joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003eee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100849f3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100bb500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.WebRequest.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x100a7723
lea ecx, [esi + 0x10]
mov dword [ebp - 4], 0
call fcn.10017020
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 1
call fcn.10036080
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 2
push 0x100a7723
mov dword [ebp - 0x14], ecx
call fcn.10017020
mov dword [esi + 0x24], 0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 4
mov dword [esi + 0x28], 0
call fcn.1005fd00
mov al, byte [ebp + 8]
mov byte [esi + 0xc], al
mov al, byte [ebp + 0xc]
mov byte [esi + 0xd], al
xor eax, eax
mov byte [esi + 0x3c], 1
mov word [esi + 0x2c], ax
mov edi, dword [esi + 0x24]
mov dword [esi + 0x24], eax
test edi, edi
je 0x1003efb8
mov eax, dword [edi]
mov ecx, edi
push eax
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.10028910
push dword [edi]
call fcn.1006219e
push 8
push edi
mov byte [ebp - 4], 4
call fcn.1006228a
add esp, 0xc
mov edi, dword [esi + 8]
mov dword [esi + 8], 0
test edi, edi
je 0x1003efec
mov eax, dword [edi]
mov ecx, edi
push eax
mov byte [ebp - 4], 6
push dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.10028910
push dword [edi]
call fcn.1006219e
push 8
push edi
call fcn.1006228a
add esp, 0xc
mov eax, esi
mov byte [esi + 0x3d], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10049530
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x100bb500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x30]
mov dword [esi + 4], esi
call fcn.10060040
test eax, eax
jne 0x1004956d
xor ebx, ebx
jmp 0x10049577
lea ecx, [esi + 0x30]
call fcn.10060040
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x30]
call fcn.1005fe70
push 0
push 0
push 3
push 0
push 0
push ebx
push dword [eax]
movzx eax, byte [esi + 0x3d]
mov ecx, 0x100bf648
push eax
mov dword [ebp - 4], 0
call fcn.10028fc0
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov edx, dword [ebp - 0x10]
mov dword [esi + 0x48], eax
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100495d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x1004960b
push 0x10089fac
lea ecx, [ebp - 0x10]
call fcn.10007930
push eax
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.100216b0
push 0x100adb08
lea eax, [ebp - 0x28]
push eax
call fcn.10063e94
push 0x10049d10
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
jne 0x1004964e
push 0x10089fac
lea ecx, [ebp - 0x14]
call fcn.10007930
push eax
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x3c]
call fcn.100216b0
push 0x100adb08
lea eax, [ebp - 0x3c]
push eax
call fcn.10063e94
push 2
mov ecx, esi
call fcn.100431e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100498e0
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085d48
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x100bb500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x4c]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x10049963
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x10049963
push 0x10089fac
lea ecx, [ebp - 0x14]
call fcn.10007930
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x34]
call fcn.100216b0
push 0x100adb08
lea eax, [ebp - 0x34]
push eax
call fcn.10063e94
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x14]
mov ecx, dword [ebp - 0x10]
add edx, ecx
cmp edx, ecx
jb 0x100499bc
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0x14]
cmp edx, eax
jb 0x100499bc
test ecx, ecx
je 0x100499aa
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0x14]
add eax, ecx
cmp eax, 0xa00000
jbe 0x100499aa
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.10051630
push 0x100ad9f4
lea eax, [ebp - 0x20]
push eax
call fcn.10063e94
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xcaa82f9b
lea ecx, [ebp - 0x2c]
call fcn.10051630
push 0x100ad9f4
lea eax, [ebp - 0x2c]
push eax
call fcn.10063e94
int3

Function at 0x10049b20
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085d78
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100bb500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebx + 0x18]
lea edi, [ebx + 0x14]
sub esi, dword [edi]
mov ecx, dword [ebp + 8]
lea eax, [esi + ecx]
cmp eax, esi
jl 0x10049c18
cmp eax, ecx
jl 0x10049c18
cmp eax, 0xa00000
jle 0x10049b8d
push 0xcaa10024
lea ecx, [ebp - 0x1c]
call fcn.10051630
push 0x100ad9f4
lea eax, [ebp - 0x1c]
push eax
call fcn.10063e94
push eax
mov ecx, edi
call fcn.1000c6e0
mov eax, dword [edi]
lea ecx, [ebx + 0x40]
push ecx
push dword [ebp + 8]
add eax, esi
push eax
push dword [ebx + 0x4c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x10049bee
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3e5
je 0x10049beb
push 0x10089fac
lea ecx, [ebp + 8]
call fcn.10007930
push eax
mov dword [ebp - 4], 0
call ebx
push eax
lea ecx, [ebp - 0x30]
call fcn.100216b0
push 0x100adb08
lea eax, [ebp - 0x30]
push eax
call fcn.10063e94
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x40]
mov ecx, edi
add eax, esi
push eax
call fcn.1000c6e0
push 0xa
mov ecx, ebx
call fcn.100431e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa82f9c
jmp 0x10049b77
Function at 0x1004bf00
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10086178
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100bb500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0x10
call fcn.10008530
mov ecx, eax
test ecx, ecx
jne 0x1004bf44
push 0x80004005
call fcn.10008310
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 0
test edi, edi
jns 0x1004bf67
push 0x80070057
call fcn.10008310
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x1004bf84
push edi
lea ecx, [ebp - 0x14]
call fcn.10008cd0
mov esi, dword [ebp - 0x14]
cmp edi, dword [esi - 8]
jg 0x1004bf5d
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1004bfd5
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
jne 0x1004bfb5
push dword [esi - 8]
push esi
call fcn.1006887d
add esp, 8
test eax, eax
js 0x1004bf5d
cmp eax, dword [esi - 8]
jg 0x1004bf5d
xor ecx, ecx
mov dword [esi - 0xc], eax
push ecx
mov word [esi + eax*2], cx
mov ecx, dword [ebp + 0xc]
push esi
call fcn.1004c160
test al, al
jne 0x1004bfe4
push dword [ebp + 8]
call fcn.1004c380
add esp, 4
xor bl, bl
jmp 0x1004bfe6
mov bl, 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1004c005
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004c160
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100861eb
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x100bb500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xe4], eax
lea eax, [esi + 0x50]
mov ecx, eax
mov dword [esi + 0x4c], 7
mov dword [ebp - 0xec], eax
call fcn.10008410
lea eax, [esi + 0x54]
mov ecx, eax
mov dword [ebp - 0xe8], eax
call fcn.10008410
lea ecx, [esi + 0x58]
call fcn.10008410
lea eax, [esi + 0x5c]
mov ecx, eax
mov dword [ebp - 0xf0], eax
call fcn.10008410
mov byte [esi + 0x48], 0
test ebx, ebx
je 0x1004c359
mov dword [ebp - 0xd8], 0
push 0x100
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0
call fcn.1004bcd0
mov edi, dword [ebp - 0xd8]
lea eax, [esi + 0x4c]
push eax
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xdc], 0x44
push eax
push edi
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xe0], 0x80
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp - 0xe4]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1004c2b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1004c315
cmp dword [ebp - 0xdc], 0x44
jbe 0x1004c26c
push 0x80004005
call fcn.10008310
mov eax, dword [ebp - 0xe0]
cmp eax, 0x80
jbe 0x1004c28b
push eax
lea ecx, [ebp - 0xd8]
call fcn.1004c450
mov edi, dword [ebp - 0xd8]
lea eax, [esi + 0x4c]
push eax
lea eax, [ebp - 0xe0]
push eax
push edi
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp - 0xe4]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x1004c315
lea eax, [ebp - 0x54]
mov byte [esi + 0x48], 1
push eax
lea eax, [esi + 4]
push eax
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1004c315
mov ecx, dword [ebp - 0xe8]
push edi
call fcn.1002d530
mov ecx, dword [ebp - 0xec]
push ebx
call fcn.1002d530
push dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xf0]
call fcn.1002d530
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x1004c311
lea ecx, [ebp - 0xd8]
call fcn.1004bdc0
mov al, 1
jmp 0x1004c35b
lea ecx, [esi + 0x50]
mov dword [esi + 0x4c], 7
call fcn.10008410
lea ecx, [esi + 0x54]
call fcn.10008410
lea ecx, [esi + 0x58]
call fcn.10008410
lea ecx, [esi + 0x5c]
call fcn.10008410
lea eax, [ebp - 0xd4]
mov byte [esi + 0x48], 0
cmp dword [ebp - 0xd8], eax
je 0x1004c359
lea ecx, [ebp - 0xd8]
call fcn.1004bdc0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006281c
mov esp, ebp
pop ebp
ret 8
Function at 0x1004c600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10086270
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100bb500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [ebp + 8]
lea eax, [ebp - 0x14]
mov dword [edi + 0x30], 0xcaa1002d
push eax
call fcn.1004c710
push dword [edi + 4]
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.10028ed0
add esp, 8
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.10053b20
mov esi, eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
push ecx
call fcn.10008330
add eax, 0x10
add esp, 4
mov dword [ebp + 8], eax
push esi
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.1002dc20
test al, al
lea ecx, [ebp + 8]
sete bl
call fcn.10007c70
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004c6be
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x1004c6d4
push 0xcaa90038
push edi
call fcn.100333e0
add esp, 8
xor bl, bl
jmp 0x1004c6e4
push 0x4aa90039
push edi
call fcn.100336a0
add esp, 8
mov bl, 1
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1004c6f1
mov edx, dword [ecx]
push 1
call dword [edx]
lea ecx, [ebp - 0x14]
call fcn.10007c70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10052e50
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
xor bl, bl
push str.Entering_DetectIfService__
push esi
mov byte [ebp - 1], bl
xor edi, edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.10033a50
add esp, 8
push 4
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x10052e92
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10052f68
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push esi
push 1
push 0x3b
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x10052ebb
test esi, esi
jne 0x10052ee1
call ebx
cmp eax, 0xea
jne 0x10052f65
add edi, dword [ebp - 0xc]
push esi
call fcn.10068751
push edi
call fcn.1006b46f
mov esi, eax
add esp, 8
mov eax, dword [ebp - 0x10]
jmp 0x10052e98
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100bfaf4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100bf768]
cmp eax, dword [ecx + 4]
jg 0x10052f9b
push dword [0x100bf764]
push str.ADAL_process_ProcessId:__u_n
push 0
call fcn.10033a60
xor ebx, ebx
add esp, 0xc
cmp dword [ebp - 8], ebx
jbe 0x10052f68
mov eax, dword [0x100bf764]
lea edi, [esi + 0x24]
push dword [edi]
push eax
push str.Comparing_ADAL_PID___u__to_Service_PID___u__n
push 0
call fcn.10033a60
mov eax, dword [0x100bf764]
add esp, 0x10
cmp eax, dword [edi]
je 0x10052f4b
inc ebx
add edi, 0x2c
cmp ebx, dword [ebp - 8]
jb 0x10052f25
jmp 0x10052f65
imul eax, ebx, 0x2c
mov byte [ebp - 1], 1
push dword [eax + esi + 0x24]
push str.Service_PID___u__matches_ADAL_PID._ADAL_is_running_within_a_service_context._n
push 0
call fcn.10033a60
add esp, 0xc
mov bl, byte [ebp - 1]
push str.No_service_PID_found_matching_the_ADAL_PID__so_ADAL_is_NOT_running_within_a_service_context_n
push 0
call fcn.10033a50
mov eax, dword [ebp - 0x10]
add esp, 8
test eax, eax
je 0x10052f85
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x10052f92
push esi
call fcn.10068751
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100bf768
call fcn.1006270a
add esp, 4
cmp dword [0x100bf768], 0xffffffff
jne 0x10052f01
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x100bf768
mov dword [0x100bf764], eax
call fcn.100626cb
add esp, 4
jmp 0x10052f01
Function at 0x10055030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rol esi, cl
inc ebp
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10054dae
inc edx
nop
inc edi
stc
lea eax, [ebp - 0x58]
push eax
call fcn.10054dbe
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10054d73
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1005509c
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
invalid

Function at 0x100551e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x10055249
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10054dbe
push eax
push esi
push dword [ebp + 8]
call fcn.10054d73
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10054dae
add ah, byte [ebp + 0x21]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.10054dae
sal byte [edi + 0x46], 1
and al, 0x8d
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid

Function at 0x10055d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x39d30001], ebx
test dword [ebp + 0x26fffffc], ebx
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
Function at 0x10056df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x680]
jmp 0x10056dfd
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x10056e44
lea eax, [ebp - 0x714]
push eax
call fcn.10054dbe
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.10054d73
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x10056e4f
jmp 0x10056e54
jmp 0x10056750

Function at 0x10078c7d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007893d
Function at 0x40296a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4029a9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4029a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4029a9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4029a9
cmp dword [ecx + 0x74], 0xe
jbe 0x4029a9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40d8ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xe2ac1c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe2ac26
pushal
call 0xe2ac2c
pop ebp
sub ebp, 0x10
sub ebp, 0xa2ac1c
jmp 0xe2ac42
mov eax, 0xa2ac1c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c2
mov edx, 0x43c9a118
xor byte [eax], dl
inc eax
dec ecx
jne 0xe2ac59
jmp 0xe2ac6c
xchg ebx, eax
aad 0x93
xchg ecx, eax
and al, 0x18
sbb byte [eax], bl
cdq
fchs
sbb byte [eax], bl
sbb byte [ebx], bl
aad 0xa0
sbb eax, 0xa2181818
xor byte [eax], bl
sbb byte [eax], bl
out dx, eax
cli
sbb edx, eax
xchg ebx, eax
cdq
adc al, 0x18
sbb byte [eax], bl
sbb ebx, ebp
dec eax
dec eax
jo 0xe2ac92
or al, 0x38
sbb byte [eax + 0x2e], dh
invalid
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x401c66
pop dword [ebp - 0xc]
mov eax, 0x84d4c6a7
sub eax, 0x8494aa41
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x52a220a6
add dword [ebp - 0x1c], 0xfbb024a5
mov dword [ebp - 0x18], 0x6abe2a1e
sub dword [ebp - 0x18], 0x388addd9
mov dword [ebp - 0x14], 0x97203928
sub dword [ebp - 0x14], 0x4ad3f4fa
mov dword [ebp - 0x10], 0xd690a7c9
add dword [ebp - 0x10], 0x296f5837
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xfcf22e4f
sub dword [ebp - 0x1c], 0x887fc4f9
mov dword [ebp - 0x18], 0x65439d3
add dword [ebp - 0x18], 0x3b1827a2
mov dword [ebp - 0x14], 0x150f3cf1
sub dword [ebp - 0x14], 0xb19fd085
mov dword [ebp - 0x10], 0x8d559101
sub dword [ebp - 0x10], 0x8d559101
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xa22e75d9
sub eax, 0xa1ee45ad
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x39a8e
push 0
call eax
mov ecx, 0x16059d8d
add ecx, 0xe9fab72a
xor esi, esi
add esi, eax
mov edi, 0xd8ab5405
add edi, 0x27951bfb
add edi, dword [ebp - 0xc]
mov edx, 0x9fb791bd
sub edx, 0xd05cf0
sub dword [ebp - 4], edx
mov ebx, dword [edi]
add dword [ebp - 8], 0xfc92ba98
add ebx, edx
sub dword [ebp - 8], 0x4eb76ed2
mov dword [esi], ebx
xor dword [ebp - 8], eax
add esi, 0x7007602b
sub esi, 0x70076027
add edi, 0xe1bc7a8b
add edi, 0x1e438579
loop 0x401d85
add eax, 0x145af
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret