joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1a037f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x144e000]
push edi
or ebp, 0xffffffff
jmp 0x1a03812
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1a03819
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a03808
mov eax, 1
add ebx, ebx
jne 0x1a0382b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1a0383c
jne 0x1a0385b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a0385b
dec eax
add ebx, ebx
jne 0x1a03848
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1a03820
add ebx, ebx
jne 0x1a03857
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1a038ad
xor ecx, ecx
sub eax, 3
jb 0x1a03873
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1a038e2
sar eax, 1
mov ebp, eax
jmp 0x1a0387e
add ebx, ebx
jne 0x1a0387e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a0384c
inc ecx
add ebx, ebx
jne 0x1a0388c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a0384c
add ebx, ebx
jne 0x1a03899
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1a0388e
jne 0x1a038aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1a0388e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1a038cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1a038be
jmp 0x1a0380e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1a038cc
add edi, ecx
jmp 0x1a0380e
pop esi
mov edi, esi
mov ecx, 0x4ca7b1
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x1a03907
cmp byte [edi], 0x25
jne 0x1a038ec
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x1a038ea
lea edi, [esi + 0x15c7000]
mov eax, dword [edi]
or eax, eax
je 0x1a0394f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x25695cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x25696fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1a0390d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2569704]
or eax, eax
je 0x1a03949
mov dword [ebx], eax
add ebx, 4
jmp 0x1a0392a
call dword [esi + 0x2569700]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1a03980
cmp al, 0xef
ja 0x1a03973
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1a03955
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1a03962
mov ebp, dword [esi + 0x2569708]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1a039b4
sub esp, 0xffffff80
jmp 0x92006c
Function at 0x6d2570
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [edx + ecx + 0xdc]
lea esi, [edx + eax + 0xdc]
xor esi, eax
cmp edx, edi
jne 0x6d25ae
cmp ecx, 0xecd559c0
jne 0x6d25ae
mov eax, ecx
sub eax, dword [ebp + 0xc]
je 0x6d25ae
add eax, esi
xor eax, ecx
add eax, 0x154
mov esi, eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, esi
mov ecx, dword [ebp + 0xc]
and eax, ecx
cmp ebx, ecx
mov edx, ebx
mov dword [ebp - 0x10], eax
je 0x6d262c
movsx ebx, al
cmp ebx, ecx
jne 0x6d25fe
xor ebx, esi
imul ebx, edx
add ebx, edi
lea eax, [ebx + edx]
movsx eax, al
mov esi, eax
imul esi, ebx
add esi, eax
push edx
push esi
mov edi, edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp + 0xc]
mov edx, edi
mov edi, dword [ebp + 8]
imul eax, esi, 0x1b3
or ebx, eax
mov dword [ebp - 0x10], ebx
cmp edx, edi
jne 0x6d2630
cmp edx, ecx
jne 0x6d2630
cmp eax, edi
jl 0x6d2630
mov ebx, dword [ebp - 0x10]
movsx ecx, bl
or ecx, eax
imul eax, ecx, 0xe0
lea esi, [edi + eax + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, ebx
add esi, 0x7f
mov eax, esi
jmp 0x6d2633
cmp edx, edi
je 0x6d2602
mov eax, dword [ebp - 0x10]
movsx eax, al
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6d4050
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor eax, eax
mov esi, eax
nop
nop
nop
nop
nop
nop
push 1
push eax
mov edi, eax
call fcn.006d38d0
add esp, 8
mov eax, edi
mov ecx, edi
shr eax, 1
mov ebx, eax
xor ebx, 0xedb88320
test cl, 1
cmove ebx, eax
push 1
push ebx
call fcn.006d38d0
add esp, 8
mov eax, ebx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test bl, 1
cmove ecx, eax
push 1
push ecx
mov ebx, ecx
call fcn.006d38d0
add esp, 8
mov eax, ebx
mov ecx, ebx
shr eax, 1
mov ebx, eax
xor ebx, 0xedb88320
test cl, 1
cmove ebx, eax
push 1
push ebx
call fcn.006d38d0
add esp, 8
mov eax, ebx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test bl, 1
cmove ecx, eax
push 1
push ecx
mov ebx, ecx
call fcn.006d38d0
add esp, 8
mov eax, ebx
mov ecx, ebx
shr eax, 1
mov ebx, eax
xor ebx, 0xedb88320
test cl, 1
cmove ebx, eax
push 1
push ebx
call fcn.006d38d0
add esp, 8
mov eax, ebx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test bl, 1
cmove ecx, eax
push 1
push ecx
mov ebx, ecx
call fcn.006d38d0
add esp, 8
mov eax, ebx
mov ecx, ebx
shr eax, 1
mov ebx, eax
xor ebx, 0xedb88320
test cl, 1
cmove ebx, eax
push 1
push ebx
call fcn.006d38d0
add esp, 8
mov eax, ebx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test bl, 1
cmove ecx, eax
mov dword [edi*4 + 0x6f2128], ecx
push 0x5babac12
call fcn.006d3d70
add esp, 4
sub esi, eax
add esi, 0xad889749
push 1
push edi
call fcn.006d53a0
add esp, 8
cmp esi, 0x100
mov eax, esi
jne 0x6d4060
mov dword [0x6f4af8], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6d7100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x6d7195
mov ebx, 0xffffffff
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push 0xf6233b52
call fcn.006d3d70
add esp, 4
mov ecx, eax
mov eax, dword [ebp + 8]
mov edx, ebx
shr edx, cl
movzx ecx, bl
mov esi, edx
movzx eax, byte [eax + edi]
push eax
push ecx
call fcn.006d10c0
add esp, 8
mov ebx, esi
xor ebx, dword [eax*4 + 0x6f2128]
push 0xf2840cdb
call fcn.006d3d70
add esp, 4
mov ecx, edi
sub ecx, eax
inc ecx
push 0x4a73781
push ecx
call fcn.006d53a0
add esp, 8
mov esi, eax
push 1
push edi
call fcn.006d53a0
mov eax, dword [ebp + 0xc]
add esp, 8
cmp esi, eax
mov edi, esi
jne 0x6d7120
push 0xffffffffffffffff
push ebx
call fcn.006d10c0
add esp, 8
jmp 0x6d7197
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6e13d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edi, dword [ebp + 8]
mov ebx, 1
mov dword [0x6f3224], 1
mov dword [0x6f2528], edi
nop
mov esi, edi
shr esi, 0x1e
push 0xffffffffffffffff
push edi
call fcn.006d10c0
add esp, 8
mov dword [ebp - 0x10], eax
push 0x9e8bb125
call fcn.006d3d70
add esp, 4
and eax, dword [ebp - 0x10]
and edi, 0x97577580
or edi, eax
xor edi, esi
xor edi, 0x68a88a7f
imul edi, edi, 0x6c078965
add edi, ebx
mov dword [ebx*4 + 0x6f2528], edi
push 0x105c841
call fcn.006d3d70
add esp, 4
lea ebx, [ebx + eax + 0x8d90ce6]
push 0xf623392a
call fcn.006d3d70
add esp, 4
cmp ebx, eax
jne 0x6e13f0
mov dword [0x6f3224], 0x270
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6e1d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [ebp + 0xc], 0
je 0x6e1e70
mov ebx, dword [ebp + 8]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], eax
call fcn.006ef110
xor esi, esi
nop
nop
nop
push 0xf6233b43
call fcn.006d3d70
add esp, 4
mov ecx, eax
mov eax, ebx
xor edx, edx
div ecx
mov edi, edx
push 0x3b
call fcn.006d9600
add esp, 4
neg al
movzx eax, al
push eax
push edi
mov eax, dword [ebp + 8]
mov edi, eax
call fcn.006d1e10
add esp, 8
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xd]
lea ecx, [ebp - 0x20]
push eax
call fcn.006ee970
movsx eax, byte [ebp - 0xd]
push eax
push ebx
call fcn.006d53a0
add esp, 8
mov ebx, eax
neg esi
xor ebx, edi
push 1
push 0
call fcn.006d2a30
add esp, 8
push eax
push esi
call fcn.006d53a0
add esp, 8
mov esi, eax
neg esi
cmp esi, 0x14
jne 0x6e1dc0
lea eax, [ebp - 0x2f]
push eax
push 0x6f0636
call fcn.006da490
add esp, 8
lea esi, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.006ef030
mov ecx, dword [ebp + 0x10]
push esi
call fcn.006eecd0
mov ecx, esi
call fcn.006ee980
mov eax, dword [ebp - 0x14]
inc eax
cmp eax, dword [ebp + 0xc]
jne 0x6e1db0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6e2950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
cmp eax, 2
jb 0x6e29b7
mov edi, dword [ebp + 8]
dec eax
mov bl, byte [edi]
inc edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edi]
mov dword [ebp - 0x10], eax
push 0xff
push esi
call fcn.006d7720
add esp, 8
mov bh, al
push 0x3d
call fcn.006d9600
add esp, 4
mov ecx, esi
and al, bh
xor bl, 0x67
and cl, 0x98
or cl, al
movzx eax, bl
movzx ecx, cl
push eax
push ecx
call fcn.006d7720
add esp, 8
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov byte [edi], bl
inc edi
dec eax
jne 0x6e2970
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6e5ba0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x6e5bbb
dec eax
je 0x6e5bbb
mov ecx, dword [esp + 4]
nop
movzx edx, byte [ecx + eax - 1]
xor byte [ecx + eax], dl
dec eax
jne 0x6e5bb0
ret

Function at 0x6e6b60
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
push 0xc6d154
push 0
call fcn.006de600
add esp, 8
call eax
mov esi, eax
push dword [0x6f4af8]
push eax
call fcn.006d1370
add esp, 8
test al, 1
jne 0x6e6b99
mov dword [0x6f4af8], esi
push esi
call fcn.006e13d0
add esp, 4
pop esi
pop ebp
jmp fcn.006dbf80

Function at 0x6e9560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, edx
mov dword [ebp - 0x14], ecx
mov ecx, 3
mov edi, edx
mov esi, 0xffffffff
and eax, 7
cmp eax, 3
cmova ecx, eax
mov dword [ebp - 0x10], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edi
mov ecx, 0x4ec4ec4f
mul ecx
mov ecx, edi
shr edx, 3
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
add eax, edx
sub ecx, eax
push 0x1e86
push ecx
call fcn.006d8ca0
add esp, 8
mov ecx, dword [ebp - 0x14]
add eax, 0x1ee7
mov ebx, edi
shl ebx, 8
mov word [ecx + esi*2 + 2], ax
push 0xf6233b42
call fcn.006d3d70
add esp, 4
mov ecx, eax
mov eax, ebx
shr edi, cl
mov ecx, ebx
and eax, 0x4e155b00
and ecx, 0xb1eaa400
xor eax, 0x4e155ba8
push ecx
push eax
call fcn.006d72c0
add esp, 8
xor eax, edi
and edi, ebx
inc esi
xor eax, 0x4e155ba8
or edi, eax
inc edi
cmp esi, dword [ebp - 0x10]
jb 0x6e9590
push 1
push 0
call fcn.006d2a30
add esp, 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub ecx, eax
mov word [edx + ecx*2], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6ed700
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x6ed782
mov esi, eax
push 0x208
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x6ed782
mov edi, eax
push 0xf6233a5e
call fcn.006d3d70
add esp, 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x6ed778
lea eax, [ebp - 0x2e]
push eax
push 0x6f0430
call fcn.006d34e0
add esp, 8
push 0xffffffffffffffff
push eax
push edi
call fcn.006e44d0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6ed773
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x6ed778
call fcn.006edb40
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x28
pop esi
pop edi
pop ebp
ret
Function at 0x6ed8d0
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x22c
lea esi, [ebp - 0x22e]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x26]
push eax
push 0x6f0a12
call fcn.006d34e0
add esp, 8
push 0xffffffffffffffff
push eax
push esi
call fcn.006e44d0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x6ed94b
mov esi, eax
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push 0
push eax
push 4
push 0x6f2124
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x22c
pop esi
pop ebp
ret

Function at 0x6edb40
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x228
lea esi, [ebp - 0x230]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x28]
push eax
push 0x6f0a12
call fcn.006d34e0
add esp, 8
push 0xffffffffffffffff
push eax
push esi
call fcn.006e44d0
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x6edbe5
mov edi, dword [0x6f2124]
mov esi, eax
push 0x4a393dc0
call fcn.006d3d70
add esp, 4
sub edi, eax
inc edi
push 0xbc1a069a
push edi
call fcn.006d53a0
add esp, 8
mov dword [0x6f2124], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push 0
push eax
push 4
push 0x6f2124
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x228
pop esi
pop edi
pop ebp
ret
Function at 0x10005870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.10004b66
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10004b1b
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
stc
invalid
invalid
call fcn.10004b56
mov dh, 0xaa
inc edx
sbb bh, bh
mov ch, 0x68
stc
invalid

Function at 0x100059f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sar ah, 0xff
dec dword [ecx + 0x4680845]
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax + 0x6a]
add bh, bh
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
call fcn.10004b56
and al, 0x55
js sym.VCRUNTIME140.dll___GetPlatformExceptionInfo
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
invalid
invalid

Function at 0x10005ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
invalid
invalid
Function at 0x405c8c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422aa4], 0
push esi
jne 0x405cc3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405c9d
mov dword [ecx*4 + 0x422aa0], eax
inc ecx
cmp ecx, 0x100
jl 0x405c98
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405cf4
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422aa0]
xor eax, esi
inc ecx
dec edx
jne 0x405cd6
pop edi
not eax
pop esi
ret 0xc

Function at 0x7c761d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x7d1368
cmp edx, dword [eax]
je 0x7c763f
add eax, 8
inc ecx
cmp eax, 0x7d13f8
jl 0x7c7630
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x7d1368]
jne 0x7c776d
mov eax, dword [0xbd6c60]
cmp eax, 1
je 0x7c7747
test eax, eax
jne 0x7c7670
cmp dword [0x7d1294], 1
je 0x7c7747
cmp edx, 0xfc
je 0x7c776d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7c76a7
lea eax, [ebp - 0x1a4]
push 0x7ccdd8
push eax
call fcn.007c8000
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.007c8490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x7c76ea
lea eax, [ebp - 0x1a4]
push eax
call fcn.007c8490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x7ccdd4
push edi
call fcn.007ca360
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x7ccdb8
push eax
call fcn.007c8000
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.007c8010
lea eax, [ebp - 0xa0]
push 0x7ccdb4
push eax
call fcn.007c8010
push dword [esi + 0x7d136c]
lea eax, [ebp - 0xa0]
push eax
call fcn.007c8010
push 0x12010
lea eax, [ebp - 0xa0]
push 0x7ccd8c
push eax
call fcn.007ca2d4
add esp, 0x2c
pop edi
jmp 0x7c776d
lea eax, [ebp + 8]
lea esi, [esi + 0x7d136c]
push 0
push eax
push dword [esi]
call fcn.007c8490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1000116c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10002c02
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10005038]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x20], 0
push 0x10003130
mov ecx, dword [ebp + 0xc]
call fcn.1000156d
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100011bf
cmp dword [ebp - 0x10], 0
jne 0x100011e4
mov eax, dword [ebp + 0x10]
and dword [eax], 0
push 0
mov ecx, dword [ebp + 8]
call fcn.10001642
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x20]
or eax, 1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
jmp 0x1000127d
push 2
push 0
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push 0
push 0
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
mov eax, dword [ebp + 0x10]
push dword [eax]
call fcn.100021a2
pop ecx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
call fcn.100015ea
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
push dword [eax]
push 1
lea ecx, [ebp - 0x18]
call fcn.10001678
push eax
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR100.dll_fclose]
pop ecx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.10001610
mov eax, dword [ebp - 0x20]
or eax, 1
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.10001667
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret

Function at 0x1000128a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x40
push 0x3000
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100012ae
xor al, al
jmp 0x100012ca
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [ebp - 8]
mov al, 1
leave
ret

Function at 0x100021ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10005038]
jne 0x100021c4
repz ret
jmp fcn.100025d1
Function at 0x403f20
Capabilities:
Download url
Receive data

Disassembly:
push ebx
push esi
push edi
lea edx, [ecx + 0x211c]
lea edi, [ecx + 0x1f14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, str.strInfolist.ini
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push edx
and ecx, 3
push str.http:__app.ancamera.co.kr_help_AnCamCoderInfo.php
rep movsb byte es:[edi], byte [esi]
push eax
call sub.urlmon.dll_URLDownloadToFileA
pop edi
pop esi
pop ebx
ret

Function at 0x405c80
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
push 0x442bbc
mov edi, ecx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov edx, dword [eax + 0x20]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
mov ecx, dword [edi + 0x20]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [edi + 0x20]
lea edx, [esp + 0x30]
push edx
push eax
call esi
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov dword [edi + 0x16f8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [edi + 0x16fc], edx
mov edx, dword [esp + 0x24]
sub ecx, edx
lea edx, [esp + 0x40]
sub eax, esi
push edx
push 5
mov dword [edi + 0x1700], eax
mov dword [edi + 0x1704], ecx
mov dword [esp + 0x48], 0x24
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
mov ebp, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebp
push 1
mov esi, eax
call ebp
push 0x50
mov ebx, eax
call ebp
test eax, eax
jne 0x405d4c
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x405d6e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
sub esi, eax
push 1
add esi, ecx
push ebx
push esi
sub eax, ecx
push 0
push eax
jmp 0x405db1
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
sub eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x30]
sar eax, 1
add eax, edx
cmp eax, esi
jbe 0x405d2d
push 1
push ebx
push esi
push 0
push esi
jmp 0x405db1
cmp eax, 1
jne 0x405d89
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
mov edx, ecx
sub edx, eax
add edx, ebx
sub eax, ecx
push edx
push esi
push eax
jmp 0x405daf
cmp eax, 2
push 1
jne 0x405d9f
mov ebp, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x18]
sub esi, ebp
add esi, ebx
jmp 0x405dac
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub eax, ecx
add eax, ebx
push eax
push esi
push 0
push 0
mov ecx, edi
call sub.MFC42.DLL_CWnd::MoveWindow
push 0
lea ecx, [edi + 0x9d0]
call sub.MFC42.DLL_CWnd::ShowWindow
push 5
lea ecx, [edi + 0xb34]
call sub.MFC42.DLL_CWnd::ShowWindow
mov dword [edi + 0x16e4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret