joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001130
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10012004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.10001400
add esp, 8
mov byte [eax + 1], 0
lea eax, [ebp - 0x114]
push eax
call fcn.10001330
mov edi, eax
cmp byte [edi + 0xb], 0
je 0x100012ba
xor ecx, ecx
cmp dword [0x10012c54], 2
jl 0x10001291
movaps xmm2, xmmword [0x10010c80]
mov eax, 4
movaps xmm3, xmmword [0x10010cd0]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
movd xmm4, eax
mov eax, 0x1f
psrad xmm1, xmm4
movaps xmm0, xmm1
movd xmm5, eax
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x10010ca0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x10010c90]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x10010cb0]
movd xmm0, dword [edi]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.8888888888888888]
pxor xmm1, xmm0
movaps xmm0, xmm2
movd dword [edi], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm4
movaps xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x10010ca0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x10010cb0]
movd xmm0, dword [edi + 4]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.8888888888888888]
pxor xmm1, xmm0
movd dword [edi + 4], xmm1
mov eax, 0x5397829d
lea esi, [ecx + edi]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
inc ecx
imul eax, eax, 0x31
sub dl, al
add dl, 0x38
xor byte [esi], dl
cmp ecx, 0xc
jl 0x10001291
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ecx
lea ecx, [ebp - 0x108]
call fcn.10001000
add eax, dword [0x10013314]
lea ecx, [ebp - 0x108]
add esp, 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FlsSetValue]
push dword [0x10013314]
call dword [sym.imp.KERNEL32.dll_FlsFree]
push 0
push 0
push 0
push dword [0x10013310]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x10013308], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001360
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x10012004]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
jne 0x100013e7
push ebx
push 0x8c
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.100025e0
add esp, 0xc
mov dword [ebp - 0x94], 0
lea eax, [ebp - 0x94]
push eax
push 0x8c
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
xor ebx, ebx
cmp dword [ebp - 0x94], 0x8c
sete bl
jne 0x100013d4
push 0x100010a0
call dword [sym.imp.KERNEL32.dll_FlsAlloc]
mov dword [0x10013314], eax
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001409
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10001409
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x62a085
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303b0
cmp edx, dword [eax]
je 0x62a0a7
add eax, 8
inc ecx
cmp eax, 0x630440
jl 0x62a098
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303b0]
jne 0x62a1d5
mov eax, dword [0x637d40]
cmp eax, 1
je 0x62a1af
test eax, eax
jne 0x62a0d8
cmp dword [0x6302d8], 1
je 0x62a1af
cmp edx, 0xfc
je 0x62a1d5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62a10f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062aa70
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062af00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62a152
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062af00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62f49c
push edi
call fcn.0062cdd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062aa70
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062aa80
lea eax, [ebp - 0xa0]
push 0x62f47c
push eax
call fcn.0062aa80
push dword [esi + 0x6303b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062aa80
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062cd44
add esp, 0x2c
pop edi
jmp 0x62a1d5
lea eax, [ebp + 8]
lea esi, [esi + 0x6303b4]
push 0
push eax
push dword [esi]
call fcn.0062af00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40110b
Capabilities:
Accept command line arguments

Disassembly:
push 0x5c
push 0x429e70
call fcn.00402ad5
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x24], 0xbaadc0de
jne 0x40112f
push dword [ebp - 0x28]
call fcn.00401322
pop ecx
push 0x44
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.00401285
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x401162
mov eax, 0x4204ac
mov dword [ebp - 0x20], eax
mov cl, 0x20
mov byte [ebp - 0x19], cl
mov dl, byte [eax]
test dl, dl
je 0x401177
cmp dl, cl
jg 0x401177
inc eax
mov dword [ebp - 0x20], eax
jmp 0x401167
mov dl, byte [eax]
cmp dl, cl
jle 0x401191
cmp dl, 0x22
jne 0x40118b
movsx ecx, cl
xor ecx, 0x20
mov byte [ebp - 0x19], cl
inc eax
mov dword [ebp - 0x20], eax
jmp 0x401177
mov dl, byte [eax]
test dl, dl
je 0x4011a1
cmp dl, cl
jg 0x4011a1
inc eax
mov dword [ebp - 0x20], eax
jmp 0x401191
call fcn.004013fc
push ecx
push ecx
call fcn.00401311
mov ecx, eax
call fcn.00404b8c
push eax
push 0
call fcn.0040132c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
push ecx
push dword [eax]
call fcn.0040343b
pop ecx
pop ecx
ret

Function at 0x4013fc
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x42b004], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [section..data], eax
pushaw
mov eax, 1
cpuid
shr edx, 0x1a
and edx, 1
mov dword [0x42b008], edx
popaw
call fcn.0040293b
test eax, eax
je 0x4014a7
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edi, edi
mov ebx, 0x42b060
inc edi
push 0xfffffffffffffff6
mov dword [0x42b070], ebx
mov dword [0x42b07c], edi
call esi
push 0xfffffffffffffff5
mov dword [0x42b080], eax
mov dword [0x42b090], ebx
mov dword [0x42b09c], edi
call esi
push 0xfffffffffffffff4
mov dword [0x42b0a0], eax
mov dword [0x42b0b0], ebx
mov dword [0x42b0bc], edi
call esi
push 0x420154
push 0x420150
mov dword [0x42b0c0], eax
call fcn.004012f0
push 0x42014c
push 0x42011c
call fcn.004012f0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
push 0xffffffffffffffff
push 0x243
call fcn.0040132c
int3

Function at 0x403c34
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 8], edi
test esi, esi
je 0x403cb8
cmp word [esi], di
je 0x403cb8
call fcn.00403cbe
test al, al
jne 0x403c5e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x403c61
xor eax, eax
inc eax
test eax, eax
je 0x403c85
mov ecx, dword [0x42bf28]
push 0x15
xor edx, edx
mov eax, ecx
pop esi
div esi
mov dword [edx*4 + 0x42bf28], ecx
inc dword [0x42bf28]
mov al, 1
jmp 0x403cba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403c81
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x403cb8
push edi
push 0x42c7ec
push 0x42c7f4
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
pop edi
pop esi
leave
ret
Function at 0x407785
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4123f8
call fcn.00402a4a
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xa
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.0041459b
add esp, 0xc
mov byte [ebp - 4], 9
lea ecx, [esi + 0x78]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 9
call fcn.004055a6
mov byte [ebp - 4], 8
lea ecx, [esi + 0x6c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 8
call fcn.004055a6
mov byte [ebp - 4], 7
lea ecx, [esi + 0x60]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 7
call fcn.004055a6
mov byte [ebp - 4], 6
lea ecx, [esi + 0x54]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 6
call fcn.004055a6
mov byte [ebp - 4], 5
lea ecx, [esi + 0x48]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 5
call fcn.004055a6
mov byte [ebp - 4], 4
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
call fcn.004055a6
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
call fcn.004055a6
mov byte [ebp - 4], 2
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
call fcn.004055a6
mov byte [ebp - 4], 1
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
call fcn.004055a6
mov byte [ebp - 4], bl
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], bl
call fcn.004055a6
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004055a6
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40788f
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4120c7
call fcn.00402a4a
push ecx
push ebx
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004052a7
and dword [ebp - 4], 0
push 0xffffffffffffffff
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
call fcn.004052a7
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push dword [ebp + 0x18]
lea ecx, [esi + 0x18]
call fcn.004052a7
push 2
pop ebx
mov byte [ebp - 4], bl
push 0xffffffffffffffff
push dword [ebp + 0x20]
lea ecx, [esi + 0x24]
call fcn.004052a7
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push dword [ebp + 0x1c]
lea ecx, [esi + 0x30]
call fcn.004052a7
mov byte [ebp - 4], 4
push 0xffffffffffffffff
push dword [ebp + 0x24]
lea ecx, [esi + 0x3c]
call fcn.004052a7
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push dword [ebp + 0x2c]
lea ecx, [esi + 0x48]
call fcn.004052a7
mov byte [ebp - 4], 6
push 0xffffffffffffffff
push dword [ebp + 0x28]
lea ecx, [esi + 0x54]
call fcn.004052a7
mov byte [ebp - 4], 7
push 0xffffffffffffffff
push dword [ebp + 0x14]
lea ecx, [esi + 0x60]
call fcn.004052a7
mov byte [ebp - 4], 8
lea ecx, [esi + 0x6c]
mov dword [ebp + 8], ecx
call fcn.004057e0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x78]
mov dword [ebp + 8], ecx
call fcn.004057e0
mov byte [ebp - 4], 0xc
mov eax, dword [0x42bfc0]
push 1
cmp eax, 1
push 0
cmove eax, ebx
push 0
mov dword [0x42bfc0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.0041459b
add esp, 0xc
mov ecx, esi
call fcn.00407c26
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x28

Function at 0x40900a
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [0x473508]
mov eax, esi
mov edx, esi
mov ebx, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
test edi, edi
je 0x409041
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push esi
call edi
mov edx, dword [ebp - 8]
mov ecx, eax
mov eax, dword [ebp - 0xc]
jmp 0x409043
mov ecx, esi
test ecx, ecx
jne 0x40904b
xor eax, eax
jmp 0x4090ac
mov dword [ebp - 0x18], eax
mov eax, dword [0x42bf9c]
xor edi, edi
inc edi
cmp eax, edi
push 2
pop ecx
cmove eax, ecx
mov dword [0x42bf9c], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x40908e
push esi
push str.there
push 0x42682c
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x472fe8]
test eax, eax
je 0x4090a5
push esi
push esi
push 0x10
lea ecx, [ebp - 0x1c]
push ecx
push esi
push ebx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4091e6
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0x40912a
mov esi, edx
mov dword [ebp - 0xc], ecx
mov word [ebp - 8], 1
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [0x42bf80]
xor edx, edx
push 0x15
pop edi
mov eax, ecx
div edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [edx*4 + 0x42bf80], ecx
inc dword [0x42bf80]
cmp byte [ebp - 7], 0
je 0x409268
push 0x1194
push esi
call edi
test eax, eax
jne 0x409268
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x409264
push 0
push str.there
push 0x42682c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, 1
jmp 0x4092a4
lea eax, [ebp - 0xc]
push eax
push 0x40912a
mov word [ebp - 8], 0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [ebp - 7], 0
je 0x4092a2
mov eax, dword [0x42bfa4]
push 2
pop ecx
cmp eax, 1
push 0x1194
cmove eax, ecx
push esi
mov dword [0x42bfa4], eax
call edi
test eax, eax
je 0x409264
xor al, al
pop edi
pop esi
leave
ret
Function at 0x4096c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x412294
call fcn.00402a4a
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0x12
mov esi, dword [edi]
test esi, esi
je 0x4096f7
mov ecx, esi
call fcn.00407785
push esi
call fcn.004015ee
pop ecx
mov byte [ebp - 4], 0x11
lea ecx, [edi + 0xdc]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0x11
call fcn.004055a6
mov byte [ebp - 4], 0x10
lea ecx, [edi + 0xd0]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0x10
call fcn.004055a6
mov byte [ebp - 4], 0xf
lea ecx, [edi + 0xc4]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xf
call fcn.004055a6
mov byte [ebp - 4], 0xe
lea ecx, [edi + 0xb8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xe
call fcn.004055a6
mov byte [ebp - 4], 0xd
lea ecx, [edi + 0xac]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xd
call fcn.004055a6
mov byte [ebp - 4], 0xc
lea ecx, [edi + 0xa0]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xc
call fcn.004055a6
mov byte [ebp - 4], 0xb
lea ecx, [edi + 0x94]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xb
call fcn.004055a6
mov byte [ebp - 4], 0xa
lea ecx, [edi + 0x88]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xa
call fcn.004055a6
mov byte [ebp - 4], 9
lea ecx, [edi + 0x7c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 9
call fcn.004055a6
mov byte [ebp - 4], 8
lea ecx, [edi + 0x70]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 8
call fcn.004055a6
mov byte [ebp - 4], 7
lea ecx, [edi + 0x64]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 7
call fcn.004055a6
mov byte [ebp - 4], 6
lea ecx, [edi + 0x58]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 6
call fcn.004055a6
mov byte [ebp - 4], 5
lea ecx, [edi + 0x4c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 5
call fcn.004055a6
mov byte [ebp - 4], 4
lea ecx, [edi + 0x40]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
call fcn.004055a6
mov byte [ebp - 4], 3
lea ecx, [edi + 0x34]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
call fcn.004055a6
mov byte [ebp - 4], 2
lea ecx, [edi + 0x28]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
call fcn.004055a6
mov byte [ebp - 4], 1
lea ecx, [edi + 0x1c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
call fcn.004055a6
mov byte [ebp - 4], 0
lea ecx, [edi + 0x10]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0
call fcn.004055a6
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + 4]
mov dword [ebp - 0x14], ecx
or dword [ebp - 4], 0xffffffff
call fcn.004055a6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40bf81
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x412dce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [esp + 0x30]
mov edi, edx
mov dword [esp + 0x18], ebx
call fcn.004057e0
mov dword [esp + 0x54], 1
mov esi, dword [0x42bf80]
xor edx, edx
push 0x15
mov eax, esi
pop ecx
div ecx
mov dword [edx*4 + 0x42bf80], esi
inc dword [0x42bf80]
test edi, edi
je 0x40c01b
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x44]
call fcn.004052a7
push 2
pop eax
mov byte [esp + 0x54], al
cmp dword [esp + 0x40], 0
lea ecx, [esp + 0x30]
jne 0x40c000
call fcn.00405784
jmp 0x40c00d
push dword [esp + 0x44]
push dword [esp + 0x40]
call fcn.00405317
mov byte [esp + 0x54], 1
lea ecx, [esp + 0x3c]
call fcn.004055a6
mov ecx, dword [0x471334]
xor edi, edi
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x40c045
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebp + 8]
or eax, 0x2001f
push eax
push edi
push dword [esp + 0x3c]
push ebx
call ecx
mov esi, eax
jmp 0x40c047
mov esi, edi
push 2
test esi, esi
je 0x40c07f
mov dword [esp + 0x1c], 1
pop eax
mov eax, dword [esp + 0x18]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x40c18e
push edi
push 0x42c7ec
push 0x42c7f4
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40c18e
mov eax, dword [0x42bf88]
pop ecx
cmp eax, 1
cmove eax, ecx
lea ecx, [esp + 0x24]
mov dword [0x42bf88], eax
call fcn.004057e0
mov byte [esp + 0x54], 0xd
push 0x8001
lea ecx, [esp + 0x28]
call fcn.00405810
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
xor eax, eax
mov word [ebx + 0x10000], ax
mov dword [esp + 0x2c], 0x8000
mov dword [esp + 0x14], edi
test edi, edi
je 0x40c17d
mov eax, dword [0x4729a8]
xor esi, esi
test eax, eax
je 0x40c0f3
lea ecx, [esp + 0x1c]
push ecx
push esi
push esi
push esi
lea ecx, [esp + 0x24]
push ecx
push ebx
push esi
push dword [esp + 0x2c]
call eax
jmp 0x40c0f5
mov eax, esi
test eax, eax
jne 0x40c116
mov ecx, dword [esp + 0x10]
push esi
push dword [ebp + 8]
mov edx, ebx
call fcn.0040bf81
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40c180
mov dword [esp + 0x14], edi
jmp 0x40c0d1
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x30]
push 0x20
mov ecx, 0x471238
call fcn.004111b0
mov eax, dword [0x472d5c]
test eax, eax
je 0x40c147
push 0
push dword [ebp + 8]
push esi
push dword [esp + 0x24]
call eax
jmp 0x40c152
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
jne 0x40c180
mov eax, dword [0x42bfb0]
cmp eax, 1
push 2
pop ecx
cmove eax, ecx
mov dword [0x42bfb0], eax
mov eax, dword [0x42bfa0]
cmp eax, 1
cmove eax, ecx
mov dword [0x42bfa0], eax
jmp 0x40c180
push 8
pop esi
mov byte [esp + 0x54], 1
lea ecx, [esp + 0x24]
call fcn.004055a6
or dword [esp + 0x54], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.004055a6
mov ecx, dword [esp + 0x4c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c3d2
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x4131d3
call fcn.00402a4a
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
mov eax, edx
push ebx
mov esi, ecx
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c52c
test edi, edi
je 0x40c52c
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x40c436
push 0
push str.there
push 0x42682c
push 0
call ebx
lea ecx, [ebp - 0x2c]
call fcn.0040c614
mov dword [ebp - 4], 3
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040c644
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x40c475
push 0
push str.there
push 0x42682c
push 0
call ebx
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
jne 0x40c49f
mov ecx, esi
call fcn.004057e0
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], 1
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0040b87b
jmp 0x40c53d
mov dword [ebp - 0x18], edi
and dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c4ee
cmp dword [ebp - 0x14], 0
je 0x40c4ee
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
jne 0x40c4a2
mov ecx, esi
call fcn.004057e0
mov byte [ebp - 4], 8
push ecx
push edi
push ebx
mov ecx, esi
call fcn.0040c8d3
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], 1
jmp 0x40c48e
mov ecx, dword [0x42bf80]
xor edx, edx
push 0x15
mov eax, ecx
pop edi
div edi
mov eax, dword [0x471d9c]
mov dword [edx*4 + 0x42bf80], ecx
inc dword [0x42bf80]
test eax, eax
je 0x40c515
call eax
mov ecx, esi
call fcn.004057e0
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], 1
jmp 0x40c48e
mov ecx, esi
call fcn.004057e0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40e767
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push edx
mov edi, ecx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040cc2c
or esi, 0xffffffff
jmp 0x40e7cc
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x40e7ab
push ebx
push str.there
push 0x42682c
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
lea ecx, [ebp - 0x3c]
call fcn.0040ce02
push 8
xor esi, eax
pop ecx
mov eax, esi
and eax, 1
neg eax
and eax, 0xedb88320
shr esi, 1
xor esi, eax
dec ecx
jne 0x40e7b9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
shr ecx, 0x18
add ecx, dword [eax + 0x14]
sub ecx, dword [ebp - 0x10]
jne 0x40e785
not esi
mov dword [edi], esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret