joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005fa2d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1005faca
push ebx
push esi
call fcn.1005facd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1005f931
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1005fa77
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005fac9
push edi
push eax
call fcn.1005de5c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1005fa97
call fcn.1005bb54
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005fac8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1005f931
add esp, 0x20
test eax, eax
jne 0x1005fab6
push edi
call fcn.1005bb54
jmp 0x1005fabe
push ebx
call fcn.1005bb54
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10002428
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
lea eax, [ebx + 4]
push eax
mov dword [ebx], 0x1000183c
call edi
xor ebp, ebp
xor esi, esi
inc esi
mov ecx, 0x280
mov eax, 0x1e0
mov dword [ebx + 0x24], esi
lea esi, [ebx + 0x60]
mov dword [ebx], 0x1000151c
mov dword [ebx + 0x14], ebp
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x1c], ebp
mov dword [ebx + 0x20], ebp
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], ebp
mov dword [ebx + 0x54], ebp
mov dword [ebx + 0x58], ebp
call fcn.10005a4f
lea esi, [ebx + 0x88]
call fcn.10005a4f
xor eax, eax
inc eax
mov dword [ebx + 0xe8], eax
mov dword [ebx + 0xec], eax
mov dword [ebx + 0xf4], eax
lea eax, [ebx + 0x28]
push eax
mov dword [ebx + 0xb0], ebp
mov dword [ebx + 0xb4], ebp
mov dword [ebx + 0xb8], ebp
mov dword [ebx + 0xbc], ebp
mov dword [ebx + 0xc0], ebp
mov dword [ebx + 0xc4], ebp
mov dword [ebx + 0xc8], ebp
mov dword [ebx + 0xd4], ebp
mov dword [ebx + 0xd8], ebp
mov dword [ebx + 0xf0], ebp
mov dword [ebx + 0xf8], ebp
mov dword [ebx + 0x104], ebp
mov dword [ebx + 0x108], ebp
mov dword [ebx + 0x10c], ebp
call dword [sym.imp.RtmPal.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.RtmPal.dll_CreateEventW]
push ebp
push ebp
push ebp
push ebp
call esi
push ebp
push ebp
push ebp
push ebp
mov dword [ebx + 0xdc], eax
call esi
push ebp
push ebp
push ebp
push ebp
mov dword [ebx + 0xe0], eax
call esi
mov dword [ebx + 0xe4], eax
lea eax, [ebx + 0x100]
push eax
call edi
xor esi, esi
lea eax, [esp + 0x10]
inc esi
push eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], 4
push 0x2001f
push ebp
push 0x10001450
push 0x80000001
call dword [sym.imp.RtmPal.dll_RegOpenKeyExW]
test eax, eax
jne 0x10002591
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
push ebp
push 0x100014e4
push dword [esp + 0x24]
call dword [sym.imp.RtmPal.dll_RegQueryValueExW]
test eax, eax
je 0x10002587
mov dword [esp + 0xc], esi
push dword [esp + 0x10]
call dword [sym.imp.RtmPal.dll_RegCloseKey]
cmp dword [esp + 0xc], ebp
jne 0x100025ce
call fcn.100023d9
cmp eax, esi
jne 0x100025ce
mov eax, dword [0x10008260]
cmp eax, 0x10008260
je 0x100025c6
test byte [eax + 0x1c], 2
je 0x100025c6
cmp byte [eax + 0x19], 4
jb 0x100025c6
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.100022d0
mov dword [ebx + 0xf4], ebp
jmp 0x100025f4
mov eax, dword [0x10008260]
cmp eax, 0x10008260
je 0x100025f4
test byte [eax + 0x1c], 2
je 0x100025f4
cmp byte [eax + 0x19], 4
jb 0x100025f4
push ebx
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.100022d0
push 8
lea edx, [ebx + 0x110]
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
pop edi
pop esi
mov dword [edx + 0x1c], 2
mov eax, ebx
pop ebp
add esp, 0x10
ret
Function at 0x1000290c
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [0x10008260]
mov ebp, 0x10008260
cmp eax, ebp
je 0x10002942
test byte [eax + 0x1c], 2
je 0x10002942
cmp byte [eax + 0x19], 4
jb 0x10002942
push dword [esi + 0x58]
push dword [esi + 0x54]
push esi
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1000236c
mov edi, dword [sym.imp.RtmPal.dll_CloseHandle]
xor ebx, ebx
cmp dword [esi + 0xf8], ebx
je 0x100029f2
call fcn.10002ac4
push dword [esi + 0xdc]
call dword [sym.imp.RtmPal.dll_SetEvent]
push 0xffffffffffffffff
push dword [esi + 0xf8]
call dword [sym.imp.RtmPal.dll_WaitForSingleObject]
test eax, eax
je 0x100029e4
push 1
push dword [esi + 0xf8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x100029b5
mov eax, dword [0x10008260]
cmp eax, ebp
je 0x100029ae
test byte [eax + 0x1c], 2
je 0x100029ae
cmp byte [eax + 0x19], 2
jb 0x100029ae
push esi
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.100022d0
call fcn.10002858
jmp 0x100029e4
mov eax, dword [0x10008260]
cmp eax, ebp
je 0x100029e4
test byte [eax + 0x1c], 2
je 0x100029e4
cmp byte [eax + 0x19], 2
jb 0x100029e4
call dword [sym.imp.RtmPal.dll_GetLastError]
push eax
mov eax, dword [0x10008260]
push esi
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.100022fd
push dword [esi + 0xf8]
call edi
mov dword [esi + 0xf8], ebx
push dword [esi + 0xdc]
call edi
push dword [esi + 0xe0]
mov dword [esi + 0xdc], ebx
call edi
push dword [esi + 0xe4]
mov dword [esi + 0xe0], ebx
call edi
pop edi
mov dword [esi + 0xe4], ebx
mov dword [esi + 0x104], ebx
pop esi
pop ebp
pop ebx
ret
Function at 0x10005477
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ecx
push ebx
push ebp
push esi
test edi, edi
je 0x10005524
xor ebp, ebp
cmp word [edi], bp
je 0x10005524
push 0x5c
mov esi, edi
mov ebx, ebp
mov ecx, 0x104
pop edx
mov dword [esp + 0xc], 0x2f
cmp ebx, ecx
jge 0x1000552c
cmp word [esi], bp
je 0x10005520
movzx eax, word [esi]
cmp ax, dx
je 0x100054cd
cmp ax, word [esp + 0xc]
je 0x100054cd
cmp ebx, ecx
jge 0x100054cd
add esi, 2
inc ebx
cmp word [esi], bp
jne 0x100054b1
movzx eax, word [esi]
test ax, ax
je 0x1000551b
cmp ax, dx
je 0x100054e1
cmp ax, word [esp + 0xc]
jne 0x1000552c
cmp word [esi - 2], 0x3a
je 0x10005518
cmp esi, edi
je 0x10005518
push ebp
xor eax, eax
push edi
mov word [esi], ax
call dword [sym.imp.RtmPal.dll_CreateDirectoryW]
push 0x5c
pop edx
mov word [esi], dx
test eax, eax
jne 0x10005513
call dword [sym.imp.RtmPal.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000552c
push 0x5c
pop edx
mov ecx, 0x104
add esi, 2
cmp word [esi], bp
jne 0x100054a4
cmp ebx, ecx
jge 0x1000552c
xor eax, eax
inc eax
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
jmp 0x10005527

Function at 0x10005ff3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10008120]
jne 0x10005ffd
repz ret
jmp fcn.10006468
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, reloc.user32.dll_DefWindowProcA
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x6abac0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x68000]
push edi
or ebp, 0xffffffff
jmp 0x6abae2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6abae9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6abad8
mov eax, 1
add ebx, ebx
jne 0x6abafb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6abb0c
jne 0x6abb2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6abb2b
dec eax
add ebx, ebx
jne 0x6abb18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6abaf0
add ebx, ebx
jne 0x6abb27
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6abb7d
xor ecx, ecx
sub eax, 3
jb 0x6abb43
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6abbb2
sar eax, 1
mov ebp, eax
jmp 0x6abb4e
add ebx, ebx
jne 0x6abb4e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6abb1c
inc ecx
add ebx, ebx
jne 0x6abb5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6abb1c
add ebx, ebx
jne 0x6abb69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6abb5e
jne 0x6abb7a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6abb5e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6abb9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6abb8e
jmp 0x6abade
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6abb9c
add edi, ecx
jmp 0x6abade
pop esi
mov edi, esi
mov ecx, 0x1e12
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6abbba
cmp byte [edi], 0x11
jne 0x6abbba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6abbbf
lea edi, [esi + 0x2a7000]
mov eax, dword [edi]
or eax, eax
je 0x6abc2e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x306e40]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x306e68]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6abbec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x306e70]
or eax, eax
je 0x6abc28
mov dword [ebx], eax
add ebx, 4
jmp 0x6abc09
call dword [esi + 0x306e6c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6abc5f
cmp al, 0xef
ja 0x6abc52
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6abc34
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6abc41
mov ebp, dword [esi + 0x306e74]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6abc93
sub esp, 0xffffff80
jmp 0x4024c0
Function at 0x499430
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x82000]
push edi
jmp 0x49944a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x499451
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x499440
mov eax, 1
add ebx, ebx
jne 0x499463
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x499474
jne 0x499493
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x499493
dec eax
add ebx, ebx
jne 0x499480
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x499458
add ebx, ebx
jne 0x49948f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4994e5
xor ecx, ecx
sub eax, 3
jb 0x4994ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49951a
sar eax, 1
mov ebp, eax
jmp 0x4994b6
add ebx, ebx
jne 0x4994b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x499484
inc ecx
add ebx, ebx
jne 0x4994c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x499484
add ebx, ebx
jne 0x4994d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4994c6
jne 0x4994e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4994c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x499504
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4994f6
jmp 0x499446
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x499504
add edi, ecx
jmp 0x499446
pop esi
mov edi, esi
mov ecx, 0xad9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x499522
cmp byte [edi], 0xe
jne 0x499522
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x499527
lea edi, [esi + 0x96000]
mov eax, dword [edi]
or eax, eax
je 0x499596
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xfde44]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xfde9c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x499554
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xfdea4]
or eax, eax
je 0x499590
mov dword [ebx], eax
add ebx, 4
jmp 0x499571
call dword [esi + 0xfdea0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4995c7
cmp al, 0xef
ja 0x4995ba
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x49959c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4995a9
mov ebp, dword [esi + 0xfdea8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4995fb
sub esp, 0xffffff80
jmp 0x405b8d
Function at 0x406004
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x422a1c], esi
push edi
jne 0x40603e
mov ecx, 0x422a18
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x40601a
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422e18
jl 0x406015
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406073
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a18]
xor eax, esi
inc ecx
dec edx
jne 0x406056
pop edi
pop esi
not eax
ret 0xc

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x412d62
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x1505
jmp 0x412d83
lea eax, [ecx - 0x61]
cmp eax, 0x19
ja 0x412d7b
and ecx, 0xffffffdf
imul edx, edx, 0x21
xor edx, ecx
add esi, 2
movzx ecx, word [esi]
test ecx, ecx
jne 0x412d70
mov eax, dword [ebp + 0x10]
movzx ecx, dl
mov edx, ecx
and ecx, 0x1f
shr edx, 5
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp + 0x14]
inc edx
shl edx, cl
pop esi
mov dword [eax], edx
pop ebp
ret 0x10

Function at 0x4152c0
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x419dd8
call fcn.00415a50
push 1
call fcn.0041535a
pop ecx
test al, al
jne 0x415171
push 7
call fcn.004157f4
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00415325
mov byte [ebp - 0x24], al
mov eax, dword [0x41a1c0]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41516a
test eax, eax
jne 0x4151db
mov dword [0x41a1c0], ecx
push 0x401028
push 0x401018
call sub.ucrtbase_clr0400.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4151be
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4152b4
push 0x401014
push section..text
call sub.ucrtbase_clr0400.dll__initterm
pop ecx
pop ecx
mov dword [0x41a1c0], 2
jmp 0x4151e0
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004154c7
pop ecx
call fcn.004157e8
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x415210
push esi
call fcn.0041543d
pop ecx
test al, al
je 0x415210
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00415a3b
call esi
call fcn.004157ee
mov esi, eax
cmp dword [esi], edi
je 0x41522e
push esi
call fcn.0041543d
pop ecx
test al, al
je 0x41522e
push dword [esi]
call sub.ucrtbase_clr0400.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.0041590f
movzx eax, ax
push eax
call sub.ucrtbase_clr0400.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00415942
test al, al
jne 0x415259
push esi
call sub.ucrtbase_clr0400.dll_exit
test bl, bl
jne 0x415262
call sub.ucrtbase_clr0400.dll__cexit
push edi
push 1
call fcn.004154e4
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4152b4
call fcn.00415a96
ret
call fcn.00542000
jmp 0x415152
Function at 0x4058ed
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push esi
lea ecx, [ebp - 0x18]
call fcn.0040174b
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push 1
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.0040174e
mov esi, eax
test esi, esi
je 0x4059b1
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.0040752b
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004073d0
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004073d0
and byte [ebp - 0x21b], 0
lea eax, [ebp - 0x21f]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004073d0
lea eax, [ebp - 0x11c]
push 0x40f1dc
push eax
call fcn.004073d0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push esi
call fcn.004071e0
mov esi, eax
add esp, 0x40
test esi, esi
lea ecx, [ebp - 0x18]
jne 0x4059b5
call fcn.00401808
xor eax, eax
jmp 0x405a09
call fcn.00401808
push dword [ebp - 4]
lea eax, [ebp - 0x11c]
push esi
push eax
call fcn.00403cbb
push esi
call fcn.0040785b
add esp, 0x10
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004046d7
pop ecx
test eax, eax
pop ecx
je 0x405a07
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x11c]
push eax
call fcn.00403dfa
pop ecx
push 1
pop esi
mov eax, esi
pop esi
leave
ret

Function at 0x405ee4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
and byte [ebp - 0x10c], 0
push ebx
lea eax, [ebp - 0x10c]
push 0x104
push eax
push 1
push str.c_el
call fcn.00403434
pop ecx
pop ecx
push eax
push 0x40f244
push closesocket
call fcn.004044e4
lea eax, [ebp - 0x10c]
push eax
call fcn.00405ca4
movsx eax, byte [ebp - 0x10c]
mov bl, byte [ebp - 0x10a]
push eax
call fcn.0040773e
add esp, 0x1c
and dword [ebp - 8], 0
mov byte [ebp - 1], al
mov al, byte [ebp - 8]
add al, 0x61
cmp al, byte [ebp - 1]
je 0x405f8e
and byte [ebp - 0x10a], 0
mov byte [ebp - 0x10c], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
mov byte [ebp - 0x10a], bl
jne 0x405f8e
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
push 0x405e8c
push eax
call fcn.00403e11
add esp, 0xc
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1a
jl 0x405f48
xor eax, eax
pop ebx
leave
ret 4
Function at 0x10009506
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10009515
pop dword [ebp - 0x44]
mov eax, 0x6e481aa9
add eax, 0xa1b87a6c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x84080e8a
add dword [ebp - 0x54], 0xca4a36c1
mov dword [ebp - 0x50], 0xac7cf922
sub dword [ebp - 0x50], 0x7a49acdd
mov dword [ebp - 0x4c], 0x18d64b2
sub dword [ebp - 0x4c], 0xb5412084
mov dword [ebp - 0x48], 0xf552d9da
sub dword [ebp - 0x48], 0xf552d9da
lea eax, [ebp - 0x54]
push eax
mov eax, 0xa7dc910
add eax, 0x58247b4
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xfadd9e70
add dword [ebp - 0x54], 0x7994cae6
mov dword [ebp - 0x50], 0xda75b686
sub dword [ebp - 0x50], 0x99095511
mov dword [ebp - 0x4c], 0xefa99fbb
sub dword [ebp - 0x4c], 0x8c3a334f
mov dword [ebp - 0x48], 0xeb042b94
sub dword [ebp - 0x48], 0xeb042b94
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3a0e3
push 0
call eax
mov ecx, 0x86c3b0f4
sub ecx, 0x86c3706f
xor edi, edi
add edi, eax
mov ebx, 0x73fd3149
sub ebx, 0x63fa5749
add ebx, dword [ebp - 0x44]
mov esi, 0x4917ae67
add esi, 0x6ad4fd6a
xor dword [ebp - 0x30], 0xe27d129a
mov edx, dword [ebx]
add dword [ebp - 0x1c], 0x85249085
xor edx, esi
mov dword [edi], edx
xor dword [ebp - 0x24], esi
add edi, 4
add ebx, 4
loop 0x10009634
add eax, 0x3e10b3d0
sub eax, 0x3e0fbee9
mov ebx, eax
add eax, 0xc0e6d555
add eax, 0x3f192ab0
mov ecx, sym.msimp32.dll_Ordinal_5
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x10023d3a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10001b3c]
jne 0x1002420f
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10028d58], eax
mov dword [0x10028d54], ecx
mov dword [0x10028d50], edx
mov dword [0x10028d4c], ebx
mov dword [0x10028d48], esi
mov dword [0x10028d44], edi
mov word [0x10028d70], ss
mov word [0x10028d64], cs
mov word [0x10028d40], ds
mov word [0x10028d3c], es
mov word [0x10028d38], fs
mov word [0x10028d34], gs
pushfd
pop dword [0x10028d68]
mov eax, dword [ebp]
mov dword [0x10028d5c], eax
mov eax, dword [ebp + 4]
mov dword [0x10028d60], eax
lea eax, [ebp + 8]
mov dword [0x10028d6c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10028ca8], 0x10001
mov eax, dword [0x10028d60]
mov dword [0x10028c5c], eax
mov dword [0x10028c50], 0xc0000409
mov dword [0x10028c54], 1
mov eax, dword [0x10001b3c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10028390]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10028ca0], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10001b4c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10028ca0], 0
jne 0x100242fb
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret