joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003cac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x100a010]
je 0x1003ccc
inc eax
cmp eax, 0x12
jb 0x1003cbd
shl eax, 3
cmp edx, dword [eax + 0x100a010]
mov dword [ebp + 8], eax
jne 0x1003e6a
mov ecx, dword [0x100acc0]
cmp ecx, 1
je 0x1003e3f
test ecx, ecx
jne 0x1003cfe
cmp dword [0x100a004], 1
je 0x1003e3f
cmp edx, 0xfc
je 0x1003e6a
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1003d39
push 5
pop ecx
mov esi, 0x100189c
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003d48
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x1003d80
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003d60
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x1001898
push ebx
call fcn.01006500
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003d85
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x100a014]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003d9c
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.01004850
mov edx, esp
push 6
pop ecx
mov esi, 0x100187c
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003dc8
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1003dd4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003ded
mov eax, dword [ebp + 8]
mov esi, 0x1001878
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x100a014]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003e08
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1003e14
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x1001850
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.01006403
add esp, 0xc
jmp 0x1003e6a
mov ecx, dword [eax + 0x100a014]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003e4a
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005e0d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.01004850
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1005ea2
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x100acc8]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x1005ea2
cmp eax, 1
je 0x1005eba
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1005ea2
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x1005e77
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x1005e9e
xor eax, eax
inc eax
jmp 0x1005ed6
cmp esi, ebx
jae 0x1005ea6
xor eax, eax
jmp 0x1005ed6
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100acc8]
jmp 0x1005ebc
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1006403
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x100af88], ebx
push esi
push edi
jne 0x1006483
push 0x1001ba0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10064be
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001b94
push edi
call esi
test eax, eax
mov dword [0x100af88], eax
je 0x10064be
push 0x1001b84
push edi
call esi
push 0x1001b70
push edi
mov dword [0x100af8c], eax
call esi
cmp dword [0x100acc8], 2
mov dword [0x100af90], eax
jne 0x1006483
push 0x1001b54
push edi
call esi
test eax, eax
mov dword [0x100af98], eax
je 0x1006483
push 0x1001b3c
push edi
call esi
mov dword [0x100af94], eax
mov eax, dword [0x100af94]
test eax, eax
je 0x10064c8
call eax
test eax, eax
je 0x10064af
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x100af98]
test eax, eax
je 0x10064af
test byte [ebp - 8], 1
jne 0x10064c8
cmp dword [0x100acd4], 4
jb 0x10064c2
or byte [ebp + 0x12], 0x20
jmp 0x10064e7
xor eax, eax
jmp 0x10064f7
or byte [ebp + 0x12], 4
jmp 0x10064e7
mov eax, dword [0x100af8c]
test eax, eax
je 0x10064e7
call eax
mov ebx, eax
test ebx, ebx
je 0x10064e7
mov eax, dword [0x100af90]
test eax, eax
je 0x10064e7
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x100af88]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10078a2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
jne 0x10078c0
xor eax, eax
jmp 0x1007a2e
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x100c3a0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x10078f3
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.01008db6
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x10079c5
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edi
jbe 0x1007a00
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
mov dword [ebp - 8], edi
cmp ecx, dword [ebp + 0x10]
jae 0x100794e
mov edx, dword [ebp - 0xc]
inc dword [ebp - 0xc]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x100793f
inc dword [ebp - 0x14]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 8]
mov byte [eax], dl
inc eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x400
jl 0x1007922
mov edi, eax
lea eax, [ebp - 0x41c]
sub edi, eax
push 0
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100798e
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
cmp eax, edi
jl 0x1007997
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x1007913
jmp 0x1007999
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
jne 0x1007a29
cmp dword [ebp - 4], edi
je 0x1007a00
push 5
pop esi
cmp dword [ebp - 4], esi
jne 0x10079f2
call fcn.0100593a
mov dword [eax], 9
call fcn.01005943
mov dword [eax], esi
jmp 0x10079fb
push edi
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10079e7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
jmp 0x1007999
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1007999
push dword [ebp - 4]
call fcn.0100594c
pop ecx
or eax, 0xffffffff
jmp 0x1007a2c
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1007a15
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x1007a15
xor eax, eax
jmp 0x1007a2c
call fcn.0100593a
mov dword [eax], 0x1c
call fcn.01005943
mov dword [eax], edi
jmp 0x10079fb
sub eax, dword [ebp - 0x14]
pop esi
pop ebx
pop edi
leave
ret
Function at 0x1008e42
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
call fcn.01007c5d
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1008f87
push 2
push esi
push dword [ebp + 8]
call fcn.01007c5d
add esp, 0xc
cmp eax, ebx
je 0x1008f87
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x1008f2a
mov ebx, 0x1000
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x1008ebb
call fcn.0100593a
mov dword [eax], 0xc
or esi, 0xffffffff
jmp 0x1008f72
push 0x8000
push dword [ebp + 8]
call fcn.010091aa
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp edi, ebx
mov eax, ebx
jge 0x1008ed5
mov eax, edi
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.010078a2
add esp, 0xc
cmp eax, 0xffffffff
je 0x1008ef1
sub edi, eax
test edi, edi
jg 0x1008ecd
jmp 0x1008f09
call fcn.01005943
cmp dword [eax], 5
jne 0x1008f06
call fcn.0100593a
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.010091aa
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1008f72
jge 0x1008f72
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01007c5d
push dword [ebp + 8]
call fcn.0100767f
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x1008f72
call fcn.0100593a
mov dword [eax], 0xd
call fcn.01005943
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.01007c5d
add esp, 0xc
mov eax, esi
pop edi
jmp 0x1008f89
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x1008f8d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x1009153
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x100c3a0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x1009153
test cl, 0x48
je 0x1008ff3
mov al, byte [eax + 5]
cmp al, 0xa
je 0x1008ff3
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1009045
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x100902d
call fcn.0100593a
mov dword [eax], 9
call fcn.01005943
mov dword [eax], esi
jmp 0x100903d
cmp eax, 0x6d
je 0x1009153
push eax
call fcn.0100594c
pop ecx
or eax, 0xffffffff
jmp 0x1009155
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x100914e
test edx, edx
je 0x1009068
cmp byte [ebx], 0xa
jne 0x1009068
or al, 4
jmp 0x100906a
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x1009148
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x1009138
cmp al, 0xd
je 0x100909e
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x100912a
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x10090b8
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x10090b3
add dword [ebp + 0x10], 2
jmp 0x100910c
mov dword [ebp + 0x10], eax
jmp 0x1009126
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10090e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1009126
cmp dword [ebp - 0xc], 0
je 0x1009126
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x1009101
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x100910c
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x1009129
cmp ebx, dword [ebp + 0xc]
jne 0x1009111
cmp byte [ebp - 1], 0xa
jne 0x1009111
mov byte [ebx], 0xa
jmp 0x1009129
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.01007c5d
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x100912a
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x1009082
jmp 0x1009148
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x1009148
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x1009155
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4016c9
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
push dword [esi + 0x1438]
xor ebp, ebp
call fcn.00402cac
pop ecx
push ebp
push dword [esi + 0x1430]
lea edi, [esi + 0x142c]
push dword [edi]
mov ebx, eax
call dword [0x408028]
push dword [esi + 0x1438]
push ebx
push dword [edi]
call dword [0x408024]
xor ecx, ecx
cmp eax, dword [esi + 0x1438]
jne 0x401764
cmp ecx, dword [esi + 0x143c]
jne 0x401764
push ecx
lea eax, [esi + 0x1224]
push eax
call dword [0x408034]
cmp eax, 0xffffffff
mov dword [esi + 0x1440], eax
jne 0x401741
push 0x4082e4
lea eax, [esi + 8]
push eax
call dword [0x408014]
push 0x37
jmp 0x401775
xor eax, eax
xor byte [eax + ebx], 7
inc eax
cmp eax, 0x7d0
jl 0x401743
push dword [esi + 0x1438]
push ebx
push dword [esi + 0x1440]
call dword [0x408030]
jmp 0x401776
push 0x4082c8
lea eax, [esi + 8]
push eax
call dword [0x408014]
push 0x36
pop ebp
push ebx
call fcn.00402bcf
mov esi, dword [esi + 0x1440]
cmp esi, 0xffffffff
pop ecx
je 0x40178f
push esi
call dword [0x40801c]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x40197d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401990
push esp
mov dword [ebp - 0x24], 0x4016f4
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a2f
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a10
pop ebp
ret 0x10
Function at 0x40193b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
xor esi, esi
call fcn.00407265
push eax
call fcn.00407428
sub byte [esi + 0x435a80], 0x32
pop ecx
call fcn.00407265
push eax
call fcn.00407428
add byte [esi + 0x435a80], 0x9d
pop ecx
call fcn.00407265
push eax
call fcn.00407428
add byte [esi + 0x435a80], 0x58
pop ecx
call fcn.00407265
push eax
call fcn.00407428
xor byte [esi + 0x435a80], 0x86
pop ecx
call fcn.00407265
push eax
call fcn.00407428
add byte [esi + 0x435a80], 0x67
pop ecx
call fcn.00407265
push eax
call fcn.00407428
xor byte [esi + 0x435a80], 0xb2
pop ecx
call fcn.00407265
push eax
call fcn.00407428
add byte [esi + 0x435a80], 0xa
pop ecx
call fcn.00407265
push eax
call fcn.00407428
inc byte [esi + 0x435a80]
pop ecx
call fcn.00407265
push eax
call fcn.00407428
xor byte [esi + 0x435a80], 0xaf
pop ecx
call fcn.00407265
push eax
call fcn.00407428
xor byte [esi + 0x435a80], 0xa2
pop ecx
call fcn.00407265
push eax
call fcn.00407428
add byte [esi + 0x435a80], 0xab
pop ecx
call fcn.00407265
push eax
call fcn.00407428
add byte [esi + 0x435a80], 0x33
pop ecx
call fcn.00407265
push eax
call fcn.00407428
add byte [esi + 0x435a80], 0x35
pop ecx
call fcn.00407265
push eax
call fcn.00407428
add byte [esi + 0x435a80], 0x36
inc esi
pop ecx
cmp esi, 0x23000
jb 0x401945
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401a60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0x10]
mov edi, dword [ebp]
mov ebx, edi
xor ebx, 0x14d
mov dword [esp + 0x18], ebp
cmp dword [esi + 0x14], 0x10
jb 0x401a83
mov esi, dword [esi]
shr edi, 2
push esi
push edi
push str._x_and__p
mov dword [esp + 0x20], edi
call fcn.004010d6
add esp, 0xc
test edi, edi
je 0x401ae0
mov ebp, esi
push 4
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.0040a920
imul ecx, dword [esp + 0x1c], 0x5bd1e991
add esp, 0xc
imul ebx, ebx, 0x5bd1e991
add ebp, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov dword [esp + 0x10], eax
sub edi, 1
jne 0x401a9f
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x401b09
sub eax, 1
je 0x401aff
sub eax, 1
jne 0x401b17
movsx ecx, byte [esi + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [esi + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov eax, ebx
shr eax, 0xd
xor eax, ebx
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0xc
ret
Function at 0x43e640
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a574b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00498391
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x43e6c2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00495e47
mov eax, dword [eax]
push 0x4c01f4
push eax
call fcn.00488b54
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049861c
test bl, bl
je 0x43e6c2
push 0x4c01f4
lea ecx, [esp + 0xc]
call fcn.004989f8
push 0x4c3d50
lea ecx, [esp + 0xc]
call fcn.004989f8
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x43e6fe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049861c
jmp 0x43e7c9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x43e782
lea edx, [esp + 0x7c]
push 0x4c3d4c
push edx
call fcn.00488b54
add esp, 8
test eax, eax
je 0x43e782
lea eax, [esp + 0x7c]
push 0x4c3d48
push eax
call fcn.00488b54
add esp, 8
test eax, eax
je 0x43e782
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43e712
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049861c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x43efc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x43f022
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x43f030
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a57cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4cae08]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x43f168
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x43f096
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0049861c
xor eax, eax
jmp 0x43f1df
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004987a5
push esi
lea ecx, [esp + 0xc]
call fcn.00498a34
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x43f1bd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocStringLen
call fcn.0043efc0
test eax, eax
jne 0x43f1bd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocStringLen
mov ecx, edi
call fcn.0043efc0
test eax, eax
jne 0x43f1bd
lea eax, [esp + 0x14]
push 0x4c3d64
push eax
call fcn.00489d00
mov esi, eax
add esp, 8
test esi, esi
jne 0x43f19c
lea ecx, [esp + 0x14]
push 0x4c3d60
push ecx
call fcn.00489c80
mov esi, eax
add esp, 8
test esi, esi
jne 0x43f19c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x43f19f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00498755
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x43f0ae
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0049861c
xor eax, eax
jmp 0x43f1df
mov byte [esi], 0
push 0x4c3d5c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0049861c
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4