joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404cf1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
push esi
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 8], ecx
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x404d9b
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add esi, 0x10
mov ebx, 0x1000
cmp dword [esi], 0
jne 0x404d5c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
test eax, eax
mov dword [ebp - 0xc], eax
jle 0x404d85
push 4
push ebx
push eax
mov eax, dword [esi - 4]
add eax, dword [ebp - 8]
push eax
call edi
push dword [ebp - 0xc]
mov dword [esi - 8], eax
push 0
push eax
call fcn.0040cba0
add esp, 0xc
jmp 0x404d85
mov eax, dword [esi - 4]
push 4
add eax, dword [ebp - 8]
push ebx
push dword [esi]
push eax
call edi
mov ecx, dword [esi + 4]
push dword [esi]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push ecx
push eax
call fcn.0040cff0
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi - 8], eax
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
add esi, 0x28
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 4], eax
jl 0x404d2a
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4050d3
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x428030
push 8
mov eax, edx
pop esi
test al, 1
je 0x4050ed
shr eax, 1
xor eax, 0xedb88320
jmp 0x4050ef
shr eax, 1
dec esi
jne 0x4050e0
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x428430
jl 0x4050db
mov dword [0x428430], 1
pop esi
ret

Function at 0x40510c
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x428430], 0
push esi
mov esi, dword [esp + 8]
jne 0x40511f
call fcn.004050d3
xor eax, eax
cmp dword [esp + 0x10], eax
jle 0x40514c
mov ecx, dword [esp + 0xc]
mov edx, esi
and edx, 0xff
movzx ecx, byte [eax + ecx]
xor ecx, edx
shr esi, 8
mov ecx, dword [ecx*4 + 0x428030]
xor esi, ecx
inc eax
cmp eax, dword [esp + 0x10]
jl 0x405127
mov eax, esi
pop esi
ret

Function at 0x405165
Capabilities:
Delete file

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
je 0x4051b1
push 0x422b30
push ebp
call fcn.0040dc24
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x4051b1
push 2
push ebx
push esi
call fcn.0040e2ab
push esi
call fcn.0040e128
push esi
mov edi, eax
call fcn.0040da3d
push 0x4220c0
push ebp
call fcn.0040dc24
mov esi, eax
add esp, 0x1c
cmp esi, ebx
jne 0x4051b5
xor al, al
jmp 0x405202
push ebx
push ebx
push esi
call fcn.0040e2ab
add esp, 0xc
cmp edi, ebx
jle 0x4051f2
mov ebx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ
push ebx
call fcn.0040d330
cmp edi, eax
pop ecx
jae 0x4051d8
mov eax, edi
jmp 0x4051df
push ebx
call fcn.0040d330
pop ecx
push esi
push eax
push 1
push ebx
call fcn.0040daba
sub edi, eax
add esp, 0x10
test edi, edi
jg 0x4051c9
push esi
call fcn.0040da3d
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x405234
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
mov edx, 0x81
push edi
xor ebx, ebx
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], bx
mov word [ebp - 0x410], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x618], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x616]
push 0x25
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
push edi
call fcn.0040d437
pop ecx
test eax, eax
pop ecx
jne 0x4052ae
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
call fcn.0040cb55
add esp, 0xc
push 1
pop eax
jmp 0x40535a
xor esi, esi
mov eax, edi
push 0x25
push eax
call fcn.0040d437
pop ecx
cmp eax, ebx
pop ecx
je 0x4052c6
add eax, 2
inc esi
jmp 0x4052b2
mov eax, esi
push 2
cdq
pop ecx
idiv ecx
cmp edx, 1
je 0x40531e
mov esi, 0x104
lea eax, [ebp - 0x208]
push esi
push edi
push eax
call fcn.0040cb55
lea eax, [ebp - 0x208]
push 0x25
push eax
call fcn.0040d437
lea edi, [eax + 2]
push 0x25
push edi
mov word [eax], bx
call fcn.0040d437
add esp, 0x1c
mov ebx, eax
lea eax, [ebp - 0x410]
and word [ebx], 0
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x405322
xor eax, eax
jmp 0x40535a
add ebx, 2
lea eax, [ebp - 0x410]
push ebx
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x618]
push str._s_s_s
push eax
call fcn.0040d3c8
push dword [ebp + 0x10]
lea eax, [ebp - 0x618]
push dword [ebp + 0xc]
push eax
call fcn.00405234
add esp, 0x20
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40535f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and word [ebp - 0x208], 0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.00405234
add esp, 0xc
test eax, eax
je 0x40544f
push 0x5c
push dword [ebp + 8]
call fcn.0040d437
pop ecx
test eax, eax
pop ecx
je 0x405453
lea eax, [ebp - 0x208]
push 0x5c
push eax
call fcn.0040d460
cmp byte [ebp + 0xc], 1
pop ecx
pop ecx
mov ebx, eax
jne 0x4053d3
and word [ebx], 0
lea eax, [ebp - 0x208]
push eax
call fcn.00405207
test al, al
pop ecx
jne 0x405453
mov word [ebx], 0x5c
lea edi, [ebp - 0x208]
test edi, edi
je 0x405453
push 0x5c
push edi
call fcn.0040d437
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x40543f
cmp byte [ebp + 0xc], al
jne 0x405453
xor edi, edi
lea eax, [ebp - 0x208]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40542a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40544f
test esi, esi
je 0x405433
mov word [esi], 0x5c
cmp byte [ebp + 0xc], 1
jne 0x4053ef
cmp esi, ebx
je 0x405453
jmp 0x4053ef
cmp word [esi - 2], 0x3a
lea edi, [esi + 2]
je 0x4053ef
and word [esi], 0
jmp 0x40540a
xor eax, eax
jmp 0x405456
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4054b7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
and word [ebp - 0x208], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x410]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x208]
push eax
push 0
lea eax, [ebp - 0x410]
push 0x422b38
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.0040cb55
add esp, 0xc
mov al, 1
pop edi
leave
ret

Function at 0x405771
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push ebx
push esi
push edi
push 0x1f
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x94]
mov dword [ebp - 0x98], esi
push 1
rep stosd dword es:[edi], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
xor ecx, ecx
lea eax, [ebp - 0x98]
pop edi
mov edx, edi
shl edx, cl
test dword [ebp + 0xc], edx
je 0x4057b1
inc dword [ebp - 0x14]
mov dword [eax], edi
inc ecx
add eax, 4
cmp ecx, 0x20
jl 0x4057a3
cmp dword [ebp + 8], esi
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xe], 0x52
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xd], 0x40
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x50
mov byte [ebp - 9], 0x6d
mov byte [ebp - 7], 0x3c
mov byte [ebp - 8], 0x7c
mov byte [ebp - 6], 0x23
mov byte [ebp - 5], 0x59
mov byte [ebp - 3], 0x73
mov byte [ebp - 4], 0x4b
mov byte [ebp - 2], 0x24
mov byte [ebp - 1], 0x5e
je 0x405814
push 0x422b30
push dword [ebp + 8]
call fcn.0040dc24
mov ebx, eax
pop ecx
cmp ebx, esi
pop ecx
jne 0x40581c
or eax, 0xffffffff
jmp 0x4058f6
push 2
push esi
push ebx
call fcn.0040e2ab
add esp, 0xc
mov esi, 0x2c8
push edi
push 0xfffffd38
push ebx
call fcn.0040e2ab
add esp, 0xc
test eax, eax
jne 0x4058ec
push esi
push eax
lea eax, [ebp - 0x360]
push eax
call fcn.0040cba0
push ebx
push esi
lea eax, [ebp - 0x360]
push edi
push eax
call fcn.0040e364
add esp, 0x1c
cmp eax, esi
jne 0x4058ec
lea eax, [ebp - 0x360]
push esi
push eax
call fcn.004055c1
lea eax, [ebp - 0x10]
push 0x10
push eax
lea eax, [ebp - 0x360]
push esi
push eax
call fcn.00405569
lea eax, [ebp - 0x360]
push eax
call fcn.004056af
add esp, 0x1c
test al, al
je 0x4058ec
xor ecx, ecx
lea eax, [ebp - 0x98]
mov dword [ebp + 8], ecx
cmp dword [eax], edi
jne 0x4058bd
mov edx, edi
shl edx, cl
test dword [ebp - 0x35c], edx
je 0x4058bd
inc dword [ebp + 8]
inc ecx
add eax, 4
cmp ecx, 0x20
jl 0x4058aa
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jne 0x4058d1
inc dword [ebp - 0x18]
mov eax, 0xfffffd38
push edi
sub eax, dword [ebp - 0x9c]
push eax
push ebx
call fcn.0040e2ab
add esp, 0xc
jmp 0x40582d
push ebx
call fcn.0040da3d
mov eax, dword [ebp - 0x18]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405bb9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 0x14], esi
je 0x405c3e
push esi
push dword [ebp + 8]
call fcn.00405771
pop ecx
cmp eax, esi
pop ecx
jle 0x405c3e
cmp dword [ebp + 0xc], eax
jge 0x405c3e
sub eax, dword [ebp + 0xc]
push 0x422b30
push dword [ebp + 8]
mov byte [ebp - 0xf], 0x65
dec eax
mov byte [ebp - 0x10], 0x25
mov dword [ebp + 0xc], eax
mov byte [ebp - 0xe], 0x52
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xd], 0x40
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x50
mov byte [ebp - 9], 0x6d
mov byte [ebp - 7], 0x3c
mov byte [ebp - 8], 0x7c
mov byte [ebp - 6], 0x23
mov byte [ebp - 5], 0x59
mov byte [ebp - 3], 0x73
mov byte [ebp - 4], 0x4b
mov byte [ebp - 2], 0x24
mov byte [ebp - 1], 0x5e
call fcn.0040dc24
mov ebx, eax
pop ecx
cmp ebx, esi
pop ecx
jne 0x405c45
xor al, al
jmp 0x405d0a
push 2
push esi
push ebx
call fcn.0040e2ab
add esp, 0xc
mov esi, 0x2c8
push 1
push 0xfffffd38
push ebx
call fcn.0040e2ab
add esp, 0xc
test eax, eax
jne 0x405cfc
push esi
push eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.0040cba0
push ebx
push esi
lea eax, [ebp - 0x2dc]
push 1
push eax
call fcn.0040e364
lea eax, [ebp - 0x2dc]
push esi
push eax
call fcn.004055c1
lea eax, [ebp - 0x10]
push 0x10
push eax
lea eax, [ebp - 0x2dc]
push esi
push eax
call fcn.00405569
lea eax, [ebp - 0x2dc]
push eax
call fcn.004056af
add esp, 0x38
test al, al
je 0x405cfc
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
je 0x405ce3
inc dword [ebp - 0x14]
mov eax, 0xfffffd38
sub eax, dword [ebp - 0x18]
push 1
push eax
push ebx
call fcn.0040e2ab
add esp, 0xc
jmp 0x405c56
lea eax, [ebp - 0x2dc]
push esi
push eax
push dword [ebp + 0x10]
call fcn.0040cff0
add esp, 0xc
mov byte [ebp + 0xb], 1
jmp 0x405d00
and byte [ebp + 0xb], 0
push ebx
call fcn.0040da3d
mov al, byte [ebp + 0xb]
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x406099
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6d8
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xe], 0x52
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xd], 0x40
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x50
mov byte [ebp - 9], 0x6d
mov byte [ebp - 7], 0x3c
mov byte [ebp - 8], 0x7c
mov byte [ebp - 6], 0x23
mov byte [ebp - 5], 0x59
mov byte [ebp - 3], 0x73
mov byte [ebp - 4], 0x4b
mov byte [ebp - 2], 0x24
mov byte [ebp - 1], 0x5e
je 0x4061cc
push 0x422b30
push dword [ebp + 8]
call fcn.0040dc24
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x4061cc
push 2
push 0
push edi
call fcn.0040e2ab
push edi
call fcn.0040e128
add esp, 0x10
mov dword [ebp + 8], eax
mov ebx, 0xfffffd38
mov esi, 0x2c8
push 1
push ebx
push edi
call fcn.0040e2ab
add esp, 0xc
test eax, eax
jne 0x4061a5
push esi
push eax
lea eax, [ebp - 0x2d8]
push eax
call fcn.0040cba0
push edi
push esi
lea eax, [ebp - 0x2d8]
push 1
push eax
call fcn.0040e364
lea eax, [ebp - 0x2d8]
push esi
push eax
call fcn.004055c1
lea eax, [ebp - 0x10]
push 0x10
push eax
lea eax, [ebp - 0x2d8]
push esi
push eax
call fcn.00405569
lea eax, [ebp - 0x2d8]
push eax
call fcn.004056af
add esp, 0x38
test al, al
je 0x4061a5
mov eax, ebx
push 1
sub eax, dword [ebp - 0x14]
push eax
push edi
call fcn.0040e2ab
push edi
call fcn.0040e128
add esp, 0x10
mov dword [ebp + 8], eax
jmp 0x406128
push 0
push 0
push edi
call fcn.0040e2ab
push 0x4220c0
push dword [ebp + 0xc]
call fcn.0040dc24
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x4061d0
push edi
call fcn.0040da3d
pop ecx
xor al, al
jmp 0x406219
mov esi, dword [ebp + 8]
test esi, esi
jle 0x406209
mov eax, 0x400
cmp esi, eax
jge 0x4061e2
mov eax, esi
push edi
push eax
lea eax, [ebp - 0x6d8]
push 1
push eax
call fcn.0040e364
push ebx
push eax
lea eax, [ebp - 0x6d8]
push 1
push eax
call fcn.0040daba
add esp, 0x20
sub esi, eax
jmp 0x4061d3
push edi
call fcn.0040da3d
push ebx
call fcn.0040da3d
pop ecx
mov al, 1
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4076c3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x2c]
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x2c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
lea ecx, [edi + ecx - 0x106]
sub ebx, eax
cmp eax, ecx
jb 0x40774b
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.0040cff0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
mov dword [ebp + 8], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x40770e
mov eax, dword [esi + 0x40]
mov dword [ebp + 8], edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x407730
add ebx, edi
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x40781b
mov ecx, dword [esi + 0x74]
push ebx
add ecx, dword [esi + 0x6c]
add ecx, dword [esi + 0x38]
push ecx
push eax
call fcn.00407820
add dword [esi + 0x74], eax
mov ebx, dword [esi + 0x74]
add esp, 0xc
cmp ebx, 3
jb 0x407796
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x4077aa
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4076cf
mov ecx, dword [esi + 0x16c0]
mov eax, dword [esi + 0x3c]
cmp ecx, eax
jae 0x40781b
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp ecx, edi
jae 0x4077ea
sub eax, edi
mov ebx, eax
mov eax, 0x102
cmp ebx, eax
jbe 0x4077cf
mov ebx, eax
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.0040cba0
add esp, 0xc
add ebx, edi
mov dword [esi + 0x16c0], ebx
jmp 0x40781b
lea edx, [edi + 0x102]
cmp ecx, edx
jae 0x40781b
sub edi, ecx
sub eax, ecx
add edi, 0x102
cmp edi, eax
jbe 0x407804
mov edi, eax
mov eax, dword [esi + 0x38]
push edi
add eax, ecx
push 0
push eax
call fcn.0040cba0
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x412975
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x423510
cmp edx, dword [eax]
je 0x412997
add eax, 8
inc ecx
cmp eax, 0x4235a0
jl 0x412988
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x423510]
jne 0x412ac5
mov eax, dword [0x428460]
cmp eax, 1
je 0x412a9f
test eax, eax
jne 0x4129c8
cmp dword [0x422fc8], 1
je 0x412a9f
cmp edx, 0xfc
je 0x412ac5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4129ff
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00411ea0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040d330
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x412a42
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040d330
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x420600
push edi
call fcn.004152a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00411ea0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00411eb0
lea eax, [ebp - 0xa0]
push 0x4205e0
push eax
call fcn.00411eb0
push dword [esi + 0x423514]
lea eax, [ebp - 0xa0]
push eax
call fcn.00411eb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00415be1
add esp, 0x2c
pop edi
jmp 0x412ac5
lea eax, [ebp + 8]
lea esi, [esi + 0x423514]
push 0
push eax
push dword [esi]
call fcn.0040d330
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x417fc0
Capabilities:
Delete file

Disassembly:
push esi
push edi
push 0x422b30
push dword [esp + 0x10]
call fcn.0040dc24
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x418007
push 2
push 0
push esi
call fcn.0040e2ab
push esi
call fcn.0040e128
push esi
mov edi, eax
call fcn.0040da3d
push 0x4220c0
push dword [esp + 0x24]
call fcn.0040dc24
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x41800b
xor al, al
jmp 0x41805f
push 0
push 0
push esi
call fcn.0040e2ab
add esp, 0xc
test edi, edi
jle 0x41804c
push ebx
mov ebx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ
push ebx
call fcn.0040d330
cmp edi, eax
pop ecx
jae 0x418031
mov eax, edi
jmp 0x418038
push ebx
call fcn.0040d330
pop ecx
push esi
push eax
push 1
push ebx
call fcn.0040daba
sub edi, eax
add esp, 0x10
test edi, edi
jg 0x418022
pop ebx
push esi
call fcn.0040da3d
pop ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
pop edi
pop esi
ret
Function at 0x100054ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x2cb8], 2
mov dword [ebp - 0xc], edi
mov dword [edi + 0x2cb0], esi
jne 0x10005534
lea ecx, [edi + 0x38]
push 1
call fcn.10005454
test eax, eax
je 0x1000552e
push dword [edi + 0x80]
mov ecx, edi
push dword [edi + 0x7c]
call fcn.10004c8e
jmp 0x100056f7
mov dword [edi + 0x2cb8], esi
mov edx, dword [edi + 0x38]
push ebx
mov ebx, dword [edi + 0x3c]
push 8
pop ecx
sub ecx, edx
shr ebx, cl
mov dword [ebp - 0x10], edx
mov edx, 0xff
shr ebx, 0x10
and ebx, edx
cmp dword [edi + 0x2ca0], 0x25
jae 0x1000556b
mov eax, 0x100c995c
mov ecx, 0x100c994c
mov dword [ebp - 4], 0x100c998c
jmp 0x1000557c
mov eax, 0x100c997c
mov ecx, 0x100c996c
mov dword [ebp - 4], 0x100c99c8
cmp dword [edi + 0x2cac], esi
cmove eax, ecx
mov dword [ebp - 8], eax
mov cl, byte [eax]
mov eax, dword [ebp - 4]
sar edx, cl
mov eax, dword [eax]
xor eax, ebx
not edx
test eax, edx
je 0x100055b8
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
inc esi
mov edx, 0xff
mov cl, byte [esi + edi]
mov eax, dword [eax + esi*4]
sar edx, cl
xor eax, ebx
not edx
test eax, edx
jne 0x1000559c
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
lea ebx, [edi + 0x38]
movzx eax, byte [esi + eax]
add eax, dword [ebp - 0x10]
mov ecx, ebx
mov dword [ebx], eax
call fcn.10005408
cmp esi, 9
jb 0x10005670
jne 0x100055ed
push dword [edi + 0x80]
inc dword [edi + 0x2cb8]
push dword [edi + 0x7c]
jmp 0x100056ef
and dword [edi + 0x2cb8], 0
mov ecx, edi
cmp esi, 0xe
jne 0x10005620
push 0x100c9808
call fcn.10004d92
push 0xf
mov ecx, ebx
lea esi, [eax + 5]
call fcn.10005454
add eax, 0x7fff
push esi
mov dword [edi + 0x7c], eax
push eax
jmp 0x100056e9
mov eax, dword [edi + 0x78]
sub eax, esi
inc eax
and eax, 3
push 0x100c97d0
mov ebx, dword [edi + eax*4 + 0x68]
mov dword [ebp - 0x10], esi
call fcn.10004d92
lea esi, [eax + 2]
cmp esi, 0x101
jne 0x10005659
cmp dword [ebp - 0x10], 0xa
jne 0x10005659
xor dword [edi + 0x2cac], 1
xor eax, eax
jmp 0x100056f6
cmp ebx, 0x100
jb 0x10005662
inc esi
mov eax, dword [edi + 0x2cc8]
dec eax
cmp ebx, eax
jb 0x100056d3
inc esi
jmp 0x100056d3
mov ecx, dword [edi + 0x2ca0]
and dword [edi + 0x2cb8], 0
add ecx, esi
mov eax, ecx
shr eax, 4
sub ecx, eax
mov dword [edi + 0x2ca0], ecx
push 0x100c98b0
mov ecx, edi
call fcn.10004d92
mov ecx, eax
and ecx, 0xff
dec ecx
mov ebx, dword [edi + ecx*4 + 0x498]
cmp ecx, 0xffffffff
je 0x100056d0
dec dword [edi + ebx*4 + 0x1494]
mov eax, dword [edi + ecx*4 + 0x494]
inc dword [edi + eax*4 + 0x1494]
mov dword [edi + ecx*4 + 0x498], eax
mov dword [edi + ecx*4 + 0x494], ebx
add esi, 2
mov eax, dword [edi + 0x78]
push esi
mov dword [edi + eax*4 + 0x68], ebx
mov eax, dword [edi + 0x78]
inc eax
and eax, 3
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], ebx
push ebx
mov dword [edi + 0x80], esi
mov ecx, edi
call fcn.10004c8e
pop ebx
pop edi
pop esi
leave
ret
Function at 0x100094f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
or dword [esi], 0xffffffff
xor bl, bl
xor cl, cl
xor eax, eax
mov byte [esi + 4], 0
test edi, edi
je 0x1000955b
mov edx, dword [ebp + 8]
xor cl, byte [eax + edx]
inc eax
cmp eax, edi
jb 0x1000950f
test cl, cl
jne 0x1000955b
test edi, edi
je 0x1000955b
mov ecx, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov edx, edi
mov byte [esi + 4], bl
call fcn.10025d80
mov edx, eax
xor eax, eax
xor ecx, ecx
cmp dword [ecx + 0x100c9c6c], edx
jne 0x10009545
cmp dword [ecx + 0x100c9c68], edi
je 0x10009551
add ecx, 0xc
inc eax
cmp ecx, 0x48
jb 0x10009535
or eax, 0xffffffff
mov dword [esi], eax
test eax, eax
jns 0x1000955b
mov byte [esi + 4], 0
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 8

Function at 0x1000bfa2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
mov eax, dword [ecx + eax*4]
shr eax, 8
mov dword [ebp - 8], ecx
mov eax, dword [ecx + eax*4]
movzx ecx, al
push esi
or esi, 0xffffffff
push edi
mov dword [ebp - 4], edx
mov dword [ebp + 8], ecx
xor ebx, ebx
mov edx, dword [ebp - 8]
movzx edi, al
shr eax, 8
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
cmp ebx, 4
jne 0x1000c00a
test edi, edi
je 0x1000c006
mov eax, esi
shr eax, 0x18
xor eax, ecx
push ecx
mov ecx, dword [ebp + 0xc]
shl esi, 8
xor esi, dword [eax*4 + 0x100f1f80]
call fcn.1000d198
mov ecx, dword [ebp + 8]
dec edi
jne 0x1000bfe3
mov edx, dword [ebp - 4]
xor ebx, ebx
jmp 0x1000c032
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp + 0xc]
cmovne ebx, eax
mov eax, esi
shr eax, 0x18
xor eax, edi
shl esi, 8
xor esi, dword [eax*4 + 0x100f1f80]
push edi
inc ebx
mov dword [ebp + 8], edi
call fcn.1000d198
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
dec edx
mov dword [ebp - 4], edx
jne 0x1000bfc8
not esi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8