joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c6991
Capabilities:
Enumerate pe sections
Execute anti-debugging instructions

Disassembly:
mov dword [eax + 4], ecx
clc
cmc
call fcn.005dcfff
mov dword [esp + 0x20], eax
pushal
lea esp, [esp + 0x40]
jle 0x5e876a
push 0xa5f50899
lea esp, [esp + 4]
call 0x5addeb
rcl cx, 6
bt edi, 7
add esp, 4
shld ecx, edi, 0x1a
mov ecx, dword [ebp + 8]
shrd dx, bx, 8
mov edx, dword [ebp + 8]
sbb ah, al
pushal
adc ax, 0x1f73
sal al, cl
sub edx, dword [ecx + 8]
and cl, 0xf2
sar al, 3
pop eax
mov dword [ebp - 0x1c], edx
aaa
mov eax, dword [ebp + 0xc]
xadd ecx, edx
bswap ecx
mov dword [ebp - 0x14], eax
cdq
rcl dh, 6
shrd cx, sp, 3
shl cl, 5
mov ecx, dword [ebp - 0x14]
btr dx, bx
stc
and edx, 0x9fc9683c
shl dl, 2
mov dword [ebp - 0xc], ecx
pushfd
lea ecx, [edx - 0x557f776a]
sar cx, cl
mov edx, dword [ebp - 0xc]
btc cx, 8
cmc
mov eax, dword [ebp - 0xc]
ror cx, 0xe
add eax, dword [edx + 0x3c]
test bp, 0x53cb
sar cl, 2
rcl ecx, cl
bts cx, bp
mov dword [ebp - 8], eax
bsr cx, ax
aas
dec ah
and cl, al
mov ecx, dword [ebp - 8]
das
mov ah, byte [esp + 0xc]
btc ax, 1
xor edx, edx
call fcn.005c9245
pushfd
pushal
jmp 0x5cea43

Function at 0x5ce885
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ch
mov dword [eax], 0
cmc
cmp dl, 0xe
btr cx, 4
clc
mov ecx, dword [ebp + 0x14]
cmp cl, bl
mov dword [ecx + 4], 1
clc
call fcn.005d1e6d
mov dword [ecx + 4], 0
rdtsc
add ax, 0x1935
mov edx, dword [ebp - 0xc]
pushal
mov dword [edx], 1
adc ax, 0x3b52
rdtsc
mov eax, dword [ebp - 0xc]
cmp bl, al
xor cl, ah
pop ecx
shl ch, cl
mov ecx, dword [ebp - 4]
sal dx, 0xd
mov dword [eax + 8], ecx
bsf dx, di
mov edx, dword [ebp - 0xc]
das
cwde
mov eax, dword [ebp - 8]
sal cx, 1
pop ecx
mov dword [edx + 0xc], eax
cmc
btc dx, 1
bts cx, cx
mov ecx, dword [ebp - 0xc]
sal dh, 6
or ecx, 0x80000000
ror dl, cl
push edx
mov edx, dword [ebp + 8]
mov byte [esp + 8], 0xbe
mov dword [edx], ecx
bt ax, 0xb
bt cx, bp
clc
pushfd
cmp dword [ebp + 0x14], 0
mov byte [esp + 8], cl
pushal
push esi
lea esp, [esp + 0x44]
je 0x5b988a
invalid
shrd ax, dx, cl
aam 0x17
sal cx, 0xf
mov eax, dword [ebp + 0x14]
bswap cx
jmp 0x5c34d6
mov byte [esp + 4], 0x21
lea esp, [esp + 8]
je 0x5d5a43
bsr dx, ax
sub dl, al
aam 4
mov ecx, dword [ebp - 0xc]
jmp 0x5cba3b
Function at 0x5cea02
Capabilities:
Enumerate pe sections
Execute anti-debugging instructions

Disassembly:
dec dh
mov dword [ebp - 0x20], ecx
bsf dx, sp
sbb dx, 0xa33b
lea edx, [0xe49ec282]
inc dx
mov edx, dword [ebp - 0x20]
pushal
push 0xb68cda9e
test bl, 0x36
cmp edx, dword [ebp - 0x1c]
push dword [esp + 0xc]
mov byte [esp + 0x10], dl
call fcn.005df5cf
jmp 0x5c9b90
btr ax, 9
das
jmp 0x5dc35b
cmc
cmc
sub ecx, ecx
bswap cx
mov cx, word [eax + 6]
cmp cl, bh
cmp dword [ebp - 0x10], ecx
jmp 0x5deb7c
sub ecx, 0xd1b458f2
pushfd
call fcn.005dd571
lea esp, [esp + 0x10]
je 0x5cea2f
or ah, ah
lahf
mov edx, dword [ebp + 0x14]
adc eax, 0x70cfaa13
setbe ch
mov eax, dword [edx]
sal dl, cl
test dl, dl
mov dword [ebp - 0x10], eax
cmp ax, 0x174f
and dh, 0xe8
mov ecx, dword [ebp - 4]
shl dl, cl
mov edx, dword [ecx + 0xc]
call fcn.005d62d8
lea esp, [esp + 0x24]
call 0x5addeb
pushfd
add esp, 8
push esp
aas
mov ecx, dword [ebp + 8]
ror ax, cl
sbb ah, bh
setae dl
sub ah, ah
mov edx, dword [ebp + 8]
rcr al, 6
shr al, cl
bsr eax, esp
sar al, cl
sub edx, dword [ecx + 8]
inc ch
sub ch, 0x87
cwde
mov dword [ebp - 0x1c], edx
aaa
rcr eax, 0x1f
movsx dx, al
mov eax, dword [ebp + 0xc]
mov dx, 0x4994
shld cx, si, cl
jmp 0x5db9d8
mov dword [ebp - 0x14], eax
cdq
or cl, 0x91
mov ecx, dword [ebp - 0x14]
bts dx, 9
das
rdtsc
xadd dx, ax
mov dword [ebp - 0xc], ecx
btr ax, bp
sal ax, cl
cwde
mov edx, dword [ebp - 0xc]
cmc
clc
mov eax, dword [ebp - 0xc]
shl cl, 4
add eax, dword [edx + 0x3c]
adc ecx, esi
rcl cx, 1
movsx cx, cl
mov dword [ebp - 8], eax
aad 0x3f
rcl cx, cl
dec al
cwde
mov ecx, dword [ebp - 8]
daa
daa
bswap eax
dec ah
xor edx, edx
movzx dx, cl
mov dx, word [ecx + 0x14]
lea ecx, [ecx*4 + 0x70378fd3]
mov eax, dword [ebp - 8]
bswap ecx
movzx cx, dl
push esi
pop ecx
lea ecx, [eax + edx + 0x18]
mov byte [esp], bl
pushal
pushfd
pushfd
mov dword [ebp - 4], ecx
mov byte [esp + 8], al
mov dword [ebp - 0x10], 0
pushfd
lea esp, [esp + 0x30]
jmp 0x5c22da
mov eax, dword [ebp - 8]
jo 0x5c00d8
test dh, 0xa7
xor ecx, ecx
rol ch, 2
shld cx, di, cl
mov cx, word [eax + 6]
push 0x24ff290f
cmp dword [ebp - 0x10], ecx
mov dword [esp], eax
lea esp, [esp + 4]
jge 0x5d8dd8
movzx ax, cl
mov edx, dword [ebp - 0x10]
rcr ah, 4
bswap ax
bswap cx
imul edx, edx, 0x28
rol cl, cl
bswap eax
sal al, 1
mov eax, dword [ebp - 4]
shl ch, cl
mov ecx, dword [ebp - 0xc]
cmp sp, 0xfa01
add ecx, dword [eax + edx + 0xc]
jmp 0x5bbba8
Function at 0x5d03cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edi + 0x6105bb05]
lea esp, [esp + 0x28]
jb 0x5d8d11
pushal
mov byte [esp], 0xfd
xchg dword [esp + 0x20], edi
pushfd
push dword [esp + 0x24]
ret 0x28
lea esp, [esp + 8]
je 0x5c8e4d
lea eax, [esp - 0x6a3cf96a]
movzx ax, cl
push ecx
mov eax, 0xc0000001
pushfd
pushal
pushfd
lea esp, [esp + 0x2c]
jmp fcn.005dd844
cmp dword [ebp - 8], 0
push edx
lea esp, [esp + 4]
jne 0x5c5504
bswap cx
rdtsc
pushal
mov eax, dword [ebp + 0x1c]
pushfd
xchg dword [esp + 0x20], eax
pop ecx
not cl
mov ecx, dword [ebp + 0x18]
pushal
bswap edx
mov dword [esp + 0x38], ecx
rdtsc
mov edx, dword [ebp + 0x14]
pop eax
push 0xa76995db
push 0x379e5bfd
movsx cx, bl
xchg dword [esp + 0x38], edx
lahf
pushfd
mov eax, dword [ebp + 0x10]
xchg cx, dx
call fcn.005e36a8
jmp 0x5bac4a
jmp 0x5e1776
lea esp, [esp + 0x30]
je 0x5dd958
pushal
stc
push dword [esp + 4]
stc
cmp dword [ebp + 0x18], 4
mov byte [esp], bl
lea esp, [esp + 0x24]
jne 0x5e75a1
pushfd
clc
push eax
cmp dword [ebp + 0x14], 8
jmp 0x5bda21
pushfd
xchg dword [esp + 4], edi
mov byte [esp], dh
push dword [esp + 4]
ret 8
aam 0x24
daa
mov edx, dword [ebp + 0x10]
aas
btr ecx, ecx
ror ah, cl
mov dword [ebp - 8], edx
bts ax, di
xor ecx, 0xfe518e5c
sub eax, 0x6a56bb09
mov eax, dword [ebp - 8]
xor cl, bh
and cl, 0x75
sal ch, cl
pushal
mov dword [eax], 7
adc ch, 0xaa
shrd ecx, edi, 9
shrd cx, dx, 3
sal ch, cl
mov ecx, dword [ebp - 8]
call fcn.005e497d
stc
mov dword [ebp - 8], 1
cmc
cmp ecx, 0x14e9c889
jmp 0x5c89bc

Function at 0x5d0a41
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi - 0x4122520c]
push 6
adc byte [ebp + 0x3e08fe94], cl
xor byte [esi + 0x45], ah
add byte [edi + 0x2a6705f0], ah
jae 0x5d0a57
inc eax
dec ebx
cmpsb byte [esi], byte es:[edi]
inc ebp
sub al, 0x9e
test eax, 0xf8b5f3ba
lahf
loop 0x5d0a18
stosd dword es:[edi], eax
cmp al, byte [esi + 0x48913ebd]
xchg byte [ebp + 0x50], bl
xor byte [edi - 0x47902302], dl
dec eax
xchg ebp, eax
das
adc ch, byte [esp + edi*2]
push esi
jne 0x5d0a1e
jb fcn.005d09e2
sub al, 0x81
enter 0xfffffffffffff49d, 0xffffffffffffffad
cld
jmp 0x7d817ffb
Function at 0x10001ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1000c543
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x1000e060]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x10001cb0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [sym.imp.MSVCR71.dll_fopen]
push edi
push 0x1000e2d8
push eax
call esi
mov edi, eax
add esp, 8
test edi, edi
jne 0x10001cd2
pop edi
xor al, al
pop esi
ret
mov ecx, dword [esp + 0x10]
push ebp
push 0x1000e268
push ecx
call esi
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x10001cf8
push edi
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 4
pop ebp
pop edi
xor al, al
pop esi
ret
push ebx
mov ebx, dword [esp + 0x1c]
push ebx
call fcn.1000bed8
push edi
push ebx
mov esi, eax
push 1
push esi
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x14
test eax, eax
pop ebx
jle 0x10001d26
push ebp
push eax
push 1
push esi
call dword [sym.imp.MSVCR71.dll_fwrite]
add esp, 0x10
push edi
mov edi, dword [sym.imp.MSVCR71.dll_fclose]
call edi
push ebp
call edi
push esi
call fcn.1000bf50
add esp, 0xc
pop ebp
pop edi
mov al, 1
pop esi
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [0x3d406ec8]
push eax
sbb dword [ebp - 0x2d8b66c0], 0x40
add byte [ecx - 0x4d], dl
popal
add byte [esi + 0x40], 0
sub dword [edx + eax - 0x3badffbf], 0xc
test eax, eax
je 0x401787
lodsb al, byte [esi]
push 0x9c40d274
call dword [0x40c1bb]

Function at 0x401790
Capabilities:
Terminate process

Disassembly:
nop
nop
jo 0x40174e
inc eax
add byte [eax - 0x7e1314ab], dl
push ebp
jmp 0x40177f
sub esp, 0x490000b8
add byte [ecx - 0x5f], cl
add byte [ecx - 0x5f], cl
js 0x40179e
inc ecx
add byte [ebp - 0x55b35e40], al
inc ecx
add byte [esp + 0x68], dh
inc eax
cmp al, 0x41
add byte [eax + 0x5e], dl
test eax, eax
mov eax, dword [0x41aa4c]
je 0x40178b
push 0x413c40
push eax
pop esi
sahf
inc eax
insd dword es:[edi], dx
add byte [esi - 0x6e], ah
or eax, 0x410274
jmp 0x4017cf
mov dword [0xdd1808], eax
mov eax, dword [0xb3410288]
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_printf]
mov word [0x410bb4], cx
test dword [0x915d759a], ecx
adc eax, 0x411800
push edx
push str.Benchmarking__s
call esi
mov eax, dword [0x410278]
add esp, 0x6e
test eax, eax
je 0x40187b
mov eax, dword [0x410174]
push eax
ret 0x3c40
adc byte [ebx + 0xb40bc8], ah
push 0
push ecx
push edx
push 0x544117f8
call fcn.00406010
test eax, eax
sbb al, 0xe
push eax
or byte [eax - 0x2c], dl
sti
add al, ch
mov byte [0x83000005], al
les ecx, [eax]
mov eax, dword [0x41027c]
test dword [ebp + 0x75], eax
xor eax, 0xa630aca1
add byte [ebx - 0x41cf63f3], cl
add byte [ebx - 0x273d96af], cl
add byte [edx], ch
sub bl, byte [ecx + edx*8 - 0x5eb2ffc0]
mov es, word [eax + 0x41]
add byte [ecx + 0x68], dl
dec eax
aam 0x62
add byte [edx + 0x50], dl
call fcn.00405890
add esp, 0x1c
mov dword [0x419f48], eax
jmp 0x4018e4
mov ecx, dword [0xff0280]
test ecx, ecx
xchg edx, eax
mov ecx, dword es:[0x41604c]
push 0
push 0x2cd19c
push 0x40d405
push 0x74d428
push eax
push ecx
cld
sar dword [edi], cl
add byte [eax], al
add esp, 0x18
ret 0x40bf
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x40000080
mov ecx, 0x1380059
xor ebx, ecx
mov edx, 0x402022
mov edi, 0x4028100
xor edx, edi
xor ebx, edx
mov edi, ebx
add esp, 0xfffffffc
mov dword [esp], edi
mov esi, 0x714b5542
xor esi, 0x5adfba16
mov edi, 0x1e27a61b
xor esi, edi
xor esi, 0x70c9d204
pop eax
xor esi, eax
mov eax, esi
mov edi, 0x5c5d12a4
mov ebx, 0xa3a2ed58
xor edi, ebx
add esp, edi
push 0x871d796
mov esi, 0x4969266e
pop edi
xor esi, edi
push esi
mov edx, 0x40088080
mov ebx, 0x1107178
xor edx, ebx
pop ecx
xor edx, ecx
xor edx, edx
jmp 0x403f1a

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4062ca
Capabilities:
Encode data using xor

Disassembly:
mov edi, ebx
add esp, 0xfffffffc
mov dword [esp], edi
push 0x71ed4539
mov edx, 0xc9bb3ab
pop ebx
xor edx, ebx
push edx
push 0x1d9a0304
mov esi, 0x2fb79339
pop edi
xor esi, edi
pop ecx
xor esi, ecx
mov ebx, 0
xor ebx, esi
mov ecx, ebx
xor ecx, 0xffffffff
and ecx, 0xffffffff
and ebx, 0
or ebx, ecx
and ebx, 0x4f5bf2af
and esi, 0xb0a40d50
or esi, ebx
mov edi, 0xfffffffc
add esp, edi
mov ebx, esp
mov dword [ebx], esi
mov edi, 0x17d9ef9
xor edi, 0x9659efb
mov ebx, 0x291217e2
mov edx, 0xd125fe6
xor edx, ebx
xor edi, edx
mov edx, edi
mov ebx, 0xffffffff
xor edx, ebx
and edx, 0x2c585806
and edi, 0xd3a7a7f9
or edi, edx
mov ebx, edi
mov esi, ebx
push esi
call eax
pop ecx
mov ecx, 0x1e384c1d
mov ebx, 0x1b07edb8
xor ebx, ecx
mov ecx, ebx
xor ecx, 0xffffffff
and ecx, 0x93660b8
and ebx, 0xf6c99f47
or ebx, ecx
add esp, 0xfffffffc
mov eax, esp
mov dword [eax], ebx
mov eax, 0x12027040
mov ebx, 0x12002ac
xor eax, ebx
push eax
push 0x311a5642
mov edx, 0x2e31e696
pop eax
xor edx, eax
pop esi
xor edx, esi
pop edi
xor edx, edi
mov edi, 0x6b8d24e6
xor edi, 0x3c1fd581
push edi
mov ebx, 0x6db3f491
xor ebx, 0x52d38d13
pop esi
xor ebx, esi
mov edi, ebx
push edi
mov esi, 0x292d87cf
xor esi, 0xe90f00f
mov ebx, 0x3f3ed5e5
mov eax, 0x70314b9e
xor eax, ebx
xor eax, esi
pop ecx
xor eax, ecx
mov esi, 0x18dd1d98
mov ecx, 0x6b0b0d64
xor ecx, esi
mov esi, 0x7a90136c
xor ecx, esi
mov esi, ecx
push esi
push 0x2ee8bac0
mov ecx, 0x6e318b3
pop esi
xor ecx, esi
mov esi, 0x7d537fb4
mov edi, 0x5c5e845c
xor edi, esi
xor edi, ecx
pop ebx
xor edi, ebx
mov ecx, 0
xor ecx, edx
mov ebx, ecx
push ebx
pop ecx
mov esi, 0xfffffffc
add esp, esi
mov dword [esp], ecx
xor esi, esi
add esi, edi
mov ebx, 0
mov ecx, 4
xor ebx, ecx
sub esp, ebx
mov dword [esp], esi
xor edx, edx
mov dl, byte [eax]
add edi, edx
mov dl, byte [edi]
pop edi
mov byte [eax], dl
mov ecx, 0x51e121c6
mov ebx, 0x1819286a
xor ebx, ecx
push 0xe65ffe6a
mov esi, 0x50580839
pop ecx
xor esi, ecx
xor esi, ebx
add eax, esi
pop edx
dec edx
mov ecx, 0x36547ea6
xor ecx, 0x6aeb5288
mov esi, 0x6724a775
xor ecx, esi
xor ecx, 0x3b9b8b5b
xor ecx, edx
or ecx, edx
jne 0x406414
push 0x5c99cda
mov ebx, 0x5899eda
pop edi
xor ebx, edi
mov edx, 0x28
mov esi, 0x400
xor edx, esi
xor ebx, edx
mov edx, 0xf6ca41
mov esi, 0x70082000
xor edx, esi
push edx
mov ecx, 0x6ba86e94
xor ecx, 0x1b56dcc7
pop edi
xor ecx, edi
xor ebx, ecx
call ebx
pop eax
pop eax
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x40108f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x401097
mov dword [ecx*4 + 0x503f60], eax
inc ecx
cmp ecx, 0x100
jb 0x401092
mov edx, 0x800
jmp 0x4010e4
mov eax, dword [ecx*4 + 0x503b60]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x503f60]
inc ecx
mov dword [ecx*4 + 0x503f5c], eax
cmp ecx, edx
jb 0x4010c3
mov dword [0x4fdd80], 0x401107
call fcn.00403d79
pop esi
test eax, eax
jne 0x401106
mov dword [0x4fdd80], 0x4011a3
ret

Function at 0x401993
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [esi]
test edi, edi
je 0x4019de
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x4019af
mov eax, edi
and dword [ebp + 0x10], 0
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x4019e4
test ecx, ecx
je 0x4019de
test edi, edi
ja 0x4019a4
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x403b26
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x403b3f
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x403b62
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x403b67
inc edi
cmp edi, dword [ebp - 4]
jb 0x403b59
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x403c5f
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x403bbe
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x403b92
cmp cl, 0xff
jne 0x403be9
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x403bf7
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x403bfe
dec ecx
shl edx, cl
and edx, 7
je 0x403b83
movzx ecx, byte [edx + 0x476734]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x47672c], 0
mov cl, byte [ebx + 4]
je 0x403be6
test cl, cl
je 0x403be6
cmp cl, 0xff
jne 0x403b83
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x403b54
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x403c32
movzx esi, byte [edx + 0x476734]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x403c1d
cmp al, 0xff
jne 0x403c2f
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x403bb0
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x403b54
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret

Function at 0x403e2c
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x14], ecx
lea ecx, [esi + 0xc]
push ecx
movzx ecx, byte [esp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 4
push ecx
lea eax, [esi + 0x10]
push eax
push 0x403df6
push 0
push 0
mov dword [eax], esi
call fcn.0044f6aa
add esp, 0x18
xor ecx, ecx
test eax, eax
mov dword [esi + 4], eax
setne cl
mov al, cl
pop esi
ret 8

Function at 0x403e6e
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x403e90
cmp byte [esi + 0x1c], 0
je 0x403e85
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
ret
Function at 0x407657
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0x128
mov eax, dword [0x4fc448]
xor eax, ebp
mov dword [ebp + 0xa4], eax
mov eax, dword [ebp + 0xb4]
push ebx
push esi
mov esi, dword [ebp + 0xb8]
push edi
mov edi, dword [ebp + 0xbc]
push 0x4769ec
push dword [ebp + 0xb0]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x64], edi
call fcn.00450abd
xor ebx, ebx
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
cmp eax, ebx
jne 0x4076d6
cmp esi, ebx
je 0x4076cf
lea eax, [ebp - 0x80]
push eax
call fcn.00406ca1
pop ecx
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00406770
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00406492
xor al, al
jmp 0x4077c6
cmp edi, ebx
je 0x4076e1
mov eax, dword [edi]
mov dword [ebp - 0x5c], eax
jmp 0x4076e4
mov dword [ebp - 0x5c], ebx
push 9
xor eax, eax
pop ecx
mov word [ebp + 0x7c], ax
lea edi, [ebp + 0x7e]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x58]
push 0xffffffffffffffff
push ebx
stosw word es:[edi], ax
call fcn.00406412
push 2
push ebx
push dword [ebp - 0x50]
call fcn.00450972
push dword [ebp - 0x50]
call fcn.0045087a
push ebx
push ebx
push dword [ebp - 0x50]
mov edi, eax
call fcn.00450972
add esp, 0x1c
xor esi, esi
cmp edi, ebx
je 0x407788
push edi
call fcn.0044fa4e
push dword [ebp - 0x50]
mov ebx, eax
push 1
push edi
push ebx
call fcn.004506c0
push edi
push ebx
push esi
call fcn.00405caa
mov esi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044fa4e
push edi
push ebx
push eax
mov dword [ebp - 0x54], eax
call fcn.00405caa
mov ecx, dword [ebp - 0x58]
add esp, 0x30
push esi
push dword [ebp - 0x54]
call fcn.00406982
push dword [ebp - 0x54]
call fcn.0044fc84
push ebx
call fcn.0044fc84
pop ecx
pop ecx
xor ebx, ebx
push esi
push edi
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp - 0x4c]
push 0x4769b4
push eax
call fcn.00450216
mov ecx, dword [ebp - 0x60]
add esp, 0x14
cmp ecx, ebx
je 0x4077af
lea eax, [ebp - 0x4c]
push eax
call fcn.00406a20
push dword [ebp - 0x50]
call fcn.004503a4
mov eax, dword [ebp - 0x64]
pop ecx
cmp eax, ebx
je 0x4077c4
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
mov al, 1
mov ecx, dword [ebp + 0xa4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f17f
add ebp, 0xa8
leave
ret