joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc767
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x4bc790
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.004dece0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4bc7c7
push ebx
call fcn.004db939
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.004dece0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4bc804
push ebx
call fcn.004db939
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
push 0x80000101
push 0
push 0x5c
push 1
mov ebx, 0x140
call fcn.004dbd80
add esp, 0x10
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ecx, 2
call fcn.004a2fac
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4bc853
push ebx
call fcn.004db939
add esp, 4
mov dword [ebp - 0x14], esp
push 0xff
mov ebx, dword [ebp + 0x14]
push dword [ebx]
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, 0xff
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 0xff
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4bc8a5
push 6
call fcn.004db93f
add esp, 4
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4bc8b8
push ebx
call fcn.004db939
add esp, 4
cmp dword [ebp - 0x20], 0
je 0x4bc8ea
push 0x80000401
push dword [ebp - 4]
push dword [ebp - 8]
push 1
mov ebx, 0x168
call fcn.004dc230
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
jmp 0x4bc923
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004dbd80
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
jmp 0x4bc923
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4c3520
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0xc
call fcn.004db933
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
jmp 0x4c3568
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
push 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4c3594
push 6
call fcn.004db93f
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x64
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4c35be
push 6
call fcn.004db93f
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x102
jne 0x4c361c
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4c35f0
push 6
call fcn.004db93f
add esp, 4
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4c3612
push 6
call fcn.004db93f
add esp, 4
push 0
call fcn.004db95d
add esp, 4
jmp 0x4c362c
mov ebx, dword [ebp - 8]
push ebx
call fcn.004db939
add esp, 4
mov esp, ebp
pop ebp
ret 4

Function at 0x4c74ff
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
jmp 0x4c7521
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.004dece0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4c7556
push ebx
call fcn.004db939
add esp, 4
pop eax
mov dword [ebp - 4], eax
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4c756d
mov eax, 0x5ba926
push eax
push 1
mov ebx, 0x130
call fcn.004dc500
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4c75a9
push 6
call fcn.004db93f
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c75d7
mov eax, dword [ebp - 4]
test eax, eax
je 0x4c75d2
push eax
mov ebx, eax
call fcn.004a294e
inc eax
push eax
call fcn.004db933
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4c7610
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004dbd80
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4c7610
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4c7621
push ebx
call fcn.004db939
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4d04bf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], esp
push 0
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4d0506
push 6
call fcn.004db93f
add esp, 4
cmp dword [ebp - 4], 0
jne 0x4d051e
fld qword [ebp - 0xc]
fadd qword [0x5baaaf]
fstp qword [ebp - 0xc]
jmp 0x4d0506
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4deb60
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x4debd0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4dec39
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.004dbbb0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x4dec40
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4decd2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x4decc4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4decbc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4dec85
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x4ded90
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4dedae
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4deda3
pop esi
ret

Function at 0x4dee90
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.004dbbb0
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x4deee7
push ebx
push edi
call fcn.004dbc40
push esi
mov ebx, esi
call fcn.004dbbb0
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x4deebe
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4f4800
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x6004bc]
xor edx, edx
cmp eax, edx
jne 0x4f4826
xor eax, eax
mov byte [eax + 0x6003bc], al
inc eax
cmp eax, 0x100
jl 0x4f480e
mov dword [0x6004bc], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x6003bc
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4f48b7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4f488a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4f4858
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4f48c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4f4913
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4f48fa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fb2a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x529cee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004fbbc0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x59d85c
call fcn.00519fcd
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4fb333
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00519fcd
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4fb32c
push 0
mov ecx, eax
call fcn.004f2440
mov dword [esi + 0xc], eax
jmp 0x4fb335
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4fb335
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x51c65a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x51c692
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0051a6e7
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0051a6bf
jmp 0x51c69e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x51dd4c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x51dd8e
call fcn.00523842
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x51dd8e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x51dd85
xor eax, eax
jmp 0x51dd96
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0051dd9c
pop edi
pop esi
pop ebx
ret 4

Function at 0x523d72
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x523da0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x523dbe
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00523cd8
jmp 0x523dbe
mov eax, dword [esi + 0x14]
test eax, eax
je 0x523dbe
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00523cd8
test edi, edi
mov eax, edi
jne 0x523da8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5512fa
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jo 0x5b13bb
mov esp, esi
pushfd
push ebx
mov dword [esp + 4], 0xd54d7893
pushfd
lea esp, [esp + 0xc]
jmp 0x503311
mov ebp, 0xcc665c77
pop ebx
fucomp st(5)
sbb eax, 0x39ef892b
lahf
fucom st(7)
pop ecx
mov esp, dword [ecx + 0x384ab1ef]
inc ebx
imul ebp, dword [ebp - 0x165741be], 0x68
adc esp, dword [ebx + 0x12e87834]
jle 0x5b13c4
push 0x7834a313
call 0x5b91d7
mov eax, dword [0x44ef9f71]
add byte [ecx + 0x44ef9f71], ah
cmp al, 0xb3
xor byte [eax + ebx*4 - 0x28], ch
les eax, [esp + edx*2 - 0x34]
mov al, byte [0xec68684c]
fmul dword [ebp - 0x18]
outsb dx, byte [esi]
adc ecx, 0x18ecb4bf
dec edx
sbb byte [ebp - 0x4d], ch
jg 0x5b139d
push 0x5f
les ebx, [ecx - 0x582d9ce]
xchg ebp, eax
fsubr qword [edx]
int 0xb2
jbe 0x5b13ff
mov ch, 0x86
invalid
dec edi
jle 0x5b1476
mov ch, 0xf7
retf 0x1dad
push esi
das
or ah, byte [ecx - 0x21779072]
jbe 0x5b1405
loopne 0x5b14d3
dec esi
mov eax, ecx
mov ebp, ebx
invalid
sub edi, ecx
pop es
bound edi, qword [eax - 0x24]
invalid
xor edi, dword [edi]
mov ecx, 0x44f09779
cmp al, 0xbb
inc eax
nop
invalid
mov ebx, 0x50f09040
pop eax
loopne 0x5b14bb
cwde
adc dword [edi + 0x48], esi
aas
add dword [edx], ebx
or ch, byte [ebx]
push ss
adc ebp, eax
and byte [ebp + 0x60de32e5], dh
js 0x5b14cb
push ebp
lahf
pop esi
enter 0x7044, 0x50
cld
enter 0x4430, 0x6c
daa
dec edx
add ebx, dword [ebp - 0x2b06f358]
push ebx
push ecx
outsd dx, dword [esi]
add byte [edi - 0x49db2575], cl
lodsb al, byte [esi]
mov byte [0x704e0a30], al
jb 0x5b14b5
cmovs ecx, dword [esi]
cli
invalid

Function at 0x553c8c
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
insb byte es:[edi], dx
scasb al, byte es:[edi]
mov eax, 0x20693d3c
pop ss
pushal
int 0x3c
inc ecx
frstor dword [ebx + 0x22]
invalid
mov ecx, 0x11ae810d
les ebp, [edx]
push es
enter 0x343f, 0x76
movsd dword es:[edi], dword [esi]
jbe 0x553bd8
pop edx
pop esi
inc ebp
sbb ah, byte [edx]
jns 0x553c26
movsd dword es:[edi], dword [esi]
ror dword [esi + 0x3280b58], 0x67
add dh, byte [ecx]
ljmp 0xb909
pushfd
call fcn.005b5053
and al, 0xbc
push esp
sbb dword [edi], edi
cmp al, 0xfe
sub dword [ebx - 0x5488bc49], 0xfffffffb
adc ecx, dword [ebx]
arpl word [edi - 0x4271a809], ax
loopne 0x553c31
jb 0x553ceb
salc
or edi, 0x43
invalid
dec eax
mov bl, 0x18
invalid
xchg edi, eax
xor al, dl
cwde
pop es
insb byte es:[edi], dx
push es
dec eax
ja 0x553cd4
cmp esp, dword [ecx]
mov eax, 0xe30e9fbb
pop eax
or byte [edi - 0x36332756], dh
inc dword [edi]
loopne 0x553d72
sti
push ds
cmp al, 0x13
invalid
cmp eax, 0x88b0932a
or ah, byte [eax]
pop es
fcompp
test eax, 0xc617a114
mov edi, 0x8805a9b4
dec ecx
mov bh, 0xec
jns 0x553d7a
sahf
out 0xe, eax
lahf
stosd dword es:[edi], eax
adc dh, al
test eax, 0xfc0a5048
xchg edx, eax
scasb al, byte es:[edi]
cmp dword [esi + 0x6e], edi
aad 0xd7
xor eax, 0xc8f6ca48
add byte [eax + 0x26], ah
sbb dword [ecx - 0x22], esp
shl dword [ebx - 0x2c66c4dd], 1
in eax, dx
pop edi
popal
imul dword [ecx]
pop ebx
invalid
Function at 0x5bd149
Capabilities:
Encode data using xor

Disassembly:
call fcn.005b2fa7
add byte [eax], al
inc edi
je 0x5b639f
js 0x5b63c2
inc ebp
js 0x5b63c5
outsb dx, byte gs:[esi]
je 0x5b63a5
outsd dx, dword [esi]
imul ebp, dword [esi + 0x74], 0x413233
jp 0x5b63b9
das
add ah, dh
scasd eax, dword es:[edi]
adc al, 0xa4
dec eax
ljmp 0xde2e
adc al, 0x79
sar byte [ecx + 0x53500f67], cl
add byte [esi - 0x58], ah
pop ss
or dword [edx + 0x7789c834], esp
sub al, 0xd9
bound edi, qword [edi + 6]
sbb dword [esi], 0x92b216dd
or al, 0x7c
iretd
mov byte [esp], 0x8c
pushal
pushal
add ecx, edx
bt bx, si
mov dword [ebp - 0x10], ecx
rcl ch, 4
bswap cx
add ch, dh
mov ecx, dword [ebp + 0xc]
pushfd
cmp ecx, 0xffff
mov byte [esp], dh
lea esp, [esp + 0x48]
jl 0x5b6340
pushfd
lea esp, [esp + 4]
jbe 0x5bf6dd
or di, 0x10be
or di, dx
call fcn.005bfd76
iretd
sbb al, ah
aaa
invalid
pushfd
clc
clc
sub ecx, dword [edx + 0x10]
bt dx, 0xb
push dword [esp]
cmp ch, dl
cmp ecx, dword [edx + 0x14]
pushfd
call fcn.00551b40
pop eax
xor al, 0xdc
rol byte [ebp + 0x3c], cl
jbe 0x5bf6d1
dec edi
inc ebx
stosd dword es:[edi], eax
invalid
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x402fc9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x402fd8
pop dword [ebp - 0x40]
mov eax, 0x402fd8
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x4950b084
sub dword [ebp - 0x50], 0xfafe6b39
mov dword [ebp - 0x4c], 0xfd56ca34
add dword [ebp - 0x4c], 0x34dc8211
mov dword [ebp - 0x48], 0x1f694077
add dword [ebp - 0x48], 0x2ce303b7
mov dword [ebp - 0x44], 0x823cdc62
sub dword [ebp - 0x44], 0x823cdc62
lea eax, [ebp - 0x50]
push eax
mov eax, 0xf1eccf7c
add eax, 0xe5400d8
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xa502dc1a
add dword [ebp - 0x50], 0xcf6f8d3c
mov dword [ebp - 0x4c], 0x5e0497a1
add dword [ebp - 0x4c], 0xe367c9d4
mov dword [ebp - 0x48], 0xa312b2fd
sub dword [ebp - 0x48], 0x3fa34691
mov dword [ebp - 0x44], 0x4fe05f70
add dword [ebp - 0x44], 0xb01fa090
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x38ee7
push 0
call eax
mov ecx, 0x49e8e9c9
add ecx, 0xb6175bdc
mov edi, eax
mov esi, 0x5c05f4b5
add esi, 0xa43bbb4b
add esi, dword [ebp - 0x40]
mov ebx, 0x5d84e9e1
add ebx, 0x2fe54475
xor dword [ebp - 0x30], esi
mov edx, dword [esi]
sub dword [ebp - 0x20], eax
xor edx, ebx
sub dword [ebp - 0x38], 0xdbc7febb
mov dword [edi], edx
sub dword [ebp - 0x10], 0xc8898dd6
add edi, 0xdfa054fa
sub edi, 0xdfa054f6
add esi, 0xa5fd466d
sub esi, 0xa5fd4669
loop 0x4030f0
add eax, 0xab8c5e13
sub eax, 0xab8b54ac
mov ebx, eax
add eax, 0xa2c3f6e0
add eax, 0x5d3c0925
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401b7c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x34
mov eax, 0x40f8cf
call fcn.0040f737
mov dword [ebp - 0x3c], edx
mov ebx, ecx
mov dword [ebp - 0x38], ebx
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], al
push 0xdc
push 1
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
lea edx, [esi + edi]
mov dword [ebp - 0x40], edx
jmp 0x401d21
mov cl, byte [esi]
mov eax, esi
mov dword [ebp - 0x30], eax
cmp cl, 0x7c
je 0x401ce4
cmp eax, edx
jae 0x401bfd
inc eax
cmp byte [eax], 0x7c
jne 0x401bf3
mov dword [ebp - 0x30], eax
cmp cl, 0x2a
jne 0x401ce4
movsx eax, byte [esi + 1]
sub eax, 0x63
je 0x401c20
sub eax, 1
je 0x401c1b
mov ecx, ebx
jmp 0x401c23
lea ecx, [ebx + 0x30]
jmp 0x401c23
lea ecx, [ebx + 0x18]
lea edx, [ebp - 0x2c]
call fcn.0040122d
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x34], ecx
cmp edi, ecx
jae 0x401c56
lea eax, [edi + 1]
cmp ecx, 0xf
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
mov word [eax + edi], 0x5c
mov edi, dword [ebp - 0x30]
jmp 0x401d1b
mov ebx, 0x7fffffff
mov eax, ebx
sub eax, edi
cmp eax, 1
jb 0x401d40
lea esi, [edi + 1]
or esi, 0xf
cmp esi, ebx
jbe 0x401c76
mov esi, ebx
jmp 0x401c8a
mov edx, ecx
mov eax, ebx
shr edx, 1
sub eax, edx
cmp ecx, eax
ja 0x401c72
lea eax, [ecx + edx]
cmp esi, eax
cmovb esi, eax
lea ecx, [esi + 1]
call fcn.00402e2c
cmp dword [ebp - 0x34], 0xf
mov ebx, eax
lea eax, [edi + 1]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], eax
push edi
jbe 0x401cc6
mov esi, dword [ebp - 0x2c]
push esi
push ebx
call fcn.004057f0
mov edx, dword [ebp - 0x34]
add esp, 0xc
mov ecx, esi
mov word [edi + ebx], 0x5c
lea edx, [edx + 1]
call fcn.00402c8e
jmp 0x401cd9
lea eax, [ebp - 0x2c]
push eax
push ebx
call fcn.004057f0
add esp, 0xc
mov word [edi + ebx], 0x5c
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ebx
mov ebx, dword [ebp - 0x38]
jmp 0x401d1b
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmova eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
push eax
call fcn.004028b4
mov edi, dword [ebp - 0x30]
mov eax, edi
mov ecx, dword [ebp - 0x3c]
sub eax, esi
push eax
push esi
call fcn.004028b4
mov ecx, dword [ebp - 0x3c]
push 5
push str..dll_
call fcn.004028b4
mov edx, dword [ebp - 0x40]
lea esi, [edi + 1]
cmp esi, edx
jb 0x401be3
mov edx, dword [ebp - 0x18]
cmp edx, 0xf
jbe 0x401d3a
mov ecx, dword [ebp - 0x2c]
inc edx
call fcn.00402c8e
call fcn.0040f6f5
ret
call fcn.004010e3
int3