joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ba3
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
push ebx
push esi
push edi
xor ebx, ebx
push 0x104
mov esi, eax
lea eax, [ebp - 0x327]
push ebx
push eax
mov byte [ebp - 0x328], bl
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push str.SOFTWAREMozilla
push CreateStatusWindowA
mov byte [esi], bl
call fcn.0040abda
add esp, 0xc
test eax, eax
jne 0x403d54
push 0xff
lea eax, [ebp - 0x21f]
push ebx
push eax
mov byte [ebp - 0x220], bl
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call fcn.0040ac5f
add esp, 0xc
test eax, eax
jne 0x403d4b
mov edi, 0x3ff
push 7
lea eax, [ebp - 0x220]
push str.mozilla
push eax
call sub.msvcrt.dll__mbsnbicmp
add esp, 0xc
test eax, eax
jne 0x403d2b
push 0x104
lea eax, [ebp - 0x11f]
push ebx
push eax
mov byte [ebp - 0x120], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x727]
push ebx
push eax
mov byte [ebp - 0x728], bl
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push str._s_bin
lea eax, [ebp - 0x728]
push edi
push eax
call sub.msvcrt.dll__snprintf
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x728]
push eax
push dword [ebp - 4]
call fcn.0040ac17
add esp, 0x1c
lea eax, [ebp - 0x120]
push 0x5c
push eax
call sub.msvcrt.dll__mbsrchr
cmp eax, ebx
pop ecx
pop ecx
je 0x403cd4
mov byte [eax], bl
cmp byte [ebp - 0x120], bl
je 0x403d2b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00403ad7
test eax, eax
je 0x403d2b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_CompareFileTime]
test eax, eax
jg 0x403d0a
cmp byte [ebp - 0x328], bl
jne 0x403d2b
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x328]
push eax
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
inc dword [ebp - 8]
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0040ac5f
add esp, 0xc
test eax, eax
je 0x403c3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x328]
push eax
push esi
call sub.msvcrt.dll_strcpy
cmp byte [esi], bl
pop ecx
pop ecx
jne 0x403db8
push 0x104
push esi
push str._programfiles_Mozilla_Firefox
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
push ebx
push esi
call fcn.00403ad7
test eax, eax
jne 0x403d85
mov byte [esi], bl
cmp byte [esi], bl
jne 0x403db8
call fcn.004042d4
push ebx
push esi
call fcn.00403ad7
test eax, eax
jne 0x403d9b
mov byte [esi], bl
cmp byte [esi], bl
jne 0x403db8
push esi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push ebx
push esi
call fcn.00403ad7
test eax, eax
jne 0x403db8
mov byte [esi], bl
xor eax, eax
cmp byte [esi], bl
pop edi
pop esi
setne al
pop ebx
leave
ret
Function at 0x404068
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
call fcn.00403e70
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x4040f7
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4040e0
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4040e0
push ebx
mov byte [edi + esi], 0
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x4040e9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
jmp 0x404100
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x404212
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x404409
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push esi
push dword [ebp + 0xc]
lea esi, [ebp - 0x24c]
call fcn.0040435f
pop ecx
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40446f
push dword [ebp + 0x10]
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x144]
push eax
call dword [ebp + 8]
test eax, eax
je 0x404463
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x404439
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor eax, eax
inc eax
jmp 0x404471
xor eax, eax
pop esi
leave
ret

Function at 0x4044c8
Capabilities:
Get common file path

Disassembly:
cmp byte [0x410028], 0
push esi
mov esi, 0x410028
jne 0x4044e8
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
mov dword [0x410130], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_strcpy
mov eax, dword [0x410130]
pop ecx
pop ecx
pop esi
ret

Function at 0x404814
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x40c427
push eax
push eax
push dword [esp + 0x14]
push str.open
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret
Function at 0x404caf
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404d09
cmp byte [ebp - 0x114], 0x2e
jne 0x404cf1
lea eax, [ebp - 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x404cd4
jmp 0x404d02
mov edi, dword [ebp + 0xc]
push 0x50
pop ecx
lea esi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x404f64
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov esi, eax
call fcn.00403e70
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x404fb5
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
call fcn.00404e9f
mov edx, edi
mov eax, esi
call fcn.00404e6c
push edi
push dword [esi]
push ebx
call fcn.004049e6
mov eax, dword [esi]
add esp, 0xc
mov byte [edi + eax], 0
push ebx
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
pop edi
jmp 0x404fb7
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x405835
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040bac0
push esi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x40fdd0
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x40c427
push dword [ebp + 8]
push 0x40fed8
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp byte [ebp - 0x1004], 0
pop esi
je 0x4058a1
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_strcpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x4058a5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040bac0
push esi
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x40fdd0
push edi
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x40c427
push dword [ebp + 8]
mov esi, 0x40fed8
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp byte [ebp - 0x1004], 0
jne 0x40590d
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
jmp 0x40590f
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x405b9a
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00404212
test eax, eax
pop ecx
je 0x405c08
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x40fdd0
push edi
call sub.msvcrt.dll_strcpy
push str.general
mov esi, 0x40fed8
push esi
call sub.msvcrt.dll_strcpy
add esp, 0x10
push edi
push 0
push 0x40c764
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
push edi
push 0x3f
dec eax
push 0x40ff28
neg eax
push 0x40c427
sbb eax, eax
push str.charset
inc eax
push esi
mov dword [0x40ff20], eax
mov byte [0x40ff28], 0
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
pop edi
pop esi
ret
Function at 0x408b31
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x108]
mov eax, esi
call fcn.00408a6f
test eax, eax
je 0x408bc4
push ebx
push edi
push 5
pop ebx
call fcn.00405382
mov ecx, dword [esi + 0x460]
push 0x40caf4
push eax
push str.Backup_Filename__.bak_
xor ebx, ebx
lea edi, [ebp - 0x108]
call fcn.00404970
add esp, 0xc
test eax, eax
pop edi
pop ebx
je 0x408bc4
push 0
lea eax, [ebp - 0x108]
push eax
mov eax, dword [esi + 0x234]
add eax, 0x1f0
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
jne 0x408bc4
push dword [esi + 0x460]
call fcn.00403ee6
pop ecx
leave
ret

Function at 0x408bc6
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x108]
mov eax, edi
call fcn.00408a6f
test eax, eax
je 0x408c6b
push ebx
push esi
push 6
pop ebx
call fcn.00405382
push 0x40caf4
push eax
mov eax, dword [edi + 0x460]
push str.Backup_Filename__.bak_
lea esi, [ebp - 0x108]
call fcn.00404909
add esp, 0xc
test eax, eax
je 0x408c69
mov eax, dword [edi + 0x234]
xor esi, esi
push esi
add eax, 0x1f0
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
jne 0x408c56
push dword [edi + 0x460]
call fcn.00403ee6
pop ecx
push esi
push esi
push 0x415
push dword [edi + 0x460]
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop ebx
leave
ret

Function at 0x408e0b
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
mov esi, eax
push edi
lea edi, [esi + 0x23c]
call fcn.00404ec4
mov eax, dword [esi + 0x230]
mov dword [esi + 0x24c], 0x2000
cmp dword [eax + 0x3c], 0
je 0x408e38
mov eax, edi
call fcn.004022d2
mov ebx, dword [esi + 0x234]
push 0x9c5b
push esi
call fcn.00408788
mov eax, edi
call fcn.00404eb8
push dword [esi + 0x460]
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x408eb3
call dword [sym.imp.USER32.dll_EmptyClipboard]
test ebx, ebx
je 0x408eaa
push ebx
call sub.msvcrt.dll_strlen
pop ecx
lea edi, [eax + 1]
push edi
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x408eaa
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push edi
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
ret
Function at 0x409d6a
Capabilities:
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
xor ebx, ebx
lea edi, [ebp - 0x34]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call fcn.0040b4ec
test eax, eax
je 0x409ee3
cmp dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
je 0x409ee3
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [ebp - 0x34]
cmp dword [ebp - 4], ebx
pop ecx
pop ecx
je 0x409ee3
cmp dword [ebp - 0x30], ebx
je 0x409dc9
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push str.SELECT_id__name__value__host__path__expiry__lastAccessed__isSecure__isHttpOnly__creationTime_FROM_moz_cookies
push dword [ebp - 4]
call dword [ebp - 0x30]
add esp, 0x14
cmp dword [ebp + 0xc], ebx
je 0x409ed7
mov edi, dword [ebp - 0x24]
mov dword [ebp - 8], 1
mov esi, 0xffff
cmp dword [ebp - 0x2c], ebx
je 0x409def
push dword [ebp + 0xc]
call dword [ebp - 0x2c]
pop ecx
jmp 0x409df1
mov eax, esi
cmp eax, 0x64
jne 0x409ecb
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x34]
call fcn.0040b765
push 1
push dword [ebp + 0xc]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x6c], edx
call fcn.0040b74b
push 2
push dword [ebp + 0xc]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x34]
call fcn.0040b74b
push 3
push dword [ebp + 0xc]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x34]
call fcn.0040b74b
push 4
push dword [ebp + 0xc]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x34]
call fcn.0040b74b
push 5
push dword [ebp + 0xc]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x34]
call fcn.0040b765
push 6
push dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x54], edx
call fcn.0040b765
cmp edi, ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
je 0x409e81
push 7
push dword [ebp + 0xc]
call edi
pop ecx
pop ecx
jmp 0x409e83
mov eax, esi
xor ecx, ecx
cmp eax, ebx
setne cl
cmp edi, ebx
mov dword [ebp - 0x3c], ecx
je 0x409e9c
push 8
push dword [ebp + 0xc]
call edi
pop ecx
pop ecx
jmp 0x409e9e
mov eax, esi
xor ecx, ecx
cmp eax, ebx
setne cl
push 9
push dword [ebp + 0xc]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x40], ecx
call fcn.0040b765
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], edx
lea edx, [ebp - 0x70]
mov dword [ebp - 0x48], eax
mov eax, dword [ecx]
push edx
call dword [eax]
jmp 0x409de1
cmp dword [ebp - 0x1c], ebx
je 0x409ed7
push dword [ebp + 0xc]
call dword [ebp - 0x1c]
pop ecx
cmp dword [ebp - 0x18], ebx
je 0x409ee3
push dword [ebp - 4]
call dword [ebp - 0x18]
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40ab01
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040bac0
xor eax, eax
cmp dword [ebp + 8], eax
push ebx
push esi
mov byte [ebp - 0x2004], al
je 0x40ab58
push 0x2000
push eax
lea eax, [ebp - 0x2003]
push eax
call sub.msvcrt.dll_memset
push dword [edi]
lea ebx, [ebp - 0x2004]
push dword [ebp + 0x14]
call fcn.00404ae0
add esp, 0x14
push dword [ebp + 0x18]
mov eax, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
mov esi, eax
jmp 0x40aba3
mov esi, 0x2000
push esi
push eax
lea eax, [ebp - 0x2003]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x2004]
push esi
push eax
push 0x40c427
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea ebx, [ebp - 0x2004]
neg esi
call fcn.00404b59
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40aba9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x40abc7
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040aab5
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [esi], eax
pop ebp
ret

Function at 0x40afce
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
call fcn.0040af9f
xor ebx, ebx
cmp dword [0x40fff8], ebx
je 0x40aff9
call fcn.004043b0
push ebx
push 0x1a
push esi
push ebx
call dword [0x40fff8]
jmp 0x40b073
push 0x103
lea eax, [ebp - 0x127]
push ebx
push eax
mov byte [ebp - 0x128], bl
call sub.msvcrt.dll_memset
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.0040abda
add esp, 0x18
cmp eax, ebx
jne 0x40b05d
lea eax, [ebp - 0x24]
push str.AppData
push eax
call sub.msvcrt.dll_strcpy
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov eax, 0x104
call fcn.0040abf4
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x128]
push eax
push esi
call sub.msvcrt.dll_strcpy
xor eax, eax
cmp byte [esi], bl
pop ecx
pop ecx
setne al
pop ebx
leave
ret
Function at 0x40b870
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x40c3a0
call fcn.0040ba5c
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40b8ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40b8ad
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40b8c5
cmp eax, 0x20b
je 0x40b8b2
mov dword [ebp - 0x1c], ebx
jmp 0x40b8d9
cmp dword [ecx + 0x84], 0xe
jbe 0x40b8ad
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x40b8d3
cmp dword [ecx + 0x74], 0xe
jbe 0x40b8ad
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x410244], 0xffffffff
or dword [0x410248], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x40f1dc]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x40f1d8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x410240], eax
call fcn.00405d88
cmp dword [section..data], ebx
jne 0x40b934
push fcn.00405d88
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0040ba48
push 0x40c37c
push 0x40c378
call sub.msvcrt.dll__initterm
mov eax, dword [0x40f1d4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x40f1d0]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x40c374
push 0x40c35c
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x40b9ca
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x40b99e
cmp al, 0x22
jne 0x40b990
cmp byte [esi], 0x22
jne 0x40b9a7
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x40b9b1
cmp al, 0x20
jbe 0x40b9a3
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x40b9d5
movzx eax, word [ebp - 0x48]
jmp 0x40b9d8
cmp byte [esi], 0x20
jbe 0x40b9a7
inc esi
mov dword [ebp - 0x34], esi
jmp 0x40b9ca
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x40b9f5
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x40ba2a
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040ba95
ret
Function at 0x202260
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x20229a
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x2022a1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x202280
jmp 0x2022a3
mov eax, 0x1505
jmp 0x2022a3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x202990
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x202b56
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x202b4f
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
jmp 0x202a33
mov edx, dword [esp]
mov eax, edx
sub eax, dword [esp + 4]
add ebx, eax
mov ebp, edx
not ebp
mov esi, dword [esp + 0xc]
and ebp, esi
not esi
mov eax, ecx
mov edx, 0x80078071
mul edx
and esi, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
mov dword [esp], eax
mov eax, edi
mov edx, 0x80078071
mul edx
sub ecx, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov edx, 0x15b0
sub ebp, esi
je 0x202b4f
xor eax, eax
cmp edx, 8
mov dword [esp], edx
jb 0x202ab4
and edx, 0x1ff8
mov dword [esp + 4], edx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add eax, 8
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 4]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 5]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 6]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 7]
add edi, esi
mov esi, ecx
xor esi, edi
and ecx, edi
lea ecx, [esi + ecx*2]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x202a50
add ebx, eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], ebp
mov esi, eax
sub esi, edx
jae 0x2029eb
mov ebp, edx
and ebp, 3
mov dword [esp + 4], eax
je 0x202b02
mov dword [esp + 8], esi
neg ebp
xor eax, eax
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec eax
cmp ebp, eax
jne 0x202ae0
mov ebp, dword [esp + 4]
sub ebp, eax
mov esi, dword [esp + 8]
cmp esi, 0xfffffffc
ja 0x2029e0
jmp 0x202b0f
mov ebp, eax
mov edx, ebx
cmp esi, 0xfffffffc
ja 0x2029e0
mov eax, dword [esp]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + ebp]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 3]
add edi, esi
add ecx, edi
add ebp, 4
cmp eax, ebp
jne 0x202b20
jmp 0x2029e0
shl ecx, 0x10
or ecx, edi
jmp 0x202b5b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x202b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x202bc8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x202bca
not eax
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x23f80c]
mov eax, edi
shr eax, 4
shr ebx, 4
mov ebp, ebx
and ebp, edi
and edi, 0xf
or edi, ebx
xor edi, ebp
xor eax, dword [edi*4 + 0x23f80c]
inc esi
cmp edx, esi
jne 0x202b90
not eax
jmp 0x202bca
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret