joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404890
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e980
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x415284]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
test esi, esi
je 0x4049e5
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4049e5
cmp byte [eax], 0
je 0x4049e5
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4049e5
cmp byte [eax], 0
je 0x4049e5
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x4049d1
cmp esi, 0x80000000
mov edi, str.UNKNOWN
jne 0x404929
mov edi, str.HKEY_CLASSES_ROOT
jmp 0x404981
cmp esi, 0x80000001
jne 0x404938
mov edi, str.HKEY_CURRENT_USER
jmp 0x404981
cmp esi, 0x80000002
jne 0x404947
mov edi, str.HKEY_LOCAL_MACHINE
jmp 0x404981
cmp esi, 0x80000005
jne 0x404956
mov edi, str.HKEY_CURRENT_CONFIG
jmp 0x404981
cmp esi, 0x80000003
jne 0x404965
mov edi, str.HKEY_USERS
jmp 0x404981
cmp esi, 0x80000004
jne 0x404974
mov edi, str.HKEY_PERFORMANCE_DATA
jmp 0x404981
cmp esi, 0x80000006
jne 0x404981
mov edi, str.HKEY_DYN_DATA
push eax
mov esi, str.REGEDIT4_r_n
call fcn.004043a0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
push edi
mov dword [ebp - 4], 0
call fcn.00404640
add esp, 0x14
mov bl, al
jmp 0x4049b9
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4049d1
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406620
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x415284]
xor eax, esp
mov dword [esp + 0x10c], eax
mov ecx, dword [esp + 0x118]
mov eax, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x120]
push edi
lea edx, [esp + 8]
push edx
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x4066a9
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push edi
push edx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [esp + 0x10]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x406690
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x114]
pop edi
pop esi
xor ecx, esp
call fcn.0040d786
add esp, 0x110
ret
Function at 0x406de0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40ecf9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x415284]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x90], 0
jne 0x406ebb
call sub.MFC80.DLL_Ordinal_1084
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f89
push 0
call edi
test eax, eax
mov dword [ebx + 0x90], eax
jne 0x406ebb
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC80.DLL_Ordinal_310]
push 0x104
push 0x104
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
call dword [sym.imp.MFC80.DLL_Ordinal_2468]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC80.DLL_Ordinal_5403]
push str.winhlp32.exe
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC80.DLL_Ordinal_911]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC80.DLL_Ordinal_876]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x406eb1
push 0x6a
push esi
call edi
test eax, eax
je 0x406eaa
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [ebx + 0x90], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC80.DLL_Ordinal_578]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x406f20
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [0x415284]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
test ebx, ebx
je 0x4070c1
cmp byte [ebx], 0
je 0x4070c1
cmp dword [esp + 0x21c], 0
mov eax, str.open
je 0x406f61
mov eax, 0x411bbc
push ebp
mov ebp, dword [esp + 0x21c]
push esi
push ebp
push 0
push 0
push ebx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4070a7
lea eax, [esp + 0xc]
push eax
push str..htm
push 0x80000000
call fcn.00406620
add esp, 0xc
test eax, eax
jne 0x4070a7
lea eax, [esp + 0xc]
add eax, 0xffffffff
lea ebx, [ebx]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x406fb0
mov ecx, dword [str._shellopencommand]
mov edx, dword [0x411ba4]
mov dword [eax], ecx
mov ecx, dword [0x411ba8]
mov dword [eax + 4], edx
mov edx, dword [0x411bac]
mov dword [eax + 8], ecx
mov ecx, dword [0x411bb0]
mov dword [eax + 0xc], edx
lea edx, [esp + 0xc]
mov dword [eax + 0x10], ecx
push edx
mov eax, edx
push eax
push 0x80000000
call fcn.00406620
add esp, 0xc
test eax, eax
jne 0x4070a7
mov esi, dword [sym.imp.MSVCR80.dll__mbsstr]
lea ecx, [esp + 0xc]
push str.__1_
push ecx
call esi
add esp, 8
test eax, eax
jne 0x407047
lea edx, [esp + 0xc]
push 0x411b94
push edx
call esi
add esp, 8
test eax, eax
jne 0x407047
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x407036
sub eax, edx
lea eax, [esp + eax + 0xb]
jmp 0x40704a
mov byte [eax], 0
push edi
mov edi, eax
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x407050
mov cx, word [0x411b90]
mov word [edi], cx
mov ecx, ebx
mov esi, ebx
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x407068
sub ecx, esi
mov edx, ecx
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x407078
mov ecx, edx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [0x4152c0]
push ebp
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040d786
add esp, 0x20c
ret
mov ecx, dword [esp + 0x20c]
pop ebx
xor ecx, esp
mov eax, 0x24
call fcn.0040d786
add esp, 0x20c
ret
Function at 0x40aa20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x40aa2b
xor eax, eax
ret
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
not esi
jb 0x40ab27
push ebp
mov ebp, edi
shr ebp, 3
jmp 0x40aa50
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + 0x412118]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x412118]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + 0x412118]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x412118]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x412118]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x412118]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x412118]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x412118]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x40aa50
pop ebp
test edi, edi
je 0x40ab4c
jmp 0x40ab30
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x412118]
add ecx, 1
sub edi, 1
jne 0x40ab30
mov eax, esi
pop edi
not eax
pop esi
ret
Function at 0x40acd0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x48
push esi
mov esi, dword [esp + 0x50]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x40acee
mov eax, 0x1000000
pop esi
add esp, 0x48
ret
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x40ad08
mov eax, 0x200
pop esi
add esp, 0x48
ret
mov eax, dword [esp + 0x18]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
je 0x40ad1b
mov ebp, 1
test al, 2
je 0x40ad22
or ebp, 2
test al, 4
je 0x40ad29
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x40ad33
or ebp, 0x10
test al, 0x20
je 0x40ad3a
or ebp, 0x20
test ecx, ecx
je 0x40ad46
or ebp, 0x40000000
jmp 0x40ad4c
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x40ad5c
or ebp, 0x800000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [esp + 0xc], eax
jbe 0x40ae0b
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push esi
call ebx
cmp word [esp + 0x10], 0x54ad
jne 0x40ae09
mov eax, dword [esp + 0x1c]
lea edx, [eax + 0x34]
cmp dword [esp + 0x14], edx
jbe 0x40ae09
push 0
push 0
push eax
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebx
mov eax, dword [esp + 0x20]
cmp eax, 0x5a4d
je 0x40ae03
cmp eax, 0x454e
je 0x40ae03
cmp eax, 0x454c
je 0x40ae03
cmp eax, 0x4550
jne 0x40ae09
or ebp, 0x400000
pop edi
pop ebx
mov eax, dword [esp + 0x58]
test eax, eax
je 0x40ae15
mov dword [eax], ebp
mov eax, dword [esp + 0x5c]
test eax, eax
pop ebp
je 0x40ae24
mov edx, dword [esp + 8]
mov dword [eax], edx
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x40ae6d
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
call fcn.0040ac30
mov dword [esi + 4], edx
mov edx, dword [esp + 0x38]
mov dword [esi], eax
mov eax, dword [esp + 0x34]
push edx
push eax
call fcn.0040ac30
mov ecx, dword [esp + 0x30]
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x2c]
push ecx
push edx
mov dword [esi + 8], eax
call fcn.0040ac30
add esp, 0x18
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x60]
test esi, esi
je 0x40ae9b
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx eax, word [esp + 4]
movzx ecx, word [esp + 8]
shl eax, 0x10
or eax, ecx
mov dword [esi], eax
xor eax, eax
pop esi
add esp, 0x48
ret
Function at 0x40b020
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x40b063
mov eax, dword [esi + 0x1c]
push edi
mov edi, dword [esp + 0x10]
lea edx, [eax + edi]
cmp edx, dword [esi + 0x20]
jb 0x40b048
pop edi
mov dword [esi + 0xc], 0x30000
xor eax, eax
pop esi
ret 8
mov edx, dword [esp + 0xc]
push edi
push edx
add eax, ecx
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
pop edi
pop esi
ret 8
mov eax, dword [esi]
test eax, eax
je 0x40b089
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0xc]
pop esi
ret 8
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop esi
ret 8

Function at 0x40b390
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x64]
test ecx, ecx
push edi
je 0x40b3e3
mov eax, dword [esi + 0x6c]
mov edi, dword [esi + 0x68]
cmp eax, edi
jae 0x40b42d
mov edx, dword [esp + 0x14]
sub edi, eax
cmp edi, edx
jbe 0x40b3b6
mov edi, edx
mov ebx, dword [esp + 0x10]
push edi
add eax, ecx
push eax
push ebx
call sub.MSVCR80.dll_memcpy
mov eax, dword [esi + 0x58]
add dword [esi + 0x6c], edi
add dword [esi + 0x54], edi
push edi
push ebx
push eax
call fcn.0040aa20
add esp, 0x18
mov dword [esi + 0x58], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x40b426
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b42d
mov edi, dword [esp + 0x14]
mov eax, dword [esi + 0x58]
add dword [esi + 0x54], edi
push edi
push ebx
push eax
call fcn.0040aa20
add esp, 0xc
mov dword [esi + 0x58], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov dword [esi + 0xc], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x40c480
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
xor ebx, ebx
xor edi, edi
cmp dword [esi + 0x6af90], ebx
mov dword [esi + 0x6af80], 2
mov ebp, 1
je 0x40c6a3
cmp dword [esi + 0x6af90], 3
jb 0x40c4fb
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebx, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], ebx
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebx, ebx
je 0x40c53b
mov edx, dword [esi + 0x6af84]
sub edx, ebx
cmp edx, 0x7efa
ja 0x40c53b
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x40c523
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.00409da0
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x40c53b
mov edi, eax
cmp edi, 3
jb 0x40c61e
mov ecx, dword [esi + 0x6af84]
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
push ecx
push esi
call fcn.00409780
sub dword [esi + 0x6af90], edi
add esp, 0xc
cmp edi, dword [esi + 0x6af98]
mov edx, eax
mov eax, dword [esi + 0x6af90]
ja 0x40c5d7
cmp eax, 3
jb 0x40c5d7
sub edi, ebp
jmp 0x40c580
add dword [esi + 0x6af84], ebp
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [esi + ecx + 0x1af72]
mov ebx, dword [esi + 0x6af7c]
shl ebx, 5
xor eax, ebx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebx, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
sub edi, ebp
mov dword [esi + ecx*4 + 0x2af70], ebx
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x40c580
jmp 0x40c641
add dword [esi + 0x6af84], edi
mov eax, dword [esi + 0x6af84]
lea ecx, [eax + esi]
movzx eax, byte [ecx + 0x1af70]
mov dword [esi + 0x6af7c], eax
movzx ecx, byte [ecx + 0x1af71]
shl eax, 5
push str.Call_UPDATE_HASH___MIN_MATCH_3_more_times
xor ecx, eax
and ecx, 0x7fff
push ebp
push esi
xor edi, edi
mov dword [esi + 0x6af7c], ecx
call fcn.004092d0
add esp, 0xc
jmp 0x40c647
mov edx, dword [esi + 0x6af84]
movzx eax, byte [edx + esi + 0x1af70]
push eax
push 0
push esi
call fcn.00409780
add esp, 0xc
add dword [esi + 0x6af90], 0xffffffff
mov edx, eax
add dword [esi + 0x6af84], ebp
test edx, edx
je 0x40c681
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x40c65e
lea ecx, [eax + esi + 0x1af70]
jmp 0x40c660
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.0040c2c0
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x40c696
push esi
call fcn.00409fa0
add esp, 4
cmp dword [esi + 0x6af90], 0
jne 0x40c4a7
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x40c6b6
lea ecx, [eax + esi + 0x1af70]
jmp 0x40c6b8
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push ebp
sub edx, eax
push edx
push ecx
push esi
call fcn.0040c2c0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40d786
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x415284]
jne 0x40d790
repz ret
jmp fcn.0040de1f
Function at 0x1000e2ee
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10022f17
call fcn.100214ba
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x1000e39c
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.1001b97a
add esp, 0xc
test eax, eax
js 0x1000e39c
mov edi, dword [ebp - 0x41c]
cmp edi, 0x400
jg 0x1000e382
push edi
call fcn.100033e4
pop ecx
test al, al
je 0x1000e382
mov eax, edi
call fcn.100216b0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000e38e
push edi
lea ecx, [ebp - 0x428]
call fcn.1001b97a
push 3
push edi
push esi
push eax
call fcn.1001b97a
cmp eax, ebx
jne 0x1000e3d9
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000e3b5
lea ecx, [ebp - 0x418]
call fcn.1000cdea
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10002dcb
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.10021516
ret 0x10
push 2
push ebx
push eax
call fcn.1000cff7
mov edi, eax
mov dword [ebp - 0x41c], edi
cmp edi, ebx
jne 0x1000e3fa
call fcn.10003ef0
mov esi, eax
jmp 0x1000e4c4
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x1000e41d
call fcn.10003ef0
jmp 0x1000e4b6
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x1000e413
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x424], esi
cmp eax, esi
jae 0x1000e44d
mov esi, 0x8007000e
jmp 0x1000e4b8
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1001b97a
mov dword [ebp - 4], 1
jmp 0x1000e47b
cmp dword [ebp - 0x418], ebx
je 0x1000e446
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.1001b97a
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.1001b97a
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000e3ba
lea ecx, [ebp - 0x418]
call fcn.1000cdea
jmp 0x1000e3ba
Function at 0x10014920
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
xor ecx, ecx
xor edx, edx
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov cl, byte [esi + 0x100]
mov dl, byte [esi + 0x101]
test ebp, ebp
je 0x1001496f
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x10014944
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x10014981
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov eax, 0x3020100
push esi
mov ecx, 0x40
mov esi, dword [esp + 0xc]
push edi
mov edx, esi
push ebp
mov dword [edx], eax
add edx, 4
add eax, 0x4040404
dec ecx
jne 0x10014995
xor ecx, ecx
xor edi, edi
mov ebp, dword [esp + 0x1c]
mov byte [esi + 0x100], cl
mov byte [esi + 0x101], cl
xor ebx, ebx
xor edx, edx
xor eax, eax
mov dl, byte [edi + esi]
mov al, byte [ebp + ecx]
add bl, al
inc ecx
add bl, dl
inc edi
mov al, byte [ebx + esi]
mov byte [edi + esi - 1], al
cmp dword [esp + 0x18], ecx
mov byte [ebx + esi], dl
jne 0x100149db
xor ecx, ecx
cmp edi, 0x100
jb 0x100149b8
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x10015290
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x100152dc
jle 0x100152d7
cmp eax, 3
jg 0x100152d7
push esi
mov esi, dword [ecx]
test esi, esi
je 0x100152ce
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
sub ecx, eax
push edi
sub edx, eax
mov edi, dword [ecx + eax]
mov ebx, dword [eax]
xor edi, ebx
mov dword [edx + eax], edi
add eax, 4
dec esi
jne 0x100152bc
pop edi
pop ebx
mov eax, 1
pop esi
ret 0x10
xor eax, eax
ret 0x10
mov eax, dword [ecx + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call fcn.1001b97a
mov eax, 1
ret 0x10

Function at 0x10015850
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x1001589c
jle 0x10015897
cmp eax, 3
jg 0x10015897
push esi
mov esi, dword [ecx]
test esi, esi
je 0x1001588e
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
sub ecx, eax
push edi
sub edx, eax
mov edi, dword [ecx + eax]
mov ebx, dword [eax]
xor edi, ebx
mov dword [edx + eax], edi
add eax, 4
dec esi
jne 0x1001587c
pop edi
pop ebx
mov eax, 1
pop esi
ret 0x10
xor eax, eax
ret 0x10
mov eax, dword [ecx + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call fcn.10016740
mov eax, 1
ret 0x10
Function at 0x10015d70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
mov eax, dword [esi + 8]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, dword [esi + 0x124]
sub eax, 2
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], ecx
je 0x10015eb2
dec eax
je 0x10015db6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc
mov ecx, dword [esi + 0x20]
push esi
mov edi, ecx
lea eax, [esp + 0x20]
and ecx, 0x1f
mov ebx, 1
push 1
push eax
shr edi, 5
shl ebx, cl
call fcn.10015300
test eax, eax
mov ebp, dword [esp + 0x124]
je 0x10015df4
push esi
push 1
push ebp
call fcn.10015300
test eax, eax
je 0x10015df4
mov eax, 1
jmp 0x10015df6
xor eax, eax
mov ecx, dword [esp + 0x10]
lea edi, [esp + edi*4 + 0x1c]
cmp ecx, 1
mov dword [edi], ebx
je 0x10015e67
dec ecx
mov dword [esp + 0x10], ecx
test eax, eax
je 0x10015e54
lea ecx, [esp + 0x1c]
push esi
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
call fcn.10015680
test eax, eax
je 0x10015e54
push esi
push ebp
push ebp
push ebp
call fcn.10015680
test eax, eax
je 0x10015e54
mov ecx, dword [esp + 0x120]
push esi
push ebp
push ebp
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.100156f0
test eax, eax
je 0x10015e54
mov eax, 1
jmp 0x10015e56
xor eax, eax
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
xor edx, ebx
dec ecx
mov dword [edi], edx
mov dword [esp + 0x10], ecx
jne 0x10015e0a
test eax, eax
je 0x10015da7
lea eax, [esp + 0x1c]
push esi
push eax
push ebp
push ebp
push ebp
call fcn.100156f0
test eax, eax
je 0x10015da7
mov ecx, dword [esp + 0x120]
push esi
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.1001b97a
test eax, eax
je 0x10015da7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10c
ret 0xc
xor esi, esi
xor edx, edx
test edi, edi
mov edi, dword [esp + 0x124]
je 0x10015f09
mov ebx, dword [esp + 0x120]
mov eax, edx
shr eax, 5
mov ecx, edx
mov ebx, dword [ebx + eax*4]
and ecx, 0x1f
shr ebx, cl
mov ebp, dword [edi + eax*4]
and ebx, 1
xor esi, ebx
mov ebx, esi
not ebx
and ebx, 1
shl ebx, cl
not ebx
and ebx, ebp
mov ebp, esi
and ebp, 1
shl ebp, cl
or ebx, ebp
inc edx
mov dword [edi + eax*4], ebx
mov eax, dword [esp + 0x10]
cmp edx, eax
jne 0x10015ec1
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + ebx*4 - 4]
xor eax, eax
test esi, esi
sete al
shl edx, cl
shr edx, cl
mov dword [edi + ebx*4 - 4], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc

Function at 0x10017130
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esp + 0x18]
sub eax, 0x182
je 0x10017164
sub eax, 0x64
je 0x10017164
sub eax, 0x64
cmp word [esp + 0x20], 6
jb 0x10017164
push 0xc
call fcn.1001cf10
add esp, 0x24
ret
push 4
call fcn.1001cf10
add esp, 0x24
ret