joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ee88
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x41ee4e
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x41ee49
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x41ee33
and ecx, 0xfff
add byte [eax], al
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x41ee3b
cmp edx, ebx
jne 0x41ef89
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x41ee0a
add eax, dword [eax + 4]
jmp 0x41edf7
mov dword [ebp + 0xc], ebx
jmp 0x41ee59
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x41ee71
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x41ee8f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
clc
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x41eeed
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x41eed4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41eedd
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x41eee7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x41eec9
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x41ee53
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x40b4b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b6b0]
jne 0x40b4ba
repz ret
jmp fcn.0041327c

Function at 0x41b5ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b6b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00410162
and dword [ebp - 0x14], 0
cmp dword [0x462e18], 0
mov dword [ebp - 0x18], eax
jne 0x41b65f
push 0x403880
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41b707
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403874
push ebx
call edi
test eax, eax
je 0x41b707
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403864
push ebx
mov dword [0x462e18], eax
call edi
push eax
call esi
push 0x403850
push ebx
mov dword [0x462e1c], eax
call edi
push eax
call esi
push 0x403834
push ebx
mov dword [0x462e20], eax
call edi
push eax
call esi
mov dword [0x462e28], eax
test eax, eax
je 0x41b65f
push 0x40381c
push ebx
call edi
push eax
call esi
mov dword [0x462e24], eax
mov eax, dword [0x462e24]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41b6b8
cmp dword [0x462e28], ecx
je 0x41b6b8
push eax
call esi
push dword [0x462e28]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41b6b8
test ebx, ebx
je 0x41b6b8
call edi
test eax, eax
je 0x41b6af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41b6af
test byte [ebp - 8], 1
jne 0x41b6b8
or dword [ebp + 0x10], 0x200000
jmp 0x41b6eb
mov eax, dword [0x462e1c]
cmp eax, dword [ebp - 0x18]
je 0x41b6eb
push eax
call esi
test eax, eax
je 0x41b6eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41b6eb
mov eax, dword [0x462e20]
cmp eax, dword [ebp - 0x18]
je 0x41b6eb
push eax
call esi
test eax, eax
je 0x41b6eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x462e18]
call esi
test eax, eax
je 0x41b707
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41b709
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b4b0
leave
ret
Function at 0x423260
Capabilities:
Access the windows event log
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1804
call fcn.004224f0
cmp dword [0x803ba0], 0x37
jne 0x423322
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x404520
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x404550
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x4045b8
push 0
lea ecx, [esp + 0x80c]
push ecx
push 0x4045d8
push 0x404600
push 0x404620
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea eax, [esp + 0x1008]
push eax
push 0x404658
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov ecx, dword [0x803ba4]
mov eax, dword [0x800010]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x1804
ret
Function at 0x4417e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x441805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x441878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x44183a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x44186d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x44186b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x441831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4417fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000983f
pop dword [ebp - 0x10]
mov eax, 0xc77946b7
add eax, 0x48875188
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3a213
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x84c4140e
sub ecx, 0x84c3c78b
mov ebx, eax
mov esi, 0xee999bf1
sub esi, 0xde9815f1
add esi, dword [ebp - 0x10]
mov edi, 0x50556bea
mov edx, dword [esi]
xor dword [ebp - 0xc], edx
xor edx, edi
sub dword [ebp - 4], edx
mov dword [ebx], edx
xor dword [ebp - 0xc], edx
add ebx, 4
add esi, 0x5145ea27
sub esi, 0x5145ea23
loop 0x10009893
add eax, 0x672e31a8
add eax, 0x98d2f337
mov ebx, eax
add eax, 0x2e92548e
sub eax, 0x2e925489
mov ecx, 0x224c164f
sub ecx, 0x124c164f
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40107d
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
and dword [ebp - 8], 0
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
and dword [ebp - 4], 0
cmp dword [ebp - 8], 3
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpW]
mov edi, eax
mov esi, str._runtime
jl 0x4010b8
push esi
push dword [edi + 4]
call ebx
cmp dword [ebp - 8], 5
jl 0x4010c4
push esi
push dword [edi + 0xc]
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor esi, esi
cmp dword [ebp - 4], esi
jne 0x401159
push 0x20a
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push eax
mov edi, str.Adobe_AIRVersions1.0Adobe_AIR.dll
mov dword [ebp - 4], eax
call section..text
pop ecx
pop ecx
test al, al
jne 0x401101
push 4
pop eax
jmp 0x401195
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40111f
push dword [ebp - 4]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 4], esi
cmp dword [ebp - 4], esi
jne 0x401159
push 0xe
pop ecx
lea eax, [ebp - 4]
push 0x1c
mov esi, str.Versions1.0Adobe_AIR.dll
lea edi, [ebp - 0x40]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0040755e
pop ecx
pop ecx
test eax, eax
jne 0x4010f9
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp - 4], 0
jne 0x401159
push 3
jmp 0x4010fb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp + 0xc]
mov dword [esi], eax
test eax, eax
je 0x4010f9
push dword [ebp - 4]
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push str.RuntimeInstallerWinMain
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40119a
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edx, ax
mov ecx, 0x40def4
xor eax, eax
movzx edi, dx
mov esi, ecx
cmp edi, dword [esi]
je 0x4011be
inc eax
add esi, 0x10
cmp eax, 0x11
jb 0x4011b1
cmp eax, 0x11
jne 0x4011e4
mov esi, 0x3ff
xor eax, eax
and edx, esi
push ebx
mov di, word [ecx]
mov ebx, esi
and di, bx
cmp dx, di
je 0x4011e3
inc eax
add ecx, 0x10
cmp eax, 0x10
jb 0x4011cd
pop ebx
pop edi
pop esi
ret
Function at 0x4011e7
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push str.SetDllDirectoryA
mov ebx, str.kernel32.dll
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x401216
push 0x40a42c
call eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 4], 3
mov dword [ebp - 8], eax
jl 0x40128b
push dword [eax + 4]
push str._stdio
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x40128b
mov eax, dword [ebp - 8]
xor edi, edi
push edi
push edi
push 4
push edi
push edi
push 0xc0000000
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40126f
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_SetStdHandle]
push eax
push 0xfffffffffffffff6
call ebx
test eax, eax
je 0x401267
push dword [ebp - 8]
push 0xfffffffffffffff5
call ebx
test eax, eax
jne 0x4012a0
jmp 0x401267
push str.AttachConsole
push ebx
call esi
push eax
call edi
test eax, eax
je 0x40129e
push 0xffffffffffffffff
call eax
xor edi, edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.0040107d
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
je 0x4012dd
call fcn.0040119a
push edi
push 0x30
shl eax, 4
mov eax, dword [eax + 0x40def8]
push 0x40c134
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxExW]
mov eax, ebx
jmp 0x4012e7
push dword [ebp - 4]
push edi
call esi
push eax
call dword [ebp - 8]
push eax
jmp 0x401269
Function at 0x4034a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040234c
and dword [ebp - 4], 0
cmp dword [0x40e600], 0
mov ebx, eax
jne 0x403554
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403605
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x403605
push eax
call fcn.004022da
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e600], eax
call esi
push eax
call fcn.004022da
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e604], eax
call esi
push eax
call fcn.004022da
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e608], eax
call esi
push eax
call fcn.004022da
pop ecx
mov dword [0x40e610], eax
test eax, eax
je 0x403554
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004022da
pop ecx
mov dword [0x40e60c], eax
mov eax, dword [0x40e60c]
cmp eax, ebx
je 0x4035ac
cmp dword [0x40e610], ebx
je 0x4035ac
push eax
call fcn.00402355
push dword [0x40e610]
mov esi, eax
call fcn.00402355
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4035ac
test edi, edi
je 0x4035ac
call esi
test eax, eax
je 0x4035a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4035a3
test byte [ebp - 0xc], 1
jne 0x4035ac
or dword [ebp + 0x10], 0x200000
jmp 0x4035e5
mov eax, dword [0x40e604]
cmp eax, ebx
je 0x4035e5
push eax
call fcn.00402355
pop ecx
test eax, eax
je 0x4035e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4035e5
mov eax, dword [0x40e608]
cmp eax, ebx
je 0x4035e5
push eax
call fcn.00402355
pop ecx
test eax, eax
je 0x4035e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e600]
call fcn.00402355
pop ecx
test eax, eax
je 0x403605
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x403607
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40530e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d9f8]
jne 0x405318
repz ret
jmp fcn.00406a35
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x401c66
pop dword [ebp - 0x50]
mov eax, 0x401c66
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x448b38b
add dword [ebp - 0x60], 0x4a0991c0
mov dword [ebp - 0x5c], 0xf477380
sub dword [ebp - 0x5c], 0xdd14273b
mov dword [ebp - 0x58], 0x5d72b625
add dword [ebp - 0x58], 0xeed98e09
mov dword [ebp - 0x54], 0x53936f37
add dword [ebp - 0x54], 0xac6c90c9
lea eax, [ebp - 0x60]
push eax
mov eax, 0x51330ea2
sub eax, 0x50f2de4e
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x1d4d6192
add dword [ebp - 0x60], 0x572507c4
mov dword [ebp - 0x5c], 0xedbf19cd
sub dword [ebp - 0x5c], 0xac52b858
mov dword [ebp - 0x58], 0x9e52153d
sub dword [ebp - 0x58], 0x3ae2a8d1
mov dword [ebp - 0x54], 0xf62be39e
sub dword [ebp - 0x54], 0xf62be39e
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xd50c1b79
add eax, 0x2b3414b3
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38d2a
push 0
call eax
mov ecx, 0xce300b87
sub ecx, 0xce2fba29
mov edi, eax
mov ebx, 0x41726400
add ebx, 0xbece0c00
add ebx, dword [ebp - 0x50]
mov esi, 0x3368c2fa
sub esi, 0x52cc6b9b
mov edx, dword [ebx]
add dword [ebp - 0x44], 0x73f439a3
sub edx, esi
sub dword [ebp - 0x1c], ecx
mov dword [edi], edx
xor dword [ebp - 0x4c], 0xdc9f525b
add edi, 4
add ebx, 4
loop 0x401d83
add eax, 0x1384b
mov ebx, eax
add eax, 0x8576a602
add eax, 0x7a895a03
mov ecx, 0x5304b2ba
add ecx, 0xad3b4d46
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x407fea
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x4016b8
call fcn.004082b0
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x400000], 0x5a4d
jne 0x40803d
mov eax, dword [0x40003c]
lea eax, [eax + 0x400000]
cmp dword [eax], 0x4550
jne 0x40803d
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x408055
cmp ecx, 0x20b
je 0x408042
mov dword [ebp - 0x60], ebx
jmp 0x408069
cmp dword [eax + 0x84], 0xe
jbe 0x40803d
xor ecx, ecx
cmp dword [eax + 0xf8], ebx
jmp 0x408063
cmp dword [eax + 0x74], 0xe
jbe 0x40803d
xor ecx, ecx
cmp dword [eax + 0xe8], ebx
setne cl
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x40aa94], edi
mov dword [0x40aa98], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x40aa88]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x40aa84]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40aa90], eax
call fcn.004082ac
cmp dword [0x40a040], ebx
jne 0x4080c6
push fcn.004082ac
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0040829a
push 0x40a018
push 0x40a014
call sub.msvcrt.dll__initterm
mov eax, dword [0x40aa80]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
push dword [0x40aa7c]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x74], eax
push 0x40a010
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
cmp byte [eax], 0x22
jne 0x408151
inc eax
mov dword [ebp - 0x78], eax
mov cl, byte [eax]
cmp cl, bl
je 0x408131
cmp cl, 0x22
jne 0x408122
cmp byte [eax], 0x22
jne 0x40813a
inc eax
mov dword [ebp - 0x78], eax
mov cl, byte [eax]
cmp cl, bl
je 0x408145
cmp cl, 0x20
jbe 0x408136
test byte [ebp - 0x30], 1
je 0x40815c
movzx ecx, word [ebp - 0x2c]
jmp 0x40815f
cmp byte [eax], 0x20
jbe 0x40813a
inc eax
mov dword [ebp - 0x78], eax
jmp 0x408151
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.00407a92
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x60], ebx
jne 0x40817d
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x4081b9
mov eax, esi
jmp 0x4081cd
call fcn.004082eb
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402594
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4025a2
call dword [0x40b004]
or eax, eax
je 0x4025a3
ret
mov al, 1
jmp fcn.00402614

Function at 0x4025ac
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4025ba
call dword [0x40b008]
or eax, eax
jne 0x4025bb
ret
mov al, 2
jmp fcn.00402614

Function at 0x4025c4
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4025fc
test edx, edx
je 0x4025e6
push eax
mov eax, ecx
call dword [0x40b00c]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402614
mov dword [eax], edx
mov eax, ecx
call dword [0x40b008]
or eax, eax
jne 0x4025df
ret
mov al, 1
jmp fcn.00402614
test edx, edx
je 0x402610
push eax
mov eax, edx
call dword [0x40b004]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret

Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x403780
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402614
cmp eax, edx
je 0x4037f0
cmp word [eax], 8
jb 0x4037a5
push eax
push edx
cmp word [eax], 0x100
je 0x40379b
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4037a3
add eax, 8
call fcn.00403198
pop edx
pop eax
cmp word [edx], 8
jae 0x4037bc
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
jne 0x4037dc
mov edx, dword [edx + 8]
or edx, edx
je 0x4037d3
mov ecx, dword [edx - 8]
inc ecx
jle 0x4037d3
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x403744
ret

Function at 0x407868
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407884
shr eax, 1
xor eax, 0xedb88320
jmp 0x407886
shr eax, 1
dec edx
jne 0x407877
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407870
pop esi
ret

Function at 0x40789c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078bf
call fcn.00407868
push 1
push 0x40c558
call fcn.004043fc
mov eax, edi
test esi, esi
je 0x4078ea
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078c5
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx