joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e890
Capabilities:
Encrypt data using rc4 ksa
Get disk information
Read .ini file

Disassembly:
sub esp, 0x548
mov eax, dword [0x4130a0]
xor eax, esp
mov dword [esp + 0x544], eax
push ebx
push ebp
push esi
xor ecx, ecx
push edi
xor eax, eax
lea esp, [esp]
mov byte [eax + 0x4dd180], al
inc eax
cmp eax, 0x100
jne 0x40e8b0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x4e1c70], ecx
mov dword [0x4e1c74], ecx
xor edx, edx
mov eax, ecx
div dword [esp + 0x55c]
cmp dword [0x4e5684], 0x9bc
mov esi, edx
jne 0x40e901
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [0x4e1c74]
movsx eax, byte [esi + 0x414170]
mov bl, byte [ecx + 0x4dd180]
add eax, dword [0x4e1c70]
movzx edx, bl
add edx, eax
and edx, 0xff
cmp dword [0x4e5684], 0x88a
mov dword [0x4e1c70], edx
jne 0x40e95d
push 0
push 0
lea eax, [esp + 0x158]
push eax
push 0
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [0x4e1c74]
cmp dword [0x4e5684], 0x298
mov edx, dword [0x4e1c70]
mov al, byte [edx + 0x4dd180]
mov byte [ecx + 0x4dd180], al
jne 0x40e997
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [0x4e1c74]
mov edx, dword [0x4e1c70]
inc ecx
mov byte [edx + 0x4dd180], bl
mov dword [0x4e1c74], ecx
cmp ecx, 0x100
jne 0x40e8d6
xor esi, esi
cmp dword [0x4e5684], 0x523
jne 0x40e9d7
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp dword [0x4e5684], 0x9be
mov dword [0x4e1c74], esi
jne 0x40e9f5
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [esp + 0x554]
pop edi
mov dword [0x4e1c70], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401799
add esp, 0x548
ret
Function at 0x40ea20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [0x4e5684]
push ebx
push esi
push edi
mov edi, dword [0x4dd178]
mov dword [esp + 0x10], eax
call fcn.0040e7e0
cmp dword [0x4e5684], 0x488
mov esi, eax
jne 0x40ea6a
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupWrite]
push esi
call fcn.0040e890
add esp, 4
cmp dword [0x4e5684], 0xac1
jne 0x40ea91
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov esi, dword [esp + 0x10]
dec esi
cmp dword [0x4e5684], 0x638
mov dword [esp + 0x10], esi
jne 0x40eabc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
mov esi, dword [esp + 0x10]
test esi, esi
jl 0x40eb26
mov ecx, dword [0x4e1c74]
inc ecx
and ecx, 0xff
mov dl, byte [ecx + 0x4dd180]
movzx eax, dl
add eax, dword [0x4e1c70]
mov dword [0x4e1c74], ecx
and eax, 0xff
mov bl, byte [eax + 0x4dd180]
mov byte [eax + 0x4dd180], dl
mov byte [ecx + 0x4dd180], bl
movzx ecx, byte [eax + 0x4dd180]
movzx edx, bl
add ecx, edx
mov dword [0x4e1c70], eax
and ecx, 0xff
mov al, byte [ecx + 0x4dd180]
xor byte [edi + esi], al
sub dword [esp + 0x10], 1
mov esi, dword [esp + 0x10]
test esi, esi
jge 0x40eac0
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x40ee00
Capabilities:
Check for unexpected memory writes
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x40f084
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x4130a0]
xor eax, esp
mov dword [esp + 0x43c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4130a0]
xor eax, esp
push eax
lea eax, [esp + 0x454]
mov dword fs:[0], eax
cmp dword [0x4e5684], 0x328
jne 0x40ee99
push 0x35
xor esi, esi
push str.gatofavutumifunides_xukudine_huxaveciguhehetuzepujuyo
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], esi
mov byte [esp + 0x28], 0
call fcn.004011e0
push esi
mov dword [esp + 0x460], esi
call fcn.00401a63
add esp, 4
mov dword [esp + 0x45c], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x40ee99
mov eax, dword [esp + 0x20]
push eax
call fcn.00401a6e
add esp, 4
mov ebx, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor esi, esi
jmp 0x40eeb0
cmp dword [0x4e5684], 0xed3
jne 0x40eed7
push 0
lea ecx, [esp + 0x54]
push ecx
push 0
push 0
call edi
push 0
push 0
push 0
push 0
push 0
push 0
call ebp
cmp esi, 0x5fea2d
jle 0x40eefb
cmp ebx, 0x33c8c6c0
je 0x40eefb
cmp dword [esp + 0x2c], 0x256e89e6
je 0x40eefb
cmp dword [esp + 0x48], 0x2c8468e
jne 0x40ef0d
inc esi
mov eax, esi
cdq
cmp edx, 1
jl 0x40eeb0
jg 0x40ef0d
cmp eax, 0x7fd4d065
jb 0x40eeb0
call fcn.0040eb30
cmp dword [0x4e5684], 0x622
jne 0x40ef3c
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeStatus]
push 0
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
call dword [0x4dd178]
xor eax, eax
mov ecx, dword [esp + 0x454]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x43c]
xor ecx, esp
call fcn.00401799
add esp, 0x44c
ret 0x10
Function at 0x5f0615
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x20], ebx
setbe bh
call fcn.005f062d
mov ebx, esi
setno bh
add bh, 0x1e
jle 0x5f0617
mov ebx, dword [esp]
jmp 0x5f06a4
jmp 0x5f05f3
mov ebx, dword [esp]
jmp 0x5f06a4
mov ebx, 0xbcc444e7
inc bx
jmp 0x5f0679
mov ebx, 0xcc3b4336
push eax
ret
jmp 0x5f064e
jne 0x5f065b
mov ebx, 0xcc3b4336
jmp 0x5f0660
mov esp, edi
lea ebx, [esp + 0x30]
push si
push word [esp]
jne 0x5f0677
je 0x5f064e

Function at 0x5f06c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror dl, 0
jmp 0x5f077e
and ah, dl
call fcn.005f0731
into
xchg dword [esp + 4], ebx
mov ah, byte [esp]
sbb eax, ecx
sub ax, cx
jmp 0x5f0758
xchg dword [esp + 4], ebx
xchg bl, al
clc
mov ax, si
push dword [esp + 4]
ret 8
lea ebx, [ebx - 0x29]
mov eax, 0x332c865a
mov ax, cx
clc
mov ax, bx
lea eax, [esp + ebp]
jmp 0x5f0742
lea ebx, [edx*4]
mov ax, word [esp]
bts bx, bp
jp 0x5f0713
and ah, dl
neg al
jmp 0x5f07be
Function at 0x5f489d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, cx
mov edx, dword [esp]
mov edx, ecx
btc edx, ebp
xchg dword [esp], edx
jmp 0x5f49ec
push ebp
call 0x5f497c
mov dword [esp], esp
pushal
call 0x5f4a3a
pushal
arpl word [esi], ax
cmc
xor byte [esi - 0xc], ah
push 0xd
cld
dec ebp
popal
mov dword [esp + 0x38], ebp
pushfd
mov dword [esp], ecx
push word [esp + 3]
js 0x5f49f2
jns 0x5f4a54
mov cl, 0x22
mov al, 0xd7
and dl, byte [edx - 0x6d08980f]
popal
fmul dword [ecx]
cwde
push cs
imul ebx, dword [eax - reloc.MFC42.DLL_CComboBox::MeasureItem], 0x9c820f
add byte [eax], al
mov dword [esp], esp
pushal
jmp 0x5f49f6

Function at 0x5f4a3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebx, 0x2fdade4d
jmp 0x5f486a
push 0xf05e0f50
jmp 0x5f4a80
lea esp, [esp + 1]
xchg word [esp], bx
lea esp, [esp + 3]
jmp 0x5f47c6
jmp 0x5f47ae
mov ebx, ecx
xchg dl, dh
pushfd
lea esp, [esp]
bsr edx, ebp
jmp 0x5f4a2e
bswap edx
jmp 0x5f4822
bswap edx
call fcn.005f4893
bsr edx, ebx
mov ebx, dword [ebx + reloc.MFC42.DLL_CComboBox::MeasureItem]
sub esp, 0xb
jbe 0x5f4868
xor edx, 0x466bb5bf
mov edx, esp
lea esp, [esp + 3]
jmp 0x5f3af5
xor edx, 0x466bb5bf
mov edx, esp
lea esp, [esp + 3]
jmp 0x5f3af5
jmp 0x5f4852
call fcn.005f489d
pushal
mov dx, 0xe76
jmp 0x5f48c9
not dl
jmp 0x5f494c
lea edx, [edi*4]
jmp 0x5f4953
mov esp, ebp
xchg dh, dl
rcr edx, cl
jge 0x5f4876
not dl
jmp 0x5f487d
lea edx, [edi*4]
push ebx
ret
jb 0x5f4ad0
jae 0x5f4ad0
lea esp, [esp + 2]
mov dword [esp + 0x5c], esi
pushfd
jmp 0x5f4aa4
lea esp, [esp + 0x5c]
jmp 0x5f4a7a
pop word [esp]
mov dword [esp + 0x5c], edi
jmp 0x5f4a5a
pushfd
jmp 0x5f3b3b
cpuid
mov dh, 0x88
lea edi, [edx + edx]
jmp 0x5f4a8d
clc
jb 0x5f4b18
jae 0x5f4b18
jmp [ebx - 5]
push word [esp + 2]
jno 0x5f4a70
pop word [esp]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
call 0x5f4ae3
sub esi, dword [eax + reloc.MFC42.DLL_CComboBox::MeasureItem]
aaa
lodsd eax, dword [esi]
cmp eax, 0x2707b744
mov esi, 0x7c64b2c
setbe cl
jecxz 0x5f4ad5
shl ebx, 2
bsf dx, sp
jbe 0x5f4820
mov esp, 0x43860fd4
std
invalid
ja 0x5f4806
call fcn.005f4b7a

Function at 0x5f4b7a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
xchg dword [esp + 8], eax
call fcn.005f4ae8

Function at 0x5f4f69
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg eax
mov ah, byte [esp]
xchg al, ah
neg ax
xchg dword [esp], edx
jmp 0x5f4f95
mov ax, bp
sbb eax, 0x676267a7
and ax, 0xe06f
btc ax, si
neg al
jmp 0x5f4ff2
lea edx, [edx + 0x25]
bsf ax, bx
bsr ax, ax
xchg dword [esp], edx
call fcn.005f4fd1

Function at 0x5ff315
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x5e4283
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x5e429d
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x5e428c
pop esi
jmp 0x5e42a8
ret 4
jmp 0x5e4276
Function at 0x6d0bb0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
cmc
pushal
push word [esp + 3]
mov bp, word [esp + 0x1f]
jmp 0x6d0bfd
lea ebp, [edi + edi]
bsf ax, bx
rdtsc
rdtsc
jmp 0x6d0b9a
std
pop word [esp + 5]
bswap ebx
xchg word [esp + 0xc], cx
jmp 0x6d0c14
rdtsc
xchg dword [esp + 2], edi
xchg byte [esp + 0x21], ch
mov edi, 0xfaaca96c
mov bp, 0x1d0e
mov bh, al
jmp 0x6d0be7
pop word [esp + 0xe]
lea edx, [edi*4]
add esp, 0xa
jmp 0x6d0dea
lea ebx, [ebp + 0x53]
ror di, cl
mov di, word [esp]
bsr edx, ebp
sub esp, 0x1a
jmp 0x6d0c95
xchg ebx, esi
xchg dl, al
xchg cx, ax
lea esp, [esp + 2]
mov cx, word [esp + 8]
add esp, 2
jmp 0x6d0c40
push word [esp + 4]
neg al
mov ch, byte [esp + 2]
bsf eax, ebp
mov cl, dh
rcl eax, 0x15
jmp 0x6d0cad
mov esi, 0xfe09660c
mov ah, byte [esp + 3]
mov byte [esp + 1], dl
jmp 0x6d0cdd
lea esp, [esp + 3]
lea ebx, [esi*4]
btr edi, esp
mov word [esp + 0x13], bx
and ah, cl
popal
jmp 0x6d0c6a
mov dl, al
mov bl, 0xcd
mov ah, byte [esp + 7]
pop word [esp + 4]
jmp 0x6d0c7f
mov bx, word [esp + 0xe]
xchg word [esp], bx
mov ecx, 0xc988a973
pushfd
btr ebp, ecx
bswap eax
jmp 0x6d0c56
push dword [esp + 3]
pushfd
push dword [esp + 4]
rdtsc
call int.006d0d6b
adc ecx, dword [edx + reloc.MFC42.DLL_CComboBox::MeasureItem]
stosd dword es:[edi], eax
ret 0x4c7d
push word [esp + 3]
shr di, 0xe
cld
pop edi
mov word [esp + 0xb], cx
mov byte [esp + 0xe], ch
jmp 0x6d0cc4
btr di, bp
bsf ax, bx
xchg word [esp + 0x11], ax
bt ebx, ebp
lea esp, [esp + 6]
clc
jmp 0x6d0cf8

Function at 0x6d0d6b
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
bswap ebp
sub esp, 6
push word [esp + 6]
jmp 0x6d0d50
pop edx
xchg word [esp + 4], cx
cpuid
xchg word [esp], bx
push word [esp + 0x13]
add esp, 0xf
jmp 0x6d0d0e
lea esp, [esp]
pop ax
pop si
mov bx, 0xcc7c
lea esp, [esp + 3]
jmp 0x6d0db2
sbb edx, 0x4c9fcf64
mov bh, dh
mov eax, dword [esp + 3]
lea eax, [esp + edx]
xchg byte [esp + 7], dh
jmp 0x6d0d3a
lea edx, [edx*4]
mov ecx, esp
jmp 0x6d0d24
add esi, esp
cld
mov dh, byte [esp + 7]
rdtsc
call fcn.006d0d76
mov al, byte [esp + 1]
xchg dword [esp + 4], edi
xchg cx, bx
lea esi, [esp + 0xde]
jmp 0x6d0dc8
lea esp, [esp]
mov di, bp
rcl ebx, 0x17
neg al
lea edi, [esi*4]
ror ebx, cl
jmp 0x6d0d8c
bswap edi
pop word [esp]
mov edi, dword [esp + 7]
mov di, 0xb574
mov ebx, dword [esp + 5]
inc eax
jmp 0x6d0e4f
pop si
call fcn.006d0e04
cpuid
call fcn.006d0f0b
dec esi
iretd
push dword [esp + 2]
ror ch, cl
xchg byte [esp + 0xa], ah
add esp, 0xc
cld
neg ax
jmp 0x6d0e1a

Function at 0x6d0f80
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea ebp, [esi + ebp]
xchg word [esp + 0x12], si
jmp 0x6d0fab
Function at 0x6d4bbc
Capabilities:
Access peb ldr_data

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov dword [esp], ebp
std
lea esp, [esp]
call fcn.006d057a
insb byte es:[edi], dx
in eax, 0x75
sbb al, 0xef
dec edx
xchg esp, eax
pop es
scasb al, byte es:[edi]
mov ecx, 0xe80ff98
nop
pop ebp
add byte [eax + ebp*8 - 0x23], bl
inc dword [eax + 0x5d900e]
pushfd
call 0x6d03c0
push word [esp]
pop ax
stc
cpuid
cmc
bswap eax
jmp 0x6d0416
mov ecx, eax
rcr edx, 0x1b
neg bh
lea edx, [ebp - 0xd3]
mov bx, word [esp + 1]
jmp 0x6d0454
bts ebp, ebp
xchg dword [esp], edx
rcr si, cl
add esp, 2
add esp, 0
mov byte [esp], cl
jmp 0x6d03fe
btr eax, ebx
mov bl, al
cpuid
xchg word [esp], di
pop di
bswap ebp
jmp 0x6d0465
rcr dh, cl
call fcn.006d0478
imul esp, edx, 0x70
pop ss
loop 0x6d0455
scasd eax, dword es:[edi]
daa
mov bh, 0xd2
and ecx, eax
fidiv dword [reloc.MFC42.DLL_CComboBox::MeasureItem]
rdtsc
rdtsc
std
xor dword [edi], ecx
xor ebp, edi
sets al
lea edx, reloc.MFC42.DLL_CComboBox::MeasureItem
cmc
jmp 0x6d042a
mov ebx, esp
bsf edi, ecx
bsr cx, sp
setno dl
setg bl
mov dl, dh
jmp 0x6d043b
jmp 0x6d1019
call 0x6d101e
jmp 0x6d135e
pop eax
sub eax, 0x6d101e
jmp 0x6d14b0
popal
jmp 0x6d03a8
cmp dword [eax + reloc.MFC42.DLL_CComboBox::MeasureItem], 0
je 0x6d03d7
lea esp, [esp + 8]
jmp 0x6d141a
call 0x6d28b7
jmp 0x6d4c55
mov dword [esp + 0x8c], edi
lea esp, [esp + 0x8c]
jmp 0x6d4c07
mov eax, dword [eax]
jmp 0x6d4c15
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x6d4bf1
mov eax, dword [eax + 8]
push eax
jmp 0x6d28b2
pop eax
sub eax, 0x2d28b7
push eax
jmp 0x6d05da
Function at 0x100200c
Capabilities:
Check if file exists
Identify system language via api
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp + 0x10]
lea eax, [ebp - 0x228]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
call esi
mov bx, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
cmp ax, bx
je 0x10020d7
push edi
push dword [ebp + 0xc]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea eax, [ebp - 0x228]
push eax
call edi
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call esi
movzx eax, ax
push eax
lea eax, [ebp - 0x20]
push 0x100110c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
call esi
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x228]
push eax
call esi
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10020d7
push dword [ebp + 0x10]
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 0xc]
call edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1002117
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push 0x104
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.0100200c
push 1
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x208]
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
leave
ret 4

Function at 0x100227d
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x2c8
push ebx
push esi
push 2
push 4
lea eax, [ebp + 0x6c]
push eax
push 4
push 0x10011c8
xor ebx, ebx
push 0x1001158
mov dword [ebp + 0x6c], ebx
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
jmp loc.0105d51d
Function at 0x100241f
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x10011e0
call fcn.01002608
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x100245c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100245c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002474
cmp eax, 0x20b
je 0x1002461
mov dword [ebp - 0x1c], ebx
jmp 0x1002488
cmp dword [ecx + 0x84], 0xe
jbe 0x100245c
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1002482
cmp dword [ecx + 0x74], 0xe
jbe 0x100245c
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1003018], 0xffffffff
or dword [0x100301c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1003014]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1003010]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1003020], eax
jmp 0x105cb71

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405e6a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405e8e
xor eax, eax
test eax, eax
je 0x405ea0
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405ea0
xor ecx, ecx
jmp 0x405ea3
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4

Function at 0x405f43
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43eacc], 0
push esi
jne 0x405f7a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f54
mov dword [ecx*4 + 0x43eac8], eax
inc ecx
cmp ecx, 0x100
jl 0x405f4f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405fab
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43eac8]
xor eax, esi
inc ecx
dec edx
jne 0x405f8d
pop edi
not eax
pop esi
ret 0xc

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40560d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40561c
pop dword [ebp - 0x4c]
mov eax, 0x9e40fcc9
add eax, 0x61ff5953
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xe5a04dba
add dword [ebp - 0x5c], 0x68b1f791
mov dword [ebp - 0x58], 0x3c01d138
add dword [ebp - 0x58], 0xf6317b0d
mov dword [ebp - 0x54], 0x9884620b
add dword [ebp - 0x54], 0xb3c7e223
mov dword [ebp - 0x50], 0x1cee7fcc
add dword [ebp - 0x50], 0xe3118034
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x5ece99d3
sub eax, 0x5e8dc97f
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9f14857f
add dword [ebp - 0x5c], 0xd55de3d7
mov dword [ebp - 0x58], 0x94b283c
sub dword [ebp - 0x58], 0xc7dec6c7
mov dword [ebp - 0x54], 0x35aa755a
add dword [ebp - 0x54], 0x2dc4f712
mov dword [ebp - 0x50], 0x1ce8fcdd
add dword [ebp - 0x50], 0xe3170323
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x770c176e
add eax, 0x8934b8de
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x386bf
push 0
call eax
mov ecx, 0xae6989eb
add ecx, 0x5196b9b1
mov edi, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x4c]
mov edx, 0x5f770140
sub edx, 0x30bd12d7
mov dword [ebp - 0x48], 0xf37ea033
mov esi, dword [ebx]
xor dword [ebp - 0x40], 0x4f5484ec
add esi, edx
sub dword [ebp - 0x3c], edi
mov dword [edi], esi
sub dword [ebp - 0x48], 0x30fdaa2
add edi, 0xf139f7ba
sub edi, 0xf139f7b6
add ebx, 4
loop 0x405738
add eax, 0x10143
mov ebx, eax
add eax, 5
mov ecx, 0x25eaf182
add ecx, 0xda550e7e
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1000bc8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1000bc99
pop dword [ebp - 0x18]
mov eax, 0x1000bc99
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3af87
push 0
mov eax, 0x3e968cc9
add eax, 0xd16c0443
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x5f5de4dc
add ecx, 0xa0a26469
mov edx, eax
mov esi, 0xfeff0306
sub esi, 0xeefa9706
add esi, dword [ebp - 0x18]
mov ebx, 0x66bf7622
sub dword [ebp - 0x10], ecx
mov edi, dword [esi]
sub dword [ebp - 0x10], ecx
xor edi, ebx
sub dword [ebp - 8], ecx
mov dword [edx], edi
xor dword [ebp - 0x14], eax
add edx, 4
add esi, 4
loop 0x1000bced
add eax, 0x5e6deec4
add eax, 0xa1932923
mov ebx, eax
add eax, 0xe7ff1cfc
sub eax, 0xe7ff1cf7
mov ecx, 0x7ce9332a
add ecx, 0x9316ccd6
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x6f7910a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_InvokeOn32___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.InvokeOn32
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f791100
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_IntOpInitialize___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.IntOpInitialize
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f791160
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CallbackProcessing_3216___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.CallbackProcessing_3216
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f7911c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_IUnknownObj32___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.IUnknownObj32
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f791220
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CSm16ReleaseHandler_Release32___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.CSm16ReleaseHandler_Release32
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f791280
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_ThkMgrInitialize___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.ThkMgrInitialize
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4