joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4153e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x2024]
test eax, eax
je 0x415405
push eax
lea eax, [esi + 0x20]
push eax
call fcn.00415b50
mov dword [esi + 0x2024], 0
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push 0
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 4], 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x415442
cmp dword [ebp - 4], edi
pop edi
jae 0x41543b
push dword [sym.imp.TD_Root_22.12_15.dll_class_OdString_const_OdString::kEmpty]
lea eax, [esi + 0x10]
push eax
push 0x2e
jmp 0x41544e
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [sym.imp.TD_Root_22.12_15.dll_class_OdString_const_OdString::kEmpty]
lea eax, [esi + 0x10]
push eax
push 0x37
lea ecx, [ebp + 0xc]
call sub.TD_Root_22.12_15.dll_public:_void___thiscall_OdError_FileException::constructor_enum_OdResult__class_OdString_const___class_OdString_const__
push 0x433b1c
lea eax, [ebp + 0xc]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x415500
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
xorps xmm0, xmm0
push eax
push dword [ecx + 0xc]
movlpd qword [ebp - 8], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x415530
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ecx + 0x24], 0
je 0x415546
mov eax, dword [ecx + 0x28]
mov edx, dword [ecx + 0x2c]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
xorps xmm0, xmm0
push eax
push dword [ecx + 0xc]
movlpd qword [ebp - 8], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x415570
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
lea eax, [ebp - 0xc]
push eax
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 1
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 4]
movlpd qword [ebp - 8], xmm0
push eax
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x2024]
mov edx, 0
mov esi, dword [ebp - 0xc]
add ecx, eax
adc edx, dword [ebp - 4]
cmp edx, esi
jb 0x4155cf
ja 0x4155c7
cmp ecx, edi
jbe 0x4155cf
pop edi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edi
mov edx, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415880
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
push edi
test eax, 0x40000000
jne 0x415920
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
push ebx
push eax
push dword [ebp + 0xc]
push edi
call fcn.00415600
cmp ebx, 3
je 0x4158b1
cmp ebx, 4
jne 0x415919
mov eax, dword [edi]
cmp dword [eax + 0xc], 0
jne 0x4158c8
cmp dword [eax + 0x10], 0
je 0x4158c8
mov ecx, edi
call sub.TD_Root_22.12_15.dll_protected:_void___thiscall_OdString::syncUnicode_void_const
mov eax, dword [edi]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415919
test eax, 0x5e10
jne 0x415919
lea eax, [esi + 0x2c]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push dword [esi + 0xc]
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x20], eax
test eax, eax
je 0x415919
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x24], eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push dword [sym.imp.TD_Root_22.12_15.dll_class_OdString_const_OdString::kEmpty]
lea ecx, [ebp + 8]
push dword [ebp + 8]
push 0x30
call sub.TD_Root_22.12_15.dll_public:_void___thiscall_OdError_FileException::constructor_enum_OdResult__class_OdString_const___class_OdString_const__
push 0x433b1c
lea eax, [ebp + 8]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x415950
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp eax, 0x80000000
je 0x415966
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.00415600
push dword [sym.imp.TD_Root_22.12_15.dll_class_OdString_const_OdString::kEmpty]
lea ecx, [ebp + 8]
push dword [ebp + 8]
push 0x30
call sub.TD_Root_22.12_15.dll_public:_void___thiscall_OdError_FileException::constructor_enum_OdResult__class_OdString_const___class_OdString_const__
push 0x433b1c
lea eax, [ebp + 8]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x415990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41fd18
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x43fe30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov al, byte [ebp + 8]
push 0
mov byte [ebp + 0xb], al
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp + 0xb]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4159fa
cmp dword [ebp - 0x10], 1
jne 0x4159fa
mov byte [esi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [sym.imp.TD_Root_22.12_15.dll_class_OdString_const_OdString::kEmpty]
lea eax, [esi + 0x10]
push eax
push 0x32
lea ecx, [ebp - 0x14]
call sub.TD_Root_22.12_15.dll_public:_void___thiscall_OdError_FileException::constructor_enum_OdResult__class_OdString_const___class_OdString_const__
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00415ff0
int3

Function at 0x415a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41fd48
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x43fe30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x24]
test ecx, ecx
jne 0x415a8c
mov al, byte [ebp + 8]
push ecx
mov byte [ebp + 0xb], al
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp + 0xb]
mov dword [ebp - 0x10], ecx
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x415abe
cmp dword [ebp - 0x10], 1
jne 0x415abe
mov byte [esi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
cmp eax, dword [esi + 0x2c]
jb 0x415a9e
ja 0x415ae1
cmp edx, dword [esi + 0x28]
ja 0x415ae1
mov al, byte [ebp + 8]
mov byte [ecx + edx], al
add dword [esi + 0x30], 1
adc dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [sym.imp.TD_Root_22.12_15.dll_class_OdString_const_OdString::kEmpty]
lea eax, [esi + 0x10]
push eax
push 0x32
lea ecx, [ebp - 0x18]
call sub.TD_Root_22.12_15.dll_public:_void___thiscall_OdError_FileException::constructor_enum_OdResult__class_OdString_const___class_OdString_const__
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00415ff0
push dword [sym.imp.TD_Root_22.12_15.dll_class_OdString_const_OdString::kEmpty]
lea eax, [esi + 0x10]
push eax
push 0x32
lea ecx, [ebp - 0x14]
call sub.TD_Root_22.12_15.dll_public:_void___thiscall_OdError_FileException::constructor_enum_OdResult__class_OdString_const___class_OdString_const__
push 0x433b1c
lea eax, [ebp - 0x14]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x415b50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41fd78
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x43fe30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push 0
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x415bb4
cmp dword [ebp - 0x10], edi
jne 0x415bb4
mov byte [esi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [sym.imp.TD_Root_22.12_15.dll_class_OdString_const_OdString::kEmpty]
lea eax, [esi + 0x10]
push eax
push 0x32
lea ecx, [ebp + 0xc]
call sub.TD_Root_22.12_15.dll_public:_void___thiscall_OdError_FileException::constructor_enum_OdResult__class_OdString_const___class_OdString_const__
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00415ff0
int3

Function at 0x416020
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x416039
pop esi
mov esp, ebp
pop ebp
ret
push dword [sym.imp.TD_Root_22.12_15.dll_class_OdString_const_OdString::kEmpty]
lea eax, [esi + 0x10]
push eax
push 0x37
lea ecx, [ebp - 4]
call sub.TD_Root_22.12_15.dll_public:_void___thiscall_OdError_FileException::constructor_enum_OdResult__class_OdString_const___class_OdString_const__
push 0x433b1c
lea eax, [ebp - 4]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x416060
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0
jne 0x41607c
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x41608f
jmp 0x41608a
push dword [sym.imp.TD_Root_22.12_15.dll_class_OdString_const_OdString::kEmpty]
lea eax, [esi + 0x10]
push eax
push 0x32
jmp 0x41609b
pop esi
mov esp, ebp
pop ebp
ret
push dword [sym.imp.TD_Root_22.12_15.dll_class_OdString_const_OdString::kEmpty]
lea eax, [esi + 0x10]
push eax
push 0x37
lea ecx, [ebp - 4]
call sub.TD_Root_22.12_15.dll_public:_void___thiscall_OdError_FileException::constructor_enum_OdResult__class_OdString_const___class_OdString_const__
push 0x433b1c
lea eax, [ebp - 4]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x401a80
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edx, 2
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
cmp word [eax + ecx + 0x5c], 2
je 0x401ad0
mov edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x401af0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x401b47
xor ecx, ecx
xor edx, edx
jmp 0x401b29
cmp ax, 0x5c
jne 0x401bb0
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x401b47
cmp ax, 9
je 0x401b35
cmp ax, 0x20
jne 0x401b10
test ecx, ecx
je 0x401b9b
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x401b29
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x401bd0
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401080
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x401b98
cmp ax, 0x20
je 0x401b98
jmp 0x401b47
cmp ax, 0x22
jne 0x401b39
and edx, 1
jne 0x401b39
xor ecx, 1
jmp 0x401b1d
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x401b60
Function at 0x401af0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edx, 2
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
cmp word [eax + ecx + 0x5c], 2
je 0x401ad0
mov edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x401af0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x401b47
xor ecx, ecx
xor edx, edx
jmp 0x401b29
cmp ax, 0x5c
jne 0x401bb0
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x401b47
cmp ax, 9
je 0x401b35
cmp ax, 0x20
jne 0x401b10
test ecx, ecx
je 0x401b9b
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x401b29
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x401bd0
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401080
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x401b98
cmp ax, 0x20
je 0x401b98
jmp 0x401b47
cmp ax, 0x22
jne 0x401b39
and edx, 1
jne 0x401b39
xor ecx, 1
jmp 0x401b1d
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x401b60
Function at 0x430004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0xef7058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ef71a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xef707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xef706a
add dl, dl
jne 0xef7089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xef70dc
xor eax, eax
add dl, dl
jne 0xef7096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xef717d
add dl, dl
jne 0xef70a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xef70b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xef70bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xef70c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xef70d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xef7075
mov eax, 1
add dl, dl
jne 0xef70ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xef70f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xef70e1
sub eax, ebx
mov ebx, 1
jne 0xef7128
mov ecx, 1
add dl, dl
jne 0xef710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xef7119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xef7105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xef7075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xef713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xef714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xef7136
cmp eax, 0x7d00
jae 0xef716d
cmp eax, 0x500
jb 0xef7168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xef7075
cmp eax, 0x7f
ja 0xef7170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xef7075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xef719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xef7075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x484cdf
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x484a08
sub ebx, 1
mov ebx, edi
sub ebx, ebx
call fcn.00484d21
sub edi, 0x4e235f20
xor dword [esi], ecx
mov edi, 0xcd8a0083
add esi, 2
mov ebx, edi
sub edi, 0x1509c279
sub ebx, ebx
cmp esi, eax
jl fcn.00484cdf
sub edi, ebx
add ebx, 0x6d6f7558
sub edi, edi
ret
Function at 0x409710
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47c1eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047127b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x409792
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046f18d
mov eax, dword [eax]
push 0x50cc78
push eax
call fcn.00461bc4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00471506
test bl, bl
je 0x409792
push 0x50cc78
lea ecx, [esp + 0xc]
call fcn.00471896
push 0x50cc84
lea ecx, [esp + 0xc]
call fcn.00471896
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4097ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00471506
jmp 0x409899
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x409852
lea edx, [esp + 0x7c]
push 0x50cc80
push edx
call fcn.00461bc4
add esp, 8
test eax, eax
je 0x409852
lea eax, [esp + 0x7c]
push 0x50cc7c
push eax
call fcn.00461bc4
add esp, 8
test eax, eax
je 0x409852
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4097e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00471506
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a090
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a0f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40a100
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47c26b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x516648]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40a238
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40a166
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00471506
xor eax, eax
jmp 0x40a2af
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00471643
push esi
lea ecx, [esp + 0xc]
call fcn.004718d2
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40a28d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040a090
test eax, eax
jne 0x40a28d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040a090
test eax, eax
jne 0x40a28d
lea eax, [esp + 0x14]
push 0x50cc94
push eax
call fcn.00462c60
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a26c
lea ecx, [esp + 0x14]
push 0x50cc90
push ecx
call fcn.00462be0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a26c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40a26f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004715f3
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40a17e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00471506
xor eax, eax
jmp 0x40a2af
mov byte [esi], 0
push 0x50cc8c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00471506
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4