joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c6fc
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004095e8
xor eax, eax
push ebp
push 0x40c7bc
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040a0dc
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a28c
mov eax, dword [ebx]
call fcn.0040c5c4
test al, al
jne 0x40c799
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040a0dc
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a28c
mov eax, dword [ebx]
call fcn.0040c5c4
test al, al
jne 0x40c799
mov eax, ebx
call fcn.00409504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c7c3
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409564
lea eax, [ebp - 4]
call fcn.00409504
ret

Function at 0x40d08c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x41bb48
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41bba1
test eax, edx
je 0x41bba4
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41bb5f
movzx eax, word [eax]
sub eax, ecx
jmp 0x41bb86
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41bb87
add ecx, 4
js 0x41bb77
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41bb84
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41bb86
xor eax, eax
ret
test eax, eax
je 0x41bbb0
test edx, edx
jne 0x41bb50
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x41c9c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x41c9ed
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x4204ac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4204e5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040968c
jmp 0x4204ee
mov eax, ebx
mov edx, esi
call fcn.004098e4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4204f8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x42051a
movzx eax, word [esp]
jmp 0x42051c
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x421814
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x421939
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0042161c
mov esi, eax
mov eax, dword [0x4e6180]
cmp byte [eax], 0
je 0x4218e1
mov eax, dword [0x4e5fd0]
call fcn.004070ec
call fcn.00406b0c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4217e4]
call fcn.0040b2cc
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x421954
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x42191d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4e5f98]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4e9c50]
call fcn.0040b6bc
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421940
lea eax, [ebp - 4]
mov edx, dword [0x4217e4]
call fcn.0040b3f0
ret
Function at 0x4229b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x422ab0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040992c
lea eax, [ebp - 4]
call fcn.00409a84
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a020
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x422a9a
mov eax, ebx
call fcn.004069b8
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x422a93
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a020
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x422a7d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x422ac4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x422a7d
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422a9a
mov eax, dword [ebp - 0x10]
call fcn.004069d4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422ab7
lea eax, [ebp - 4]
call fcn.00409504
ret

Function at 0x4233ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004099d4
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040d06c
mov edi, eax
cmp edi, 0x104
jbe 0x423397
mov eax, edi
add eax, eax
call fcn.004069b8
mov esi, eax
jmp 0x423399
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040d06c
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4233d2
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4233bc
mov eax, esp
cmp esi, eax
je 0x4233df
mov eax, esi
call fcn.004069d4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x423418
cmp bl, 0
je 0x423414
cmp bl, 0x41
jl 0x42340f
cmp bl, 0x5a
jg 0x42340f
or bl, 0x20
xor al, bl
inc esi
jmp 0x4233f3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x423358

Function at 0x423c64
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040a0dc
add esp, 0x800
pop ebx
ret
Function at 0x431fac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x431ffe
test eax, edx
je 0x432001
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x431fc1
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x431fe7
add ecx, 4
js 0x431fd7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x431fe4
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x43200d
test edx, edx
jne 0x431fb4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x47b13c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x47b144
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4abb20
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4abbbe
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4abb82
cmp byte [ebx + 0x11], 0
jne 0x4abb82
cmp byte [ebx + 0x3c], 0
jne 0x4abb82
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4abba3
lea edx, [ebp - 4]
mov eax, dword [0x4e613c]
call fcn.0040cfd8
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x486ac4]
call fcn.00421964
call fcn.00408b44
jmp 0x4abba3
lea edx, [ebp - 8]
mov eax, dword [0x4e613c]
call fcn.0040cfd8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x486ac4]
call fcn.00421964
call fcn.00408b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4abbc5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409564
ret

Function at 0x4ac55c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4ac5aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004ab9a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac5c3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4ac5cc
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004ab9a0
dec esi
jne 0x4ac5ee
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4cfa0c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov dword [ebp - 4], eax
call 0x40f594
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x10]
mov eax, 4
call fcn.004cf654
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4cfad8
mov dword [ebp - 0x3c], 0x1c
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004cf674
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
jmp 0x4cfac9
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x10]
jne 0x4cfab3
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x20]
je 0x4cfab3
mov eax, dword [ebp - 0x34]
push eax
push 0
push 2
call dword [0x4ec454]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4cfab3
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_SuspendThread
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x4cfaaa
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.0049a248
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004cf698
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
jne 0x4cfa66
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x4cfae0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
cmp dword [ebp - 4], 0
je 0x4cfb52
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4cfb52
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0049a42c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4cfb4a
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0x10]
push eax
push 0
push 2
call dword [0x4ec454]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x4cfb4a
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x4cfb09
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x456320
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x456328
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4564f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40d398]
call fcn.00402e08
mov esi, eax
mov dword [ebp - 0x10], 1
mov ebx, 0x43
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00403cec
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x456510
call fcn.00403e10
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00403cec
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 0x45651c
call fcn.00403e10
mov eax, dword [ebp - 4]
call fcn.00403f88
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 3
jne 0x4564c5
mov eax, dword [0x45891c]
mov eax, dword [eax]
mov edx, 0x456528
call fcn.00403ed4
jne 0x456446
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00455e14
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x4564c5
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4564c5
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.00408aa8
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x456534
call fcn.00403e10
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0045670c
inc dword [ebp - 0x10]
mov eax, dword [0x4589e4]
mov eax, dword [eax]
call fcn.00445e28
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x4563f8
jmp 0x4564c5
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00455e14
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x4564c5
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4564c5
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00408aa8
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x456534
call fcn.00403e10
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00456570
inc dword [ebp - 0x10]
mov eax, dword [0x4589e4]
mov eax, dword [eax]
call fcn.00445e28
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x456479
inc ebx
cmp ebx, 0x57
jne 0x45635b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4564fe
lea eax, [ebp - 0x34]
mov edx, 8
call fcn.00403b68
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b68
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000140b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10001415
repz ret
jmp fcn.100017d4
Function at 0x1000aaa3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1000aab2
pop dword [ebp - 0x2c]
mov eax, 0x4bda128c
add eax, 0xc4269826
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x47451fc7
add dword [ebp - 0x3c], 0x70d2584
mov dword [ebp - 0x38], 0xdf767413
sub dword [ebp - 0x38], 0xad4327ce
mov dword [ebp - 0x34], 0xe63e3c68
sub dword [ebp - 0x34], 0x99f1f83a
mov dword [ebp - 0x30], 0x48a9944d
sub dword [ebp - 0x30], 0x48a9944d
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xc2ee34b1
add dword [ebp - 0x3c], 0xb18434a5
mov dword [ebp - 0x38], 0x1edaf57f
sub dword [ebp - 0x38], 0xdd6e940a
mov dword [ebp - 0x34], 0xe4ad6f67
add dword [ebp - 0x34], 0x7ec1fd05
mov dword [ebp - 0x30], 0x8c1d95a
add dword [ebp - 0x30], 0xf73e26a6
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x4c46b74a
sub eax, 0x3c45f71e
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3742b
push 0
call eax
mov ecx, 0x4508
xor ebx, ebx
add ebx, eax
mov esi, 0xba8691ea
sub esi, 0xaa821dea
add esi, dword [ebp - 0x2c]
mov edx, 0xf0b1b675
add dword [ebp - 4], 0x542465af
mov edi, dword [esi]
xor dword [ebp - 8], esi
xor edi, edx
add dword [ebp - 0x28], 0x8398a77c
mov dword [ebx], edi
xor dword [ebp - 0x28], 0x30c9ced9
add ebx, 0xa4fdb076
sub ebx, 0xa4fdb072
add esi, 4
loop 0x1000abc5
add eax, 0xfb114608
sub eax, 0xfb103f15
xor ebx, ebx
add ebx, eax
add eax, 0xd7773821
add eax, 0x2888c7e4
mov ecx, 0x8e7ebbe6
sub ecx, 0x7e7ebbe6
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4031fc
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x401ba0
call fcn.00403408
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x400000], 0x5a4d
jne 0x40324f
mov eax, dword [0x40003c]
lea eax, [eax + 0x400000]
cmp dword [eax], 0x4550
jne 0x40324f
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x403267
cmp ecx, 0x20b
je 0x403254
mov dword [ebp - 0x60], ebx
jmp 0x40327b
cmp dword [eax + 0x84], 0xe
jbe 0x40324f
xor ecx, ecx
cmp dword [eax + 0xf8], ebx
jmp 0x403275
cmp dword [eax + 0x74], 0xe
jbe 0x40324f
xor ecx, ecx
cmp dword [eax + 0xe8], ebx
setne cl
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x46fc04], edi
mov dword [0x46fc08], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x46fbfc]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x46fbf8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x46fc0c], eax
call fcn.00403404
cmp dword [0x46f7c8], ebx
jne 0x4032d8
push fcn.00403404
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.004033f2
push 0x404010
push 0x40400c
call sub.msvcrt.dll__initterm
mov eax, dword [0x46fbf4]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
push dword [0x46fbf0]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x74], eax
push 0x404008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
cmp byte [eax], 0x22
jne 0x403363
inc eax
mov dword [ebp - 0x78], eax
mov cl, byte [eax]
cmp cl, bl
je 0x403343
cmp cl, 0x22
jne 0x403334
cmp byte [eax], 0x22
jne 0x40334c
inc eax
mov dword [ebp - 0x78], eax
mov cl, byte [eax]
cmp cl, bl
je 0x403357
cmp cl, 0x20
jbe 0x403348
test byte [ebp - 0x30], 1
je 0x40336e
movzx ecx, word [ebp - 0x2c]
jmp 0x403371
cmp byte [eax], 0x20
jbe 0x40334c
inc eax
mov dword [ebp - 0x78], eax
jmp 0x403363
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.00402890
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x60], ebx
jne 0x40338f
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x4033cb
mov eax, esi
jmp 0x4033df
call fcn.00403443
ret

Function at 0xb4e504
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00b4e504
ret
Function at 0x4065c9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4065ed
xor eax, eax
test eax, eax
je 0x406600
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406600
xor ecx, ecx
jmp 0x406603
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x40672c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a65c4], 0
push esi
jne 0x406763
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40673d
mov dword [ecx*4 + 0x7a65c0], eax
inc ecx
cmp ecx, 0x100
jl 0x406738
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406794
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a65c0]
xor eax, esi
inc ecx
dec edx
jne 0x406776
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx