joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c4da
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41f278]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push 0x20
push 2
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x40c53f
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x40c536
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x10], 1
pop ebx
sete al
call fcn.0040efeb
leave
ret

Function at 0x40c5ff
Capabilities:
Move file

Disassembly:
cmp byte [esp + 0xc], 0
push 0xa
pop eax
je 0x40c60c
push 0xb
pop eax
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40c624
jmp fcn.0040442e
xor eax, eax
ret

Function at 0x40d971
Capabilities:
Get common file path

Disassembly:
mov eax, 0x418212
call fcn.0040fa68
push ecx
and dword [ebp - 0x10], 0
mov eax, dword [0x4200d0]
push esi
mov ecx, 0x4200d0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov esi, 0x105
push esi
lea eax, [ebp - 0x10]
call fcn.004066cd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
or eax, 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004066f0
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov eax, esi
call fcn.00407184
add eax, 0x10
mov dword [edi], eax
mov eax, esi
call fcn.0040328d
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40e5fa
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004110e0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40e695
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x420288]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40e695
cmp eax, 1
je 0x40e6b6
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40e695
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40e662
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40e691
xor eax, eax
inc eax
jmp 0x40e6d5
cmp edi, eax
jae 0x40e699
xor eax, eax
jmp 0x40e6d5
cmp eax, esi
jae 0x40e6a0
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x420288]
jmp 0x40e6b9
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x410fce
Capabilities:
Terminate process

Disassembly:
push 8
push 0x419798
call fcn.0040f060
push 8
call fcn.004103b6
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4202c8], esi
jne 0x411002
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4202c4], esi
mov al, byte [ebp + 0x10]
mov byte [0x4202c0], al
cmp dword [ebp + 0xc], edi
jne 0x41104c
cmp dword [0x421eac], edi
je 0x41103c
mov eax, dword [0x421ea8]
sub eax, 4
mov dword [0x421ea8], eax
cmp eax, dword [0x421eac]
jb 0x41103c
mov eax, dword [eax]
cmp eax, edi
je 0x41101d
call eax
jmp 0x41101d
push 0x41f050
mov eax, 0x41f048
call fcn.00410f4c
pop ecx
push 0x41f05c
mov eax, 0x41f054
call fcn.00410f4c
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x41107d
cmp dword [ebp + 0x10], edi
jne 0x41108b
mov dword [0x4202c8], esi
push dword [ebp + 8]
call fcn.00410f0a
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x41108a
push 8
call fcn.00410301
pop ecx
ret
call fcn.0040f09b
ret
Function at 0x412100
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x41f278]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x41f800]
je 0x412135
inc eax
cmp eax, 0x13
jb 0x412126
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x41f800]
jne 0x41225b
mov eax, dword [0x420108]
cmp eax, 1
je 0x412233
cmp eax, edx
jne 0x412165
cmp dword [0x41f274], 1
je 0x412233
cmp ecx, 0xfc
je 0x41225b
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41219b
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00413bb0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0040f1d0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4121cf
mov eax, edi
push eax
call fcn.0040f1d0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x41a0e0
push edi
call fcn.00413fc0
add esp, 0x10
push edi
call fcn.0040f1d0
push dword [esi + 0x41f804]
mov ebx, eax
call fcn.0040f1d0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004110e0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00413bb0
push edi
push ebx
call fcn.00413bc0
push 0x41a0c0
push ebx
call fcn.00413bc0
push dword [esi + 0x41f804]
push ebx
call fcn.00413bc0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00415575
add esp, 0x2c
jmp 0x41225b
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x41f804]
push dword [esi]
call fcn.0040f1d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040efeb
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x412f7e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x412fac
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x412fb3
cmp ebx, dword [eax + 4]
jae 0x412fb3
xor eax, eax
jmp 0x4131a3
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x412fc4
xor eax, eax
inc eax
jmp 0x4131a2
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x412fda
cmp ecx, edx
jae 0x41311f
cmp dword [eax + 4], 0
je 0x412fe3
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x412fcb
cmp dword [ebp + 8], 0
je 0x413005
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x41311f
cmp eax, esi
jae 0x41311f
mov eax, dword [0x420510]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x41302a
cmp dword [esi*4 + 0x420518], edi
je 0x413123
inc esi
cmp esi, eax
jl 0x413018
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41319f
cmp dword [ebp - 8], 0x1000000
jne 0x41319f
test byte [ebp - 0xc], 0xcc
je 0x4130a8
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x41319f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41319f
cmp word [eax + 0x18], 0x10b
jne 0x41319f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x41319f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4130a8
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4130a8
test byte [ecx + 0x27], 0x80
jne 0x41311f
push 1
push 0x420558
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x412fbc
mov ecx, dword [0x420510]
test ecx, ecx
mov edx, ecx
jle 0x4130dc
lea eax, [ecx*4 + 0x420514]
cmp dword [eax], edi
je 0x4130dc
dec edx
sub eax, 4
test edx, edx
jg 0x4130d0
test edx, edx
jne 0x41310d
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4130e9
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x413101
lea eax, [edx*4 + 0x420518]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4130ef
cmp ecx, 0x10
jge 0x41310d
inc ecx
mov dword [0x420510], ecx
push 0
push 0x420558
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x412fbc
xor eax, eax
jmp 0x4131a2
test esi, esi
jle 0x412fbc
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x420558
call ebx
test eax, eax
jne 0x412fbc
cmp dword [esi*4 + 0x420518], edi
je 0x413179
mov eax, dword [0x420510]
lea esi, [eax - 1]
test esi, esi
jl 0x413167
cmp dword [esi*4 + 0x420518], edi
je 0x413163
dec esi
jns 0x413157
test esi, esi
jge 0x413177
cmp eax, 0x10
jge 0x413172
inc eax
mov dword [0x420510], eax
lea esi, [eax - 1]
jmp 0x413179
je 0x413191
xor ecx, ecx
test esi, esi
jl 0x413191
lea eax, [ecx*4 + 0x420518]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x41317f
push 0
push 0x420558
call ebx
jmp 0x412fbc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415130
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x41f278]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x415161
xor eax, eax
jmp 0x4152ea
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x420d80]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x41519d
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.00415e4d
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x415278
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x4152b6
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x415201
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4151f2
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x4151d2
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x415241
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x41524a
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x4151c3
jmp 0x41524c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x4152e5
cmp dword [ebp - 0x6c], edi
je 0x4152b6
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x4152ab
call fcn.0040e79b
mov dword [eax], 9
call fcn.0040e7a4
mov dword [eax], esi
jmp 0x4152e0
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4152a0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x41524c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x41524c
push dword [ebp - 0x6c]
call fcn.0040e7ad
pop ecx
jmp 0x4152e0
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x4152ce
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x4152ce
xor eax, eax
jmp 0x4152e8
call fcn.0040e79b
mov dword [eax], 0x1c
call fcn.0040e7a4
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x4152e8
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.0040efeb
add ebp, 0x3a0
leave
ret
Function at 0x415575
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4205e0], ebx
push esi
push edi
jne 0x4155f5
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x415630
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x4205e0], eax
je 0x415630
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x4205e4], eax
call esi
cmp dword [0x420288], 2
mov dword [0x4205e8], eax
jne 0x4155f5
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x4205f0], eax
je 0x4155f5
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x4205ec], eax
mov eax, dword [0x4205ec]
test eax, eax
je 0x41563a
call eax
test eax, eax
je 0x415621
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x4205f0]
test eax, eax
je 0x415621
test byte [ebp - 8], 1
jne 0x41563a
cmp dword [0x420294], 4
jb 0x415634
or byte [ebp + 0x12], 0x20
jmp 0x415659
xor eax, eax
jmp 0x415669
or byte [ebp + 0x12], 4
jmp 0x415659
mov eax, dword [0x4205e4]
test eax, eax
je 0x415659
call eax
mov ebx, eax
test ebx, ebx
je 0x415659
mov eax, dword [0x4205e8]
test eax, eax
je 0x415659
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4205e0]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x405ebb
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x405ef6
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x405edd
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x405eee
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x405ef8
inc edi
add eax, 0x28
cmp edi, esi
jb 0x405ed3
xor eax, eax
pop edi
pop esi
ret

Function at 0x406123
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x58]
push eax
call fcn.00405e8b
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00405e40
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x406169
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00405e7b
push 0x2e
imul ecx, dword fs:[ebp - 0x17af3fbb], 0xffffffc5
cld
invalid

Function at 0x406b16
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00405e40
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.00405e7b
add dword [0x468ebbc], ecx
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x406b44
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x406b6f
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x406d39
cmp dword [ebp + 0xc], 1
je 0x406d39
cmp dword [ebp + 0xc], 8
jne 0x406d01
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
invalid
test dword [edx - 7], ecx
invalid
Function at 0x406d06
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp al, 0xf0
movsb byte es:[edi], byte [esi]
or dword [eax - 0x5435b], eax
inc dword [eax]
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.00405e7b
leave
cmp byte [edx], ah
sub byte [eax - 0x22f5b], al
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00405e59
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00405e8b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00405e40
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00405e7b
pop edi
jge 0x406e7a
push 0x104
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00405e7b
in eax, 0xe8
adc eax, 0xe0658006
add byte [eax - 0x39ff1e9b], al
inc ebp
loop 0x406ebe
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
inc ebp
ljmp 0xc6b2
Function at 0x10005fa6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10005ff2
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10005fe1
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 9
jmp 0x10005ff0
push 0x18fd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x1000600e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x18]
call fcn.10003665
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1000b2e9
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059e58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000b460
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1000b363
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1000b35e
push 1
push 0x1be8
push 0x2d28
push 0x7302
push 0x335
push 1
push 0x6691
call fcn.10008e0d
add esp, 0x1c
jmp 0x1000b45e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x4583
mov dword [ebp - 0x38], str.wlfpt_fet_copodb_jljvjeep_bpivxf_pmbhu_gon_viz_svgp_nozt_zwjcdusme
cmp dword [ebp - 0x24], 0x45ed
jle 0x1000b40c
push 0
push 0xb38
push 0
push 0
push 0x1df6
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
and dword [ebp - 0x18], 0
jmp 0x1000b3af
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6109
jge 0x1000b40c
and dword [ebp - 0x1c], 0
jmp 0x1000b3c5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x33e3
jge 0x1000b40a
and dword [ebp - 0x20], 0
jmp 0x1000b3db
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6380
jge 0x1000b408
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0x10075878
call fcn.1000dfeb
jmp 0x1000b3d4
jmp 0x1000b3be
jmp 0x1000b3a8
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1000b41e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x44b9
jge 0x1000b438
mov edx, dword [ebp - 0x38]
mov ecx, 0x10075878
call fcn.10010d3e
jmp 0x1000b454
or dword [ebp - 4], 0xffffffff
jmp 0x1000b45e
jmp 0x1000b472
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push 1
push dword [ebp - 0x3c]
call fcn.10005f87
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret