joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406360
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40646a
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4063b3
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403218
jmp 0x406451
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00406314
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00406334
mov ebx, eax
test esi, esi
je 0x4063db
dec esi
test esi, esi
jl 0x4063db
cmp edi, ebx
jne 0x4063ba
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.00403258
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.004034b8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004032c4
cmp eax, 2
jl 0x406451
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406451
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004032c4
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406451
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004032c4
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.004034b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406471
lea eax, [ebp - 0x110]
call fcn.00403134
ret

Function at 0x406520
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4065b8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x40656d
mov eax, dword [ebx + 0x19]
call fcn.00403478
push eax
push esi
mov eax, edi
call fcn.00403478
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403478
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x4065a2
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.00403478
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00406164
mov eax, dword [ebp - 8]
call fcn.00403478
push eax
mov eax, edi
call fcn.00403478
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403478
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065bf
lea eax, [ebp - 8]
call fcn.00403134
ret
Function at 0x407d00
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x407d0c
or byte [eax + 0x27], 0x10
mov byte [eax + 0x4e], dl
mov ecx, dword [eax + 0x18]
jecxz 0x407d28
push eax
je 0x407d29
call dword [0x414130]
pop eax
push 5
push dword [eax + 0x18]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x15a], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x414130]
ret

Function at 0x4093ac
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.004091e4
je 0x4093f1
mov eax, ebx
push edx
call fcn.00409674
pop edx
cmp eax, edx
je 0x4093f1
test edx, edx
mov eax, ebx
jne 0x4093d0
pop ebx
inc edx
jmp fcn.00409664
mov byte [ebx + 0x49], dl
cmp dl, 5
jne 0x4093d9
dec edx
push edx
xor edx, edx
call fcn.00409664
mov eax, dword [ebx + 0x3d]
movzx eax, word [eax + 0xe]
call fcn.00408f78
pop edx
cmp al, dl
xchg ebx, eax
pop ebx
jne fcn.00409410
ret
Function at 0x401420
Capabilities:
Create process on windows
Create process suspended
Set current directory

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x2a4
mov dword [ebp - 0x278], ecx
call fcn.004013a0
mov dword [ebp - 0x258], 0x44
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x226], 0
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x258]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
mov dword [esp + 8], 9
mov dword [esp + 4], str..hl.exe
lea eax, [ebp - 0x212]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp + 8], 0x16
mov dword [esp + 4], str.__steam__game_cstrike
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x278]
cmp dword [eax], 1
jle 0x40152f
mov dword [ebp - 8], 1
jmp 0x401522
mov dword [esp + 4], 0x40304f
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, dword [ebp - 8]
shl eax, 2
mov edx, dword [ebp - 0x278]
add eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
add dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x278]
cmp eax, dword [edx]
jl 0x4014e5
mov edx, dword [ebp - 0x278]
mov eax, dword [edx + 4]
mov edx, dword [eax]
lea eax, [ebp - 0x208]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004015eb
lea eax, [ebp - 0x208]
mov dword [esp], eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
lea eax, [ebp - 0x268]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x258]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x108]
mov dword [esp + 4], eax
lea eax, [ebp - 0x212]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x264]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x405540
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3384b0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x351014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x352070
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00417ba0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x351a88
push eax
call fcn.00417ba0
mov esi, dword [0x352080]
xor ebx, ebx
mov edi, dword [0x352084]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x355280], bl
mov eax, ebx
mov ecx, 0x352070
cmovae ecx, dword [0x352070]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x355390], al
inc ebx
cmp ebx, 0x100
jl 0x4055c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x355280]
movzx eax, byte [esi + 0x355390]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x405614
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x355280]
mov byte [esi + 0x355280], al
inc esi
mov byte [edi + 0x355280], dl
cmp esi, 0x100
jl 0x4055f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00405190
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x405669
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40565f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4056bf
push edx
push ecx
call fcn.0041d148
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x4056ab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4056a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4056bf
push edx
push ecx
call fcn.0041d148
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043674a
int3
Function at 0x405940
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x351014]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], 0x67452301
push 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.00417830
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push 0x10
push eax
push esi
call fcn.00433d30
lea eax, [esp + 0x1c]
add esp, 0xc
lea ebx, [esi + 0x10]
cmp edi, eax
je 0x405a0b
mov eax, dword [edi]
test eax, eax
je 0x4059ed
mov ecx, dword [edi + 8]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4059e3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a4e
mov eax, edx
push ecx
push eax
call fcn.0041d148
add esp, 8
mov eax, dword [esp + 0x18]
mov dword [edi], esi
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0041cad1
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x405a3c
mov ecx, dword [esp + 0x18]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x405a32
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a4e
push ecx
push esi
call fcn.0041d148
add esp, 8
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041cad1
mov esp, ebp
pop ebp
ret
call fcn.0043674a
int3
Function at 0x407820
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x351014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call dword [0x33f0a4]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x407a09
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x407a09
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00433bd0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call dword [0x33f04c]
test eax, eax
je 0x407a09
push 4
push 0x1000
push 4
push 0
call dword [0x33f094]
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call dword [0x33f038]
test eax, eax
je 0x407a09
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x347cec
push dword [esp + 0x30]
call dword [0x33f0a8]
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x40792c
push 0x347cf0
push 0x347d08
call dword [0x33f07c]
push eax
call dword [0x33f03c]
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call dword [0x33f040]
mov dword [esp + 0x14], eax
test eax, eax
je 0x407a09
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call dword [0x33f0a0]
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x4079c3
mov dword [esp + 0xc], eax
call fcn.00407670
push eax
call dword [0x33f078]
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [0x33f0a0]
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x407972
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call dword [0x33f0a0]
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call dword [0x33f054]
push dword [esp + 0x24]
call dword [0x33f084]
push 0x8000
push 0
push esi
call dword [0x33f09c]
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0041cad1
mov esp, ebp
pop ebp
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x402fc9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x402fd8
pop dword [ebp - 0x1c]
mov eax, 0xedc4cb37
sub eax, 0xed849b5f
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xb4ae270f
add dword [ebp - 0x2c], 0x99a41e3c
mov dword [ebp - 0x28], 0x23774d67
sub dword [ebp - 0x28], 0xf1440122
mov dword [ebp - 0x24], 0xeb9bd100
sub dword [ebp - 0x24], 0x9f4f8cd2
mov dword [ebp - 0x20], 0xdb8d0819
sub dword [ebp - 0x20], 0xdb8d0819
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x7bf262a2
sub dword [ebp - 0x2c], 0x77ff94c
mov dword [ebp - 0x28], 0xe2b4aa42
sub dword [ebp - 0x28], 0xa14848cd
mov dword [ebp - 0x24], 0xbf3bf629
sub dword [ebp - 0x24], 0x5bcc89bd
mov dword [ebp - 0x20], 0x394bf031
sub dword [ebp - 0x20], 0x394bf031
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x386f3
push 0
call eax
mov ecx, 0x43a8
mov ebx, eax
mov edi, 0x39084731
sub edi, 0x38c69731
add edi, dword [ebp - 0x1c]
mov edx, 0x53a406c4
add edx, 0xfe7e94f9
mov dword [ebp - 8], 0xb9abf0f3
mov esi, dword [edi]
mov dword [ebp - 0x10], 0x416300e2
xor esi, edx
add dword [ebp - 4], 0x808b19a3
mov dword [ebx], esi
add dword [ebp - 0x10], 0x2a61b88a
add ebx, 4
add edi, 0x33871763
add edi, 0xcc78e8a1
loop 0x4030ea
add eax, 0xc6a7eb76
add eax, 0x395915fd
mov ebx, eax
add eax, 5
mov ecx, 0x99845930
add ecx, 0x66bba6d0
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x2d817083
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2d8e2e01
call fcn.2d805d6a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
push str.SoftwareMicrosoftInternet_Explorer
xor ebx, ebx
push 0x80000002
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x2d8170b6
xor al, al
jmp 0x2d81717e
push ebx
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], ebx
push 0x100
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.2d898ad9
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
push ebx
push str.Version
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
jne 0x2d81712f
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x2d81712f
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.2d898ad9
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x2d81717c
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], edi
cmp eax, 0x1000
jb 0x2d817173
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.2d898ad9
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.2d898ad9
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
Function at 0x2d8357c4
Capabilities:
Get disk information

Disassembly:
push 0x3c
mov eax, 0x2d8e5ab1
call fcn.2d805d6a
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call fcn.2d898ad9
pop ecx
test al, al
je 0x2d83591e
lea eax, [ebp - 0x44]
push eax
push ebx
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
push dword [ebp - 0x44]
push 1
call fcn.2d898ad9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x2d835926
lea eax, [ebp - 0x44]
push eax
push edi
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
mov byte [edi + 3], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
call fcn.2d82c3ac
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.2d8361de
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], bl
pop ecx
pop ecx
cmp eax, 0x10
jb 0x2d8358a4
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
cmp eax, 0x1000
jb 0x2d835898
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.2d898ad9
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.2d898ad9
pop ecx
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
cmp eax, 2
je 0x2d8358c0
cmp eax, 5
jne 0x2d8358c2
mov bl, 1
mov eax, dword [0x2d96a8d4]
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 8
jb 0x2d83591e
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x2d835915
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.2d898ad9
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.2d898ad9
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
xor al, al
jmp 0x2d835920
Function at 0x40cabe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40cacd
pop dword [ebp - 0x10]
mov eax, 0x40cacd
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x53466
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x368ffcdd
add ecx, 0xc97058fc
mov edi, eax
mov ebx, 0x476e00
add ebx, dword [ebp - 0x10]
mov edx, 0x9beb84a
sub edx, 0x708487b0
xor dword [ebp - 0xc], edx
mov esi, dword [ebx]
add dword [ebp - 4], 0xc641abc3
add esi, edx
mov dword [ebp - 4], 0x33476c51
mov dword [edi], esi
sub dword [ebp - 4], 0xd145c715
add edi, 0x7adc3ec0
add edi, 0x8523c144
add ebx, 0xc5a3831b
add ebx, 0x3a5c7ce9
loop 0x40cb1c
add eax, 0xbc118508
add eax, 0x43efc52f
mov ebx, eax
add eax, 0xc7d943c9
sub eax, 0xc7d943c4
mov ecx, 0xfe7c1024
sub ecx, 0xfe3c1024
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x43fbad
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5e8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fbf0
push str.SystemFunction040
push dword [0x46b5e8]
call edi
push str.SystemFunction041
push dword [0x46b5e8]
mov dword [0x46b5f0], eax
call edi
mov dword [0x46b5f4], eax
jmp 0x43fbf5
mov eax, dword [0x46b5f4]
cmp dword [0x46b5f0], 0
je 0x43fc06
test eax, eax
jne 0x43fcad
push 0x46b5ec
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fcb7
push str.CryptProtectMemory
push dword [0x46b5ec]
call edi
cmp dword [0x46b5f0], 0
mov dword [0x46b5f8], eax
jne 0x43fc6b
test eax, eax
jne 0x43fc6b
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x28
push str.cryputil.cpp
call fcn.004037d3
jmp 0x43fcb7
push str.CryptUnprotectMemory
push dword [0x46b5ec]
call edi
cmp dword [0x46b5f4], 0
mov dword [0x46b5fc], eax
jne 0x43fcad
test eax, eax
jne 0x43fcad
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x2d
jmp 0x43fc5f
mov dword [0x46b600], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x1000103f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x16], 1
jne 0x100010a9
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp + 8]
push eax
movzx eax, byte [esi + 0x11]
push 0x40
push eax
push dword [esi + 0x12]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push eax
call ebx
movzx eax, byte [esi + 0x11]
push eax
push dword [esi + 0x12]
lea eax, [esi + 0x17]
push eax
call fcn.1000fa40
movzx eax, byte [esi + 0x11]
push eax
push esi
push dword [esi + 0x12]
call fcn.1000fa40
add esp, 0x18
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
movzx eax, byte [esi + 0x11]
push eax
push dword [esi + 0x12]
call edi
push eax
call ebx
pop edi
mov byte [esi + 0x16], 0
pop ebx
pop esi
pop ebp
ret

Function at 0x100010ac
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x16], 0
jne 0x10001108
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp + 8]
push eax
movzx eax, byte [esi + 0x11]
push 0x40
push eax
push dword [esi + 0x12]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push eax
call ebx
movzx eax, byte [esi + 0x11]
push eax
lea eax, [esi + 0x17]
push eax
push dword [esi + 0x12]
call fcn.1000fa40
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
movzx eax, byte [esi + 0x11]
push eax
push dword [esi + 0x12]
call edi
push eax
call ebx
pop edi
mov byte [esi + 0x16], 1
pop ebx
pop esi
pop ebp
ret