joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1025a6c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1038418]
jne 0x1025a7d
test ecx, 0xffff0000
jne 0x1025a7d
ret
jmp fcn.01025afa

Function at 0x1025f85
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10358e8
call fcn.010264bc
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1038858
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1025d6b
cmp eax, esi
jne 0x1025d5e
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1025d6e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1025d45
xor esi, esi
inc esi
mov eax, dword [0x1038854]
cmp eax, esi
jne 0x1025d81
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x1025dbc
mov eax, dword [0x1038854]
test eax, eax
jne 0x1025db6
mov dword [0x1038854], esi
push 0x1001590
push 0x1001588
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x1025dbc
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1025e93
mov dword [0x103883c], esi
mov eax, dword [0x1038854]
cmp eax, esi
jne 0x1025de0
push 0x1001584
push 0x100156c
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x1038854], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1025ded
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1038864], ebx
je 0x1025e0e
push 0x1038864
call fcn.01026617
pop ecx
test eax, eax
je 0x1025e0e
push ebx
push 2
push ebx
call dword [0x1038864]
mov eax, dword [0x1038824]
mov ecx, dword [sym.imp.MSVCR80.dll___winitenv]
mov dword [ecx], eax
push dword [0x1038824]
push dword [0x1038828]
push dword [0x1038820]
call fcn.0101c5b5
add esp, 0xc
mov dword [0x1038838], eax
cmp dword [0x103882c], ebx
jne 0x1025e79
push eax
call dword [sym.imp.MSVCR80.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR80.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x103883c], ebx
jne 0x1025e87
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1038838]
call fcn.01026501
ret
call fcn.01025a87
jmp 0x1025d23

Function at 0x1028e29
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [ebp + 0x10]
jle 0x1028e66
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1028e43
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1028e82
dec esi
je 0x1028e7b
dec esi
jne 0x1028e87
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x102a2f8
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebx + 4], eax
xor eax, eax
cmp byte [ebp + 0x24], al
mov dword [ebx + 0x10], ecx
mov ecx, dword [ebp + 0x10]
push edi
mov word [ebx + 0xc], ax
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], eax
jne 0x102a342
mov ecx, 0x2000
lea edi, [esi + 0x8000]
rep movsd dword es:[edi], dword [esi]
mov word [ebx + 0x2c], ax
mov dword [ebx + 0x30], eax
call fcn.01029d45
mov eax, dword [ebx + 0x14]
and dword [ebx + 0x20], 0
mov ecx, 0x8000
push 2
mov word [ebx + 0x3c], cx
mov dword [ebx + 0x34], ecx
add eax, ecx
pop edx
movzx edi, byte [eax]
mov esi, dword [ebx + 0x20]
shl esi, 5
xor esi, edi
and esi, 0x7fff
inc eax
dec edx
mov dword [ebx + 0x20], esi
jne 0x102a366
cmp byte [ebp + 0x24], 0
je 0x102a38d
mov edi, ebx
call fcn.01029b99
jmp 0x102a39c
xor eax, eax
mov edx, dword [ebx + 0x18]
and word [eax + edx], 0
inc eax
inc eax
dec ecx
jne 0x102a38f
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.01028fac
push 0x4b
pop edx
call fcn.01028fac
call fcn.0102a077
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
je 0x102a3d6
mov edi, dword [ebx + 0x14]
mov ecx, 0x2000
lea esi, [edi + 0x8000]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x28]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24
Function at 0x40d769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x411190
cmp edx, dword [eax]
je 0x40d78b
add eax, 8
inc ecx
cmp eax, 0x411220
jl 0x40d77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x411190]
jne 0x40d8b9
mov eax, dword [0x411bb0]
cmp eax, 1
je 0x40d893
test eax, eax
jne 0x40d7bc
cmp dword [0x4110e4], 1
je 0x40d893
cmp edx, 0xfc
je 0x40d8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40d7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040e670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040e490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40d836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040e490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41045c
push edi
call fcn.0040ef00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040e670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040e680
lea eax, [ebp - 0xa0]
push 0x41043c
push eax
call fcn.0040e680
push dword [esi + 0x411194]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040e680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040ee75
add esp, 0x2c
pop edi
jmp 0x40d8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x411194]
push 0
push eax
push dword [esi]
call fcn.0040e490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6e6459a1
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6d5a4ab8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40313c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004043e8
test esi, esi
jne 0x403172
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004044d8
jmp 0x403190
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403040
mov edi, eax
test esi, esi
je 0x403190
cmp dword [ebx], 0
je 0x403190
dec esi
jmp 0x403179
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4036f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x412020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403790
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403770
xor eax, eax
push ebp
push 0x403769
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4037ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403770
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x412020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x412020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404268
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x446044], 0
je 0x4042c9
cmp word [0x446218], 0xd7b2
jne 0x404291
cmp dword [0x446220], 0
jbe 0x404291
mov eax, 0x446214
call dword [0x446230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x412758
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042f0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41202c], 0
jne 0x4042e5
push 0
push 0x412750
push 0x412758
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405478
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4056a8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4054fb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4056a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4054fb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4056c4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405584
xor eax, eax
push ebp
push 0x40557d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004052b4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405562
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4056e4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405562
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405584
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40569e
cmp byte [ebp - 0xd], 0
jne 0x4055cb
cmp byte [ebp - 0x12], 0
je 0x40569e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4055e4
dec ebx
cmp byte [ebx], 0x2e
je 0x4055f3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4055e3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40569e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405630
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40569e
cmp byte [ebp - 0xd], 0
je 0x40569e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40569e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405584
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4056a8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4054fb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4056a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4054fb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4056c4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405584
xor eax, eax
push ebp
push 0x40557d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004052b4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405562
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4056e4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405562
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405584
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40569e
cmp byte [ebp - 0xd], 0
jne 0x4055cb
cmp byte [ebp - 0x12], 0
je 0x40569e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4055e4
dec ebx
cmp byte [ebx], 0x2e
je 0x4055f3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4055e3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40569e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405630
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40569e
cmp byte [ebp - 0xd], 0
je 0x40569e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40569e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409998
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4099d1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044d8
jmp 0x4099da
mov eax, ebx
mov edx, esi
call fcn.0040443c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4099e4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409a06
movzx eax, byte [esp]
jmp 0x409a08
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a098
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x409f10
mov eax, dword [0x4457c0]
cmp byte [eax], 0
je 0x40a114
mov eax, dword [0x4456e8]
call fcn.00403200
call fcn.00402eac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004072d4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a15c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a14a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4456c8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4487f0]
call fcn.0040525c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40fb8c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x44a9dc
mov eax, ebx
mov edx, 8
test al, 1
je 0x40fba8
shr eax, 1
xor eax, 0xedb88320
jmp 0x40fbaa
shr eax, 1
dec edx
jne 0x40fb9b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x40fb94
pop ebx
ret
Function at 0x40fca4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov byte [ebp - 1], 0
mov edi, dword [ebp + 0xc]
jmp 0x40fd47
mov eax, dword [edi + 0xc]
add eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0xc], eax
mov esi, dword [edi + 0x10]
add esi, dword [ebp + 8]
mov ebx, esi
cmp dword [edi + 4], 0xffffffff
jne 0x40fd3f
mov esi, dword [edi]
add esi, dword [ebp + 8]
jmp 0x40fd3f
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40fd34
test byte [esi + 3], 0x80
je 0x40fd10
mov eax, dword [esi]
and eax, 0xffff
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx], eax
jmp 0x40fd24
mov eax, dword [ebp + 8]
add eax, dword [esi]
add eax, 2
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
cmp dword [ebx], 0
je 0x40fd5b
add esi, 4
add ebx, 4
cmp dword [esi], 0
jne 0x40fce3
add edi, 0x14
cmp dword [edi + 0x10], 0
je 0x40fd57
cmp dword [edi + 0xc], 0
jne 0x40fcb9
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40fd68
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x40fee9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.0040fbf0
test al, al
jne 0x40fda9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40fef3
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0x3c]
add edi, dword [ebp - 4]
cmp dword [edi], 0x4550
je 0x40fdc7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40fef3
mov ebx, edi
add ebx, 0xf8
mov eax, dword [edi + 0x50]
test eax, eax
jne 0x40fde3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40fef3
push 0x40
push 0x3000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
test esi, esi
jne 0x40fe05
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40fef3
movzx eax, word [edi + 6]
mov dword [ebp - 0x10], eax
mov ecx, ebx
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00405c24
mov eax, dword [ebp - 0x10]
dec eax
test eax, eax
jl 0x40fe50
inc eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
add edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
add eax, esi
call fcn.00405c24
add ebx, 0x28
dec dword [ebp - 0x18]
jne 0x40fe35
mov eax, dword [edi + 0xa0]
test eax, eax
je 0x40fe6f
mov edx, dword [edi + 0xa4]
push edx
mov ecx, eax
add ecx, esi
mov eax, dword [edi + 0x34]
mov edx, esi
call fcn.0040fc30
mov eax, dword [edi + 0x80]
add eax, esi
push eax
push esi
call fcn.0040fca4
test al, al
jne 0x40fe8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40fef3
mov ebx, esi
mov dword [ebx + 0x4c], 0xbc610f
mov eax, dword [ebp - 8]
mov dword [ebx + 0x44], eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0x50], eax
push 0x40
push 0x1000
mov eax, dword [ebx + 0x44]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x48]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405c24
mov eax, dword [edi + 0x28]
mov edx, eax
add edx, esi
mov ebx, edx
test eax, eax
je 0x40fedf
push 0
push 1
push esi
call ebx
test eax, eax
je 0x40fedf
mov dword [ebp - 0xc], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40fef3
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4011f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x40b394], 0
push esi
jne 0x401227
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x401201
mov dword [ecx*4 + 0x40b390], eax
inc ecx
cmp ecx, 0x100
jl 0x4011fc
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x401258
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x40b390]
xor eax, esi
inc ecx
dec edx
jne 0x40123a
pop edi
not eax
pop esi
ret 0xc
Function at 0x402ae5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x425f70]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402b79
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402b36
cmp dword [ebp + 0x10], ebx
jne 0x402b6d
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402ae5
test eax, eax
jne 0x402b48
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402b1d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00407b6b
cmp eax, ebx
je 0x402b80
push ebx
push dword [0x425f70]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402b79
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x425f70], ebx
jne 0x402b76
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402b76
jmp 0x402b79