joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409af4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea ebx, [edx + 0x982]
push edi
mov edi, dword [ebp + 0x18]
mov eax, esi
add ecx, 0xffffc9d2
xor eax, 0x2fa9
add edi, 0x998
cmp eax, ecx
je 0x409c28
xor edx, 0x2627
xor esi, 0x195b
cmp edx, esi
jge 0x409c09
mov eax, dword [0x93113c]
xor ebx, ebx
mov esi, dword [ebp + 0x20]
mov dword [eax + 0xd4], 0x976898
mov edx, dword [0x93113c]
mov eax, dword [0x976950]
add eax, 0x7e3c45
mov ecx, dword [edx + 0x4c]
sub ecx, dword [esi + 0x80]
add eax, ecx
mov dword [0x976950], eax
mov eax, dword [edx + 0x98]
mov ecx, dword [eax + ebx]
mov eax, dword [0x976930]
xor ecx, dword [0x976920]
mov dword [ebx + eax], ecx
add ebx, 4
mov eax, dword [0x976934]
add dword [esi + 0x88], eax
mov ecx, dword [0x93113c]
mov eax, dword [ecx + 0x60]
sub eax, 0x85fa10
add dword [ecx + 0x3c], eax
mov eax, dword [0x9768f8]
add eax, 0xff7a05f0
xor dword [0x9768e4], eax
cmp ebx, 0x17a6dc
jl 0x409b4f
mov ecx, dword [0x93113c]
mov ebx, dword [0x976930]
mov dword [0x976924], ebx
mov edx, dword [esi + 0x58]
cmp dword [ecx + 0x60], edx
je 0x409bfa
push dword [esi + 0xe4]
mov eax, dword [ecx + 0xd8]
add eax, dword [esi + 0x94]
push eax
push dword [ecx + 0xd4]
call ebx
mov dword [esi + 0xc0], eax
jmp 0x409c28
mov eax, dword [esi + 0x3c]
xor eax, edx
add eax, 0x26933
add dword [esi + 0x60], eax
jmp 0x409c28
mov ecx, dword [ebp + 0x20]
mov eax, dword [0x97691c]
xor eax, ebx
add dword [ecx + 0xc], eax
mov eax, dword [ecx + 0x60]
add dword [ecx + 0x4c], 0xffffd9d9
or eax, 0x1bc1
imul edi, eax
xor edi, 0x2d9
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x409cb0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, ecx
push esi
mov esi, dword [ebp + 8]
xor edx, 0x2fa8
add esi, 0xffffcac2
lea eax, [esi + 0x2465]
cmp edx, eax
je 0x409d97
add ecx, 0xffffd058
lea eax, [edx + 0x270f]
cmp ecx, eax
jg 0x409d62
mov ecx, dword [0x93113c]
mov edx, dword [ebp + 0x10]
mov eax, dword [ecx + 0xd0]
cmp eax, dword [0x976940]
je 0x409d1e
mov eax, dword [0x976918]
mov ecx, dword [ecx + 0xa4]
add eax, 0xff7d074c
add eax, ecx
imul eax, dword [edx + 0x20]
mov dword [edx + 0x20], eax
mov ecx, dword [0x93113c]
jmp 0x409d34
mov eax, dword [0x9768f8]
sub eax, dword [edx + 0xa4]
add eax, 0x11eeb
or dword [0x9768e4], eax
cmp dword [edx + 0x20], 0x17699
jb 0x409d4f
mov eax, dword [ecx + 0xdc]
add eax, dword [ecx + 0x28]
imul eax, dword [ecx + 0x7c]
mov dword [ecx + 0x7c], eax
jmp 0x409d97
mov eax, dword [ecx + 0x68]
sub eax, dword [ecx + 0xb8]
sub eax, 0x36f00
mov dword [ecx + 0x38], eax
jmp 0x409d97
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov eax, dword [0x93113c]
and ecx, esi
or ecx, 0x322e
cmp dword [eax + 0x7c], ecx
je 0x409d97
mov eax, dword [0x9768b0]
or edx, 0x1c3e
and eax, 0x345d
imul eax, eax, 0x2a8c
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov eax, dword [ebp + 0x18]
add eax, 0xa5a
pop esi
pop ebp
ret
Function at 0x40a884
Capabilities:
Get hostname

Disassembly:
push ecx
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push esi
lea ebx, [eax - 0x285]
add eax, 0xffffcdd2
push edi
mov edi, dword [esp + 0x34]
lea edx, [ecx - 0x132b]
lea esi, [ecx - 0x2eec]
mov dword [esp + 0x20], eax
mov ecx, eax
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x30]
xor ecx, 0x2bf7
lea eax, [edi + 0xf64]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], esi
lea ebp, [edi - 0x20d0]
mov edi, dword [esp + 0x28]
cmp eax, ecx
jl 0x40a9a7
mov ecx, dword [0x93113c]
mov eax, esi
xor eax, 0x2465
cmp ebp, eax
jg 0x40a90d
mov eax, dword [0x976968]
add edx, 0x189c
add eax, 0x9912f0e
xor dword [0x9768d0], eax
jmp 0x40a9ad
mov eax, dword [ecx + 0x44]
or eax, dword [ecx + 0x3c]
or eax, edi
cmp ebp, eax
jb 0x40a9ad
mov eax, dword [ebx + 0xa8]
and eax, 0x2627
add dword [ecx + 0x4c], eax
mov ecx, dword [0x93113c]
mov edx, dword [0x976940]
imul edx, dword [esp + 0x10]
mov eax, dword [ecx + 0xdc]
add eax, dword [ebx + 0xc8]
mov esi, dword [ecx + 0x74]
and esi, dword [ecx + 0x58]
mov ecx, dword [ebx + 0x84]
and ecx, dword [esp + 0x20]
imul edi, eax, 0x2e37
mov eax, dword [esp + 0x34]
sub eax, dword [0x9768b8]
add eax, 0xd86
push eax
mov eax, dword [esp + 0x2c]
add eax, ebp
imul eax, eax, 0x2bf7
push eax
push ecx
push edx
push ebx
push esi
push edi
call fcn.0040938e
mov ecx, dword [ebx + 8]
add esp, 0x1c
mov edi, dword [esp + 0x28]
xor ecx, edi
push ecx
mov ecx, dword [ebx]
xor ecx, eax
and ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ecx, dword [0x93113c]
cmp dword [0x976950], 0x14792
jb 0x40a9cd
mov eax, dword [ebx + 0xb8]
sub eax, 0x1d072
add dword [ecx + 0x38], eax
mov ecx, dword [0x93113c]
cmp dword [ebx + 0x28], 0x17d3d
jb 0x40a9dd
add dword [ecx + 0x38], 0xfffffded
push ebx
lea eax, [esi + 0x2400]
push eax
lea eax, [edx - 0xe87]
push eax
mov eax, ebp
xor eax, 0x2fa8
push eax
lea eax, [ebp + 0x270f]
push eax
mov eax, dword [esp + 0x34]
add eax, 0x3034
push eax
lea eax, [esi + 0x345d]
push eax
call fcn.0040b844
add esp, 0x1c
lea eax, [edi - 0x982]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x40b654
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
lea esi, [eax - 0x2465]
mov edi, ebp
lea edx, [eax + 0x9f1]
xor edi, 0xf79
lea eax, [ebp + 0x506]
mov dword [esp + 0x14], edx
lea ebx, [ebp + 0x330]
cmp esi, eax
je 0x40b7a8
mov edi, dword [esp + 0x2c]
lea eax, [ebp + 0x1622]
push eax
lea eax, [edi + 0x3ab]
push eax
mov eax, esi
xor eax, 0x2fa9
push 0x976898
push eax
mov eax, esi
xor eax, 0x2fa8
push eax
call fcn.00408170
mov dword [esp + 0x28], eax
xor esi, 0x2465
push 0x976898
lea eax, [edi + 0x3ca]
push eax
lea eax, [ebx - 0x23]
push eax
push esi
lea eax, [edi - 0x68c]
push eax
push edi
call fcn.00408d09
mov ecx, dword [0x976950]
add esp, 0x2c
mov esi, dword [esp + 0x18]
xor ebx, 0x12f2
mov edi, eax
cmp ecx, dword [0x97693c]
jb 0x40b712
mov ecx, dword [0x9768f0]
xor ecx, dword [0x9768a0]
add ecx, 0x2eb331ab
xor dword [esi + 0x1c], ecx
mov eax, dword [esi]
sub eax, 0x75159
mov dword [esi + 0x50], eax
mov eax, 0xf67a854d
sub eax, dword [esi + 0xd0]
mov ecx, dword [0x93113c]
add dword [ecx + 0x50], eax
mov ecx, 0xffe99cf5
mov eax, dword [0x93113c]
sub ecx, dword [eax + 0xdc]
lea eax, [ebp + 0x1467]
add dword [esi], ecx
push dword [0x93113c]
push eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffff809
push eax
mov eax, dword [esp + 0x38]
add eax, 0xfffffc83
xor eax, 0x128
push eax
lea eax, [ebp + 0xe1c]
push eax
lea eax, [ebx - 0x6be]
xor eax, 0x13e9
push eax
call fcn.0040884e
mov ecx, dword [esi + 0x50]
add esp, 0x18
jmp 0x40b79e
mov eax, ecx
imul eax, ecx
add dword [esi + 0xa0], eax
mov eax, dword [esi + 8]
dec eax
xor dword [0x976950], eax
inc ecx
cmp ecx, dword [esi + 0x54]
jbe 0x40b788
jmp 0x40b839
mov ebx, dword [esp + 0x18]
mov eax, edx
mov ecx, dword [0x93113c]
sub eax, dword [ebx + 0x74]
cmp esi, eax
jae 0x40b80a
mov eax, edi
or eax, edx
mov edx, dword [ecx + 0x7c]
cmp edx, eax
jne 0x40b80a
lea eax, [edx + 0x2a8c]
imul eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebx + 0xd0]
and eax, edi
and eax, 0x2627
push eax
mov eax, dword [0x93113c]
mov eax, dword [eax + 0x70]
xor eax, dword [0x9768f8]
add eax, esi
push eax
lea eax, [edi + esi]
imul eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [0x93113c]
mov eax, dword [ecx + 0xa4]
and eax, esi
cmp esi, eax
jne 0x40b839
mov eax, dword [ebx + 0xdc]
sub esi, edi
xor eax, edi
or eax, dword [ebx + 0xac]
xor dword [ecx + 0x20], eax
lea ecx, [ebp + 0x330]
mov eax, dword [0x93113c]
or esi, ecx
xor dword [eax + 0x74], esi
lea eax, [edi - 0xa5e]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40b844
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x14]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
lea ecx, [eax - 0xe87]
mov dword [esp + 0x18], ecx
lea ebx, [edx - 0x2fa8]
mov ecx, dword [esp + 0x28]
xor edx, 0x195a
xor ecx, 0xaec
mov dword [esp + 0x20], edx
lea ebp, [edi - 0x5a8]
add eax, 0xfffffbd7
xor edi, 0x1ab8
mov dword [esp + 0xc], ebp
cmp ecx, eax
jge 0x40ba20
push esi
mov esi, dword [esp + 0x30]
cmp edi, edx
jg 0x40b8fc
mov eax, 0x1a12d3
sub eax, dword [esi + 0xb8]
add dword [0x9768d0], eax
mov eax, dword [0x93113c]
add dword [eax + 0x38], 0xffffeb07
mov edx, dword [0x93113c]
mov eax, dword [0x976900]
add eax, 0xff669428
mov ecx, dword [edx + 0x80]
add ecx, eax
mov eax, dword [edx + 0xa8]
add eax, 0x40
push eax
push ecx
push dword [esi + 0x38]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [eax + 0x8000]
mov eax, dword [0x93113c]
mov dword [eax + 0x98], ecx
jmp 0x40b921
mov eax, dword [esi + 0x58]
or eax, 0x353e
cmp dword [0x9768f0], eax
jb 0x40b921
mov eax, dword [0x93113c]
mov eax, dword [eax + 0x68]
and eax, 0x2a8c
sub eax, edi
or dword [0x97691c], eax
lea eax, [ebx + 0x2eec]
cmp dword [esp + 0x1c], eax
jge 0x40ba1f
lea eax, [ebp + 0x16b]
cmp edi, eax
je 0x40ba1f
lea eax, [edi + 0xc66]
cmp ebx, eax
jg 0x40b95c
mov eax, dword [esi + 0xd0]
add eax, 0x98562b8
mov dword [esi + 0x78], eax
jmp 0x40ba1f
mov eax, ebx
mov dword [esp + 0x2c], ebp
and eax, dword [esi + 0x60]
mov edi, ebp
cmp ebp, eax
jne 0x40ba1f
mov edx, dword [0x9768dc]
mov eax, dword [esi + 0xc8]
add eax, edx
mov dword [esp + 0x18], ebp
cmp ebp, eax
je 0x40ba0b
mov edi, dword [esp + 0x1c]
mov ebp, edi
or ebp, ebx
mov eax, dword [esi + 0x28]
imul eax, edi
push ebx
push eax
mov eax, dword [0x93113c]
mov ecx, dword [eax + 0xa4]
xor ecx, 0x2465
sub ecx, dword [eax + 0xbc]
mov eax, dword [0x97691c]
or eax, 0x270f
xor eax, dword [0x9768b0]
push ecx
push eax
mov eax, dword [esi + 0x60]
or eax, ebx
sub eax, dword [0x9768f8]
push ebp
push eax
imul eax, dword [0x976948], 0x2fa8
and eax, dword [0x9768e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 0xc8]
add ecx, 2
mov edx, dword [0x9768dc]
add eax, edx
mov dword [esp + 0x18], ecx
cmp ecx, eax
jne 0x40b991
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x2c]
mov ecx, ebx
add edi, 3
and ecx, dword [esi + 0x60]
mov dword [esp + 0x2c], edi
cmp edi, ecx
je 0x40b975
pop esi
mov eax, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10003370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000337f
pop dword [ebp - 0x10]
mov eax, 0x1000337f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xe747e1c4
add dword [ebp - 0x20], 0x670a6387
mov dword [ebp - 0x1c], 0xfa456aa0
add dword [ebp - 0x1c], 0x37ede1a5
mov dword [ebp - 0x18], 0x8749eb9e
sub dword [ebp - 0x18], 0x3afda770
mov dword [ebp - 0x14], 0xfa7a479c
add dword [ebp - 0x14], 0x585b864
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xaf453495
sub dword [ebp - 0x20], 0x3ad2cb3f
mov dword [ebp - 0x1c], 0x2cb64718
add dword [ebp - 0x1c], 0x14b61a5d
mov dword [ebp - 0x18], 0x3f2e0270
sub dword [ebp - 0x18], 0xdbbe9604
mov dword [ebp - 0x14], 0xd9edaebe
add dword [ebp - 0x14], 0x26125142
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x9d00acf4
add eax, 0x73010320
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3bebc
push 0
call eax
mov ecx, 0x3e81
xor ebx, ebx
add ebx, eax
mov edx, 0x1002b000
add edx, dword [ebp - 0x10]
mov edi, 0x6ec7fc5c
xor dword [ebp - 4], 0xa652393a
mov esi, dword [edx]
mov dword [ebp - 0xc], 0x17c76a59
add esi, edi
xor dword [ebp - 4], 0xcface4fc
mov dword [ebx], esi
add ebx, 4
add edx, 4
loop 0x10003487
add eax, 0xe41f5939
sub eax, 0xe41e6c62
mov ebx, eax
add eax, 0x906b404d
sub eax, 0x906b4048
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x9ed058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9ed1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9ed07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ed06a
add dl, dl
jne 0x9ed089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ed0dc
xor eax, eax
add dl, dl
jne 0x9ed096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ed17d
add dl, dl
jne 0x9ed0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ed0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ed0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ed0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9ed0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9ed075
mov eax, 1
add dl, dl
jne 0x9ed0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ed0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ed0e1
sub eax, ebx
mov ebx, 1
jne 0x9ed128
mov ecx, 1
add dl, dl
jne 0x9ed10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9ed119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ed105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ed075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9ed13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9ed14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ed136
cmp eax, 0x7d00
jae 0x9ed16d
cmp eax, 0x500
jb 0x9ed168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ed075
cmp eax, 0x7f
ja 0x9ed170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ed075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9ed19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9ed075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4109a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x57d718]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 8], ax
mov ecx, esi
push 0xc
mov dword [ebp - 0x24], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x55005c
mov dword [ebp - 0x1c], 0x690074
mov dword [ebp - 0x18], 0x73006c
mov dword [ebp - 0x14], 0x63005c
mov dword [ebp - 0x10], 0x660065
mov dword [ebp - 0xc], 0x390036
call fcn.0040c2a0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004bddc0
mov esp, ebp
pop ebp
ret 4

Function at 0x410a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x57d718]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x18
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x55005c
mov dword [ebp - 0x34], 0x690074
mov dword [ebp - 0x30], 0x73006c
mov dword [ebp - 0x2c], 0x63005c
mov dword [ebp - 0x28], 0x660065
mov dword [ebp - 0x24], 0x390036
mov dword [ebp - 0x20], 0x43005c
mov dword [ebp - 0x1c], 0x660065
mov dword [ebp - 0x18], 0x690056
mov dword [ebp - 0x14], 0x770065
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
call fcn.0040c2a0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bddc0
mov esp, ebp
pop ebp
ret 4

Function at 0x410ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
xor eax, eax
mov dword [ebp - 0x34], 0x55005c
push edi
mov dword [ebp - 0x30], 0x690074
mov dword [ebp - 0x2c], 0x73006c
mov dword [ebp - 0x28], 0x63005c
mov dword [ebp - 0x24], 0x660065
mov dword [ebp - 0x20], 0x390036
mov dword [ebp - 0x1c], 0x43005c
mov dword [ebp - 0x18], 0x660065
mov dword [ebp - 0x14], 0x690056
mov dword [ebp - 0x10], 0x770065
mov dword [ebp - 0xc], 0x65002e
mov dword [ebp - 8], 0x650078
mov word [ebp - 4], ax
call fcn.004066f0
mov ecx, eax
test ecx, ecx
je 0x410b8c
mov eax, dword [ecx]
push 2
push 0x18
call dword [eax]
test eax, eax
je 0x410b96
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x18
jl 0x410b82
mov dword [eax - 0xc], 0x18
xor eax, eax
mov ecx, dword [esi]
push 0x30
mov word [ecx + 0x30], ax
lea eax, [ebp - 0x34]
push eax
push 0x30
push dword [esi]
call fcn.00406de0
add esp, 0x10
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062e0
push 0x80004005
call fcn.004062e0
call fcn.00406d10
int3
Function at 0x525442
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005250e4

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4203c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x4203d6
pop dword [ebp - 0x14]
mov eax, 0x4203d6
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xe5374021
add dword [ebp - 0x24], 0x691b052a
mov dword [ebp - 0x20], 0x31b10a1d
add dword [ebp - 0x20], 0x824228
mov dword [ebp - 0x1c], 0x3d5ca923
add dword [ebp - 0x1c], 0xeef9b0b
mov dword [ebp - 0x18], 0xdeaa05c1
sub dword [ebp - 0x18], 0xdeaa05c1
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x350d039a
add dword [ebp - 0x24], 0x3f6565bc
mov dword [ebp - 0x20], 0xf7ec3c7f
add dword [ebp - 0x20], 0x498024f6
mov dword [ebp - 0x1c], 0x4ea0fb8d
sub dword [ebp - 0x1c], 0xeb318f21
mov dword [ebp - 0x18], 0xfadbc26b
sub dword [ebp - 0x18], 0xfadbc26b
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x16420f6e
add eax, 0xea0021b6
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x40302
push 0
call eax
mov ecx, 0x235de0e
add ecx, 0xfdca72e9
mov ebx, eax
mov esi, 0x434400
add esi, dword [ebp - 0x14]
mov edi, 0xa05fcb4
xor dword [ebp - 4], edx
mov edx, dword [esi]
sub dword [ebp - 4], edi
sub edx, edi
xor dword [ebp - 0xc], ebx
mov dword [ebx], edx
add ebx, 0x5f7dd58f
add ebx, 0xa0822a75
add esi, 0xf060606d
add esi, 0xf9f9f97
loop 0x4204e2
add eax, 0x7ceb25c4
add eax, 0x831610eb
mov ebx, eax
add eax, 5
mov ecx, 0xc49acf76
sub ecx, 0xc45acf76
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x405c83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4345c0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405caf
push edi
call esi
cmp eax, 0xffffffff
jne 0x405cf1
test ebx, ebx
je 0x405cee
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x405ce8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
mov eax, esi
jmp 0x405cf1
call fcn.00401abd
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406306
Capabilities:
Get disk information

Disassembly:
mov eax, 0x434664
call fcn.004339e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041c900
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x4063d4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406342
mov eax, ebx
add eax, eax
push eax
call fcn.0040b97d
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x4063cd
cmp ebx, dword [ebp - 0x14]
ja 0x4063cd
lea ecx, [ebp - 0x2c]
call fcn.004028e9
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x4063b5
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4063aa
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.0040b97d
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406380
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401abd
push esi
call fcn.00401abd
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x4063d6
push esi
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40b97d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40b98c
pop dword [ebp - 0x3c]
mov eax, 0x40b98c
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3d522
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x5183
xor edi, edi
add edi, eax
mov edx, 0x44c600
add edx, dword [ebp - 0x3c]
mov esi, 0xf13bfee
add esi, 0x2b5028d9
mov dword [ebp - 0x24], 0x862a9abb
mov ebx, dword [edx]
add dword [ebp - 0x34], 0xeb3c78b2
xor ebx, esi
sub dword [ebp - 0x2c], 0x3b076ee3
mov dword [edi], ebx
xor dword [ebp - 0x14], ebx
add edi, 4
add edx, 0xbfd92c80
sub edx, 0xbfd92c7c
loop 0x40b9d7
add eax, 0xb933f771
sub eax, 0xb932be92
mov ebx, eax
add eax, 0x98840c5
add eax, 0xf677bf40
mov ecx, 0xd59d8b25
add ecx, 0x2aa274db
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret