joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100438fb
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d3722
call fcn.100cece0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.10001da4
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.10001da4
mov eax, dword [esi + 0x18]
lea ecx, [ebx + 0x4c]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.10001da4
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
mov byte [ebp - 4], 2
call fcn.10001da4
mov al, byte [esi + 0x64]
push 5
mov byte [ebx + 0x64], al
mov al, byte [esi + 0x65]
mov byte [ebx + 0x65], al
mov al, byte [esi + 0x66]
mov byte [ebx + 0x66], al
mov al, byte [esi + 0x67]
mov byte [ebx + 0x67], al
mov eax, dword [ebp + 8]
add esi, 0x68
lea edi, [ebx + 0x68]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x7c], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1007f713
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x100d7204
call fcn.100cece0
sub esp, 0x64
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 8]
push esi
mov dword [esi + 0x10], eax
mov al, byte [ebx + 0x2c]
mov byte [esi + 0x69], al
cmp dword [ebx], 0x10900
mov edx, ebx
sete al
mov byte [esi + 0x68], al
call fcn.1007f8eb
xor edi, edi
cmp eax, edi
jne 0x1007f8da
mov ecx, dword [ebx + 0x80]
lea eax, [ebx + 0x80]
or ecx, dword [eax + 4]
jne 0x1007f76b
push 1
pop eax
jmp 0x1007f76d
xor eax, eax
test al, al
lea ecx, [ebp - 0x70]
mov dword [ebp + 0xc], edi
sete byte [ebp + 0x17]
call fcn.100786d5
mov eax, dword [esi + 0x24]
mov dword [ebp - 4], edi
cmp eax, edi
mov dword [ebp - 0x14], edi
jbe 0x1007f8bf
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x20]
add eax, dword [ebp - 0x10]
cmp word [ebx + 0x20], 1
mov dword [ebp - 0x1c], eax
jne 0x1007f892
cmp word [eax + 0x20], 1
jne 0x1007f892
cmp byte [esi + 0x68], 0
mov eax, dword [esi + 0x60]
sete cl
movzx edi, cl
lea ecx, [esi + 0x5c]
add edi, eax
call fcn.10080f40
mov ecx, eax
mov edx, edi
mov dword [ebp - 0x18], ecx
call fcn.10036d3b
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x70]
push dword [ebp - 0x18]
push esi
push ebx
push edi
push dword [ebp + 8]
call fcn.1007e9a8
test eax, eax
jne 0x1007f8aa
add edi, 0x2c
push 0x14
lea eax, [ebp - 0x30]
push edi
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1007f826
cmp byte [ebx + 0x2c], 0
je 0x1007f8c5
xor eax, eax
cmp byte [edi + eax], 0
jne 0x1007f8c5
inc eax
cmp eax, 0x14
jb 0x1007f816
mov edi, dword [ebp - 0x18]
and dword [edi + 0x1c], 0
cmp dword [esi + 0x3c], 0
jne 0x1007f83e
push dword [ebp + 0x10]
lea ecx, [esi + 0x38]
call fcn.10080ecb
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.10036d3b
test eax, eax
jne 0x1007f8aa
cmp byte [ebp + 0x17], al
je 0x1007f892
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x78]
cmp ecx, dword [eax + 8]
jne 0x1007f8a6
mov ecx, dword [ebx + 0x7c]
cmp ecx, dword [eax + 0xc]
jne 0x1007f8a6
and byte [ebp + 0x17], 0
mov cl, 1
cmp byte [ebx + 0x2d], 0
je 0x1007f892
cmp dword [eax + 0x24], 1
jne 0x1007f892
inc dword [ebp + 0xc]
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebp + 0xc]
sete al
test cl, cl
je 0x1007f88a
test al, al
je 0x1007f8c5
test al, al
je 0x1007f892
test cl, cl
je 0x1007f8ae
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x40
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x24]
jae 0x1007f8bf
jmp 0x1007f792
xor cl, cl
jmp 0x1007f86a
mov esi, eax
jmp 0x1007f8cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
push 1
pop eax
jmp 0x1007f8da
cmp byte [ebp + 0x17], 0
je 0x1007f8ca
push 1
pop esi
jmp 0x1007f8cc
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x1008095a
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
mov eax, 0x100d729c
call fcn.100cece0
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.CREATIONTIME
mov ecx, edi
lea edx, [esi + 4]
call fcn.10080ade
push str.LASTMODIFICATIONTIME
lea edx, [esi + 0xc]
mov ecx, edi
mov byte [esi], al
call fcn.10080ade
mov byte [esi + 1], al
lea eax, [ebp - 0x18]
push str.NAME
push eax
mov ecx, edi
call fcn.10036d3b
and dword [ebp - 4], 0
lea edx, [esi + 0x14]
mov ecx, eax
call fcn.10036d3b
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov byte [esi + 2], al
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.DIRCOUNT
push eax
mov ecx, edi
call fcn.10036d3b
lea edx, [esi + 0x20]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.10036d3b
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.FILECOUNT
push eax
mov ecx, edi
call fcn.10036d3b
lea edx, [esi + 0x28]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.10036d3b
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x24]
mov dword [esp], str.INDEX
push eax
mov ecx, edi
call fcn.10036d3b
lea edx, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.10036d3b
push dword [ebp - 0x24]
mov byte [esi + 3], al
call fcn.100034b3
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10080f88
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d731b
call fcn.100cece0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100851fe
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100d78af
call fcn.100cece0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10001da4
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10085281
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100c1f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x100c1fcb
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x100c200c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x100c1ff1
mov ecx, ebx
call fcn.100c1c50
add ebx, 0x28
dec ebp
jne 0x100c1fe5
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x100c2007
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.100c1b20
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.100c20b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x20]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x1c]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
push ebp
call fcn.10036d3b
mov ebx, eax
cmp ebx, edi
je 0x100c2084
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.100c20e0
cmp ebx, edi
jle 0x100c207f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x100c2084
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x100c2096
cmp dword [esi + 0x40], edi
jne 0x100c2096
cmp dword [esi + 0x3c], edi
jne 0x100c2096
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x116a4e69
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7c85652c
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40e27b
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b548]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409431
mov dword [ebp - 0x14], eax
cmp dword [0x43357c], esi
jne 0x40e36e
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40e2fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e44e
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e44e
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e44e
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43357c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x433580], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x433584], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43358c], eax
test eax, eax
je 0x40e36b
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x433588], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40e393
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40e386
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40e3a8
push 4
pop eax
jmp 0x40e450
cmp dword [ebp - 0x14], esi
je 0x40e3a8
push dword [0x43357c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40e38d
mov eax, dword [0x433588]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e406
cmp dword [0x43358c], edi
je 0x40e406
push eax
call ebx
push dword [0x43358c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e406
test eax, eax
je 0x40e406
call ecx
test eax, eax
je 0x40e3fb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e3fb
test byte [ebp - 8], 1
jne 0x40e406
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e436
mov eax, dword [0x433580]
cmp eax, edi
je 0x40e433
push eax
call ebx
test eax, eax
je 0x40e433
call eax
mov esi, eax
test esi, esi
je 0x40e433
mov eax, dword [0x433584]
cmp eax, edi
je 0x40e433
push eax
call ebx
test eax, eax
je 0x40e433
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43357c]
call ebx
test eax, eax
je 0x40e44e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e450
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404483
mov esp, ebp
pop ebp
ret
Function at 0x43b644
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub edi, 0xc474c803
call fcn.0043b67d
inc edx
sub edx, 1
inc edx
xor dword [ebx], eax
sub edx, edx
sub edi, edx
inc ebx
mov edi, 0xb5f3dc2a
sub edx, 0x820fd880
cmp ebx, ecx
jne fcn.0043b644
add edi, 1
or edx, edx
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401c66
pop dword [ebp - 0x40]
mov eax, 0x401c66
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x15690aaa
add dword [ebp - 0x50], 0x38e93aa1
mov dword [ebp - 0x4c], 0x434c109f
add dword [ebp - 0x4c], 0xeee73ba6
mov dword [ebp - 0x48], 0xeab06fc9
add dword [ebp - 0x48], 0x619bd465
mov dword [ebp - 0x44], 0xe100f19b
add dword [ebp - 0x44], 0x1eff0e65
lea eax, [ebp - 0x50]
push eax
mov eax, 0x29907ada
sub eax, 0x29504a86
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf529bb70
add dword [ebp - 0x50], 0x7f48ade6
mov dword [ebp - 0x4c], 0xc76747dd
sub dword [ebp - 0x4c], 0x85fae668
mov dword [ebp - 0x48], 0x24dfcd32
sub dword [ebp - 0x48], 0xc17060c6
mov dword [ebp - 0x44], 0xd0f7b7d4
add dword [ebp - 0x44], 0x2f08482c
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x13bc1266
sub eax, 0x137be23a
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x373fe
push 0
call eax
mov ecx, 0x84bba2fe
add ecx, 0x7b44a815
mov ebx, eax
mov edi, 0x4496b33
add edi, 0xfbf704cd
add edi, dword [ebp - 0x40]
mov edx, 0x4905d285
add edx, 0x4b5e1cca
sub dword [ebp - 0x38], 0x3cc74200
mov esi, dword [edi]
add dword [ebp - 8], edx
add esi, edx
xor dword [ebp - 0x30], 0xadc2565b
mov dword [ebx], esi
mov dword [ebp - 0x1c], 0x963ad00e
add ebx, 0x17754542
add ebx, 0xe88abac2
add edi, 0x81e8e047
add edi, 0x7e171fbd
loop 0x401d83
add eax, 0xfb5954c3
sub eax, 0xfb5835a4
mov ebx, eax
add eax, 0x83ce5b00
add eax, 0x7c31a505
mov ecx, 0xaf3055ed
sub ecx, 0xaef055ed
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100015b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [0x100c0050]
push 0
push dword [0x100c3388]
call fcn.1004f1c0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x100c0050]
push dword [0x100c0054]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push dword [0x100c0050]
push dword [0x100c3388]
push dword [0x100c0054]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push dword [0x100c0050]
push dword [0x100c3388]
call fcn.10001780
add esp, 8
mov dword [0x100c3384], 1
mov esp, ebp
pop ebp
ret

Function at 0x10001780
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0xc], 0x3a344b25
mov dword [ebp - 8], 0x134c442b
mov word [ebp - 4], 0x2f62
test esi, esi
jle 0x100017d0
push edi
mov edi, dword [ebp + 8]
nop dword [eax + eax]
mov eax, 0xcccccccd
mul ecx
mov eax, ecx
shr edx, 3
lea edx, [edx + edx*4]
add edx, edx
sub eax, edx
mov al, byte [ebp + eax - 0xc]
xor byte [ecx + edi], al
inc ecx
cmp ecx, esi
jl 0x100017b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100017e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor bl, bl
mov dword [ebp - 0x40], 0x4295115a
mov dword [ebp - 0x3c], 0x46fbffdb
mov dword [ebp - 0x38], 0x7712c4a6
mov dword [ebp - 0x34], 0x50c85635
mov dword [ebp - 0x30], 0x2e89eea3
mov dword [ebp - 0x2c], 0x649e380a
mov dword [ebp - 0x28], 0xcf581a40
mov dword [ebp - 0x24], 0x587ba7ef
mov dword [ebp - 0x20], 0x8af6fe58
mov dword [ebp - 0x1c], 0x9c40e27e
mov dword [ebp - 0x18], 0x1c5a598c
mov dword [ebp - 0x14], 0x3e1cc46c
mov dword [ebp - 0x10], 0xc05ca117
mov dword [ebp - 0xc], 0x4ac2fd5e
mov dword [ebp - 8], 0xab58e08a
mov dword [ebp - 4], 0xb3d91ae9
test esi, esi
jle 0x1000188b
push edi
mov edi, dword [ebp + 8]
xor edx, edx
lea eax, [edx + edx*2]
inc bl
lea ecx, [edx + edx*2]
and eax, 0x1f
shl ecx, 2
and ecx, 0x1c
mov al, byte [ebp + eax - 0x20]
xor al, byte [ebp + ecx - 0x40]
xor byte [edx + edi], al
movzx edx, bl
cmp edx, esi
jl 0x10001867
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret