joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x414b27
Capabilities:
Encode data using xor

Disassembly:
popfd
push es
fldenv [0xf60e4e51]
invalid
mov al, 0xb9
mov ecx, 0x8d8d0194
and bl, ah
inc esp
inc eax
invalid
mov bl, al
dec esi
mov byte [0xfe32bc43], al
jne 0x414b00
loop 0x414acd
push edi
pop ds
test dword [eax - 0x35], eax
sub al, byte [eax + 0x3d752166]
inc ecx
inc esi
sub byte [ecx + ecx*8 + 0x41533a99], cl
sti
cmp dword [0x4da28c7f], edx
push esp
mov byte [ebp - 0x6d5047e], ch
rcr dword [esi - 0x45], 1
dec esp
xlatb
mov ecx, 0x6b4cbc4b
push ebp
mov ebx, 0x53741515
jne 0x414bce
retf
or eax, edi
test al, 0xd0
pop ss
xor al, 0
popal
loopne 0x414bda
int3
salc
xlatb
pop esp
push edx
push edi
jno 0x414b8d
adc ah, dl
movsb byte es:[edi], byte [esi]
loop 0x414b37
xor esp, dword [esi + eax*2]
mov byte fs:[esi - 0x2b], dh
outsd dx, dword [esi]
scasd eax, dword es:[edi]
dec ecx
jle 0x414b91
cmp edx, ecx
cmpsd dword [esi], dword es:[edi]
and al, byte [esi + 0x55]
push esp
xor esi, esp
fcmove st(0), st(5)
pop ecx
shr byte [ebx - 0x61aeb065], cl
wait
and edx, dword [ebp - 0x1e]
inc ebx
inc ecx
sbb eax, 0xc97c53c9
and al, 0x37
pop ecx
aam 0x7b
jmp 0x1b003031
in eax, 0x8d
insd dword es:[edi], dx
mov esp, 0xcae553a9
or dword [edx - 0x3b77faf6], 0xd05598d7
movsd dword es:[edi], dword [esi]
popal
adc dword [ecx + 0x5b], esi
mov ah, al
xlatb
cwde
push ebp
shl byte [ebp + 0x5b711161], 1
pop edx
adc bl, dl
pushfd
mov word [edx + edx*2], ss
ja 0x414b89
fcomp qword [eax]
popfd
in eax, dx
in eax, dx
mov cl, 0x54
jle 0x414c48
and al, 0x3e
mov dword [ebx - 0x79], esi
push 0xe
sbb eax, 0x9ffafeb9
out 0xa3, eax
imul esi, dword [ecx + ecx*8 - 0x78], 1
xor dh, cl
invalid
int3
Function at 0x4010cc
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4010de
mov eax, dword [0x40f08b]
shl eax, 2
mov dword [0x40f08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00405694
pop edx
call fcn.00404a30
call fcn.00405698
push 0
call fcn.0040694c
pop ecx
push 0x40f034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x40f093], eax
push 0
jmp fcn.0040a720

Function at 0x401430
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
mov eax, dword [0x44f37c]
mov edx, dword [0x44f384]
lea ecx, [ebp - 0x224]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x44f380]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], edx
mov edx, dword [0x44f388]
mov dword [0x453628], 1
mov dword [ebp - 0x18], edx
push 0x208
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x224]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401574
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
push 2
push 0
push 0xfffffffffffffff8
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 4]
push 0
push eax
lea edx, [ebp - 0x14]
push 8
push edx
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4014df
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401576
push 8
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.00405b40
add esp, 0xc
test eax, eax
je 0x4014f9
xor eax, eax
jmp 0x401576
push 2
push 0
push 0xfffffffffffffff4
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edx, [ebp - 4]
push edx
push 4
push esi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x401522
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401576
push 4
push 0x1000
mov edx, dword [esi]
push edx
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x44f378], eax
mov eax, edi
sub eax, dword [esi]
sub eax, 0xc
push 0
push 0
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea edx, [ebp - 4]
push 0
push edx
mov eax, dword [0x44f378]
mov ecx, dword [esi]
push ecx
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40156d
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401576
mov eax, 1
jmp 0x401576
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4032ac
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x14]
add eax, dword [ebp + 0xc]
add eax, 0x18
xor ecx, ecx
jmp 0x4032e0
mov edx, dword [eax + 8]
test edx, edx
jne 0x4032cf
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp ebx, esi
jb 0x4032dc
add edx, esi
cmp ebx, edx
jb 0x4032ed
inc ecx
add eax, 0x28
mov edx, dword [ebp + 0xc]
movzx edx, word [edx + 6]
cmp ecx, edx
jb 0x4032c5
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x403328
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x403342
xor eax, eax
jmp 0x4034c2
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x403356
xor eax, eax
jmp 0x4034c2
cmp word [ebx + 0x14], 0xe0
jne 0x403366
cmp word [ebx + 0x18], 0x10b
je 0x40336d
xor eax, eax
jmp 0x4034c2
mov dword [0x45342c], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004032ac
add esp, 8
test eax, eax
jne 0x403398
xor eax, eax
jmp 0x4034c2
mov edx, dword [0x45342c]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004032f4
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x4033ca
push 0x10
push 0
push str.Error_in_GetProcAddressDirectly__
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x4034c2
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x403494
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x403486
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x403481
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x403478
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x40346d
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x40346d
test cl, cl
je 0x403462
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x40346d
add eax, 2
add edx, 2
test cl, cl
jne 0x403446
jne 0x40346d
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x4034c2
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x40342c
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x403404
jmp 0x4034c0
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x4034b8
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x4034b4
cmp dword [eax], 0
je 0x4034b4
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x4034c2
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x40349b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4035d4
Capabilities:
Query service status

Disassembly:
push ebx
add esp, 0xffffffe4
push 0xf003f
push str.ServicesActive
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
test eax, eax
jne 0x4035f1
xor eax, eax
jmp 0x40362e
push 0xf01ff
push str.NTice
push eax
call sub.ADVAPI32.DLL_OpenServiceA
mov ebx, eax
push esp
push ebx
call sub.ADVAPI32.DLL_QueryServiceStatus
test eax, eax
jne 0x403618
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
xor eax, eax
jmp 0x40362e
cmp dword [esp + 4], 4
jne 0x40362c
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, 1
jmp 0x40362e
xor eax, eax
add esp, 0x1c
pop ebx
ret

Function at 0x403690
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x4036a9
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4036b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop ebp
ret
Function at 0x4036d0
Capabilities:
Enumerate process modules
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
mov ecx, 0x4a
push eax
add esp, 0xfffffc30
push ebx
push esi
push edi
lea edi, [ebp - 0x238]
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x44f974
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.00403668
pop ecx
test eax, eax
je 0x40370c
push ebx
call fcn.004036b0
pop ecx
mov dword [ebp - 0x2cc], 0x94
lea eax, [ebp - 0x2cc]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x2bc], 1
jne 0x40374a
push ebx
call fcn.00403544
pop ecx
test eax, eax
jne 0x403741
push ebx
call fcn.0040357c
pop ecx
test eax, eax
je 0x403767
push ebx
call fcn.004036b0
pop ecx
jmp 0x403767
push ebx
call fcn.00403690
pop ecx
test eax, eax
jne 0x403760
push ebx
call fcn.00403634
pop ecx
test eax, eax
je 0x403767
push ebx
call fcn.004036b0
pop ecx
mov dword [ebp - 0x238], 0x128
call sub.KERNEL32.DLL_GetCurrentProcessId
mov edi, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4037d3
jmp 0x4037c2
push str.explorer.exe
lea edx, [ebp - 0x214]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4037b4
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 4], ecx
cmp edi, dword [ebp - 0x230]
jne 0x4037c2
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x403796
cmp esi, dword [ebp - 4]
je 0x4037f8
cmp dword [ebp - 4], 0
je 0x4037f8
push esi
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x4038d6
xor edx, edx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0xc], edx
push 0x105
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x44fb19
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcatA
push str.EXPLORER.EXE
lea edx, [ebp - 0x110]
push edx
call sub.KERNEL32.DLL_lstrcatA
push esi
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x4038d6
lea eax, [ebp - 8]
lea edx, [ebp - 0x12cc]
push eax
push 0x1000
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4038b2
xor esi, esi
lea ebx, [ebp - 0x12cc]
jmp 0x4038a8
push 0x104
lea eax, [ebp - 0x13d0]
push eax
mov edx, dword [ebx]
push edx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x4038a4
lea ecx, [ebp - 0x13d0]
push ecx
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4038a4
mov dword [ebp - 0xc], 1
jmp 0x4038b2
inc esi
add ebx, 4
mov edx, dword [ebp - 8]
shr edx, 2
cmp esi, edx
jb 0x40386b
push edi
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0xc], 0
jne 0x4038d6
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x1f0fff
dec dword [edi]
pop ds
add al, ch
cwde
mov dl, 0
add byte [edx], ch
Function at 0x403930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
je 0x403941
jne 0x403941
jmp fcn.004038c5
cmp esi, 8
jb 0x40397f
xor ebx, ebx
jmp 0x403976
mov eax, dword [ebp + 0x10]
mov edx, ebx
add edx, edi
push eax
push edx
call fcn.00403984
add esp, 8
movsx ecx, word [ebp + 0xc]
mov eax, 0x64
sub eax, ecx
imul esi
mov ecx, 0x64
xor edx, edx
div ecx
add ebx, eax
add ebx, 8
mov eax, esi
sub eax, 8
cmp ebx, eax
jbe 0x40394a
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403984
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004018dc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403a37
mov eax, fcn.00401580
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403a37
mov eax, fcn.00403be0
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403a37
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403a37
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x4039ff
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403a54
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004018dc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403b0a
mov eax, fcn.00401580
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403b0a
mov eax, fcn.00403a54
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403b0a
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403b0a
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403ad2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403c30
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004018dc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403ce6
mov eax, fcn.00401580
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403ce6
mov eax, fcn.00403be0
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403ce6
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403ce6
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403cae
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405388
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x40974c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4097ae
call fcn.004096fc
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00405a74
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00405a74
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40980c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x45195c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4098e6
cmp dword [0x451958], 0
jne 0x4098e6
cmp dword [0x451b4c], 0
je 0x4098a0
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004095fc
add esp, 8
mov ebx, eax
test eax, eax
jne 0x409886
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004095fc
add esp, 8
mov ebx, eax
test eax, eax
jne 0x409886
lea ebx, [ebp - 0x84]
jmp 0x409887
inc ebx
call fcn.004097c8
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x409921
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x451960
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00405a74
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x451963
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x409921
cmp dword [0x451958], 0
je 0x409900
cmp dword [0x451958], 0xffffffff
je 0x409921
push esi
call dword [0x451958]
pop ecx
mov eax, dword [0x45195c]
test eax, eax
je 0x409921
cmp dword [0x45195c], 0xffffffff
je 0x409921
cmp byte [eax], 0
je 0x409921
push esi
push eax
call fcn.0040974c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a164
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x453ea8], 0
jne 0x40a1e5
cmp dword [0x453ec8], 0
jne 0x40a194
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x453ec8], eax
test eax, eax
jne 0x40a194
push str.GetEnvironmentStrings_failed
call fcn.00409938
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x453ec8]
jmp 0x40a1a8
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00405a74
pop ecx
mov edi, eax
test eax, eax
jne 0x40a1a0
lea edi, [ebp + 1]
push edi
call fcn.00404940
pop ecx
mov ebx, eax
mov dword [0x453eac], ebx
test ebx, ebx
jne 0x40a1d2
xor eax, eax
jmp 0x40a2a8
push edi
mov edx, dword [0x453ec8]
push edx
push ebx
call fcn.00405924
add esp, 0xc
jmp 0x40a205
xor esi, esi
mov ebx, dword [0x453ea8]
jmp 0x40a1ff
push eax
call fcn.00405a74
pop ecx
test eax, eax
jne 0x40a1fb
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a1ef
lea ebx, [esi + 4]
push 4
mov dword [0x453eb0], ebx
inc ebx
push ebx
call fcn.004044a4
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40a228
xor eax, eax
jmp 0x40a2a8
cmp dword [0x453ea8], 0
jne 0x40a259
xor esi, esi
mov ebx, dword [0x453eac]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40a24a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00405a74
pop ecx
mov edi, eax
test eax, eax
jne 0x40a240
jmp 0x40a28a
xor esi, esi
mov ebx, dword [0x453ea8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40a284
push eax
call fcn.00405a74
pop ecx
test eax, eax
je 0x40a279
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40a27d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a268
mov eax, dword [0x453ea8]
test eax, eax
je 0x40a29a
push eax
call fcn.00404950
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x453ea8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40ca28
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x4525bc
sub eax, eax
test esi, esi
je 0x40cb08
sub eax, 1
test ecx, ecx
je 0x40cb06
test esi, 3
je 0x40ca66
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40ca4b
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x40caed
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40ca74
mov ecx, edx
test ecx, ecx
je 0x40cb06
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40caf3
not eax
mov dword [esp + 0x1c], eax
popal
ret