joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4630cc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00462f42

Function at 0x4670ef
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00466d6c
Function at 0x468b13
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c7518], 0
push esi
push edi
mov esi, 0x4c7530
jne 0x468b32
push 0
call fcn.0042543a
pop ecx
mov ecx, eax
call fcn.00468ad6
mov dword [0x4c4190], 0x270
mov edi, 0xe3
mov dword [0x4c7ef0], esi
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi], eax
mov esi, edx
dec edi
jne 0x468b47
mov edi, 0x18c
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, ecx
mov dword [esi], eax
lea esi, [edx]
dec edi
jne 0x468b7c
mov ecx, dword [0x4c7530]
mov al, cl
and al, 1
movzx edx, al
mov eax, dword [esi]
neg edx
pop edi
sbb edx, edx
xor eax, ecx
and eax, 0x7ffffffe
and edx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, edx
mov dword [esi], eax
pop esi
ret

Function at 0x46901b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x469040
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.00421080
add esp, 0xc
jmp 0x469053
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.00425812
add esp, 0x10
movzx ecx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, eax
mov byte [ebp - 4], 0
movzx eax, byte [ebp - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 8]
push str.EA06
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
call fcn.004258c0
neg eax
pop ecx
pop ecx
sbb eax, eax
neg eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x469129
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10000
mov eax, dword [esi + 0x460]
test eax, eax
je 0x46913f
cmp eax, ecx
jne 0x46915a
push dword [esi + 0x1c]
push ecx
push 1
push dword [esi + 0x458]
call fcn.00425812
add esp, 0x10
and dword [esi + 0x460], 0
mov ecx, dword [esi + 0x460]
mov eax, dword [esi + 0x458]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 0x460], ecx
pop esi
ret

Function at 0x469172
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x45c]
mov esi, dword [edi + 0x454]
mov byte [esi + edx], al
mov eax, 0x10000
inc dword [edi + 0x45c]
cmp dword [edi + 0x45c], eax
jne 0x4691b9
push dword [edi + 0x20]
push eax
push 1
push dword [edi + 0x454]
call fcn.00424a93
add esp, 0x10
and dword [edi + 0x45c], 0
pop edi
pop esi
pop ebp
ret 4
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5d8ab6
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x5d87dc
inc esi
mov esi, esi
sub ecx, 1
call fcn.005d8b00
dec esi
xor dword [edi], edx
dec ecx
add ecx, 0xcca3c0ae
add edi, 2
sub esi, 0xccfc42fd
add ecx, ecx
sub esi, ecx
cmp edi, ebx
jl fcn.005d8ab6
mov ecx, 0x39292e45
sub ecx, 1
ret
Function at 0x4078cd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x6f91d290]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x4078d7
mov ebp, dword [esp + 0x14]
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [esp + 0x18]
movzx eax, byte [edx + ebp]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x40791d
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x4078fc
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40793c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
lea eax, [esp]
push ebx
push esi
push edi
push 0x400
push ecx
xor esi, esi
push eax
mov edi, esi
call fcn.00437450
mov edx, dword [esp + 0x420]
add esp, 0xc
mov ebx, esi
add edx, 1
je 0x4079cc
push ebp
mov ebp, dword [esp + 0x414]
inc esi
and esi, 0x800000ff
jns 0x407982
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [esp + esi*4 + 0x10]
add edi, eax
and edi, 0x800000ff
jns 0x407998
dec edi
or edi, 0xffffff00
inc edi
mov cl, al
mov eax, dword [esp + edi*4 + 0x10]
mov dword [esp + esi*4 + 0x10], eax
movzx eax, cl
mov dword [esp + edi*4 + 0x10], eax
mov ecx, dword [esp + esi*4 + 0x10]
add ecx, eax
and ecx, 0x800000ff
jns 0x4079bf
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [esp + ecx*4 + 0x10]
xor byte [ebx + ebp], al
inc ebx
cmp ebx, edx
jb 0x407971
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x400
ret 8
Function at 0x599850
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x59986a
pop edi
lea eax, [esi + 1]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x59997a
push ebp
jmp 0x599880
mov eax, ebx
cmp ebx, 0x15b0
jb 0x59988f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x59993b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x5998b0
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x5998b0
test eax, eax
je 0x59994d
nop
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x599940
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x599880
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5d8e73
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x5d8b64
add ecx, ecx
call fcn.005d8eb9
add esi, 1
mov esi, 0xaeafcfa1
xor dword [edx], ebx
mov esi, ecx
sub ecx, 0x70295cbf
sub ecx, 0xf32f675
add edx, 2
dec esi
cmp edx, eax
jl fcn.005d8e73
push 0xb6a31743
pop ecx
ret
Function at 0x46c650
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23000]
push edi
jmp 0x46c66a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x46c671
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46c660
mov eax, 1
add ebx, ebx
jne 0x46c683
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x46c694
jne 0x46c6b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46c6b3
dec eax
add ebx, ebx
jne 0x46c6a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x46c678
add ebx, ebx
jne 0x46c6af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x46c705
xor ecx, ecx
sub eax, 3
jb 0x46c6cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46c73a
sar eax, 1
mov ebp, eax
jmp 0x46c6d6
add ebx, ebx
jne 0x46c6d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46c6a4
inc ecx
add ebx, ebx
jne 0x46c6e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46c6a4
add ebx, ebx
jne 0x46c6f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46c6e6
jne 0x46c702
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46c6e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46c724
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46c716
jmp 0x46c666
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46c724
add edi, ecx
jmp 0x46c666
pop esi
mov edi, esi
mov ecx, 0xb70
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46c742
cmp byte [edi], 0xc
jne 0x46c742
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x46c747
lea edi, [esi + 0x69000]
mov eax, dword [edi]
or eax, eax
je 0x46c7b6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x72f48]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x72fac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46c774
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x72fb4]
or eax, eax
je 0x46c7b0
mov dword [ebx], eax
add ebx, 4
jmp 0x46c791
call dword [esi + 0x72fb0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x46c7e7
cmp al, 0xef
ja 0x46c7da
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x46c7bc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x46c7c9
mov ebp, dword [esi + 0x72fb8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x46c81b
sub esp, 0xffffff80
jmp 0x4113b6
Function at 0x4235a0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer
Read file on windows
Set console window title

Disassembly:
mov eax, 0x1864
call fcn.0040e490
cmp dword [0x7adb8c], 0x37
jne 0x423692
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x404694
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0xc68]
push edx
push 0x40474c
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0x404788
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
lea eax, [esp + 8]
push eax
push 0x4047a8
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0x404848
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0
lea ecx, [esp + 0x468]
push ecx
push 0
push 0x4048f0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
lea edx, [esp + 0x1064]
push edx
push 0
push 0x40479c
push 0x40489c
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 0
push 0
push 0x4049a4
push 0x4049dc
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov eax, dword [0x7aeb80]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x42ebdc]
mov byte [eax + esi], dl
add esp, 0x1864
ret
Function at 0x423830
Capabilities:
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7adb8c]
sub esp, 0x2dc
push ebx
push ebp
push esi
mov esi, dword [0x42ebdc]
shr eax, 3
push edi
test eax, eax
je 0x4239df
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
jmp 0x423864
mov esi, dword [esp + 0x18]
cmp dword [0x7adb8c], 0x1c
jne 0x423881
lea eax, [esp + 0x34]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x428310]
mov ecx, dword [0x428314]
mov eax, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x28], edx
mov edx, dword [0x428318]
mov dword [esp + 0x30], ecx
mov ecx, dword [0x42831c]
mov dword [esp + 0x14], eax
mov ebx, 0xc6ef3720
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], 0x20
jmp 0x4238c5
mov eax, dword [esp + 0x14]
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [esp + 0x2c]
shl ecx, 4
add ecx, dword [esp + 0x24]
add eax, ebx
xor edx, ecx
xor edx, eax
sub edi, edx
mov ecx, edi
shl ecx, 4
mov dword [0x7adafc], 0
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
cmp dword [0x7adb8c], 0x1be
lea ebp, [ebx + edi]
jne 0x42391a
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x30]
cmp dword [0x7adb8c], 0x979
mov dword [0x7adb00], 0xff6b3619
mov dword [0x7adb04], 0xffffffff
jne 0x423956
lea eax, [esp + 0x98]
push eax
push 0x404528
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor esi, ebp
xor dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
mov eax, dword [0x7adb8c]
cmp eax, 0x93
je 0x423976
add ebx, 0x61c88647
dec dword [esp + 0x1c]
jne 0x4238c1
cmp eax, 0x8d4
jne 0x423992
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], edi
cmp dword [0x7adb8c], 0x17
jne 0x4239ce
push 0
push 0
push 0
push 0x404610
push 0x4046a8
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esi, 8
dec dword [esp + 0x20]
mov dword [esp + 0x18], esi
jne 0x423860
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2dc
ret
Function at 0x4738c7
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4735cc
or eax, edx
add edx, 0x3e7e5526
call fcn.00473904
sub esp, 4
mov dword [esp], edx
pop edx
xor dword [ebx], esi
inc eax
or edx, edx
dec edx
add ebx, 2
inc edx
push eax
pop eax
cmp ebx, ecx
jl fcn.004738c7
or eax, eax
sub eax, 0x4e2834e
ret
Function at 0x401123
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x18]
mov edi, ecx
push eax
call fcn.0040117e
xor ebp, ebp
pop ecx
pop ecx
mov ebx, dword [eax]
mov dword [eax], ebp
cmp dword [esp + 0x14], ebp
je 0x401152
push 4
push dword [esp + 0x18]
call fcn.004021ef
pop ecx
pop ecx
lea esi, [edi + 4]
push esi
push ebp
push ebx
push 0x401107
push ebp
push ebp
call fcn.004073c7
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x401174
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 6
mov dword [esi], ebp
call fcn.00401f1c
int3

Function at 0x40157f
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
push esi
mov esi, ebp
cmp dword [esp + 0x10], esi
jbe 0x4016ad
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push edi
mov edi, dword [esp + 0x14]
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x79
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x39
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x6e
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x41
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x4d
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x13
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x23
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xf7
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xb
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x94
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x17
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xf9
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x9d
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x4d
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x48
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x40
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xc1
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x45
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x12
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xc8
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x5c
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xa5
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe8
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x15
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xbf
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x33
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x3e
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x11
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x47
inc esi
cmp esi, dword [esp + 0x18]
jb 0x40159b
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x408959
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x4085d8
sub esi, 1
add ebx, esi
call fcn.00408976
xor dword [eax], edx
inc eax
cmp eax, ecx
jne fcn.00408959
ret

Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
std
in al, dx
fsubp st(4)
js 0x401e9d
mov esi, dword [ebp - 0x1d]
push esi
lea eax, [ebp - 0x78]
push 0xffffffffffffffe8
push eax
push esi
call 0x404086e0
mov ecx, dword [ebp + 8]
sub eax, 0x40c0c815
add byte [eax + 0x51], dl
add edx, 0x40
push str._s:__s___d__n
push edx
dec ebx
adc eax, 0x408e80
pop esi
mov edx, 0x83004102
invalid
nop
nop
nop
push ebp
scasd eax, dword es:[edi]
in al, dx
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0x7b]
push edi
mov eax, dword [esi + 0x14]
mov dword [ebp + 8], eax
adc byte [eax + 0x4b], ch
add byte [eax], al
dec esp
mov al, byte [0x8900af0b]
adc eax, 0xe30ba4
mov ebx, eax
popfd
inc esi
adc al, 0x85
invalid

Function at 0x40a950
Capabilities:
Encode data using xor

Disassembly:
test esp, esp
pop ds
in al, 0x1f
inc ecx
add byte [ebp - 0x74e88a37], al
add al, 0x85
xor eax, 0x50004063
lds edx, [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi], eax
jne 0x40a951
pop esi
cmpsd dword [esi], dword es:[edi]
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x43b659
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
push eax
pop ebx
and eax, ebx
call fcn.0043b690
add ebx, ebx
add ebx, 1
xor dword [esi], edi
or eax, eax
or ebx, eax
inc esi
sub ebx, eax
dec ebx
cmp esi, edx
jne fcn.0043b659
add ebx, 0x9fa0d55f
mov eax, 0x6fef8945
mov ebx, 0x2eabbf30
ret
Function at 0xcd2370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xcd238e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xcfb074
push ecx
mov edi, eax
call fcn.00ce6198
mov esi, eax
add esp, 8
test esi, esi
jne 0xcd23cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00ce602e
push esi
call fcn.00ce5fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xcd5850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xcd58ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xd00720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xcd58ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00ce61e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xcd58ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xd00720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xcd592a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00ce7082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xcd5957
mov word [eax], si
add eax, 2
push eax
call fcn.00ce7030
add esp, 4
jmp 0xcd5959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xcd58ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xcd58b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xcd5ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret