joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a39
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
push 1
rep stosd dword es:[edi], eax
pop edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
xor esi, esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
mov word [ebp - 0x24], 0xa
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403aa9
cmp dword [ebp + 0x10], esi
je 0x403aa5
cmp dword [ebp + 0x10], 0xffffffff
jne 0x403a8d
push 0xffffffffffffffff
jmp 0x403a90
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x403aa9
cmp eax, 0x102
je 0x403aa9
mov eax, edi
jmp 0x403aab
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x403aed
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
push esi
push 0x80
push 3
push esi
push 1
push bind
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403b1b
push eax
jmp 0x403b81
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3c
ja 0x403b2b
push edi
jmp 0x403b81
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push esi
push 0x3c
push edi
call ebx
lea eax, [ebp - 0xc]
push esi
push eax
lea eax, [ebp + 0xb]
push 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403b28
movzx eax, byte [ebp + 0xb]
push esi
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 8], eax
ja 0x403b28
push esi
push esi
push dword [ebp - 8]
push edi
call ebx
lea eax, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 2]
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push edi
jne 0x403b90
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 2], 0x50
jne 0x403b87
cmp byte [ebp - 1], 0x45
jne 0x403b87
push 1
pop eax
jmp 0x403b89
Function at 0x403d4e
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x403d9c
push str.RegisterServiceProcess
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, edi
je 0x403d95
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.00404847
push eax
call fcn.0040481f
pop ecx
lea eax, [ebp - 0x190]
pop ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x403dcb
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x403e8c
mov esi, dword [ebp + 0x10]
push esi
call fcn.00404280
test eax, eax
pop ecx
jbe 0x403df2
push esi
call fcn.00404280
cmp byte [eax + esi - 1], 0x21
pop ecx
jne 0x403df2
push esi
call fcn.00401856
jmp 0x403e8c
mov dword [0x40e46c], edi
call fcn.0040127d
call fcn.00401492
test eax, eax
jne 0x403e5d
call section..text
test eax, eax
je 0x403e1d
push 0x40e448
call fcn.0040107c
test eax, eax
jne 0x403e33
cmp dword [0x40e46c], edi
je 0x403e8c
push dword [0x40e450]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403e8c
call fcn.0040106f
test eax, eax
je 0x403e49
call fcn.00401334
push esi
call fcn.004015c3
jmp 0x403e8c
cmp dword [0x40e460], edi
jbe 0x403e56
call fcn.00401db1
call fcn.00401334
jmp 0x403e8c
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp + 0x10]
push eax
push edi
push edi
push 0x4024e2
push edi
push edi
call esi
mov ebx, eax
lea eax, [ebp + 0x10]
push eax
push edi
push edi
push 0x4033f7
push edi
push edi
call esi
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x4071d5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d468
cmp edx, dword [eax]
je 0x4071f7
add eax, 8
inc ecx
cmp eax, 0x40d4f8
jl 0x4071e8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d468]
jne 0x407325
mov eax, dword [0x40e498]
cmp eax, 1
je 0x4072ff
test eax, eax
jne 0x407228
cmp dword [0x40d39c], 1
je 0x4072ff
cmp edx, 0xfc
je 0x407325
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40725f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404430
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404280
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4072a2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404280
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b5ec
push edi
call fcn.00408d60
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404430
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404440
lea eax, [ebp - 0xa0]
push 0x40b5cc
push eax
call fcn.00404440
push dword [esi + 0x40d46c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404440
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408cd2
add esp, 0x2c
pop edi
jmp 0x407325
lea eax, [ebp + 8]
lea esi, [esi + 0x40d46c]
push 0
push eax
push dword [esi]
call fcn.00404280
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x11a0008], 0x8088405
inc edx
mov dword [ebx + 0x11a0008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x118956f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e161
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e14a
test esi, esi
jbe 0x41e161
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ac
test eax, eax
jne 0x41e13c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e161
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e119
jmp 0x41e161
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e161
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1189576
ret
Function at 0x41e9a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x1189f53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e9df
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e9f8
lea eax, [ebp - 0x10]
mov edx, dword [0x11a2248]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ea0b
lea eax, [ebp - 0x10]
mov edx, dword [0x11a2248]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ea17
adc edx, 0
mov edx, dword [edx*4 + 0x11a10d8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41eb25
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41eb18
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d9c
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41eb18
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41eb18
cmp dx, 0x150
ja 0x41eb18
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41eb18
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eb3d
inc ebx
cmp ebx, 0x19
jne 0x41e9d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1189f5a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x292e2f85
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x44bb3285
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x724a03
Capabilities:
Check for vm using instruction vpcext

Disassembly:
wait
sbb al, 0xe3
movsd dword es:[edi], dword [esi]
xchg ebp, eax
adc dword [edx], ebp
test eax, 0x41ad00b0
test dword [ebx - 0x51467491], 0xefe55a5a
aas
insb byte es:[edi], dx
out dx, eax
enter 0x6d19, 0x7e
sub al, 0x86
push ss
or dword [esi], esi
mov edi, dword [eax]
das
js 0x72494d
sbb eax, 0x7d3963e7
mov ecx, 0x5b840e92
cld
or edx, dword [esi + esi - 0x37]
imul eax, dword [edi], 0x3b
mov cl, 0x65
aad 0x37
jecxz 0x724a04
pushal
xchg ebp, eax
xor bh, byte [ecx - 0x18]
dec ecx
aas
invalid
insd dword es:[edi], dx
push edi
adc esi, dword [edi - 0x7aa3280b]
sal dword [edi], 0x95
cld
jl 0x72498c
std
push edi
insb byte es:[edi], dx
jnp 0x72494e
xchg dword [edx + 0x53], esi
push esi
lock or dword [edi], ebx
pop esi
retf
loope 0x72499a
xchg ebp, eax
ror eax, cl
mov eax, dword es:[0x1d70243]
aaa
call 0x3e342fb6

Function at 0x724a13
Capabilities:
Check for vm using instruction vpcext

Disassembly:
salc
ror byte [ecx], cl
scasb al, byte es:[edi]
sbb ah, byte [eax]
out 0xf2, al
and al, 0xfe
pop eax
add dword [eax - 0x16], esi
push ss
lcall 0xa0cf, 0x100fa011
push ecx
jno 0x7249f9
mov esp, 0xe897fad8
in eax, dx
in eax, dx
jg 0x724a28
or ch, 0xed
xchg byte [edi - 0x1fe0d8d4], ah
int3

Function at 0x725b33
Capabilities:
Encode data using xor

Disassembly:
pushal
xor eax, dword [edi + 0x172d0a1f]
sbb eax, 0x5d611ff6
out 0x54, al
mov dl, 0x70
invalid
Function at 0x401050
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
mov eax, dword [edi]
push esi
push ebx
mov ecx, edi
call dword [eax]
mov edx, dword [edi + 0x28]
inc edx
cmp eax, 0xffffffff
mov dword [edi + 0x28], edx
je 0x401085
test eax, eax
jl 0x40109b
cmp eax, 1
jg 0x40109b
mov eax, dword [esi + 8]
test eax, eax
je 0x401090
mov esi, eax
jmp 0x40105d
mov eax, dword [esi + 4]
test eax, eax
je 0x4010ac
mov esi, eax
jmp 0x40105d
mov dword [esi + 8], ebx
mov dword [ebx], esi
pop edi
pop esi
pop ebx
ret 8
push str.InsertBelow___Error.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebx
ret 8
mov dword [esi + 4], ebx
mov dword [ebx], esi
pop edi
pop esi
pop ebx
ret 8

Function at 0x4015f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
cmp ebp, ebx
mov esi, ecx
je 0x4016b6
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4016b6
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x4016a9
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x10]
push ebx
push ecx
lea edx, [esi + 0x2c]
push 4
push edx
push eax
call edi
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push ebx
push eax
lea ecx, [esi + 0x30]
push 4
push ecx
push edx
call edi
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push 0
lea ebx, [esi + 0x34]
push eax
push 4
push ebx
push ecx
call edi
lea edx, [esp + 0x18]
mov ecx, esi
push edx
push 0x401530
push 2
call fcn.004010c0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
push ebp
push ecx
mov ecx, esi
call fcn.004016d0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
pop ebx
pop ecx
ret 4
pop esi
pop ebp
mov eax, 0x57
pop ebx
pop ecx
ret 4
Function at 0x4016d0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0xc], ecx
je 0x4017cd
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4017cd
push edi
push ebp
push 0x80
push 3
push ebp
push 1
push 0xc0000000
push esi
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4017bc
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebp
jbe 0x4017a9
lea eax, [esi + 1]
push eax
call sub.MFC42.DLL_operatornew
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4017a9
lea ecx, [esp + 0x10]
push ebp
push ecx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4017a0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push esi
push ebx
mov dword [esp + 0x2c], ebp
call fcn.004017e0
mov ebp, eax
test ebp, ebp
jne 0x40178f
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push ebp
push eax
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4017a0
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 8
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
pop edi
pop esi
pop ebp
add esp, 8
ret 8
pop esi
mov eax, 0x57
pop ebp
add esp, 8
ret 8
Function at 0x4017e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
test ebp, ebp
push edi
je 0x4018c5
mov ebx, dword [esp + 0x18]
test ebx, ebx
jle 0x4018c5
lea edi, [ebx + 1]
push edi
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
test esi, esi
jne 0x40181a
pop edi
pop esi
pop ebp
mov eax, 0xe
pop ebx
ret 0xc
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
test ebx, ebx
jle 0x401880
mov edi, ebp
sub edi, esi
lea ecx, [ebx - 1]
cmp eax, ecx
je 0x401859
mov ecx, eax
and ecx, 0x80000001
jns 0x40184e
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x40186a
mov dl, byte [eax + ebp + 1]
mov byte [eax + esi], dl
jmp 0x40187b
mov edx, eax
and edx, 0x80000001
jns 0x401868
dec edx
or edx, 0xfffffffe
inc edx
je 0x401873
mov cl, byte [eax + ebp - 1]
mov byte [eax + esi], cl
jmp 0x40187b
lea ecx, [eax + esi]
mov dl, byte [edi + ecx]
mov byte [ecx], dl
inc eax
cmp eax, ebx
jl 0x401838
xor ecx, ecx
test ebx, ebx
jle 0x401893
mov al, byte [ecx + esi]
add al, 0x80
mov byte [ecx + esi], al
inc ecx
cmp ecx, ebx
jl 0x401886
xor ecx, ecx
test ebx, ebx
jle 0x4018b6
mov eax, ecx
mov edi, 0x1a
cdq
idiv edi
mov al, byte [edx + str.QKDRBPITHUXNFEMLCJSYAWZGVO]
mov dl, byte [ecx + esi]
xor dl, al
mov byte [ecx + esi], dl
inc ecx
cmp ecx, ebx
jl 0x401899
mov ecx, dword [esp + 0x1c]
pop edi
xor eax, eax
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 0xd
pop ebx
ret 0xc
Function at 0x4065f5
Capabilities:
Check os version

Disassembly:
dec ebp
add al, byte [eax]
shl dh, 0x20
xor al, al
jb 0x4065c5
pop ebp
mov dx, dx
ret
mov al, 1
mov esi, esi
call fcn.0043c639
fisub dword [ebp - 1]
xlatb
jp 0x40629e
ljmp 0x2ac:0x74870f40
mov ebx, dword [ebp + 0x44]
jno 0x413985
jo 0x4065bf
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
ret
jo 0x413985
fdivr dword [esi - 0x71]
inc esp
and al, 0xfc
mov edx, dword [ebp + 0x38]
lea esi, [esi + 8]
mul dword [ebp + ebx]
mov dword [ebp + 0x30], eax
xchg esi, edi
xchg edi, esi
mov dword [ebp + 0x38], edx
mov bl, bl
ja 0x424d74
jbe 0x4065ed
nop
cpuid
ret 0x860f
jbe 0x424d74
and byte [eax - 0x73], 0x64
and al, 4
mov cl, byte [ebp + 0xc]
mov dx, word [ebp + 0x10]
push eax
ja 0x41a6fa
jbe 0x40660c
cli
into
jbe 0x41a6fa
invalid
or ebp, dword [edx - 0x2279147a]
jmp 0x4065b0
and eax, 0x20e1c092
not word [edi]
mov esi, esi
jmp dword [esi]
mov eax, eax
jmp 0x410167
push ecx
mov ecx, dword [ebp + 0x1c]
push edx
call fcn.0042d6ea
shl bp, 0x20
shr eax, 0x1e
sub edx, 0
jno 0x4101a8
shl byte [esi + 0xf], 1
and ebx, 0xd9000098
std
jno 0x419a91
fscale
mov edx, dword [esi + 4]
jne 0x43d6fd
je 0x417ad0
retf
je 0x43d6fd
fxch st(5)
mov bx, bx
push esi
mov esi, esi
mov byte [esi + 0xba], cl
shr edi, 0x40
shr esi, 0x40
mov bx, bx
mov byte [esi + 0xbb], 0
shr bp, 0x40
xchg bl, ah
mov bh, bh
xchg ah, bl
mov word [esi + 0xbc], dx
call fcn.00439725
mov al, byte [ebp + 0xb]
shr cx, 0x40
mov cx, cx
jmp 0x41a737
push esi
xchg bp, ax
mov bx, bx
shl bp, 0x20
xchg bp, ax
mov byte [esi + 0xba], bl
jne 0x42bea0
mov cx, cx
je 0x41a759
sti
popfd
cmpsd dword [esi], dword es:[edi]
je 0x42bea0
je 0x42bea0
and eax, 0xa2a96859
inc ecx
add bl, al
or byte [ecx + edx*2 + 0x1e23e852], 2
add byte [ebx + 0xff0ff06], cl
sbb dword [eax + 0x70000070], 0x4eb65803
shr cx, 0x40
shl bx, 0x20
mov byte [esi + 0xbb], 0
jmp fcn.00405ad8
jmp 0x41eb0d
push eax
shr ch, 0x40
shl cx, 0x20
shr dh, 0x40
jmp 0x41eb1a
push esi
xchg bl, al
xchg al, bl
push 0
mov byte [esi + 0xba], cl
shr cl, 0x40
jmp 0x41ac33
jmp dword [esi]
jmp dword [esi]
mov ax, word [eax]
shr ah, 0x40
ja 0x4296cd
jbe 0x4340cd
pop ecx
mov esi, 0xfa860fa3
push ebp
invalid
jbe 0x4296cd
mov ebp, esp
mov eax, dword [0x46b1f5]
xor ecx, ecx
jb 0x40fac9
cmp ax, 0xffff
je 0x4062bf
jne 0x43a2fb
ljmp 0x558b:0x6649273d
mov dx, word [ebp + 8]
test bh, 0xa4
cmp ax, dx
je 0x4062ce
jne 0x43a30f
std
aaa
inc ecx
xchg ah, bh
xchg bh, ah
mov eax, ecx
clc
and eax, 0xffff
jb 0x40fad4
mov ax, word [eax + eax + 0x46b1f5]
cmp ax, 0xffff
jne 0x43a2ff
je 0x43a339
or al, 0xa4
ret
ja 0x4062bc
jbe 0x43a345
nop
cpuid
ret 0x860f
jbe 0x4062bc
mov eax, dword [ebp + 0xc]
cmp eax, 0x9c40244c
je 0x410195
jne 0x43a35e
push ss
test byte [ebx - 0x75], cl
dec ebp
and al, 0x8b
push ebp
and byte [edi], cl
xchg edx, edi
pop ebp
std
push dword [esi + 3]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
ja 0x410164
jbe 0x43a36f
retf
jbe 0x410164
and byte [ecx], 0x8d
jbe 0x43a382
js 0x42cf81
jns 0x43a384
rol byte [esi + 0xf], 1
mov edi, esi
sub edi, edi
push dword [0x448b66b1]
jns 0x42cf81
xor eax, 0x448b66b1
add eax, 0x3e850f00
mov edi, edi
jmp dword [esi - 0x3f]
push ebp
jmp 0x43a2dc
Function at 0x4091a1
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop dword [esp - 4]
mov eax, dword [0x46ab51]
test eax, eax
jb 0x439003
xchg dl, dh
xchg dh, dl
jne 0x43a34b
je 0x4091c1
fadd st(0), st(0)
std
call fcn.00421307
test eax, eax
jb 0x4201e1
xchg bx, di
xchg di, bx
jne 0x43a34b
je 0x4091df
js 0x409223
adc eax, 0x89665e5f
rcr byte [ebx + 0x5d], 0xc3
ret 0xf1d
pop edi
pop esi
mov ax, ax
pop ebx
pop ebp
ret
sbb esi, dword [edi + 0x61000042]
add byte [eax + 0x38], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cwde
aaa
inc ebx
add byte [esi - 0x2f], ah
inc edx
add byte [eax], dh
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
movsb byte es:[edi], byte [esi]
pop dword [ecx]
and byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
movsb byte es:[edi], byte [esi]
pop dword [ecx]
or al, 0
add byte [eax], al
xor al, 0
add byte [eax], al
invalid
add eax, 0xff5e8d57