joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420158
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040a6a0
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4201c2
test ah, 4
je 0x4201bb
test bl, bl
jne 0x420180
mov al, 1
jmp 0x4201e9
test al, 0x10
je 0x420188
xor eax, eax
jmp 0x4201e9
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x4201ac
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x4201e9
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x4201e9
test al, 0x10
sete al
jmp 0x4201e9
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 2
je 0x4201e3
cmp ebx, 3
je 0x4201e3
cmp ebx, 0x7b
je 0x4201e3
mov eax, esi
call fcn.00420118
test al, al
jne 0x4201e7
xor eax, eax
jmp 0x4201e9
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x4201f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.0040a6a0
mov ebp, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x420297
test esi, 0x400
jne 0x42022c
test esi, 0x10
setne bl
jmp 0x4202c7
cmp byte [esp], 0
je 0x420260
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x4202c7
push eax
call sub.kernel32.dll_CloseHandle_1
test esi, 0x10
setne bl
jmp 0x4202c7
test esi, 0x10
je 0x42026c
mov bl, 1
jmp 0x4202c7
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x420293
push eax
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x4202c7
mov bl, 1
jmp 0x4202c7
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x4202c1
cmp eax, 3
je 0x4202c1
cmp eax, 0xa1
je 0x4202c1
cmp eax, 0x7b
je 0x4202c1
cmp eax, 0x35
je 0x4202c1
cmp eax, 0x15
je 0x4202c1
cmp eax, 0x43
jne 0x4202c5
xor ebx, ebx
jmp 0x4202c7
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42048c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x420531
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040a6a0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
test edi, 0x400
setne al
test al, bl
je 0x420516
or edi, 0xffffffff
lea edx, [ebp - 4]
mov eax, esi
call fcn.0041ed74
test al, al
je 0x420516
mov eax, dword [ebp - 4]
call fcn.00420b5c
test al, al
je 0x420506
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004208f0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00427040
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.0040a8f4
mov eax, dword [ebp - 4]
call fcn.0040a6a0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420538
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409af4
ret
Function at 0x420544
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x420617
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409ebc
cmp byte [ebp - 9], 0
je 0x4205d5
mov eax, ebx
call fcn.0040a6a0
push eax
call sub.kernel32.dll_GetFileAttributesW
test ah, 4
je 0x4205d5
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0041ed74
test al, al
je 0x4205d5
mov eax, dword [ebp - 8]
call fcn.00420b5c
test al, al
je 0x4205ca
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004208f0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00427040
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
call fcn.0040a8f4
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00409ebc
push edi
mov eax, dword [ebp - 4]
call fcn.0040a6a0
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x4205ef
call sub.kernel32.dll_GetLastError_2
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42061e
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409af4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409af4
ret

Function at 0x420750
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0040a6a0
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4207a5
call sub.kernel32.dll_GetLastError_2
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x42079f
test ah, 4
je 0x42079f
test al, 0x10
je 0x42079f
mov eax, esi
call fcn.0040a6a0
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4207a5
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x420aa0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0
call sub.kernel32.dll_SetLastError
push esp
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x420ad0
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040a744
add esp, 0x20c
pop ebx
ret

Function at 0x4245b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4245e9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00409c1c
jmp 0x4245f2
mov eax, ebx
mov edx, esi
call fcn.00409e74
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4245fc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x42461e
movzx eax, word [esp]
jmp 0x424620
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x42591c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x425a41
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00425724
mov esi, eax
mov eax, dword [0x50c290]
cmp byte [eax], 0
je 0x4259e9
mov eax, dword [0x50c0b8]
call fcn.004076bc
call fcn.00406f2c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4258ec]
call fcn.0040bcd8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x425a5c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x425a25
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x50c078]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x51059c]
call fcn.0040c0c8
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425a48
lea eax, [ebp - 4]
mov edx, dword [0x4258ec]
call fcn.0040bdfc
ret
Function at 0x426ad8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x426bd8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409ebc
lea eax, [ebp - 4]
call fcn.0040a048
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a6a0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x426bc2
mov eax, ebx
call fcn.00406dd8
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x426bbb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a6a0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x426ba5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x426bec
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x426ba5
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426bc2
mov eax, dword [ebp - 0x10]
call fcn.00406df4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426bdf
lea eax, [ebp - 4]
call fcn.00409a94
ret

Function at 0x427af8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00409f90
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040eb1c
mov edi, eax
cmp edi, 0x104
jbe 0x427aa3
mov eax, edi
add eax, eax
call fcn.00406dd8
mov esi, eax
jmp 0x427aa5
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040eb1c
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x427ade
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x427ac8
mov eax, esp
cmp esi, eax
je 0x427aeb
mov eax, esi
call fcn.00406df4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x427b24
cmp bl, 0
je 0x427b20
cmp bl, 0x41
jl 0x427b1b
cmp bl, 0x5a
jg 0x427b1b
or bl, 0x20
xor al, bl
inc esi
jmp 0x427aff
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x427a64

Function at 0x428380
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040a744
add esp, 0x800
pop ebx
ret
Function at 0x428948
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00409a94
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040a6a0
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x42898d
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00409c1c
jmp 0x4289a6
mov edx, ebx
dec edx
mov eax, esi
call fcn.0040a81c
push ebx
mov eax, dword [esi]
call fcn.0040a6a0
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47f198
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x47f1a0
mov eax, edx
pop esi
pop ebx
ret
Function at 0x4b1c18
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b1cb6
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4b1c7a
cmp byte [ebx + 0x11], 0
jne 0x4b1c7a
cmp byte [ebx + 0x3c], 0
jne 0x4b1c7a
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b1c9b
lea edx, [ebp - 4]
mov eax, dword [0x50c244]
call fcn.0040ea88
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48cb34]
call fcn.00425a6c
call fcn.00409198
jmp 0x4b1c9b
lea edx, [ebp - 8]
mov eax, dword [0x50c244]
call fcn.0040ea88
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x48cb34]
call fcn.00425a6c
call fcn.00409198
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1cbd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409af4
ret

Function at 0x4b2654
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b26a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b1a98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b26bb
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b26c4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b1a98
dec esi
jne 0x4b26e6
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4e2168
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
xor ebx, ebx
cmp dword [esp], 0
je 0x4e21cd
mov eax, dword [esp]
call fcn.004e2418
test al, al
je 0x4e21cd
mov eax, dword [esp]
call fcn.004e2228
mov esi, eax
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
dec esi
mov eax, dword [esp]
movzx eax, word [eax + esi*2]
mov edx, eax
mov ecx, eax
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x4e21b0
mov edx, eax
and dx, 0xffdf
mov eax, edx
cmp ax, 0x41
jb 0x4e21cd
cmp ax, 0x5a
ja 0x4e21cd
sub al, 0x41
mov ecx, eax
shr edi, cl
and edi, 1
cmp edi, 1
sete bl
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4eb284
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x509e70
test edx, edx
jne 0x4eb2a3
xor eax, eax
jmp 0x4eb3c1
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4eb2c0
push esi
push edx
push eax
call fcn.004eb3c8
add esp, 0xc
jmp 0x4eb3c1
push esi
push edx
push eax
call fcn.004eb688
add esp, 0xc
jmp 0x4eb3c1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4ff340
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409b78
xor eax, eax
push ebp
push 0x4ff3f7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ff3d5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00407720
lea eax, [ebp - 0x222]
xor ecx, ecx
mov edx, 0x200
call fcn.00407720
lea eax, [ebp - 0x222]
mov edx, dword [ebp - 4]
call fcn.00420c80
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x222]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x614
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ff3e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff3fe
lea eax, [ebp - 4]
call fcn.00409a94
ret

Function at 0x4ff408
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x4891e4]
call fcn.00407cc8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ff4ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004a4c1c
mov eax, dword [ebp - 4]
call fcn.004a4c04
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004a22b4
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4ff495
inc ebx
xor esi, esi
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, esi
movzx eax, byte [ebp - 5]
shr eax, cl
not al
xor byte [ebp - 0xd], al
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x10]
inc esi
dec ebx
jne 0x4ff464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff4b2
mov eax, dword [ebp - 0xc]
call fcn.00407cf8
ret
Function at 0x4ff4c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00409b78
mov eax, dword [ebp - 8]
call fcn.00409b78
mov eax, dword [ebp - 0xc]
call fcn.00409b78
xor eax, eax
push ebp
push 0x4ff5e9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x4ff519
mov eax, dword [ebp - 0xc]
call fcn.0040a6a0
mov esi, eax
jmp 0x4ff51b
xor esi, esi
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00407720
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push 0
push 0
push 0
push 0
push 0
push 0x4ff604
push dword [ebp - 4]
push 0x4ff614
push dword [ebp - 8]
push 0
lea eax, [ebp - 0x68]
mov edx, 5
call fcn.0040a97c
mov eax, dword [ebp - 0x68]
call fcn.0040a6a0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4ff5c6
cmp byte [ebp + 0xc], 0
je 0x4ff5c6
jmp 0x4ff58a
test bl, bl
jne 0x4ff58a
push 1
call sub.kernel32.dll_Sleep_2
push 0
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4ff57f
push 0xffffffffffffffff
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff5f0
lea eax, [ebp - 0x68]
call fcn.00409a94
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409af4
ret

Function at 0x4ff8f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.00409f10
mov eax, dword [esi]
test eax, eax
je 0x4ff911
sub eax, 4
mov eax, dword [eax]
test ax, ax
jbe 0x4ff961
mov word [ebp - 2], ax
mov bx, 1
mov eax, esi
call fcn.0040a040
movzx edx, bx
lea eax, [eax + edx - 1]
push eax
movzx eax, bx
mov edx, dword [esi]
movzx eax, byte [edx + eax - 1]
movzx edx, di
shr edx, 8
xor al, dl
pop edx
mov byte [edx], al
movzx eax, bx
mov edx, dword [esi]
movzx eax, byte [edx + eax - 1]
add di, ax
imul ax, di, 0xce6d
add ax, 0x58bf
mov edi, eax
inc ebx
dec word [ebp - 2]
jne 0x4ff91e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x1130058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x11301a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x113007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113006a
add dl, dl
jne 0x1130089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11300dc
xor eax, eax
add dl, dl
jne 0x1130096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113017d
add dl, dl
jne 0x11300a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11300b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11300bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11300c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11300d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1130075
mov eax, 1
add dl, dl
jne 0x11300ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11300f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11300e1
sub eax, ebx
mov ebx, 1
jne 0x1130128
mov ecx, 1
add dl, dl
jne 0x113010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1130119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1130105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1130075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x113013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x113014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1130136
cmp eax, 0x7d00
jae 0x113016d
cmp eax, 0x500
jb 0x1130168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1130075
cmp eax, 0x7f
ja 0x1130170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1130075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x113019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1130075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x4066be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4066cd
pop dword [ebp - 0x10]
mov eax, 0xb8184056
sub eax, 0xb7d7d989
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3866e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xe872740c
add ecx, 0x178dd039
mov ebx, eax
mov esi, 0x16dae137
sub esi, 0x16996937
add esi, dword [ebp - 0x10]
mov edi, 0x97cd5d38
add dword [ebp - 4], 0x618f5691
mov edx, dword [esi]
xor dword [ebp - 8], edx
xor edx, edi
sub dword [ebp - 8], 0x3ab43a46
mov dword [ebx], edx
xor dword [ebp - 4], 0x601ef525
add ebx, 4
add esi, 4
loop 0x406721
add eax, 0x103e7
xor ebx, ebx
add ebx, eax
add eax, 0x5c3af550
sub eax, 0x5c3af54b
mov ecx, 0x60ac48c4
sub ecx, 0x606c48c4
add ecx, dword [ebp - 0x10]
call ebx
leave
ret