joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd7f0
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x4fa8e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x528c24]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x20]
lea ebx, [eax + 0x16]
push 0
push ebx
lea ecx, [esp + 0x1c]
call fcn.004d3530
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0x3c]
mov edi, dword [esp + 0x18]
movzx ebp, word [eax + 0x24]
shr ecx, 4
mov dword [esp + 0x28], 0
test cl, 1
je 0x4dd87f
mov ecx, eax
mov edx, dword [ecx + 0x3c]
and edx, 0x70
cmp dl, 0x70
jne 0x4dd86b
push 1
call fcn.004e19a0
mov eax, dword [esi + 0x24]
xor ecx, ecx
mov word [eax + 4], cx
jmp 0x4dd87f
push ebx
call fcn.004e19a0
mov edx, dword [esi + 0x14]
movzx eax, word [edx + 0x24]
mov ecx, dword [esi + 0x24]
mov word [ecx + 4], ax
mov eax, dword [esi + 0x24]
cmp word [eax + 4], bp
je 0x4dd89c
mov edx, dword [esi + 0x14]
mov ecx, dword [edx + 0x3c]
and ecx, 0x70
cmp cl, 0x70
je 0x4dd89c
xor edx, edx
mov word [eax + 8], dx
mov eax, dword [esi + 0x24]
mov ecx, dword [0x52a338]
mov eax, dword [eax + 0x20]
mov dword [edi], ecx
mov edx, dword [esi + 0x24]
movzx ecx, word [edx + 4]
mov word [edi + 4], cx
mov ecx, dword [esi + 0x24]
movzx ecx, word [ecx + 6]
mov word [edi + 6], cx
mov edx, dword [esi + 0x24]
movzx ecx, word [edx + 8]
mov word [edi + 8], cx
mov ecx, dword [esi + 0x24]
movzx ecx, word [ecx + 0xa]
mov word [edi + 0xa], cx
mov edx, dword [esi + 0x24]
mov ecx, dword [edx + 0xc]
mov dword [edi + 0xc], ecx
mov ecx, dword [esi + 0x24]
mov ecx, dword [ecx + 0x10]
mov dword [edi + 0x10], ecx
mov word [edi + 0x14], ax
mov edx, dword [esi + 0x24]
mov ecx, dword [edx + 0x1c]
movzx eax, ax
push eax
push ecx
add edi, 0x16
push edi
call fcn.0048fa10
add esp, 0xc
cmp ebx, 0xffffffff
jbe 0x4dd914
push 0
push 0xd7
call fcn.004c1d80
mov ecx, dword [esp + 0x18]
push 1
push ebx
push ecx
mov ecx, dword [esi + 0x14]
call fcn.004e19f0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.004d3560
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4e0840
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4fad08
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x528c24]
xor eax, esp
mov dword [esp + 0xb4], eax
push ebx
push esi
push edi
mov eax, dword [0x528c24]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov edi, dword [esp + 0xd8]
mov esi, dword [esp + 0xdc]
xor eax, eax
mov dword [esp + 0x10], eax
xor edx, edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], eax
mov word [esp + 0x1c], dx
mov ebx, 1
mov dword [esp + 0xd0], ebx
test byte [esp + 0xe4], bl
je 0x4e08cc
push 0xffffffffffffffff
add ecx, 4
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.0041b190
jmp 0x4e0900
mov ax, word [esp + 0xe0]
cmp ax, 0x64
jae 0x4e08ea
movzx eax, ax
push eax
push str.z_.2u
lea ecx, [esp + 0x20]
push ecx
jmp 0x4e08f8
movzx edx, ax
push edx
push 0x50eaec
lea eax, [esp + 0x20]
push eax
call fcn.004cba70
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x4e090b
mov esi, dword [esi + 4]
jmp 0x4e090e
add esi, 4
push esi
lea ecx, [esp + 0x38]
call fcn.004c1080
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
mov byte [esp + 0xd0], 2
jae 0x4e092f
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x38]
call fcn.004cad10
push edi
lea ecx, [esp + 0x38]
call fcn.004cadd0
lea ecx, [esp + 0x34]
mov dword [esp + 0x10], ebx
mov byte [esp + 0xd0], bl
call fcn.004d3650
cmp dword [esp + 0x30], 8
jb 0x4e096b
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0048d108
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.0048d9be
add esp, 0xc4
ret 0x10
Function at 0x4e2aa0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x4e2ab3
pop esi
xor eax, eax
pop ebx
ret 8
push edi
call fcn.0049853a
mov dword [eax], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 4]
push esi
push eax
push ecx
call fcn.004adf2e
mov edi, eax
add esp, 0xc
cmp edi, esi
jge 0x4e2ae8
call fcn.0049853a
cmp dword [eax], 0
je 0x4e2ae8
mov ecx, ebx
call fcn.004e27a0
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
Function at 0x4e4f70
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 4]
call fcn.004e7360
movsx ecx, byte [esp + 0x10]
xor ecx, edi
and ecx, 0xff
mov eax, dword [eax + ecx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0xc]
movzx ebx, al
add ebx, dword [esi + 8]
mov dword [esi + 4], eax
imul ebx, ebx, 0x8088405
inc ebx
mov dword [esi + 8], ebx
shr ebx, 0x18
call fcn.004e7360
movsx edx, bl
xor edx, edi
shr edi, 8
and edx, 0xff
xor edi, dword [eax + edx*4]
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4e4fd0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
push ebp
push edi
mov edi, ecx
xor ebp, ebp
mov dword [edi + 4], 0x12345678
mov dword [edi + 8], 0x23456789
mov dword [edi + 0xc], 0x34567890
cmp dword [eax + 8], ebp
jbe 0x4e5059
push ebx
push esi
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
mov bl, byte [edx + ebp]
mov esi, dword [edi + 4]
call fcn.004e7360
movsx ecx, bl
xor ecx, esi
and ecx, 0xff
mov eax, dword [eax + ecx*4]
shr esi, 8
xor eax, esi
mov esi, dword [edi + 0xc]
movzx ebx, al
add ebx, dword [edi + 8]
mov dword [edi + 4], eax
imul ebx, ebx, 0x8088405
inc ebx
mov dword [edi + 8], ebx
shr ebx, 0x18
call fcn.004e7360
movsx edx, bl
xor edx, esi
and edx, 0xff
shr esi, 8
xor esi, dword [eax + edx*4]
mov eax, dword [esp + 0x14]
inc ebp
mov dword [edi + 0xc], esi
cmp ebp, dword [eax + 8]
jb 0x4e4ff6
pop esi
pop ebx
pop edi
pop ebp
ret 4

Function at 0x4e5060
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push 0xffffffffffffffff
push 0x4fb388
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x528c24]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
push eax
call fcn.004e4fd0
xor ebp, ebp
push ebp
push 0xc
lea ecx, [esp + 0x1c]
call fcn.004d3530
mov ecx, dword [esp + 0x18]
push ebp
push 0xc
push ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x34], ebp
call fcn.004e1ee0
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0x18]
mov edi, dword [esi + 4]
and eax, 0xfffd
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
sar ebx, 8
xor bl, byte [edx + ebp]
call fcn.004e7360
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov eax, dword [eax + ecx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0xc]
mov dword [esi + 4], eax
movzx eax, al
add eax, dword [esi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 8], eax
shr eax, 0x18
mov byte [esp + 0x30], al
call fcn.004e7360
movsx edx, byte [esp + 0x30]
xor edx, edi
and edx, 0xff
shr edi, 8
xor edi, dword [eax + edx*4]
inc ebp
cmp ebp, 0xc
mov dword [esi + 0xc], edi
jl 0x4e50b6
mov eax, dword [esp + 0x34]
mov cl, byte [eax + 8]
shr cl, 3
test cl, 1
je 0x4e5140
cmp byte [eax + 0xd], bl
jmp 0x4e5143
cmp byte [eax + 0x13], bl
lea ecx, [esp + 0x14]
sete bl
mov dword [esp + 0x28], 0xffffffff
call fcn.004d3560
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x4e9ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
mov dword [esp + 0xc], edi
cmp eax, edx
jb 0x4e9f70
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call fcn.0048fa10
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x4e9f3f
sub eax, ebp
jmp 0x4e9f41
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x4e9f30
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x4e9f60
sub eax, ebp
jmp 0x4e9f62
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x4e9f51
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x4ea08a
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [esp + 0xc]
mov ebx, ecx
mov dword [esp + 0x10], eax
cmp ebx, edx
jbe 0x4e9f98
mov ebx, edx
test ebx, ebx
je 0x4e9fd3
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
cmp dword [edx + 0x18], 1
jne 0x4e9fc1
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.004ec040
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov edx, dword [edi]
push ebx
push edx
push eax
call fcn.0048fa10
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x4e9ffe
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
movzx edx, byte [edx + 1]
shl eax, cl
xor eax, edx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x4ea012
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4e9ef0
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x4ea08a
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x4ea059
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x4ea039
mov ebx, 0x102
mov ecx, dword [esi + 0x38]
push ebx
add ecx, edi
push 0
push ecx
call fcn.0048d9d0
add esp, 0xc
add ebx, edi
pop edi
pop ebp
mov dword [esi + 0x16c0], ebx
pop ebx
add esp, 8
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x4ea08a
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x4ea073
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call fcn.0048d9d0
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x402e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x402e0f
pop dword [ebp - 0x4c]
mov eax, 0x7d6db695
sub eax, 0x7d2d8886
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xe596a0e4
add dword [ebp - 0x5c], 0x68bba467
mov dword [ebp - 0x58], 0x413df2e3
add dword [ebp - 0x58], 0xf0f55962
mov dword [ebp - 0x54], 0xd62db7d0
sub dword [ebp - 0x54], 0x89e173a2
mov dword [ebp - 0x50], 0x159d88c
sub dword [ebp - 0x50], 0x159d88c
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xef44ba6a
sub eax, 0xef0379da
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x60a1547a
sub dword [ebp - 0x5c], 0xec2eeb24
mov dword [ebp - 0x58], 0x18ab4f0a
add dword [ebp - 0x58], 0x28c1126b
mov dword [ebp - 0x54], 0x66cff49e
add dword [ebp - 0x54], 0xfc9f77ce
mov dword [ebp - 0x50], 0xbd89080e
add dword [ebp - 0x50], 0x4276f7f2
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x68721c0
add eax, 0xf9ba1e7c
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x379f9
push 0
call eax
mov ecx, 0xf127d9ae
sub ecx, 0xf1279e57
mov edi, eax
mov ebx, 0x41c000
add ebx, dword [ebp - 0x4c]
mov edx, 0x789d79d9
sub edx, 0x63d07496
add dword [ebp - 0x18], eax
mov esi, dword [ebx]
mov dword [ebp - 0x44], 0xed52004a
xor esi, edx
sub dword [ebp - 0x34], edx
mov dword [edi], esi
add edi, 0x9f638feb
sub edi, 0x9f638fe7
add ebx, 4
loop 0x402f2b
add eax, 0x81ebf25b
add eax, 0x7e14edd4
xor ebx, ebx
add ebx, eax
add eax, 0xa034fcc1
sub eax, 0xa034fcbc
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4068fb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40691f
xor eax, eax
test eax, eax
je 0x406932
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406932
xor ecx, ecx
jmp 0x406935
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a58
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43110c], 0
push esi
jne 0x406a8f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a69
mov dword [ecx*4 + 0x431108], eax
inc ecx
cmp ecx, 0x100
jl 0x406a64
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406ac0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431108]
xor eax, esi
inc ecx
dec edx
jne 0x406aa2
pop edi
not eax
pop esi
ret 0xc

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442030]
jne 0x401073
repz ret
jmp fcn.00401e41

Function at 0x408aeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d3a
and dword [ebp - 4], 0
cmp dword [0x444b68], 0
mov ebx, eax
jne 0x408b9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c4d
push eax
call fcn.00404cc8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x444b68], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x444b6c], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x444b70], eax
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x444b78], eax
test eax, eax
je 0x408b9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x444b74], eax
mov eax, dword [0x444b74]
cmp eax, ebx
je 0x408bf4
cmp dword [0x444b78], ebx
je 0x408bf4
push eax
call fcn.00404d43
push dword [0x444b78]
mov esi, eax
call fcn.00404d43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bf4
test edi, edi
je 0x408bf4
call esi
test eax, eax
je 0x408beb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408beb
test byte [ebp - 0xc], 1
jne 0x408bf4
or dword [ebp + 0x10], 0x200000
jmp 0x408c2d
mov eax, dword [0x444b6c]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c2d
mov eax, dword [0x444b70]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x444b68]
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af50
Capabilities:
Set console window title

Disassembly:
sub esp, 0x828
mov eax, dword [0x442030]
xor eax, esp
mov dword [esp + 0x820], eax
mov eax, dword [0x2c2255c]
push ebx
mov ebx, dword [0x2c22280]
push esi
mov esi, dword [0x442f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40af91
push 0x440820
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2c2255c]
mov dword [0x444d0c], esi
cmp eax, 0x114e
jne 0x40afb6
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x2c2255c]
cmp eax, 0x2f
jne 0x40afd6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
call fcn.0040ae50
mov ecx, dword [esp + 0x82c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401069
add esp, 0x828
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x401c66
pop dword [ebp - 0x50]
mov eax, 0x462aa3b0
sub eax, 0x45ea874a
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd4f5e249
add dword [ebp - 0x60], 0x795c6302
mov dword [ebp - 0x5c], 0xa4d9ab2a
sub dword [ebp - 0x5c], 0x72a65ee5
mov dword [ebp - 0x58], 0x10a1e21f
sub dword [ebp - 0x58], 0xc4559df1
mov dword [ebp - 0x54], 0xdf10e96a
sub dword [ebp - 0x54], 0xdf10e96a
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xdb21000e
add dword [ebp - 0x60], 0x99516948
mov dword [ebp - 0x5c], 0x7fff86a7
sub dword [ebp - 0x5c], 0x3e932532
mov dword [ebp - 0x58], 0x5aa23a02
add dword [ebp - 0x58], 0x8cd326a
mov dword [ebp - 0x54], 0xe6f7ec91
add dword [ebp - 0x54], 0x1908136f
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x559f713a
sub eax, 0x555f410e
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x35ea6
push 0
call eax
mov ecx, 0x39f977f9
sub ecx, 0x39f9323c
xor esi, esi
add esi, eax
mov edx, 0x407000
add edx, dword [ebp - 0x50]
mov ebx, 0xcac3f368
sub dword [ebp - 0x30], 0xcd35c918
mov edi, dword [edx]
xor dword [ebp - 0x14], ebx
sub edi, ebx
xor dword [ebp - 0x18], 0x944f85b3
mov dword [esi], edi
xor dword [ebp - 8], edi
add esi, 0x8e51af30
add esi, 0x71ae50d4
add edx, 4
loop 0x401d79
add eax, 0x2d7c5d04
sub eax, 0x2d7b533d
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401ad0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408048
call sym._EnterCriticalSection_4
mov ebx, dword [0x408040]
sub esp, 4
test ebx, ebx
je 0x401b1b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401b14
test esi, esi
je 0x401b14
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401af0
mov dword [esp], 0x408048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d00
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401d50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401e24
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x401d8e
cmp eax, 4
jne 0x401db0
test esi, esi
je 0x401da2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x401d94
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x401def
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x401de1
cmp ecx, 0x40
je 0x401da2
cmp ecx, 4
je 0x401da2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d00
lea esi, [esi]

Function at 0x404360
Capabilities:
Resume thread
Suspend thread

Disassembly:
push esi
mov esi, eax
push ebx
sub esp, 0x2e4
mov dword [esp], eax
call sym._SuspendThread_4
sub esp, 4
mov ebx, eax
cmp eax, 0xffffffff
je 0x4043ab
lea eax, [esp + 0x14]
mov dword [esp], esi
mov ebx, 0xffffffff
mov dword [esp + 4], eax
mov dword [esp + 0x14], 0x10003
call sym._GetThreadContext_8
sub esp, 8
test eax, eax
jne 0x4043c0
mov dword [esp], esi
call sym._ResumeThread_4
sub esp, 4
add esp, 0x2e4
mov eax, ebx
pop ebx
pop esi
ret
mov ebx, dword [esp + 0xcc]
jmp 0x4043a0