joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f020
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x40f253
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 0x40f268
mov eax, dword [0x4429e8]
call fcn.004067d8
mov edx, dword [ebp - 4]
mov eax, 0x442a10
call fcn.00403b60
mov edx, 0x4429f0
mov eax, dword [0x442a10]
call fcn.0040e600
cmp edx, dword [0x442a18]
jne 0x40f07c
cmp eax, dword [0x442a14]
jb 0x40f0c3
jmp 0x40f07e
jl 0x40f0c3
push 0x50040
push dword [0x442a08]
push 0x40f284
push 0x40f294
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 8]
call fcn.00403fa8
push eax
push 0x40f2a0
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
call sub.kernel32.dll_ExitProcess_1
cmp dword [0x442a00], 0
je 0x40f0d2
call dword [0x442a00]
call fcn.0040e86c
test al, al
jne 0x40f0e2
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
mov eax, dword [0x442a10]
call fcn.00403fa8
push eax
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00406478
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x40f171
push 0x50030
push dword [0x442a08]
push 0x40f284
push 0x40f2dc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x10]
call fcn.00403fa8
push eax
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x18]
call fcn.00405bf8
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x40f2f0
call fcn.00403df4
mov eax, dword [ebp - 0x14]
call fcn.00403fa8
push eax
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
call sub.kernel32.dll_ExitProcess_1
push 0x80
mov eax, dword [0x442a10]
call fcn.00403fa8
push eax
call sub.kernel32.dll_SetFileAttributesA
push dword [0x442a1c]
push 0x40f318
push 0x40f32c
push dword [0x4429f8]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00403e68
mov edx, dword [ebp - 0x1c]
mov eax, 0x80000002
call fcn.00406708
mov ebx, eax
push 0
push 0x400
mov eax, dword [0x442a10]
call fcn.004065cc
call fcn.00404604
mov ecx, eax
mov edx, 0x40f338
mov eax, ebx
call fcn.0040683c
mov ecx, dword [0x4429ec]
mov edx, 0x40f350
mov eax, ebx
call fcn.00406874
mov eax, ebx
call fcn.004068b4
push 0x50040
push dword [0x442a08]
push 0x40f284
push 0x40f294
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x20]
call fcn.00403fa8
push eax
push 0x40f360
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
call fcn.0040e8f8
Function at 0x40f384
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x40f505
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040e86c
test al, al
jne 0x40f3af
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
push 0
push 0x40f51c
push dword [0x4429f8]
push 0x40f534
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 4]
call fcn.00403fa8
push eax
push 0x40f538
push 0
push 0
call sub.shell32.dll_ShellExecuteA
lea eax, [ebp - 8]
mov ecx, dword [0x4429f8]
mov edx, 0x40f54c
call fcn.00403df4
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.0040dcd0
push dword [0x442a1c]
push 0x40f560
push 0x40f574
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e68
mov edx, dword [ebp - 0xc]
mov eax, 0x80000002
call fcn.004066d8
mov ebx, eax
mov edx, dword [0x4429f8]
mov eax, ebx
call fcn.004068c0
mov eax, ebx
call fcn.004068b4
push 0x50040
push dword [0x442a08]
push 0x40f580
push 0x40f590
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x10]
call fcn.00403fa8
push eax
push 0x40f59c
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
push 0
push 0x40f5d0
push dword [0x4429f4]
push 0x40f5e8
lea edx, [ebp - 0x18]
mov eax, dword [0x4429f4]
call fcn.00406634
push dword [ebp - 0x18]
push 0x40f5fc
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403e68
mov eax, dword [ebp - 0x14]
call fcn.00403fa8
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x40f608
call fcn.0040e550
mov eax, dword [ebp - 0x1c]
call fcn.00403fa8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1

Function at 0x40f610
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40f6c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x40f6d4
mov eax, dword [0x4429e8]
call fcn.004067d8
mov edx, dword [ebp - 8]
mov eax, 0x442a10
call fcn.00403b60
mov eax, dword [0x4429f8]
call fcn.00403fa8
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x442a20], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x40f67a
push 0
call sub.kernel32.dll_ExitProcess_1
push 4
push 0
push 0
push 0xf001f
mov eax, dword [0x442a20]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 4], eax
mov eax, dword [0x4428a8]
call fcn.0040cf88
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_UnmapViewOfFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f6c8
lea eax, [ebp - 8]
call fcn.00403b0c
ret
Function at 0x411944
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x41197d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403bfc
jmp 0x411986
mov eax, ebx
mov edx, esi
call fcn.00403b60
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x411990
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4119b1
mov al, byte [esp]
jmp 0x4119b3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x412048
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x411eb0
mov eax, dword [0x441670]
cmp byte [eax], 0
je 0x4120c4
mov eax, dword [0x4415cc]
call fcn.00402ab4
call fcn.0040298c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00410e18
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x41210c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4120fa
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4415ac]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x442660]
call fcn.0040490c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x412ae8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x412b4c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403d60
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00410ce0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412b53
lea eax, [ebp - 0xc]
call fcn.00403b0c
ret
Function at 0x421e24
Capabilities:
Read file on windows

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
push 4
push 0x1000
mov eax, dword [ebx + 0x50]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [esp], eax
push 0
push 0
call fcn.00402b74
fild qword [ebx + 0x58]
fmulp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [esp + 0x18]
call fcn.004061b8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push edx
push eax
mov eax, dword [ebx + 0x50]
dec eax
xor edx, edx
not eax
not edx
and eax, dword [esp]
and edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_SetFilePointerEx
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_ReadFile
push 0x8000
push 0
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_VirtualFree_1
add esp, 0x10
pop ebx
ret
Function at 0x42b9e8
Capabilities:
Create process on windows

Disassembly:
push ebx
mov bl, byte [0x442c28]
xor bl, 1
test bl, bl
je 0x42ba32
push 0x50044
mov eax, dword [0x442c44]
call fcn.00403fa8
push eax
push 0x42ba38
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
cmp eax, 6
jne 0x42ba32
push 5
push 0
push 0
push 0x42ba9c
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
pop ebx
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40259d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x4025e5
mov dword [ebp - 0xc], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4025dd
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 4], eax
jmp 0x402614
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x402611
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402628
mov eax, 0
jmp 0x40267c
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40264f
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x402674
push 6
call fcn.0043a7d3
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x40267c
mov esp, ebp
pop ebp
ret 8
Function at 0x4036da
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40371a
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4037a7
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x4548ed]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.00402682
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x1bc
call fcn.0043c4a0
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403772
push ebx
call fcn.0043a7c7
add esp, 4
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00402a9c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4037a7
push 6
call fcn.0043a7d3
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x4037c1
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0043a7cd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4037c6
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4037d7
push ebx
call fcn.0043a7c7
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x409cee
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push SysStringLen
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x409d2f
mov eax, 0x45426f
push eax
push 1
mov ebx, 0x130
call fcn.0043c550
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 8], 2
fild dword [ebp - 4]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x4548cc]
fstp qword [ebp - 0x24]
mov dword [ebp - 0x28], esp
fld qword [ebp - 0x24]
call fcn.00402682
push eax
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop
nop
cmp dword [ebp - 0x28], esp
je 0x409d89
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x409dae
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x409ddb
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x409dfd
push 6
call fcn.0043a7d3
add esp, 4
call fcn.00409e92
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x409e27
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 0x18], esp
xor eax, eax
call dword [sym.imp.USER32.dll_EmptyClipboard]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x409e46
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push 1
xor eax, eax
call dword [sym.imp.USER32.dll_SetClipboardData]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x409e6d
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 0x18], esp
xor eax, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x409e8c
push 6
call fcn.0043a7d3
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x41512c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push reloc.OLEAUT32.dll_SysStringLen
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.0043f070
add esp, 0x10
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
call fcn.004151a1
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x415196
push 6
call fcn.0043a7d3
add esp, 4
jmp 0x41519b
mov esp, ebp
pop ebp
ret 0x14
Function at 0x418cc6
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 4], esp
je 0x418cf3
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
push 0x41e5c6
push 0xe
xor eax, eax
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418d27
push 6
call fcn.0043a7d3
add esp, 4
mov dword [0x485b1d], eax
mov dword [ebp - 4], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 4], esp
je 0x418d50
push 6
call fcn.0043a7d3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
push 0x42572f
push 0xd
xor eax, eax
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418d84
push 6
call fcn.0043a7d3
add esp, 4
mov dword [0x485b21], eax
mov esp, ebp
pop ebp
ret
Function at 0x43be20
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x43beb2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x43bea4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x43be9c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x43be65
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x43f1e0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x43f24a
push esi
lea edi, [eax + 0x400]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x43f21a
push esi
xor edi, edi
call dword [0x48670c]
add esp, 4
test eax, eax
je 0x43f266
push eax
push esi
call fcn.004413b0
add esp, 8
mov edi, eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x43f2a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x43f2be
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x43f2b3
pop esi
ret

Function at 0x43f2d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x43f339
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0043b840
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x43f820
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x43f861.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x43f861.2
jmp dword [eax*4 + 0x43f8ec]
mov word [esp + 0x48], di
jmp 0x43f89a
mov word [esp + 0x48], 2
jmp 0x43f89a
mov word [esp + 0x48], 3
jmp 0x43f89a
mov word [esp + 0x48], 4
jmp 0x43f89a
mov word [esp + 0x48], 7
jmp 0x43f89a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x43f8e4
cmp dword [esp + 0x70], edi
je 0x43f8d0
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x440bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x440c11
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x440c6b
inc edi
cmp edi, esi
jl 0x440c05
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x440ca0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x440c5a
cmp byte [eax], bl
je 0x440c75
cmp byte [eax + 1], bl
je 0x440c7e
cmp byte [eax + 2], bl
je 0x440c88
cmp byte [eax + 3], bl
je 0x440c94
add eax, 4
cmp eax, edi
jb 0x440c31
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4