joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4468a1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x45e640]
push ebx
push esi
xor eax, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x44694b
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x38], eax
call esi
mov dword [ebp - 0x34], eax
push 4
xor ebx, ebx
jmp 0x446a4d
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x4469fb
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x446a4e
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4469f0
cmp dword [ebp - 0x24], 1
jne 0x4469f0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x44df74
push eax
call fcn.00431447
add esp, 0xc
cmp eax, 1
jne 0x4469f0
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
push 2
mov dword [ebp - 0x3c], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x446a4e
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x446a4e
lea ecx, [ebp - 0x18]
push ecx
push 0x44688b
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x446a4e
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
mov dword [ebp - 0x3c], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x40], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x446a73
push dword [ebp + edi*4 - 0x40]
mov ecx, dword [ebp - 0x2c]
call fcn.00446802
cmp eax, ebx
pop ecx
jne 0x446a75
inc edi
cmp edi, esi
jl 0x446a5d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042fe7d
leave
ret 4
Function at 0x446a86
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x45d694
je 0x446b42
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x446b2a
mov esi, dword [ebx + 4]
jmp 0x446b24
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x446b14
cmp dword [ebp - 0xc], 4
jne 0x446b14
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x446b0c
or dword [eax + 0x9c], ecx
jmp 0x446b14
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x446ad8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x446abb
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x446f36
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x44b21e
call fcn.0043147c
sub esp, 0x124
mov eax, dword [0x45e640]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, ebp
mov dword [ebp - 0x10], esp
lea edx, [ebp - 0x124]
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
push edx
push eax
push ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x447044
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x447018
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.004021b0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.00446f36
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004019d0
test bl, bl
jne 0x447018
or dword [ebp - 4], 0xffffffff
jmp 0x446f83
cmp esi, 0x103
je 0x447028
cmp esi, 0x3f2
jne 0x447038
push dword [edi]
push dword [ebp - 0x12c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042fe7d
leave
ret 8
Function at 0x448283
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x4482b8
cmp edi, dword [esi + 0xc]
jge 0x4482b8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4482b8
cmp edi, dword [eax + 8]
jge 0x4482b8
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x4482ba
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4483be
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4483f2
jmp fcn.0043d240
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x448463
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x44855c
cmp eax, dword [edi + 0xc]
jge 0x44855c
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x4484b4
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x448545
cmp dword [ebp + 0xc], ebx
je 0x448545
jmp 0x4484de
push 0x10
call fcn.0044814f
cmp eax, ebx
je 0x4484ca
mov ecx, eax
call fcn.004483b5
mov esi, eax
jmp 0x4484cc
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x4484f5
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x448505
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x448517
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0043d240
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004318a0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x448557
cmp ecx, dword [esi + 8]
jge 0x448557
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x44855d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x44861b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x448649
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x448667
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00448585
jmp 0x448667
mov eax, dword [esi + 0x14]
test eax, eax
je 0x448667
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00448585
test edi, edi
mov eax, edi
jne 0x448651
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x5727ec]
test ecx, ecx
je 0x44871a
jmp 0x44861a
ret 8

Function at 0x4013f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [0x411028]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x402ab1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410060]
jne 0x402abb
repz ret
jmp fcn.00404d5c

Function at 0x4096e7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404746
and dword [ebp - 4], 0
cmp dword [0x411a14], 0
mov ebx, eax
jne 0x409798
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409849
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40e1b8
push edi
call esi
test eax, eax
je 0x409849
push eax
call fcn.004046d4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x411a14], eax
call esi
push eax
call fcn.004046d4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411a18], eax
call esi
push eax
call fcn.004046d4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x411a1c], eax
call esi
push eax
call fcn.004046d4
pop ecx
mov dword [0x411a24], eax
test eax, eax
je 0x409798
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004046d4
pop ecx
mov dword [0x411a20], eax
mov eax, dword [0x411a20]
cmp eax, ebx
je 0x4097f0
cmp dword [0x411a24], ebx
je 0x4097f0
push eax
call fcn.0040474f
push dword [0x411a24]
mov esi, eax
call fcn.0040474f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4097f0
test edi, edi
je 0x4097f0
call esi
test eax, eax
je 0x4097e7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4097e7
test byte [ebp - 0xc], 1
jne 0x4097f0
or dword [ebp + 0x10], 0x200000
jmp 0x409829
mov eax, dword [0x411a18]
cmp eax, ebx
je 0x409829
push eax
call fcn.0040474f
pop ecx
test eax, eax
je 0x409829
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409829
mov eax, dword [0x411a1c]
cmp eax, ebx
je 0x409829
push eax
call fcn.0040474f
pop ecx
test eax, eax
je 0x409829
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x411a14]
call fcn.0040474f
pop ecx
test eax, eax
je 0x409849
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40984b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x459634
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x49ebb8]
cmp dword [eax + 0x30], 0
je 0x4596de
cmp dword [ebx + 0x94], 0
jne 0x4596d8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4595c4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4596d8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45969e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4596d8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041ac6c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4596ad
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45a240
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45a275
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404ab0
jmp 0x45a282
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a14
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45b364
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45b3a5
mov eax, esi
call fcn.00441a08
test al, al
je 0x45b3a5
mov eax, dword [ebx + 0x84]
call fcn.00441704
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45b3a5
push 0
mov eax, dword [ebx + 0x84]
call fcn.00441704
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4019ac
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x254
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
xor ebx, ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ebp, dword [sym.imp.MSVCRT.dll_wcscpy]
lea edi, [esi + eax*2]
mov dword [esp], 0x408298
push edi
call ebp
pop ecx
lea eax, [esp + 0x18]
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
and word [edi], bx
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4019f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401aba
lea eax, [esp + 0x40]
push 0x408294
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
je 0x401a6d
lea eax, [esp + 0x40]
push 0x40828c
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
je 0x401a6d
lea eax, [esp + 0x40]
push eax
push edi
call ebp
test byte [esp + 0x1c], 0x10
pop ecx
pop ecx
je 0x401a4d
push 0x408250
push esi
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
mov ecx, esi
call fcn.004019ac
jmp 0x401a67
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401a69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x401a93
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4019f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x12
jne 0x401a93
xor ebx, ebx
push dword [esp + 0x10]
and word [edi], 0
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x401ab8
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x401ab8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret

Function at 0x403cdb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
xor esi, esi
mov edx, 0x409040
mov ecx, 0x409440
push 8
mov eax, esi
pop edi
mov ebx, eax
and ebx, 1
neg ebx
and ebx, 0xedb88320
shr eax, 1
xor eax, ebx
dec edi
jne 0x403cef
mov dword [edx], eax
add edx, 4
inc esi
cmp edx, ecx
jb 0x403cea
mov eax, dword [ecx - 0x400]
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x409040]
xor edx, eax
mov dword [ecx], edx
add ecx, 4
cmp ecx, 0x40b040
jb 0x403d0d
mov eax, 0x403d61
mov esi, 0x403e15
mov dword [0x40b044], eax
mov dword [0x409030], eax
mov dword [0x40b040], esi
call fcn.0040547c
test eax, eax
jne 0x403d5d
mov dword [0x409030], esi
pop edi
pop esi
pop ebx
ret
Function at 0x403f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
and dword [esi], 0
test edi, edi
je 0x403fd9
mov eax, 0x400000
cmp edi, eax
ja 0x403fa3
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x403fd1
test ecx, ecx
je 0x403fd9
test edi, edi
jbe 0x403fd9
jmp 0x403f98
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x403fdb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x403fe2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
and dword [esi], 0
test edi, edi
je 0x40403b
mov eax, 0x400000
cmp edi, eax
ja 0x404005
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x404033
test ecx, ecx
je 0x40403b
test edi, edi
jbe 0x40403b
jmp 0x403ffa
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40403d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x405155
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], edx
push edi
mov edx, ecx
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov edi, dword [ecx]
and edi, 7
cmp dword [ebp - 4], 5
jb 0x40529a
sub dword [ebp - 4], 4
add dword [ebp + 8], 5
push ebx
push esi
mov ecx, dword [ebp - 4]
lea esi, [eax + edx]
lea ebx, [edx + ecx]
cmp esi, ebx
jae 0x40519c
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x40519c
inc esi
jmp 0x40518b
mov ecx, esi
sub ecx, eax
mov eax, esi
sub ecx, edx
sub eax, edx
cmp esi, ebx
jae 0x405286
cmp ecx, 2
jbe 0x4051b7
xor edi, edi
jmp 0x4051e1
shr edi, cl
test edi, edi
je 0x4051e1
cmp edi, 4
ja 0x40527b
cmp edi, 3
je 0x40527b
mov ecx, edi
shr ecx, 1
mov cl, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
je 0x40527b
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x40527b
movzx ebx, byte [esi + 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 2]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 1]
shl ecx, 8
or ecx, ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, eax
add eax, 5
cmp dword [ebp + 0x10], 0
mov dword [ebp - 8], ecx
je 0x405223
add ebx, ecx
jmp 0x405225
sub ebx, ecx
test edi, edi
je 0x405258
and edi, 6
mov edx, ebx
shl edi, 2
mov ecx, edi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x405253
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [ebp + 0x10], 0
je 0x405250
add ebx, dword [ebp - 8]
jmp 0x405253
sub ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor edi, edi
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [esi + 3], cl
mov byte [esi + 4], bl
jmp 0x405182
or edi, 8
shr edi, 1
inc eax
jmp 0x405182
push 2
pop edx
pop esi
shr edi, cl
cmp edx, ecx
mov edx, dword [ebp + 0xc]
sbb ecx, ecx
pop ebx
not ecx
and ecx, edi
mov dword [edx], ecx
pop edi
leave
ret 0xc
Function at 0x10def230
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10def23a
pushal
call 0x10def240
pop ebp
sub ebp, 0x10
sub ebp, 0xdef230
jmp 0x10def256
mov eax, 0xdef230
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e6
mov edx, 0xcfdf20be
xor byte [eax], dl
inc eax
dec ecx
jne 0x10def26d
jmp 0x10def280
xor eax, 0x82373573
mov esi, 0x7f3fbebe
inc esi
mov esi, 0x73bdbebe
push es
mov ecx, 0x4bebebe
xchg esi, eax
mov esi, 0x5c49bebe
mov ebp, 0xb23f3576
mov esi, 0x7bbdbebe
out dx, al
out dx, al
salc
or dl, byte [ecx]
mov al, 0xbe
salc
ret 0x6efc
Function at 0x4b2cc0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov ebx, dword [ecx + 0x1c]
test ebx, ebx
je 0x4b2ce8
call fcn.004a3a10
mov ecx, ebx
mov ebx, dword [ebp - 4]
mov dword [ebp + 8], eax
leave
jmp fcn.004a6320
mov ebx, dword [ebp - 4]
leave
ret 4