joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40604d
Capabilities:
Hide graphical window

Disassembly:
push 0x138
mov eax, 0x415fa2
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x128], eax
xor eax, eax
inc eax
mov dword [ebx + 0x24], eax
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x120]
push eax
mov dword [ebx + 0x28], ecx
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x120]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x144]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x118], 1
call fcn.00411c5b
lea esi, [ebp - 0x124]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00411c5b
test eax, eax
jne 0x4060e4
push 0xe
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x406109
push ebx
push edi
call fcn.00411c5b
push 0
push 0x4076dc
push dword [ebp - 0x128]
push 0x516
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x124]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x120]
push eax
call fcn.00408436
call fcn.00414c5e
ret 4

Function at 0x40613b
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebx + 0x24], 2
mov dword [ebp - 0x148], 1
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.00411c5b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00411c5b
test eax, eax
jne 0x4061da
push 0xe
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x4061ff
push ebx
push edi
call fcn.00411c5b
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x517
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8
Function at 0x406231
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebx + 0x24], 3
mov dword [ebp - 0x148], 1
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.00411c5b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00411c5b
test eax, eax
jne 0x4062d0
push 0xe
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x4062f5
push ebx
push edi
call fcn.00411c5b
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x518
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8

Function at 0x406327
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebx + 0x24], 4
mov dword [ebp - 0x148], 1
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.00411c5b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00411c5b
test eax, eax
jne 0x4063c6
push 0xe
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x4063eb
push ebx
push edi
call fcn.00411c5b
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x519
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8
Function at 0x40641d
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebx + 0x24], 6
mov dword [ebp - 0x148], 1
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.00411c5b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00411c5b
test eax, eax
jne 0x4064bc
push 0xe
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x4064e1
push ebx
push edi
call fcn.00411c5b
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x51b
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8

Function at 0x406513
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebx + 0x24], 5
mov dword [ebp - 0x148], 1
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.00411c5b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00411c5b
test eax, eax
jne 0x4065b2
push 0xe
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x4065d7
push ebx
push edi
call fcn.00411c5b
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x51a
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8
Function at 0x406609
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebx + 0x24], 7
mov dword [ebp - 0x148], 1
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.00411c5b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00411c5b
test eax, eax
jne 0x4066a8
push 0xe
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x4066cd
push ebx
push edi
call fcn.00411c5b
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x51c
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8

Function at 0x4066ff
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebx + 0x24], 8
mov dword [ebp - 0x148], 1
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.00411c5b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00411c5b
test eax, eax
jne 0x40679e
push 0xe
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x4067c3
push ebx
push edi
call fcn.00411c5b
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x51d
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8
Function at 0x4067f5
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebx + 0x24], 9
mov dword [ebp - 0x148], 1
call fcn.00407a43
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.00411c5b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea edi, [ebx + 8]
push 0
xor eax, eax
call fcn.00411c5b
test eax, eax
jne 0x406894
push 0xe
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x4068b9
push ebx
push edi
call fcn.00411c5b
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x51e
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8

Function at 0x40c4c6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419448]
jne 0x40c4cf
ret
jmp fcn.0040d579

Function at 0x40c83f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x419448]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0040c7d4
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0040d2b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x40c88e
cmp dword [ebp - 0x1c], 5
jb 0x40c8a6
jmp 0x40c8a2
cmp dword [ebp - 0x10], 1
jne 0x40c8a6
cmp dword [ebp - 0x1c], 4
ja 0x40c8a2
jne 0x40c8a6
cmp dword [ebp - 0x18], 0
jbe 0x40c8a6
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4194ac
call fcn.0040c2ac
test eax, eax
jge 0x40c8c7
mov byte [0x425b14], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040c4c6
add ebp, 0x78
leave
ret
Function at 0x40ca79
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x424f3c], 0
push esi
jne 0x40c9ec
call fcn.0040c917
test eax, eax
je 0x40ca2f
mov eax, dword [0x424f3c]
cmp eax, 1
jne 0x40ca0d
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x40ca2f
pop esi
ret
push eax
call dword [0x424f44]
test eax, eax
jne 0x40ca77
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40ca33
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x424f3c]
call dword [0x424f44]
mov edi, eax
test edi, edi
je 0x40ca5a
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x40ca76
lea edi, [esi + 0xff0]
push esi
push dword [0x424f3c]
call dword [0x424f40]
add esi, 0x10
cmp esi, edi
jb 0x40ca60
mov eax, esi
pop edi
pop esi
ret
jmp 0x40c9d9
Function at 0x40d56f
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x60
push 0x41dae0
call fcn.0040d680
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.kernel32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40d3da
push 0x12
call fcn.0040d32a
pop ecx
jmp 0x40d564
mov dword [esi], edi
push esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
push esi
push 0
test eax, eax
jne 0x40d3f8
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x40d564
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
je 0x40d42a
or edi, 0x8000
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x42542c], esi
mov dword [0x425434], eax
mov dword [0x425438], ecx
mov dword [0x42543c], edx
mov dword [0x425430], edi
call fcn.0040d34e
mov dword [ebp - 0x20], eax
xor ebx, ebx
inc ebx
push ebx
call fcn.0040e0b6
pop ecx
test eax, eax
jne 0x40d472
push 0x1c
call fcn.0040d32a
pop ecx
call fcn.0040f594
test eax, eax
jne 0x40d483
push 0x10
call fcn.0040d32a
pop ecx
call fcn.004106d6
mov dword [ebp - 4], ebx
call fcn.00410496
test eax, eax
jge 0x40d49c
push 0x1b
call fcn.0040f88e
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x426c9c], eax
call fcn.00410361
mov dword [0x424f70], eax
call fcn.00411c5b
test eax, eax
jge 0x40d4c2
push 8
call fcn.0040f88e
pop ecx
call fcn.00410035
test eax, eax
jge 0x40d4d3
push 9
call fcn.0040f88e
pop ecx
push ebx
call fcn.0040f9aa
pop ecx
test eax, eax
je 0x40d4e5
push eax
call fcn.0040f88e
pop ecx
call fcn.0040ffd8
test byte [ebp - 0x44], bl
je 0x40d4f5
movzx ecx, word [ebp - 0x40]
jmp 0x40d4f8
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x400000
call main
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x40d515
push eax
call fcn.0040fb0a
call fcn.0040fb2c
jmp 0x40d54a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0x40d569
mov eax, 0xff
call fcn.0040d6c5
ret
call fcn.00411c5b
jmp 0x40d38f
Function at 0x411c5b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x411c6a
pop dword [ebp - 0x34]
mov eax, 0x30a69134
add eax, 0xcf9a8b36
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x393e2
push 0
mov eax, 0x7e9124d2
add eax, 0x81b06d9a
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x49ab
xor edx, edx
add edx, eax
mov ebx, 0x43b600
add ebx, dword [ebp - 0x34]
mov edi, 0x825b3123
add edi, 0x5d0df461
sub dword [ebp - 0x24], eax
mov esi, dword [ebx]
xor dword [ebp - 0xc], eax
sub esi, edi
mov dword [ebp - 0x24], 0xbec0d0e1
mov dword [edx], esi
add dword [ebp - 0x28], eax
add edx, 0x465cf8fa
add edx, 0xb9a3070a
add ebx, 0x84c15392
sub ebx, 0x84c1538e
loop 0x411cbf
add eax, 0x1197f
xor ebx, ebx
add ebx, eax
add eax, 0xf6b53bba
sub eax, 0xf6b53bb5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x10001060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call fcn.1000106f
Function at 0x401550
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x618
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x628]
mov ecx, 0x81
stosw word es:[edi], ax
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
push esi
rep stosd dword es:[edi], eax
push str.Default_IM
push str.Instant_Messenger
stosw word es:[edi], ax
call fcn.004052a0
mov edi, dword [sym.imp.MSVCRT.dll__wcsicmp]
push str.WEBSITE
push esi
call edi
add esp, 0x14
test eax, eax
jne 0x4015d1
mov ecx, ebx
call fcn.004026c0
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x618
ret 4
lea eax, [esp + 0x214]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
call dword [sym.imp.IMStateHelper.dll_Ordinal_1]
add esp, 0xc
cmp word [esp + 0xc], 0
je 0x40165f
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40165f
push esi
push 0x4101a8
call edi
add esp, 8
test eax, eax
je 0x40163a
push 5
lea eax, [esp + 0x218]
push 0
lea ecx, [esp + 0x14]
push eax
push ecx
push str.open
push 0
call dword [0x411550]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x618
ret 4
lea edx, [esp + 0x214]
push 0
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00405730
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x618
ret 4
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x41e]
mov word [esp + 0x41c], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x41c]
push ecx
push esi
stosw word es:[edi], ax
call dword [sym.imp.IMStateHelper.dll_Ordinal_2]
lea edx, [esp + 0x424]
push edx
call fcn.004054d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x618
ret 4

Function at 0x405170
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push esi
call fcn.00405260
add esp, 4
test eax, eax
jne 0x4051bf
push esi
call fcn.00405130
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x4051bf
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0xc]
push 2
push ecx
push esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x406310
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
and eax, 0xffff
push eax
call fcn.004063a0
push eax
call fcn.00406330
add esp, 8
ret
Function at 0x40949c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0x10000000
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 1
mov eax, dword [0x410ef0]
mov dword [ebp - 8], eax
mov ecx, dword [0x410ef4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0
jmp 0x4094ea
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x1f
jge 0x40952c
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
test eax, eax
je 0x409516
lea ecx, [ebp - 8]
push ecx
call dword [0x411504]
cmp eax, 3
je 0x409516
mov edx, dword [ebp - 0x1c]
not edx
mov eax, dword [ebp - 0x18]
and eax, edx
mov dword [ebp - 0x18], eax
mov cx, word [ebp - 8]
add cx, 1
mov word [ebp - 8], cx
mov edx, dword [ebp - 0x1c]
shl edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x4094e1
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x40b170
Capabilities:
Encrypt data using des

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push 8
push 8
push eax
push 0x412748
mov dword [esp + 0x10], ecx
call fcn.0040b710
push 0x40
push 0x40d688
push 0x412748
push 0x412748
call fcn.0040b5e0
mov eax, dword [esp + 0x34]
add esp, 0x20
test eax, eax
jne 0x40b1ba
mov dword [0x412744], 0x412748
mov eax, 0x412768
jmp 0x40b1c9
mov dword [0x412744], 0x412768
mov eax, 0x412748
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov dword [0x412740], eax
push edi
lea ebp, [ebx + 0x2d0]
mov dword [esp + 0x1c], 0x10
jmp 0x40b1eb
mov eax, dword [0x412740]
mov ecx, 8
mov esi, eax
mov edi, 0x412720
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x24]
test ecx, ecx
mov ecx, dword [esp + 0x10]
jne 0x40b208
push ebx
jmp 0x40b209
push ebp
push eax
call fcn.0040b310
mov ecx, dword [0x412744]
mov edx, dword [0x412740]
push 0x20
push ecx
push edx
call fcn.0040b6d0
mov eax, dword [esp + 0x28]
mov edi, dword [0x412744]
add esp, 0xc
add ebx, 0x30
sub ebp, 0x30
mov ecx, 8
mov esi, 0x412720
dec eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], eax
jne 0x40b1e6
push 0x40
push 0x40d6c8
push 0x412748
push 0x412748
call fcn.0040b5e0
mov eax, dword [esp + 0x28]
push 8
push 0x40
push 0x412748
push eax
call fcn.0040b770
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10

Function at 0x40b280
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 8
push 8
push eax
push 0x4126e0
call fcn.0040b710
push 0x38
push str.91__
push 0x4126e0
push 0x4126e0
call fcn.0040b5e0
mov edi, dword [esp + 0x2c]
add esp, 0x20
xor esi, esi
movsx ecx, byte [esi + 0x40d7c0]
mov edx, dword [0x4114bc]
push ecx
push 0x1c
push edx
call fcn.0040b650
movsx eax, byte [esi + 0x40d7c0]
mov ecx, dword [0x4114c0]
push eax
push 0x1c
push ecx
call fcn.0040b650
push 0x30
push 0x40d790
push 0x4126e0
push edi
call fcn.0040b5e0
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x40b2b4
pop edi
pop esi
ret 8