joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004d413
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x100b4bb8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1004d459
cmp word [ebx], dx
jne 0x1004d459
or byte [eax + edi + 0x28], 4
jmp 0x1004d45e
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1004d5c1
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1004d5a1
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1004d49f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1004d4d5
cmp eax, edx
jae 0x1004d4e3
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1004d47a
jmp 0x1004d5c1
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1004d59c
cmp dword [ebp - 0x18], 0
je 0x1004d59c
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x100b4bb8]
test byte [eax + edi + 0x28], 0x48
je 0x1004d572
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1004d536
mov word [esi], cx
jmp 0x1004d56d
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x100b4bb8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x100b4bb8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x100b4bb8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1004d5c1
pop eax
cmp word [ebp - 4], ax
jne 0x1004d582
cmp esi, ebx
jne 0x1004d582
mov word [esi], ax
jmp 0x1004d5be
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1004d268
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1004d5c1
push 0xd
pop eax
jmp 0x1004d57d
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x100b4bb8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1004d5bb
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1004d5c1
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100500e6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10050183
push ebx
push esi
call fcn.100500af
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1004a3f9
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10050130
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10050182
push edi
push eax
call fcn.1004a31b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10050150
call fcn.1004987a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10050181
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1004a3f9
add esp, 0x20
test eax, eax
jne 0x1005016f
push edi
call fcn.1004987a
jmp 0x10050177
push ebx
call fcn.1004987a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10052a3a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10046d09
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10052aa9
cmp esi, dword [ebp - 4]
je 0x10052aa4
cmp dword [ebp + 0xc], 0
je 0x10052aa4
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10052a81
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1005258c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10052aab
xor eax, eax
inc eax
jmp 0x10052aab
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10052b10
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005b080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10046d09
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10046d09
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10052b87
cmp word [ecx], dx
je 0x10052b87
mov eax, dword [0x100bbfec]
push edi
dec eax
push eax
push 0x100bbed8
call fcn.10052aaf
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10052bfa
cmp word [eax], dx
je 0x10052bfa
mov eax, dword [edi]
test eax, eax
je 0x10052bab
cmp word [eax], dx
je 0x10052bab
lea eax, [ebp - 0x10]
push eax
call fcn.10052492
jmp 0x10052bb4
lea eax, [ebp - 0x10]
push eax
call fcn.1005252d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10052c24
mov eax, dword [0x100bbed4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x100bbbc8
call fcn.10052aaf
add esp, 0xc
test al, al
je 0x10052c24
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10052bef
cmp word [eax], di
je 0x10052bef
lea eax, [ebp - 0x10]
push eax
call fcn.10052492
pop ecx
jmp 0x10052c26
lea eax, [ebp - 0x10]
push eax
call fcn.1005252d
jmp 0x10052bec
mov eax, dword [edi]
test eax, eax
je 0x10052c11
cmp word [eax], dx
je 0x10052c11
lea eax, [ebp - 0x10]
push eax
call fcn.10052447
pop ecx
jmp 0x10052c24
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10052cef
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10052934
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10052cef
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10052cef
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10052cef
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10052c7c
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1004be39
test ebx, ebx
je 0x10052cea
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1004be39
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10052cef
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10052cef
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100562f5
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10052cf1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b541
leave
ret
Function at 0x10056511
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1005648d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10056680
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10056680
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10056635
jg 0x1005656d
test eax, eax
je 0x1005662b
push 1
push 0x1000
call fcn.10046942
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10056590
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10056622
push 0x8000
push ebx
call fcn.100563be
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100565b9
jg 0x100565b4
cmp ecx, 0x1000
jb 0x100565b9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10047a24
add esp, 0x10
cmp eax, 0xffffffff
je 0x100565fe
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100565b4
jl 0x100565e5
test ecx, ecx
jne 0x100565a6
push dword [ebp - 0xc]
push ebx
call fcn.100563be
push esi
call fcn.1004987a
add esp, 0xc
xor ebx, ebx
jmp 0x1005668e
cmp byte [edi + 0x24], 0
je 0x10056615
cmp dword [edi + 0x20], 5
jne 0x10056615
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10056620
mov ebx, dword [edi + 0x18]
jmp 0x10056622
xor ebx, ebx
push esi
call fcn.1004987a
pop ecx
jmp 0x1005668e
test ecx, ecx
jg 0x100565f7
jl 0x10056635
test eax, eax
jae 0x100565f7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1004d268
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10056655
cmp byte [edi + 0x1c], 0
je 0x100565f7
jmp 0x10056686
push ebx
call fcn.10050a74
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100565f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1005668e
cmp byte [edi + 0x1c], 0
je 0x1005668b
mov ebx, dword [edi + 0x18]
jmp 0x1005668e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1004d268
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10058080
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100580ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100580ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x3ad7258d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3ad7a064]
jne 0x3ad72597
repz ret
jmp fcn.3ad73d0c

Function at 0x3ad75a5b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x3ad75a6a
pop dword [ebp - 0x48]
mov eax, 0x37cf763f
sub eax, 0xfcf81bd5
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3bf26
push 0
mov eax, 0x9361351c
sub eax, 0x588a2468
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x5958
xor edi, edi
add edi, eax
mov ebx, 0xdc85def6
add ebx, 0x5e528f0a
add ebx, dword [ebp - 0x48]
mov edx, 0x4c58dab9
sub edx, 0x4dede17e
sub dword [ebp - 0x10], esi
mov esi, dword [ebx]
xor dword [ebp - 0x18], 0xf1ac9ef1
sub esi, edx
mov dword [edi], esi
xor dword [ebp - 0x20], ebx
add edi, 4
add ebx, 4
loop 0x3ad75ac5
add eax, 0x90c94704
add eax, 0x6f38112f
xor ebx, ebx
add ebx, eax
add eax, 0x7cf2ea6f
add eax, 0x830d1596
mov ecx, 0xb35b8b59
sub ecx, 0x78848b59
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x3ad779e2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.3ad72618
and dword [ebp - 4], 0
cmp dword [0x3ad7b5e8], 0
mov ebx, eax
jne 0x3ad77a93
push 0x3ad72234
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x3ad77b44
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x3ad72228
push edi
call esi
test eax, eax
je 0x3ad77b44
push eax
call fcn.3ad75a5b
mov dword [esp], 0x3ad72218
push edi
mov dword [0x3ad7b5e8], eax
call esi
push eax
call fcn.3ad75a5b
mov dword [esp], 0x3ad72204
push edi
mov dword [0x3ad7b5ec], eax
call esi
push eax
call fcn.3ad75a5b
mov dword [esp], 0x3ad721e8
push edi
mov dword [0x3ad7b5f0], eax
call esi
push eax
call fcn.3ad75a5b
pop ecx
mov dword [0x3ad7b5f8], eax
test eax, eax
je 0x3ad77a93
push 0x3ad721d0
push edi
call esi
push eax
call fcn.3ad75a5b
pop ecx
mov dword [0x3ad7b5f4], eax
mov eax, dword [0x3ad7b5f4]
cmp eax, ebx
je 0x3ad77aeb
cmp dword [0x3ad7b5f8], ebx
je 0x3ad77aeb
push eax
call fcn.3ad75a5b
push dword [0x3ad7b5f8]
mov esi, eax
call fcn.3ad75a5b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x3ad77aeb
test edi, edi
je 0x3ad77aeb
call esi
test eax, eax
je 0x3ad77ae2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x3ad77ae2
test byte [ebp - 0xc], 1
jne 0x3ad77aeb
or dword [ebp + 0x10], 0x200000
jmp 0x3ad77b24
mov eax, dword [0x3ad7b5ec]
cmp eax, ebx
je 0x3ad77b24
push eax
call fcn.3ad75a5b
pop ecx
test eax, eax
je 0x3ad77b24
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x3ad77b24
mov eax, dword [0x3ad7b5f0]
cmp eax, ebx
je 0x3ad77b24
push eax
call fcn.3ad75a5b
pop ecx
test eax, eax
je 0x3ad77b24
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x3ad7b5e8]
call fcn.3ad75a5b
pop ecx
test eax, eax
je 0x3ad77b44
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x3ad77b46
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406fc0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x406ffe
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x406ff6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407000
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x406fe6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4070d0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407101
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407101
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407101
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x412d80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UzBUtnck
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x412da2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412da9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412d98
mov eax, 1
add ebx, ebx
jne 0x412dbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412db0
jne 0x412dcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412db0
xor ecx, ecx
sub eax, 3
jb 0x412de0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x412e52
mov ebp, eax
add ebx, ebx
jne 0x412deb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412df8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x412e1c
inc ecx
add ebx, ebx
jne 0x412e08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x412dfd
jne 0x412e19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412dfd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x412e3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x412e2d
jmp 0x412d9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x412e3c
add edi, ecx
jmp 0x412d9e
pop esi
mov edi, esi
mov ecx, 0x2ad
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x412e5a
cmp byte [edi], 0
jne 0x412e5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x412e5f
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x412ece
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x120b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1211c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x412e8c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12124]
or eax, eax
je 0x412ec8
mov dword [ebx], eax
add ebx, 4
jmp 0x412ea9
call dword [esi + 0x12120]
mov ebp, dword [esi + 0x12128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x412f02
sub esp, 0xffffff80
jmp 0x406f9c

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401443
pop dword [ebp - 0x30]
mov eax, 0x401443
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x991e88d7
sub dword [ebp - 0x40], 0x4acc438c
mov dword [ebp - 0x3c], 0xff860ec6
add dword [ebp - 0x3c], 0x32ad3d7f
mov dword [ebp - 0x38], 0x590ba1
add dword [ebp - 0x38], 0x4bf3388d
mov dword [ebp - 0x34], 0x70834191
sub dword [ebp - 0x34], 0x70834191
lea eax, [ebp - 0x40]
push eax
mov eax, 0xf5d62395
add eax, 0xa6a5d6f
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xf4aed24e
add dword [ebp - 0x40], 0x7fc39708
mov dword [ebp - 0x3c], 0x4b997983
add dword [ebp - 0x3c], 0xf5d2e7f2
mov dword [ebp - 0x38], 0x5a871a0
add dword [ebp - 0x38], 0x5dc6facc
mov dword [ebp - 0x34], 0x73b914a6
sub dword [ebp - 0x34], 0x73b914a6
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xcef45b30
sub eax, 0xceb3da30
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3837a
push 0
call eax
mov ecx, 0xdc428142
add ecx, 0x23bdc673
mov edi, eax
mov esi, 0x5fe814f7
sub esi, 0x5fa130f7
add esi, dword [ebp - 0x30]
mov ebx, 0x33130518
add ebx, 0xfa999a34
add dword [ebp - 0x10], edi
mov edx, dword [esi]
mov dword [ebp - 0x2c], 0xa61098fa
xor edx, ebx
xor dword [ebp - 0x24], ebx
mov dword [edi], edx
add dword [ebp - 0xc], edi
add edi, 4
add esi, 0x1b64b28e
add esi, 0xe49b4d76
loop 0x401560
add eax, 0x111a7
mov ebx, eax
add eax, 0xbc1f9ac7
sub eax, 0xbc1f9ac2
mov ecx, 0x869e4d49
sub ecx, 0x865e4d49
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x401960
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004019c0
Function at 0x402360
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402398
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x40238e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x40239a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x402380
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x401c66
pop dword [ebp - 0x50]
mov eax, 0xb57256cb
add eax, 0x4acdc59b
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xb55c5402
sub dword [ebp - 0x60], 0x670a0eb7
mov dword [ebp - 0x5c], 0x78188675
add dword [ebp - 0x5c], 0xba1ac5d0
mov dword [ebp - 0x58], 0x8fdd3a6c
sub dword [ebp - 0x58], 0x4390f63e
mov dword [ebp - 0x54], 0x517c90c9
add dword [ebp - 0x54], 0xae836f37
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x8df8cb13
sub dword [ebp - 0x60], 0x198661bd
mov dword [ebp - 0x5c], 0x1f91fdf2
add dword [ebp - 0x5c], 0x21da6383
mov dword [ebp - 0x58], 0x9cf1e54d
sub dword [ebp - 0x58], 0x398278e1
mov dword [ebp - 0x54], 0x4e310df8
sub dword [ebp - 0x54], 0x4e310df8
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x35932
push 0
call eax
mov ecx, 0x6fd4b6ee
add ecx, 0x902b8d72
mov esi, eax
mov edi, 0x2e271f4f
add edi, 0xd21950b1
add edi, dword [ebp - 0x50]
mov edx, 0xecbb1bc5
sub edx, 0xb4b175fb
sub dword [ebp - 0x28], esi
mov ebx, dword [edi]
add dword [ebp - 0xc], 0xdfd85b78
xor ebx, edx
mov dword [esi], ebx
sub dword [ebp - 0x44], esi
add esi, 4
add edi, 0x881b30a2
sub edi, 0x881b309e
loop 0x401d7e
add eax, 0x10453
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1cefe7fd
sub ecx, 0x1cafe7fd
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret