joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444930
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push dword [esp + 0x28]
call fcn.0043d710
add esp, 4
mov ecx, dword [esp]
mov edi, dword [esp + 4]
mov eax, dword [esp + 8]
test ecx, ecx
je 0x444996
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov edx, esp
push 1
call fcn.00443210
add esp, 4
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
test ebx, ebx
je 0x444992
push 0
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x44499d
mov byte [esi], 4
test edi, edi
jne 0x4449ad
jmp 0x4449bc
mov eax, dword [esp + 0x14]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x4449bc
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test edi, edi
je 0x4449bc
push ebx
push 0
push dword [0x4c0838]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0x18
pop esi
pop edi
pop ebx
ret

Function at 0x446db0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x4bf068]
test eax, eax
je 0x446e68
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x446ddc
cmp dword [eax + 4], 0
mov edi, eax
je 0x446ddc
add edi, 8
jmp 0x446e63
mov eax, dword [0x4bf068]
test eax, eax
je 0x446e77
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x446e61
mov esi, eax
test eax, eax
jne 0x446e37
movzx eax, byte [0x4c0890]
mov ecx, 0xc
mov edx, 4
call fcn.0040de10
test eax, eax
je 0x446e92
mov dword [eax], 0x4bf068
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4bf068]
test eax, eax
je 0x446e86
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x446e63
test ecx, ecx
je 0x446e63
lock dec dword [ecx]
jne 0x446e63
call fcn.0040ac30
jmp 0x446e63
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x4bf068
call fcn.004676d0
jmp 0x446dc0
mov ecx, 0x4bf068
call fcn.004676d0
jmp 0x446dea
mov ecx, 0x4bf068
call fcn.004676d0
jmp 0x446e2f
mov ecx, 4
mov edx, 0xc
call fcn.00465940
ud2

Function at 0x448880
Capabilities:
Check os version
Create process on windows
Encode data using base64
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x5a0
mov esi, esp
mov dword [esi + 0x588], ebp
call fcn.0044889c
Function at 0x44ea70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.0043d710
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test edx, edx
je 0x44ead5
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.0044e9b0
mov edi, dword [esp]
test edi, edi
je 0x44eae4
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44eaf9
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x44eaf1
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0
mov ecx, esp
call fcn.0043d8e0
mov dword [esi], 0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi], 0
je 0x44eaf1
push edi
push 0
push dword [0x4c0838]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x44eaf1
Function at 0x450920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x457150
mov esi, edx
mov edi, ecx
mov ecx, 8
mov edx, 4
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0x4c0890]
call fcn.0040de10
test eax, eax
je 0x450a16
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x450ae0
push esi
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x45099d
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x450a05
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
cmp dword [eax + 4], 0
je 0x4509ea
cmp dword [eax + 8], 9
jae 0x4509d5
mov eax, dword [ebp - 0x20]
jmp 0x4509db
mov eax, dword [ebp - 0x20]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x4c0838]
call dword [sym.imp.kernel32.dll_HeapFree]
push edi
push 0
push dword [0x4c0838]
call dword [sym.imp.kernel32.dll_HeapFree]
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.00465940
ud2
Function at 0x450f80
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.004573f0
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x457180
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x1044]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.00459b90
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 0x448140
push eax
push 0x1000
push esi
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x4510d4
mov ebx, dword [sym.imp.kernel32.dll_SleepEx]
mov dword [ebp - 0x20], edi
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x45100a
cmp dword [ebp - 0x2c], 0
jne 0x4510e5
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x4510e5
cmp esi, 0x1000
ja 0x451121
xor edi, edi
nop dword [eax]
mov eax, esi
sub eax, edi
jb 0x451107
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
lea ecx, [ebp + edi - 0x1044]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], edx
push 0x448140
lea edx, [ebp - 0x44]
push edx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WriteFileEx]
test eax, eax
je 0x4510dc
nop dword [eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x451080
cmp dword [ebp - 0x2c], 0
jne 0x4510e2
add edi, dword [ebp - 0x28]
cmp edi, esi
jne 0x451040
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
push 0x448140
lea eax, [ebp - 0x44]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
push eax
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x45100a
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x4510e5
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, edi
mov edx, esi
push 0x4b3eb0
call fcn.00465f10
add esp, 4
jmp 0x45113c
mov dword [ebp - 0x10], 0
mov ecx, esi
mov edx, 0x1000
push 0x4b3eb0
call fcn.00465d00
add esp, 4
ud2
Function at 0x451230
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x4571a0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x4512ae
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x4b3fd8
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x4b4004
mov dword [esi + 0x2c], 0x4423c0
mov dword [esi + 0x3c], 1
call fcn.00465bf0
ud2

Function at 0x453210
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov edi, edx
jne 0x4532d8
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx + 4]
test edx, edx
jne 0x45323e
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x4532c2
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x4532ae
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x453274
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x453292
jmp 0x453286
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x45328d
cmp eax, 0x6d
jne 0x4532a3
mov word [esi], 4
jmp 0x45329c
mov ecx, 1
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x45329c
mov ecx, ebx
push 1
call fcn.00467a00
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
jmp 0x453245
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.00467a00
add esp, 4
mov edx, dword [ebx + 4]
jmp 0x45323e
mov edx, esp
mov ecx, edi
mov dword [esp], 0
call fcn.00467be0
ud2
Function at 0x4568a0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x4bf078]
test eax, eax
je 0x456985
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4568d1
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x45697a
mov eax, dword [0x4bf078]
test eax, eax
je 0x456994
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x456957
mov esi, eax
test eax, eax
jne 0x456937
movzx eax, byte [0x4c0890]
mov ecx, 0x20
mov edx, 8
call fcn.0040de10
test eax, eax
je 0x4569af
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x4bf078
mov esi, eax
mov eax, dword [0x4bf078]
test eax, eax
je 0x4569a3
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x45695b
movaps xmm0, xmmword [esp]
jmp 0x456969
xor esi, esi
jmp 0x45697d
lea ecx, [esp + 0x10]
call fcn.00451230
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x4bf078
call fcn.004676d0
jmp 0x4568b8
mov ecx, 0x4bf078
call fcn.004676d0
jmp 0x4568df
mov ecx, 0x4bf078
call fcn.004676d0
jmp 0x45692f
mov ecx, 8
mov edx, 0x20
call fcn.00465940
ud2

Function at 0x457b1e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x457b5d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x457b5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x457b5d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x457b5d
cmp dword [ecx + 0x74], 0xe
jbe 0x457b5d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x45f115
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x45f1b2
push ebx
push esi
call fcn.0045f0de
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0045f072
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x45f15f
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x45f1b1
push edi
push eax
call fcn.0045fd32
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x45f17f
call fcn.0045dbd3
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x45f1b0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0045f072
add esp, 0x20
test eax, eax
jne 0x45f19e
push edi
call fcn.0045dbd3
jmp 0x45f1a6
push ebx
call fcn.0045dbd3
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4604af
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4b8540
push 0x4b8538
push str.FlsAlloc
push 0x1f
call fcn.0046036e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4604e3
push dword [ebp + 8]
mov ecx, esi
call dword [0x468218]
call esi
jmp 0x4604e9
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x46052d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4b8550
push 0x4b8548
push str.FlsGetValue
push 0x21
call fcn.0046036e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x460564
push dword [ebp + 8]
mov ecx, esi
call dword [0x468218]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x46056c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4b8558
push 0x4b8550
push str.FlsSetValue
push 0x22
call fcn.0046036e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4605a6
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x468218]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x465620
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46564d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46564d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4676d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x467741
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x46777c
cmp dword [esp + 4], 0
je 0x467763
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x467791
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x4c084c]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x4c084c], esi
jne 0x467720
mov byte [0x4c0848], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x467773
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x4677d4
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x467767
mov edi, dword [esp]
jmp 0x467773
mov edi, dword [esi]
jmp 0x467772
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00467810
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x4b42f8
mov dword [esp + 8], 0x4b42c0
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str._rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
call fcn.00465bf0
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x4b42c0
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str._rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00467850
ud2

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00409a27
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00409a27
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00409a27
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00409a27
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00409a27
mov dword [0x41203c], eax
call fcn.00409a27
test eax, eax
jge 0x402550
push 8
call fcn.00409a27
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00409a27
pop ecx
push 1
call fcn.00409a27
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00409a27
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00409a27
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00409a27
jmp 0x402495

Function at 0x409a27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x409a36
pop dword [ebp - 0x28]
mov eax, 0x409a36
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3a00a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4b0e
xor edx, edx
add edx, eax
mov edi, 0x7a5236d1
sub edi, 0x7a10fb0d
add edi, dword [ebp - 0x28]
mov esi, 0xe677aef0
sub esi, 0xf937e302
mov dword [ebp - 0x24], 0x5cf3b12b
mov ebx, dword [edi]
mov dword [ebp - 4], 0xcebf8a1c
sub ebx, esi
xor dword [ebp - 0x18], 0x171c1558
mov dword [edx], ebx
add edx, 0xf3d4952f
sub edx, 0xf3d4952b
add edi, 0xd84b27e5
add edi, 0x27b4d81f
loop 0x409a87
add eax, 0xf167a424
sub eax, 0xf1668519
xor ebx, ebx
add ebx, eax
add eax, 0xea0444f5
add eax, 0x15fbbb10
mov ecx, 0x1f73d337
sub ecx, 0x1f33d337
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x402639
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402678
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402678
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402678
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402678
cmp dword [ecx + 0x74], 0xe
jbe 0x402678
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x406231
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x426d54], 0
push esi
jne 0x406268
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406242
mov dword [ecx*4 + 0x426d50], eax
inc ecx
cmp ecx, 0x100
jl 0x40623d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406299
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x426d50]
xor eax, esi
inc ecx
dec edx
jne 0x40627b
pop edi
not eax
pop esi
ret 0xc

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401554
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401e00
sub eax, fcn.004015cb
push eax
push fcn.004015cb
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107d
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401478
mov eax, ebx
call fcn.004014c9
lea eax, [ebx + 0x1b600]
lea edx, [ebx - 1]
lea ecx, [ebp - 2]
and edx, eax
test ebx, ebx
je 0x401071
mov eax, 0x402054
add eax, eax
jmp 0x401076
mov eax, 0x402054
mov ebx, ecx
call fcn.004015cb
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop edx
pop ecx
pop ebx
ret

Function at 0x401554
Capabilities:
Delete file
Encode data using base64 via winapi

Disassembly:
push ebx
push ecx
push edx
enter 0x11c, 0
lea ebx, [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push ebx
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0
push 0
lea ebx, [ebp - 4]
call dword [sym.imp.USER32.DLL_GetWindow]
push ebx
lea ebx, [ebp - 0x18]
push ebx
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
lea eax, [ebp - 0x18]
movzx ebx, byte [ebp - 0x18]
push eax
sub ebx, 0x41
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, ebx
leave
pop edx
pop ecx
pop ebx
ret

Function at 0x4015cb
Capabilities:
Delete file

Disassembly:
hlt
push edi
mov edi, 0x72647246
jb 0x401617
ror byte [ecx + 0x6ed8c765], 0
inc edi
add al, 0xe8
push edi
jbe 0x4015a9
popal
mov dword [ebx + edx*2 + 0x6c], ebp
mov dword [ecx + 0x45], esp
jae 0x401612
and byte [ebp + eax*2], 0x8d
mov dword [edx - 0x39], edx
invalid
inc ebp
call 0x6e75775d
outsb dx, byte [esi]
inc ebp
inc ebp
add al, 0xa2
invalid
Function at 0x66a412f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x66a41325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x66a41325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x66a4132c
mov eax, 1
jmp 0x66a41331
mov eax, 0
leave
ret