joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ab94
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
xor edx, edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404290
xor eax, eax
push ebp
push 0x40ac91
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402d60
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 5
mov eax, dword [0x410540]
mov eax, dword [eax]
call fcn.004042a0
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea edx, [ebp - 8]
mov eax, dword [0x4105c0]
call fcn.0040efdc
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
push dword [ebp - 8]
push 0x40aca8
push dword [ebp - 4]
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.00404160
mov eax, dword [ebp - 0x60]
call fcn.004042a0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x40ac6e
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004042a0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ac98
lea eax, [ebp - 0x60]
call fcn.00403e10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e34
ret

Function at 0x40ad78
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe8c
mov ebx, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
push 1
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov ebp, eax
push 0
lea eax, [esp + 0x14]
push eax
push 0x40
lea eax, [esp + 0x20]
push eax
push ebx
call sub.kernel32.dll_ReadFile
cmp word [esp + 0x14], 0x5a4d
je 0x40adde
push 0
push 0
push ebp
push ebx
call sub.kernel32.dll_SetFilePointer
mov dword [esp], 0
mov dword [esp + 4], 0
jmp 0x40ae8f
mov eax, dword [esp + 0x50]
push 0
push 0
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [esp + 0x14]
push eax
push 0xf8
lea eax, [esp + 0x60]
push eax
push ebx
call sub.kernel32.dll_ReadFile
cmp dword [esp + 0x54], 0x4550
je 0x40ae2a
push 0
push 0
push ebp
push ebx
call sub.kernel32.dll_SetFilePointer
mov dword [esp], 0
mov dword [esp + 4], 0
jmp 0x40ae8f
mov ax, word [esp + 0x5a]
xor edi, edi
movzx esi, ax
dec esi
test esi, esi
jl 0x40ae75
inc esi
push 0
lea eax, [esp + 0x14]
push eax
push 0x28
lea eax, [esp + 0x158]
push eax
push ebx
call sub.kernel32.dll_ReadFile
mov ecx, dword [esp + 0x15c]
mov eax, dword [esp + 0x160]
cmp edi, eax
jae 0x40ae72
mov edi, eax
lea eax, [ecx + edi]
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
dec esi
jne 0x40ae3a
push 0
push 0
push ebp
push ebx
call sub.kernel32.dll_SetFilePointer
mov eax, dword [esp + 8]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x174
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40aea4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40b0a2
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
xor eax, eax
call fcn.0040ba64
mov eax, dword [0x410458]
mov eax, dword [eax]
call fcn.0040ad78
mov edx, dword [0x410564]
mov dword [edx], eax
mov eax, dword [0x410564]
mov eax, dword [eax]
xor edx, edx
call fcn.0040ba64
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 3]
mov eax, dword [0x410458]
mov ecx, 3
call fcn.0040bab8
cmp dword [ebp - 8], 3
jne 0x40b08c
lea eax, [ebp - 0x10]
lea edx, [ebp - 3]
mov ecx, 3
call fcn.00404074
mov eax, dword [ebp - 0x10]
mov edx, 0x40b0b8
call fcn.004041ec
jne 0x40b08c
mov eax, dword [0x410564]
add dword [eax], 0x100
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 0xa]
mov eax, dword [0x410458]
mov ecx, 1
call fcn.0040bab8
mov al, byte [ebp - 0xa]
and al, 8
cmp al, 8
sete byte [0x4102e0]
mov al, byte [ebp - 0xa]
and al, 0x40
cmp al, 0x40
sete byte [0x4102e4]
mov al, byte [ebp - 0xa]
and al, 0x80
cmp al, 0x80
sete byte [0x4102e8]
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 0xb]
mov eax, dword [0x410458]
mov ecx, 1
call fcn.0040bab8
cmp byte [ebp - 0xb], 0
seta byte [0x4102dc]
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 9]
mov eax, dword [0x410458]
mov ecx, 1
call fcn.0040bab8
cmp byte [ebp - 9], 0
seta byte [0x4102d8]
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 0xa]
mov eax, dword [0x410458]
mov ecx, 1
call fcn.0040bab8
cmp byte [ebp - 0xa], 0
seta byte [0x4102d4]
cmp byte [0x4102dc], 0
je 0x40b007
lea eax, [ebp - 8]
push eax
push 0
xor ecx, ecx
mov cl, byte [ebp - 0xb]
mov edx, dword [0x4117a4]
mov eax, dword [0x410458]
call fcn.0040bab8
xor eax, eax
mov al, byte [ebp - 0xb]
mov edx, dword [0x4117a4]
mov byte [edx + eax], 0
cmp byte [0x4102d8], 0
je 0x40b049
lea eax, [ebp - 8]
push eax
push 0
xor ecx, ecx
mov cl, byte [ebp - 9]
mov edx, dword [0x41179c]
mov eax, dword [0x410458]
call fcn.0040bab8
xor eax, eax
mov al, byte [ebp - 9]
mov edx, dword [0x41179c]
mov byte [edx + eax], 0
cmp byte [0x4102d4], 0
je 0x40b06d
lea eax, [ebp - 8]
push eax
push 0
xor ecx, ecx
mov cl, byte [ebp - 0xa]
mov edx, dword [0x4117a0]
mov eax, dword [0x410458]
call fcn.0040bab8
xor eax, eax
mov al, byte [ebp - 0xa]
mov edx, dword [0x4117a0]
mov byte [edx + eax], 0
mov eax, dword [0x410654]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b0a9
lea eax, [ebp - 0x10]
call fcn.00403e10
ret
Function at 0x40b0bc
Capabilities:
Set current directory

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, 0x4117ac
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], 0x4117cc
mov eax, 0x40b118
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 1
xor eax, eax
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x18], eax
push esi
call sub.shell32.dll_SHBrowseForFolderA
mov dword [0x4118d4], eax
cmp dword [0x4118d4], 0
je 0x40b112
push ebx
mov eax, dword [0x4118d4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
push ebx
call sub.kernel32.dll_SetCurrentDirectoryA
pop esi
pop ebx
ret

Function at 0x40bab8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebx], eax
mov dword [ebp - 8], 0xffffffff
mov dx, 1
xor eax, eax
call fcn.0040ba64
mov eax, dword [0x4104a8]
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0040ba64
mov eax, dword [ebp + 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40bbdc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov eax, dword [0x4104c8]
cmp byte [eax], 0
je 0x40bbfe
mov eax, dword [0x410634]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [0x411920], eax
or eax, 0xffffffff
pop esi
pop ebx
ret
mov eax, dword [0x410634]
cmp dword [eax], 0
jg 0x40bc17
xor eax, eax
mov dword [0x411920], eax
or eax, 0xffffffff
jmp 0x40bcd0
movzx eax, word [0x41191c]
cmp eax, dword [0x411920]
jb 0x40bc99
push 0x411920
push 0
mov eax, dword [0x410634]
mov eax, dword [eax]
mov edx, 0x8000
call fcn.0040ead4
mov ecx, eax
mov edx, dword [0x411914]
mov eax, dword [0x410458]
call fcn.0040bab8
mov eax, dword [0x410624]
mov ax, word [eax + 6]
and ax, 1
cmp ax, 1
jne 0x40bc90
mov esi, dword [0x411920]
dec esi
test esi, esi
jl 0x40bc90
inc esi
xor ebx, ebx
call fcn.0040d8ec
mov edx, dword [0x411914]
xor byte [edx + ebx], al
mov eax, dword [0x411914]
mov al, byte [eax + ebx]
call fcn.0040d818
inc ebx
dec esi
jne 0x40bc71
mov word [0x41191c], 0
cmp dword [0x411920], 0
jne 0x40bcb0
mov word [0x41191c], 0
or eax, 0xffffffff
jmp 0x40bcd0
movzx eax, word [0x41191c]
mov edx, dword [0x411914]
movzx eax, byte [edx + eax]
inc word [0x41191c]
mov edx, dword [0x410634]
dec dword [edx]
pop esi
pop ebx
ret
Function at 0x40bd24
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, esp
mov eax, dword [0x41190c]
mov dword [ebp], eax
mov ax, word [0x411910]
mov word [esp + 4], ax
mov bx, word [0x411924]
mov si, word [esp + 4]
and si, 7
lea ecx, [esp + 4]
mov edx, ebp
mov eax, esi
call fcn.0040bd18
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.0040bcd4
mov si, word [ebp]
and si, 0xffff
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.0040bd18
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.0040bcd4
mov ax, word [ebp]
not ax
and ax, 0xffff
cmp si, ax
je 0x40bdac
mov word [0x411924], 0
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.0040bd18
test si, si
je 0x40be49
dec esi
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 8
call fcn.0040bcd4
movzx eax, bx
mov edx, dword [0x411918]
mov cl, byte [ebp]
mov byte [edx + eax], cl
inc ebx
cmp bx, 0x8000
jne 0x40be27
push 0
lea eax, [esp + 0xc]
push eax
movzx eax, bx
push eax
mov eax, dword [0x411918]
push eax
mov eax, dword [0x4105f4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
movzx edi, bx
mov eax, edi
call fcn.0040e958
mov ecx, dword [0x410544]
mov edx, edi
mov eax, dword [0x411918]
call fcn.0040eab0
xor ebx, ebx
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 8
call fcn.0040bd18
mov eax, dword [0x4104c8]
cmp byte [eax], 0
jne 0x40be63
test si, si
jne 0x40bdc4
mov word [0x411924], bx
mov eax, dword [ebp]
mov dword [0x41190c], eax
mov ax, word [esp + 4]
mov word [0x411910], ax
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40cd60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, 0x411908
mov word [0x41191c], 0
xor eax, eax
mov dword [0x411920], eax
mov word [0x411924], 0
mov word [0x411910], 0
xor eax, eax
mov dword [0x41190c], eax
xor ebx, ebx
xor eax, eax
mov dword [0x411914], eax
xor eax, eax
mov dword [0x411918], eax
mov eax, 0x8002
call fcn.004028a4
mov dword [0x411914], eax
mov eax, 0x8002
call fcn.004028a4
mov dword [0x411918], eax
xor eax, eax
push ebp
push 0x40ceab
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x411928], eax
xor eax, eax
mov dword [0x41192c], eax
xor eax, eax
push ebp
push 0x40ce75
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [esi], 0
lea eax, [ebp - 4]
call fcn.0040ccc0
cmp bx, word [esi]
jae 0x40ce04
mov bx, word [esi]
cmp dword [ebp - 4], 0
jne 0x40ce14
mov eax, dword [0x4104c8]
cmp byte [eax], 0
je 0x40cdef
cmp word [0x411924], 0
jbe 0x40ce6b
push 0
lea eax, [ebp - 8]
push eax
movzx eax, word [0x411924]
push eax
mov eax, dword [0x411918]
push eax
mov eax, dword [0x4105f4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
movzx eax, word [0x411924]
call fcn.0040e958
mov ecx, dword [0x410544]
movzx edx, word [0x411924]
mov eax, dword [0x411918]
call fcn.0040eab0
mov word [0x411924], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40ce7f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ceb2
mov edx, 0x8001
mov eax, dword [0x411914]
call fcn.004028d4
mov edx, 0x8001
mov eax, dword [0x411918]
call fcn.004028d4
ret

Function at 0x40d0f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40d15a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404074
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d80
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40d144
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d161
lea eax, [ebp - 0x10]
call fcn.00403e10
ret
Function at 0x40d50c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40d70e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404008
jmp 0x40d6a2
mov edx, dword [ebp - 8]
mov eax, 0x40d724
call fcn.00404338
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jle 0x40d56c
mov edi, 1
mov eax, dword [ebp - 8]
mov al, byte [eax + edi - 1]
mov edx, dword [ebp - 4]
mov byte [edx + ebx], al
inc ebx
inc edi
dec esi
jne 0x40d55a
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x40d730
call fcn.00404338
mov ecx, eax
sub ecx, dword [ebp - 0x10]
inc ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004042f8
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x40d730
call fcn.00404338
inc eax
push eax
mov eax, dword [ebp - 8]
call fcn.004040a0
mov ecx, eax
mov eax, dword [ebp - 8]
pop edx
call fcn.004042f8
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004066cc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00403ea8
mov eax, dword [ebp - 0xc]
mov edx, 0x40d73c
call fcn.004041ec
jne 0x40d607
mov eax, dword [0x4105c0]
call fcn.0040ec00
movzx ecx, ax
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
mov eax, dword [0x4105c0]
call fcn.00402a30
mov eax, dword [0x4105c0]
call fcn.0040ec00
movzx eax, ax
add ebx, eax
jmp 0x40d678
mov eax, dword [ebp - 0xc]
mov edx, 0x40d74c
call fcn.004041ec
jne 0x40d62d
mov eax, pe_nt_image_headers32
sub eax, ebx
push eax
mov eax, dword [ebp - 4]
add eax, ebx
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
add ebx, eax
jmp 0x40d678
mov eax, dword [ebp - 0xc]
mov edx, 0x40d75c
call fcn.004041ec
jne 0x40d653
mov eax, pe_nt_image_headers32
sub eax, ebx
push eax
mov eax, dword [ebp - 4]
add eax, ebx
push eax
call sub.kernel32.dll_GetSystemDirectoryA
add ebx, eax
jmp 0x40d678
mov eax, dword [ebp - 0xc]
mov edx, 0x40d76c
call fcn.004041ec
jne 0x40d678
mov eax, dword [ebp - 4]
add eax, ebx
push eax
mov eax, pe_nt_image_headers32
sub eax, ebx
push eax
call sub.kernel32.dll_GetTempPathA
add ebx, eax
dec ebx
cmp dword [ebp - 8], 0
je 0x40d6a2
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00404578
mov eax, dword [ebp - 0x14]
cmp word [eax], 0x5c
je 0x40d6a2
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x40d77c
call fcn.004040ec
mov edx, dword [ebp - 8]
mov eax, 0x40d724
call fcn.00404338
test eax, eax
jne 0x40d53d
mov eax, dword [ebp - 8]
call fcn.004040a0
mov esi, eax
test esi, esi
jle 0x40d6dc
mov edi, 1
mov eax, dword [ebp - 8]
mov al, byte [eax + edi - 1]
mov edx, dword [ebp - 4]
mov byte [edx + ebx], al
inc ebx
inc edi
dec esi
jne 0x40d6ca
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d715
lea eax, [ebp - 0x18]
call fcn.00403e10
lea eax, [ebp - 0x14]
call fcn.00404414
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403e34
ret
Function at 0x40d818
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0x411950
mov edx, dword [esi]
mov eax, ebx
call fcn.0040d7fc
mov edi, eax
mov dword [esi], edi
and edi, 0xff
add dword [esi + 4], edi
imul ebx, dword [esi + 4], 0x8088405
inc ebx
mov dword [esi + 4], ebx
mov eax, ebx
call fcn.00405904
call fcn.00405908
mov edx, dword [esi + 8]
call fcn.0040d7fc
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret

Function at 0x40d910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00404290
xor eax, eax
push ebp
push 0x40d9d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
cmp dword [ebp + 8], 0
je 0x40d9c3
mov eax, dword [ebp + 8]
call fcn.0040d860
mov al, byte [ebp - 1]
dec eax
test al, al
jb 0x40d986
inc eax
mov byte [ebp - 4], al
mov bl, 0
call fcn.0040d8ec
xor edx, edx
mov dl, bl
xor ecx, ecx
mov cl, byte [ebp - 1]
add edx, ecx
xor al, byte [esi + edx]
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
call fcn.0040d818
xor eax, eax
mov al, bl
mov dl, byte [ebp - 3]
mov byte [esi + eax], dl
inc ebx
dec byte [ebp - 4]
jne 0x40d958
xor eax, eax
mov al, byte [ebp - 1]
mov bl, byte [esi + eax - 1]
and di, 8
cmp di, 8
je 0x40d9b0
mov eax, dword [ebp + 0x10]
call fcn.00405904
call fcn.00405908
cmp bl, al
jne 0x40d9c3
mov byte [ebp - 2], 1
jmp 0x40d9c3
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
jne 0x40d9c3
mov byte [ebp - 2], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d9e0
lea eax, [ebp + 8]
call fcn.00403e10
ret
Function at 0x40eadc
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [0x410634]
mov eax, dword [edi]
mov edx, 0x8000
call fcn.0040ead4
add eax, 2
call fcn.004028a4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40ebf2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jle 0x40ebd7
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [edi]
mov edx, 0x8000
call fcn.0040ead4
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, dword [0x410458]
call fcn.0040bab8
mov eax, dword [edi]
mov edx, 0x8000
call fcn.0040ead4
cmp eax, dword [ebp - 4]
jbe 0x40eb55
call fcn.004038f4
jmp 0x40ebf9
mov eax, dword [ebp - 4]
sub dword [edi], eax
mov eax, dword [0x410624]
mov ax, word [eax + 6]
and ax, 1
cmp ax, 1
jne 0x40eb9a
mov esi, dword [ebp - 4]
dec esi
test esi, esi
jl 0x40eb9a
inc esi
xor ebx, ebx
call fcn.0040d8ec
mov edx, dword [ebp - 8]
mov dl, byte [edx + ebx]
xor al, dl
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
mov eax, dword [ebp - 8]
mov al, byte [eax + ebx]
call fcn.0040d818
inc ebx
dec esi
jne 0x40eb78
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4105f4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 4]
call fcn.0040e958
mov ecx, dword [0x410544]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0040eab0
cmp dword [edi], 0
jg 0x40eb19
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ebf9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004028d4
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x40376c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b0f4]
jne 0x403776
repz ret
jmp fcn.00403c18
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x78d12f1c
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x20635e37
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401016
xor al, al
jmp 0x401018
mov al, 1
pop ebp
ret 4

Function at 0x40107f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebp
ret 0xc
Function at 0x401850
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov byte [ebp - 0x804], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x800]
call fcn.004015e0
lea ecx, [ebp - 0x800]
push ecx
call fcn.0040113c
push 0x80
lea ecx, [ebp - 0x800]
call fcn.004016c0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x800]
call fcn.004016c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 5
div ecx
test edx, edx
je 0x4018c2
mov al, byte [ebp - 0x804]
jmp 0x401a9a
push 0x4080b4
mov edx, dword [ebp + 8]
push edx
call fcn.004023e8
add esp, 8
mov dword [ebp - 0x808], eax
push 0x4080b4
mov ecx, 0x408940
call fcn.004016c0
push eax
call fcn.004023e8
add esp, 8
mov dword [ebp - 0x80c], eax
push 0x4080b0
lea ecx, [ebp - 0x800]
call fcn.004016c0
push eax
call fcn.004023e8
add esp, 8
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x808], 0
je 0x401a1c
cmp dword [ebp - 0x80c], 0
je 0x401a1c
cmp dword [ebp - 0x810], 0
je 0x401a1c
mov eax, dword [ebp - 0x808]
push eax
call fcn.00401b00
and eax, 0xff
test eax, eax
jne 0x401a1c
push 1
mov ecx, dword [ebp - 0x810]
push ecx
mov edx, dword [ebp - 0x80c]
push edx
call fcn.00401aa0
cmp dword [ebp - 0x80c], 0
je 0x40198d
mov eax, dword [ebp - 0x80c]
push eax
call fcn.00402372
add esp, 4
mov dword [ebp - 0x80c], 0
push 0
mov ecx, dword [ebp - 0x810]
push ecx
mov edx, dword [ebp - 0x808]
push edx
call fcn.00401aa0
cmp dword [ebp - 0x808], 0
je 0x4019c4
mov eax, dword [ebp - 0x808]
push eax
call fcn.00402372
add esp, 4
mov dword [ebp - 0x808], 0
cmp dword [ebp - 0x810], 0
je 0x4019e6
mov ecx, dword [ebp - 0x810]
push ecx
call fcn.00402372
add esp, 4
mov dword [ebp - 0x810], 0
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x800]
call fcn.004016c0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov byte [ebp - 0x804], 1
cmp dword [ebp - 0x808], 0
je 0x401a3e
mov edx, dword [ebp - 0x808]
push edx
call fcn.00402372
add esp, 4
mov dword [ebp - 0x808], 0
cmp dword [ebp - 0x80c], 0
je 0x401a60
mov eax, dword [ebp - 0x80c]
push eax
call fcn.00402372
add esp, 4
mov dword [ebp - 0x80c], 0
cmp dword [ebp - 0x810], 0
je 0x401a82
mov ecx, dword [ebp - 0x810]
push ecx
call fcn.00402372
add esp, 4
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x800]
call fcn.004016c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, byte [ebp - 0x804]
mov esp, ebp
pop ebp
ret 4
Function at 0x401bb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00402180
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x810]
call fcn.004015e0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
push 0x22
push 1
lea ecx, [ebp - 0x810]
call fcn.004016a0
push eax
call fcn.004027f0
add esp, 8
mov esi, eax
lea ecx, [ebp - 0x810]
call fcn.004016c0
sub esi, eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 1
push 0
lea ecx, [ebp - 0x810]
call fcn.004016a0
movsx eax, byte [eax]
cmp eax, 0x22
je 0x401c3d
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x810]
call fcn.00401ce0
add eax, 1
mov dword [ebp - 0xc], eax
push 0x5c
mov ecx, dword [ebp - 0x10]
add ecx, 1
push ecx
lea ecx, [ebp - 0x810]
call fcn.004016a0
push eax
call fcn.004027f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401c90
lea ecx, [ebp - 0x810]
call fcn.004016c0
mov edx, dword [ebp - 4]
sub edx, eax
add edx, 1
cmp edx, dword [ebp - 0xc]
jge 0x401c90
lea ecx, [ebp - 0x810]
call fcn.004016c0
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 0x10], ecx
jmp 0x401c3d
mov edx, dword [ebp - 8]
push edx
lea ecx, [ebp - 0x810]
call fcn.004016a0
push eax
lea ecx, [ebp - 0x1010]
call fcn.004015e0
mov ecx, 0x200
lea esi, [ebp - 0x1010]
mov edi, 0x408940
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc]
sub eax, 1
push eax
mov ecx, 0x408940
call fcn.004016a0
mov byte [eax], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret