joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409fbb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
push esi
mov esi, dword [esp + 0x20]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x409fdb
xor eax, eax
jmp 0x40a135
add dword [esp + 0x20], 5
lea ecx, [eax - 4]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
or ebp, 0xffffffff
add ecx, ebx
mov dword [esp + 0x10], ecx
lea edx, [edi + ebx]
jmp 0x40a000
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x40a004
inc edx
cmp edx, ecx
jb 0x409ff7
mov edi, edx
sub edi, ebx
cmp edx, ecx
jae 0x40a117
mov ecx, edi
sub ecx, ebp
cmp ecx, 3
jbe 0x40a03c
xor esi, esi
mov al, byte [edx + 4]
mov ebp, edi
mov dword [esp + 0x18], ebp
test al, al
je 0x40a077
cmp al, 0xff
je 0x40a077
and esi, 3
xor eax, eax
add esi, esi
or esi, 1
inc eax
jmp 0x40a110
dec ecx
shl esi, cl
and esi, 7
je 0x40a01b
movzx eax, byte [esi + 0x476b54]
mov ecx, edx
sub ecx, eax
cmp byte [esi + 0x476b4c], 0
mov al, byte [ecx + 4]
je 0x40a063
test al, al
je 0x40a063
cmp al, 0xff
jne 0x40a01b
and esi, 3
mov ebp, edi
add esi, esi
or esi, 1
inc edi
mov ecx, dword [esp + 0x10]
jmp 0x409ff2
mov ebp, dword [esp + 0x28]
movzx ebx, al
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
shl ebx, 8
or ebx, eax
cmp dword [esp + 0x30], 0
je 0x40a0a6
add ebx, edi
add ebx, ebp
jmp 0x40a0aa
sub ebx, edi
sub ebx, ebp
mov dword [esp + 0x24], ebx
test esi, esi
je 0x40a0e4
movzx eax, byte [esi + 0x476b54]
shl eax, 3
push 0x18
pop ecx
sub ecx, eax
mov dword [esp + 0x14], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x40a0d1
cmp al, 0xff
jne 0x40a0e4
xor ebx, ebx
push 0x20
pop ecx
sub ecx, dword [esp + 0x14]
inc ebx
shl ebx, cl
dec ebx
xor ebx, dword [esp + 0x24]
jmp 0x40a099
mov ebp, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
and al, 1
mov byte [edx + 1], bl
dec al
not al
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
mov ebx, dword [esp + 0x20]
shr eax, 8
push 5
mov byte [edx + 2], al
pop eax
add edi, eax
jmp 0x40a06e
mov edx, edi
xor eax, eax
sub edx, ebp
pop ebp
pop ebx
lea ecx, [edx - 1]
shl esi, cl
and esi, 7
cmp edx, 3
cmova esi, eax
mov eax, dword [esp + 0x24]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
Function at 0x40da8a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [esp + 8], edx
jbe 0x40dab0
push esi
mov esi, dword [esp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [esp + 0xc]
jb 0x40da9c
pop esi
mov eax, ecx
ret

Function at 0x40f079
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
sub esp, 0x54
push 0x40
mov eax, 0x45b9a5
call fcn.0042084a
mov ebx, dword [ebp + 0x60]
mov eax, dword [ebp + 0x64]
push dword [ebp + 0x54]
and dword [ebp - 4], 0
lea ecx, [ebp + 0x4c]
push eax
call fcn.0040e77e
push dword [ebp + 0x54]
lea eax, [ebp + 0x68]
sub esp, 0x38
mov edi, esp
sub esp, 0x10
mov esi, esp
mov ecx, esi
mov dword [ebp + 0x54], esi
push eax
call fcn.0040f488
push dword [ebp + 0x50]
mov eax, dword [ebp + 0x74]
mov ecx, edi
push dword [ebp + 0x4c]
mov dword [esi + 0xc], eax
call fcn.0040e70d
lea eax, [ebp - 0x4c]
push eax
call fcn.00414d99
add esp, 0x40
push dword [ebp + 0x54]
xor ecx, ecx
mov byte [ebp - 4], 1
sub esp, 0x38
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], 1
lea eax, [ebp]
push eax
call fcn.00414d99
mov ecx, esp
mov dword [ebp + 0x54], esp
lea eax, [ebp]
mov byte [ebp - 4], 2
push eax
mov dword [ebp + 0x50], ecx
call fcn.0040f4c1
sub esp, 0x40
mov byte [ebp - 4], 3
mov ecx, esp
lea eax, [ebp - 0x4c]
mov dword [ebp + 0x50], ecx
push eax
call fcn.0040f4c1
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], 2
call fcn.0040e803
lea eax, [ebp + 0x40]
mov ecx, ebx
push eax
call fcn.0040e317
lea ecx, [ebp + 0x40]
call fcn.0040de83
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.0040f95d
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 5
call fcn.0040f95d
lea ecx, [ebp + 0x68]
call fcn.0040f616
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
lea esp, [ebp + 0x58]
pop ebp
ret
Function at 0x414c92
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
sub esp, 0x54
push 0x40
mov eax, 0x45b9a5
call fcn.0042084a
mov ebx, dword [ebp + 0x60]
mov eax, dword [ebp + 0x64]
push dword [ebp + 0x54]
and dword [ebp - 4], 0
lea ecx, [ebp + 0x4c]
push eax
call fcn.0040e77e
push dword [ebp + 0x54]
lea eax, [ebp + 0x68]
sub esp, 0x38
mov edi, esp
sub esp, 0x10
mov esi, esp
mov ecx, esi
mov dword [ebp + 0x54], esi
push eax
call fcn.0040f488
push dword [ebp + 0x50]
mov eax, dword [ebp + 0x74]
mov ecx, edi
push dword [ebp + 0x4c]
mov dword [esi + 0xc], eax
call fcn.004146ec
lea eax, [ebp - 0x4c]
push eax
call fcn.00414d99
add esp, 0x40
push dword [ebp + 0x54]
xor ecx, ecx
mov byte [ebp - 4], 1
sub esp, 0x38
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], 1
lea eax, [ebp]
push eax
call fcn.00414d99
mov ecx, esp
mov dword [ebp + 0x54], esp
lea eax, [ebp]
mov byte [ebp - 4], 2
push eax
mov dword [ebp + 0x50], ecx
call fcn.0040f4c1
sub esp, 0x40
mov byte [ebp - 4], 3
mov ecx, esp
lea eax, [ebp - 0x4c]
mov dword [ebp + 0x50], ecx
push eax
call fcn.0040f4c1
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], 2
call fcn.0040e803
lea eax, [ebp + 0x40]
mov ecx, ebx
push eax
call fcn.0040e317
lea ecx, [ebp + 0x40]
call fcn.0040de83
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.0040f95d
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 5
call fcn.0040f95d
lea ecx, [ebp + 0x68]
call fcn.0040f616
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
lea esp, [ebp + 0x58]
pop ebp
ret
Function at 0x415a4a
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x45bb56
call fcn.0042087e
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x415b4a
cmp byte [ebx + 0x3d], 0
je 0x415b4a
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x415a84
xor al, al
jmp 0x415b4c
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004161ed
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x415ae2
sub eax, 1
je 0x415ae6
dec eax
sub eax, 1
je 0x415b38
xor bl, bl
jmp 0x415b3a
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x415b1e
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00440274
add esp, 0x10
cmp esi, eax
jne 0x415ade
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x415b38
test esi, esi
jne 0x415aa8
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0040debf
jmp 0x415aa2
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00408e63
mov al, bl
jmp 0x415b4c
mov al, 1
call fcn.00420828
ret
Function at 0x41f852
Capabilities:
Check if file exists

Disassembly:
push 0x290
mov eax, 0x45ca8e
call fcn.0042087e
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x29c], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.0040d007
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41f8d3
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x41f8cc
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0x2f
je 0x41f8cc
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0x3a
jne 0x41f8d3
mov eax, 0x477784
jmp 0x41f8d8
mov eax, 0x47777c
push eax
mov dword [ebp - 0x294], eax
call fcn.0041ec31
pop ecx
push eax
push dword [ebp - 0x294]
lea ecx, [ebp - 0x28]
call fcn.0041df68
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x290]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ecx, dword [ebp - 0x298]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x41f945
and dword [ecx], 0
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call edi
cmp eax, 2
je 0x41f937
call edi
cmp eax, 0x12
je 0x41f937
call edi
mov edi, eax
jmp 0x41f939
xor edi, edi
call fcn.0041d4ab
mov dword [esi], edi
jmp 0x41f9ce
lea eax, [ebp - 0x264]
push eax
call fcn.0041ec31
pop ecx
mov ecx, dword [ebp - 0x29c]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.0041e03d
test dword [ebp - 0x290], 0x400
je 0x41f979
and dword [edi], 0
and dword [ebx], 0
jmp 0x41f9c6
test byte [ebp - 0x290], 0x10
je 0x41f986
push 3
jmp 0x41f988
push 2
pop eax
mov dword [edi], eax
lea ecx, [ebp - 0x40]
mov dword [ebx], eax
lea eax, [ebp - 0x264]
push eax
call fcn.0041dbdb
push dword [ebp - 0x290]
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00420031
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
mov dword [edi + 4], eax
call fcn.00408eb6
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
and dword [esi], 0
call fcn.0041d4ab
push 0
push 1
lea ecx, [ebp - 0x28]
mov dword [esi + 4], eax
call fcn.00408eb6
mov eax, esi
call fcn.00420828
ret
Function at 0x4203aa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x2c
mov eax, 0x45ccd8
call fcn.0042087e
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x4203cc
mov eax, dword [edi]
jmp 0x4203ce
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x4203ed
push esi
push edi
push ebx
call fcn.00420291
add esp, 0xc
jmp 0x4204c0
test eax, 0x400
je 0x420483
cmp dword [edi + 0x14], 8
jb 0x420402
mov eax, dword [edi]
jmp 0x420404
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.0041dbdb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
push ecx
push 0x2000000
push 3
push ecx
push 7
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00408eb6
cmp esi, 0xffffffff
jne 0x42044c
push dword [ebp - 0x34]
jmp 0x4203de
push edi
call fcn.0041ff11
pop ecx
test al, al
jne 0x420475
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.00420031
pop ecx
pop ecx
push esi
mov dword [ebx], 9
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4204c0
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x420492
and dword [esi], 0
call fcn.0041d4ab
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x4204a9
mov dword [ebp - 0x30], 2
call fcn.00420031
pop ecx
pop ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
call fcn.00420828
ret

Function at 0x44cc01
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044ca80

Function at 0x44ea27
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044e6e7
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401443
pop dword [ebp - 0x40]
mov eax, 0x401443
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xa16853cf
sub dword [ebp - 0x50], 0x53160e84
mov dword [ebp - 0x4c], 0xead90fd2
sub dword [ebp - 0x4c], 0xb8a5c38d
mov dword [ebp - 0x48], 0x4b7e95c6
add dword [ebp - 0x48], 0xcdae68
mov dword [ebp - 0x44], 0x17727f37
add dword [ebp - 0x44], 0xe88d80c9
lea eax, [ebp - 0x50]
push eax
mov eax, 0x5fe8d2ea
add eax, 0xa057ae1a
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x64939f16
sub dword [ebp - 0x50], 0xf02135c0
mov dword [ebp - 0x4c], 0xd223551f
add dword [ebp - 0x4c], 0x6f490c56
mov dword [ebp - 0x48], 0xac2d903
add dword [ebp - 0x48], 0x58ac9369
mov dword [ebp - 0x44], 0x93f82e9e
sub dword [ebp - 0x44], 0x93f82e9e
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xa5c2f276
add eax, 0x5a7d8e8a
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3a2ae
push 0
call eax
mov ecx, 0x6a7f2c66
sub ecx, 0x6a7edce4
xor edx, edx
add edx, eax
mov ebx, 0xcd115f6c
add ebx, 0x33358494
add ebx, dword [ebp - 0x40]
mov edi, 0x7241b725
add edi, 0xcac6552a
sub dword [ebp - 0x1c], 0xb881049d
mov esi, dword [ebx]
mov dword [ebp - 0x2c], 0xd11f2954
add esi, edi
xor dword [ebp - 0x28], 0xe924b1ae
mov dword [edx], esi
add edx, 4
add ebx, 0x8421cec4
sub ebx, 0x8421cec0
loop 0x401562
add eax, 0x130db
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x10013a4
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x248]
mov edi, 0xfffff758
and eax, edi
or eax, dword [ebp + 8]
push eax
lea eax, [esi + 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10013e4
mov eax, dword [esi + 0x248]
and eax, edi
or eax, dword [ebp + 8]
mov dword [esi + 0x248], eax
mov al, 1
jmp 0x10013f5
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10013f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor al, al
pop edi
pop esi
pop ebp
ret 8

Function at 0x29a0e4e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x29a0e4f2
pop dword [ebp - 0x48]
mov eax, 0x1b1426d
sub eax, 0xd8105d7b
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x4e93021e
sub dword [ebp - 0x58], 0x40bcd3
mov dword [ebp - 0x54], 0x9e3b40f1
sub dword [ebp - 0x54], 0x6c07f4ac
mov dword [ebp - 0x50], 0x1b118d8d
add dword [ebp - 0x50], 0x313ab6a1
mov dword [ebp - 0x4c], 0x279bde6a
sub dword [ebp - 0x4c], 0x279bde6a
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x9e433db1
sub dword [ebp - 0x58], 0x29d0d45b
mov dword [ebp - 0x54], 0x14a5f0ea
add dword [ebp - 0x54], 0x2cc6708b
mov dword [ebp - 0x50], 0x52a3339f
add dword [ebp - 0x50], 0x10cc38cd
mov dword [ebp - 0x4c], 0x2615ec96
sub dword [ebp - 0x4c], 0x2615ec96
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x12ef9de6
sub eax, 0xe94e5da2
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x38a3e
push 0
call eax
mov ecx, 0x97808c2a
sub ecx, 0x97804b1b
mov esi, eax
mov edi, 0x29a22000
add edi, dword [ebp - 0x48]
mov edx, 0xb2c34e82
add edx, 0xf6b74150
sub dword [ebp - 0x2c], 0xc1c459b2
mov ebx, dword [edi]
add dword [ebp - 0x34], 0x5c685ae2
xor ebx, edx
xor dword [ebp - 0xc], 0x200f978f
mov dword [esi], ebx
sub dword [ebp - 0x2c], ecx
add esi, 0x37cb7d3d
add esi, 0xc83482c7
add edi, 0x42d1d3fa
add edi, 0xbd2e2c0a
loop 0x29a0e609
add eax, 0x3d33c206
add eax, 0xc2cd3509
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9b5b928c
sub ecx, 0x71bb928c
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4013e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040ec60
mov eax, dword [esi + 4]
test eax, eax
je 0x401407
cmp eax, 1
je 0x401407
cmp eax, 0x80010106
jne 0x4015fa
cmp byte [esi + 0xc], 0
je 0x4015fa
or byte [ebp - 0x14], 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0x41155c
call fcn.004010c0
test al, al
je 0x4015e5
cmp dword [esi + 0x258], 0
jne 0x401484
push 0
push 0
xorps xmm0, xmm0
push 1
lea eax, [ebp - 0x10]
movq qword [ebp - 0xc], xmm0
push eax
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x258], eax
test eax, eax
je 0x4015e5
push 0x41245c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4015e5
push 0x104
lea eax, [esi + 0x44]
push eax
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4015e5
lea eax, [esi + 0x25c]
push eax
push ecx
xor ecx, ecx
call fcn.00405880
add esp, 8
test al, al
je 0x4015e5
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x464]
push eax
mov dword [ebp + 8], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x4015e5
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 8
mov dword [ebp - 8], 0x4021
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
cmp eax, 1
jne 0x4015e5
lea ecx, [esi + 0x38]
mov dword [0x4160e0], esi
call fcn.004102a0
test al, al
je 0x4015e5
xor ebx, ebx
cmp dword [ebp - 0x18], ebx
jbe 0x4015d0
lea ecx, [ecx]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + ebx*4]
mov dword [eax + ebx*4], 0
test byte [0x41622c], 1
mov dword [ebp + 8], ecx
jne 0x401584
push 0x416f0c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [0x41622c], 1
jne 0x401579
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
or byte [0x41622c], 1
mov dword [0x41623c], eax
mov dword [0x416230], 0x40c790
push 0x416f0c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 8
push 0
push dword [0x41623c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov edi, eax
test edi, edi
je 0x4015c1
push ecx
push edi
mov dword [edi + 4], ecx
sub esp, 8
lea ecx, [esi + 0x10]
mov dword [edi], 0x411548
call fcn.00409540
test eax, eax
jne 0x4015c6
push ecx
mov ecx, edi
call fcn.00401080
jmp 0x4015c6
call fcn.0040c8d0
inc ebx
cmp ebx, dword [ebp - 0x18]
jb 0x401530
lea ecx, [ebp - 0x20]
mov bl, 1
call fcn.00401e10
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x20]
xor bl, bl
call fcn.00401e10
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401910
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x904000
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne al
test al, al
jne 0x40197c
cmp dword [ebp - 0x30], 0
je 0x40197c
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne al
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401d60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4b4
push ebx
push esi
push edi
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x416f0c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
lea ecx, [esp + 0x14]
call fcn.004012b0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
call fcn.004013e0
test al, al
jne 0x401db2
mov ebx, 0x273
jmp 0x401dbd
lea ecx, [esp + 0x10]
call fcn.00401990
mov ebx, eax
lea ecx, [esp + 0x10]
call fcn.00401610
mov esi, 0x416204
mov edi, 6
test byte [esi], 1
je 0x401de1
mov eax, dword [esi + 4]
test eax, eax
je 0x401dde
call eax
and byte [esi], 0xfe
add esi, 8
dec edi
jne 0x401dd0
push 0x416f0c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402380
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 0x4c]
push edi
lea ecx, [ebx + 0x4c]
call dword [eax]
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jle 0x4023ce
cmp eax, 0x104
jae 0x4023ce
mov edx, eax
lea ecx, [ebp - 0x208]
call fcn.00408ae0
test eax, eax
je 0x4023ce
mov edx, dword [ebx + 0x4c]
push eax
lea ecx, [ebx + 0x4c]
call dword [edx + 0x10]
xor esi, esi
lea eax, [ebp - 0x208]
push eax
push ecx
mov ecx, dword [esi + section..data]
call fcn.00405880
add esp, 8
test al, al
je 0x402406
or edx, 0xffffffff
lea ecx, [ebp - 0x208]
call fcn.00408ae0
test eax, eax
je 0x402406
mov edx, dword [ebx + 0x4c]
push eax
lea ecx, [ebx + 0x4c]
call dword [edx + 0x10]
add esi, 4
cmp esi, 0x1c
jb 0x4023d0
push 0x104
lea eax, [ebp - 0x208]
push eax
push str._ProgramW6432_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jle 0x40244b
cmp eax, 0x104
jae 0x40244b
mov edx, eax
lea ecx, [ebp - 0x208]
call fcn.00408ae0
test eax, eax
je 0x40244b
mov edx, dword [ebx + 0x4c]
push eax
lea ecx, [ebx + 0x4c]
call dword [edx + 0x10]
xor esi, esi
cmp dword [ebx + 0x54], esi
jbe 0x402472
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov eax, dword [ebx + 0x50]
push dword [eax + esi*4]
call edi
mov eax, dword [ebx + 0x50]
push dword [eax + esi*4]
call dword [sym.imp.USER32.dll_CharLowerW]
inc esi
cmp esi, dword [ebx + 0x54]
jb 0x402458
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret