joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4062b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x818]
sub esp, 0x86c
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x824], 4
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
mov dword [esp + 4], 0x40c0c8
mov dword [esp], 0x400
call dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
lea eax, [ebp - 0x82c]
sub esp, 8
mov dword [esp + 0x18], eax
mov eax, dword [0x40c080]
mov dword [esp + 0x30], 0x14
mov dword [esp + 0x10], eax
mov eax, dword [0x40c08c]
mov dword [esp + 0x2c], 0xd
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x24], 0xd
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x65
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x102
mov dword [esp + 4], 0x50001002
mov dword [esp], eax
call sym._CreateToolbarEx_52
mov dword [0x40c0b0], eax
mov eax, dword [0x40c080]
sub esp, 0x34
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4b5
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
cmp word [ebp - 0x818], 0
je 0x40654f
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4063c0
sub eax, ebx
sar eax, 1
inc eax
xor edx, edx
mov esi, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 0xc], ebx
mov edi, 0x40c0c8
mov word [ebp + eax*2 - 0x818], dx
mov eax, dword [0x40c0b0]
mov ebx, 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44d
mov dword [esp], eax
call esi
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x828], 0x9001
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [0x40c0b0]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x443
mov dword [esp], eax
call esi
mov eax, dword [0x40c0b0]
inc dword [ebp - 0x81c]
sub esp, 0x10
mov dword [esp + 0xc], 0x40c0c8
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44d
mov dword [esp], eax
call esi
mov dword [ebp - 0x828], 0x9002
sub esp, 0x10
cmp word [0x40c0c8], 0
je 0x4064f1
lea esi, [esi]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
sub esp, 4
cmp eax, 5
je 0x406528
ja 0x406500
cmp eax, 2
je 0x406540
cmp eax, 4
jne 0x406518
mov dword [ebp - 0x82c], 4
lea eax, [ebp - 0x82c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [0x40c0b0]
mov dword [esp + 4], 0x443
mov dword [esp], eax
call esi
inc dword [ebp - 0x828]
inc dword [ebp - 0x81c]
sub esp, 0x10
nop
add edi, 2
cmp word [edi - 2], 0
jne 0x4064e0
inc ebx
cmp word [edi], 0
jne 0x406480
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 6
jne 0x406518
mov dword [ebp - 0x82c], 5
jmp 0x4064af
mov dword [ebp - 0x82c], 2
jmp 0x4064af
mov dword [ebp - 0x82c], 3
jmp 0x4064af
mov dword [ebp - 0x82c], 1
jmp 0x4064af
mov eax, 1
jmp 0x4063ce
Function at 0x408040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
mov ebx, eax
mov eax, 0x415b70
cmove ebx, eax
mov eax, ebx
call sym._is_exe_file
test eax, eax
je 0x408080
mov ebx, dword [ebp - 4]
mov eax, 1
leave
ret
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0x80000000
call dword [sym.imp.advapi32.dll_RegQueryValueW]
mov ebx, dword [ebp - 4]
sub esp, 0x10
test eax, eax
leave
sete al
movzx eax, al
add eax, eax
ret

Function at 0x408490
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x2c
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.user32.dll_ShowWindow]
mov dword [ebp - 0x20], eax
call eax
sub esp, 8
test ebx, ebx
je 0x40859a
mov eax, dword [ebp + 8]
and eax, 1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
and eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x18]
mov edx, dword [esi + 0x84]
and eax, 0x10
test edx, edx
je 0x4085c0
test eax, eax
je 0x408590
cmp word [ebx + 0x44], 0x2e
je 0x408630
test edi, edi
je 0x408510
lea eax, [ebx + 0x44]
mov edx, edi
call sym._pattern_imatch
test eax, eax
je 0x408590
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x40851d
test byte [ebx + 0x18], 6
jne 0x408590
mov eax, dword [ebp + 8]
and eax, 0xe
cmp eax, 0xe
je 0x408550
lea eax, [ebx + 0x44]
call sym._get_file_type
cmp eax, 1
je 0x408620
cmp eax, 2
je 0x4085e0
test byte [ebp + 8], 8
je 0x408590
lea esi, [esi]
nop
cmp dword [ebp + 0xc], 0xffffffff
mov eax, 0xffffffff
je 0x408561
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0x181
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
mov edx, dword [esi + 0x84]
sub esp, 0x10
test edx, edx
je 0x408590
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4085f0
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4084d3
mov eax, dword [esi]
mov dword [esp + 4], 5
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov eax, dword [ebp + 0xc]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x4084fa
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x4084fa
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4084d3
jmp 0x40859a
test byte [ebp + 8], 4
jne 0x408550
jmp 0x408590
mov edx, dword [ebx + 4]
test edx, edx
je 0x408590
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, esi
call sym._insert_entries.part.0
mov ebx, dword [ebx]
mov dword [ebp + 0xc], eax
test ebx, ebx
jne 0x4084d3
jmp 0x40859a
test byte [ebp + 8], 2
jne 0x408550
jmp 0x408590
movzx eax, word [ebx + 0x46]
test ax, ax
je 0x408590
cmp ax, 0x2e
jne 0x4084fa
cmp word [ebx + 0x48], 0
jne 0x4084fa
jmp 0x408590
Function at 0x408a70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
mov ebx, ecx
sub esp, 0x64c
mov eax, dword [eax + 0x90]
mov dword [ebp - 0x62c], edx
lea edx, [ebp - 0x220]
call sym._get_path
lea eax, [ebp - 0x220]
mov dword [esp + 0xc], sym._DestinationDlgProc_16
mov dword [esp + 0x10], eax
mov eax, dword [esi]
mov dword [esp + 4], 0x68
mov dword [esp + 8], eax
mov eax, dword [0x40c080]
mov dword [esp], eax
call dword [sym.imp.user32.dll_DialogBoxParamW]
sub esp, 0x14
cmp eax, 1
je 0x408ae0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x62c]
mov edi, eax
mov eax, dword [esi + 0x90]
call sym._get_path
movzx edx, word [ebp - 0x220]
cmp dx, 0x2f
je 0x408b0e
cmp word [ebp - 0x21e], 0x3a
jne 0x408bb0
xor eax, eax
jmp 0x408b20
movzx edx, word [ebp + eax - 0x220]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x408b18
lea eax, [ebp - 0x220]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x408acf
test al, 0x10
je 0x408acf
lea eax, [ebp - 0x420]
lea esi, [ebp - 0x620]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x62c]
mov dword [esp + 0xc], esi
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll__wsplitpath]
lea eax, [ebp - 0x420]
mov dword [esp], ebx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x220]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s_s
call dword [sym.imp.user32.dll_wsprintfW]
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0x90]
mov edx, ebx
mov eax, dword [eax + 8]
call sym._get_path
cmp word [ebx], 0
mov eax, ebx
je 0x408c19
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x408bd0
mov edx, eax
sub edx, ebx
lea esi, [edx - 2]
sar edx, 1
movzx esi, word [ebx + esi]
cmp si, 0x5c
je 0x408bfb
cmp si, 0x2f
je 0x408bfb
mov ecx, 0x2f
inc edx
mov word [eax], cx
lea esi, [ebx + edx*2]
xor eax, eax
movzx edx, word [ebp + eax - 0x220]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x408c00
jmp 0x408b2c
xor edx, edx
mov esi, 0xfffffffe
jmp 0x408be2
Function at 0x40a520
Capabilities:
Set current directory

Disassembly:
test edx, edx
je 0x40a600
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
mov ebx, eax
xor eax, eax
sub esp, 0x220
mov dword [ebx + 0x94], edx
mov word [ebp - 0x210], ax
mov eax, dword [edx + 4]
mov dword [ebx + 0x128], edx
test eax, eax
cmove eax, edx
mov dword [ebx + 0x124], eax
mov edx, dword [edx + 0x10]
test edx, edx
je 0x40a5c8
mov eax, ebx
call sym._refresh_right_pane
mov eax, esi
lea edx, [ebp - 0x210]
call sym._get_path
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [ebp + eax - 0x210]
mov word [ebx + eax + 0x164], dx
add eax, 2
test dx, dx
jne 0x40a580
mov eax, dword [ebx]
test eax, eax
je 0x40a5b4
lea ecx, [ebp - 0x210]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [sym.imp.user32.dll_SetWindowTextW]
sub esp, 8
cmp word [ebp - 0x210], 0
jne 0x40a5e0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, esi
mov dword [esp], eax
mov eax, ebx
call sym._scan_entry
jmp 0x40a568
lea eax, [ebp - 0x210]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
sub esp, 4
test eax, eax
je 0x40a5be
call sym._set_space_status
jmp 0x40a5be
ret

Function at 0x40a6b0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea eax, [ebp - 0x998]
sub esp, 0x9c0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x9a0]
mov dword [esp + 8], eax
lea eax, [ebp - 0x9a8]
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
sub esp, 0x10
test eax, eax
jne 0x40a740
xor eax, eax
mov edx, 0x3f
lea ebx, [ebp - 0x808]
jmp 0x40a707
movzx edx, word [eax + 0x415c0c]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x40a700
mov eax, dword [0x40c0a8]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40b
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp - 0x908]
mov edx, dword [ebp - 0x9a4]
mov ebx, dword [sym.imp.shlwapi.dll_StrFormatByteSizeW]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x9a8]
lea esi, [ebp - 0x988]
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
mov edx, dword [ebp - 0x99c]
sub esp, 0x10
mov dword [ebp - 0x990], eax
lea eax, [ebp - 0x888]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x9a0]
mov dword [esp + 4], edx
mov dword [esp + 0xc], 0x40
mov dword [esp], eax
call ebx
lea ebx, [ebp - 0x808]
mov dword [ebp - 0x98c], eax
mov eax, dword [0x40c080]
sub esp, 0x10
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], esi
mov dword [esp + 4], 0x4c3
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
lea eax, [ebp - 0x990]
sub esp, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x400
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0x2400
call dword [sym.imp.kernel32.dll_FormatMessageW]
sub esp, 0x1c
jmp 0x40a713
Function at 0x40b8d0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40b96b
cmp ax, 9
je 0x40b958
cmp ax, 0x20
je 0x40b958
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp ax, 0x5c
je 0x40b9c0
cmp ax, 0x22
je 0x40b9d0
mov dword [ebp - 0x6c], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40b96b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x40b910
test edi, 1
jne 0x40b910
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x40b958
cmp ax, 0x20
je 0x40b958
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x40b9e8
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
inc dword [ebp - 0x6c]
jmp 0x40b92b
and dword [ebp - 0x6c], 1
jne 0x40b924
xor edi, 1
jmp 0x40b92b
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x40b984

Function at 0x40ba00
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40974c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40975b
pop dword [ebp - 0x18]
mov eax, 0x59bff3fa
add eax, 0xa680a361
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x84e61cd8
sub dword [ebp - 0x28], 0x3693d78d
mov dword [ebp - 0x24], 0x81049303
add dword [ebp - 0x24], 0xb12eb942
mov dword [ebp - 0x20], 0x40412893
add dword [ebp - 0x20], 0xc0b1b9b
mov dword [ebp - 0x1c], 0xb30f830c
add dword [ebp - 0x1c], 0x4cf07cf4
lea eax, [ebp - 0x28]
push eax
mov eax, 0x1c825473
sub eax, 0x1c418427
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x9c3cd870
sub dword [ebp - 0x28], 0x27ca6f1a
mov dword [ebp - 0x24], 0xaff7fb20
sub dword [ebp - 0x24], 0x6e8b99ab
mov dword [ebp - 0x20], 0xd4df3a14
sub dword [ebp - 0x20], 0x716fcda8
mov dword [ebp - 0x1c], 0xf49baed8
add dword [ebp - 0x1c], 0xb645128
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x43cba89a
sub eax, 0x438ad852
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3ba3a
push 0
call eax
mov ecx, 0x89b04f7
sub ecx, 0x89ab4ae
xor edi, edi
add edi, eax
mov ebx, 0xd80631
add ebx, 0xff69a9cf
add ebx, dword [ebp - 0x18]
mov edx, 0xde766cad
xor dword [ebp - 0xc], 0xfcca476f
mov esi, dword [ebx]
xor esi, edx
mov dword [edi], esi
sub dword [ebp - 8], 0x25f43912
add edi, 0x1ddc3c93
sub edi, 0x1ddc3c8f
add ebx, 0xed302889
add ebx, 0x12cfd77b
loop 0x409879
add eax, 0x95c03239
add eax, 0x6a4101be
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10005a7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10005a89
pop dword [ebp - 0x28]
mov eax, 0x8761345c
sub eax, 0x7760d9d3
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x6edd675
sub dword [ebp - 0x38], 0xb89b912a
mov dword [ebp - 0x34], 0x91e06347
sub dword [ebp - 0x34], 0x5fad1702
mov dword [ebp - 0x30], 0x6832aaaf
sub dword [ebp - 0x30], 0x1be66681
mov dword [ebp - 0x2c], 0x7562f151
add dword [ebp - 0x2c], 0x8a9d0eaf
lea eax, [ebp - 0x38]
push eax
mov eax, 0x675474c2
sub eax, 0x5753b49e
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x6d39678b
sub dword [ebp - 0x38], 0xf8c6fe35
mov dword [ebp - 0x34], 0x33b82371
add dword [ebp - 0x34], 0xdb43e04
mov dword [ebp - 0x30], 0x37512d7f
sub dword [ebp - 0x30], 0xd3e1c113
mov dword [ebp - 0x2c], 0x20498717
sub dword [ebp - 0x2c], 0x20498717
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x28d64d17
sub eax, 0x18d58ceb
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a6be
push 0
call eax
mov ecx, 0xe3a4a6d7
sub ecx, 0xe3a45534
mov edx, eax
mov ebx, 0x10047400
add ebx, dword [ebp - 0x28]
mov esi, 0x17e3d283
sub esi, 0x5aa9c1e0
mov edi, dword [ebx]
add dword [ebp - 0x14], 0x322afd49
add edi, esi
add dword [ebp - 4], eax
mov dword [edx], edi
xor dword [ebp - 4], 0x5869b6bb
add edx, 4
add ebx, 0xe35fab70
add ebx, 0x1ca05494
loop 0x10005ba5
add eax, 0x1395f
mov ebx, eax
add eax, 0xcf1f190e
add eax, 0x30e0e6f7
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x100024be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100024cd
pop dword [ebp - 0x20]
mov eax, 0xcd768337
sub eax, 0xbd765e6a
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x4a1da33b
add dword [ebp - 0x30], 0x434a210
mov dword [ebp - 0x2c], 0x62016a7
sub dword [ebp - 0x2c], 0xd3ecca62
mov dword [ebp - 0x28], 0x8bc1f8c9
add dword [ebp - 0x28], 0xc08a4b65
mov dword [ebp - 0x24], 0xce0d3ff5
add dword [ebp - 0x24], 0x31f2c00b
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xe0ae0d25
add dword [ebp - 0x30], 0x93c45c31
mov dword [ebp - 0x2c], 0x52f1a246
sub dword [ebp - 0x2c], 0x118540d1
mov dword [ebp - 0x28], 0xeb0353a5
sub dword [ebp - 0x28], 0x8793e739
mov dword [ebp - 0x24], 0xdbf8ea2b
add dword [ebp - 0x24], 0x240715d5
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x72447780
add eax, 0x9dbbc8fc
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x39497
push 0
call eax
mov ecx, reloc.kernel32.dll_InterlockedCompareExchange
mov edi, eax
mov edx, 0x2f6c63e4
sub edx, 0x1f6bcde4
add edx, dword [ebp - 0x20]
mov esi, 0xabb36616
add esi, 0xc0d004ee
mov ebx, dword [edx]
xor dword [ebp - 4], ebx
xor ebx, esi
sub dword [ebp - 0x14], edx
mov dword [edi], ebx
add edi, 0xbbfcec06
sub edi, 0xbbfcec02
add edx, 0xdaf5b59a
add edx, 0x250a4a6a
loop 0x100025e4
add eax, 0x13e93
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x100032c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10007040]
jne 0x100032d2
repz ret
jmp fcn.100036ab
Function at 0x10007b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10007b2f
pop dword [ebp - 0x3c]
mov eax, 0xdc4c81ba
sub eax, 0xcc4c068b
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xebc4a381
add dword [ebp - 0x4c], 0x628da1ca
mov dword [ebp - 0x48], 0x50c2ecbf
add dword [ebp - 0x48], 0xe1705f86
mov dword [ebp - 0x44], 0xdd626eda
sub dword [ebp - 0x44], 0x91162aac
mov dword [ebp - 0x40], 0xe996e444
sub dword [ebp - 0x40], 0xe996e444
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x4609b5f0
add dword [ebp - 0x4c], 0x2e68b366
mov dword [ebp - 0x48], 0xf0bc5d0b
sub dword [ebp - 0x48], 0xaf4ffb96
mov dword [ebp - 0x44], 0x61c29701
add dword [ebp - 0x44], 0x1acd56b
mov dword [ebp - 0x40], 0x792c9421
add dword [ebp - 0x40], 0x86d36bdf
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x396b1
push 0
call eax
mov ecx, 0x46c1
xor esi, esi
add esi, eax
mov edi, 0x1001b000
add edi, dword [ebp - 0x3c]
mov edx, 0x5c574af9
add edx, 0xe19a44c2
add dword [ebp - 0x2c], ebx
mov ebx, dword [edi]
sub dword [ebp - 8], esi
xor ebx, edx
xor dword [ebp - 0x1c], 0x9a5be4f4
mov dword [esi], ebx
xor dword [ebp - 0x20], 0x5cb56923
add esi, 0x8be727a5
sub esi, 0x8be727a1
add edi, 0x7fdb4443
add edi, 0x8024bbc1
loop 0x10007c3d
add eax, 0x10dd7
xor ebx, ebx
add ebx, eax
add eax, 0xc2224e0e
add eax, 0x3dddb1f7
mov ecx, 0x337f7ca5
sub ecx, 0x237f7ca5
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401c66
pop dword [ebp - 0x1c]
mov eax, 0x7cb28c8f
add eax, 0x838d8fd7
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xcff9b59
sub dword [ebp - 0x2c], 0xbead560e
mov dword [ebp - 0x28], 0x7d75367
add dword [ebp - 0x28], 0x2a5bf8de
mov dword [ebp - 0x24], 0x3049bee1
add dword [ebp - 0x24], 0x1c02854d
mov dword [ebp - 0x20], 0xf54ff453
sub dword [ebp - 0x20], 0xf54ff453
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x7417f3fb
sub eax, 0x73d7c3a7
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xd9a968de
sub dword [ebp - 0x2c], 0x6536ff88
mov dword [ebp - 0x28], 0xe2277c14
add dword [ebp - 0x28], 0x5f44e561
mov dword [ebp - 0x24], 0xf7f3735e
sub dword [ebp - 0x24], 0x948406f2
mov dword [ebp - 0x20], 0x96f175c9
sub dword [ebp - 0x20], 0x96f175c9
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x35dba
push 0
call eax
mov ecx, 0x87179e55
add ecx, 0x78e8a72d
mov edx, eax
mov ebx, 0xc68d5d4c
add ebx, 0x39b312b4
add ebx, dword [ebp - 0x1c]
mov esi, 0x18093932
sub esi, 0xa7ebb86
sub dword [ebp - 0x14], esi
mov edi, dword [ebx]
mov dword [ebp - 0xc], 0x7cf185fb
xor edi, esi
xor dword [ebp - 8], edx
mov dword [edx], edi
xor dword [ebp - 0x14], edx
add edx, 0xbe7fc8ae
sub edx, 0xbe7fc8aa
add ebx, 0xbafc37a
add ebx, 0xf4503c8a
loop 0x401d83
add eax, 0x9e9c106e
add eax, 0x6164f86d
xor ebx, ebx
add ebx, eax
add eax, 0x5f6fc004
add eax, 0xa0904001
mov ecx, 0x9bde3e26
add ecx, 0x6461c1da
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret