joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482b6b
Capabilities:
Delete file
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
lea ebp, [esi + 0xc0]
push edi
mov ecx, ebp
xor edi, edi
call fcn.00489926
test al, al
je 0x482d12
cmp byte [esi + 0x1f6], 0
je 0x482ba2
mov ecx, ebp
call fcn.0048b51f
xor eax, eax
jmp 0x482db5
lea ebx, [esi + 0x1d0]
mov eax, dword [ebx]
test eax, eax
je 0x482bf1
push eax
mov ecx, ebp
call fcn.0048b0bc
mov edi, eax
test edi, edi
jge 0x482bea
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x482bea
test byte [eax + 0x1c], 1
je 0x482bea
cmp byte [eax + 0x19], 2
jb 0x482bea
push edi
push 0x4aaa88
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00425267
add esp, 0x14
mov ecx, ebx
call fcn.004944ca
push 0x4c6540
lea ecx, [esp + 0x18]
mov byte [esp + 0x17], 1
call fcn.0040cc78
cmp byte [esi + 0x1f5], 0
je 0x482c96
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00481aa1
push 0
push 0xffffffffffffffff
push 0x4c8620
lea ecx, [esp + 0x24]
call fcn.00446ad9
cmp dword [0x4c865c], 0
je 0x482c8d
lea edx, [esp + 0x13]
mov byte [esi + 0x1f6], 1
mov ecx, dword [0x4c865c]
mov eax, dword [ecx]
push edx
push dword [esi + 8]
call dword [eax + 0xc]
mov edi, eax
mov byte [esi + 0x1f6], 0
test edi, edi
jge 0x482c8d
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x482c8d
test byte [eax + 0x1c], 1
je 0x482c8d
cmp byte [eax + 0x19], 2
jb 0x482c8d
push edi
push 0x4aaa88
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00425267
add esp, 0x14
lea ecx, [esp + 0x18]
call fcn.00437b63
mov ecx, ebp
call fcn.0048b51f
cmp byte [esi + 0x1f5], 0
je 0x482d06
cmp byte [esp + 0x13], 0
je 0x482d06
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x482d06
push eax
mov ecx, esi
call fcn.00482800
cmp byte [esi + 0x1f8], 0
mov edi, eax
je 0x482d06
test edi, edi
je 0x482d06
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x482cfc
test byte [eax + 0x1c], 1
je 0x482cfc
cmp byte [eax + 0x19], 3
jb 0x482cfc
push edi
push 0x4aaa88
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00425267
add esp, 0x14
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00401395
lea ecx, [esi + 0x50]
call fcn.0048c5f6
cmp byte [esi + 0x1f7], 0
je 0x482db3
mov eax, dword [0x4c6094]
mov ebx, 0x4c6094
cmp eax, ebx
je 0x482d56
test byte [eax + 0x1c], 1
je 0x482d56
cmp byte [eax + 0x19], 2
jb 0x482d56
push 0x4aaa88
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
push 0x40010004
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x482db3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x4c6094]
cmp eax, ebx
je 0x482d9f
test byte [eax + 0x1c], 1
je 0x482d9f
cmp byte [eax + 0x19], 2
jb 0x482d9f
push esi
push 0x4aaa88
push 0x22
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00425267
add esp, 0x14
test esi, esi
jle 0x482daf
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
jmp 0x482db5
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4898f6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
cmp ecx, eax
je 0x489920
cmp dword [esp + 8], eax
je 0x489920
jbe 0x48991d
mov edx, eax
and edx, 0x1f
mov dl, byte [edx + 0x4aae7c]
xor byte [eax + ecx], dl
inc eax
cmp eax, dword [esp + 8]
jb 0x489908
xor eax, eax
ret
mov eax, 0x80070057
ret

Function at 0x48ca86
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x48cac9
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x48cac2
test byte [eax + 0x1c], 1
je 0x48cac2
cmp byte [eax + 0x19], 2
jb 0x48cac2
push ecx
push 0x4ab14c
push 0x50
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00425267
add esp, 0x14
mov eax, 0x80070057
jmp 0x48cb03
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0x48caf8
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x48cac2
test byte [eax + 0x1c], 1
je 0x48cac2
cmp byte [eax + 0x19], 2
jb 0x48cac2
push ecx
push 0x4ab14c
push 0x51
jmp 0x48cab4
mov eax, dword [eax + 8]
mov ecx, dword [esp + 8]
mov dword [ecx], eax
xor eax, eax
ret 8
Function at 0x48da24
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push 0x7c
mov eax, 0x49bb84
call fcn.00454d9d
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x44], eax
call fcn.0043d9d0
and dword [ebp - 4], 0
mov esi, 0x4c6540
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0040cc78
push esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.0040cc78
push esi
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.0040cc78
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.0048b397
mov esi, eax
test esi, esi
jge 0x48dac0
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00401395
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00401395
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00401395
lea ecx, [ebp - 0x6c]
call fcn.0043d9b0
mov eax, esi
call fcn.00454df9
ret 0x10
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x40]
call fcn.0043dfbc
pop ecx
pop ecx
test al, al
jne 0x48dafa
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00401395
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00401395
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00401395
mov esi, 0x8007000e
jmp 0x48daae
push 0x4aaf10
lea ecx, [ebp - 0x38]
call fcn.0040cdda
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x38]
call fcn.0043dfbc
pop ecx
pop ecx
test al, al
je 0x48dad2
push 0
push 0xffffffffffffffff
push 0x4c86a0
lea ecx, [ebp - 0x88]
call fcn.00446ad9
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x74], edi
push dword [ebp - 0x38]
mov dword [ebp - 0x70], ebx
call fcn.0048cd9d
lea ecx, [ebp - 0x88]
mov esi, eax
call fcn.00437b63
test esi, esi
jge 0x48db8f
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x48dbfa
test byte [eax + 0x1c], 1
je 0x48dbfa
cmp byte [eax + 0x19], 2
jb 0x48dbfa
push esi
push 0x4ab14c
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00425267
jmp 0x48dbf7
push dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
push dword [ebp - 0x3c]
push 0x4ab1d4
call fcn.0048b142
mov esi, eax
test esi, esi
jge 0x48dbca
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x48dbfa
test byte [eax + 0x1c], 1
je 0x48dbfa
cmp byte [eax + 0x19], 2
jb 0x48dbfa
push esi
push 0x4ab14c
push 0x1e
jmp 0x48db82
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x48dbfa
test byte [eax + 0x1c], 1
je 0x48dbfa
cmp byte [eax + 0x19], 4
jb 0x48dbfa
push dword [ebp - 0x3c]
push 0x4ab14c
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042528a
add esp, 0x14
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48da8d
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x48da8d
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4b2008], 0x8088405
inc edx
mov dword [ebx + 0x4b2008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cc40
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cc71
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc59
add dl, dl
jne 0x41cc7c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cccd
xor eax, eax
add dl, dl
jne 0x41cc89
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd6a
add dl, dl
jne 0x41cc98
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cca3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccae
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccb9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41ccc3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cc68
mov eax, 1
add dl, dl
jne 0x41ccdb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cce6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccd2
sub eax, ebx
mov ebx, 1
jne 0x41cd19
mov ecx, 1
add dl, dl
jne 0x41ccff
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccf6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cd30
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd3b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cd27
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cd8b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cc68
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e214
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49b6d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e2c5
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e2ae
test esi, esi
jbe 0x41e2c5
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088dc
test eax, eax
jne 0x41e2a0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e2c5
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e27d
jmp 0x41e2c5
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e2c5
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b6da
ret
Function at 0x41eb1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x49c0cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eb57
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eb70
lea eax, [ebp - 0x10]
mov edx, dword [0x4b4258]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eb83
lea eax, [ebp - 0x10]
mov edx, dword [0x4b4258]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eb8f
adc edx, 0
mov edx, dword [edx*4 + 0x4b30e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ec9d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ec90
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dcc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ec90
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ec90
cmp dx, 0x150
ja 0x41ec90
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ec90
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ecb5
inc ebx
cmp ebx, 0x19
jne 0x41eb49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c0d2
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret