joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f370
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40f40d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 0xc]
call fcn.0040317c
mov eax, dword [ebp - 4]
call fcn.004035bc
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x40f3f7
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x40f3eb
test ebx, ebx
jne 0x40f3ea
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [ebp - 0xc]
call fcn.00404768
mov eax, dword [esi + ebx*4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx], eax
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x40f3cd
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f414
lea eax, [ebp - 4]
call fcn.0040317c
ret
Function at 0x40f41c
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
mov eax, dword [ebp - 8]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40f5f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x20
call fcn.004027f4
mov eax, dword [ebp - 4]
call fcn.004035bc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x48]
push eax
push 2
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40f5ce
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], 0x2000
mov eax, dword [ebp - 0x18]
call fcn.00402494
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0x103
je 0x40f5b5
cmp eax, 0xea
jne 0x40f50c
mov dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.004024d4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
jne 0x40f5ce
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
dec eax
test eax, eax
jl 0x40f4a5
inc eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x4c]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.00403374
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 8]
call fcn.00403508
je 0x40f5a4
mov byte [ebp - 0x21], 0
mov eax, dword [0x4129a8]
call fcn.00403bec
mov ebx, eax
test ebx, ebx
jl 0x40f588
inc ebx
xor edi, edi
lea eax, [ebp - 0x54]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.00403374
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
lea edx, [ebp - 0x20]
call fcn.0040f370
mov eax, dword [0x4129a8]
mov eax, dword [eax + edi*4]
cmp eax, dword [ebp - 0x20]
jne 0x40f584
mov byte [ebp - 0x21], 1
jmp 0x40f588
inc edi
dec ebx
jne 0x40f555
cmp byte [ebp - 0x21], 0
jne 0x40f5a4
lea eax, [ebp - 0x58]
mov edx, dword [esi + 0x14]
add edx, 2
call fcn.00403374
mov eax, dword [ebp - 0x58]
call fcn.0040e670
add esi, 0x20
dec dword [ebp - 0x28]
jne 0x40f523
jmp 0x40f4a5
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
jne 0x40f5ce
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
call fcn.004024b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f5fd
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004031a0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031a0
ret
Function at 0x40f608
Capabilities:
Get file size
Read file on windows
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40f789
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00404a10
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40f773
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0x1000000
jae 0x40f76d
cmp esi, dword [0x4129c8]
jl 0x40f698
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [0x4129b0]
push eax
push ebx
call sub.kernel32.dll_ReadFile
mov eax, dword [0x411200]
mov eax, dword [eax]
call fcn.004035bc
mov ecx, eax
mov eax, dword [0x4129b0]
mov edx, esi
call fcn.00408d58
test eax, eax
sete al
jmp 0x40f69a
mov al, 1
test al, al
je 0x40f76d
mov eax, esi
call fcn.00402494
mov edi, eax
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov edx, edi
mov ecx, esi
mov eax, ebx
call fcn.004045c8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_GetFileTime
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov edx, dword [0x4129b4]
mov ecx, dword [0x4129c8]
mov eax, ebx
call fcn.00404884
mov edx, edi
mov ecx, esi
mov eax, ebx
call fcn.00404884
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, edi
call fcn.00405364
test al, al
je 0x40f752
cmp dword [ebp - 0x28], 0
jbe 0x40f752
cmp dword [ebp - 0x2c], 0
je 0x40f752
mov esi, dword [0x4129bc]
sub esi, dword [0x4129b4]
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_SetFilePointer
cmp esi, eax
jne 0x40f752
mov edx, dword [ebp - 0x28]
mov eax, dword [0x4129b8]
call fcn.00407f7c
mov ecx, eax
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.00404884
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
mov edx, esi
mov eax, edi
call fcn.004024b4
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f790
lea eax, [ebp - 4]
call fcn.0040317c
ret
Function at 0x40fa9c
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40fbfe
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x20
call fcn.004027f4
mov eax, dword [ebp - 4]
call fcn.004035bc
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
push 1
push 0
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40fbe0
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x2000
mov eax, dword [ebp - 0x14]
call fcn.00402494
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0x103
je 0x40fbc7
cmp eax, 0xea
jne 0x40fb65
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.004024d4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
jne 0x40fbe0
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jl 0x40fafe
inc esi
mov eax, dword [ebx]
call fcn.00403be4
inc eax
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x407f2c]
call fcn.00403da0
add esp, 4
mov eax, dword [ebx]
call fcn.00403bec
mov edx, dword [ebx]
lea eax, [edx + eax*4]
push eax
lea eax, [ebp - 0x3c]
mov edx, dword [edi + 0x14]
add edx, 2
call fcn.00403374
mov ecx, dword [ebp - 0x3c]
mov edx, 0x40fc18
pop eax
call fcn.00403408
add edi, 0x20
dec esi
jne 0x40fb75
jmp 0x40fafe
mov eax, dword [ebp - 0x18]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
jne 0x40fbe0
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
call fcn.004024b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fc05
lea eax, [ebp - 0x3c]
call fcn.0040317c
lea eax, [ebp - 4]
call fcn.0040317c
ret
Function at 0x40fcd8
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.004035ac
mov eax, dword [ebp - 0x18]
call fcn.004035ac
mov eax, dword [ebp - 0x1c]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40fddc
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x14]
call fcn.004035bc
push eax
mov eax, dword [ebp - 0x18]
call fcn.004035bc
mov edx, eax
mov eax, dword [0x412650]
pop ecx
call fcn.0040fc60
pop ecx
test al, al
je 0x40fdc1
mov eax, dword [ebp - 0x1c]
call fcn.00404a00
test al, al
je 0x40fd52
mov eax, dword [ebp - 0x1c]
call fcn.004035bc
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
push ebp
push 0x40fda6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x1c]
call fcn.004035bc
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40fdb0
mov eax, dword [ebp - 0x10]
call fcn.0040450c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fde3
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004031a0
ret

Function at 0x4100fc
Capabilities:
Read file via mapping

Disassembly:
push ebx
xor ebx, ebx
push 0x410160
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x4129c0], eax
cmp dword [0x4129c0], 0
je 0x41011f
mov bl, 1
jmp 0x41013b
push 0x410160
push 0x4054
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x4129c0], eax
push 0
push 0
push 0
push 6
mov eax, dword [0x4129c0]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x4129c4], eax
test bl, bl
jne 0x41015c
call fcn.0040f79c
mov eax, ebx
pop ebx
ret
Function at 0x410170
Capabilities:
Clear file content
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x410178
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x41032b
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GetLocalTime
lea edx, [ebp - 0x24]
movzx eax, word [ebp - 0x20]
call fcn.0040477c
push dword [ebp - 0x24]
push 0x410344
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 0x1e]
call fcn.0040477c
push dword [ebp - 0x28]
push 0x410344
lea edx, [ebp - 0x2c]
movzx eax, word [ebp - 0x1a]
call fcn.0040477c
push dword [ebp - 0x2c]
lea eax, [ebp - 8]
mov edx, 5
call fcn.0040347c
lea eax, [ebp - 0x10]
mov ecx, dword [0x41f204]
mov edx, dword [ebp - 4]
call fcn.00403408
mov eax, dword [ebp - 0x10]
call fcn.00404a00
test al, al
je 0x4102ae
mov eax, dword [ebp - 0x10]
call fcn.004035bc
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00403374
mov eax, dword [ebp - 0x30]
mov edx, 2
call fcn.00404a10
mov esi, eax
cmp esi, 0xffffffff
je 0x410303
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov edx, eax
mov eax, 0x1e
call fcn.00407f7c
mov edi, eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00403654
mov eax, dword [ebp - 0xc]
call fcn.004035bc
mov edx, eax
mov ecx, edi
mov eax, esi
call fcn.004045c8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00403508
jne 0x41027a
xor ebx, ebx
jmp 0x4102a6
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00404854
mov eax, dword [ebp - 8]
call fcn.004033bc
push eax
mov eax, dword [ebp - 8]
call fcn.004035bc
mov edx, eax
mov eax, esi
pop ecx
call fcn.00404884
push esi
call sub.kernel32.dll_SetEndOfFile
push esi
call sub.kernel32.dll_CloseHandle
jmp 0x410303
mov eax, dword [ebp - 0x10]
call fcn.00404860
mov esi, eax
cmp esi, 0xffffffff
je 0x410301
mov eax, dword [ebp - 8]
call fcn.004033bc
push eax
mov eax, dword [ebp - 8]
call fcn.004035bc
mov edx, eax
mov eax, esi
pop ecx
call fcn.00404884
push esi
call sub.kernel32.dll_CloseHandle
push 6
lea eax, [ebp - 0x34]
mov ecx, dword [0x41f204]
mov edx, dword [ebp - 4]
call fcn.00403408
mov eax, dword [ebp - 0x34]
call fcn.004035bc
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x410303
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410332
lea eax, [ebp - 0x34]
mov edx, 5
call fcn.004031a0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004031a0
ret
Function at 0x4018c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x403464], eax
mov edi, 0
mov ecx, 0xa
push edi
loop 0x4018dd
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [0x403464]
mov dword [ebp - 0x1c], edx
lea ecx, str.contents
mov dword [ebp - 8], ecx
lea eax, section..text
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x66
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x403464]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403474], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403474]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019a6
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40198d
pop ebp
ret 0x10

Function at 0x403161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x403161
lcall 0x5de5, 0x8b10c483
jmp loc.00791034
Function at 0x7ffe53a2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
not eax
not eax
and al, 0xff
xor eax, ecx
xor eax, ecx
and al, 0xff
add al, 4
sub al, 4
and al, 0xff
pushf
popf
push eax
pop eax
push bx
inc esp
inc esp
inc esi
dec esi
not eax
not eax
push eax
pop eax
pushf
popf
add al, 0
xor eax, ecx
xor eax, ecx
push eax
pop eax
not eax
not eax
and al, 0xff
xor eax, ecx
xor eax, ecx
and al, 0xff
xor eax, ecx
xor eax, ecx
push es
pop ds
not eax
not eax
push es
pop ds
xor eax, ecx
xor eax, ecx
and al, 0xff
not eax
not eax
inc esi
dec esi
add al, 4
sub al, 4
and al, 0xff
add al, 4
sub al, 4
inc esi
dec esi
push bx
inc esp
inc esp
push es
pop ds
push bx
inc esp
inc esp
push es
pop ds
xor eax, ecx
xor eax, ecx
and al, 0xff
push bx
inc esp
inc esp
add al, 0
xor eax, ecx
xor eax, ecx
push es
pop ds
xor eax, ecx
xor eax, ecx
add al, 0
cld
call 0x7ffe5432
pop edx
and al, 0xff
xor dx, dx
pushal
inc eax
popal
add edx, 0xd5e0
xor ecx, ecx
stc
mov cl, 0x1e
add al, 0
xor byte [ecx + edx], 0xe3
loop 0x7ffe5448
inc esi
dec esi
and al, 0xff
nop
push dword fs:[0x24]
push es
pop ds
pop dword [edx + 0xa]
clc
mov cl, 0xff
pushf
popf
push edx
loop 0x7ffe5466
inc esi
dec esi
stc
add al, 0
mov dword [edx + 0x11], 0xffffacbb
pushf
popf
push eax
pop eax
inc esi
dec esi
mov ecx, dword [eax + 0x2c]
push es
pop ds
not eax
not eax
cld
mov dword [edx + 0x1b], ecx
xor eax, ecx
xor eax, ecx
and al, 0xff
mov dword [edx + 0x100], ecx
pushf
popf
cld
mov dword [eax + 0x2c], esp
push 0
nop
push 0
push eax
pop eax
push 0
nop
push eax
pop eax
push 0
inc esi
dec esi
push 0x30
push edx
cdq
pop edx
push 0x20
xor eax, ecx
xor eax, ecx
push es
pop ds
push 0
not eax
not eax
push es
pop ds
pushal
inc eax
popal
push 0
push eax
pop eax
xor eax, ecx
xor eax, ecx
add edx, 0xffff7f31
stc
push es
pop ds
push edx
push es
pop ds
push edx
stc
push 0
inc esi
dec esi
call dword [edx + 0x8212]
xor eax, ecx
xor eax, ecx
inc esi
dec esi
cld
add al, 0
add esp, 0x3f8
inc esi
dec esi
xor eax, eax
add al, 0
xor eax, ecx
xor eax, ecx
cld
push eax
pop eax
inc eax
add al, 0
xor eax, ecx
xor eax, ecx
push es
pop ds
ret 0xc

Function at 0x7ffe8354
Capabilities:
Encode data using xor

Disassembly:
and al, 0xff
push eax
pop eax
clc
pop eax
add al, 4
sub al, 4
add eax, 0x1d
inc esi
dec esi
push bx
inc esp
inc esp
clc
mov byte [eax], 5
add al, 4
sub al, 4
and al, 0xff
call 0x7ffe8354
nop
add eax, 5
mov ecx, eax
add eax, 0
call 0x7ffe8319
push es
pop ds
pop eax
and al, 0xff
clc
inc esi
dec esi
add eax, 0x19
not eax
not eax
mov byte [eax], 5
push es
pop ds
push bx
inc esp
inc esp
clc
call fcn.7ffe84d6
pushf
popf
inc esi
dec esi
add eax, 5
clc
xchg ecx, eax
sub ecx, eax
lea esp, [esp]
xor byte [eax + ecx], 0x72
and al, 0xff
loop 0x7ffe8347
push es
pop ds
cld
push es
pop ds
pop ecx
lcall 0xf12a, 0x72727272
mov dl, 0x75
mov ah, 0x72
ja 0x7ffe82fc
invalid
Function at 0x401667
Capabilities:
Hash data with crc32
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34
mov dword [esp], str.Dumping_AppCompatCache_registry_key_n
call fcn.00401000
mov dword [esp + 8], 0x404008
mov dword [esp + 4], 1
lea eax, [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
sub esp, 0xc
lea eax, [ebp - 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x10
lea eax, [ebp - 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0x404000
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
sub esp, 0x18
mov esi, eax
lea ebx, [ebp - 0x24]
cmp eax, 0x80000005
jne 0x401724
mov edi, dword [ebp - 0x1c]
add edi, 0x10
mov dword [esp], edi
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x40177d
lea eax, [ebp - 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 2
mov dword [esp + 4], 0x404000
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
sub esp, 0x18
mov esi, eax
test esi, esi
js 0x40177d
cmp dword [ebx + 4], 3
jne 0x40177d
cmp dword [ebp + 8], 0
je 0x401746
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
lea eax, [ebx + 0xc]
mov dword [esp], eax
call fcn.00401580
mov eax, dword [ebx + 8]
mov dword [esp + 8], eax
lea eax, [ebx + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_RtlComputeCrc32]
sub esp, 0xc
mov dword [esp + 8], eax
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Len:__lu__Crc:_0x_lx_n
call fcn.00401000
jmp 0x40178d
mov dword [esp + 4], esi
mov dword [esp], str.Failed_reading_AppCompatCache_from_registry__0x_lx__n
call fcn.00401000
lea eax, [ebp - 0x24]
cmp ebx, eax
je 0x40179c
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4017af
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtClose]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4024a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
lea esi, [ebp + 0xc]
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], esi
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_vfprintf]
call sub.msvcrt.dll_abort
Function at 0x4029b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0
cmp word [edx], 0x5a4d
jne 0x4029d9
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x4029d9
cmp word [edx + 0x18], 0x10b
sete al
movzx eax, al
pop ebp
ret

Function at 0x4029db
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
add edx, dword [edx + 0x3c]
movzx eax, word [edx + 0x14]
lea eax, [edx + eax + 0x18]
movzx esi, word [edx + 6]
test esi, esi
je 0x402a1d
mov edx, 0
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x402a0c
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x402a22
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4029fe
mov eax, 0
jmp 0x402a22
mov eax, 0
pop ebx
pop esi
pop ebp
ret
Function at 0x4029d0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402a0d
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402a2d
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004049f0
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402bf4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404780
test esi, esi
jne 0x402c2a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404870
jmp 0x402c48
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402aa8
mov edi, eax
test esi, esi
je 0x402c48
cmp dword [ebx], 0
je 0x402c48
dec esi
jmp 0x402c31
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403258
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4c3008], 0x8088405
inc edx
mov dword [ebx + 0x4c3008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4037e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4c3024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403878
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403858
xor eax, eax
push ebp
push 0x403851
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403894
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403858
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4c3024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4c3024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404560
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4c804c], 0
je 0x4045c1
cmp word [0x4c8220], 0xd7b2
jne 0x404589
cmp dword [0x4c8228], 0
jbe 0x404589
mov eax, 0x4c821c
call dword [0x4c8238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4c3094
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4045e8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4c3034], 0
jne 0x4045dd
push 0
push 0x4c308c
push 0x4c3094
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404734
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027e8
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4c804d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4046fc
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc