joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1cae530
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x1cf7014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x1cae510
lea eax, [ebp - 0x14]
push 0
push eax
push 0x1cae310
push 0x1d0d1b8
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1cae628
mov esi, dword [ebp + 0x10]
cmp dword [0x1d0d1bc], 0
je 0x1cae588
mov ecx, esi
call dword [section..00cfg]
push dword [ebp + 0xc]
call esi
add esp, 4
xor esi, esi
jmp 0x1cae5d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x1d0d1c0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x1cae5e8
mov ebx, dword [ebp + 8]
push 0x1d0d1c4
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov dword [ebx*4 + 0x1d0d1c8], esi
push 0x1d0d1c4
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
mov esi, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb0ac3
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x14
call fcn.01cae8a0
add esp, 4
test eax, eax
je 0x1cae574
mov edi, eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
push eax
push dword [0x1d0d1c0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1cae5a9
push edi
call fcn.01cae8e0
add esp, 4
jmp 0x1cae574
call fcn.01cc3c50
int3

Function at 0x1cafa00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x1cafa38
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x1cf0990]
inc esi
cmp ecx, esi
jne 0x1cafa20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1cc220d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1cf7014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x1cdd390
push esi
call fcn.01ccf6df
pop ecx
pop ecx
test eax, eax
jne 0x1cc223b
xor al, al
jmp 0x1cc22b8
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.01cc1f9e
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x1cc2275
push dword [ebp - 0x210]
call fcn.01c5d2d0
xor al, al
jmp 0x1cc22b6
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1cc227b
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x1cc229b
push edx
call fcn.01cc215e
pop ecx
test al, al
je 0x1cc2266
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1cc22a9
mov bl, 1
push dword [ebp - 0x210]
call fcn.01c5d2d0
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01cb0ac3
leave
ret
Function at 0x1cc380a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1cfb9a8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1cc384a
cmp byte [ebx], 0xa
jne 0x1cc384a
or byte [eax + edi + 0x28], 4
jmp 0x1cc384f
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x1cc394d
mov al, byte [edx]
cmp al, 0x1a
je 0x1cc392f
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x1cc387e
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1cc38a3
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1cc38ad
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1cc3860
jmp 0x1cc394d
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1cc392a
cmp dword [ebp - 0xc], 0
je 0x1cc392a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x1cfb9a8]
test byte [eax + edi + 0x28], 0x48
je 0x1cc3904
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1cc38ef
mov byte [esi], dl
jmp 0x1cc3900
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1cfb9a8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1cc394d
cmp byte [ebp - 1], 0xa
jne 0x1cc3913
cmp esi, ebx
jne 0x1cc3913
mov byte [esi], 0xa
jmp 0x1cc394c
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.01cce7b0
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1cc394d
mov byte [esi], 0xd
jmp 0x1cc394c
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x1cfb9a8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1cc3949
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1cc394d
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1cc3956
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x1cfb9a8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1cc3999
cmp word [esi], dx
jne 0x1cc3999
or byte [edi + eax + 0x28], 4
jmp 0x1cc399e
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x1cc3ad7
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x1cc3ab7
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x1cc39e0
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1cc3a16
cmp eax, edx
jae 0x1cc3a22
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x1cc39b8
jmp 0x1cc3ad7
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1cc3ab3
cmp dword [ebp - 0x14], 0
je 0x1cc3ab3
mov eax, dword [ebx*4 + 0x1cfb9a8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x1cc3a8b
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x1cc3ad1
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x1cfb9a8]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x1cfb9a8]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x1cfb9a8]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x1cc3ad4
pop ebx
cmp word [ebp - 4], bx
jne 0x1cc3a9c
cmp esi, dword [ebp + 0xc]
jne 0x1cc3a9c
mov word [esi], bx
jmp 0x1cc3ad4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.01cce7b0
add esp, 0x10
cmp word [ebp - 4], bx
je 0x1cc3ad7
push 0xd
jmp 0x1cc3ad0
mov ecx, dword [ebx*4 + 0x1cfb9a8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1cc3ace
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1cc3ad7
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1ccbf96
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1cde618
push 0x1cde610
push 0x1cde618
push 0x1e
call fcn.01ccc4f2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1ccbfca
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1ccbfd0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1ccc014
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1cde63c
push 0x1cde634
push 0x1cde63c
push 0x20
call fcn.01ccc4f2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1ccc04b
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1cd21c1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1cd225e
push ebx
push esi
call fcn.01cd22af
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.01cd210a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1cd220b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1cd225d
push edi
push eax
call fcn.01c5d280
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1cd222b
call fcn.01c5d2d0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1cd225c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.01cd210a
add esp, 0x20
test eax, eax
jne 0x1cd224a
push edi
call fcn.01c5d2d0
jmp 0x1cd2252
push ebx
call fcn.01c5d2d0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1cd2261
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1cd2272
pop esi
ret
push ebx
push edi
push esi
call fcn.01cd22af
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.01c5d280
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1cd229a
push ebx
push esi
push edi
call fcn.01cb2db0
add esp, 0xc
push 0
call fcn.01c5d2d0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1cd22f1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01cd255a

Function at 0x1cd5220
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01cd522b
Function at 0x401460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
call fcn.0040dad0
mov ebx, dword [0x410e38]
mov dword [esp + 8], str.EventThrottleFlushPeriodMs
mov dword [esp + 4], 0x412860
imul eax, ebx, 0xd03d18ef
mov dword [esp], str.onecoreuap_baseAppModelSearch_search_searchgatherinclude_batchchunk.hxx
mov dword [esp + 0xc], eax
mov edx, eax
or edx, 0xe5c928e5
mov dword [0x410d50], edx
call fcn.0040dd1c
imul eax, ebx, 0x63c7b84f
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov edx, eax
mov dword [0x410dc4], eax
and eax, 0xd1811084
and edx, 0xd99f9d86
mov dword [0x410c10], edx
xor edx, edx
mov ebx, dword fs:[0x30]
mov dword [0x410d50], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1e
mov dword [esp], 0xffffffff
mov dword [ebp - 0xc], edx
call fcn.00401083
test eax, eax
mov eax, 0
js 0x401520
cmp dword [ebp - 0x14], 0
je 0x401520
mov eax, 0x2500
jmp 0x4015d7
cmp word [eax + str.onecoreuap_baseAppModelSearch_search_searchgatherinclude_batchchunk.hxx], 0
je 0x401559
add eax, 2
cmp eax, 0x1696
jne 0x401520
mov eax, dword [0x410c10]
mov dword [esp + 8], 0x4123a0
mov dword [esp + 4], str.onecoreuap_baseAppModelSearch_search_searchgatherinclude_batchchunk.hxx
mov dword [esp + 0xc], eax
mov dword [esp], str.onecoreuap_baseAppModelSearch_search_searchgatherinclude_batchchunk.hxx
call fcn.0040dd1c
mov eax, dword [0x410dc4]
and dword [0x410d50], 0xf698d6bc
add eax, 0xf5b58e5
mov dword [0x410e38], eax
call fcn.0040dad0
xor edx, edx
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1f
mov dword [esp], 0xffffffff
call fcn.00401083
or eax, dword [ebp - 0x10]
je 0x401516
lea eax, [ebp - 0xc]
mov dword [esp], 0xffffffff
mov dword [esp + 4], eax
mov eax, dword [0x40f970]
call dword [eax + 0x3c]
push eax
push eax
cmp byte [ebx + 2], 1
je 0x401516
cmp dword [ebp - 0xc], 0
jne 0x401516
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x409c04
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x13c
mov edi, dword [str.at_3]
lea eax, [edi - 0x385a50f3]
mov dword [0x410fa8], eax
mov eax, dword [0x410fa8]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.currentContextMessage
xor eax, 0xaed062a2
mov dword [esp + 8], 0x411400
mov dword [ebp - 0x11c], eax
mov dword [0x410fa8], eax
imul eax, eax, 0xa0f0cabb
mov dword [esp + 4], str.lv_LV
mov dword [esp], 0x411400
mov dword [0x410b98], eax
call fcn.0040bd10
mov byte [ebp + ebx - 0x118], bl
inc ebx
cmp ebx, 0x100
jne 0x409c23
xor esi, esi
xor ecx, ecx
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [eax + edx]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x409c7f
mov byte [ebp - 0x19], al
mov eax, dword [ebp + 0x14]
sub edi, 0x157a6e2b
mov byte [ebp + esi - 0x118], bl
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [0x410b98], edi
xor edi, edi
add eax, esi
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], esi
je 0x409dfd
inc ebx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x118]
mov byte [ebp - 0x11d], al
add eax, edi
movzx edi, al
xor eax, eax
cmp byte [eax + 0x411400], 0
je 0x409d46
inc eax
cmp eax, 0x26cc
jne 0x409d08
mov eax, dword [0x410b98]
mov dword [esp + 0x10], str.message
mov dword [esp + 0xc], str.message
mov dword [esp + 8], str.SOFTWAREMicrosoftWindows_Search
mov dword [esp + 4], eax
mov dword [esp], str.ha_Latn_NG
call fcn.0040bf08
mov eax, dword [str.at_3]
mov dword [esp + 0xc], str.so_SO
mov dword [esp + 8], str.address_not_available
lea ecx, [eax + 0x12ba9f65]
mov dword [esp + 4], str.so_SO
mov dword [esp + 0x10], ecx
mov dword [esp], 0x411400
mov dword [ebp - 0x128], eax
mov dword [str.at_3], ecx
call fcn.0040bd10
mov eax, dword [ebp - 0x128]
mov dword [esp + 0x10], str.message
mov dword [esp + 0xc], 0x411400
mov cl, byte [ebp + edi - 0x118]
add eax, 0x29f6d56f
mov dword [esp + 8], str.lv_LV
imul eax, eax, 0x8c693aa1
mov dword [esp], str.API_MS_Win_Core_LocalRegistry_L1_1_0.dll
mov byte [ebp + ebx - 0x118], cl
mov dword [0x410b98], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp + 4], eax
call fcn.0040bf08
mov al, byte [ebp - 0x11d]
mov byte [ebp + edi - 0x118], al
add al, byte [ebp + ebx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor byte [esi], al
inc esi
jmp 0x409ce4
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40ac2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
cmp word [eax + str.imageName], 0
je 0x40ac5d
add eax, 2
cmp eax, 0x322c
jne 0x40ac3a
mov eax, dword [0x410ce8]
add eax, 0x6e100d32
mov dword [0x410b04], eax
mov esi, dword [0x410c44]
mov ebx, dword [0x410b04]
mov dword [esp + 0x10], str.imageName
mov dword [esp], str.imageName
imul eax, esi, 0x8633e096
and ebx, 0xfbf5e80
mov dword [0x410b04], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [0x410ce8], eax
call fcn.0040d51c
mov eax, esi
and eax, 0xf46b3841
mov dword [0x410e0c], eax
test edi, edi
jne 0x40acdc
mov dword [esp + 4], 0x412c40
mov eax, ebx
mov edi, 0xe8
mov dword [esp], 0x412c40
or eax, 0xf7cb888a
mov dword [0x410c44], eax
call fcn.0040bc50
mov ecx, 5
jmp 0x40acf3
dec edi
mov eax, 0
mov edi, 0xba
sete cl
cmovne edi, eax
movzx ecx, cl
lea ecx, [ecx + ecx*4]
xor eax, eax
cmp word [eax + str.operation_would_block], 0
je 0x40ad15
add eax, 2
cmp eax, 0x1a54
jne 0x40acf5
and esi, 0x30210000
mov dword [0x410c44], esi
sub ebx, 0x7e8e8ca0
mov dword [ebp - 0x1c], ecx
mov dword [0x410ce8], ebx
and ebx, 0xfc8645ad
call fcn.0040be68
mov dword [0x410b04], ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [0x410c44]
mov dword [ebp - 0x1c], ecx
xor eax, 0xc7b44023
mov dword [0x410e0c], eax
call fcn.00403608
mov edx, dword [0x40f9a0]
mov ecx, dword [ebp - 0x1c]
lea ebx, [edx + 1]
xor edx, edx
div ebx
mov eax, dword [0x411b54]
add eax, ecx
add eax, dword [edx*8 + 0x40f9a8]
movzx edx, byte [eax]
cmp edx, edi
jne 0x40ad38
mov esi, dword [0x410c44]
lea edx, [esi - 0x36ae820a]
mov dword [0x410ce8], edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405137
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pushfd
mov byte [ebp - 0x791], 0xc1
mov byte [ebp - 0x790], 0x8b
mov byte [ebp - 0x78f], 0x83
mov byte [ebp - 0x78e], 0x83
mov byte [ebp - 0x78d], 0xef
call fcn.004034b2
push 0x6a9fe9d6
or al, 0x8d
test dword [eax + edi*8 - 1], esp
call dword [eax - 0x18]
push eax
jecxz 0x405170
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x550]
lea eax, [ebp + eax - 0x654]
push eax
call fcn.00403423
add esp, 0xc
lea eax, [ebp - 0x654]
mov dword [ebp - 0x3a0], eax
jmp 0x40542a
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.004034b2
and al, 0x82
invalid

Function at 0x4056f2
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
ret 4

Function at 0x405790
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405b84
mov edi, eax
cmp edi, 0xffffffff
je 0x4057d1
test byte [esp + 0x10], 1
push esi
je 0x4057b3
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4057b9
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4057c2
xor eax, eax
inc eax
jmp 0x4057d3
test byte [esp + 0x10], 4
jne 0x4057d1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x3200288f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x3200289e
pop dword [ebp - 0x38]
mov eax, 0x8c868710
add eax, 0xa579a18e
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x44114156
add dword [ebp - 0x48], 0xa4103f5
mov dword [ebp - 0x44], 0x88cceae8
add dword [ebp - 0x44], 0xa966615d
mov dword [ebp - 0x40], 0x3dc32cbb
sub dword [ebp - 0x40], 0xf176e88d
mov dword [ebp - 0x3c], 0x524ace61
add dword [ebp - 0x3c], 0xadb5319f
lea eax, [ebp - 0x48]
push eax
mov eax, 0xff166b19
add eax, 0x32eec56b
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x2e02a0cc
sub dword [ebp - 0x48], 0xb9903776
mov dword [ebp - 0x44], 0x6a0dd1df
sub dword [ebp - 0x44], 0x28a1706a
mov dword [ebp - 0x40], 0x357fd46c
add dword [ebp - 0x40], 0x2def9800
mov dword [ebp - 0x3c], 0xaf3203a7
add dword [ebp - 0x3c], 0x50cdfc59
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x245a7cb4
sub eax, 0xf2554c38
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x45772
push 0
call eax
mov ecx, 0x409f
xor edi, edi
add edi, eax
mov ebx, 0x3207a200
add ebx, dword [ebp - 0x38]
mov esi, 0x4b66cfd6
xor dword [ebp - 0x2c], eax
mov edx, dword [ebx]
xor dword [ebp - 8], edx
add edx, esi
xor dword [ebp - 0x34], edx
mov dword [edi], edx
add dword [ebp - 4], ecx
add edi, 0x410425a1
sub edi, 0x4104259d
add ebx, 0x9cfeb7ab
add ebx, 0x63014859
loop 0x320029b0
add eax, 0xf54f
mov ebx, eax
add eax, 0xdbb72fad
add eax, 0x2448d058
mov ecx, 0xa9fdda8f
add ecx, 0x88022571
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401008
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x7c
push edi
mov edi, esp
push 0x7c
push edi
call sub.KERNEL32.dll_GetSystemDirectoryA
push edi
add edi, eax
mov eax, 0x7265705c
stosd dword es:[edi], eax
mov eax, 0x2e737466
stosd dword es:[edi], eax
mov eax, 0x6c6c64
stosd dword es:[edi], eax
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0x7c
pop edi
inc eax
je 0x40103d
jmp fcn.00401274
add byte [eax], al
invalid

Function at 0x4016b4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov eax, 0x4031a4
push eax
push ebx
mov ebx, esp
push ebx
mov ebx, 0x2b
push ebx
add dword [esp], 0x15
mov eax, 0xfffffe68
push eax
add dword [esp], 0xaec
mov eax, section..data
push eax
push sym.imp.KERNEL32.dll_VirtualProtect
pop edx
call dword [edx]
pop ecx
pop eax
mov edi, 0x403400
mov dword [eax - 0xe4], edi
lea edx, [edi - 0xc0]
lea edi, [0x402529]
xor esi, esi
add esi, 0x554
sub edi, 0xfffffffc
mov ebx, dword [edi - 4]
mov dword [edx + 0xc0], ebx
add edx, 4
xor dword [edx + 0xbc], 0x99a32157
add dword [edx + 0xbc], 0x5ae34687
sub esi, 4
test esi, esi
jne 0x401707
push eax
call sub.USER32.dll_GetActiveWindow
pop eax
pop ebp
ret 8
Function at 0x405f2e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42bdb4], 0
push esi
jne 0x405f65
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f3f
mov dword [ecx*4 + 0x42bdb0], eax
inc ecx
cmp ecx, 0x100
jl 0x405f3a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f96
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42bdb0]
xor eax, esi
inc ecx
dec edx
jne 0x405f78
pop edi
not eax
pop esi
ret 0xc

Function at 0x414dec
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [ecx], eax
add ecx, 4
sub edx, 0x8361bea5
cmp ecx, esi
jne fcn.00414dec
ret
Function at 0x10019b60
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x10019b7e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x10019b73
pop esi
ret
Function at 0x100023f9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x1000243e
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x10002444
add eax, 4
pop esi
dec esi
push esi
jne 0x10002426
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8