joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65a450
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x294], edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406ec4
lea eax, [ebp - 0x278]
mov edx, dword [0x46e9ac]
call fcn.004078ec
xor eax, eax
push ebp
push 0x65a6dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00479f18
mov eax, dword [ebp - 8]
call fcn.004717dc
test al, al
je 0x65a6a1
xor edx, edx
push ebp
push 0x65a697
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x27c]
mov ecx, 0x65a6f8
mov edx, dword [ebp - 8]
call fcn.004072b0
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.004719c0
test eax, eax
jne 0x65a685
mov eax, dword [ebp - 0x264]
mov edx, 0x65a70c
call fcn.00407528
je 0x65a667
mov eax, dword [ebp - 0x264]
mov edx, 0x65a71c
call fcn.00407528
je 0x65a667
mov eax, dword [ebp - 0x268]
mov edx, eax
or edx, 0x10
cmp edx, eax
jne 0x65a597
push dword [ebp - 8]
push dword [ebp - 0x264]
push 0x65a730
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.00407380
mov eax, dword [ebp - 0x280]
call fcn.0065a450
lea eax, [ebp - 0x284]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 8]
call fcn.004072b0
mov eax, dword [ebp - 0x284]
call fcn.00472130
jmp 0x65a667
lea eax, [ebp - 0x288]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 8]
call fcn.004072b0
mov eax, dword [ebp - 0x288]
call fcn.00406f68
push eax
call sub.KERNEL32.DLL_DeleteFileW
jmp 0x65a667
mov eax, dword [ebp - 0x264]
mov edx, 0x65a70c
call fcn.00407528
je 0x65a667
mov eax, dword [ebp - 0x264]
mov edx, 0x65a71c
call fcn.00407528
je 0x65a667
mov ebx, dword [ebp - 0x268]
mov eax, ebx
or eax, 0x10
cmp eax, ebx
jne 0x65a642
push dword [ebp - 8]
push dword [ebp - 0x264]
push 0x65a730
lea eax, [ebp - 0x28c]
mov edx, 3
call fcn.00407380
mov eax, dword [ebp - 0x28c]
call fcn.0065a450
lea eax, [ebp - 0x290]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 8]
call fcn.004072b0
mov eax, dword [ebp - 0x290]
call fcn.00472130
jmp 0x65a667
lea eax, [ebp - 0x294]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 8]
call fcn.004072b0
mov eax, dword [ebp - 0x294]
call fcn.00406f68
push eax
call sub.KERNEL32.DLL_DeleteFileW
lea eax, [ebp - 0x278]
call fcn.00471a10
test eax, eax
je 0x65a5c1
lea eax, [ebp - 0x278]
call fcn.00471a34
mov eax, dword [ebp - 4]
call fcn.00472130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65a6a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65a6e4
lea eax, [ebp - 0x294]
mov edx, 7
call fcn.00406ed4
lea eax, [ebp - 0x278]
mov edx, dword [0x46e9ac]
call fcn.004079c4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ed4
ret
Function at 0x65a734
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x65a7b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403d24
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x65a7d4
mov edx, ebx
call fcn.004072b0
mov eax, dword [ebp - 0x24]
call fcn.00406f68
mov dword [ebp - 0x16], eax
mov eax, 0x65a7d8
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x614
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65a7be
lea eax, [ebp - 0x24]
call fcn.00406ecc
ret
Function at 0x65b11c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
push esp
push 0xff
call sub.KERNEL32.DLL_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004070dc
add esp, 0x200
pop ebx
ret
Function at 0x65e068
Capabilities:
Check for time delay via gettickcount
Create process on windows
Create process suspended
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00406ec4
mov eax, dword [ebp - 8]
call fcn.00406ec4
xor eax, eax
push ebp
push 0x65e1ca
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00471794
test al, al
je 0x65e1a2
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00403d24
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
cmp byte [ebp + 8], 0
jne 0x65e0dd
mov word [ebp - 0x20], 0
jmp 0x65e0e3
mov word [ebp - 0x20], 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
call fcn.00471c9c
mov eax, dword [ebp - 0x64]
call fcn.00406f68
push eax
push 0
push 0
push 0
push 0
push 0
push 0x65e1e8
push dword [ebp - 4]
push 0x65e1f8
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00407380
mov eax, dword [ebp - 0x68]
call fcn.00406f68
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
je 0x65e1a2
call sub.KERNEL32.DLL_GetTickCount_1
mov edi, eax
mov esi, edi
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x640], 0
je 0x65e15b
push 0x65e200
call sub.KERNEL32.DLL_OutputDebugStringW
jmp 0x65e197
sub esi, edi
cmp esi, 0x2bf20
mov eax, dword [ebp - 0x60]
call fcn.0065e038
test al, al
jne 0x65e17b
push 0x65e25c
call sub.KERNEL32.DLL_OutputDebugStringW
jmp 0x65e197
push 0xa
call sub.KERNEL32.DLL_Sleep
mov eax, dword [0x67d250]
mov eax, dword [eax]
call fcn.0051c130
call sub.KERNEL32.DLL_GetTickCount_1
mov esi, eax
jmp 0x65e143
mov eax, dword [ebp - 0x60]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65e1d1
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00406ed4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ed4
ret
Function at 0x65e2bc
Capabilities:
Check for time delay via gettickcount
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x65e3d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403d24
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x140
push 0x65e3f0
push ebx
push 0x65e3f0
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00407380
mov eax, dword [ebp - 0x44]
call fcn.00406f68
mov dword [ebp - 0x30], eax
mov eax, esi
call fcn.00406f68
mov dword [ebp - 0x2c], eax
mov eax, 0x65e3f4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 1
xor eax, eax
push ebp
push 0x65e359
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65e363
call sub.KERNEL32.DLL_GetTickCount_1
mov esi, eax
mov ebx, esi
mov eax, dword [ebp - 4]
cmp byte [eax + 0x640], 0
je 0x65e384
push 0x65e400
call sub.KERNEL32.DLL_OutputDebugStringW
jmp 0x65e3c0
sub ebx, esi
cmp ebx, 0x2bf20
mov eax, dword [ebp - 8]
call fcn.0065e28c
test al, al
jne 0x65e3a4
push 0x65e45c
call sub.KERNEL32.DLL_OutputDebugStringW
jmp 0x65e3c0
push 0xa
call sub.KERNEL32.DLL_Sleep
mov eax, dword [0x67d250]
mov eax, dword [eax]
call fcn.0051c130
call sub.KERNEL32.DLL_GetTickCount_1
mov ebx, eax
jmp 0x65e36c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65e3dd
lea eax, [ebp - 0x44]
call fcn.00406ecc
ret

Function at 0x65e48c
Capabilities:
Check for time delay via gettickcount
Print debug messages

Disassembly:
push ebx
push esi
mov ebx, eax
call sub.KERNEL32.DLL_GetTickCount_1
mov esi, eax
cmp byte [ebx + 0x640], 0
je 0x65e4ad
push 0x65e510
call sub.KERNEL32.DLL_OutputDebugStringW
pop esi
pop ebx
ret
mov eax, dword [0x67ce4c]
cmp dword [eax], 0
je 0x65e4c4
push 0x65e55c
call sub.KERNEL32.DLL_OutputDebugStringW
pop esi
pop ebx
ret
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x6e8]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x65e4e8
cmp eax, 0x88b8
jbe 0x65e4f7
jmp 0x65e4ea
jle 0x65e4f7
push 0x65e590
call sub.KERNEL32.DLL_OutputDebugStringW
pop esi
pop ebx
ret
push 0xa
call sub.KERNEL32.DLL_Sleep
mov eax, dword [0x67d250]
mov eax, dword [eax]
call fcn.0051c130
jmp 0x65e490
Function at 0x6616b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00406ec4
xor eax, eax
push ebp
push 0x661762
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x661724
push dword fs:[edx]
mov dword fs:[edx], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406f68
mov ebx, eax
push ebx
push 0x661770
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x66171a
push 1
push 0
push ebx
push 0x66177c
push 0x661770
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x66174c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x661769
lea eax, [ebp - 4]
call fcn.00406ecc
ret

Function at 0x662e28
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x662f6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x57b914]
call fcn.0057c614
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x662f4e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x662e94
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax + 4]
lea eax, [ebp - 4]
mov ecx, 0x662f88
call fcn.004072b0
mov eax, dword [ebp - 4]
call fcn.0065a450
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x662e9e
xor eax, eax
push ebp
push 0x662ed1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax + 8]
lea eax, [ebp - 4]
mov ecx, 0x662f88
call fcn.004072b0
mov eax, dword [ebp - 4]
call fcn.0065a450
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x662edb
xor eax, eax
push ebp
push 0x662f2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x49f730]
call fcn.0049f9ec
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0049fa8c
mov edx, 0x662fd8
mov eax, ebx
call fcn.0049fdf0
test al, al
jne 0x662f1d
push 0x663028
call sub.KERNEL32.DLL_OutputDebugStringW
mov eax, ebx
call fcn.004047c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x662f38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x662f55
mov eax, dword [ebp - 8]
call fcn.004047c4
ret
Function at 0x413c40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 0x2c], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.004145e0
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
and esp, 0xfffffff0
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
leave
shl edx, 5
add eax, edx
ret
Function at 0x784560
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x290000]
push edi
or ebp, 0xffffffff
jmp 0x784582
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x784589
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x784578
mov eax, 1
add ebx, ebx
jne 0x78459b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7845ac
jne 0x7845bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7845bc
dec eax
add ebx, ebx
jne 0x7845b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x784590
xor ecx, ecx
sub eax, 3
jb 0x7845d4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x784646
sar eax, 1
mov ebp, eax
jmp 0x7845df
add ebx, ebx
jne 0x7845df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x7845ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x784610
inc ecx
add ebx, ebx
jne 0x7845fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7845f1
jne 0x78460d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7845f1
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x784630
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x784621
jmp 0x78457e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x784630
add edi, ecx
jmp 0x78457e
pop esi
mov edi, esi
mov ecx, 0xa710
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x78464e
cmp byte [edi], 0x1e
jne 0x78464e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x784653
lea edi, [esi + 0x380000]
mov eax, dword [edi]
or eax, eax
je 0x7846cb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3dfc98]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3dfe14]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x784680
mov ecx, edi
jns 0x7846af
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3dfe18]
or eax, eax
je 0x7846c5
mov dword [ebx], eax
add ebx, 4
jmp 0x78469d
call dword [esi + 0x3dfe1c]
popal
jmp 0x569c55
Function at 0x407e4f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433c50]
jne 0x407e59
repz ret
jmp fcn.0040c58d

Function at 0x40b2e0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406080
and dword [ebp - 4], 0
cmp dword [0x43d620], 0
mov ebx, eax
jne 0x40b391
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b442
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b442
push eax
call fcn.0040600e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43d620], eax
call esi
push eax
call fcn.0040600e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43d624], eax
call esi
push eax
call fcn.0040600e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43d628], eax
call esi
push eax
call fcn.0040600e
pop ecx
mov dword [0x43d630], eax
test eax, eax
je 0x40b391
push 0x42ff10
push edi
call esi
push eax
call fcn.0040600e
pop ecx
mov dword [0x43d62c], eax
mov eax, dword [0x43d62c]
cmp eax, ebx
je 0x40b3e9
cmp dword [0x43d630], ebx
je 0x40b3e9
push eax
call fcn.00406089
push dword [0x43d630]
mov esi, eax
call fcn.00406089
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b3e9
test edi, edi
je 0x40b3e9
call esi
test eax, eax
je 0x40b3e0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b3e0
test byte [ebp - 0xc], 1
jne 0x40b3e9
or dword [ebp + 0x10], 0x200000
jmp 0x40b422
mov eax, dword [0x43d624]
cmp eax, ebx
je 0x40b422
push eax
call fcn.00406089
pop ecx
test eax, eax
je 0x40b422
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b422
mov eax, dword [0x43d628]
cmp eax, ebx
je 0x40b422
push eax
call fcn.00406089
pop ecx
test eax, eax
je 0x40b422
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43d620]
call fcn.00406089
pop ecx
test eax, eax
je 0x40b442
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b444
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4086ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4086d9
pop dword [ebp - 0x44]
mov eax, 0x3942506
add eax, 0xfcac61d3
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x709ebec4
sub dword [ebp - 0x54], 0x224c7979
mov dword [ebp - 0x50], 0x90a92f6f
add dword [ebp - 0x50], 0xa18a1cd6
mov dword [ebp - 0x4c], 0x2487c0d7
sub dword [ebp - 0x4c], 0xd83b7ca9
mov dword [ebp - 0x48], 0x8a987352
add dword [ebp - 0x48], 0x75678cae
lea eax, [ebp - 0x54]
push eax
mov eax, 0x91bb6521
add eax, 0x6e856b33
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x3dc63a3b
sub dword [ebp - 0x54], 0xc953d0e5
mov dword [ebp - 0x50], 0x46787dec
sub dword [ebp - 0x50], 0x50c1c77
mov dword [ebp - 0x4c], 0x3784a642
sub dword [ebp - 0x4c], 0xd41539d6
mov dword [ebp - 0x48], 0x22ae6870
sub dword [ebp - 0x48], 0x22ae6870
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x21a91a5b
add eax, 0xde97b5f1
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3c6c1
push 0
call eax
mov ecx, 0x539c
xor edx, edx
add edx, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x44]
mov esi, 0xc3ba1056
xor dword [ebp - 0x2c], esi
mov ebx, dword [edi]
add dword [ebp - 0x34], edi
xor ebx, esi
sub dword [ebp - 0x38], 0xd6329e5c
mov dword [edx], ebx
add dword [ebp - 0x28], esi
add edx, 0x63d052e5
add edx, 0x9c2fad1f
add edi, 0x93681151
sub edi, 0x9368114d
loop 0x4087eb
add eax, 0x14143
xor ebx, ebx
add ebx, eax
add eax, 0x9f5781a0
sub eax, 0x9f57819b
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x1002195
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xf0
push 4
call fcn.010012b0
test eax, eax
pop ecx
je 0x10021b6
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_void___thiscall_CLASS_DESCRIPTOR::constructor_void_]
jmp 0x10021b8
xor eax, eax
test eax, eax
mov dword [0x1004004], eax
je 0x10021c9
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_CLASS_DESCRIPTOR::Initialize_void_]
lea ecx, [ebp - 0x78]
call fcn.010012ff
lea ecx, [ebp - 0x78]
call fcn.01001cd6
test al, al
je 0x10021ee
lea ecx, [ebp - 0x78]
call fcn.0100133e
test al, al
je 0x10021ee
push dword [ebp + 0x10]
jmp 0x10021f0
push 2
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x100026a3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060637
call fcn.10060010
sub esp, 0x1c
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x20], 0x696c
cmp dword [ebp - 0x20], 0x6d21
push edi
mov dword [ebp - 0x10], esp
jle 0x10002733
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x24], esi
xor ebx, ebx
sar esi, cl
xor edi, edi
mov eax, edi
mov ecx, 0x1007bf98
xor eax, ebx
or eax, esi
cdq
push edx
push eax
call fcn.10007154
inc edi
cmp edi, 0x7148
jl 0x100026de
inc ebx
cmp ebx, 0x25c1
jl 0x100026dc
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x15dd
jl 0x100026d3
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5954
jl 0x100026ce
push 0x14db
push 1
push 0x40c
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp byte [ebp - 0x14], 0
je 0x10002740
mov eax, dword [ebp + 8]
dec dword [eax]
jmp 0x10002763
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x10002763
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 8
inc dword [edx]
cmp dword [edx], 4
jl 0x10002751
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x694d
jge 0x1000277f
mov edx, str.sdvyxylfk_qszf_elg_ltecu_gigkerblo_iqlk_jcapeykz_rhqzbo_iepu
mov ecx, 0x1007bf98
call fcn.1000a079
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret