joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41539e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x420ee4], ebx
push esi
push edi
jne 0x41541e
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x415459
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x420ee4], eax
je 0x415459
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x420ee8], eax
call esi
cmp dword [0x420d24], 2
mov dword [0x420eec], eax
jne 0x41541e
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x420ef4], eax
je 0x41541e
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x420ef0], eax
mov eax, dword [0x420ef0]
test eax, eax
je 0x415463
call eax
test eax, eax
je 0x41544a
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x420ef4]
test eax, eax
je 0x41544a
test byte [ebp - 8], 1
jne 0x415463
cmp dword [0x420d30], 4
jb 0x41545d
or byte [ebp + 0x12], 0x20
jmp 0x415482
xor eax, eax
jmp 0x415492
or byte [ebp + 0x12], 4
jmp 0x415482
mov eax, dword [0x420ee8]
test eax, eax
je 0x415482
call eax
mov ebx, eax
test ebx, ebx
je 0x415482
mov eax, dword [0x420eec]
test eax, eax
je 0x415482
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x420ee4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x416d81
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00414450
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x416e1c
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x420d24]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x416e1c
cmp eax, 1
je 0x416e3d
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x416e1c
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x416de9
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x416e18
xor eax, eax
inc eax
jmp 0x416e5c
cmp edi, eax
jae 0x416e20
xor eax, eax
jmp 0x416e5c
cmp eax, esi
jae 0x416e27
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x420d24]
jmp 0x416e40
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402b13
Capabilities:
Terminate process

Disassembly:
push 0x4012ac
push 0x409090
call fcn.0040376b
pop ecx
pop ecx
push 1
call fcn.00403678
Function at 0x40631b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x409690
cmp edx, dword [eax]
je 0x40633d
add eax, 8
inc ecx
cmp eax, 0x409720
jl 0x40632e
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x409690]
jne 0x40646b
mov eax, dword [0x4099d8]
cmp eax, 1
je 0x406445
test eax, eax
jne 0x40636e
cmp dword [0x4092f4], 1
je 0x406445
cmp edx, 0xfc
je 0x40646b
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x4063a5
lea eax, [ebp - 0x1a4]
push 0x402200
push eax
call fcn.0040437b
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004039ae
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4063e8
lea eax, [ebp - 0x1a4]
push eax
call fcn.004039ae
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x402104
push edi
call fcn.0040427d
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x402580
push eax
call fcn.0040437b
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404382
lea eax, [ebp - 0xa0]
push 0x4020fe
push eax
call fcn.00404382
push dword [esi + 0x409694]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404382
push 0x12010
lea eax, [ebp - 0xa0]
push 0x402108
push eax
call fcn.00404048
add esp, 0x2c
pop edi
jmp 0x40646b
lea eax, [ebp + 8]
lea esi, [esi + 0x409694]
push 0
push eax
push dword [esi]
call fcn.004039ae
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
leave
ret
Function at 0x42ffc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0xc], ecx
xor ebx, ebx
lea ecx, [ebp - 4]
push ecx
push ebx
lea eax, [esi + 8]
push eax
push 0x42fdb7
push ebx
push ebx
mov byte [esi + 0x18], bl
mov dword [eax], esi
call fcn.00466e8b
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x42fff8
mov dword [esi + 4], ebx
cmp dword [esi + 4], ebx
jne 0x430005
mov byte [esi + 0x18], 1
xor al, al
jmp 0x430007
mov al, 1
pop esi
pop ebx
leave
ret 4

Function at 0x4309e7
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov esi, ecx
push 0
lea ebx, [esi + 0x30]
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x430a0a
xor eax, eax
jmp 0x430af3
push edi
call fcn.004667bd
push edi
push 0
push eax
mov dword [esi + 8], eax
call fcn.00466400
add esp, 0x10
push dword [esi + 8]
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x430a03
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
call fcn.00430798
test eax, eax
je 0x430a03
mov eax, dword [ebp - 0x2c]
mov ecx, eax
mov word [esi + 0xe], ax
mov eax, dword [ebp - 0x28]
shr ecx, 0x10
mov word [esi + 0xc], cx
mov ecx, eax
mov word [esi + 0x12], ax
mov eax, dword [ebp - 0x24]
shr ecx, 0x10
mov word [esi + 0x10], cx
mov ecx, eax
mov word [esi + 0x16], ax
mov eax, dword [ebp - 0x20]
shr ecx, 0x10
mov word [esi + 0x1a], ax
mov word [esi + 0x14], cx
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov edi, 0x104
push edi
shr ecx, 0x10
lea eax, [esi + 0x238]
push eax
mov word [esi + 0x18], cx
push str.CompanyName
mov ecx, esi
call fcn.00430889
test eax, eax
je 0x430a03
push edi
lea eax, [esi + 0x648]
push eax
push str.FileDescription
mov ecx, esi
call fcn.00430889
test eax, eax
je 0x430a03
push edi
lea eax, [esi + 0x440]
push eax
push str.ProductName
mov ecx, esi
call fcn.00430889
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1032bdd7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ecx, dword [edx + 0x14]
push 0xe58df8cf
jmp 0x10317d1b
pushal
call 0x1031449c
jle 0x103367a7
push 0x1cdf35da
pushal
jmp 0x10337c24
sbb si, cx
mov esi, dword [eax + 0x3c]
shld dx, sp, 1
pushfd
add esi, eax
shl dx, 0xd
cmc
mov edx, dword [esi + 0x78]
cmc
cmc
stc
pushfd
test edx, edx
push 0x63f79346
mov word [esp], 0xf55b
lea esp, [esp + 0x10]
je fcn.1033d42d
shl cl, 6
btc cx, si
add edx, eax
movsx cx, bl
pushal
mov byte [esp], bh
cmc
mov ecx, dword [esi + 0x7c]
cmc
add ecx, edx
pushal
mov dword [ebp - 0x10], ecx
rcl ecx, 0xd
rcr cl, cl
xor ch, ah
mov ecx, dword [ebp + 0xc]
mov byte [esp], 0xfb
cmp ecx, 0xffff
jmp 0x10333147
lea esp, [esp + 0x40]
jbe 0x1033530a
pushfd
shld di, si, 0xe
rcl edi, cl
test cl, 0x8a
mov edi, dword [edx + 0x24]
neg bl
xor bl, 0xf1
lea ecx, [esp + 0x77dad4d2]
add edi, eax
neg ch
movsx cx, cl
mov ebx, dword [edx + 0x20]
not ch
movzx ecx, al
add ebx, eax
inc cx
cmp ax, bx
sbb ecx, 0x644beb67
mov dword [ebp - 8], 0
rcr cx, 0xc
sar cx, 4
cmc
mov ecx, dword [edx + 0x18]
sub esp, 0xfffffffc
push edx
cmc
cmc
sub ecx, dword [edx + 0x10]
jmp 0x101b9044
call fcn.10332a63
sbb al, 0xab
nop
rcl byte [ebp - 3], cl
and al, byte [ecx]
cmp al, 0xc1
fcmovnu st(0), st(2)
cmovno edi, esi
loop 0x10336812
xlatb
sub al, 0xfe
adc dword [ebx - 0x18], edx
cli
in eax, dx
enter 0x334f, 0
push 0x7d
scasd eax, dword es:[edi]
insb byte es:[edi], dx
push esi
invalid
push esi
push ds
in eax, 0xea
int1
push eax
mov ebx, 0x6cdfab88
fdiv qword [ebx]
sub ebp, dword [ebx]
dec ebx
fld xword [ebp - 0x3e]
mov word [esp], cx
pushal
mov dword [esp + 0x3c], 0x2cd56aa1
pushfd
pushfd
lea esp, [esp + 0x44]
jmp 0x103404a8
pushal
pushfd
pushfd
pop dword [esp + 0x20]
jmp 0x1033f707

Function at 0x10337643
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ebp + 0x14], ecx
pushal
pushfd
lea esp, [esp + 0x2c]
ja 0x10331449
pushfd
jmp 0x101bba15
pushfd
push dword [esp]
mov esi, dword [esp + 0xc]
pop edi
pop ebx
pushfd
mov edi, dword [esp + 0xc]
pushal
call fcn.1032dd95
setno bh
pop ebx
jmp 0x1031704e
movsx di, al
jmp 0x10331ca1
not cl
btc ecx, edi
xor cx, 0x5b8
mov ecx, dword [esi + 4]
pushfd
stc
or ecx, ecx
push 0x56ffa6f2
jmp 0x10336dfe
pushal
mov edi, dword [esp + 0x20]
xchg si, bp
movsx esi, dl
bswap si
xchg bp, si
mov esi, dword [esp + 0x24]
movzx bp, al
movzx bp, al
pop ebp
mov ebp, dword [esp + 0x24]
pushfd
push dword [esp + 0x2c]
ret 0x38
lea esp, [esp + 8]
je 0x10335135
clc
bswap di
rcl di, cl
add dword [ebp - 4], ecx
call fcn.10330f8b
jmp fcn.10334f43
jmp 0x101b86fa
Function at 0x4053da
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x405400
jmp 0x405516
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
jne 0x405420
jmp 0x405516
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov al, byte [ebp - 4]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0040999c
add esp, 4
mov dword [0x40f0a0], 0
mov dword [ebp - 0x420], 0x646c6f47
mov dword [ebp - 0x41c], 0x6f736e65
mov byte [ebp - 0x418], 0x66
mov dword [ebp - 0x20], 0
jmp 0x40546d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x40548d
mov eax, dword [ebp - 0x20]
movsx eax, byte [eax + ebp - 0x420]
xor al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ecx + ebp - 0x420], al
jmp 0x40546a
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x417], al
push 0xa
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4054f5
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.0040953f
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0x4054a9
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40551b
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004092f4
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040937c
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00409c52
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 2
jne 0x40559e
cmp dword [0x40f2d2], 1
jne 0x40559e
cmp dword [ebp - 0xc], 0
je 0x40559e
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004053da
add esp, 8
jmp 0x4055ad
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x14], eax
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 8
Function at 0x40577c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
jmp 0x4057c4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4057ea
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x40f0a4], ecx
jne 0x4057e8
cmp dword [ebp - 0xc], 0
je 0x4057e6
mov eax, dword [ebp - 0xc]
add dword [eax + 8], 0xa
jmp 0x4057ea
jmp 0x4057c1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x40588d
mov dword [ebp - 0x18], 0
jmp 0x405818
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x40588d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x40f0a4], ecx
jne 0x40588b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx*4 + 0x40f1b2]
cmp dword [eax*4 + 0x40f13a], ecx
jb 0x40587a
mov eax, dword [ebp - 0x10]
cmp dword [0x40f0a0], eax
je 0x405868
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x40f11c]
push eax
call fcn.0040999c
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [0x40f0a0], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004094f3
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add dword [ecx*4 + 0x40f13a], eax
jmp 0x40588d
jmp 0x405815
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x40589e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
jmp 0x4058ec
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x40594e
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp dword [eax*4 + 0x40f0a4], ecx
jne 0x40594c
mov eax, dword [ebp - 0xc]
cmp dword [0x40f0a0], eax
je 0x405926
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x40f11c]
push eax
call fcn.0040999c
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x40f0a0], eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0040953f
add esp, 8
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x40594a
mov eax, dword [ebp - 8]
add dword [eax + 8], 0xa
jmp 0x40594e
jmp 0x4058e9
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x40597c
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004094f3
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x4095d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], 0xffffffff
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 0
push 0
push 0x1e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], 0
jmp 0x409612
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jge 0x4096e8
push 0
lea eax, [ebp - 0x14]
push eax
push 0xa
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
mov al, byte [ebp - 0x20]
cmp eax, 0x54
jne 0x4096e3
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x44
je 0x409662
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
je 0x409662
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x53
jne 0x4096e3
mov al, byte [ebp - 0x17]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.0040999c
add esp, 4
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
jne 0x4096b5
mov dword [0x40f2d2], 1
mov dword [ebp - 0x10], 0
jmp 0x409698
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jge 0x4096b3
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x1e]
xor cl, byte [ebp - 0x17]
mov eax, dword [ebp - 0x10]
mov byte [eax + ebp - 0x1e], cl
jmp 0x409695
jmp 0x4096bf
mov dword [0x40f2d2], 0
mov eax, dword [ebp - 0x1e]
xor eax, 0x19611225
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1a]
xor eax, 0x198931
and eax, 0xffffff
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx]
mov dword [ebp - 8], eax
jmp 0x4096e8
jmp 0x40960f
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 8]
jmp 0x4096ff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409829
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0xffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 0xa
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], 0
jmp 0x40985b
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jge 0x409876
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x18]
xor cl, byte [ebp - 0xf]
mov eax, dword [ebp - 8]
mov byte [eax + ebp - 0x18], cl
jmp 0x409858
cmp dword [ebp - 0x18], 0x646c6f47
jne 0x4098c0
cmp dword [ebp - 0x14], 0x6f736e65
jne 0x4098c0
xor eax, eax
mov al, byte [ebp - 0x10]
cmp eax, 0x66
jne 0x4098c0
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.0040999c
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x4098b7
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [ebp - 4], 0xa
jmp 0x4098d0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 4]
jmp 0x4098d5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409b9b
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
cmp dword [0x40f5e2], 0
je 0x409c45
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [0x40fb40], eax
mov dword [0x40fb44], 0
mov dword [0x40fb48], 0
push 0x40fb40
push 0x40a3f7
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x40fb48], 1
jne 0x409c18
push 0x43000
mov eax, 0x40f010
add eax, 0x5d6
push eax
mov eax, 0x40f010
add eax, 0x5ec
push eax
mov eax, dword [0x40fb44]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x409c3b
push 0x43000
mov eax, 0x40f010
add eax, 0x5d6
push eax
mov eax, 0x40f010
add eax, 0x5ec
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x409cad
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004092f4
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040937c
add esp, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00409edc
add esp, 8
cmp eax, 0xffffffff
je 0x409d12
mov dword [ebp - 0x14], 1
jmp 0x409d19
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 2
jne 0x409d49
cmp dword [ebp - 8], 0
je 0x409d49
cmp dword [ebp - 0x14], 0
je 0x409d49
push 0x40f690
mov eax, dword [ebp - 4]
push eax
call fcn.00409d5a
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x409f2a
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 2
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x409fff
cmp dword [ebp - 8], 0
jne 0x409fff
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov al, byte [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
push eax
call fcn.0040999c
add esp, 4
mov dword [ebp - 0x41c], 0x646c6f47
mov dword [ebp - 0x418], 0x6f736e65
mov byte [ebp - 0x414], 0x66
mov dword [ebp - 0x1c], 0
jmp 0x409fb7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
jge 0x409fd9
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax + ebp - 0x41c]
mov ecx, dword [ebp + 0xc]
xor al, byte [ecx]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + ebp - 0x41c], al
jmp 0x409fb4
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ebp - 0x413], al
push 0
lea eax, [ebp - 0x1c]
push eax
push 0xa
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40a011
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 8]
push 0xfffffffffffffff0
add ecx, 0x646c6f47
pop esi
xor word [eax + 0xc], cx
xor word [eax + 0xe], cx
xor dword [eax + 0x110], ecx
xor byte [eax + 0x114], cl
mov dword [ebp + 8], ecx
lea ecx, [eax + 0x10]
sub esi, eax
mov edi, 0x100
lea eax, [ecx + esi]
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp + 8]
xor byte [ecx], al
inc ecx
dec edi
jne 0x40d9b6
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40d9ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov eax, dword [eax + 8]
mov dword [ebp + 0x10], 0x100
add eax, 0x646c6f47
xor edi, edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 7]
mov eax, edi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp - 4]
xor al, byte [esi + edi]
inc edi
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x10]
jne 0x40d9f8
pop edi
pop esi
pop ebx
leave
ret