joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406c68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x406c94
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406c94
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x406c96
xor eax, eax
ret 8

Function at 0x4099e5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
test byte [0x418a00], 1
push ebx
push esi
push edi
jne 0x409a08
or dword [0x418a00], 1
call fcn.00409991
mov dword [0x4189fc], eax
push 4
pop eax
call fcn.004144d0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x409a9d
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x48]
lea edi, [eax - 1]
not edi
and edi, esi
sub edi, eax
mov dword [ebp - 8], eax
mov eax, dword [0x4188bc]
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xffff1000
add esi, 0x11000
add esi, ebx
cmp edi, esi
jb 0x409a9d
cmp eax, 1
je 0x409abe
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x409a9d
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x409a6a
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x409a99
xor eax, eax
inc eax
jmp 0x409add
cmp edi, eax
jae 0x409aa1
xor eax, eax
jmp 0x409add
cmp eax, esi
jae 0x409aa8
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4188bc]
jmp 0x409ac1
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409c92
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
ret 8
Function at 0x409fe3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
cmp word [ecx], 0
mov eax, dword [esp + 4]
push ebx
mov ebx, eax
je 0x40a071
cmp word [eax], 0
push ebp
push esi
push edi
je 0x40a06c
mov ebp, dword [sym.imp.USER32.dll_CharNextW]
cmp word [ebx], 0
mov edi, dword [esp + 0x18]
mov esi, ebx
je 0x40a05b
mov ax, word [edi]
test ax, ax
je 0x40a075
movzx ecx, word [esi]
movzx eax, ax
sub ecx, eax
jne 0x40a05b
push esi
call ebp
push edi
mov dword [esp + 0x18], eax
call ebp
mov ecx, eax
mov eax, dword [esp + 0x14]
mov edx, eax
sub ecx, edi
sub edx, esi
xor ecx, edx
test ecx, 0xfffffffe
jne 0x40a05b
jmp 0x40a051
inc esi
inc esi
movzx edx, word [esi]
inc edi
inc edi
movzx ecx, word [edi]
sub edx, ecx
je 0x40a055
cmp esi, eax
jb 0x40a043
cmp word [esi], 0
jne 0x40a00f
cmp word [edi], 0
je 0x40a075
push ebx
call ebp
mov ebx, eax
cmp word [ebx], 0
jne 0x40a003
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, ebx
jmp 0x40a06e

Function at 0x40a225
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov eax, 0x200c
lea ebp, [esp - 0x1f8c]
call fcn.004144d0
mov eax, dword [0x418890]
push esi
xor esi, esi
push esi
push esi
push esi
push esi
mov dword [ebp + 0x1f88], eax
lea eax, [ebp - 0x7c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0x1f94]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40a299
cmp dword [ebp - 0x7c], 1
jne 0x40a29d
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push dword [ebp + 0x1f94]
mov dword [ebp - 0x80], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40a299
cmp word [ebp - 0x78], si
je 0x40a299
inc eax
jmp 0x40a2a6
xor eax, eax
jmp 0x40a2a6
xor eax, eax
cmp eax, dword [ebp - 0x7c]
sbb eax, eax
neg eax
mov ecx, dword [ebp + 0x1f88]
pop esi
call fcn.004140e5
add ebp, 0x1f8c
leave
ret 4

Function at 0x40a86f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x4146e4
call fcn.00414440
sub esp, 0x214
mov eax, dword [0x418890]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
mov dword [ebp - 0x214], esi
push 0x2001f
push dword [ebp + 8]
lea ecx, [ebp - 0x214]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.00409c43
cmp eax, esi
jne 0x40a90e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40a8c8
lea eax, [ebp - 0x210]
push eax
call fcn.0040a86f
cmp eax, esi
jne 0x40a90d
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x214]
je 0x40a8b8
call fcn.00409bde
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.00409bde
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004140e5
leave
ret 4
Function at 0x40cb44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x414810
call fcn.00414440
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
push 2
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
call fcn.0040b4e2
mov esi, eax
cmp esi, edi
mov dword [ebp - 0x14], esi
jne 0x40cba0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x40cb8b
call esi
mov esi, eax
jmp 0x40ccb9
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x40ccb9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, edi
je 0x40cbc1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, edi
jne 0x40cbe9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x40cbd4
call esi
jmp 0x40ccae
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x40ccb0
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x40cc57
lea edi, [ebx + 1]
cmp edi, 0x400
ja 0x40cc24
push edi
call fcn.00409ae5
test al, al
je 0x40cc24
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.004144d0
mov dword [ebp + 8], esp
jmp 0x40cc30
push edi
lea ecx, [ebp - 0x10]
call fcn.0040b4bf
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40cc3e
mov esi, 0x8007000e
jmp 0x40ccb0
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov byte [eax + ebx], 0
test edi, edi
jne 0x40cc5f
xor eax, eax
jmp 0x40cca2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea ebx, [esi + esi]
cmp ebx, 0x400
ja 0x40cc8f
push ebx
call fcn.00409ae5
test al, al
je 0x40cc8f
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.004144d0
mov eax, esp
jmp 0x40cc98
push ebx
lea ecx, [ebp - 0x10]
call fcn.0040b4bf
push 0
push esi
push edi
push eax
call fcn.00409b40
push dword [ebp + 0x14]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0040c13e
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x10]
call fcn.0040a6d4
mov eax, esi
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x411161
Capabilities:
Delete file

Disassembly:
mov eax, 0x4149fd
call fcn.00414440
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov eax, dword [esi + 0x4c]
test eax, eax
mov dword [ebp - 4], 2
je 0x410e41
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 0x74]
test eax, eax
je 0x410e4f
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [esi + 0x8c]
cmp dword [eax], 0
je 0x410e62
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x50]
test eax, eax
je 0x410e7b
push dword [eax + 0x20]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [esi + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
mov eax, dword [esi + 0x70]
test eax, eax
je 0x410e89
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esi + 0x78]
test eax, eax
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
je 0x410e99
push eax
call ebx
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x410ea3
push eax
call ebx
mov eax, dword [esi + 0x80]
test eax, eax
je 0x410eb0
push eax
call ebx
mov eax, dword [esi + 0x84]
test eax, eax
je 0x410ebd
push eax
call ebx
lea edi, [esi + 0x88]
mov eax, dword [edi]
test eax, eax
je 0x410ed4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [edi]
call ebx
mov ecx, esi
call fcn.00409347
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 1
call fcn.0041044c
lea ecx, [esi + 0x54]
call fcn.0040d6f1
lea ecx, [esi + 0x24]
call fcn.00409b77
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push esi
mov esi, ecx
push 0x41898c
mov dword [esi], 0x402534
mov dword [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, esi
pop esi
jmp 0x410e19
Function at 0x411c3c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push edi
lea ebx, [ecx + eax + 0x18]
jbe 0x411d1e
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x411cb9
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x411d09
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push edi
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x411d28
mov edx, dword [ebx - 4]
add edx, dword [ebp - 4]
mov ecx, edi
mov dword [ebx - 8], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x411d09
mov ecx, dword [ebx + 4]
add ecx, eax
mov eax, dword [ebp + 0xc]
push ecx
call fcn.00411c24
test eax, eax
je 0x411d28
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push dword [ebx]
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x411d28
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
add eax, dword [ebp - 4]
mov esi, dword [ebx + 4]
add esi, dword [ebp + 8]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov dword [ebx - 8], eax
mov eax, dword [esi]
movzx eax, word [eax + 6]
inc dword [ebp - 8]
add ebx, 0x28
cmp dword [ebp - 8], eax
jl 0x411c69
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x411d21
Function at 0x413b1f
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x418890]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
push 0xf0000000
push 0x18
push 0x4028a0
xor ebx, ebx
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x30], cl
mov byte [ebp - 0x2f], 2
mov word [ebp - 0x2e], bx
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
lea edi, [ebp - 0x24]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x413c0c
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
xor edi, edi
test eax, eax
je 0x413c00
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea eax, [ebp - 0x34]
push eax
push 4
push dword [ebp + 0xc]
inc edi
mov dword [ebp - 0x34], edi
call esi
test eax, eax
jne 0x413bae
xor edi, edi
jmp 0x413bf7
push ebx
lea eax, [ebp - 0x34]
push eax
push 3
push dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
call esi
test eax, eax
je 0x413baa
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::size_void_const]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::data_void_const]
push eax
push ebx
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x413baa
push dword [ebp - 0x38]
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004140e5
leave
ret 8
Function at 0x413c1b
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x418890]
push esi
push 0xf0000000
xor esi, esi
push 0x18
push esi
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x42c]
push eax
mov dword [ebp - 0x434], 0x20
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x428], esi
mov byte [ebp - 0x24], 0xf6
mov byte [ebp - 0x23], 0xeb
mov byte [ebp - 0x22], 0x4b
mov byte [ebp - 0x21], 0xcd
mov byte [ebp - 0x20], 0xcc
mov byte [ebp - 0x1f], 0x25
mov byte [ebp - 0x1e], 0xe
mov byte [ebp - 0x1d], 0x54
mov byte [ebp - 0x1c], 0x58
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x1f
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0xa
mov byte [ebp - 0x17], 0x85
mov byte [ebp - 0x16], 0x56
mov byte [ebp - 0x15], 0xe6
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0xc2
mov byte [ebp - 0x12], 0x92
mov byte [ebp - 0x11], 0x82
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xf], 0xc6
mov byte [ebp - 0xe], 0xb9
mov byte [ebp - 0xd], 0xab
mov byte [ebp - 0xc], 0xf4
mov byte [ebp - 0xb], 0x83
mov byte [ebp - 0xa], 0xf7
mov byte [ebp - 9], 0x21
mov byte [ebp - 8], 1
mov byte [ebp - 7], 0x26
mov byte [ebp - 6], 0x54
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x413dca
push ebx
push edi
lea eax, [ebp - 0x428]
push eax
push esi
push esi
push 0x800c
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x413d06
xor edi, edi
jmp 0x413db9
mov edi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push esi
push 0x1f
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x428]
call edi
test eax, eax
jne 0x413d26
xor edi, edi
jmp 0x413dad
push 0x40290c
push dword [ebp + 8]
mov dword [ebp - 0x430], esi
call dword [sym.imp.msvcrt.dll__wfopen]
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
je 0x413d8d
push ebx
push 0x400
lea eax, [ebp - 0x424]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, esi
jbe 0x413d85
add dword [ebp - 0x430], eax
push esi
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x428]
call edi
test eax, eax
je 0x413dd7
cmp dword [ebp - 0x430], 0xc00
jb 0x413d42
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
push esi
lea eax, [ebp - 0x434]
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
xor edi, edi
test eax, eax
je 0x413dad
inc edi
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.004140e5
leave
ret 8
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
xor eax, eax
jmp 0x413dc8
Function at 0x4140e5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x418890]
jne 0x4140ee
ret
jmp 0x4140f3
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x418890]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x418a34]
test eax, eax
je 0x414117
call eax
cmp dword [0x418a38], 0
je 0x41415e
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x418a38]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.004140e5
add ebp, 0x2a8
leave
ret

Function at 0x455612
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x455621
pop dword [ebp - 0x20]
mov eax, 0x704c8e0
sub eax, 0x6bf72bf
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xe7ca4659
add dword [ebp - 0x30], 0x6687fef2
mov dword [ebp - 0x2c], 0xf9e04624
sub dword [ebp - 0x2c], 0xc7acf9df
mov dword [ebp - 0x28], 0x4db35d0b
add dword [ebp - 0x28], 0xfe98e723
mov dword [ebp - 0x24], 0xa7a28422
add dword [ebp - 0x24], 0x585d7bde
lea eax, [ebp - 0x30]
push eax
mov eax, 0x278d574b
add eax, 0xd8b85919
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x43839347
sub dword [ebp - 0x30], 0xcf1129f1
mov dword [ebp - 0x2c], 0x2f7d0a59
sub dword [ebp - 0x2c], 0xee10a8e4
mov dword [ebp - 0x28], 0x8eb1518a
add dword [ebp - 0x28], 0xd4be1ae2
mov dword [ebp - 0x24], 0x43066906
add dword [ebp - 0x24], 0xbcf996fa
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x50d1c
push 0
call eax
mov ecx, 0xd99877f8
sub ecx, 0xd9982227
mov edi, eax
mov ebx, 0x476000
add ebx, dword [ebp - 0x20]
mov edx, 0x2bdea7f5
add edx, 0xbe44ba82
xor dword [ebp - 0xc], edi
mov esi, dword [ebx]
add dword [ebp - 0x10], 0x38abbab0
xor esi, edx
sub dword [ebp - 8], ecx
mov dword [edi], esi
sub dword [ebp - 0x14], 0xd86ddfdc
add edi, 4
add ebx, 4
loop 0x455738
add eax, 0x80ad4890
add eax, 0x7f540187
xor ebx, ebx
add ebx, eax
add eax, 0xfd447616
add eax, 0x2bb89ef
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040c272
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040c272
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040c272
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040c272
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040c272
mov dword [0x41203c], eax
call fcn.0040c272
test eax, eax
jge 0x402550
push 8
call fcn.0040c272
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040c272
pop ecx
push 1
call fcn.0040c272
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040c272
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040c272
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040c272
jmp 0x402495

Function at 0x40c272
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40c281
pop dword [ebp - 0x44]
mov eax, 0xaf7725a4
sub eax, 0xaf366323
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3b52a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x384ee5bf
sub ecx, 0x384e96a5
xor esi, esi
add esi, eax
mov edx, 0xc89281d3
add edx, 0x37aeb9f1
add edx, dword [ebp - 0x44]
mov edi, 0x2f3b68b5
add edi, 0x79b359e6
add dword [ebp - 0x18], ebx
mov ebx, dword [edx]
xor dword [ebp - 0x34], eax
add ebx, edi
xor dword [ebp - 0x34], 0xda4582bc
mov dword [esi], ebx
add dword [ebp - 0x10], edi
add esi, 0xce835b06
add esi, 0x317ca4fe
add edx, 0xcfc42b91
add edx, 0x303bd473
loop 0x40c2dd
add eax, 0xa6dbdec9
add eax, 0x59255072
mov ebx, eax
add eax, 0xc6279976
add eax, 0x39d8668f
mov ecx, 0x728695f0
sub ecx, 0x724695f0
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x407004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x403c44
push str.Java.dll
lea eax, [ebp - 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401059
mov ecx, dword [ebp - 8]
push ecx
push 0x2400
push 1
push 0x403d68
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040146b
mov esp, ebp
pop ebp
ret

Function at 0x4011d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x401070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x401c70
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401caf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401caf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401caf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401caf
cmp dword [ecx + 0x74], 0xe
jbe 0x401caf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4018c8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401907
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401907
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401907
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401907
cmp dword [ecx + 0x74], 0xe
jbe 0x401907
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret