joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f60c0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f62dd
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x4f6177
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x4f61f0
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x4f6158
cmp ecx, 0xf
jne 0x4f6269
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x4f6158
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x4f6158
call dbg.runtime.morestack_noctxt
jmp dbg.crypto/sha512.(*digest).Reset
Function at 0x514140
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5142fc
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x514169
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x514163
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x514163
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x5142ee
cmp al, 0x2c
ja 0x5142cb
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x51419d
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x514197
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x514197
cmp al, 0x2f
ja 0x514291
cmp al, 0x26
ja 0x514269
cmp al, 0x24
jne 0x51425e
cmp ecx, 2
jg 0x514214
cmp ecx, 1
je 0x514209
cmp ecx, 2
jne 0x514203
cmp al, 0x2f
jne 0x5141e3
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
jne 0x5141ef
mov eax, 1
jmp 0x5141de
cmp al, 0x2c
jne 0x5141fb
mov eax, 1
jmp 0x5141de
cmp al, 0x3f
sete al
jmp 0x5141de
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x514248
cmp al, 0x40
jne 0x514228
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
jne 0x514234
mov eax, 1
jmp 0x514223
cmp al, 0x3f
jne 0x514240
mov eax, 1
jmp 0x514223
cmp al, 0x3a
sete al
jmp 0x514223
cmp ecx, 6
je 0x514258
cmp ecx, 7
jne 0x514203
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x5141c5
jmp 0x514203
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5141c5
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x514283
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x5141c5
jmp 0x514203
cmp al, 0x3d
ja 0x5142b0
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5141c5
cmp al, 0x3d
je 0x5141c5
jmp 0x514203
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x5141c5
cmp al, 0x5f
je 0x51427d
cmp al, 0x7e
je 0x51427d
jmp 0x514203
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x514197
cmp al, 0x5b
je 0x514197
cmp al, 0x5d
je 0x514197
jmp 0x5141aa
cmp ecx, 4
je 0x514186
jmp 0x5141aa
call dbg.runtime.morestack_noctxt
jmp dbg.net/url.shouldEscape
Function at 0x5885b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x588736
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x58872f
mov ecx, dword [eax]
lea eax, [0x60bf00]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
call dbg.runtime.makemap
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044c524
lea eax, [0x60bf00]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call dbg.runtime.mapiterinit
jmp 0x588630
lea eax, [esp + 0x44]
mov dword [esp], eax
call dbg.runtime.mapiternext
mov eax, dword [esp + 0x44]
test eax, eax
je 0x588723
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx + 8]
mov dword [esp + 0x2c], edx
mov ebx, dword [ecx + 4]
mov dword [esp + 0x28], ebx
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
mov ebp, dword [eax + 4]
mov dword [esp + 0x30], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
lea esi, [0x5df7c0]
mov dword [esp], esi
mov dword [esp + 4], ebx
mov dword [esp + 8], ebx
call dbg.runtime.makeslice
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
lea ebx, [0x5df7c0]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call dbg.runtime.typedslicecopy
lea eax, [0x60bf00]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call dbg.runtime.mapassign_faststr
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x75f950]
test ecx, ecx
jne 0x58870e
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x588624
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
jmp 0x588624
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x5885d7
call dbg.runtime.morestack_noctxt
jmp dbg.net/http.Header.clone
Function at 0x589160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5892e6
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x5892df
mov ecx, dword [eax]
lea eax, [0x60bf00]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
call dbg.runtime.makemap
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044c524
lea eax, [0x60bf00]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call dbg.runtime.mapiterinit
jmp 0x5891e0
lea eax, [esp + 0x44]
mov dword [esp], eax
call dbg.runtime.mapiternext
mov eax, dword [esp + 0x44]
test eax, eax
je 0x5892d3
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx + 8]
mov dword [esp + 0x2c], edx
mov ebx, dword [ecx + 4]
mov dword [esp + 0x28], ebx
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
mov ebp, dword [eax + 4]
mov dword [esp + 0x30], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
lea esi, [0x5df7c0]
mov dword [esp], esi
mov dword [esp + 4], ebx
mov dword [esp + 8], ebx
call dbg.runtime.makeslice
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
lea ebx, [0x5df7c0]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call dbg.runtime.typedslicecopy
lea eax, [0x60bf00]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call dbg.runtime.mapassign_faststr
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x75f950]
test ecx, ecx
jne 0x5892be
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x5891d4
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
jmp 0x5891d4
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x589187
call dbg.runtime.morestack_noctxt
jmp dbg.net/http.cloneHeader
Function at 0x401000
Capabilities:
Delete file

Disassembly:
push 0x6c
mov eax, 0x416816
call fcn.0040af43
lea eax, [ebp - 0x78]
push eax
call fcn.00402080
and dword [ebp - 4], 0
sub esp, 0x1c
mov ebx, 0x845214
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.00402a60
lea ebx, [ebp - 0x78]
call fcn.00402fc0
sub esp, 0x20
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.00402a60
call fcn.004021f1
add esp, 0x20
mov edi, 0x41a71c
test al, al
je 0x4010b4
lea esi, [ebp - 0x38]
call fcn.00402a60
push edi
mov eax, esi
push eax
mov byte [ebp - 4], 1
call fcn.004031d0
sub esp, 0x20
mov ebx, esi
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.00402a60
call fcn.004021f1
add esp, 0x20
test al, al
je 0x40108f
mov esi, ebx
call fcn.004036e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x38]
call fcn.00403640
push eax
lea esi, [ebp - 0x78]
call fcn.00403640
push eax
call fcn.00409720
pop ecx
pop ecx
lea esi, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.00402b80
lea eax, [ebp - 0x58]
push eax
call fcn.00402080
mov byte [ebp - 4], 2
lea eax, [ebp - 0x58]
mov dword [esp], str.config.ini
push eax
call fcn.004031d0
sub esp, 0x20
lea ebx, [ebp - 0x58]
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.00402a60
call fcn.004021f1
add esp, 0x20
test al, al
je 0x401148
lea esi, [ebp - 0x38]
call fcn.00402a60
push edi
mov eax, esi
push eax
mov byte [ebp - 4], 3
call fcn.004031d0
sub esp, 0x20
mov ebx, esi
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.00402a60
call fcn.004021f1
add esp, 0x20
mov esi, ebx
call fcn.004036e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00403640
push eax
lea esi, [ebp - 0x58]
call fcn.00403640
push eax
call fcn.00409720
pop ecx
pop ecx
mov esi, ebx
mov byte [ebp - 4], 2
call fcn.00402b80
lea eax, [ebp - 0x38]
push eax
call fcn.00402080
mov byte [ebp - 4], 4
lea eax, [ebp - 0x38]
mov dword [esp], str.Game.7z
push eax
call fcn.004031d0
sub esp, 0x20
mov ebx, 0x41a734
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.00402af0
push 0x88
sub esp, 0x20
mov byte [ebp - 4], 5
lea ebx, [ebp - 0x38]
mov esi, esp
mov dword [ebp - 0x18], esp
call fcn.00402a60
mov byte [ebp - 4], 4
call fcn.00401e63
add esp, 0x24
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.00402080
sub esp, 0x1c
mov byte [ebp - 4], 6
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.00402a60
mov byte [ebp - 4], 4
call fcn.00401eff
add esp, 0x20
mov esi, esp
mov dword [ebp - 0x18], esp
call fcn.00402a60
call fcn.004021f1
add esp, 0x20
test al, al
je 0x4011e8
mov esi, ebx
call fcn.004036e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x38]
call fcn.00402b80
lea esi, [ebp - 0x58]
call fcn.00402b80
lea esi, [ebp - 0x78]
call fcn.00402b80
call fcn.0040afe2
ret
Function at 0x401e63
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 8
mov eax, 0x4164fe
call fcn.0040af43
mov dword [ebp - 4], 1
xor edi, edi
lea esi, [ebp + 8]
mov dword [ebp - 0x10], edi
call fcn.004036e0
push edi
push 0x80
push 2
push edi
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401eb9
lea esi, [ebp + 8]
call fcn.00402b80
lea esi, [ebp + 0x2c]
call fcn.00402b80
mov eax, edi
call fcn.0040afe2
ret
lea esi, [ebp + 0x2c]
call fcn.004036e0
push eax
movzx eax, word [ebp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
inc edi
jmp 0x401ea1

Function at 0x401eff
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x4167c3
call fcn.0040af43
sub esp, 0x20
lea ebx, [ebp + 8]
mov esi, esp
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], esp
call fcn.00402a60
call fcn.00403f30
add esp, 0x20
lea esi, [ebp + 0x28]
call fcn.00403640
mov esi, ebx
mov edi, eax
call fcn.00403640
push edi
mov ecx, eax
call fcn.0040447e
pop ecx
call fcn.004036e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00402b80
lea esi, [ebp + 0x28]
call fcn.00402b80
call fcn.0040afe2
ret

Function at 0x401f63
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41d1dc]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push ebx
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call fcn.0040dbc0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x210], 0x7d0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ebx, [ebp - 0x20c]
call fcn.004029c0
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409654
leave
ret

Function at 0x401fd8
Capabilities:
Get common file path
Get session user name

Disassembly:
push 0x320
mov eax, 0x4164c6
call fcn.0040afac
and dword [ebp - 0x324], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x31c], ax
lea eax, [ebp - 0x31a]
mov esi, ecx
push eax
mov dword [ebp - 0x32c], esi
call fcn.0040dbc0
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x31c]
push eax
mov dword [ebp - 0x328], 0x7d0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, esi
call fcn.00402860
and dword [ebp - 4], 0
mov al, byte [ebp - 0x114]
mov byte [ebp - 0x320], al
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x324], 1
mov byte [ebp - 0x31f], 0
call fcn.00402bd0
mov eax, esi
call fcn.0040aff6
ret
Function at 0x402168
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x416683
call fcn.0040af43
push 0x41a8f0
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], 1
call fcn.004031d0
sub esp, 0x20
lea ebx, [ebp + 0x28]
mov esi, esp
mov dword [ebp - 0x10], esp
call fcn.00402a60
lea ebx, [ebp + 8]
call fcn.00402fc0
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.0040dbc0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x68], esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4021d9
mov bl, 1
lea esi, [ebp + 8]
call fcn.00402b80
lea esi, [ebp + 0x28]
call fcn.00402b80
mov al, bl
call fcn.0040afe2
ret
Function at 0x403b90
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x41d1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
push esi
call fcn.00403ae0
add esp, 4
cmp al, 1
jne 0x403bcb
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409654
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x210]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403bd5
lea eax, [ebp - 0x210]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403be8
sub eax, edx
mov cl, byte [ebp + eax - 0x211]
lea eax, [ebp + eax - 0x211]
cmp cl, 0x5c
je 0x403c09
cmp cl, 0x2f
jne 0x403c0c
mov byte [eax], 0
lea eax, [ebp - 0x210]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403c15
sub eax, edx
mov esi, eax
push 0x100
lea eax, [ebp - 0x108]
push 0
push eax
mov dword [ebp - 0x218], esi
call fcn.0040dbc0
add esp, 0xc
xor ebx, ebx
test esi, esi
jle 0x403d18
mov byte [ebp - 0x213], bl
mov al, byte [ebp + ebx - 0x210]
cmp al, 0x5c
je 0x403c7f
mov byte [ebp - 0x214], al
lea eax, [ebp - 0x214]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403c65
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403c75
jmp 0x403ccb
push 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x403ca4
push 0x80
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x214]
mov byte [ebp - 0x214], 0x5c
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403cb3
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403cc3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x218]
and ecx, 3
dec eax
rep movsb byte es:[edi], byte [esi]
cmp ebx, eax
jne 0x403d0b
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x403d0b
push 0x80
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
inc ebx
cmp ebx, dword [ebp - 0x218]
jl 0x403c4c
lea edx, [ebp - 0x108]
push edx
call fcn.00403ae0
xor ecx, ecx
add esp, 4
test al, al
setne cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409654
mov esp, ebp
pop ebp
ret
Function at 0x404a22
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi]
test edi, edi
je 0x404a6a
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x404a3b
mov eax, edi
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x404a6f
test ecx, ecx
je 0x404a6a
test edi, edi
jne 0x404a30
xor eax, eax
pop edi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404a6c

Function at 0x406936
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x40693e
mov dword [ecx*4 + 0x846480], eax
inc ecx
cmp ecx, 0x100
jb 0x406939
mov edx, 0x800
jmp 0x40698b
mov eax, dword [ecx*4 + 0x846080]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x846480]
inc ecx
mov dword [ecx*4 + 0x84647c], eax
cmp ecx, edx
jb 0x40696a
mov dword [0x8451b8], 0x40725e
call fcn.004073c0
test eax, eax
jne 0x4069ac
mov dword [0x8451b8], 0x4072fa
pop esi
ret
Function at 0x4077c9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x4077e0
leave
ret
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x4077ff
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x407804
inc edi
cmp edi, dword [ebp - 8]
jb 0x4077f6
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x4078f3
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x407886
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x407830
cmp cl, 0xff
jne 0x4078b5
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
lea ebx, [esi - 5]
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x4078c6
movzx esi, byte [edx + 0x41aa84]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
mov cl, bl
test cl, cl
je 0x407876
cmp cl, 0xff
jne 0x4078c3
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x40784e
dec ecx
shl edx, cl
and edx, 7
je 0x40781d
movzx ecx, byte [edx + 0x41aa84]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x41aa7c], 0
mov cl, byte [ebx + 4]
je 0x4078b2
test cl, cl
je 0x4078b2
cmp cl, 0xff
jne 0x40781d
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x4077f1
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x4077f1
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0xc]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret

Function at 0x409654
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41d1dc]
jne 0x40965e
repz ret
jmp fcn.0040b91a

Function at 0x40a006
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40a02d
call fcn.0040cae7
mov dword [eax], esi
call fcn.0040cad4
push 0x16
pop esi
mov dword [eax], esi
call fcn.0040ca82
mov eax, esi
jmp 0x40a082
test dword [ebp + 0xc], 0xfffffff9
jne 0x40a013
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40a05a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040cafa
pop ecx
call fcn.0040cad4
mov eax, dword [eax]
jmp 0x40a082
test al, 0x10
jne 0x40a080
test al, 1
je 0x40a080
test byte [ebp + 0xc], 2
je 0x40a080
call fcn.0040cae7
mov dword [eax], 5
call fcn.0040cad4
mov dword [eax], 0xd
jmp 0x40a051
xor eax, eax
pop esi
pop ebp
ret