joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9af075
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9af09c
call fcn.00951578
mov dword [eax], esi
call fcn.00951565
push 0x16
pop esi
mov dword [eax], esi
call fcn.009521ba
mov eax, esi
jmp 0x9af0f1
test dword [ebp + 0xc], 0xfffffff9
jne 0x9af082
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9af0c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0095158b
pop ecx
call fcn.00951565
mov eax, dword [eax]
jmp 0x9af0f1
test al, 0x10
jne 0x9af0ef
test al, 1
je 0x9af0ef
test byte [ebp + 0xc], 2
je 0x9af0ef
call fcn.00951578
mov dword [eax], 5
call fcn.00951565
mov dword [eax], 0xd
jmp 0x9af0c0
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret

Function at 0x4038fa
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fa], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404658], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045ec], eax
mov dword [0x4040f2], eax
mov dword [0x4045d8], 0x30
mov dword [0x4045dc], 2
jmp 0x40393f
mov dword [0x4045e0], 0x403153
mov dword [0x4045e4], 0
mov dword [0x4045e8], 0
mov dword [0x404600], 0x40454e
mov dword [0x4045f8], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045f0], eax
mov dword [0x404604], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045f4], eax
push 0x4045d8
fadd dword [ebp + 0x40]
add bh, bh
adc eax, sym.imp.user32.dll_RegisterClassExA
push 0
push dword [0x4040f2]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push 0x40454e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404650], eax
push 5
push dword [0x404650]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404650]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404608]
jmp 0x403a13
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a05
mov eax, dword [0x404610]
jmp 0x403a2e
call 0x402bd5
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x40], str.SBIEDLL.DLL
mov dword [ebp - 0x3c], str.SBIEDLLX.DLL
mov dword [ebp - 0x38], str.WPESPY.DLL
mov dword [ebp - 0x34], 0x405254
mov dword [ebp - 0x30], str.API_LOG.DLL
mov dword [ebp - 0x2c], str.DIR_WATCH.DLL
mov dword [ebp - 0x28], str.PSTOREC.DLL
mov dword [ebp - 0x24], str.VBOXSERVICE.EXE
mov dword [ebp - 0x20], str.VBOXTRAY.EXE
mov dword [ebp - 0x1c], str.VMTOOLSD.EXE
mov dword [ebp - 0x18], str.VMWARETRAY.EXE
mov dword [ebp - 0x14], str.VMWAREUSER
mov dword [ebp - 0x10], str.VMSRVC.EXE
mov dword [ebp - 0xc], str.VMUSRVC.EXE
mov dword [ebp - 8], str.PRL_TOOLS.EXE
mov dword [ebp - 4], str.XENSERVICE.EXE
mov dword [ebp - 0x44], 0
jmp 0x401088
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 7
jae 0x4010aa
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp + ecx*4 - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4010a8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x40107f
mov dword [ebp - 0x48], 0
jmp 0x4010bc
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 9
jae 0x4010e5
push 0
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp + ecx*4 - 0x24]
push edx
call fcn.00402740
add esp, 8
movzx eax, al
test eax, eax
je 0x4010e3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4010b3
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4010f7
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x4014e0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xf0000000
push 0x18
push 0
push 0
push 0x408020
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
pop ebp
ret

Function at 0x401500
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov byte [ebp - 0x20], 8
mov byte [ebp - 0x1f], 2
mov dword [ebp - 0x1c], 0x6801
cmp dword [ebp + 0x18], 0x10
jae 0x401546
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x2c], ecx
jmp 0x40154d
mov dword [ebp - 0x2c], 0x10
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x14]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1c
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [0x408020]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x4015d6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
push 1
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x21], al
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov al, byte [ebp - 0x21]
mov esp, ebp
pop ebp
ret
Function at 0x401b50
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x41c], ecx
cmp dword [ebp - 0x41c], 2
jb 0x401bc5
cmp dword [ebp - 0x41c], 3
jbe 0x401b8c
cmp dword [ebp - 0x41c], 6
je 0x401b8c
jmp 0x401bc5
push 0x208
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x401bc5
push 4
push str.___
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x401bc5
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x401bd0
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x80000002
mov dword [ebp - 4], 0x80000001
mov dword [ebp - 0x14], 0
jmp 0x401c06
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jae 0x401c76
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + edx*4 - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401c74
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 4
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push str.NoDrives
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401c6a
cmp dword [ebp - 0x1c], 0
je 0x401c6a
mov ecx, dword [ebp - 0xc]
or ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401bfd
mov eax, dword [ebp - 0xc]
not eax
and eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x401d50
Capabilities:
Create directory
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp + 8]
push ecx
push 0x405994
lea edx, [ebp - 0x458]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x458]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0xffffffff
je 0x401e7f
push 0x4059a0
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x401dd1
push 0x4059a4
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x401dd3
jmp 0x401e4c
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x4059ac
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x4059b8
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x250]
and ecx, 0x10
je 0x401e36
lea edx, [ebp - 0x668]
push edx
lea eax, [ebp - 0x870]
push eax
call fcn.00401d50
add esp, 8
jmp 0x401e4c
push 9
lea ecx, [ebp - 0x668]
push ecx
lea edx, [ebp - 0x870]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401da5
mov edx, dword [ebp - 0x45c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x401e90
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d4
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, 1
jne 0x40201c
lea ecx, [ebp - 0x258]
push ecx
push 0x4059c4
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
je 0x40201c
movzx edx, word [ebp - 0x22c]
cmp edx, 0x2e
je 0x401ff3
mov eax, dword [ebp - 0x258]
and eax, 0x10
mov dword [ebp - 0x258], eax
je 0x401f27
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, 1
jne 0x401f22
mov edx, dword [ebp + 8]
push edx
call fcn.00401e90
add esp, 4
push 0x4059cc
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x401ff3
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x4d0]
push ecx
push 0x104
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x401ff3
lea eax, [ebp - 0x4d0]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
lea ecx, [ebp - 0x4d0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0
je 0x401ff3
push str..exe
mov edx, dword [ebp - 0x4d4]
push edx
call fcn.00402020
add esp, 8
test eax, eax
je 0x401ff3
push str.drivemgr.exe
mov eax, dword [ebp - 0x4d4]
push eax
call sub.MSVCRT.dll_wcscmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x401ff3
mov ecx, dword [ebp - 0x4d4]
push ecx
call sub.MSVCRT.dll_wcslen
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp - 0x4d4]
push edx
lea eax, [ebp - 0x2c8]
push eax
call sub.MSVCRT.dll_wcstombs
add esp, 0xc
push 1
lea ecx, [ebp - 0x2c8]
push ecx
call fcn.00402740
add esp, 8
mov edx, dword [ebp - 0x4d4]
push edx
call fcn.00403a50
add esp, 4
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401ed8
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esp, ebp
pop ebp
ret
Function at 0x4025d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov edx, 5
mov word [ebp - 0x30], dx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x402641
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x402678
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x64], ecx
cmp dword [ebp - 0x64], 0x20
jle 0x402676
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x402678
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x402740
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov byte [ebp - 5], 0
mov dword [ebp - 0x130], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402802
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x402802
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4027fd
mov byte [ebp - 5], 1
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x4027bf
jmp 0x402802
mov edx, dword [ebp - 0x128]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x4027fb
push 0
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402802
jmp 0x40277b
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x402820
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x208
push 0
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x208]
push ecx
push str._appdata_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push str.winsvcs.txt
lea edx, [ebp - 0x208]
push edx
call sub.MSVCRT.dll_wcscat
add esp, 8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402881
xor al, al
jmp 0x4028bb
push 0
push 2
push 1
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
je 0x4028b9
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4029a0
Capabilities:
Create http request
Get http content length
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 5], 0
push 0
push 0
push 0
push 1
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__rv:67.0__Gecko_20100101_Firefox_67.0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402a38
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402a2e
mov dword [ebp - 0x14], 4
push 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
push 0x20000005
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
cmp dword [ebp - 0x10], 0x1b58
jbe 0x402a24
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx]
je 0x402a24
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x403210
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x403235
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x4032a8
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x40326a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x40329d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x40329b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x403261
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x40322c
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401933
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, section..data
mov ecx, 0x4832
mov esi, 0x4b6054
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov edx, ecx
shr edx, 0xc
xor byte [eax], dl
inc eax
dec esi
jne 0x401943
pop esi
ret

Function at 0x401a9f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, eax
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
movzx eax, word [esi + 0x14]
push edi
lea edi, [eax + esi + 0x18]
xor eax, eax
cmp ax, word [esi + 6]
jae 0x401ae6
push 7
push str..custom
push edi
call fcn.00401618
add esp, 0xc
test eax, eax
je 0x401aed
movzx eax, word [esi + 6]
inc dword [ebp - 4]
add edi, 0x28
cmp dword [ebp - 4], eax
jl 0x401ac3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0xc]
mov esi, dword [eax + ebx]
lea edi, [eax + ebx + 8]
mov ebx, dword [eax + ebx + 4]
push esi
call fcn.00401e2c
and dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push 1
push 5
push edi
lea ecx, [ebp - 0xc]
push ecx
add edi, 5
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], 0x40195c
mov dword [ebp - 0x14], 0x401967
call fcn.004037de
add esp, 0x28
test eax, eax
je 0x401b4d
push dword [ebp - 4]
call fcn.00401e43
pop ecx
jmp 0x401ae6
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 4]
jmp 0x401ae8

Function at 0x401d80
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
je 0x401dbf
push edi
mov edi, dword [esp + 0x14]
sub edi, 0x18a8060
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov eax, edx
shr eax, 0xc
xor al, byte [edi + esi + 0x18a8060]
inc esi
mov byte [esi + 0x18a805f], al
cmp esi, ebx
jb 0x401d9b
pop edi
pop esi
mov byte [ebx + 0x18a8060], 0
mov eax, 0x18a8060
pop ebx
ret

Function at 0x401dce
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x401e0c
mov eax, dword [esp + 0x10]
sub eax, 0x18a8060
push ebx
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov ebx, edx
shr ebx, 0xc
xor bl, byte [eax + esi + 0x18a8060]
inc esi
mov byte [esi + 0x18a805f], bl
cmp esi, edi
jb 0x401de8
pop ebx
mov byte [edi + 0x18a8060], 0
mov byte [edi + 0x18a8061], 0
pop edi
mov eax, 0x18a8060
pop esi
ret
Function at 0x401f2e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x401f47
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x401f6a
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x401f6f
inc edi
cmp edi, dword [ebp - 4]
jb 0x401f61
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x402067
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x401fc6
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x401f9a
cmp cl, 0xff
jne 0x401ff1
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x401fff
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x402006
dec ecx
shl edx, cl
and edx, 7
je 0x401f8b
movzx ecx, byte [edx + 0x13f1294]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x13f128c], 0
mov cl, byte [ebx + 4]
je 0x401fee
test cl, cl
je 0x401fee
cmp cl, 0xff
jne 0x401f8b
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x401f5c
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x40203a
movzx esi, byte [edx + 0x13f1294]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x402025
cmp al, 0xff
jne 0x402037
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x401fb8
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x401f5c
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x406c47
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x406c68
jl 0x406c5f
test edi, edi
jne 0x406c68
xor eax, eax
xor edx, edx
jmp 0x406d29
cmp dword [ebx + 0x38], 0
je 0x406c7d
push eax
push edi
push dword [ebp + 8]
call fcn.00406d2f
jmp 0x406d29
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x406cc4
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x406cc4
cmp eax, edi
jb 0x406c9e
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00409430
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x406cca
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x406d1e
mov ecx, ebx
call fcn.00406447
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x406d09
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040f9ee
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x406d1e
jmp 0x406cdc
test edx, edx
je 0x406d1e
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040f9ee
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40890b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40894a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40894a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40894a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40894a
cmp dword [ecx + 0x74], 0xe
jbe 0x40894a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret