4063c4
cmp eax, 0x20
jne 0x4063b7
jmp 0x4063c7
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x4063d3
cmp eax, 0x20
je 0x4063c6
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.00404e97
pop edi
leave
ret
Function at 0x40107e
Capabilities:
Delete file
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x4546c8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4546cc]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ecx
call fcn.00401077
mov eax, dword [0x4546d0]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4546d4]
add ebx, 0x23f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x20
jmp 0x4010d3
xor ecx, ecx
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x463914], 0xc
mov dword [ebp - 4], eax
jne 0x4010fd
push ecx
lea eax, [ebp - 0x30]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x463914]
cmp eax, 0xfa9
jne 0x401119
mov dword [0x463910], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40113a
push str.komovavukuniburubawumukoni
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and dword [0x463868], 0
lea eax, [ebx + edi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [0x46390c], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + esi]
mov dword [ebp - 0x18], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
cmp dword [0x463914], 0xb03
jne 0x4011bb
push str.ruyenemilimusibubigukexem
push edx
push edx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
add ebx, 0x61c88647
sub edi, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
jne 0x4010d1
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x4073e0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45383c]
jne 0x4073ea
repz ret
jmp fcn.0040b7ef

Function at 0x40b1dd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405d77
and dword [ebp - 4], 0
cmp dword [0x458904], 0
mov ebx, eax
jne 0x40b28e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b33f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b33f
push eax
call fcn.00405d05
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x458904], eax
call esi
push eax
call fcn.00405d05
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x458908], eax
call esi
push eax
call fcn.00405d05
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45890c], eax
call esi
push eax
call fcn.00405d05
pop ecx
mov dword [0x458914], eax
test eax, eax
je 0x40b28e
push 0x44ff18
push edi
call esi
push eax
call fcn.00405d05
pop ecx
mov dword [0x458910], eax
mov eax, dword [0x458910]
cmp eax, ebx
je 0x40b2e6
cmp dword [0x458914], ebx
je 0x40b2e6
push eax
call fcn.00405d80
push dword [0x458914]
mov esi, eax
call fcn.00405d80
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b2e6
test edi, edi
je 0x40b2e6
call esi
test eax, eax
je 0x40b2dd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b2dd
test byte [ebp - 0xc], 1
jne 0x40b2e6
or dword [ebp + 0x10], 0x200000
jmp 0x40b31f
mov eax, dword [0x458908]
cmp eax, ebx
je 0x40b31f
push eax
call fcn.00405d80
pop ecx
test eax, eax
je 0x40b31f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b31f
mov eax, dword [0x45890c]
cmp eax, ebx
je 0x40b31f
push eax
call fcn.00405d80
pop ecx
test eax, eax
je 0x40b31f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x458904]
call fcn.00405d80
pop ecx
test eax, eax
je 0x40b33f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b341
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret