joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401007
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
cmp dword [0x2b78ed4], 0x594
mov dword [ebp - 8], eax
jne 0x40103b
push esi
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x4a3318]
mov ebx, dword [0x4a331c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
call fcn.00401000
mov eax, dword [0x4a3320]
add dword [ebp - 0x18], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4a3324]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x2b78ed4], 0xc
mov dword [ebp - 4], eax
jne 0x4010b7
push esi
lea eax, [ebp - 0x830]
push eax
push str.limuwafozufoderahiz_wulesuferore
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2b78ed4]
cmp eax, 0xfa9
jne 0x4010d3
mov dword [0x2b78ed0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ee
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x2b78888], esi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov edx, edi
shr edx, cl
add eax, edi
mov dword [ebp - 0x14], eax
mov dword [0x2b78ecc], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shr edx, cl
add edx, ebx
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
sub edi, dword [ebp - 4]
add dword [ebp - 0x18], 0x61c88647
dec dword [ebp - 0x1c]
jne 0x401072
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x405359
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a2b58]
jne 0x405363
repz ret
jmp fcn.004080bc

Function at 0x4078f7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004027ff
and dword [ebp - 4], 0
cmp dword [0x4a534c], 0
mov ebx, eax
jne 0x4079a8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407a59
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407a59
push eax
call fcn.0040278d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a534c], eax
call esi
push eax
call fcn.0040278d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a5350], eax
call esi
push eax
call fcn.0040278d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a5354], eax
call esi
push eax
call fcn.0040278d
pop ecx
mov dword [0x4a535c], eax
test eax, eax
je 0x4079a8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040278d
pop ecx
mov dword [0x4a5358], eax
mov eax, dword [0x4a5358]
cmp eax, ebx
je 0x407a00
cmp dword [0x4a535c], ebx
je 0x407a00
push eax
call fcn.00402808
push dword [0x4a535c]
mov esi, eax
call fcn.00402808
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407a00
test edi, edi
je 0x407a00
call esi
test eax, eax
je 0x4079f7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4079f7
test byte [ebp - 0xc], 1
jne 0x407a00
or dword [ebp + 0x10], 0x200000
jmp 0x407a39
mov eax, dword [0x4a5350]
cmp eax, ebx
je 0x407a39
push eax
call fcn.00402808
pop ecx
test eax, eax
je 0x407a39
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407a39
mov eax, dword [0x4a5354]
cmp eax, ebx
je 0x407a39
push eax
call fcn.00402808
pop ecx
test eax, eax
je 0x407a39
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a534c]
call fcn.00402808
pop ecx
test eax, eax
je 0x407a59
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407a5b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1010640e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1027e8f0]
jne 0x10106418
repz ret
jmp fcn.10108b2f

Function at 0x1010967e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10105197
and dword [ebp - 4], 0
cmp dword [0x102800d0], 0
mov ebx, eax
jne 0x1010972f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x101097e0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x101097e0
push eax
call fcn.10105125
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x102800d0], eax
call esi
push eax
call fcn.10105125
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x102800d4], eax
call esi
push eax
call fcn.10105125
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x102800d8], eax
call esi
push eax
call fcn.10105125
pop ecx
mov dword [0x102800e0], eax
test eax, eax
je 0x1010972f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10105125
pop ecx
mov dword [0x102800dc], eax
mov eax, dword [0x102800dc]
cmp eax, ebx
je 0x10109787
cmp dword [0x102800e0], ebx
je 0x10109787
push eax
call fcn.101051a0
push dword [0x102800e0]
mov esi, eax
call fcn.101051a0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10109787
test edi, edi
je 0x10109787
call esi
test eax, eax
je 0x1010977e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1010977e
test byte [ebp - 0xc], 1
jne 0x10109787
or dword [ebp + 0x10], 0x200000
jmp 0x101097c0
mov eax, dword [0x102800d4]
cmp eax, ebx
je 0x101097c0
push eax
call fcn.101051a0
pop ecx
test eax, eax
je 0x101097c0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x101097c0
mov eax, dword [0x102800d8]
cmp eax, ebx
je 0x101097c0
push eax
call fcn.101051a0
pop ecx
test eax, eax
je 0x101097c0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102800d0]
call fcn.101051a0
pop ecx
test eax, eax
je 0x101097e0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x101097e2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1010a120
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1027dd64], 0
mov byte [0x1027dd68], 0
mov dword [0x1027dd60], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1010a226
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
add eax, 0xfffff6b9
mov dword [0x1027dd6c], 0
mov dword [ebp - 0x28], eax
mov eax, ecx
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x1027dd64]
mov ebx, dword [ebp - 0x18]
movzx esi, byte [ebx + ecx]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1027dd6c], esi
mov dword [0x1027dd5c], 0x1dfc
mov eax, esi
cdq
mov esi, dword [ebp - 0x2c]
idiv esi
mov dword [0x1027dd64], edx
mov esi, dword [ebp - 0x28]
mov dword [0x1027dd58], esi
mov bl, byte [ebx + ecx]
mov byte [0x1027dd68], bl
mov dword [0x1027dd5c], 0xe30
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov ecx, dword [0x1027dd5c]
add ecx, 0xfffffd81
mov dword [0x1027dd58], ecx
mov bl, byte [0x1027dd68]
mov ecx, dword [0x1027dd64]
mov byte [esi + ecx], bl
mov ecx, dword [0x1027dd60]
add ecx, 1
mov dword [0x1027dd60], ecx
cmp ecx, 0x100
mov dword [ebp - 0x30], ecx
jl 0x1010a272
jmp 0x1010a285
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1027dd58], 0x1fdd
mov eax, dword [0x1027dd60]
add eax, 1
mov dword [0x1027dd60], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1010a226
xor eax, eax
mov ecx, 0x1fdd
mov dword [0x1027dd60], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x1010a160
mov eax, dword [0x1027dd58]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x1010a160
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1010b360
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1027dd58], 0x512
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1010b3f9
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
jl 0x1010b3f9
jmp 0x1010b3db
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1010b450
jmp 0x1010b467
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1010b43b
jmp 0x1010b467
mov eax, dword [ebp - 0x18]
mov dword [0x1027dd5c], 0x11c4
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x1010b411
jmp 0x1010b467
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x1010b3db
jmp 0x1010b396
mov dword [0x1027dd5c], 0x2624
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1010b467
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1010b3c7
jmp 0x1010b467
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1010b3af
jmp 0x1010b467
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x1010b476
xor eax, eax
mov dword [0x1027dd5c], 0x1864
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x1010b860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1027dd60], 0
mov dword [0x1027dd64], 0
mov dword [0x1027dd70], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1010b9ba
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x1010b8bb
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, edx
add edi, 1
mov dword [0x1027dd58], 0x1e8a
add eax, 1
mov dword [ebp - 0x2c], edx
cdq
idiv esi
mov dword [0x1027dd60], edx
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1027dd64], edx
mov dword [0x1027dd58], 0x40c5
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov cl, byte [ecx + esi]
mov byte [0x1027dd68], cl
mov dword [0x1027dd5c], 0x471
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1027dd68]
mov edx, dword [0x1027dd64]
mov byte [ebx + edx], cl
mov edx, dword [0x1027dd60]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1027dd64]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1027dd70], ecx
mov dword [0x1027dd58], 0x1cd9
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x2c]
mov ch, byte [edx + esi]
mov dword [0x1027dd5c], 0xbad
mov dword [0x1027dd58], 0x1439
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x34], edi
je 0x1010b9b8
mov eax, dword [0x1027dd60]
mov ecx, dword [0x1027dd64]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
jmp 0x1010b8bb
jmp 0x1010b9ba
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1010b9d0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x1027dd58], 0x20bf
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.1010a2b0
lea ecx, [0x1010a020]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x40], edx
mov dword [esp + 0x78], 0x140400
mov edx, dword [0x1027dd44]
mov dword [esp + 0x6c], edx
mov edx, dword [0x1027dd48]
mov dword [esp + 0x58], edx
mov edx, dword [0x1027dd4c]
mov dword [esp + 0x84], edx
mov edx, dword [0x1027dd50]
mov dword [esp + 0x7c], edx
mov edx, dword [0x1027dd54]
mov dword [esp + 0x60], edx
mov dword [0x1027dd58], 0x212d
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1010baa3
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1010baa3
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1010ac60
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x1027dd58], 0x1ed4
mov dword [esp + 0x14], eax
jmp 0x1010bafe
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x1010ba59
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
jne 0x1010ba59
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x50], ecx
mov dword [0x1027dd5c], 0x1fcc
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x68], eax
call fcn.1010b360
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x14], ecx
je 0x1010ba6d
mov eax, dword [esp + 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x8060d0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8060d6
pop ebp
sub ebp, 6
sub ebp, 0x4060d0
jmp 0x806134
jmp 0x80613d
mov eax, 0x4060d0
add eax, ebp
add eax, 0x93
mov ecx, 0x633
mov edx, 0x62d95349
xor byte [eax], dl
inc eax
dec ecx
jne 0x806154
jmp 0x806167
and ecx, dword [ecx]
and dword [ecx + 0x59], ecx
dec ecx
dec ecx
and dword [ecx - 0x7b], ecx
dec ecx
enter 0xffffffffffffd3b9, 0xffffffffffffff8e
iretd
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8e0f78
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e0f7e
pop ebp
sub ebp, 6
sub ebp, 0x4e0f78
jmp 0x8e0fdc
jmp 0x8e0fe5
mov eax, 0x4e0f78
add eax, ebp
add eax, 0x93
mov ecx, 0x629
mov edx, 0x4963a4db
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e0ffc
jmp 0x8e100f
mov cl, 0x9b
mov bl, 0xdb
retf
Function at 0x4079f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x407a3d
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x407a0c
jmp 0x407a3d
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x407a2d
pop esi
pop ebp
ret

Function at 0x4084cb
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x408500
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40852a
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40852a
test edi, edi
je 0x4084f7
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4084f7
test edi, edi
je 0x408532
mov eax, edi
jmp 0x4084f9
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x4084f9
int3
Function at 0x40aa78
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestRollingMean.exe_gMozillaPoisonSize], eax
call fcn.004084cb
pop ecx
mov ecx, dword [sym.TestRollingMean.exe_gMozillaPoisonSize]
mov dword [sym.TestRollingMean.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40aab0
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestRollingMean.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x40f396
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
mov ebx, 0x4efdbc
cmp dword [ebx], 0
jne 0x40f3db
mov dword [ebp - 4], 0x101
push 1
push dword [ebp - 4]
mov eax, dword [fcn.004092c1]
call eax
mov dword [ebx], eax
add esp, 8
lea eax, [ebp - 4]
push eax
push dword [ebx]
mov eax, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call eax
or eax, eax
je 0x40f3d6
cmp dword [ebp - 4], 0
jne 0x40f3db
mov eax, dword [ebx]
mov byte [eax], 0
cmp dword [ebx], 0
je 0x40f3e7
mov eax, dword [ebx]
cmp byte [eax], 0
jne 0x40f3ee
mov eax, 0
jmp 0x40f3f8
push dword [ebx]
call fcn.0040a7ee
sub esp, 0xfffffffc
pop ebx
leave
ret

Function at 0x40fb6d
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
mov ebx, 0x4d409c
cmp byte [ebx], 0
jne 0x40fba2
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
push 0x100
push ebx
call sub.WS2_32.dll_gethostname
call sub.WS2_32.dll_WSACleanup
mov eax, ebx
pop ebx
leave
ret

Function at 0x40fba7
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x4d419c
cmp byte [ebp + 8], 0
je 0x40fbc0
cmp byte [esi], 0
je 0x40fbc0
mov eax, esi
jmp 0x40fc1d
push 0x400
call fcn.0040fb6d
push eax
push esi
call fcn.004a9cb0
add esp, 0xc
mov byte [esi + 0x3ff], 0
push 0x2e
push esi
call fcn.004a8cc0
add esp, 8
or eax, eax
je 0x40fbee
mov eax, esi
jmp 0x40fc1d
push esi
call sub.WS2_32.dll_gethostbyname
mov ebx, eax
cmp ebx, 0
je 0x40fc00
cmp dword [ebx], 0
jne 0x40fc04
mov eax, esi
jmp 0x40fc1d
push 0x400
push dword [ebx]
push esi
call fcn.004a9cb0
mov eax, esi
add esp, 0xc
mov byte [esi + 0x3ff], 0
pop esi
pop ebx
leave
ret
Function at 0x40ff43
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, dword [ebp + 8]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov byte [edi + 0xc], 0
mov byte [edi + 0xd], 0
cmp dword [edi], 0
jne 0x40ff71
mov eax, 0
jmp 0x410027
mov esi, dword [edi + 0x10]
cmp esi, 0
jne 0x40ffc4
push 0x4d45f8
push dword [edi]
call fcn.0040bcad
mov ebx, eax
sub esp, 0xfffffff8
push 0x140
push 1
mov eax, dword [fcn.004092c1]
call eax
add esp, 8
mov esi, eax
mov dword [edi + 0x10], esi
push esi
push ebx
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call eax
mov dword [edi + 0x20], eax
push ebx
mov eax, dword [0x4d3eec]
call eax
sub esp, 0xfffffffc
cmp dword [edi + 0x20], 0xffffffff
jne 0x40ffe9
mov eax, 0
jmp 0x410027
cmp dword [edi + 0x20], 0xffffffff
jne 0x40ffd1
mov eax, 0
jmp 0x410027
push dword [edi + 0x10]
push dword [edi + 0x20]
mov eax, dword [sym.imp.KERNEL32.dll_FindNextFileA]
call eax
test eax, eax
jne 0x40ffe9
mov eax, 0
jmp 0x410027
mov esi, dword [edi + 0x10]
lea esi, [esi + 0x2c]
mov dword [edi + 4], esi
push dword [edi + 0x24]
mov eax, dword [0x4d3eec]
call eax
sub esp, 0xfffffffc
push dword [edi + 4]
push dword [edi]
call fcn.0040bda2
sub esp, 0xfffffff8
mov dword [edi + 8], eax
mov dword [edi + 0x24], eax
mov ebx, dword [edi + 0x10]
mov ebx, dword [ebx]
shr ebx, 4
and ebx, 1
mov byte [edi + 0xc], bl
mov byte [edi + 0xd], 0
mov eax, dword [edi + 4]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x411068
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push ebx
push edi
push esi
call fcn.004b31f3
add esp, 0xc
pop ebx
pop edi
pop esi
leave
ret