joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x401023
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40102a
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x401041
mov edx, dword [ebp - 4]
push edx
call fcn.004012f0
add esp, 4
or eax, 0xffffffff
jmp 0x401043
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x406cc0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4381d4]
jne 0x406cca
repz ret
jmp fcn.0040e6d0
Function at 0x4251f0
Capabilities:
Create directory
Get common file path
Get disk information
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12f8
call fcn.0040be50
cmp dword [0xbfbce4], 0x37
jne 0x425322
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x12e0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0
push 0
push 0
lea ecx, [ebp - 0x648]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push str.bebok_coholulutu
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0
push str.civovilibabewofosujolafigojiduju_xusohehexozojeritimacefoxecib
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.tucehebehorulojibovi_punawuconewojejojotayegib
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [ebp - 0x12f8], 0
xor edx, edx
mov dword [ebp - 0x12f4], edx
mov dword [ebp - 0x12f0], edx
mov dword [ebp - 0x12ec], edx
mov dword [ebp - 0x12e8], edx
lea eax, [ebp - 0x12f8]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFileGather]
push 0
lea ecx, [ebp - 0x1248]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push str.Zucuvituw_hexo_zus
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
lea edx, [ebp - 0xa48]
push edx
push str.Yovileyerip_jehuwezepef_lubehuwarivu_lucegumanovufu
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
push 0
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
push 0
lea ecx, [ebp - 0x528]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 4], 0
mov eax, dword [0xbfc3e0]
add dword [ebp - 4], eax
mov eax, 0x8c456
add dword [ebp - 4], eax
mov edx, dword [0xbfb020]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
add eax, dword [ebp + 8]
mov cl, byte [eax]
mov byte [edx], cl
mov esp, ebp
pop ebp
ret 4
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x74
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xfb
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xef
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x22
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8d
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x90
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x95
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x9a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x6c
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf2
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x29
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x34
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf4
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x411d5c
call esi
push 0x411d70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40116e
push 0x800
call eax
push 0x411d8c
call esi
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011e8
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e2c
push 0x411e3c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e4c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dfc
push 0x411e1c
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x401207
lea eax, [esp + 4]
push eax
push 0x411dfc
push 0x411e1c
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411e0c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ad3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ad3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ad3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x401ad3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x408940
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ecx
dec edx
call fcn.00408963
add edi, edi
xor dword [ebx], ecx
push edx
pop edx
dec edx
inc ebx
mov edx, edi
cmp ebx, eax
jne fcn.00408940
add edx, edi
ret
Function at 0x401e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40af88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea eax, [esp + 4]
push esi
mov esi, ecx
push eax
call fcn.00401360
add esp, 4
push str.CoeFile.cfg
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esp + 0x30], 0
call sub.MFC42u.DLL_operator
lea ecx, [esp + 8]
mov byte [esp + 0x24], 2
call fcn.0040a91a
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CFile::CFile
mov edx, dword [esp + 4]
push 0
push 0x1001
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 3
call sub.MFC42u.DLL_CFile::Open
test eax, eax
je 0x401ef0
add esi, 0x68
push 0x10c00
push esi
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CFile::Write
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CFile::Close
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call fcn.0040aaa6
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call fcn.0040a91a
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x84], 0
call fcn.004019a4
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
lea eax, [0x4046d1]
lea edx, [fcn.00401a14]
sub eax, edx
push eax
push fcn.00401a14
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x40132e
push edi
call fcn.00401894
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.004018e3
mov eax, edi
add eax, 0x1e200
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov esi, dword [ebp - 0x88]
mov ecx, esi
mov ebx, edi
sar ebx, cl
sub esi, ebx
push esi
lea esi, [0x4060e4]
xor esi, edi
push esi
call fcn.00401a14
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4019a4
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x120], 0
xor edi, edi
mov dword [ebp - 0x11c], 0x14
invalid

Function at 0x8c211c
Capabilities:
Encode data using xor

Disassembly:
push 0x8c1ea3
pop ebx
and eax, eax
call fcn.008c2158
and esi, eax
sub eax, 0xe8707d75
add esi, 0x6091a45a
xor dword [ecx], ebx
dec eax
sub eax, esi
and esi, esi
add ecx, 1
mov eax, eax
inc eax
inc eax
cmp ecx, edi
jne fcn.008c211c
and eax, eax
ret
Function at 0x4031c8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x403384
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403229
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4033a0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40329b
xor eax, eax
push ebp
push 0x403294
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00403020
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40327d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4033c0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40329b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40337c
cmp byte [ebp - 0xd], 0
jne 0x4032dd
cmp byte [ebp - 0x12], 0
je 0x40337c
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4032f6
dec ebx
cmp byte [ebx], 0x2e
je 0x403305
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4032f5
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40337c
inc ebx
cmp byte [ebp - 0x12], 0
je 0x403332
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40337c
cmp byte [ebp - 0xd], 0
je 0x40337c
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40337c
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403cc4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ecx
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push 0x403d74
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer_1
mov eax, 0x104
call fcn.0040249c
mov ebx, eax
mov edx, 0x403d84
mov eax, ebx
call fcn.00403db4
push 0
lea eax, [esp + 4]
push eax
push 0x1a
mov edi, ebx
push edi
push esi
call sub.kernel32.dll_WriteFile_1
push 0xfa
push ebx
push 0x403da4
push 0
push 0
push 0x800
call sub.kernel32.dll_GetDateFormatA
push 0
lea eax, [esp + 4]
push eax
push 0xa
push edi
push esi
call sub.kernel32.dll_WriteFile_1
mov edx, 0x403db0
mov eax, ebx
call fcn.00403db4
push 0
lea eax, [esp + 4]
push eax
push 2
push edi
push esi
call sub.kernel32.dll_WriteFile_1
mov eax, ebx
call fcn.004024b4
push esi
call sub.kernel32.dll_CloseHandle_1
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x403eb8
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, 0x403e88
call fcn.00403bb8
xor eax, eax
push ebp
push 0x4040b7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00403e14
test al, al
jne 0x4040a1
mov eax, 0xfa
call fcn.0040249c
mov dword [0x406568], eax
push 0xfa
mov eax, dword [0x406568]
push eax
mov eax, dword [0x4064c4]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
push 0
push 0x4064d8
mov eax, dword [0x406568]
push eax
call sub.kernel32.dll_OpenFile
mov edi, eax
cmp edi, 0xffffffff
jne 0x403f2e
call fcn.00403cc4
push 0
push edi
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
mov eax, esi
call fcn.0040249c
mov ebx, eax
push 0
push 0x406560
push esi
push ebx
push edi
call sub.kernel32.dll_ReadFile_1
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x406560]
xor edx, edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x403f6b
cmp eax, dword [esp]
pop edx
pop eax
jne 0x404082
xor eax, eax
mov dword [0x406560], eax
jmp 0x403f82
inc dword [0x406560]
mov eax, dword [0x406560]
xor edx, edx
push edx
push eax
mov eax, esi
sub eax, 5
cdq
cmp edx, dword [esp + 4]
jne 0x403fa0
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x403fdf
jmp 0x403fa4
pop edx
pop eax
jle 0x403fdf
mov eax, dword [0x406560]
cmp byte [ebx + eax], 0x4e
jne 0x403f7c
mov eax, dword [0x406560]
cmp byte [ebx + eax + 1], 0x61
jne 0x403f7c
mov eax, dword [0x406560]
cmp byte [ebx + eax + 2], 0x54
jne 0x403f7c
mov eax, dword [0x406560]
cmp byte [ebx + eax + 3], 0x69
jne 0x403f7c
mov eax, dword [0x406560]
cmp byte [ebx + eax + 4], 0x4b
jne 0x403f7c
add dword [0x406560], 5
mov eax, dword [0x406560]
xor edx, edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x403ffb
cmp eax, dword [esp]
pop edx
pop eax
jne 0x404004
call fcn.00403cc4
push 0xfa
mov eax, dword [0x406568]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10]
mov edx, dword [0x406568]
call fcn.00402ea4
lea eax, [ebp - 0x10]
mov edx, 0x4040d0
call fcn.00402ed4
mov eax, dword [ebp - 0x10]
call fcn.00402f18
mov edx, eax
mov eax, dword [0x406568]
call fcn.00403db4
push 0x1001
push 0x4064d8
mov eax, dword [0x406568]
push eax
call sub.kernel32.dll_OpenFile
mov edi, eax
cmp edi, 0xffffffff
je 0x404082
push 0
push 0x406564
sub esi, dword [0x406560]
push esi
mov eax, dword [0x406560]
lea eax, [ebx + eax]
push eax
push edi
call sub.kernel32.dll_WriteFile_1
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
call fcn.004024b4
mov eax, dword [0x406568]
call fcn.004024b4
call fcn.00403e14
test al, al
jne 0x4040a1
call fcn.00403cc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4040be
lea eax, [ebp - 0x10]
call fcn.00402de8
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x412e86
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
nop dword [eax]
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xec
push 0
push 0
push 0
call esi
add byte [edi + ebp], 5
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x17
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xb2
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xab
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x98
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x3d
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x1e
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x43
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xbf
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xd2
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x66
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x32
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xe5
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x79
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x4a
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xad
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x5e
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x96
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x65
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x2f
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x76
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xf4
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x77
push 0
push 0
push 0
call esi
inc byte [edi + ebp]
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x74
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xcf
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x4c
inc edi
cmp edi, ebx
jb 0x412d20
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451c59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451c6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405902
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b112
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b123
pop esi
ret
push ebx
push edi
push esi
call fcn.0049aff9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fd5
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b14b
push ebx
push esi
push edi
call fcn.004056f5
add esp, 0xc
push 0
call fcn.0040623f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40217c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40218b
pop dword [ebp - 0x28]
mov eax, 0x40218b
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x2579808e
sub dword [ebp - 0x38], 0xd7273b43
mov dword [ebp - 0x34], 0xb899d95e
sub dword [ebp - 0x34], 0x86668d19
mov dword [ebp - 0x30], 0x895fd333
sub dword [ebp - 0x30], 0x3d138f05
mov dword [ebp - 0x2c], 0xe81ee223
add dword [ebp - 0x2c], 0x17e11ddd
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x2110fa4f
sub dword [ebp - 0x38], 0xac9e90f9
mov dword [ebp - 0x34], 0x9942e3cc
add dword [ebp - 0x34], 0xa8297da9
mov dword [ebp - 0x30], 0xd5500a46
sub dword [ebp - 0x30], 0x71e09dda
mov dword [ebp - 0x2c], 0xa04de9b
sub dword [ebp - 0x2c], 0xa04de9b
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xfaaa947d
add eax, 0x5979ca7
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x408f0
push 0
call eax
mov ecx, 0xdb4e9d68
add ecx, 0x24b1b60b
xor edi, edi
add edi, eax
mov ebx, 0x8911c6f5
add ebx, 0x77317d0b
add ebx, dword [ebp - 0x28]
mov esi, 0xd6cc656e
mov dword [ebp - 0xc], 0x78310b98
mov edx, dword [ebx]
add dword [ebp - 0xc], 0x4e760e9f
sub edx, esi
xor dword [ebp - 0xc], 0x3f1d240a
mov dword [edi], edx
xor dword [ebp - 0x20], 0x37bfa8d7
add edi, 4
add ebx, 0x77c31274
add ebx, 0x883ced90
loop 0x40229f
add eax, 0x1409f
mov ebx, eax
add eax, 0xd066c4d7
add eax, 0x2f993b2e
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x4026d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [esi + 8]
call fcn.00402520
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x4026f9
mov ecx, dword [esi + 8]
mov dword [ecx + 0xc], eax
mov edi, dword [esi + 8]
lea eax, [ebp + 0x10]
push eax
push 0
push edi
push 0x4024a0
push 0
push 0
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x10], eax
test eax, eax
je 0x40273d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40273d
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], 0
mov eax, dword [esi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc