joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424465
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.0042e165
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x424491
call fcn.00424408
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4250b7
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x1c
mov eax, 0x43cc5b
call fcn.00425deb
push 0x43fb94
call fcn.0042557b
mov esi, eax
test esi, esi
je 0x4250fa
xor edi, edi
jmp 0x4250e8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jg 0x4250fa
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4250d7
call fcn.00424c94
mov ecx, eax
call fcn.00424ff7
push eax
lea ecx, [ebp - 0x28]
call fcn.00412de8
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0042770d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004128f4
xor eax, eax
inc eax
call fcn.00425d95
ret
Function at 0x4314a1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00431320

Function at 0x43449a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043415a

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4048b0
Capabilities:
Encode data using xor

Disassembly:
dec ebx
push ebp
mov ebp, esp
mov eax, dword [ebp - 0x6b]
push ebx
push esi
push edi
mov edi, dword [0x400330]
lea esi, [eax + 0x14]
mov ebx, 0xb90014
mov esp, dword [edi + 0x106cc085]
mov ecx, dword [eax]
cmp al, 0x89
push cs
call edi
add al, byte [esi]
xor al, ah
add al, 0x85
sal byte [ebp - 0x10], 0x83
fadd qword [ebx + ecx*2]
jne 0x4048af
in eax, dx
push ebp
or byte [edx - 1], dl
pop esp
add esp, 7
iretd

Function at 0x407d20
Capabilities:
Encode data using xor

Disassembly:
or byte [eax], cl
or byte [eax], cl
add ah, byte [eax + ecx]
or byte [edi + 0x6f080808], dl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or bl, al
or byte [esi], bl
or byte [eax], cl
mov dword [0x8060f08], 0x90070808
sub dl, byte [eax - 0x6f6f7970]
push ebp
mov ebp, esp
sub esp, 0x58
in al, 0x9f
inc ebp
test al, 0x57
inc eax
jge 0x407d3e
lea ecx, [ebp - 4]
test dword [ebx + 0x558dd745], ecx
or al, 0x51
mov ecx, dword [ebp + 8]
das
push edi
push eax
inc ebx
call fcn.00407f0f
push ebp
dec ebp
cld
mov edx, dword [ebp + 0x14]
cmp ecx, 0x2d
mov dword [ebp - 8], eax
insd dword es:[edi], dx
leave
mov ebx, dword [ebp + 0x74]
push es
mov byte [eax + 0x14e8d2d], 0x8d
dec edi
call dword [ebx - 0x7b]
insb byte es:[edi], dx
loope 0x407d74
cmp byte [ecx + eax], 0x30
jne 0x407d71
dec edi
jnp 0x407cf3
leave
jg 0x407d65
mov dword [ebp - 0x70], edi
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jl 0x62407e33
mov ecx, ebx
sub ecx, edi
cmp ecx, 4
or byte [edi + 0x34b0], 0xdd
xor al, 0
add ch, bl
fstp xword [edi + 0x3b]
and dl, 0x30
je 0x407d89
push 0x85462e91
fstp xword [ebp + 0x2e]
mov ecx, ebx
cmp eax, 0xa1303030
neg ecx
mov dword [ebp + 0xc], ecx
mov edx, ecx
mov edi, esi
shl dword [eax + 2], 0xf3
and eax, 0xe883ca8b
add esi, ebx
stosb byte es:[edi], al
mov edi, dword [ebp + 0x10]
mov eax, edx
mov edx, dword [ebp + 0x14]
add ebx, eax
add esi, eax
mov eax, dword [ebp - 8]
fstp qword [ecx + 0x56]
mov ecx, 1
cmp edi, ecx
jnp 0x407dea
mov dl, byte [eax]
mov byte [eax + 0x46], bl
inc eax
push 0xffffffffffffffcb
inc edx
add eax, esi
push es
mov ah, 0x46
inc ecx
enter 0x7ecf, 0xffffffffffffffed
jns 0x407e3e
adc al, 0x5c
pop esp
sti
jge 0x407e4f
out 0xf0, al
mov eax, 0x30fa3030
add eax, 0x8b3f8bcb
rol dword [ecx - 0x17], 1
add al, byte [edx + edx]
mov ecx, edx
and ecx, 0xffffffd2
or al, 0xf3
rep stosb byte es:[edi], al
mov byte [esi], 0x2e
rcl byte [ebp + 0x14], cl
inc esi
push ds
inc esi
das
pop ebx
cmp al, 0x2e
jne 0x1127e73
mov eax, dword [ebp + 0x18]
add al, 6
ret 0x850f
pop ebp
ret
mov dword [ebp + 0x3c], ebx
mov dl, byte [eax]
mov byte [esi - 1], dl
inc eax
mov byte [esi], 0x37
leave
cmp edi, 1
ror byte [edx], 0x4f
mov al, byte [ecx - 0x78]
adc dword [edx - 0x88ab0c0], eax
mov byte [esi], 0x65
inc esi
test ebx, ebx
jge 0x407e69
or cl, byte [edi - 0x76]
inc ecx
mov byte [ecx], dl
add byte [eax + 0x4f], 0x75
test esi, 0x85466506
fstp xword [ebp + 7]
neg ebx
invalid
mov byte [esi], 0xb2
je 0x407e31
mov ecx, 0xca001564
cdq
ret 0x4629
Function at 0x42cc70
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push 0xca62c1d6
push 0x8f1bbcdc
push 0x6ed9eba1
push 0x5a827999
push edx
call fcn.0042d020
ret 0x18

Function at 0x42cf00
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0xfffffff
imul eax, eax, 8
jo 0x42cf20
test ecx, 0x10000000
je 0x42cf1d
or eax, 0x80000000
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x42cf30
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0x3fffffff
imul eax, eax, 2
jo 0x42cf5a
test ecx, 0x40000000
je 0x42cf4d
or eax, 0x80000000
test ecx, 0x80000000
je 0x42cf57
or al, 1
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]

Function at 0x42cf60
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
mov eax, esi
and ecx, 0x3ffffff
imul ecx, ecx, 0x20
jo 0x42cf9e
and eax, 0xf8000000
cdq
and edx, 0x7ffffff
add eax, edx
sar eax, 0x1b
and eax, 0x1f
or ecx, eax
test esi, 0x4000000
pop esi
je 0x42cf99
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x42cfb0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, eax
xor edx, ecx
jge 0x42cfc5
add eax, ecx
jo 0x42cfd6
ret 8
xor eax, 0x80000000
add eax, ecx
jo 0x42cfd6
xor eax, 0x80000000
ret 8
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop

Function at 0x42cfe0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov ecx, ebx
mov eax, ebx
and ecx, 1
imul ecx, ecx, 0x40000000
jo 0x42d017
and al, 0xfc
cdq
and edx, 3
add eax, edx
sar eax, 2
and eax, 0x3fffffff
or ecx, eax
test bl, 2
pop ebx
je 0x42d012
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100080c7
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100080c7
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100080c7
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100080c7
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100080c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100080c7
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100080c7
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100080c7
push 0xd008
push edi
call fcn.100080c7
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100080c7
int3

Function at 0x100080c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100080d6
pop dword [ebp - 0x4c]
mov eax, 0x100080d6
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x39566
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4957
xor edx, edx
add edx, eax
mov ebx, 0xaef3e40
add ebx, 0x51247c0
add ebx, dword [ebp - 0x4c]
mov esi, 0x8f7d49d2
sub esi, 0x40913091
xor dword [ebp - 0x44], edi
mov edi, dword [ebx]
xor dword [ebp - 0x44], 0x46d0d48a
xor edi, esi
sub dword [ebp - 0x38], edx
mov dword [edx], edi
xor dword [ebp - 0x3c], 0xdbe87d50
add edx, 0xf3536d9f
sub edx, 0xf3536d9b
add ebx, 0xcbaa251e
sub ebx, 0xcbaa251a
loop 0x10008127
add eax, 0x1182f
mov ebx, eax
add eax, 0x46c2e22f
add eax, 0xb93d1dd6
mov ecx, 0xbbdc9ed4
add ecx, 0x5423612c
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401a50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401ab0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x406054]
test esi, esi
jle 0x401b9d
mov edi, dword [0x406058]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401ae4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401b96
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401ad0
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401bda
lea ebx, [esi + esi*2]
mov esi, dword [0x406058]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x406058]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401bba
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401b8f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401b8f
mov eax, dword [esp + 0x20]
add ebx, dword [0x406058]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401ba4
add dword [0x406054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401aee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x406058]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x4020a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4020f5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4020ee
test esi, esi
je 0x4020ee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020d0
mov dword [esp], 0x406408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402310
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402348
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40233e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40234a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402330
xor eax, eax
pop ebx
pop esi
ret

Function at 0x403550
Capabilities:
Resume thread
Suspend thread

Disassembly:
push esi
push ebx
mov esi, eax
sub esp, 0x2e4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x403580
add esp, 0x2e4
mov eax, 0xffffffff
pop ebx
pop esi
ret
lea eax, [esp + 0x14]
mov dword [esp], esi
mov dword [esp + 0x14], 0x10003
mov ebx, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
cmovne ebx, dword [esp + 0xcc]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
add esp, 0x2e4
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x41304a
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x414c30
push 1
xor ebx, ebx
push ebx
push 0x414ce0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x41311b
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x414cd0
push eax
call dword [ecx]
test eax, eax
jl 0x413112
cmp byte [ebp + 8], bl
je 0x41309d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x4130ba
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x4130cc
push 0x41437c
jmp 0x4130cf
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x4130e4
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x4130f5
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x413109
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x413135
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x414ac0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
in al, 0x48
sub bl, byte [edx - 0x77]
jl 0x414abb
mov al, byte [0x539c419e]
sahf
inc ecx
pushfd
push ebx
popal
fst st(7)
mov edx, 0xe8e8da7
and byte [eax + 0x4ab1375f], cl
sbb al, 0x5f
or edi, dword [esi - 0x4a]
and eax, 0xfa176a4
mov dword [eax + ebx*4], ebp
mov eax, dword [0xbf5e319e]
and ecx, dword [eax - 0x357ea41c]
pop esi
out 0x51, eax
call 0xd8caaa0c
mov eax, dword [0x5609ea0]
mov al, byte [0x4fe6779e]
add ecx, ecx
pop esi
mov bh, 0xb0
push cs
mov eax, dword [0x5e4ba8a0]
pop edi
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi + 0x5f], bl
popal
ja 0x414ab3
mov al, byte [0x5f5e889e]
popal
ja 0x414abb
mov al, byte [0x5f5e889e]
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi + 0x5f], bl
popal
mov byte [esi - 0x24], bl
lea ecx, [ecx + ebx*4 - 0x99bbaa5]
sbb eax, 0x10a58161
or dword [eax - 0x399ee1d2], ecx
sbb edi, esp
mov ecx, 0xdad9640a
inc edi
invalid
Function at 0x409840
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [0x40e300]
cmp ebx, eax
jae 0x40986d
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x40e304]
test byte [edx + eax*8 + 4], 1
jne 0x40987f
mov dword [0x40d334], 9
or eax, 0xffffffff
jmp 0x40999c
push 1
push 0
push ebx
call fcn.00408af0
add esp, 0xc
mov esi, eax
cmp eax, 0xffffffff
je 0x4098a7
push 2
push 0
push ebx
call fcn.00408af0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x4098af
or eax, 0xffffffff
jmp 0x40999c
mov eax, dword [ebp + 0xc]
neg edi
add edi, eax
jle 0x409941
push 0x1000
push 1
call fcn.00409e10
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x40993b
push 0x8000
push ebx
call fcn.00409e70
add esp, 8
mov dword [ebp - 8], eax
mov eax, 0x1000
cmp edi, 0x1000
jge 0x4098f2
mov eax, edi
mov edx, eax
push edx
mov eax, dword [ebp - 4]
push eax
push ebx
call fcn.004074e0
add esp, 0xc
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x409910
or dword [ebp - 0xc], 0xffffffff
jmp 0x409922
mov eax, edi
sub eax, dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 0xc], 0
test eax, eax
jg 0x4098e3
mov eax, dword [ebp - 8]
push eax
push ebx
call fcn.00409e70
add esp, 8
mov eax, dword [ebp - 4]
push eax
call fcn.004040b0
pop ecx
jmp 0x40998d
or dword [ebp - 0xc], 0xffffffff
jmp 0x40998d
mov dword [ebp - 0xc], 0
test edi, edi
jge 0x40998d
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00408af0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x409966
or dword [ebp - 0xc], 0xffffffff
jmp 0x40998d
push ebx
call fcn.00407980
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0xc], 0
test eax, eax
jne 0x40998d
mov dword [0x40d334], 0xd
or dword [ebp - 0xc], 0xffffffff
push 0
push esi
push ebx
call fcn.00408af0
add esp, 0xc
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40301c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
invalid
invalid