joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415ad8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00415738
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040515c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
test eax, eax
je 0x415b37
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x41ac10]
mov dl, 1
mov eax, dword [0x415630]
call fcn.0040b6e8
call fcn.0040469c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x416f00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x417081
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.00406d94
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00406db4
mov ebx, eax
jmp 0x41704d
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404f60
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408630
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00407cd0
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00407cd0
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004050f4
je 0x417024
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404f60
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00407cd0
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00407cd0
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004050f4
jne 0x41703e
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00406dd4
mov ebx, eax
test ebx, ebx
jne 0x416f7f
push esi
call sub.KERNEL32.DLL_GetVolumeInformationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417088
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404d14
lea eax, [ebp - 4]
call fcn.00404cf0
ret
Function at 0x417144
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x4171ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x415690]
call fcn.00415790
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00415830
xor ecx, ecx
mov edx, 0x417204
mov eax, ebx
call fcn.00415894
test al, al
je 0x4171b8
mov eax, dword [ebp - 4]
call fcn.0040515c
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404ee8
mov ecx, dword [ebp - 8]
mov edx, 0x41723c
mov eax, ebx
call fcn.00415a30
jmp 0x4171c5
mov edx, 0x417250
mov eax, dword [ebp - 4]
call fcn.00416d08
mov eax, ebx
call fcn.00415800
mov eax, ebx
call fcn.00403f04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4171f5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d14
ret

Function at 0x417e20
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x417ebb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x415690]
call fcn.00415790
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00415830
xor ecx, ecx
mov edx, 0x417ed0
mov eax, ebx
call fcn.00415894
test al, al
je 0x417e99
mov eax, dword [ebp - 4]
call fcn.0040515c
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404ee8
mov ecx, dword [ebp - 8]
mov edx, 0x417f08
mov eax, ebx
call fcn.00415a30
mov eax, ebx
call fcn.00415800
mov eax, ebx
call fcn.00403f04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417ec2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d14
ret
Function at 0x1000f9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000f9cf
pop dword [ebp - 0x3c]
mov eax, 0x85d085a2
sub eax, 0x75cf8bd3
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xd30607cf
add dword [ebp - 0x4c], 0x7b4c3d7c
mov dword [ebp - 0x48], 0x24e73324
sub dword [ebp - 0x48], 0xf2b3e6df
mov dword [ebp - 0x44], 0xc8e48b7
sub dword [ebp - 0x44], 0xc0420489
mov dword [ebp - 0x40], 0xdd038771
sub dword [ebp - 0x40], 0xdd038771
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xb5437610
sub dword [ebp - 0x4c], 0x40d10cba
mov dword [ebp - 0x48], 0xf325247f
sub dword [ebp - 0x48], 0xb1b8c30a
mov dword [ebp - 0x44], 0x54263555
sub dword [ebp - 0x44], 0xf0b6c8e9
mov dword [ebp - 0x40], 0xd1324d93
add dword [ebp - 0x40], 0x2ecdb26d
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x6abc6324
sub eax, 0x5abab310
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3f93f
push 0
call eax
mov ecx, 0x4c55
xor edi, edi
add edi, eax
mov ebx, 0x1002b000
add ebx, dword [ebp - 0x3c]
mov esi, 0xb19efe48
sub esi, 0x18f3553a
xor dword [ebp - 0x20], 0xfaf327c7
mov edx, dword [ebx]
xor dword [ebp - 0x24], 0x499f9b2d
sub edx, esi
sub dword [ebp - 0x38], ebx
mov dword [edi], edx
xor dword [ebp - 0x28], edi
add edi, 0x429a150d
add edi, 0xbd65eaf7
add ebx, 0x8c576d48
add ebx, 0x73a892bc
loop 0x1000fae2
add eax, 0x12427
mov ebx, eax
add eax, 5
mov ecx, 0x7fecec94
sub ecx, 0x6fecec94
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x40b750
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4013a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401360
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
lea ecx, [ebp - 0x14]
xor eax, eax
push ecx
push 0x2003f
push eax
lea edx, [ebp - 0x1c]
push 0x403f74
push edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
call esi
push eax
push 0x80000002
call fcn.004047d4
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
call edi
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov ecx, dword [ebx]
push eax
lea edx, [ebp - 0x20]
push ecx
push edx
call esi
push eax
mov eax, dword [ebp + 8]
push 1
push 0
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push ecx
push edx
call esi
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.004048f0
call edi
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
push ecx
push edx
call esi
mov eax, dword [ebp - 0x20]
push eax
push ebx
call esi
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
mov eax, dword [ebp - 0x14]
add esp, 0xc
push eax
call fcn.00404818
call edi
push 0x40b83f
jmp 0x40b83e
ret

Function at 0x40ba80
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4013a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401390
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
lea ecx, [ebp - 0x14]
xor eax, eax
push ecx
push 0x2003f
push eax
lea edx, [ebp - 0x1c]
push 0x403fd8
push edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
call esi
push eax
push 0x80000002
call fcn.004047d4
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
call edi
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov ecx, dword [ebx]
push eax
lea edx, [ebp - 0x20]
push ecx
push edx
call esi
push eax
mov eax, dword [ebp + 8]
push 1
push 0
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push ecx
push edx
call esi
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.004048f0
call edi
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
push ecx
push edx
call esi
mov eax, dword [ebp - 0x20]
push eax
push ebx
call esi
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
mov eax, dword [ebp - 0x14]
add esp, 0xc
push eax
call fcn.00404818
call edi
push 0x40bb6f
jmp 0x40bb6e
ret
Function at 0x1000bc8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000bc99
pop dword [ebp - 0x1c]
mov eax, 0xf8262fa0
sub eax, 0xe8257307
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3623f
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0xc2c17676
add ecx, 0x3d3ebf96
xor esi, esi
add esi, eax
mov edx, 0x1ac35878
add edx, 0xf5411388
add edx, dword [ebp - 0x1c]
mov edi, 0xd6d95af1
add edi, 0x3ca0d486
xor dword [ebp - 4], 0x38a2c958
mov ebx, dword [edx]
add ebx, edi
add dword [ebp - 0x10], edi
mov dword [esi], ebx
add dword [ebp - 0x14], edi
add esi, 0x5b94cccb
add esi, 0xa46b3339
add edx, 0x2eddab8d
add edx, 0xd1225477
loop 0x1000bcf5
add eax, 0xcb03
mov ebx, eax
add eax, 0x1522b3fe
add eax, 0xeadd4c07
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406037
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x406046
pop dword [ebp - 0x18]
mov eax, 0x9da80205
add eax, 0x62985e41
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x45c27794
sub dword [ebp - 0x28], 0xf7703249
mov dword [ebp - 0x24], 0xb7b2671c
add dword [ebp - 0x24], 0x7a80e529
mov dword [ebp - 0x20], 0xc3c73ecf
add dword [ebp - 0x20], 0x8885055f
mov dword [ebp - 0x1c], 0xec862278
sub dword [ebp - 0x1c], 0xec862278
lea eax, [ebp - 0x28]
push eax
mov eax, 0xc21757a9
sub eax, 0xc1d68755
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x46e039b
sub dword [ebp - 0x28], 0x8ffb9a45
mov dword [ebp - 0x24], 0x1a1f38c8
sub dword [ebp - 0x24], 0xd8b2d753
mov dword [ebp - 0x20], 0xc6a10f09
sub dword [ebp - 0x20], 0x6331a29d
mov dword [ebp - 0x1c], 0x6edaf9cb
add dword [ebp - 0x1c], 0x91250635
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x1488b2e4
add eax, 0xebb81d68
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3898f
push 0
call eax
mov ecx, 0x72c5a085
sub ecx, 0x72c55c71
xor ebx, ebx
add ebx, eax
mov edi, 0xcee7079c
sub edi, 0xcea5579c
add edi, dword [ebp - 0x18]
mov edx, 0xcb532938
sub dword [ebp - 0x14], 0x4d6b64b2
mov esi, dword [edi]
xor dword [ebp - 4], esi
xor esi, edx
mov dword [ebp - 8], 0xdaae095
mov dword [ebx], esi
sub dword [ebp - 4], esi
add ebx, 0x2fdeb628
add ebx, 0xd02149dc
add edi, 0x4dafb882
add edi, 0xb2504782
loop 0x406164
add eax, 0x10323
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x1005d905
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10033b58
push 0x10033b50
push 0x10031af8
push 0x1e
call fcn.1005d823
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005d939
push dword [ebp + 8]
mov ecx, esi
call dword [0x1006a188]
call esi
jmp 0x1005d93f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1005d983
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10033b68
push 0x10033b60
push 0x10031b1c
push 0x20
call fcn.1005d823
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005d9ba
push dword [ebp + 8]
mov ecx, esi
call dword [0x1006a188]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1005f303
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1005f3a0
push ebx
push esi
call fcn.1005f2cc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1005f215
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1005f34d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005f39f
push edi
push eax
call fcn.1005d640
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1005f36d
call fcn.1005d606
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005f39e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1005f215
add esp, 0x20
test eax, eax
jne 0x1005f38c
push edi
call fcn.1005d606
jmp 0x1005f394
push ebx
call fcn.1005d606
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x401178
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x407008], 0x8088405
inc edx
mov dword [ebx + 0x407008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x401324
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x408590
mov esi, section.DATA
mov edi, 0x408020
cmp byte [ebx + 0x28], 0
jne 0x401353
cmp dword [edi], 0
je 0x401353
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x401342
cmp dword [0x407004], 0
je 0x401362
call dword [0x407058]
cmp byte [ebx + 0x28], 2
jne 0x401372
cmp dword [esi], 0
jne 0x401372
xor eax, eax
mov dword [ebx + 0xc], eax
call dword [0x407020]
cmp byte [ebx + 0x28], 1
jbe 0x401383
cmp dword [esi], 0
je 0x4013a5
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4013a5
call dword [0x407018]
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x4013a5
test eax, eax
je 0x4013a5
push eax
call sub.KERNEL32.DLL_RaiseException
call dword [0x407024]
cmp byte [ebx + 0x28], 1
jne 0x4013b4
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x4013bf
call fcn.004012f4
cmp dword [ebx], 0
jne 0x4013db
cmp dword [0x408010], 0
je 0x4013d3
call dword [0x408010]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x401362

Function at 0x4017d4
Capabilities:
Get common file path
Get program files directory

Disassembly:
add esp, 0xffffff00
push 0x100
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlZeroMemory
push esp
push 0
push 0
push 0x26
push 0
call sub.shell32.dll_SHGetFolderPathA
push 0x401814
lea eax, [esp + 4]
push eax
lea eax, [esp + 8]
push eax
call sub.shlwapi.dll_PathCombineA
mov eax, esp
add esp, 0x100
ret

Function at 0x401e6b
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov edx, dword [ebp + 8]
mov ebx, dword [edx]
mov edx, dword [edx + 4]
bswap ebx
bswap edx
call 0x401e83
pop esi
lea esi, [esi - 0x28]
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xc6ef3720
mov edi, 0x20
mov eax, ebx
mov esi, ebx
shl eax, 4
shr esi, 5
xor esi, ecx
add eax, esi
mov esi, dword [ebp - 8]
xor esi, ebx
add eax, esi
add eax, dword [ebp - 4]
sub edx, eax
mov eax, edx
mov esi, edx
shl eax, 4
shr esi, 5
xor esi, ecx
add eax, esi
mov esi, dword [ebp - 0x10]
xor esi, edx
add eax, esi
add eax, dword [ebp - 0xc]
sub ebx, eax
sub ecx, 0x9e3779b9
dec edi
jne 0x401e9b
mov edi, dword [ebp + 0xc]
bswap edx
bswap ebx
mov dword [edi], ebx
mov dword [edi + 4], edx
popal
leave
ret 8
Function at 0x10035f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10035f6f
pop dword [ebp - 0x14]
mov eax, 0x36b95e88
add eax, 0xd94a00e7
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x9e1c2257
sub dword [ebp - 0x24], 0x4fc9dd0c
mov dword [ebp - 0x20], 0xd59f193f
add dword [ebp - 0x20], 0x5c943306
mov dword [ebp - 0x1c], 0xf32f7b04
sub dword [ebp - 0x1c], 0xa6e336d6
mov dword [ebp - 0x18], 0x1b815ece
sub dword [ebp - 0x18], 0x1b815ece
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xd4979b7d
add dword [ebp - 0x24], 0x9fdacdd9
mov dword [ebp - 0x20], 0x56ec14b7
sub dword [ebp - 0x20], 0x157fb342
mov dword [ebp - 0x1c], 0xb2fa9789
add dword [ebp - 0x1c], 0xb074d4e3
mov dword [ebp - 0x18], 0x94e42cf2
add dword [ebp - 0x18], 0x6b1bd30e
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x4d2fa
push 0
call eax
mov ecx, 0x45ec
mov ebx, eax
mov esi, 0xe48266fc
sub esi, 0xd47d7cfc
add esi, dword [ebp - 0x14]
mov edi, 0x10df72c6
sub edi, 0x3f4a4293
xor dword [ebp - 0xc], eax
mov edx, dword [esi]
xor edx, edi
xor dword [ebp - 0xc], 0xdcdc0dff
mov dword [ebx], edx
sub dword [ebp - 0x10], edx
add ebx, 0x989b1c32
add ebx, 0x6764e3d2
add esi, 0x183cc8fe
sub esi, 0x183cc8fa
loop 0x10036081
add eax, 0x10a83
mov ebx, eax
add eax, 0xe569a42
add eax, 0xf1a965c3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x1003f584
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004acd0]
jne 0x1003f58e
repz ret
jmp fcn.1003fc70
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x40e05a]
shl eax, 2
mov dword [0x40e05e], eax
push edi
push ecx
xor eax, eax
mov edi, 0x40f840
mov ecx, 0x415910
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
mov edx, dword fs:[4]
mov dword [0x40e06e], edx
mov eax, dword [edx - 8]
mov dword [0x40e066], eax
mov eax, dword [edx - 4]
mov dword [0x40e06a], eax
sub edx, 4
mov dword [0x415568], edx
sub edx, 4
cmp edx, esp
jae 0x401054
mov esp, edx
push 0
call fcn.00408b7e
pop ecx
push 0x40e02c
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e062], eax
push 0
jmp fcn.0040cda8

Function at 0x40107c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.0040b2c0
pop ecx
test eax, eax
jne 0x40109d
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
xor eax, eax
pop ebx
pop ebp
ret
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x402388
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push 0xa
push 0x40e4a8
mov eax, dword [0x4108ac]
push eax
call sub.KERNEL32.dll_FindResourceA
mov ebx, eax
test eax, eax
je 0x4023e0
push ebx
mov edx, dword [0x4108ac]
push edx
call sub.KERNEL32.dll_LoadResource
mov esi, eax
test eax, eax
je 0x4023e0
push esi
call sub.KERNEL32.dll_LockResource
mov edi, eax
test eax, eax
je 0x4023e0
push ebx
mov edx, dword [0x4108ac]
push edx
call sub.KERNEL32.dll_SizeofResource
push eax
push edi
call fcn.004023e8
add esp, 8
mov eax, 1
jmp 0x4023e2
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x404608
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x404611
mov eax, dword [ebp - 4]
add esp, 0xffffffb0
push 0x44
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.004068a8
add esp, 0xc
lea edx, [ebp - 0x2054]
mov dword [ebp - 0x44], 0x44
push 0x2000
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
lea eax, [ebp - 0x54]
lea edx, [ebp - 0x44]
push eax
push edx
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2054]
push 0
push ecx
push 0
call sub.KERNEL32.dll_CreateProcessA
cmp dword [ebp + 0xc], 0
je 0x404680
push 0xffffffffffffffff
mov eax, dword [ebp - 0x54]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov esp, ebp
pop ebp
ret

Function at 0x4049c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.KERNEL32.dll_GetVersionExA
cmp dword [ebp - 0x8c], 0
je 0x404abe
lea edx, [ebp - 8]
push edx
call sub.SHELL32.DLL_SHGetMalloc
test eax, eax
jne 0x404abe
lea ecx, [ebp - 4]
push ecx
push 2
push ebx
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
test eax, eax
jne 0x404abe
xor eax, eax
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], eax
lea edx, [ebp - 0x1c0]
mov dword [ebp - 0xb4], edx
xor eax, eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0xb0], ecx
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0xac], 1
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
push ecx
call sub.SHELL32.DLL_SHBrowseForFolder
mov ebx, eax
test ebx, ebx
je 0x404ab1
lea eax, [ebp - 0x2c4]
push eax
push ebx
call sub.SHELL32.DLL_SHGetPathFromIDList
test eax, eax
je 0x404aa7
xor eax, eax
lea edi, [ebp - 0x2c4]
or ecx, 0xffffffff
mov esi, 0x410bf0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405ae4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx]
xor ecx, dword [0x415520]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 4]
xor edx, dword [0x415524]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
mov ecx, dword [eax + 0xc]
xor ecx, dword [0x41552c]
xor edx, dword [0x415528]
xor ebx, ebx
mov eax, ecx
mov esi, ecx
shr esi, 0x15
shl eax, 0xb
or eax, esi
mov esi, ebx
and esi, 3
add eax, edx
xor eax, dword [esi*4 + 0x415520]
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
movzx esi, byte [esi + 0x415420]
movzx edi, byte [edi + 0x415420]
shl edi, 8
or esi, edi
mov edi, eax
shr edi, 0x10
shr eax, 0x18
and edi, 0xff
and eax, 0xff
movzx edi, byte [edi + 0x415420]
movzx eax, byte [eax + 0x415420]
shl edi, 0x10
shl eax, 0x18
or esi, edi
or esi, eax
mov eax, edx
xor esi, dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov esi, edx
shr esi, 0xf
shl eax, 0x11
or eax, esi
mov esi, ebx
and esi, 3
xor eax, ecx
inc ebx
add eax, dword [esi*4 + 0x415520]
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
movzx esi, byte [esi + 0x415420]
movzx edi, byte [edi + 0x415420]
shl edi, 8
or esi, edi
mov edi, eax
shr edi, 0x10
shr eax, 0x18
and edi, 0xff
and eax, 0xff
movzx edi, byte [edi + 0x415420]
movzx eax, byte [eax + 0x415420]
shl edi, 0x10
shl eax, 0x18
or esi, edi
or esi, eax
xor esi, dword [ebp - 8]
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov eax, esi
mov ecx, eax
mov edx, dword [ebp - 0xc]
cmp ebx, 0x20
jl 0x405b2a
mov eax, dword [ebp - 0x10]
xor edx, dword [0x415520]
mov dword [eax], edx
xor ecx, dword [0x415524]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, dword [0x415528]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, dword [0x41552c]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
push eax
call fcn.00405dfc
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret