joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002945
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100c020]
cmp eax, 0xffffffff
je 0x1002a07
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
mov esi, 0x314
push esi
push 0x100cbc0
push dword [0x100c020]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10029fb
cmp dword [ebp - 4], esi
jne 0x10029fb
cmp dword [0x100cbc0], 0x6e776453
jne 0x10029fb
test dword [0x100cbc8], 0x80000000
jne 0x1002a05
or dword [0x100cbc8], 0x40000000
push 0x100cdd0
push 0x100220c
push 0x103
push 0x100d000
mov byte [0x100cdcf], bl
mov byte [0x100ced3], bl
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0x10
cmp dword [0x100cbc4], 0x10000
jne 0x1002a05
test dword [0x100cbc8], 0x3fffffec
jne 0x1002a05
and dword [0x100cbc8], 0xbfffffff
jmp 0x1002a05
or dword [0x100cbc8], 0x80000000
pop esi
pop ebx
leave
ret

Function at 0x1002a0e
Capabilities:
Create directory
Delete directory
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100c024]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x110], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
mov edi, dword [ebp + 8]
push 0
call esi
mov dword [ebp - 0x114], eax
or eax, 1
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 0x10c], 0
mov ebx, eax
xor edx, edx
mov ecx, 0xf4240
mov eax, ebx
div ecx
lea eax, [ebp - 0x108]
push edx
push edi
push 0x1002210
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x10
push 0
lea eax, [ebp - 0x108]
push eax
inc ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1002aac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1002ad7
inc dword [ebp - 0x10c]
cmp dword [ebp - 0x10c], 0x3e8
jl 0x1002a55
jmp 0x1002ad7
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1002acd
push 4
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x110], 1
push dword [ebp - 0x114]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x110]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010068cd
leave
ret 4
Function at 0x1002c50
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100c024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [ebp + 8]
push esi
push edi
mov esi, 0x1002278
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x5c3a3f
push eax
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x10], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
dec eax
dec eax
je 0x1002c9b
dec eax
je 0x1002ced
sub eax, 3
jne 0x1002cbd
push 3
pop edi
jmp 0x1002ced
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0x80000000
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 8], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1002cc1
xor edi, edi
jmp 0x1002ced
push esi
lea eax, [ebp - 0x14]
push eax
push 0x18
lea eax, [ebp - 0x2c]
push eax
push esi
push esi
push 0x70000
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1002ce4
cmp dword [ebp - 0x24], 0xb
je 0x1002ce6
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010068cd
leave
ret 4

Function at 0x1002eb5
Capabilities:
Check if file exists
Delete directory
Delete file
Move file

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x100d360
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x100c7a4]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1002ede
push eax
call esi
and dword [0x100c7a4], 0
mov eax, dword [0x100c020]
cmp eax, 0xffffffff
je 0x1002ef2
push eax
call esi
or dword [0x100c020], 0xffffffff
mov esi, dword [0x100c004]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edi, 0x100c004
jmp 0x1002f36
mov eax, dword [esi + 4]
test eax, eax
je 0x1002f34
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1002f30
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1002f30
cmp eax, 3
je 0x1002f30
push 4
push 0
push dword [esi + 4]
call ebx
and dword [esi + 4], 0
mov esi, dword [esi]
cmp esi, edi
jne 0x1002f05
mov esi, dword [0x100c00c]
mov edi, 0x100c00c
jmp 0x1002f78
mov eax, dword [esi + 4]
test eax, eax
je 0x1002f76
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1002f72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1002f72
cmp eax, 3
je 0x1002f72
push 4
push 0
push dword [esi + 4]
call ebx
and dword [esi + 4], 0
mov esi, dword [esi]
cmp esi, edi
jne 0x1002f47
push 0x100d360
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret

Function at 0x10032a7
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
test edx, edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
je 0x10032d5
push esi
push edi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x100c7c0]
dec edx
inc ecx
test edx, edx
jne 0x10032bb
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10036b3
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [0x100d344]
xor ebx, ebx
cmp eax, ebx
je 0x100372d
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 8]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10036e1
push ebx
lea ecx, [ebp - 4]
push ecx
sub eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push dword [ebp + 8]
push dword [0x100d344]
call esi
test eax, eax
je 0x1003730
mov ecx, 0x1002370
mov eax, ecx
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1003710
push ebx
lea edx, [ebp - 4]
push edx
sub eax, edi
push eax
push ecx
push dword [0x100d344]
call esi
test eax, eax
pop edi
je 0x1003730
xor ebx, ebx
inc ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x10038dd
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100c024]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100c344], 0
mov eax, dword [ebp + 8]
jne 0x10039cd
push esi
push 0x1002440
push 0x1002438
push eax
call fcn.0100683c
test eax, eax
mov esi, 0x104
je 0x1003945
push esi
lea ecx, [ebp - 0x20c]
push ecx
push 1
push eax
call fcn.01006701
test eax, eax
je 0x1003945
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x100d380
jmp 0x1003966
push esi
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
push eax
push 0x1002428
lea eax, [ebp - 0x310]
push eax
call fcn.01002d05
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x100c358], eax
je 0x10039a6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002410
push eax
call esi
push 0x10023fc
push dword [0x100c358]
mov dword [0x100c344], eax
call esi
mov dword [0x100c340], eax
cmp dword [0x100c344], 0
pop esi
jne 0x10039ba
mov dword [0x100c344], 0x10038d3
cmp dword [0x100c340], 0
jne 0x10039cd
mov dword [0x100c340], 0x10038c9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010068cd
leave
ret 4
Function at 0x1003a66
Capabilities:
Query environment variable
Set environment variable
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
push esi
push 0x100245c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x1003b38
push ebx
mov ebx, 0x100d5c0
push ebx
push 0x100244c
push 0x100d380
call fcn.01002d05
push esi
push 0x4000002
push 1
push esi
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [0x100c020], esi
je 0x1003b37
push edi
mov edi, 0x314
push edi
push 0
push 0x100cbc0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
push edi
push 0x100cbc0
push esi
mov dword [0x100cbc0], 0x6e776453
mov dword [0x100cbc4], 0x10000
mov dword [0x100cbc8], 0xc0000013
mov byte [0x100cdd0], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1003b23
cmp dword [ebp - 4], edi
jne 0x1003b23
push ebx
push 0x100245c
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x1003b36
push dword [0x100c020]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x100c020], 0xffffffff
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1003b40
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x280
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x1003b5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [0x101d6e0], 0
jne 0x1003bbd
lea eax, [ebp - 0x280]
push eax
push 0x200
push esi
call fcn.01002e46
lea eax, [ebp - 0x280]
push eax
call fcn.01003746
push 0x80
lea eax, [ebp - 0x80]
push eax
push 0x20000003
push dword [0x100c35c]
mov byte [ebp - 0x80], 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x10010
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x280]
push eax
push dword [0x100d104]
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.01002eb5
test esi, esi
jne 0x1003bc7
inc esi
cmp dword [0x100c360], 0
je 0x1003be2
push 0x100d360
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and dword [0x100c360], 0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10048f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, esi
xor ebx, ebx
push edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100490c
push 0x2e
push esi
call dword [sym.imp.msvcrt.dll_strrchr]
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x1004979
push 0x10025e0
push edi
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
pop ecx
pop ecx
jne 0x1004979
xor ebx, ebx
inc ebx
mov eax, dword [0x101d6e8]
xor edx, edx
mov ecx, 0x3e8
div ecx
inc dword [0x101d6e8]
push edx
push 0x10025d8
push edi
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100493c
push esi
push 0x100c004
call fcn.010048ca
jmp 0x100497b
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x1004a35
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push esi
mov eax, ecx
push edi
mov edi, dword [ebp + 0xc]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1004a57
sub eax, esi
mov esi, eax
lea eax, [esi + 1]
push eax
push ecx
lea eax, [ebp - 0x108]
push eax
call sub.msvcrt.dll_memcpy
lea eax, [ebp + esi - 0x108]
add esp, 0xc
cmp byte [eax - 1], 0x5c
je 0x1004a8a
mov byte [eax], 0x5c
mov byte [eax + 1], 0
push dword [ebp + 0x10]
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.010049da
test eax, eax
pop edi
pop esi
je 0x1004aef
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1004aef
test al, 0x10
je 0x1004aef
push 0x10024e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1004aea
push 0x10025e8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004aea
push 0
lea ecx, [ebp - 0x108]
push ecx
call eax
test eax, eax
jne 0x1004aea
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
inc eax
jmp 0x1004af1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010068cd
leave
ret 0xc
Function at 0x1006da0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1006db3
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1006daf
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x1006de0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x1006e1f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1006e15
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1006e21
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1006e05
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43b644
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
push esi
pop eax
call fcn.0043b67c
and eax, eax
inc esi
mov esi, 0xe08fd3da
xor dword [edi], ebx
or eax, esi
add edi, 1
sub esi, 0x3b74525a
sub esi, esi
add eax, 0xf0e6ef88
cmp edi, ecx
jne fcn.0043b644
add esi, eax
ret
Function at 0x40bd59
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push esi
mov esi, eax
push esi
call fcn.0040a35d
cmp eax, 0x3f6
jae 0x40bf6d
push ebx
push edi
push 0x3c
pop edi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x44]
push eax
call fcn.0040a262
mov cl, byte [esi]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0x5c0
cmp cl, 0x22
jne 0x40bda1
lea eax, [esi + 1]
mov dword [ebp - 0x34], eax
jmp 0x40bda4
mov dword [ebp - 0x34], esi
xor eax, eax
cmp cl, bl
je 0x40bde9
mov ecx, esi
cmp byte [ecx], 0x22
jne 0x40bdc5
jmp 0x40bdb9
cmp byte [eax + esi], 0x22
je 0x40bdc1
inc eax
cmp byte [eax + esi], bl
jne 0x40bdb3
jmp 0x40bdc5
mov byte [eax + esi], 0x20
cmp byte [eax + esi], 0x20
je 0x40bddc
cmp byte [eax + esi + 1], 0x2f
je 0x40bddc
inc eax
lea ecx, [eax + esi]
cmp byte [ecx], bl
jne 0x40bdac
jmp 0x40bde9
add eax, esi
cmp byte [eax], 0x20
jne 0x40bde5
mov byte [eax], bl
inc eax
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], bl
jne 0x40bdfd
cmp byte [0x41a392], bl
je 0x40bdfd
mov dword [ebp - 0x30], 0x41a392
push dword [ebp - 0x34]
mov dword [ebp - 0x28], 1
call fcn.00407669
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40be29
push str..inf
push eax
call fcn.0040a573
test eax, eax
jne 0x40be29
mov dword [ebp - 0x38], 0x412658
push ebx
push dword [ebp - 0x34]
call fcn.0040572e
mov byte [ebp - 1], al
cmp al, bl
je 0x40be51
lea eax, [ebp - 0x844]
push eax
push dword [ebp - 0x34]
call fcn.004057e4
lea eax, [ebp - 0x844]
mov dword [ebp - 0x34], eax
cmp byte [ebp + 8], bl
je 0x40be90
cmp byte [ebp - 1], bl
jne 0x40be90
push dword [ebp - 0x34]
lea eax, [ebp - 0x444]
push eax
call fcn.0040a450
push str..exe
lea eax, [ebp - 0x444]
push eax
call fcn.0040a5bb
push ebx
lea eax, [ebp - 0x444]
push eax
call fcn.0040572e
test al, al
je 0x40bf6b
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea eax, [ebp - 0x44]
push eax
call edi
test eax, eax
setne al
cmp al, bl
jne 0x40bec2
and dword [ebp - 0x40], 0xfffffbff
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x34], esi
call edi
test eax, eax
setne al
cmp al, bl
je 0x40bf6b
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 1], bl
cmp byte [0x419f88], bl
jne 0x40bed8
cmp byte [ebp + 8], bl
je 0x40bf0f
mov eax, dword [0x419f80]
cmp eax, ebx
je 0x40bef9
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40bef9
push ebx
push dword [0x419f80]
call esi
mov byte [ebp - 1], 1
push 0x7d0
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0xc]
call fcn.0040b6c3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x40bf2e
push str..exe
push dword [ebp - 8]
call fcn.0040a573
test eax, eax
je 0x40bf5c
cmp byte [0x419f88], bl
je 0x40bf42
cmp byte [ebp + 8], bl
jne 0x40bf42
push 0x1b58
jmp 0x40bf56
xor eax, eax
cmp byte [ebp + 8], bl
sete al
dec eax
and eax, 0xfffffce0
add eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp byte [ebp - 1], bl
je 0x40bf6b
push 1
push dword [0x419f80]
call esi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x9eb920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9eb96c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9eb932
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9eb9d0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9eba22
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9eba28
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0xa03f15
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a03bd5

Function at 0xa08d0f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a08b8e

Function at 0xa0e2c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa0e2ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa0e2ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x9c24ace
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x30d672ea
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x100016a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov al, byte [edi]
mov bl, byte [edi + 1]
jle 0x10001751
movzx eax, al
xor edi, edi
movzx edx, bl
push esi
inc eax
and eax, 0x8000001f
jns 0x100016d0
dec eax
or eax, 0xffffffe0
inc eax
movzx ecx, al
mov dword [ebp - 0xc], eax
mov eax, dword [0x10017548]
mov dword [ebp - 4], ecx
add ecx, eax
movzx ebx, byte [ecx]
add ebx, edx
and ebx, 0x8000001f
jns 0x100016f2
dec ebx
or ebx, 0xffffffe0
inc ebx
movzx edx, bl
add eax, edx
mov dword [ebp - 8], edx
push eax
push ecx
call fcn.1000175c
mov edx, dword [0x10017548]
mov esi, edi
mov eax, dword [ebp - 8]
sub esi, dword [0x10016074]
pop ecx
pop ecx
movzx ecx, byte [eax + edx]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ecx, eax
and ecx, 0x8000001f
jns 0x1000172e
dec ecx
or ecx, 0xffffffe0
inc ecx
movzx eax, cl
mov ecx, dword [ebp + 8]
mov al, byte [eax + edx]
xor byte [esi + ecx], al
inc edi
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp edi, dword [ebp + 0xc]
jl 0x100016c3
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
pop esi
mov byte [edi + 1], bl
mov byte [edi], al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x676bc2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x71906c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xor eax, eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 7
mov word [edi + 4], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], al
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], 0xf
mov byte [edi + 0x34], al
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], 0xf
mov byte [edi + 0x4c], al
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], 0xf
mov byte [edi + 0x64], al
mov dword [edi + 0x8c], eax
mov dword [edi + 0x90], 0xf
mov byte [edi + 0x7c], al
lea esi, [edi + 0x94]
mov byte [ebp - 4], 5
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0042e861
add esp, 4
cmp dword [ebp + 8], 0
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
setne al
mov byte [edi], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40c220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40c279
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c279
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40c26a
cmp esi, edx
jae 0x40c279
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40c258
cmp esi, edx
jae 0x40c279
cmp word [esi], 0
je 0x40c279
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40d4b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6772f2
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x71906c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
call fcn.00429010
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x40d548
push eax
push esi
call fcn.0042943c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
lea ecx, [ebp - 0x1c]
call fcn.0040d470
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.0040d410
int3