joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10144760
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x1014478f
push esi
call fcn.10144ef0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x10144788
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x1014480a
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x101447fa
mov eax, dword [esi + 8]
test eax, eax
je 0x101447b4
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
mov edx, dword [esi + 0x190]
mov eax, dword [edx]
push esi
call eax
add esp, 4
test eax, eax
je 0x101447f6
cmp eax, 2
je 0x101447fa
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x101447a5
cmp eax, 3
je 0x101447dc
cmp eax, 1
jne 0x101447a5
add dword [ecx + 4], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x101447a5
mov edx, dword [esi + 0x11c]
add dword [eax + 8], edx
jmp 0x101447a5
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
call fcn.101445f0
pop esi
ret
cmp eax, 0xcc
je 0x1014482c
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
call fcn.101445f0
pop esi
ret
Function at 0x1014d1d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x20]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1a8]
mov dword [esp + 0x18], esi
jne 0x1014d1f7
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x1014d203
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
cmp dword [edi + 0x64], ecx
mov dword [esp + 0xc], ecx
jle 0x1014d30f
push ebx
lea edx, [esi + 0x20]
push ebp
mov dword [esp + 0x18], edx
jmp 0x1014d24c
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebp, dword [edx]
cdq
idiv ebp
cmp dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
je 0x1014d26d
mov eax, dword [esi + 0x18]
add dword [eax + ecx*4], 0xff
lea eax, [eax + ecx*4]
mov edx, dword [esi + 0x18]
mov edi, dword [edx + ecx*4]
add ebp, 0xffffffff
mov ecx, ebp
xor eax, eax
xor ebx, ebx
call fcn.1014d040
mov ecx, eax
xor esi, esi
cmp esi, ecx
jle 0x1014d2a2
lea esp, [esp]
add ebx, 1
mov ecx, ebp
mov eax, ebx
call fcn.1014d040
mov ecx, eax
cmp esi, ecx
jg 0x1014d290
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + edi], al
add esi, 1
cmp esi, 0xff
jle 0x1014d285
cmp dword [esp + 0x10], 0
je 0x1014d2f0
mov eax, 1
lea ecx, [edi - 1]
jmp 0x1014d2d0
movzx edx, byte [edi]
mov byte [ecx], dl
movzx edx, byte [edi + 0xff]
mov byte [edi + eax + 0xff], dl
add eax, 1
sub ecx, 1
cmp eax, 0xff
jle 0x1014d2d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
add dword [esp + 0x18], 4
add eax, 1
cmp eax, dword [ecx + 0x64]
mov dword [esp + 0x14], eax
jl 0x1014d240
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x1030e473
Capabilities:
Get number of processors

Disassembly:
jmp 0x10302794
call fcn.1030277f
salc
arpl word [ebp - 0x79], cx
loop 0x1030278a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x103283b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x103211dd
jmp 0x1030d476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x1031c856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x10324e32
jmp 0x1031c86d
call fcn.1031c858
adc byte [eax - 0x77], dl
loopne 0x1031c87c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x1030277d
jmp 0x103211f4
call fcn.103211df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x10302bce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x10303698
jmp 0x10304265

Function at 0x1032d6f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x1031ca70

Function at 0x10583a3d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x10583a9b
jmp 0x10583a5a
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x10583a5a
jmp 0x10583a9b
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret
Function at 0x1001224e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1001225d
pop dword [ebp - 0x28]
mov eax, 0x161b6464
add eax, 0xf9e5bdf9
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x7fd54903
sub dword [ebp - 0x38], 0x318303b8
mov dword [ebp - 0x34], 0x23f38be1
sub dword [ebp - 0x34], 0xf1c03f9c
mov dword [ebp - 0x30], 0xb19bb74a
sub dword [ebp - 0x30], 0x654f731c
mov dword [ebp - 0x2c], 0x4a4cf9bc
add dword [ebp - 0x2c], 0xb5b30644
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xa2158d35
sub dword [ebp - 0x38], 0x2da323df
mov dword [ebp - 0x34], 0xe5b1c6f6
add dword [ebp - 0x34], 0x5bba9a7f
mov dword [ebp - 0x30], 0xf629497b
sub dword [ebp - 0x30], 0x92b9dd0f
mov dword [ebp - 0x2c], 0x6cdf232c
add dword [ebp - 0x2c], 0x9320dcd4
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x39c6d42f
sub eax, 0x29c58393
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x36a0a
push 0
call eax
mov ecx, 0xe39ef896
sub ecx, 0xe39eb862
xor ebx, ebx
add ebx, eax
mov esi, 0x10041c00
add esi, dword [ebp - 0x28]
mov edi, 0x1b063226
add dword [ebp - 0x20], eax
mov edx, dword [esi]
xor dword [ebp - 4], eax
sub edx, edi
sub dword [ebp - 0x20], 0x6cadcbe1
mov dword [ebx], edx
add ebx, 0xf7dd3981
sub ebx, 0xf7dd397d
add esi, 0xc8203cd7
sub esi, 0xc8203cd3
loop 0x10012370
add eax, 0xf3a3
mov ebx, eax
add eax, 0xb3a65629
sub eax, 0xb3a65624
mov ecx, 0xe24a11e9
add ecx, 0x2db5ee17
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40974c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40975b
pop dword [ebp - 0x3c]
mov eax, 0x62ff0cc5
sub eax, 0x62be756a
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x4677d286
add dword [ebp - 0x4c], 0x7da72c5
mov dword [ebp - 0x48], 0x28277837
add dword [ebp - 0x48], 0xa0bd40e
mov dword [ebp - 0x44], 0x2bed6e5e
add dword [ebp - 0x44], 0x205ed5d0
mov dword [ebp - 0x40], 0x66b7fabe
sub dword [ebp - 0x40], 0x66b7fabe
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xa65ca95a
sub dword [ebp - 0x4c], 0x31ea4004
mov dword [ebp - 0x48], 0x9f81b7e6
add dword [ebp - 0x48], 0xa1eaa98f
mov dword [ebp - 0x44], 0x1690e680
sub dword [ebp - 0x44], 0xb3217a14
mov dword [ebp - 0x40], 0xb28dd667
sub dword [ebp - 0x40], 0xb28dd667
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3bf3a
push 0
call eax
mov ecx, 0xe587344b
sub ecx, 0xe586e2c2
xor edx, edx
add edx, eax
mov esi, 0x973bcd7a
add esi, 0x6905e286
add esi, dword [ebp - 0x3c]
mov ebx, 0xe1bb59ed
sub ebx, 0x73265f49
mov dword [ebp - 0xc], 0xebef614f
mov edi, dword [esi]
xor dword [ebp - 0x34], eax
add edi, ebx
add dword [ebp - 0x18], edx
mov dword [edx], edi
add dword [ebp - 8], ebx
add edx, 0xb6e03ead
sub edx, 0xb6e03ea9
add esi, 4
loop 0x409875
add eax, 0xb8ce8077
sub eax, 0xb8cd4780
mov ebx, eax
add eax, 0x48f09139
sub eax, 0x48f09134
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0xb3a45c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb3a465
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb3a92c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
lea eax, [ebp - 0x18]
call fcn.00a14db0
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb09074]
call fcn.00b0afec
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0xb3a8ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0b0d8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb3a458
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb3a43c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb3a440
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
mov dl, byte [0xb3a940]
call fcn.00b0a4ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00aecc40
test al, al
je 0xb3a53c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0a944
jmp 0xb3a54a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0a9c4
mov eax, dword [ebp - 4]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b0aa44
xor eax, eax
push ebp
push 0xb3a5b1
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0a904
jmp 0xb3a599
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0xb74238]
mov eax, dword [eax]
call fcn.00a779d0
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb3a5a7
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb3a57a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb3a5bb
jmp 0x17b430e
Function at 0xb4db34
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esi], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0x40
call fcn.00b4d370
test al, al
jne 0xb4db70
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4df34
mov dword [esi], 1
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x5a4d
je 0xb4db92
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4df34
mov dword [esi], 2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
add eax, 0xf8
cdq
push edx
push eax
call fcn.00b4d370
test al, al
jne 0xb4dbc1
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4df34
mov dword [esi], 3
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
je 0xb4dbfb
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4df34
mov dword [esi], 4
mov eax, dword [ebp - 0x10]
cmp word [eax + 4], 0x14c
je 0xb4dc1b
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4df34
mov dword [esi], 5
mov eax, dword [ebp - 0x10]
test byte [eax + 0x38], 1
je 0xb4dc39
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4df34
mov dword [esi], 6
xor eax, eax
push ebp
push 0xb4df1f
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x17efb52
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0xb51880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov esi, dword [0xb74054]
xor eax, eax
push ebp
push 0xb519fd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [0xb74238]
mov eax, dword [eax]
call fcn.00a7824c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00a1a6a4
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
lea edx, [esi + 0xdf8]
call fcn.00a15024
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 4]
pop edx
call fcn.00a150cc
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0xa792a0]
call fcn.00a79350
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xb519d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [esi + 0x3d]
push eax
mov ecx, 0xb51a14
mov edx, 0xb51a28
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x14]
xor eax, eax
mov al, byte [esi + 0x3c]
push eax
mov ecx, 0xb51a3c
mov edx, 0xb51a28
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov al, byte [esi + 0x3f]
push eax
mov ecx, 0xb51a50
mov edx, 0xb51a28
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x14]
mov al, byte [esi + 0x3e]
push eax
mov ecx, 0xb51a60
mov edx, 0xb51a28
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x14]
mov al, byte [esi + 0x30]
push eax
mov ecx, 0xb51a74
mov edx, 0xb51a28
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [0xb744a8]
mov eax, dword [eax]
push eax
mov ecx, 0xb51a88
mov edx, 0xb51a28
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx + 0x38c]
push eax
mov ecx, 0xb51a9c
mov edx, 0xb51a28
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebx + 0x390]
push eax
mov ecx, 0xb51aac
mov edx, 0xb51a28
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb519da
cmp dword [ebp - 8], 0
je 0xb519d2
mov eax, dword [ebp - 8]
call fcn.00a13f44
ret
Function at 0xb5e98c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0xb5e994
push ecx
push ebx
push esi
mov eax, 0xb5e334
call fcn.00a17380
mov esi, dword [0xb74238]
xor eax, eax
push ebp
push 0xb5eb66
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00a13098
cmp eax, 2
jne 0xb5ea25
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00a13100
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.00a19d98
call fcn.00aef550
mov ebx, 0x64
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.00a13100
mov eax, dword [ebp - 0x18]
call fcn.00a15280
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.00a13100
mov eax, dword [ebp - 0x1c]
call fcn.00a1a250
test al, al
je 0xb5ea25
push 0xa
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0xb5e9e7
mov al, byte [0xb5eb74]
push eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00a13100
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0xb5eb80
call fcn.00a1f378
mov eax, dword [ebp - 0x20]
call fcn.00a15280
push eax
push 0
push 0
call fcn.00a176e8
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0xb5ea9c
push 0x40
push 0xb5eb84
lea edx, [ebp - 0x2c]
mov eax, dword [0xb7431c]
call fcn.00a170b0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00ad11c0
mov eax, dword [ebp - 0x28]
call fcn.00a15280
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0xb5eb4b
mov dl, 1
mov eax, dword [0xa29c6c]
call fcn.00a13f14
mov edx, dword [0xb74230]
mov dword [edx], eax
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00aec108
test al, al
jne 0xb5eace
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00a13f44
jmp 0xb5eb4b
mov eax, dword [esi]
call fcn.00a77af4
lea edx, [ebp - 0x34]
mov eax, dword [esi]
call fcn.00a7824c
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00a1a6a4
mov eax, dword [ebp - 0x30]
call fcn.00a1a9f8
mov ecx, dword [0xb74070]
mov eax, dword [esi]
mov edx, dword [0xb50208]
call fcn.00a77b0c
mov ecx, dword [0xb743f4]
mov eax, dword [esi]
mov edx, dword [0xb5d230]
call fcn.00a77b0c
mov ecx, dword [0xb74108]
mov eax, dword [esi]
mov edx, dword [0xb5c434]
call fcn.00a77b0c
mov ecx, dword [0xb742d4]
mov eax, dword [esi]
mov edx, dword [0xb5b494]
call fcn.00a77b0c
mov eax, dword [esi]
call fcn.00a77b8c
push ebx
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb5eb6d
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.00a14dd4
ret
Function at 0x415349
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x415358
pop dword [ebp - 0x10]
mov eax, 0xd8d00238
add eax, 0x27715120
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x4189e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x55b9
xor ebx, ebx
add ebx, eax
mov esi, 0xa0b1e439
add esi, 0x5f916fc7
add esi, dword [ebp - 0x10]
mov edi, 0x1448cda7
mov dword [ebp - 0xc], 0x24efa774
mov edx, dword [esi]
xor dword [ebp - 8], 0x19650858
add edx, edi
sub dword [ebp - 8], ecx
mov dword [ebx], edx
xor dword [ebp - 4], 0x98689f95
add ebx, 4
add esi, 0xb6cbd914
sub esi, 0xb6cbd910
loop 0x4153a8
add eax, 0x908e2cf2
add eax, 0x6f731cc5
xor ebx, ebx
add ebx, eax
add eax, 0x9d2a723d
add eax, 0x62d58dc8
mov ecx, 0x1247f683
sub ecx, 0x1207f683
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x40e034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
mov ecx, 0x103
sub ecx, eax
push ecx
push str._tencentQQMiscLMM1
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401095
push 0x5c
mov esi, str.QTB.dll
push esi
call dword [sym.imp.MSVCR100.dll_strchr]
pop ecx
pop ecx
test eax, eax
jne 0x401087
call fcn.004010a3
jmp 0x40108e
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004097e2
leave
ret

Function at 0x401557
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4015ae
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4015a0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40159c
cmp edi, eax
jae 0x4015a0
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40158e
cmp edi, eax
jb 0x4015a4
xor eax, eax
jmp 0x4015ad
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4015c9
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x401de9
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a0
mov eax, dword [0x40e034]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x4a0], eax
mov ebx, edx
cmp edi, esi
je 0x401e5b
cmp eax, esi
je 0x401e5b
cmp ebx, esi
je 0x401e5b
push 0x21
push esi
push eax
call dword [sym.imp.MSVCR100.dll_memset]
add esp, 0xc
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x49c], edi
cmp edi, 0xffffffff
je 0x401e5b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x401e6c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004097e2
leave
ret
mov dword [ebx], eax
lea eax, [ebp - 0x494]
call fcn.004015c9
push esi
lea eax, [ebp - 0x498]
push eax
mov ebx, 0x400
push ebx
lea eax, [ebp - 0x43c]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x401eca
mov eax, dword [ebp - 0x498]
cmp eax, esi
jbe 0x401ed0
lea ecx, [ebp - 0x43c]
push ecx
lea ecx, [ebp - 0x494]
call fcn.004015ed
pop ecx
push esi
lea eax, [ebp - 0x498]
push eax
push ebx
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x49c]
call edi
test eax, eax
jne 0x401e97
lea edi, [ebp - 0x494]
lea ebx, [ebp - 0x18]
call fcn.00401694
push dword [ebp - 0x49c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebp - 0x3c]
movzx eax, byte [ebp + esi - 0x18]
push eax
push str._02x
push 3
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
inc esi
add edi, 2
cmp esi, 0x10
jl 0x401eed
push 0x20
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x4a0]
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov al, 1
jmp 0x401e5d