joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e1f7d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x100e1fb2
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x100e1faf
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x100e1fbb
add edx, 0x28
cmp edx, esi
jne 0x100e1f9d
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x100e1fb8
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x37ea10be
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0xf816fac
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x100323d9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10032425
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1003241f
mov ecx, dword [0x100608c0]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10032413
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100323f8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x10032421
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x100331b0
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f2a0
push 0x10045760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
cmp dword [ebp + 0xc], 1
jne 0x100332b0
push 0x24
push 0
push 0x10060f28
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [0x10060f44], eax
mov ecx, dword [0x10060f44]
mov dword [0x10060f10], ecx
mov dword [0x10060f28], 2
push 2
mov edx, dword [ebp + 8]
push edx
call fcn.1003b506
add esp, 8
mov eax, dword [0x1005d3bc]
xor eax, dword [0x1005d3f8]
xor eax, dword [0x1005d3a8]
and eax, 0x40000
test eax, eax
je 0x100332a6
mov cl, byte [0x10060f08]
mov byte [ebp - 0x58], cl
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x57]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
lea edx, [ebp - 0x58]
push edx
push 0x1005d350
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10033276
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [0x10061158], eax
push fcn.10034d97
push 0x1005d34c
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x58]
push edx
push 0x1005d350
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, 1
jmp 0x100333b2
call fcn.10034d97
jmp 0x100333b2
cmp dword [ebp + 0xc], 0
jne 0x1003336a
mov eax, dword [0x1005d3bc]
xor eax, dword [0x1005d3f8]
xor eax, dword [0x1005d3a8]
and eax, 0x40000
test eax, eax
je 0x100332eb
push 0
push 0x1005d350
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, 1
jmp 0x100333b2
mov dword [ebp - 4], 0
mov dword [ebp - 0x5c], 1
cmp dword [0x10060f48], 0
je 0x10033337
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x10060f48]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], 0
jmp 0x10033337
call fcn.10034d6e
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x64]
jmp 0x100333b2
mov dword [ebp - 0x60], 1
cmp dword [0x10060f48], 0
je 0x100333af
mov dword [ebp - 4], 2
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x10060f48]
mov dword [ebp - 0x60], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x100333af
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100343db
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x10034447
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x10034491
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1003448f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x10034493
jmp 0x1003443e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10034d97
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0
push 0x1005d350
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp dword [0x10061158], 0
je 0x10034dd6
mov eax, dword [0x10061158]
mov dword [ebp - 8], eax
mov dword [0x10061158], 0
call dword [ebp - 8]
test eax, eax
jne 0x10034dd6
xor eax, eax
jmp 0x10034e96
call fcn.10034cc5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x10034e24
cmp dword [0x10060f48], 0
je 0x10034e1d
push 0x1006116c
push 1
mov ecx, dword [0x10060f10]
push ecx
call dword [0x10060f48]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10034e16
call fcn.10034d6e
xor eax, eax
jmp 0x10034e96
mov eax, 1
jmp 0x10034e96
mov eax, 1
jmp 0x10034e96
cmp dword [ebp - 4], 0
jne 0x10034e94
call fcn.100333f1
push eax
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
call fcn.10033402
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
je 0x10034e7a
push 0x1005d6a0
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
call fcn.10033402
push eax
lea ecx, [ebp - 0x108]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x40010
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x10034e96
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003aec5
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.100364fd
add esp, 4
and eax, 0xff
test eax, eax
je 0x1003af4e
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1003af4c
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x1003af4c
jmp 0x1003af4e
jmp 0x1003aece
mov esp, ebp
pop ebp
ret

Function at 0x1003b415
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0x10061468]
test eax, eax
jne 0x1003b429
call fcn.1003b344
xor ecx, ecx
mov cl, byte [0x10061465]
test ecx, ecx
jne 0x1003b4b0
xor edx, edx
mov dl, byte [0x10061464]
test edx, edx
jne 0x1003b4b0
cmp dword [0x10061670], 0
je 0x1003b48b
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x180
mov ecx, dword [0x10061670]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
push 0x186
mov eax, dword [0x10061670]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x10061670]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x1003b4b0
push 0x10001
push 0x10061468
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x1003b4b0
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x1003e5ba
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x1003e5ca
xor eax, eax
jmp 0x1003e793
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x1003e74b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x1005f40c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x1005f40c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x1005f40c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x1005f40c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x1005f40c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x1005f40c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x1005f40c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x1005f40c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x1003e5d3
cmp dword [ebp + 0x10], 0
je 0x1003e78d
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x1005f40c]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x1003e751
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x40151a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
nop
mov eax, 3
mov dword [ebp - 0x58], eax
mov eax, 0x4012bb
mov dword [ebp - 0x54], eax
mov eax, 0
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x4c], eax
mov eax, 0
mov dword [ebp - 0x3c], eax
mov eax, 0
mov dword [ebp - 0x38], eax
mov eax, 0x4030b0
mov dword [ebp - 0x34], eax
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [ebp - 0x48], eax
mov eax, 0x64
push eax
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x44], eax
mov eax, 0x7f00
push eax
mov eax, 0
push eax
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_RegisterClassA
test eax, eax
je 0x4015a6
jmp 0x4015cd
mov eax, 0x10
push eax
mov eax, str.Error
push eax
mov eax, str.This_program_requires_Windows_NT_
push eax
mov eax, 0
push eax
call sub.user32.dll_MessageBoxA
mov eax, 0
jmp 0x4016f0
mov eax, 0x190
push eax
mov eax, 0x280
push eax
mov eax, 0
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_SetRect
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0xcf0000
push eax
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_AdjustWindowRectEx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
sub eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
sub eax, ecx
mov dword [ebp - 8], eax
mov eax, 0
push eax
call sub.user32.dll_GetSystemMetrics
mov ecx, dword [ebp - 8]
sub eax, ecx
mov ecx, 2
cdq
idiv ecx
mov dword [ebp - 0x10], eax
mov eax, 1
push eax
call sub.user32.dll_GetSystemMetrics
mov ecx, dword [ebp - 4]
sub eax, ecx
mov ecx, 3
cdq
idiv ecx
mov dword [ebp - 0xc], eax
mov eax, 0
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, 0xcf0000
push eax
mov eax, str.Fern____c__abreojosensamblador.net
push eax
mov eax, 0x4030b0
push eax
mov eax, 0
push eax
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_UpdateWindow
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
je 0x4016e8
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4016b1
mov eax, dword [ebp - 0x28]
jmp 0x4016f0
leave
ret 0x10
Function at 0x402240
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
nop
lea eax, [ebp - 0x18]
push eax
call fcn.004024d1
add esp, 4
mov eax, 2
push eax
call sub.msvcrt.dll___set_app_type
add esp, 4
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x402340
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
jne 0x4022a9
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x40228b
mov eax, dword [ebp - 0x1c]
mov ecx, 0x22
movsx edx, byte [eax]
cmp ecx, edx
jne 0x4022f6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
movsx ecx, byte [eax]
test ecx, ecx
je 0x4022f1
mov eax, dword [ebp - 0x1c]
mov ecx, 0x22
movsx edx, byte [eax]
cmp ecx, edx
jne 0x4022ef
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x4022f1
jmp 0x4022bc
jmp 0x402322
mov eax, dword [ebp - 0x1c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x402322
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
je 0x402322
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x4022f6
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
jne 0x402340
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x402322
lea eax, [ebp - 0x60]
push eax
call sub.kernel32.dll_GetStartupInfoA
movzx eax, word [ebp - 0x30]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x34]
and eax, 1
mov ecx, 0
cmp ecx, eax
jne 0x40236b
mov eax, 0xa
mov dword [ebp - 0x64], eax
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.0040151a
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
push eax
call sub.msvcrt.dll_exit
add esp, 4
leave
ret
Function at 0x401a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
push 0x214c6981
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x104
lea eax, [ebp - 0x2b8]
push eax
call dword [ebp - 0x1c]
push 0x1c368da0
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x14], eax
call dword [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x158]
push ecx
call section..text
add esp, 0xc
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x144], 0x2e
mov byte [ebp - 0x143], 0x64
mov byte [ebp - 0x142], 0x6c
mov byte [ebp - 0x141], 0x6c
mov byte [ebp - 0x140], 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2b8]
push eax
call fcn.00401e90
add esp, 8
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x2b8]
push edx
call fcn.00401e90
add esp, 8
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00401e90
add esp, 8
push 0x4e1e0843
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x1a4], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
lea edx, [ebp - 0x2b8]
push edx
call dword [ebp - 0x1a4]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
je 0x401ba5
mov dword [ebp - 0x2bc], 0
push 0x7463a627
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x2c4], eax
push 0
lea eax, [ebp - 0x2bc]
push eax
push 0xea00
push section..data
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [ebp - 0x2c4]
push 0x70ebfb28
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x2c0], eax
mov edx, dword [ebp - 0x13c]
push edx
call dword [ebp - 0x2c0]
mov byte [ebp - 0x1b0], 0x60
mov byte [ebp - 0x1af], 0x47
mov byte [ebp - 0x1ae], 0x5c
mov byte [ebp - 0x1ad], 0x56
mov byte [ebp - 0x1ac], 0x5e
mov byte [ebp - 0x1ab], 0x5e
mov byte [ebp - 0x1aa], 1
mov byte [ebp - 0x1a9], 0
mov byte [ebp - 0x1a8], 0x12
mov byte [ebp - 0x1a7], 0x32
push 0x32
push 0xa
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.00401240
add esp, 0x10
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0x45
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0
push 0x44
push 0
lea edx, [ebp - 0x1a0]
push edx
call fcn.00401220
add esp, 0xc
mov dword [ebp - 0x1a0], 0x44
push 0x10
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00401220
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x2b8]
push edx
call fcn.00401e90
add esp, 8
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x128]
push ecx
call fcn.00401e80
add esp, 8
lea edx, [ebp - 0x2b8]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.00401e90
add esp, 8
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00401df0
add esp, 4
push 0xe621d6
call fcn.004011f0
add esp, 4
mov dword [ebp - 4], eax
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x1a0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x128]
push ecx
push 0
call dword [ebp - 4]
push 0xea60
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret
Function at 0x401d00
Capabilities:
Contain obfuscated stackstrings
Get common file path
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push 0x7f8a
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
push eax
call dword [sym.imp.USER32.dll_SetSystemCursor]
call fcn.00401a50
call fcn.00401280
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x220], 0x5c
mov byte [ebp - 0x21f], 0x5c
mov byte [ebp - 0x21e], 0x73
mov byte [ebp - 0x21d], 0x79
mov byte [ebp - 0x21c], 0x73
mov byte [ebp - 0x21b], 0x74
mov byte [ebp - 0x21a], 0x65
mov byte [ebp - 0x219], 0x6d
mov byte [ebp - 0x218], 0x2e
mov byte [ebp - 0x217], 0x65
mov byte [ebp - 0x216], 0x78
mov byte [ebp - 0x215], 0x65
mov byte [ebp - 0x214], 0
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40699a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x4069d1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4069ab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x4069a6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x4069e4
pop edi
not eax
pop esi
ret 0xc