joyce8/EMBER2024-capa huggingface dataset:
Function at 0x565d44
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x565ecc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00555cd8
cmp eax, dword [ebp - 8]
jg 0x565dae
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x2c]
push eax
push 0
lea edx, [ebp - 0x30]
mov eax, dword [0x5c1a50]
call fcn.0040ad94
mov ecx, dword [ebp - 0x30]
mov dl, 1
mov eax, dword [0x435700]
call fcn.00424b90
call fcn.004067c8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00555cb4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 0x6a]
sub al, 2
jne 0x565dda
mov dl, 1
mov eax, dword [0x54bfc8]
call fcn.0054de14
call fcn.004067c8
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x6a], 1
jne 0x565e5e
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x565e0b
mov eax, dword [ebp - 0x18]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x64
jl 0x565e17
mov byte [ebp - 0x21], 1
jmp 0x565e47
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x10]
call fcn.00562ed0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x565e3f
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x64
setge byte [ebp - 0x21]
cmp byte [ebp - 0x21], 0
je 0x565e5e
mov dl, 1
mov eax, dword [0x54bfc8]
call fcn.0054de14
call fcn.004067c8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xac]
shl eax, 9
cdq
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx + 0xa0]
adc edx, dword [ecx + 0xa4]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00445a18
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x24]
cmp edx, 0
jne 0x565e97
cmp eax, 0
je 0x565eb1
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x24]
push edx
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
call fcn.00445d0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x565ed3
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.004071cc
ret
Function at 0x56e990
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
jne 0x56e9bc
mov ecx, 0xc8
mov edx, 0x56ea84
mov eax, 0x56eb54
call fcn.00406fb4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x56ea59
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x20]
and eax, 0xffff
or eax, 2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov edx, dword [ebp - 0x14]
xor edx, 1
imul edx, dword [ebp - 0x14]
shr edx, 8
xor al, dl
mov edx, dword [ebp - 0x18]
mov byte [edx], al
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
call fcn.0054f708
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
and eax, 0xff
add dword [ebp - 0x24], eax
imul eax, dword [ebp - 0x24], 0x8088405
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
shr eax, 0x18
mov edx, dword [ebp - 0x20]
call fcn.0054f708
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x18]
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x56e9f0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x10], edx
mov esp, ebp
pop ebp
ret
Function at 0x56ebe0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
jne 0x56ec09
mov ecx, 0xf8
mov edx, 0x56ecd0
mov eax, 0x56eda0
call fcn.00406fb4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0056ee08
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
and eax, 0xffff
or eax, 2
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, 1
imul dword [ebp - 0x18]
shr eax, 8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor al, byte [edx + ecx]
mov edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x24], al
mov eax, dword [ebp - 0x14]
mov al, byte [ebp + eax - 0x24]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
call fcn.0054f708
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
and eax, 0xff
mov edx, dword [ebp - 4]
add dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 0xc], 0x8088405
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
shr eax, 0x18
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
call fcn.0054f708
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc
jne 0x56ec19
mov al, byte [ebp + 0xb]
cmp al, byte [ebp - 0x19]
sete byte [ebp - 0xd]
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 4

Function at 0x56ee08
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x12345678
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x23456789
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x34567890
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x56ee49
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x56eeb9
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
call fcn.0054f708
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
and eax, 0xff
mov edx, dword [ebp - 4]
add dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 0xc], 0x8088405
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
shr eax, 0x18
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
call fcn.0054f708
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x56ee5a
mov esp, ebp
pop ebp
ret
Function at 0x59bcba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
jmp 0x59bd72
mov eax, dword [ebp + 8]
add dword [ebp + 8], 4
mov eax, dword [eax]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
shr ecx, 9
add eax, ecx
cmp eax, 0x100
jae 0x59bd0a
movsx edx, byte [eax + 0x5c04b4]
mov ecx, 9
sub ecx, edx
shl eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x5c05b4]
shl edx, 8
add eax, edx
add ebx, eax
jmp 0x59bd72
cmp eax, 0x10000
jae 0x59bd22
mov edx, eax
shr edx, 8
movsx edx, byte [edx + 0x5c04b4]
add edx, 8
jmp 0x59bd49
cmp eax, 0x1000000
jae 0x59bd3a
mov ecx, eax
shr ecx, 0x10
movsx edx, byte [ecx + 0x5c04b4]
add edx, 0x10
jmp 0x59bd49
mov ecx, eax
shr ecx, 0x18
movsx edx, byte [ecx + 0x5c04b4]
add edx, 0x18
lea ecx, [edx - 9]
shr eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x5c05b4]
mov ecx, edx
shl ecx, 8
add eax, ecx
mov edx, eax
add ebx, eax
test esi, esi
je 0x59bd72
cmp esi, edx
jg 0x59bd72
or eax, 0xffffffff
jmp 0x59bd83
mov edx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0xffffffff
test edx, edx
jne 0x59bcc9
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x5a5108
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x5a5110
push ecx
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a5293
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x553e5bd6
mov dl, 1
mov eax, dword [0x439020]
call fcn.00445954
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x18]
mov eax, dword [0x5c14a8]
call fcn.0040ad94
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x38]
lea eax, [ebp - 0x1c]
call fcn.004080a8
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xc]
pop edx
call fcn.004a8d2c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x5a5263
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
push 5
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0041ec54
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x34]
lea eax, [ebp - 0x20]
call fcn.004080a8
mov eax, dword [ebp - 0x20]
call fcn.00407e4c
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x2c]
call fcn.00407e4c
push eax
call sub.kernel32.dll_MoveFileExW
mov eax, dword [0x5c12f0]
mov eax, dword [eax]
xor edx, edx
call fcn.004a1df8
test al, al
jne 0x5a5257
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.0041ec54
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
mov edx, 0x5a52b0
call fcn.004080a8
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0x11
lea eax, [ebp - 0x38]
push eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x30]
push eax
mov eax, dword [0x5c12f0]
mov eax, dword [eax]
xor ecx, ecx
mov dx, 0x36
call fcn.004a1db0
mov eax, dword [ebp - 0x30]
mov ecx, 0x1b6
mov edx, 0x5a5304
call fcn.00406fb4
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x5a518d
mov eax, dword [ebp - 0xc]
call fcn.0040545c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a529a
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004071cc
lea eax, [ebp - 0x30]
mov edx, 7
call fcn.004071cc
ret
Function at 0x427ec0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18000]
push edi
or ebp, 0xffffffff
jmp 0x427ee2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x427ee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x427ed8
mov eax, 1
add ebx, ebx
jne 0x427efb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x427ef0
jne 0x427f0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427ef0
xor ecx, ecx
sub eax, 3
jb 0x427f20
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x427f92
mov ebp, eax
add ebx, ebx
jne 0x427f2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x427f38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x427f5c
inc ecx
add ebx, ebx
jne 0x427f48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x427f3d
jne 0x427f59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427f3d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x427f7c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x427f6d
jmp 0x427ede
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x427f7c
add edi, ecx
jmp 0x427ede
pop esi
mov edi, esi
mov ecx, 0xda4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x427f9a
cmp byte [edi], 7
jne 0x427f9a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x427f9f
lea edi, [esi + 0x25000]
mov eax, dword [edi]
or eax, eax
je 0x428017
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x29cd8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x29d8c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x427fcc
mov ecx, edi
jns 0x427ffb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x29d90]
or eax, eax
je 0x428011
mov dword [ebx], eax
add ebx, 4
jmp 0x427fe9
call dword [esi + 0x29d94]
popal
jmp 0x404292
Function at 0x20001000
Capabilities:
Delete file

Disassembly:
sub esp, 0x410
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 0x418]
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 3
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
test eax, eax
je 0x20001046
xor al, al
pop edi
add esp, 0x410
ret
push ebx
push ebp
lea edx, [esp + 0x10]
push esi
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x42c]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x2c], 0x400
mov byte [esp + 0x2b], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x20001168
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x42c]
test eax, eax
lea esi, [esp + 0x20]
jbe 0x200010c6
mov ebx, dword [0x2001a320]
push ebp
push esi
call ebx
add esp, 8
test eax, eax
je 0x200010fe
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0x14]
dec ecx
lea esi, [esi + ecx + 1]
mov ecx, esi
sub ecx, edx
cmp ecx, eax
jb 0x2000109b
cmp dword [esp + 0x430], 1
jne 0x200011d0
lea esi, [esp + eax + 0x1f]
push ebp
push esi
call dword [0x2001a134]
mov edi, dword [0x2001a130]
push esi
call edi
push esi
mov byte [eax + esi + 1], 0
call edi
mov edx, dword [esp + 0x14]
lea ecx, [edx + eax + 1]
jmp 0x200011a8
mov eax, dword [esp + 0x430]
test eax, eax
jne 0x200011d0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
or edx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x14]
mov edi, esi
not ecx
dec ecx
sub edx, ecx
or ecx, 0xffffffff
add eax, edx
mov dword [esp + 0x14], eax
sub eax, esi
lea eax, [esp + eax + 0x21]
push eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + esi + 1]
push ecx
push esi
call dword [0x2001a370]
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp ecx, 3
jae 0x200011ac
mov ecx, dword [esp + 0x428]
mov edx, dword [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x200011c9
cmp dword [esp + 0x430], 1
jne 0x200011d0
mov edi, dword [esp + 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
inc ecx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x42c]
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
test eax, eax
sete byte [esp + 0x13]
mov eax, dword [esp + 0x18]
push eax
call dword [0x2001a00c]
mov al, byte [esp + 0x13]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x410
ret
Function at 0x20001230
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [0x2001a1a0]
test eax, eax
je 0x200012a6
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [0x2001a220]
test eax, eax
je 0x200012a6
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x200012a6
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x20001294
mov edx, esi
cmp edi, ebx
jb 0x2000129e
add edx, ebx
cmp edi, edx
jbe 0x200012b0
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x20001286
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x200020e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
pushal
mov eax, dword fs:[0x30]
mov edx, dword [eax + 0xc]
add edx, 0x14
mov edx, dword [edx]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x20002121
mov esi, dword [edx + 0x28]
mov edi, dword [ebp + 8]
mov bx, word [esi]
mov bh, byte [edi]
cmp bl, 0x5a
jg 0x20002115
cmp bl, 0x41
jl 0x20002115
add bl, 0x20
cmp bl, bh
jne 0x200020f4
inc esi
inc esi
inc edi
test bx, bx
jne 0x20002103
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20002830
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x20], ecx
push 0x2000
mov dword [esp + 0x18], 0xff
call fcn.2001929c
add esp, 4
mov esi, eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], 0x2000
push 0x400
push 0x40
call dword [0x2001a140]
mov edi, dword [esp + 0x12c]
mov ebp, eax
push edi
lea eax, [ebp + 2]
mov byte [ebp], 0x8f
push eax
mov byte [ebp + 1], 0xb
call dword [0x2001a134]
push edi
call dword [0x2001a130]
mov ebx, eax
lea ecx, [esp + 0x10]
add ebx, 3
push ecx
push esi
lea eax, [esp + 0x1c]
lea edx, [ebx + ebp]
lea ecx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x134]
push 0
push eax
push ecx
push 0
push edx
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp eax, 0x103
je 0x200029a7
test eax, eax
jne 0x2000295e
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ebp
lea ecx, [ebx + eax]
lea edi, [ecx + edx]
call dword [0x2001a13c]
lea ecx, [edi + 8]
cmp ecx, eax
jbe 0x20002905
add edi, 0x400
push 0x42
push edi
push ebp
call dword [0x2001a138]
mov ebp, eax
mov edx, dword [esp + 0x10]
add ebx, 4
mov dword [ebx + ebp], edx
mov ecx, dword [esp + 0x14]
add ebx, 4
test ecx, ecx
jbe 0x20002937
mov eax, ecx
lea esi, [esp + 0x24]
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
lea ebx, [ebx + ecx + 1]
mov ecx, dword [esp + 0x10]
test ecx, ecx
jbe 0x2000295e
mov edx, ecx
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
add ebx, eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [ebx + ebp]
push esi
push edx
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x34]
inc eax
push ecx
push edx
mov dword [esp + 0x34], eax
push eax
mov eax, dword [esp + 0x144]
mov dword [esp + 0x2c], 0x2000
push eax
mov dword [esp + 0x34], 0xff
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp eax, 0x103
jne 0x200028cf
push esi
call fcn.20019296
mov ecx, dword [esp + 0x24]
add esp, 4
push ebx
push ebp
call fcn.20008c40
push ebp
call dword [0x2001a11c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 8
Function at 0x20003a20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001aa78
push 0x200192b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x20]
cmp eax, 3
ja case.default.0x20003a57
jmp dword [eax*4 + 0x20003b9c]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne case.default.0x20003a57
lea ecx, [ebp - 0x24]
push ecx
push 0x2001f
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne case.default.0x20003a57
mov edx, dword [ebp + 0x14]
cmp edx, ebx
jbe case.default.0x20003a57
cmp edx, 2
jbe 0x20003ae3
cmp edx, 4
jne case.default.0x20003a57
push edx
lea ecx, [ebp + 0x1c]
push ecx
push edx
push ebx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
test eax, eax
jne case.default.0x20003a57
jmp 0x20003b67
mov esi, dword [ebp + 0x18]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push edx
push ebx
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
test eax, eax
jne case.default.0x20003a57
jmp 0x20003b67
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push ebx
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
test eax, eax
jne case.default.0x20003a57
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne case.default.0x20003a57
jmp 0x20003b67
lea edx, [ebp - 0x24]
push edx
push 0x2001f
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
test eax, eax
jne case.default.0x20003a57
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
jne case.default.0x20003a57
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.20003b8e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x200041f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x20004200
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x2000421c
cmp al, 0x2b
jne 0x2000421c
mov al, 1
ret
xor al, al
ret