joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3c344a6d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1c791efd
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x4552b4]
shl eax, 2
mov dword [0x4552b8], eax
push edi
push ecx
xor eax, eax
mov edi, 0x45aa04
mov ecx, 0x45eaf0
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004462ec
pop edx
call fcn.00446250
call fcn.0044632c
push 0
call fcn.004476d8
pop ecx
push 0x45527c
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4552bc], eax
push 0
jmp fcn.0044f80c
Function at 0x4437f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x457200]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x443888
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x443868
xor eax, eax
push ebp
push 0x443861
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4438a4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443868
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x457200]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x457200], ax
mov esp, ebp
pop ebp
ret
Function at 0x445630
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4457e8
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x445691
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x445804
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4456fe
xor eax, eax
push ebp
push 0x4456f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4456e0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x445824
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4456fe
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4457df
cmp byte [ebp - 0xd], 0
jne 0x445740
cmp byte [ebp - 0x12], 0
je 0x4457df
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x445759
dec ebx
cmp byte [ebx], 0x2e
je 0x445768
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x445758
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4457df
inc ebx
cmp byte [ebp - 0x12], 0
je 0x445795
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4457df
cmp byte [ebp - 0xd], 0
je 0x4457df
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4457df
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445ba8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x445c90
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x45b17c], 1
jae 0x445c82
xor eax, eax
mov dword [0x45ad88], eax
xor eax, eax
mov dword [0x45ad90], eax
xor eax, eax
mov dword [0x45ad94], eax
mov byte [0x45ad9a], 2
mov byte [0x45ad9b], 2
mov byte [0x45ad9c], 3
mov word [0x45b144], 0
mov word [0x45b154], 1
mov word [0x45b164], 0xa
mov dword [0x45b16c], 0x80020004
mov dword [0x45b138], 0x444f84
mov dword [0x45b13c], 0x444f7c
mov dword [0x45b140], 0x444f84
call fcn.004437c0
test al, al
je 0x445c41
call fcn.004437f0
call fcn.004438b4
mov eax, 0x45ada0
mov edx, 0x445c9c
call fcn.004410d6
mov eax, 0x45af6c
mov edx, 0x445c9c
call fcn.004410d6
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x45ad80], eax
call fcn.0044203c
mov dword [0x45ad7c], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x45ad74], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445c97
ret

Function at 0x447968
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x447984
call fcn.00448b48
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4479a0
test bl, 1
je 0x4479a0
call fcn.0044ed50
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x55942f]
shl eax, 2
mov dword [0x559433], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.005357f4
pop edx
call fcn.00535758
call fcn.00535834
push 0
call fcn.00536ba8
pop ecx
push 0x5593d8
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x559437], eax
push 0
jmp fcn.0053f9bc

Function at 0x4017a4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa6c
push ebx
push esi
mov bx, 2
lea eax, [ebp - 0x594]
push eax
push ebx
call sub.WSOCK32.DLL_WSAStartup
push 0x400
lea edx, [ebp - 0x404]
push edx
call sub.WSOCK32.DLL_gethostname
test eax, eax
jne 0x40182b
lea ecx, [ebp - 0x404]
push ecx
call sub.WSOCK32.DLL_gethostbyname
xor esi, esi
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov dword [ebp - 4], ecx
jmp 0x401815
cmp word [eax + 0xa], 4
jne 0x401810
xor edx, edx
mov ecx, dword [ebp - 4]
jmp 0x401808
mov ebx, dword [eax + 0xc]
mov ebx, dword [ebx + esi*4]
mov bl, byte [ebx + edx]
inc edx
mov byte [ecx], bl
inc ecx
movsx ebx, word [eax + 0xa]
cmp edx, ebx
jl 0x4017fb
inc esi
add dword [ebp - 4], 4
test eax, eax
je 0x401822
mov edx, dword [eax + 0xc]
cmp dword [edx + esi*4], 0
jne 0x4017ed
call sub.WSOCK32.DLL_WSACleanup
mov eax, esi
jmp 0x401832
call sub.WSOCK32.DLL_WSACleanup
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404cf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ecx, ecx
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ebx, eax
cmp esi, ecx
mov edi, dword [ebp + 0x14]
jle 0x404d20
mov eax, ecx
inc ecx
cdq
idiv dword [ebp + 0x18]
mov al, byte [edi + edx]
xor byte [ebx], al
inc ebx
cmp esi, ecx
jg 0x404d0f
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x406c32
Capabilities:
Encode data using xor

Disassembly:
inc ebp
shr byte [edx + 0x14], 0x6a
xor byte [ebx - 0x17adf3ab], cl
pop es
out dx, eax
adc al, byte [eax]
add esp, 0xc
lea ecx, [ebp - 0x54]
push 0x14
push 0
push ecx
call fcn.00535b48
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x14
push 0
push eax
call fcn.00535b48
add esp, 0xc
mov dl, 1
mov eax, dword [0x51ef78]
call fcn.00406edc
mov dword [ebp - 0x38], eax
xor edx, edx
mov dword [ebp - 0x3c], edx
mov ecx, dword [ebp - 0x3c]
push ecx
mov eax, dword [ebp - 0x38]
push eax
call fcn.004067f4
add esp, 8
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 2
jge 0x406cca
mov dword [ebp - 0x3c], 1
mov ecx, dword [ebp - 0x3c]
push ecx
mov eax, dword [ebp - 0x38]
push eax
call fcn.004067f4
add esp, 8
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 2
jge 0x406cca
xor eax, eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
jmp 0x406ed4
mov word [ebp - 0x24], 0x14
xor ecx, ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
inc dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 4], 0
je 0x406cf0
mov eax, dword [ebp - 4]
jmp 0x406cf5
mov eax, 0x56777f
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
lea esi, [ebp - 0x54]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 2
and ecx, 3
lea eax, [ebp - 4]
rep movsb byte es:[edi], byte [esi]
dec dword [ebp - 0x18]
call fcn.00543cd4
mov word [ebp - 0x24], 0x20
xor ecx, ecx
mov dword [ebp - 8], ecx
lea ecx, [ebp - 8]
inc dword [ebp - 0x18]
mov edx, 1
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 8], 0
je 0x406d50
mov eax, dword [ebp - 8]
jmp 0x406d55
mov eax, 0x567780
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
lea esi, [ebp - 0x68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 2
and ecx, 3
lea eax, [ebp - 8]
rep movsb byte es:[edi], byte [esi]
dec dword [ebp - 0x18]
call fcn.00543cd4
lea ecx, [ebp - 0x54]
push ecx
call fcn.00535c7c
pop ecx
mov edx, eax
cmp edx, 0x14
jle 0x406d9d
mov edx, 0x14
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov esi, ecx
lea ecx, [ebp - 0x54]
cmp edx, eax
jle 0x406db6
mov bl, byte [ecx]
mov byte [esi], bl
inc eax
inc esi
inc ecx
cmp edx, eax
jg 0x406dab
lea eax, [ebp - 0x68]
push eax
call fcn.00535c7c
pop ecx
mov edx, eax
cmp edx, 0x14
jle 0x406dcc
mov edx, 0x14
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov esi, ecx
lea ecx, [ebp - 0x68]
cmp edx, eax
jle 0x406de5
Function at 0x427704
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push 0x74
mov eax, dword [ebp + 8]
add eax, 0x1d28
push eax
lea edx, [ebp - 0x78]
push edx
call fcn.00535ad8
add esp, 0xc
mov eax, dword [ebp - 0x24]
sub eax, 0x3e8
xor ebx, ebx
add eax, 0x3e8
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, 0x400ffe
mov ecx, dword [edx + 0x1d6c]
add ecx, eax
imul eax, ebx, 0x10524
add ecx, eax
mov eax, ecx
xor ecx, ecx
add eax, 2
xor edx, edx
xor ecx, dword [eax]
inc edx
add eax, 4
cmp edx, 0x4149
jl 0x427755
mov edx, dword [ebp - 4]
mov dword [edx], ecx
inc ebx
add dword [ebp - 4], 4
cmp ebx, 0xa
jl 0x427734
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4277b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [ebp + 8]
mov ebx, 0x400ff7
push dword [eax + 0xb0]
pop edx
mov eax, dword [ebp + 0xc]
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 4], edx
mov ecx, 0x12b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x100]
cdq
idiv ecx
mov ecx, 0x18ffe
add ebx, edx
add ecx, 2
mov eax, ecx
imul dword [ebp - 4]
add eax, 9
xor edx, edx
add ebx, eax
mov eax, ebx
xor ebx, ebx
shr ecx, 2
cmp ecx, edx
jle 0x427813
xor ebx, dword [eax]
inc edx
add eax, 4
cmp ecx, edx
jg 0x427809
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x12c]
mov edx, dword [ebp - 4]
cld

Function at 0x42968c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 0xc]
cmp ecx, edx
jle 0x4296a4
xor byte [eax], 0x63
inc edx
inc eax
cmp ecx, edx
jg 0x42969b
pop ebp
ret
Function at 0x4382f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
mov eax, 0x4f1a6c
push ebx
push esi
push edi
call fcn.004ee8cf
mov edx, dword [ebp + 8]
cmp byte [edx + 0xc99c94], 0
je 0x43831e
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xc99ca9], 0
jne 0x43832f
xor eax, eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x43841e
xor ebx, ebx
mov eax, dword [ebp + 8]
add eax, 0xc99c94
lea edx, [ebp - 0x4c]
mov cl, byte [eax]
inc ebx
xor cl, byte [eax + 0x3f]
inc eax
mov byte [edx], cl
inc edx
cmp ebx, 0x14
jl 0x43833c
xor esi, esi
xor ebx, ebx
lea edi, [ebp - 0x4c]
movsx eax, byte [edi]
mov dword [ebp - 0x50], eax
fild dword [ebp - 0x50]
add esp, 0xfffffff8
fstp qword [esp]
call fcn.004f4f47
add esp, 8
mov dword [ebp - 0x54], ebx
fild dword [ebp - 0x54]
fmulp st(1)
mov dword [ebp - 0x58], esi
fild dword [ebp - 0x58]
faddp st(1)
call fcn.004f4f6f
mov esi, eax
inc ebx
inc edi
cmp ebx, 0x14
jl 0x438352
add esi, 0xb46f
xor ebx, ebx
lea edx, [ebp - 0x34]
mov eax, dword [ebp + 8]
add eax, 0xc99ca9
mov cl, byte [eax]
inc eax
add cl, 0xe7
inc ebx
mov byte [edx], cl
inc edx
cmp ebx, 5
jl 0x43839a
mov byte [ebp - 0x2f], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0xc99c7c], esi
lea eax, [ebp - 8]
mov edx, esi
call fcn.004fc397
push eax
lea eax, [ebp - 4]
inc dword [ebp - 0x10]
lea edx, [ebp - 0x34]
mov word [ebp - 0x1c], 8
call fcn.004fc207
inc dword [ebp - 0x10]
pop edx
call fcn.004fc56f
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004fc48b
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004fc48b
pop eax
test al, al
je 0x438412
mov al, 1
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x43841e
xor eax, eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x457770
Capabilities:
Encode data using xor

Disassembly:
add eax, dword [eax]
mov eax, dword [esi]
cmp dword [eax + 0x24], 0
jle 0x457733
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [esi]
movzx eax, byte [eax + 0x18]
lea eax, [eax + eax*4]
mov eax, dword [eax*4 + 0x4f62f0]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.00470a39
push eax
call fcn.00495c31
mov eax, dword [esi]
cmp dword [eax + 0x38], 0
jle 0x457764
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [esi]
movzx eax, byte [eax + 0x18]
lea eax, [eax + eax*4]
mov eax, dword [eax*4 + 0x4f62f4]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.00470a39
push eax
call fcn.00495c31
mov eax, dword [esi]
cmp dword [eax + 0x30], 0
jle 0x457795
push 0
mov eax, dword [esi]
push ebp
mov ebp, esp
push esi
xor ecx, ecx
mov esi, dword [ebp + 8]
xor edx, edx
lea eax, [esi + 0xa54]
xor cl, byte [eax]
inc edx
inc eax
cmp edx, 0x1e
jl 0x457781
cmp cl, byte [esi + 0xa72]
jne 0x457797
mov al, 1
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x45b2f4
Capabilities:
Encode data using xor

Disassembly:
ror byte [ebp - 0xab6b], 0xff
mov dword [ebp - 0x84], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x708]
mov esi, edx
lea edx, [ebp - 0x98]
mov ecx, eax
invalid
Function at 0x48390c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
mov eax, 0x56cee0
push ebx
push esi
push edi
mov ebx, 0x567405
mov esi, dword [ebp + 8]
call fcn.00535f7c
mov word [ebp - 0x38], 8
xor edx, edx
lea eax, [ebx + 0x1202]
mov dword [ebp - 4], edx
lea edx, [ebp - 0x164]
inc dword [ebp - 0x2c]
mov word [ebp - 0x38], 0x14
mov ecx, dword [esi + 0x3e4]
push ecx
push eax
push edx
call fcn.005392b8
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x150]
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea eax, [ebx + 0x1205]
push eax
lea edx, [ebp - 0x150]
push edx
call fcn.00535bec
add esp, 8
lea ecx, [ebp - 0x164]
push ecx
lea eax, [ebp - 0x150]
push eax
call fcn.00535bec
add esp, 8
lea edx, [ebx + 0x1212]
push edx
lea ecx, [ebp - 0x150]
push ecx
call fcn.00535bec
add esp, 8
lea eax, [ebx + 0x1217]
push eax
lea edx, [ebp - 0x150]
push edx
call fcn.00535bec
mov word [ebp - 0x38], 0x20
add esp, 8
lea edx, [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.00543bd8
mov edx, eax
inc dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00543d04
dec dword [ebp - 0x2c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00543cd4
mov dl, 1
mov eax, dword [0x51ef78]
call fcn.00406edc
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0xc]
mov word [ebp - 0x38], 0x2c
mov word [ebp - 0x38], 0x38
lea edx, [ebx + 0x121d]
call fcn.00543bd8
inc dword [ebp - 0x2c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
dec dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00543cd4
mov word [ebp - 0x38], 0x44
lea edx, [ebx + 0x121f]
lea eax, [ebp - 0x10]
call fcn.00543bd8
inc dword [ebp - 0x2c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
dec dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
Function at 0x4841b4
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7b4
mov eax, 0x56d024
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
call fcn.00535f7c
push 0x400
push 0
lea edx, [ebp - 0x444]
push edx
call fcn.00535b48
add esp, 0xc
lea ecx, [ebp - 0x844]
push 0x400
push 0
push ecx
call fcn.00535b48
add esp, 0xc
mov eax, dword [ebp - 0x3c]
shl eax, 3
mov edx, edi
shl edx, 2
add eax, edx
mov dword [ebp - 0x848], eax
fild dword [ebp - 0x848]
mov dword [ebp - 0x84c], ebx
fild dword [ebp - 0x84c]
fmul qword [0x4844ec]
faddp st(1)
call fcn.0053cc58
mov dword [ebp - 0x38], eax
shl edi, 3
mov edx, dword [ebp - 0x40]
shl edx, 2
add edi, edx
lea eax, [ebx + ebx*2]
add edi, eax
mov dword [ebp - 0x3c], edi
mov edi, dword [ebp - 0x40]
shl edi, 3
mov edx, dword [ebp - 0x44]
shl edx, 2
add edi, edx
add edi, eax
mov ecx, dword [ebp - 0x44]
shl ecx, 3
mov edx, ebx
shl edx, 2
add ecx, edx
add ecx, eax
mov dword [ebp - 0x40], ecx
mov ecx, ebx
shl ecx, 3
mov edx, dword [ebp - 0x3c]
shl edx, 2
add ecx, edx
add ecx, eax
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x38]
shl ecx, 3
mov edx, edi
shl edx, 2
add ecx, edx
add ecx, eax
mov ebx, ecx
mov dword [esi + 0x1e08], 0xffffffff
cmp byte [esi + 0x65d], 1
jne 0x48439b
lea eax, [ebp - 0x444]
push eax
push esi
call fcn.004beb24
add esp, 8
cmp eax, 0xffffffff
jne 0x484306
mov word [ebp - 0x20], 8
mov edx, 0x56862b
lea eax, [ebp - 4]
call fcn.00543bd8
inc dword [ebp - 0x14]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00543d04
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x14
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x14]
call fcn.00543cd4
pop eax
mov word [ebp - 0x20], 8
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x4844e2
cmp eax, 0xfffffffe
jne 0x48435f
mov word [ebp - 0x20], 0x20
mov edx, 0x56862c
lea eax, [ebp - 8]
call fcn.00543bd8
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.00543d04
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x2c
add byte [eax - 0x73], dl
inc ebp
clc
test eax, eax
jne 0x48436c
mov byte [esi + 0x65d], 0
jmp 0x48439b
xor ebx, ebx
lea ecx, [ebp - 0x444]
movsx edi, byte [ecx]
mov eax, edi
mov edi, 9
xor eax, ebx
inc ebx
cdq
idiv edi
mov eax, edx
add eax, 0x30
mov byte [ecx], al
inc ecx
mov dword [esi + 0x1e08], 0x64
cmp ebx, 0x14
jl 0x484374
cmp byte [esi + 0x65d], 0
jne 0x484480
lea edx, [ebp - 0x844]
push 0x400
push edx
push 0
lea ecx, [ebp - 0x34]
push 0
push ecx
lea eax, [ebp - 0x444]
jmp [eax]
add al, 0
add byte [eax + 0x68], dl
sub eax, 0xe8005686
hlt
inc edx
or eax, 0x886c700
push ds
add byte [eax], al
add byte fs:[eax], al
add byte [ebx - 0x2dcc33bb], cl

Function at 0x4ae04c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov edx, dword [ebp + 0xc]
mov ecx, eax
inc eax
shl ecx, 2
push ecx
mov cl, 0x64
pop ebx
sub cl, bl
xor byte [edx], cl
inc edx
cmp eax, 0x28
jl 0x4ae055
pop ebx
pop ebp
ret
Function at 0x4b10c4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x56d190
push ebx
call fcn.00535f7c
mov dword [ebp - 8], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.00543c10
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
mov eax, dword [ebp + 0xc]
call fcn.00543bd0
mov ebx, eax
test bl, bl
jne 0x4b1123
push 0x80
cmp dword [ebp + 0xc], 0
je 0x4b110e
mov eax, dword [ebp + 0xc]
jmp 0x4b1113
mov eax, 0x568638
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp + 0xc]
call fcn.00543bd0
mov ebx, eax
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp + 0xc]
dec dword [ebp - 8]
call fcn.00543cd4
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret