joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420284
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x73789f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202bf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202d8
lea eax, [ebp - 0x10]
mov edx, dword [0x754348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202eb
lea eax, [ebp - 0x10]
mov edx, dword [0x754348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4202f7
adc edx, 0
mov edx, dword [edx*4 + 0x753178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420471
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420464
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420464
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420402
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420402
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420402
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420402
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420464
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420464
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420489
inc ebx
cmp ebx, 0x19
jne 0x4202b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7378a6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x40158f
Capabilities:
Enumerate pe sections
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push esi
push edi
call sub.KERNEL32.dll_GetTickCount
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA

Function at 0x4015b0
Capabilities:
Enumerate pe sections

Disassembly:
cmp byte [ebp - 0x104], 0
jne 0x4016ff
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
rcl byte [edi - 0x73], cl
inc esp
or byte [eax], bl
cmp byte [ebp - 0x104], 0
jne 0x40188e
add byte [eax], al
add byte [ebx - 0x3ca2e73c], al
int3
push 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetFileAttributesExA
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov ecx, dword [0x423dd2]
inc ecx
cdq
idiv ecx
mov edi, eax
and edi, 0xffffffa8
mov dword [ebp - 0x108], edi
or esi, esi
jne 0x4019d7
or ebp, dword [eax]
add dword [eax], eax
add bh, bh
jne 0x4018dc
push edx
jmp 0x4018e6
pop ss
push 0x100
push dword [ebp + 0xc]
push ecx
push dword [0x662a2010]
call dword [0x662a1034]
jmp 0x4018fc
pop esi
pop ebp
ret 8
mov eax, dword [ebp - 0x108]
pop edi
pop esi
leave
ret

Function at 0x449e10
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call sub.MPR.dll_WNetCloseEnum
mov dword [esp + 8], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea ecx, [esp + 0xc]
mov edi, eax
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetACP]
test edi, edi
mov dword [0xa4ee4c], eax
je 0x449e7b
test esi, esi
je 0x449e6a
mov edx, dword [0x64ed2c]
push 0x64ea48
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [0xa4ee4c]
pop edi
pop esi
add esp, 8
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100011d0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x48
xor eax, eax
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
jmp 0x10001209
mov eax, esp
mov dword [eax + 8], 0xb2
mov dword [eax + 4], 0x7ed
mov dword [eax], 0x6dbb85
mov eax, dword [sym.imp.KERNEL32.dll_SetupComm]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
jmp 0x1000125d
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, esp
mov dword [edx + 8], 0x3ba
mov dword [edx + 4], 0x3ba
mov dword [edx], 0x7b6792
mov edx, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
call edx
sub esp, 0xc
xor ecx, ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x37
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
je 0x100011e4
jmp 0x1000124a
mov eax, dword [ebp - 0x18]
sub eax, 0xf
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
jne 0x10001274
jmp 0x1000125d
mov eax, esp
mov dword [eax], 0x58
mov eax, dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
call eax
sub esp, 4
mov dword [ebp - 0x34], eax
jmp 0x100012c9
mov eax, dword [ebp - 0x30]
mov ecx, esp
mov dword [ecx + 4], 0x7d8
mov dword [ecx], 0x4c257a
mov ecx, dword [sym.imp.GDI32.dll_SetBkMode]
mov dword [ebp - 0x38], eax
call ecx
sub esp, 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov esi, esp
mov dword [esi + 4], edx
mov dword [esi], 0xedf7ea
mov edx, dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov dword [ebp - 0x3c], eax
call edx
sub esp, 8
mov ecx, dword [ebp - 0x38]
add ecx, 1
cmp ecx, 0xa
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], ecx
jne 0x10001274
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x15
mov dword [ebp - 0x10], eax
jne 0x10001209
add esp, 0x48
pop esi
pop ebp
ret
Function at 0x10006400
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1003016c], 0
mov dword [0x10030170], 0
mov dword [0x10030178], 0
mov dword [0x10030164], 0x1a14
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x1000652f
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, dword [0x1003016c]
mov esi, eax
add esi, 1
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x1003016c], edx
mov dword [0x10030164], 0xfbe
mov edi, dword [0x10030170]
mov ebx, dword [ebp - 0x1c]
movzx edx, byte [ebx + edx]
add edx, edi
mov eax, edx
cdq
idiv ecx
mov dword [0x10030170], edx
mov ecx, dword [0x1003016c]
mov bl, byte [ebx + ecx]
mov byte [0x10030174], bl
mov edi, dword [ebp - 0x1c]
mov bl, byte [edi + edx]
mov byte [edi + ecx], bl
mov dword [0x10030164], 0x1d46
mov bl, byte [0x10030174]
mov ecx, dword [0x10030170]
mov byte [edi + ecx], bl
mov ecx, dword [0x1003016c]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x10030170]
movzx edx, byte [edi + edx]
add edx, ecx
and edx, 0xff
mov dword [0x10030178], edx
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x24]
mov bl, byte [ecx + edi]
mov ecx, dword [ebp - 0x1c]
xor bl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], bl
mov ecx, dword [0x10030168]
add ecx, 0x374
mov dword [0x10030168], ecx
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
mov dword [ebp - 0x20], esi
jne 0x10006459
mov dword [0x10030168], 0x20c0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10006550
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [fcn.10006550]
mov ecx, dword [0x10030168]
add ecx, 0xffffe02f
mov edx, dword [0x10030164]
add edx, 0xffffdbc5
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
jmp 0x1000658f
mov eax, dword [ebp - 0x10]
mov dword [0x10030168], eax
mov eax, dword [ebp - 0x14]
add esp, 0x14
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
jne 0x100065b1
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x1000657f
mov eax, dword [ebp - 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
jmp 0x1000658f
Function at 0x10006730
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x10030170], 0
mov byte [0x10030174], 0
mov dword [0x10030164], 0x21
mov dword [0x1003016c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jmp 0x10006783
xor eax, eax
mov dword [0x1003016c], 0
mov dword [ebp - 0x1c], eax
jmp 0x100067b4
mov dword [0x10030168], 0x10da
mov eax, dword [0x1003016c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1003016c]
add eax, 1
mov dword [0x1003016c], eax
cmp eax, 0x100
jl 0x10006783
jmp 0x10006772
mov eax, dword [ebp - 0x1c]
mov ecx, 0x100
mov edx, dword [0x10030170]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov eax, edi
cdq
idiv ecx
mov dword [0x10030170], edx
mov ecx, dword [0x1003016c]
mov edi, dword [ebp - 0x18]
mov bl, byte [edi + ecx]
mov byte [0x10030174], bl
mov bl, byte [edi + edx]
mov byte [edi + ecx], bl
mov bl, byte [0x10030174]
mov ecx, dword [0x10030170]
mov byte [edi + ecx], bl
mov dword [0x10030164], 0x2cc
mov ecx, dword [0x1003016c]
add ecx, 1
mov dword [0x1003016c], ecx
cmp ecx, 0x100
mov dword [ebp - 0x1c], ecx
jl 0x100067b4
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10006f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x10030164], 0xf5e
mov edx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0x78
mov edi, edx
add edi, esi
add edi, 0x74
mov esi, dword [edi]
imul edi, eax, 0x78
add edx, edi
add edx, 0x58
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x536
mov ecx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jne 0x10006f53
lea eax, [0x1000813f]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
call fcn.10006b80
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.10006250
mov ecx, eax
mov dword [0x1003017c], eax
mov eax, esp
mov edx, dword [ebp - 0x3c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
lea edx, section..data
imul esi, eax, 0x78
mov edi, edx
add edi, esi
add edi, 0x74
mov esi, dword [edi]
imul edi, eax, 0x78
mov ebx, edx
add ebx, edi
add ebx, 0x18
mov edi, dword [ebx]
imul ebx, eax, 0x78
add edx, ebx
add edx, 0x58
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x48]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edx
call fcn.10005f30
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
add eax, ecx
mov edx, dword [ebp - 0x54]
add edx, 1
cmp edx, 0x536
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
jne 0x10007005
mov eax, dword [ebp - 0x48]
add eax, 0x193ff
mov ecx, dword [ebp - 0x48]
add ecx, 0x37920
mov edx, dword [ebp - 0x48]
mov dword [esp], edx
mov dword [esp + 4], edx
mov esi, dword [ebp - 0x3c]
mov dword [esp + 8], esi
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ecx
call fcn.10005fa0
xor eax, eax
mov ecx, dword [0x10030168]
add ecx, 0x571
mov dword [0x10030168], ecx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x64]
mov dword [ecx], edx
mov dword [ecx + 4], 0x11d000
mov dword [0x10030164], 0x733
mov edx, dword [ebp - 0x60]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], 0x1ff0
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401609
Capabilities:
Access peb ldr_data
Decompress data using aplib
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x164
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [esp + 0x18], 0
mov ecx, dword [eax + 0xc]
add ecx, 0xc

Function at 0x401632
Capabilities:
Decompress data using aplib
Resolve function by parsing pe exports

Disassembly:
test byte [edi], ah
add al, byte [eax]
add byte [ebx + 0x448b3c43], cl
sbb byte [eax - 0x7b], bh
ror byte [edi], 0x84
mov dword [ecx], 0x548b0000
sbb byte [eax], bl
Function at 0x4016f4
Capabilities:
Decompress data using aplib
Resolve function by parsing pe exports

Disassembly:
sub ebp, 1
jb 0x401709
movzx ebx, byte [edx]
imul esi, esi, 0x1f
inc edx
or ebx, 0x20
add ebx, esi
mov esi, ebx
jmp fcn.004016f4
mov ebp, ecx
cmp ecx, 0xd3b27eb4
jne 0x4017a7
cmp esi, 0x85a6967e
mov ebx, eax
je 0x4017cf
cmp esi, 0x91a71a6c
je 0x4017b1
cmp esi, 0xa4c53531
je 0x4017ed
cmp esi, 0xd5af321a
je 0x4017e7
cmp esi, 0x687f1b5
je 0x4017c9
cmp esi, 0x13f0e1aa
lea edx, [esp + 0x5c]
je 0x4017f1
cmp esi, 0x1d7b5c55
je 0x4017ab
cmp esi, 0x21809519
mov ebx, eax
jmp 0x4017ff
lea edx, [esp + 0x4c]
jmp 0x4017f1
lea edx, [esp + 0x24]
jmp 0x4017f1
lea edx, [esp + 0x48]
jmp 0x4017f1
lea edx, [esp + 0x60]
jmp 0x4017f1
lea edx, [esp + 0x40]
jmp 0x4017f1
lea edx, [esp + 0x38]
Function at 0x40b317
Capabilities:
Create thread

Disassembly:
push 0x68
mov eax, 0x41d215
call fcn.0041bcbb
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x18]
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp + 0x14]
push eax
lea esi, [ebp - 0x68]
mov dword [ebp - 0x6c], ecx
call fcn.004022eb
push dword [ebp - 0x74]
and dword [ebp - 4], 0
lea esi, [ebp - 0x4c]
call fcn.00401798
mov byte [ebp - 4], 1
push dword [ebp - 0x70]
lea esi, [ebp - 0x30]
call fcn.004022eb
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 2
mov esi, dword [edi + 0x28]
lea eax, [ebp - 0x6c]
push eax
push dword [esi + 4]
push esi
call fcn.0040be58
mov ecx, dword [edi + 0x2c]
mov edx, 0x2c8590a
sub edx, ecx
cmp edx, 1
jae 0x40b2e5
push str.list_T__too_long
call fcn.0041025a
inc ecx
mov dword [edi + 0x2c], ecx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
push 0xb8
mov dword [ecx], eax
call fcn.0041082d
mov esi, eax
pop ecx
mov dword [ebp - 0x70], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x40b314
push esi
lea ebx, [ebp - 0x6c]
call fcn.0040b43d
jmp 0x40b316
xor esi, esi
push esi
push 0
push 0x40b41c
call fcn.00411a7d
add esp, 0xc
lea ebx, [ebp - 0x6c]
call fcn.0040b336
call fcn.0041bd05
ret 0x14
Function at 0x40c4c6
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x426090]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x25c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x260], eax
cmp eax, 0xffffffff
je 0x40c5c2
mov ecx, 0x422548
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c52b
test dx, dx
je 0x40c527
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c52b
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c505
xor eax, eax
jmp 0x40c530
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c59b
mov ecx, 0x42254c
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c565
test dx, dx
je 0x40c561
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c565
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c53f
xor eax, eax
jmp 0x40c56a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c59b
mov esi, dword [edi]
lea eax, [ebp - 0x25c]
push eax
push dword [esi + 4]
push esi
call fcn.0040c94b
mov ecx, dword [edi + 4]
mov edx, 0x6eb3e3
sub edx, ecx
cmp edx, 1
jb 0x40c5cf
inc ecx
mov dword [edi + 4], ecx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40c4fa
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.0041032b
leave
ret
push str.list_T__too_long
call fcn.0041025a
int3

Function at 0x40cf7d
Capabilities:
Check mutex on windows

Disassembly:
xor eax, eax
cmp dword [0x428178], eax
jne 0x40cfa0
push str.__sogou_medal_mapping_lock_2014__
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push eax
push 0x428178
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0xffffffffffffffff
push dword [0x428178]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
ret
Function at 0x40dadb
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x426090]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x133a253
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x23c], ebx
jne 0x40db2b
and dword [ebp - 0x234], 0
push str.install_failed
mov esi, str.create_process
lea ecx, [edi + 4]
call fcn.00405e86
jmp 0x40dbd5
push dword [ebp + 0xc]
mov ecx, ebx
push eax
call fcn.0040d76e
mov dword [ebp - 0x234], eax
test eax, eax
je 0x40db4b
mov ebx, dword [edi]
push str.install_success
xor esi, esi
jmp 0x40db1e
and dword [ebp - 0x230], 0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x230]
push eax
mov ecx, str.exitcode_
mov dword [ebp - 0x22c], 0x200
call fcn.00402d5d
push 0xa
mov esi, eax
push 0x20
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call fcn.004118cd
push esi
lea ecx, [ebp - 0x24]
call fcn.00402d5d
mov ecx, dword [ebp - 0x230]
mov eax, dword [ebp - 0x228]
mov byte [eax + ecx], 0
mov esi, dword [ebp - 0x228]
mov ebx, dword [edi]
push str.install_failed
lea ecx, [edi + 4]
call fcn.00405e86
lea eax, [ebp - 0x224]
add esp, 0x1c
cmp dword [ebp - 0x228], eax
je 0x40dbd6
push dword [ebp - 0x228]
call fcn.004111a2
pop ecx
cmp dword [edi], 1
je 0x40dc08
lea esi, [edi + 0x20]
cmp dword [esi + 0x14], 8
jb 0x40dbe8
mov eax, dword [esi]
jmp 0x40dbea
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40dc08
cmp dword [esi + 0x14], 8
jb 0x40dbfd
mov esi, dword [esi]
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, dword [ebp - 0x234]
mov edi, dword [ebp - 0x238]
push dword [ebp - 0x23c]
neg esi
sbb esi, esi
and esi, 0xffffffe3
add esi, 0x20
mov eax, edi
call fcn.0040e25c
push 0
push 0
push 0x503
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041032b
leave
ret 8

Function at 0x40e1f0
Capabilities:
Create thread

Disassembly:
cmp dword [0x426f7c], 0x10
mov eax, dword [0x426f68]
jae 0x40e203
mov eax, 0x426f68
push eax
call fcn.00411797
push eax
push 0
push 0x40e40c
call fcn.00411a7d
add esp, 0x10
ret

Function at 0x40e29b
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x41ce02
call fcn.0041bc52
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 2
pop esi
call fcn.0040e25c
push 0x7c
call fcn.0041082d
pop ecx
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 4], esi
cmp eax, esi
je 0x40e2e0
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call fcn.0040e279
push dword [ebp - 0x10]
mov ebx, eax
call fcn.0040e306
jmp 0x40e2e2
xor eax, eax
push esi
push esi
push eax
push 0x40e56b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0041bcf1
ret 8
Function at 0x40e3cd
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Local__sogou_medal_metux_2014__
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
push esi
sete byte [ebp - 1]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp byte [ebp - 1], al
pop esi
sete al
leave
ret

Function at 0x40e9d7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ea3b
cmp dword [ebp + 0xc], 1
je 0x40ea13
cmp dword [ebp + 0xc], 2
je 0x40ea13
push 0xd
pop eax
jmp 0x40ea3b
mov eax, dword [ebp - 4]
test edi, edi
je 0x40ea35
test eax, eax
je 0x40ea30
test al, 1
jne 0x40ea0e
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40ea35
jmp 0x40ea0e
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x410081
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x427320], 0
push esi
push edi
jne 0x40fff7
call fcn.0040ff63
test eax, eax
je 0x41003c
mov eax, dword [0x427320]
cmp eax, 1
jne 0x410018
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41003c
jmp 0x41007e
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x41007e
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x410040
xor eax, eax
jmp 0x41007e
mov eax, dword [esi]
push dword [0x427320]
call edi
mov edi, eax
test edi, edi
je 0x410062
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x41007e
lea edi, [esi + 0xff0]
push esi
push dword [0x427320]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x410068
mov eax, esi
pop edi
pop esi
ret
jmp 0x40ffe3

Function at 0x41032b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426090]
jne 0x410335
repz ret
jmp fcn.00412126