joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c100
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437af8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4450e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00402300
push dword [ebp - 0x10]
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or ebx, 0xffffffff
test eax, eax
jne 0x40c2ae
xor edi, edi
mov eax, dword [ebp - 0x10]
test edi, edi
js 0x40c2b1
cmp edi, dword [eax - 0xc]
jge 0x40c2b1
lea eax, [eax + edi*2]
push 0x5c
push eax
call fcn.00416cc9
mov edi, eax
add esp, 8
test edi, edi
je 0x40c2ae
mov eax, dword [ebp - 0x10]
sub edi, eax
sar edi, 1
cmp edi, 0xffffffff
je 0x40c2b1
call fcn.00402f7e
mov ecx, eax
test ecx, ecx
je 0x40c2df
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x10]
add edi, 1
mov ebx, 0
mov byte [ebp - 4], 1
cmovns ebx, edi
cmp ebx, dword [eax - 0xc]
jl 0x40c1d1
add eax, 0xfffffff0
push eax
call fcn.0040329a
add esp, 4
add eax, 0x10
mov dword [ebp - 0x18], eax
jmp 0x40c1fd
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x40c1e1
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x40c1ed
call fcn.00402f7e
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
push ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
call fcn.00401f4b
mov eax, dword [ebp - 0x18]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 2
lea ebx, [eax - 0x10]
mov dword [ebp - 0x1c], edx
cmp ebx, edx
je 0x40c25a
cmp dword [edx + 0xc], 0
lea esi, [edx + 0xc]
jl 0x40c24b
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x40c24b
push ebx
call fcn.0040329a
add esp, 4
mov dword [ebp - 0x20], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x40c243
mov esi, dword [ebp - 0x1c]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
jmp 0x40c25a
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
push eax
call fcn.00402ac0
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x40c273
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c287
push esi
call fcn.004228c7
add esp, 4
or ebx, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40c150
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40c150
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40c2cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004031f8
int3
Function at 0x40cbe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437c68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4450e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00402f7e
mov ecx, eax
test ecx, ecx
je 0x40cd2a
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x200
or eax, ecx
mov dword [ebp - 4], 0
jge 0x40cc4a
push 0x200
lea ecx, [ebp - 0x10]
call fcn.004030e7
mov esi, dword [ebp - 0x10]
push 0
push 0x1a
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push dword [esi - 8]
push esi
call fcn.004195ec
add esp, 8
test eax, eax
js 0x40cd20
cmp eax, dword [esi - 8]
jg 0x40cd20
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov ecx, dword [esi - 0xc]
test ecx, ecx
jne 0x40ccc5
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x440fac
call fcn.00402300
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40ccb2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ecx - 1]
test eax, eax
js 0x40cd20
cmp eax, ecx
jg 0x40cd20
cmp word [esi + eax*2], 0x5c
je 0x40cce6
push 1
push 0x4410cc
lea ecx, [ebp - 0x10]
call fcn.00402c46
push 0x10
push str.HaoKanWallPaper_
lea ecx, [ebp - 0x10]
call fcn.00402c46
cmp dword [ebp + 0xc], 0
mov esi, dword [ebp - 0x10]
je 0x40cd07
push esi
call fcn.0040c100
add esp, 4
add esi, 0xfffffff0
push esi
call fcn.0040329a
mov edi, dword [ebp + 8]
add esp, 4
add eax, 0x10
mov dword [edi], eax
jmp 0x40cc96
push 0x80070057
call fcn.004031f8
push 0x80004005
call fcn.004031f8
int3
Function at 0x40d420
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4374e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4450e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00402f7e
mov ecx, eax
test ecx, ecx
je 0x40d56d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0040c480
add esp, 8
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
push dword [eax - 0xc]
push eax
call fcn.00402c46
mov edx, dword [ebp - 0x14]
or ebx, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d4aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push str.ApTest
lea ecx, [ebp - 0x10]
call fcn.00402c46
push 1
push 0x440f70
lea ecx, [ebp - 0x10]
call fcn.00402c46
push 1
push 0x440f70
lea ecx, [ebp - 0x10]
call fcn.00402c46
push 1
push 0x440f74
lea ecx, [ebp - 0x10]
call fcn.00402c46
push 1
push 0x440f78
lea ecx, [ebp - 0x10]
call fcn.00402c46
push 1
push 0x440f7c
lea ecx, [ebp - 0x10]
call fcn.00402c46
push 1
push 0x440f80
lea ecx, [ebp - 0x10]
call fcn.00402c46
push 2
push 0x440f84
lea ecx, [ebp - 0x10]
call fcn.00402c46
push 2
push 0x440f8c
lea ecx, [ebp - 0x10]
call fcn.00402c46
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40d559
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004031f8
int3
Function at 0x40ecf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
test edx, edx
jne 0x40ed0e
mov ecx, 0xd
xor eax, eax
test ecx, ecx
pop esi
sete al
pop ebp
ret 4
mov eax, edx
push edi
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ed14
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push 0x438a98
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, eax
xor eax, eax
test ecx, ecx
pop edi
sete al
pop esi
pop ebp
ret 4
Function at 0x410af0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4450e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x410bea
movzx eax, word [ebx]
test ax, ax
je 0x410bea
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x410b32
cmp dx, 0x5c
jne 0x410b34
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x410b26
cmp edi, ebx
je 0x410b83
sub edi, ebx
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push ebx
push eax
call fcn.0042489e
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x410bfa
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.00410af0
add esp, 8
lea ecx, [ebp - 0x414]
sub ecx, esi
nop dword [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x410b90
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x410ba2
lea edi, [ebp - 0x414]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x410bc0
mov ecx, ebx
lea eax, [ebp - 0x414]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00415247
mov esp, ebp
pop ebp
ret
call fcn.004158d8
int3
Function at 0x411260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x20
call fcn.00415bfd
mov ebx, eax
push 0x340
mov dword [ebx], 1
call fcn.00415bfd
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x4112a5
mov dword [eax], 0
mov dword [eax + 4], 0xffffffff
mov dword [eax + 0x134], 0xffffffff
jmp 0x4112a7
xor eax, eax
lea esi, [ebx + 8]
mov dword [ebx + 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [ebx + 4]
push esi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi], 0
jne 0x411344
cmp dword [edi + 4], 0xffffffff
jne 0x411344
add edi, 0x138
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4112e1
mov eax, dword [0x4410cc]
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
cmp eax, 1
jne 0x411315
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x411312
mov eax, 0x2000000
jmp 0x411349
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
push edi
call fcn.00413d60
add esp, 0x10
test eax, eax
jne 0x41132f
mov eax, dword [ebp - 4]
jmp 0x411349
push eax
call fcn.004143c0
mov ecx, dword [ebp - 8]
add esp, 4
mov dword [ecx], eax
mov eax, dword [0x446f9c]
jmp 0x411349
mov eax, 0x1000000
push esi
mov dword [0x446f98], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x446f98], 0
je 0x411444
cmp dword [ebx], 1
je 0x41137a
pop edi
pop esi
mov dword [0x446f98], 0x80000
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + 4]
test esi, esi
je 0x411426
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 4], 0xffffffff
je 0x41139f
push dword [esi]
call fcn.00414150
add esp, 4
mov edi, dword [esi]
mov dword [esi + 4], 0xffffffff
mov dword [ebp - 8], edi
test edi, edi
je 0x4113fe
cmp dword [edi + 0x7c], 0
je 0x4113be
push edi
call fcn.00414150
add esp, 4
mov edi, dword [edi]
test edi, edi
je 0x4113f3
cmp byte [edi], 0
je 0x4113d2
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 4], 2
jne 0x4113e8
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4113e8
push eax
call fcn.004197a3
add esp, 4
push 0x24
push edi
call fcn.004157a9
add esp, 8
push dword [ebp - 8]
call fcn.004197a3
add esp, 4
lea eax, [ebx + 8]
mov dword [esi], 0
push eax
mov dword [0x446f98], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x340
push esi
call fcn.004157a9
add esp, 8
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x20
push ebx
call fcn.004157a9
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413d60
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x10
cmp eax, 1
je 0x413d87
cmp eax, 2
je 0x413d87
cmp eax, 3
je 0x413d87
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x10000
xor eax, eax
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [edi], 0
cmp eax, 1
jne 0x413e57
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push 2
push 0
push 0
push eax
call esi
mov ebx, dword [ebp + 8]
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x413dd8
mov dword [edi], 0x100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
sete byte [ebp - 1]
cmp dword [ebp - 8], 0
je 0x413f20
push 0x24
call fcn.00415bfd
mov esi, eax
add esp, 4
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
cmp dword [ebp - 8], 0
je 0x413f37
mov cl, byte [ebp - 1]
mov byte [esi], 1
mov byte [esi + 8], cl
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], 0
mov dword [esi + 0x14], 0
test cl, cl
je 0x413f5c
push 1
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x14], eax
mov eax, esi
mov dword [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x413f17
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x413e92
mov dword [edi], 0x200
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
push dword [ebp - 8]
cmp eax, 1
sete byte [ebp - 1]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0xc], esi
test esi, esi
je 0x413f05
push esi
call fcn.004197a8
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x413f05
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x413ee7
mov dword [edi], 0x800
mov eax, 0x800
jmp 0x413ee9
mov eax, dword [edi]
cmp dword [ebp - 0x10], esi
je 0x413ef6
mov dword [edi], 0x800
jmp 0x413efa
test eax, eax
je 0x413f05
push ebx
call fcn.004197a3
add esp, 4
xor ebx, ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0
jmp 0x413f20
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x413df8
mov dword [edi], 0x300
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov byte [esi], 0
mov byte [esi + 8], 1
mov dword [esi + 0xc], 0
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x14], 0
mov dword [edi], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413f70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, esi
imul ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x413fae
push 0
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x413fa2
mov byte [edi + 0x10], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x20]
mov esi, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x1c]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp + 8]
call fcn.00416e00
add dword [edi + 0x20], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x414060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x41406e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x41412d
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a720]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a720]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a720]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a720]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a720]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a720]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a720]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a720]
sub edi, 1
jne 0x414086
pop edi
test esi, esi
je 0x41414b
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a720]
sub esi, 1
jne 0x414131
not eax
pop esi
pop ebp
ret
Function at 0x414dc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
cmp byte [esi], 0
je 0x414df4
push 0
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xb]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414def
mov byte [esi + 0x10], 1
mov edi, dword [ebp - 4]
jmp 0x414e20
mov ecx, dword [esi + 0x1c]
push ebx
mov ebx, dword [esi + 0x20]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x414e06
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x18]
add eax, ebx
push edi
push eax
lea eax, [ebp + 0xb]
push eax
call fcn.00416e00
add esp, 0xc
lea eax, [ebx + edi]
mov dword [esi + 0x20], eax
pop ebx
cmp edi, 1
jne 0x414e36
mov eax, dword [ebp + 0xc]
movzx ecx, byte [ebp + 0xb]
mov dword [eax], ecx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x414e2e
cmp byte [esi + 0x10], 0
je 0x414e2e
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42ba61
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042b721

Function at 0x434aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x447be0], 0
push esi
mov esi, dword [ebp + 8]
jne 0x434bab
push 0x447be4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x434b99
test esi, esi
jne 0x434b8e
push ebx
push edi
push str.advapi32.dll
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x434b6e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptAcquireContextA
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x434b6e
push str.CryptGenRandom
push esi
call edi
mov dword [ebp - 8], eax
test eax, eax
je 0x434b6e
push str.CryptReleaseContext
push esi
call edi
mov edi, eax
test edi, edi
je 0x434b6e
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp + 8]
push eax
call ebx
test eax, eax
je 0x434b6e
lea eax, [ebp - 4]
push eax
push 4
push dword [ebp + 8]
call dword [ebp - 8]
push 0
push dword [ebp + 8]
mov esi, eax
call edi
test esi, esi
je 0x434b6e
mov eax, dword [ebp - 4]
movzx esi, al
shl esi, 8
movzx eax, ah
or esi, eax
movzx eax, byte [ebp - 2]
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 1]
shl esi, 8
or esi, eax
jmp 0x434b82
push 0
call fcn.0041caed
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
test esi, esi
mov eax, 1
pop edi
cmove esi, eax
pop ebx
mov dword [0x447be0], esi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_SwitchToThread]
nop
call esi
cmp dword [0x447be0], 0
je 0x434ba0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x434bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add ecx, 0xdeadbeef
push ebx
mov ebx, dword [ebp + 8]
add ecx, edx
push esi
mov esi, ecx
mov dword [ebp + 0x10], esi
push edi
mov edi, ecx
cmp edx, 0xc
jbe switch.0x00434cbc
add edx, 0xfffffff3
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 4], eax
nop dword [eax + eax]
movzx esi, byte [ebx + 7]
movzx eax, byte [ebx + 6]
movzx edx, byte [ebx + 0xb]
shl esi, 8
add esi, eax
shl edx, 8
movzx eax, byte [ebx + 5]
shl esi, 8
add esi, eax
movzx eax, byte [ebx + 4]
add edi, eax
shl esi, 8
movzx eax, byte [ebx + 0xa]
add edi, esi
movzx esi, byte [ebx + 8]
add edx, eax
movzx eax, byte [ebx + 9]
add esi, ecx
shl edx, 8
add edx, eax
shl edx, 8
add esi, edx
mov edx, dword [ebp + 8]
mov ebx, esi
rol ebx, 4
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx]
shl ecx, 8
add ecx, eax
sub ecx, esi
add esi, edi
add ecx, dword [ebp + 0x10]
xor ebx, ecx
sub edi, ebx
mov eax, ebx
add ebx, esi
rol eax, 6
xor eax, edi
sub esi, eax
mov edx, eax
rol edx, 8
add eax, ebx
xor edx, esi
sub ebx, edx
mov esi, edx
rol esi, 0x10
add edx, eax
xor esi, ebx
mov ebx, dword [ebp + 8]
mov edi, esi
sub eax, esi
ror edi, 0xd
add esi, edx
xor edi, eax
mov dword [ebp + 0x10], esi
sub edx, edi
mov ecx, edi
rol ecx, 4
add ebx, 0xc
xor ecx, edx
mov dword [ebp + 8], ebx
mov edx, dword [ebp + 0xc]
add edi, esi
sub edx, 0xc
sub dword [ebp - 4], 1
mov dword [ebp + 0xc], edx
jne 0x434bf0
cmp edx, 0xc
ja 0x434d28
jmp dword [edx*4 + 0x434d78]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add ecx, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add ecx, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add ecx, eax
movzx eax, byte [ebx + 8]
add ecx, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add esi, eax
movzx eax, byte [ebx]
add esi, eax
mov dword [ebp + 0x10], esi
xor ecx, edi
mov eax, edi
rol eax, 0xe
sub ecx, eax
mov eax, ecx
mov esi, ecx
xor esi, dword [ebp + 0x10]
rol eax, 0xb
sub esi, eax
xor edi, esi
mov eax, esi
ror eax, 7
sub edi, eax
mov eax, edi
xor ecx, edi
rol eax, 0x10
sub ecx, eax
mov eax, ecx
mov edx, ecx
rol eax, 4
xor edx, esi
sub edx, eax
mov eax, edx
xor edi, edx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor ecx, edi
ror eax, 8
sub ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret