joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fc10
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x434e78]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40fc56
cmp word [ebx], dx
jne 0x40fc56
or byte [eax + edi + 0x28], 4
jmp 0x40fc5b
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x40fdbe
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x40fd9e
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x40fc9c
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x40fcd2
cmp eax, edx
jae 0x40fce0
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x40fc77
jmp 0x40fdbe
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40fd99
cmp dword [ebp - 0x18], 0
je 0x40fd99
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x434e78]
test byte [eax + edi + 0x28], 0x48
je 0x40fd6f
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x40fd33
mov word [esi], cx
jmp 0x40fd6a
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x434e78]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x434e78]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x434e78]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x40fdbe
pop eax
cmp word [ebp - 4], ax
jne 0x40fd7f
cmp esi, ebx
jne 0x40fd7f
mov word [esi], ax
jmp 0x40fdbb
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00418434
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x40fdbe
push 0xd
pop eax
jmp 0x40fd7a
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x434e78]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x40fdb8
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x40fdbe
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41317f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41321c
push ebx
push esi
call fcn.00413148
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004130dc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4131c9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41321b
push edi
push eax
call fcn.0040d4be
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4131e9
call fcn.0040d484
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41321a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004130dc
add esp, 0x20
test eax, eax
jne 0x413208
push edi
call fcn.0040d484
jmp 0x413210
push ebx
call fcn.0040d484
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41ad15
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0041ac91
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x41ae84
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x41ae84
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x41ae39
jg 0x41ad71
test eax, eax
je 0x41ae2f
push 1
push 0x1000
call fcn.00411c82
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x41ad94
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x41ae26
push 0x8000
push ebx
call fcn.0040c268
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x41adbd
jg 0x41adb8
cmp ecx, 0x1000
jb 0x41adbd
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00410fed
add esp, 0x10
cmp eax, 0xffffffff
je 0x41ae02
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x41adb8
jl 0x41ade9
test ecx, ecx
jne 0x41adaa
push dword [ebp - 0xc]
push ebx
call fcn.0040c268
push esi
call fcn.0040d484
add esp, 0xc
xor ebx, ebx
jmp 0x41ae92
cmp byte [edi + 0x24], 0
je 0x41ae19
cmp dword [edi + 0x20], 5
jne 0x41ae19
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x41ae24
mov ebx, dword [edi + 0x18]
jmp 0x41ae26
xor ebx, ebx
push esi
call fcn.0040d484
pop ecx
jmp 0x41ae92
test ecx, ecx
jg 0x41adfb
jl 0x41ae39
test eax, eax
jae 0x41adfb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00418434
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x41ae59
cmp byte [edi + 0x1c], 0
je 0x41adfb
jmp 0x41ae8a
push ebx
call fcn.00413973
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x41adfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x41ae92
cmp byte [edi + 0x1c], 0
je 0x41ae8f
mov ebx, dword [edi + 0x18]
jmp 0x41ae92
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00418434
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41c3e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c40d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41c40d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403f2c
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x1b10a419
adc byte [ebx], bl
jg 0x403fa0
xchg esp, eax
cmp bh, al
xor dh, byte [ebx + 0x7c]
fdiv dword [esi - 0x51]
nop
je 0x403f2f
inc esp
int 0x5e
test al, 0x7e
xchg byte [edi], ah
adc al, 0x97
lodsb al, byte [esi]
pushfd
invalid
xlatb
jmp 0x8ccfd61b

Function at 0x408088
Capabilities:
Encode data using xor

Disassembly:
sub ebp, dword [edi]
invalid
dec eax
xchg ecx, eax
insb byte es:[edi], dx
cmpsb byte [esi], byte es:[edi]
add al, 0xa5
sar dword [edx + 0x48ae464b], 0xf
jae 0x407fe8
sub dword [ecx + 0x5f45f163], esi
pop es
sbb al, 0xad
invalid
wait
jae 0x4080b6
leave
pop ecx
jae 0x408100
push cs
push ebp
pop esi
and bh, ah
aas
cmpsd dword [esi], dword es:[edi]
push esp
cmp ecx, esp
imul ebx
push ebp
mov esi, 0xa09ef1b0
push eax
shl dword [ebx - 0x1099df2e], cl
out dx, ax
scasd eax, dword es:[edi]
mov eax, edx
in eax, 0xc7
leave
mov esp, 0x81725578
push ebp
jb 0x408034
sbb al, 0x2b
in al, 0x77
js 0x4080a6
ja 0x408130
in eax, dx
sahf
xchg edx, eax
pop ecx
xchg esp, eax
into
int1
jo 0x408053
ja 0x40804f
jecxz 0x4080d5
and byte [esi + 0x7c543f1f], cl
dec ecx
ret 0xdb4e
xlatb
mov eax, dword [0xd02f48d8]
mov al, byte [0x7a2b7c72]
jb 0x40815a
sub edi, dword [edx - 0xf]
lds eax, [ebp + 0x56]
adc eax, 0xc4db5b0b
mov cl, 0x3f
jmp 0x40812a
adc ah, al
mov dh, 0xb
inc ebx
scasb al, byte es:[edi]
cmp edi, dword [ecx + edx*4 - 0x11558f92]
in al, 0x2c
lds edx, [ebx - 0x63]
dec ebx
dec eax
fmul dword [eax - 0x7c7791d3]
and al, 0x7d
mov esp, 0xe6723c8b
xchg ebp, eax
sal dword [esi - 0x52547467], 1
sub ebp, dword [ecx + ebx*8]
mov bh, byte [ebp - 0x522a5189]
invalid
lodsd eax, dword [esi]
sbb dword [0x640e66f0], 0x13
pop ecx
dec eax
sbb byte [eax + 0x57fad111], bl
jle 0x408159
mov bh, 0x65
fsub st(7)
outsd dx, dword [esi]
out 0xf9, eax
sti
wait
push 0xffffffffffffffd7
mov ah, 0x2e
shr dword [edi + 0x69], 0x56
mov ecx, 0x59386c30
sub eax, 0x696c9be1
xor ebp, dword [edx + 0x55]
jl 0x408139
adc esi, ecx
in al, dx
pop edi
cmp dword [esi], ebx
out 0x33, eax
out dx, eax
nop
invalid
Function at 0x435824
Capabilities:
Encode data using xor

Disassembly:
mov esi, ebx
scasd eax, dword es:[edi]
cmp eax, 0xf78a2e85
movsb byte es:[edi], byte [esi]
xor bh, al
shrd dword [ebp + 0x2a], esi, 0x77
stc
sub dh, byte [edi - 7]
das
fisubr dword [edi + ebp*4 - 0x1deb6833]
sti
sbb dword [edx - 0x3dee347e], edi
sbb dword [edx - 0x3dee347e], edi
sbb dword [edx - 0x3dee347e], edi
vpaddq xmm5, xmm6, xmmword [eax - 0x6e]
in al, 0x52
sbb esp, dword [edx + 0x62]
xor dword [ebx + eax*2 + 0x24], eax
arpl word [edi + eax*2 + 0xc], dx
xchg edi, eax
push ebx
les ebp, [eax - 0x67]
stc
and byte [esi - 0x32ef7156], bl
push 0xffffffffffffff85
aam 0xcc
mov bh, 0x37
xchg ebx, eax
aaa
jno 0x435808
inc ecx
cmpsd dword [esi], dword es:[edi]
lock add dword [esi + edi*4], ebp
xor al, 0x3c
and ebp, dword [ebp + 4]
xchg esi, eax
rol byte [eax], 0x73
mov dword [0x6b5bb1ec], eax
adc ecx, dword [edi - 0x60280d4a]
test dword [eax], edi
fadd qword [eax]
and dword [edi - 0x6be126b8], ebp
pushal
pop ebp
xchg byte [eax], al
adc dword [ebp - 0x70], ebp
push es
aam 0x4c
sbb eax, dword cs:[ecx]
mov ebx, 0x855bde44
push ds
add dword [ecx], 8
je 0x435817
clc
pushal
inc edi
fld qword [ecx - 0x51641f54]
iretd

Function at 0x438824
Capabilities:
Encode data using xor

Disassembly:
ror byte [ecx], 0x93
xchg ebx, eax
xor dword [esi], esi
push edx
lea eax, [eax + 0x54afb28b]
lodsb al, byte [esi]
ror ebp, cl
push edx
mov word [edx + edx*8 - 0x2118ab41], fs
fiadd dword [edx - 0x66613e9e]
xchg byte [ebp + 0x4f9d2867], dl
xor byte ss:[edi], al
fist word [edx + 0x1f]
push dword [esi - 0x4ba5169a]
xchg esi, eax
lahf
wait
sub dword [edx + 0x73], edx
or al, 0xab
std
pop es
out 0xe1, eax
mov cl, 0x80
inc ecx
and ebp, eax
ja 0x4387aa
in eax, dx
pop ebp
cmp ebp, dword [ebx]
enter 0x5256, 0xffffffffffffffea
inc ebp
sbb al, 0xab
push edi
inc eax
add al, 0xbd
cwde
cdq
imul esp, dword [esi - 0x42], 0x870819f4
test byte [ecx], ch
stc
jl 0x4387a8
jno 0x438865
mov ebp, 0xa09e972c
dec edx
fstp dword [ebx]
ret
and eax, 0xb9b4aca7
sub dword [ebp + ebp*4 - 0x65673548], ebx
jp 0x4387f6
ret
imul ebp, esi, 0x634dbf11
mov edi, 0x51b44f80
popfd
invalid
invalid
invalid

Function at 0x438ec4
Capabilities:
Encode data using xor

Disassembly:
imul edx, edi, 0x48
xor esi, dword [eax - 0x7f114894]
push 0xf09ce648
pop es
inc edi
mov dword [0x13a0456c], eax
add eax, 0xc304f2ff
xor ebp, dword [ecx + 0x3281a91]
mov esp, 0x73c249f2
xchg edx, eax
jae 0x438e7b
dec esi
invalid
invalid

Function at 0x4395a8
Capabilities:
Encode data using xor

Disassembly:
rcl dword [esi], cl
mov dl, 0xec
loopne 0x439549
inc ebp
loope 0x4395f1
arpl bx, di
cmp byte [eax], dl
ret
pop eax
lodsd eax, dword [esi]
adc cl, bh
Function at 0x439a50
Capabilities:
Encode data using xor

Disassembly:
sar byte [edx], 0xca
pop es
popal
inc eax
push esi
dec ebp
pop ebp
or eax, 0xb62f9e07
cli
outsd dx, dword [esi]
pop ecx
jmp 0x4399c460
push esi
inc ebx
xchg byte [eax + 0x7e0b0c7c], ch
test esp, eax
dec edi
add eax, 0x92d0c0cc
loop 0x439a17
inc esp
out dx, al
mov al, byte [0xa7a3b6e6]
add dword [edx - 0x7c], edi
insb byte es:[edi], dx
xor byte [ecx - 0x3a1e6aaa], al
pop esp
in eax, 0x63
mov ebp, 0xec261839
jbe 0x439a40
out dx, eax
sub esp, dword [ebp*8 + 0x7f8ee148]
aas
jle 0x439a2b
jb 0x439aa4
mov eax, esi
mov al, byte [0xbade7e6c]
loope 0x439ab9
arpl di, cx
xchg esp, eax
retf 0x14b
xchg esp, eax
xor bl, ch
mov dh, 0x42
sbb edi, ecx
iretd
arpl word [edi], sp
dec ecx
sbb esp, dword [eax - 0x7cf7947b]
pop ds
push ecx
movsb byte es:[edi], byte [esi]
pushal
test dword [ebx + 8], ebp
sbb dword [edi], 0x51
shl byte [edi], cl
pop edx
mov ah, 0xc5
imul eax, dword [edx + 0x5c], 0xffffffc0
mov al, 0xa8
cmc
push esi
lodsb al, byte [esi]
cmpsd dword [esi], dword es:[edi]
pop edx
jge 0x439aa8
jns 0x439a76
jg 0x439ad2
test eax, 0xfd7e2fd1
nop
daa
inc esp
jne 0x439b2c
jmp 0x58da10cb
sub al, 0xe9
mov bh, 0xf3
xchg byte [ebp + 0x101b4f83], bh
adc dword [ebp + 0xd], 0xe6da0ca7
dec esp
xor al, 0xb
xchg edi, eax
dec edi
mov eax, 0x13fb9e0e
loope 0x439b82
jmp 0x3daa4384
ja 0x439b39
jge 0x439ba1
ret 0x7c3
dec eax
out dx, eax
xchg esi, eax
mov ah, 0x10
cmp dl, byte [edx - 0xa9c6af4]
mov edi, 0x28367696
sti
loop 0x439b07
fcomp qword [edx + 0xc8afbb7]
out dx, al
pop ss
xchg eax, eax
pop eax
and al, 0x33
mov byte [edi - 0x5687c391], 0x22
mov esp, 0xe8a83abb
ret 0x56cf
sbb dword [edi], ebp
push 0x77005e9
or eax, 0x3957938f
adc eax, 0xdd707006
scasd eax, dword es:[edi]
iretd
jmp 0x92364ac6

Function at 0x49dfc0
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ecx], edi
cmp eax, 0x98d2ca74
popfd
adc al, 0x90
mov cl, 0x54
xor eax, 0xded4d6c
sbb al, 0x63
mov dh, 0x71
mov byte [esi - 0x27], 0xf3
add byte [ebx], al
outsb dx, byte [esi]
push 0x4eb992d7
mov ecx, dword [esi]
insd dword es:[edi], dx
fucomi st(1)
cmp al, byte [esi + edx*2 - 0x35]
mov byte [0xe1b4558f], al
mov ah, 0x5e
jno 0x49dfc4
retf 0x98d2
das
jmp 0xdc814141
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1d030a7b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x63c3263f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401000
Capabilities:
Copy file
Extract resource via kernel32 functions
Get common file path
Get file size
Move file
Read file on windows
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x337]
mov byte [ebp - 0x338], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x233]
mov byte [ebp - 0x234], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x12f]
mov byte [ebp - 0x130], bl
mov dword [ebp - 0x14], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0x1c], 0xa
mov byte [ebp - 0x1b], 0xa
mov byte [ebp - 0x1a], 0xa
mov byte [ebp - 0x19], 0xa
mov byte [ebp - 0x18], 0xa
mov byte [ebp - 0x17], 0xa
mov byte [ebp - 0x16], 0xa
mov byte [ebp - 0x15], 0xa
mov dword [ebp - 8], ebx
stosb byte es:[edi], al
jmp loc.00409000

Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147e
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x401499
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4014ed
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ed
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f1
xor eax, eax
jmp 0x401503
cmp dword [ebp - 4], edi
je 0x401500
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x29a051e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x29a051f8
pop dword [ebp - 0x14]
mov eax, 0xcdee914a
sub eax, 0xa44e3f52
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x78467939
sub dword [ebp - 0x24], 0x29f433ee
mov dword [ebp - 0x20], 0xb2dbae5c
sub dword [ebp - 0x20], 0x80a86217
mov dword [ebp - 0x1c], 0x1b25cefc
sub dword [ebp - 0x1c], 0xced98ace
mov dword [ebp - 0x18], 0x710ee363
add dword [ebp - 0x18], 0x8ef11c9d
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xc7f116b9
add dword [ebp - 0x24], 0xac81529d
mov dword [ebp - 0x20], 0x44c09915
add dword [ebp - 0x20], 0xfcabc860
mov dword [ebp - 0x1c], 0xdfd426a6
add dword [ebp - 0x1c], 0x839b45c6
mov dword [ebp - 0x18], 0x312ab4a6
add dword [ebp - 0x18], 0xced54b5a
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x8f97a948
add eax, 0x9a0996fc
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x39c28
push 0
call eax
mov ecx, 0xf30b8210
add ecx, 0xcf4c38c
mov edi, eax
mov esi, 0x29a22000
add esi, dword [ebp - 0x14]
mov ebx, 0xde1b20c2
add ebx, 0x625d9ae6
xor dword [ebp - 4], esi
mov edx, dword [esi]
xor dword [ebp - 0x10], ecx
add edx, ebx
xor dword [ebp - 8], 0xdd6f965c
mov dword [edi], edx
xor dword [ebp - 8], 0x689f4225
add edi, 4
add esi, 0x9a0ea05
sub esi, 0x9a0ea01
loop 0x29a0530f
add eax, 0x10943
mov ebx, eax
add eax, 0x33df773
sub eax, 0x33df76e
mov ecx, 0xb69a2a86
sub ecx, 0x8cfa2a86
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x407e80
Capabilities:
Create directory

Disassembly:
push esi
push ebx
push eax
mov eax, 0x2010
call fcn.0040efb8
sub esp, eax
mov eax, dword [esp + eax]
mov esi, eax
mov eax, dword [0x42c0a0]
test eax, eax
je 0x407f20
xor ebx, ebx
test eax, eax
jg 0x407ebb
jmp 0x407ed8
add ebx, 1
cmp dword [0x42c0a0], ebx
jle 0x407ed8
mov eax, dword [ebx*4 + 0x42b0a0]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x407eb0
jmp 0x407f12
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
cmp eax, 2
jne 0x407eec
cmp word [esi + 2], 0x3a
je 0x407f12
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
je 0x407f68
mov ebx, dword [0x42c0a0]
cmp ebx, 0x3ff
jle 0x407f80
mov eax, 1
add esp, 0x2014
pop ebx
pop esi
ret
mov ecx, 0x1000
mov edx, str.HOME
lea eax, [esp + 0x10]
call fcn.00407710
test al, al
je 0x407f9b
lea eax, [esp + 0x10]
mov ebx, dword [0x42c0a0]
mov dword [esp], eax
call sub.msvcrt.dll__wcsdup
mov dword [ebx*4 + 0x42b0a0], eax
mov eax, dword [0x42c0a0]
add eax, 1
mov dword [0x42c0a0], eax
jmp 0x407ea1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407f04
xor eax, eax
jmp 0x407f17
mov dword [esp], esi
call sub.msvcrt.dll__wcsdup
add dword [0x42c0a0], 1
mov dword [ebx*4 + 0x42b0a0], eax
jmp 0x407f12
mov eax, str.HOME
call fcn.00407db0
lea esi, [esi]
lea esi, [esi]

Function at 0x408130
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x424040]
test eax, eax
je 0x408169
mov dword [esp + 4], 0x1388
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x408180
mov eax, dword [0x424040]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
cmp byte [0x429080], 0
jne 0x4081a0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x424040]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 8
jmp 0x408158
mov edx, 0x414
lea edi, [esp + 0x12]
mov dword [esp + 0x12], 0
mov esi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [esp + 0x16], 3
mov ebx, 0x14
mov dword [esp + 0x1a], 0x4290a0
mov dword [esp + 0x1e], 0x41713c
mov word [esp + 0x22], dx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x41713c
mov dword [esp], edi
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
jmp 0x408273
test al, 0x10
je 0x408172
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x414
sub esp, 4
mov dword [esp + 0x12], 0
mov dword [esp + 0x16], 3
mov dword [esp + 0x1a], 0x4290a0
mov dword [esp + 0x1e], 0x41713c
mov word [esp + 0x22], ax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x41713c
mov dword [esp], edi
call esi
sub esp, 4
sub ebx, 1
je 0x408172
mov dword [esp], 0x4290a0
call ebp
sub esp, 4
cmp eax, 0xffffffff
jne 0x408208
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40e008
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.0041440c
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.0041440c
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x40ebdc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40ebfb
mov eax, 0
jmp 0x40ec3f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40ec1e
mov eax, 0
jmp 0x40ec3f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40ec3a
mov eax, 0
jmp 0x40ec3f
mov eax, 1
leave
ret

Function at 0x40ec41
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40eca0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40ec98
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40ec98
mov eax, dword [ebp - 4]
jmp 0x40ecb4
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40ec75
mov eax, 0
leave
ret