joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf149a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf58e10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0xf72014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0xf730ec
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00f280c0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0xf72a8c
push eax
call fcn.00f280c0
mov esi, dword [0xf730fc]
xor ebx, ebx
mov edi, dword [0xf73100]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0xf76390], bl
mov eax, ebx
mov ecx, 0xf730ec
cmovae ecx, dword [0xf730ec]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0xf764a0], al
inc ebx
cmp ebx, 0x100
jl 0xf14a20
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0xf76390]
movzx eax, byte [esi + 0xf764a0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0xf14a74
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0xf76390]
mov byte [esi + 0xf76390], al
inc esi
mov byte [edi + 0xf76390], dl
cmp esi, 0x100
jl 0xf14a50
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00f14690
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0xf14ac9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xf14abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xf14b1f
push edx
push ecx
call fcn.00f2d663
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0xf14b0b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xf14b01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xf14b1f
push edx
push ecx
call fcn.00f2d663
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00f46c6a
int3
Function at 0xf170a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0xf72014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x4b401cd
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0xf17289
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0xf17289
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00f440f0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x4b40296
nop
test eax, eax
je 0xf17289
push 4
push 0x1000
push 4
push 0
call 0x4b30e65
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x4b20006
nop
test eax, eax
je 0xf17289
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0xf68df8
push dword [esp + 0x30]
call 0x4b20380
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0xf171ac
push 0xf68dfc
push 0xf68e14
call 0x4b30b0f
nop
push eax
call 0x4b200f2
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x4b20215
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0xf17289
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x4b400a9
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0xf17243
mov dword [esp + 0xc], eax
call fcn.00f16ef0
push eax
call 0x4b309fc
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x4b400a9
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0xf171f2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x4b400a9
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x4b20491
nop
push dword [esp + 0x24]
call 0x4b30bad
nop
push 0x8000
push 0
push esi
call 0x4b40000
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.00f2cff1
mov esp, ebp
pop ebp
ret
Function at 0xf1af20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf59726
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0xf72014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x414], ebx
push 0
mov dword [ebp - 0x414], ebx
call fcn.00f48b63
push eax
call fcn.00f46660
add esp, 8
call fcn.00f4663f
cdq
mov ecx, 0x3313
idiv ecx
mov edi, edx
call fcn.00f4663f
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
imul esi, edi
call fcn.00f4663f
imul edx, eax, 0x4d
lea ecx, [ebp - 0x444]
add edx, 0x64
add edx, esi
call fcn.00f145b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
lea edx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x444]
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0xf1afd0
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0xf1afe6
push 0x40
push 0
push 0xf78560
sub esi, ecx
call fcn.00f440f0
add esp, 0xc
mov dword [0xf78554], 0
mov edx, esi
mov dword [0xf78550], 0
lea ecx, [ebp - 0x410]
mov dword [0xf78540], 0x67452301
mov dword [0xf78544], 0xefcdab89
mov dword [0xf78548], 0x98badcfe
mov dword [0xf7854c], 0x10325476
call fcn.00f15530
call fcn.00f155f0
mov ecx, 0xf765a0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xf1b071
sub ecx, edx
push ecx
push 0xf765a0
lea ecx, [ebp - 0x42c]
call fcn.00f280c0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0xf1b0cc
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xf1b0c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xf1b18c
push edx
push ecx
call fcn.00f2d663
add esp, 8
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
cmp eax, 1
jb 0xf1b187
dec eax
mov ecx, 0xa
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push ecx
inc eax
mov ecx, ebx
push eax
call fcn.00f280c0
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0xf1b169
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xf1b15f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xf1b18c
push edx
push ecx
call fcn.00f2d663
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00f2cff1
mov esp, ebp
pop ebp
ret
call fcn.00f28200
call fcn.00f46c6a
int3
Function at 0xf2dcc7
Capabilities:
Parse pe header

Disassembly:
push 0
call 0x4b50dc6
nop
test eax, eax
je 0xf2dd07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xf2dd07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xf2dd07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0xf2dd07
cmp dword [ecx + 0x74], 0xe
jbe 0xf2dd07
cmp dword [ecx + 0xe8], 0
je 0xf2dd07
mov al, 1
ret
xor al, al
ret
Function at 0x402400
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetServices_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push str.Distribuerg
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0xf003f
push 0
push eax
push 0x80000002
call dword [0x408d98]
test eax, eax
je 0x402455
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [0x408d94]
test eax, eax
je 0x4024a1
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x408d90]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0x10]
push edx
call dword [0x408d90]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4024c8
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push 0
push 3
push 0
push 1
lea ecx, [esp + 0x2c]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4024f5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x402519
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40253b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push 0
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40256d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x120]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
test esi, esi
jne 0x40259d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push edx
push ebx
push 0
push 0x66
push 0xa
push esi
call ebp
mov edi, eax
test edi, edi
je 0x4025d6
push str.Distribuerg
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Distribuerg
push 0
push 0x65
push 0xa
push esi
call ebp
mov edi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
pop ebp
test eax, eax
push ebx
jne 0x4025f7
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x408dd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e09
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00404dd4
jmp 0x408e12
mov eax, ebx
mov edx, esi
call fcn.00404c98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408e1c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e3e
movzx eax, word [esp]
jmp 0x408e40
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4095c8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4096ed
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004093dc
mov esi, eax
mov eax, dword [0x410c54]
cmp byte [eax], 0
je 0x409695
mov eax, dword [0x410b90]
call fcn.0040317c
call fcn.00402f6c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4095a4]
call fcn.00405ad8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x409708
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4096d1
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x410b70]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x413b48]
call fcn.00405b90
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4096f4
lea eax, [ebp - 4]
mov edx, dword [0x4095a4]
call fcn.00405ae4
ret
Function at 0x40bb34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40bc6c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x40bc56
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40bb91
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bc56
cmp dword [ebp - 0x14], 0
jne 0x40bba8
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404c98
mov bl, 1
jmp 0x40bc56
cmp dword [ebp - 0x14], 0x70000000
jb 0x40bbb6
call fcn.00409734
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00404dd4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004054ac
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x40bb5a
test eax, eax
jne 0x40bc56
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40bc04
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bc56
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x40bc0c
dec esi
test esi, esi
je 0x40bc1b
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x40bc0b
cmp dword [ebp - 0x10], 7
jne 0x40bc26
test esi, esi
je 0x40bc26
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404f00
cmp dword [ebp - 0x10], 7
jne 0x40bc49
test esi, esi
je 0x40bc49
lea eax, [ebp - 4]
call fcn.004054ac
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404c98
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bc73
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40c6f0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x415d9c
mov eax, esi
mov edx, 8
test al, 1
je 0x40c70c
shr eax, 1
xor eax, 0xedb88320
jmp 0x40c70e
shr eax, 1
dec edx
jne 0x40c6ff
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40c6f8
pop esi
ret

Function at 0x40c724
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x415d98], 0
jne 0x40c747
call fcn.0040c6f0
push 1
push 0x415d98
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40c772
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x415d9c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40c74d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x40e0b4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040e068
test al, al
jne 0x40e0d5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40e121
xor eax, eax
push ebp
push 0x40e111
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404d24
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e118
lea eax, [ebp - 0xc]
call fcn.0040e0a4
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e360
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40e368
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x40e455
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0040b9fc
mov edx, dword [ebp - 8]
mov ecx, 0x40e470
xor eax, eax
call fcn.0040e244
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x40e423
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x40e382
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x35
call fcn.0040ded4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00407e04
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040bf84
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x67
call fcn.0040dea4
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x406c78]
call fcn.00409740
call fcn.00403f88
jmp 0x40e382
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e45c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c90
ret

Function at 0x40e484
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
mov eax, dword [0x410ca4]
cmp dword [eax], 2
jne 0x40e4f2
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40e4ad
xor eax, eax
jmp 0x40e4ff
lea eax, [esp + 8]
push eax
push 0x40e508
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x40e4f2
xor eax, eax
jmp 0x40e4ff
push esi
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
pop esi
pop ebx
ret
Function at 0x40ea5c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40eb31
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40eb4c
push ebx
push 0x40eb5c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40eadc
mov al, 0x69
call fcn.0040e6d4
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040ea30
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40eae5
call fcn.0040ea30
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eb38
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40ebe4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ecaf
jmp 0x40eca3
cmp dword [esi + 0x10], 0x1000
jne 0x40ec8f
test byte [esi + 0x15], 1
jne 0x40ec8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x40ec40
cmp ebp, 2
je 0x40ec40
cmp ebp, 0x10
je 0x40ec40
cmp ebp, 0x20
jne 0x40ec5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40ec5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40ec6d
mov eax, dword [esi]
add eax, ebx
call fcn.0040ebdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40ec60
cmp byte [esp + 4], 0
je 0x40ec8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ecaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x40ec15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406418
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40643c
xor eax, eax
test eax, eax
je 0x40644f
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40644f
xor ecx, ecx
jmp 0x406452
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406539
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427d8c], 0
push esi
jne 0x406570
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40654a
mov dword [ecx*4 + 0x427d88], eax
inc ecx
cmp ecx, 0x100
jl 0x406545
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4065a1
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427d88]
xor eax, esi
inc ecx
dec edx
jne 0x406583
pop edi
not eax
pop esi
ret 0xc