joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d7e
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
mov dword [ebp - 4], 1
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
push 0
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push 4
push eax
push 4
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jge 0x401de9
push str.____Socket_bind_error._r_n
jmp 0x401dfd
push 5
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jge 0x401e08
push str.____Socket_Listen_error._r_n
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
xor eax, eax
leave
ret
push 1
pop eax
leave
ret

Function at 0x401e0d
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
jne 0x401e44
call sub.MSVCRT.dll__errno
push dword [eax]
call dword [sym.imp.MSVCRT.dll_strerror]
push eax
push dword [ebp + 0xc]
push str.____Gethostbyname__s__error:_s_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 0x10
jmp 0x401e90
push 0x10
lea eax, [ebp - 0x10]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov word [ebp - 0x10], 2
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov eax, dword [esi + 0xc]
push 0x10
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jge 0x401e94
push str.____Connect_error._r_n
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
xor eax, eax
jmp 0x401e97
push 1
pop eax
pop esi
leave
ret
Function at 0x401f1c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4030e8
push 0x402050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x404728], 0xffffffff
or dword [0x40472c], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x404724]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x404720]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x404730], eax
call fcn.0040204d
cmp dword [0x404700], 0
jne 0x401f9f
push 0x40204a
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00402038
push 0x40400c
push 0x404008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x40471c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x404718]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x404004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call section..text
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4498da
Capabilities:
Get disk information

Disassembly:
int3
inc esi
jo 0x44985d
je 0x449906
and byte [ecx + 0x19], 0xfb
xor eax, eax
mov word [ecx + 0x16], ax
mov edx, dword [esi + 0x138]
mov dword [ecx + 0x5a], edx
mov eax, dword [esi + 0x13c]
mov dword [ecx + 0x5e], eax
mov dx, word [esi + 0x140]
mov word [ecx + 0x62], dx
test dword [esi + 0x70], 0x2000
je 0x449924
fld dword [esi + 0x15c]
fstp dword [ecx + 0x28]
mov eax, dword [esi + 0x234]
xor al, 2
add byte [eax], al
mov dword [ecx + 0xfc], eax
test dword [esi + 0x70], 0x400
je 0x449937
cmp byte [ecx + 0x18], 0x10
jne 0x449937
mov byte [ecx + 0x18], 8
test dword [esi + 0x70], 0x4000
je 0x449944
or byte [ecx + 0x19], 2
test dword [esi + 0x70], 0x600000
je 0x449951
and byte [ecx + 0x19], 0xfd
test byte [esi + 0x70], 0x40
je 0x449975
mov al, byte [ecx + 0x19]
cmp al, 2
je 0x449962
cmp al, 6
jne 0x449975
cmp dword [esi + 0x1ec], 0
je 0x449975
cmp byte [ecx + 0x18], 8
jne 0x449975
mov byte [ecx + 0x19], 3
test byte [esi + 0x70], 4
je 0x449985
cmp byte [ecx + 0x18], 8
jae 0x449985
mov byte [ecx + 0x18], 8
mov al, byte [ecx + 0x19]
mov dl, 1
cmp al, 3
je 0x449998
test al, 2
je 0x449998
mov byte [ecx + 0x1d], 3
jmp 0x44999b
mov byte [ecx + 0x1d], dl
test dword [esi + 0x6c], 0x400000

Function at 0x44999a
Capabilities:
Get disk information

Disassembly:
sbb eax, 0x6c46f7
add byte [eax], al
je 0x4499a9
and al, 0xfb
mov byte [ecx + 0x19], al
mov al, byte [ecx + 0x19]
test al, 4
je 0x4499b3
add byte [ecx + 0x1d], dl
test dword [esi + 0x70], 0x8000
je 0x4499d5
cmp al, 2
je 0x4499c4
test al, al
jne 0x4499d5
add byte [ecx + 0x1d], dl
test dword [esi + 0x70], 0x1000000
je 0x4499d5
or al, 4
mov byte [ecx + 0x19], al
test dword [esi + 0x70], 0x100000
je 0x4499f4
mov al, byte [esi + 0x64]
cmp byte [ecx + 0x18], al
jae 0x4499e9
mov byte [ecx + 0x18], al
mov al, byte [esi + 0x65]
cmp byte [ecx + 0x1d], al
jae 0x4499f4
mov byte [ecx + 0x1d], al
mov al, byte [ecx + 0x18]
imul byte [ecx + 0x1d]
mov byte [ecx + 0x1e], al
cmp al, 8
pop esi
Function at 0x523fba
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
imul ebp, dword [edi + 0x6665f217], 0x3c5be65c
or al, 0x14
inc ecx
invalid
dec ebp
mov al, byte [0xcaa07578]
scasb al, byte es:[edi]
out 0xe, eax
clc
shr eax, 1
xchg ebp, eax
mov ecx, 0x33a68a79
add al, 0xb3
dec ecx
mov ah, byte [esi + 0x49b30433]
push eax
mov edi, 0x96a12363
pop eax
out 0xba, eax
cmc
dec eax
inc edi
jne 0x523f4b
cmpsb byte [esi], byte es:[edi]
enter 0x1b96, 0xffffffffffffffa0
std
sbb eax, 0x64aa3bf4
je 0x523f8e
cmpsb byte [esi], byte es:[edi]
js 0x523ff8
aaa
test al, 0xd9
sbb al, 0xf4
leave
jge 0x523fa6
jne 0x523f13
push esp
adc bl, byte [esi]
cld
push es
mov cl, 0x7d
fsubr dword [eax]
aam 0xf8
clc
mov ecx, 0xfd1cda11
sub cl, 6
into
pop es
loop 0x524017
lcall 0x4ec0, 0xbd234967
push ecx
and eax, 0x4ea6e87b
ror byte [esi + 0x51], 0x25
jnp 0x523f94
cmpsb byte [esi], byte es:[edi]
dec esi
mov cl, 0x7b
add al, 0x27
in al, dx
movsb byte es:[edi], byte [esi]
clc
xchg esp, edx
adc dword [edi], 0x7d55820b
adc byte [ebp + 0x7d], 0x64
fimul word [ecx]
adc byte [ebp + 0x7d], 0x64
fimul word [ecx]
adc al, 0x2b
mov esp, ebx
xlatb
jmp 0x523f5b
out dx, eax
cmp eax, 0x60a6037f
insd dword es:[edi], dx
jge 0x524020
fucompi st(4)
mov gs, ecx
adc byte [bp + si], 0xe2
mov ebx, 0x23a6e501
mov dh, 0x3c
xor esi, dword [ecx]
add ah, byte fs:[eax - 0x1e07269a]
loop 0x523fc5
add ebp, esp
cmpsb byte [esi], byte es:[edi]
and esi, dword [esi + 0x6431333c]
add ah, byte [eax - 0x1e07269a]
clc
loope 0x523fc4
stosb byte es:[edi], al
std
cdq
in al, dx
xor dword [esi], ecx
xor byte [ecx + 0x52], ch
mov byte [0xf2249baf], al
imul edx, dword [edx - 0x5e], 0xf2249baf
and dword [0xec2149e9], 0xffffffbc
enter 0x3302, 0x71
jg 0x524008
out dx, eax
mov ecx, 0xdc3a5f1f
sal byte [ecx], 0xfd
inc ecx
cdq
cmc
sbb byte [edx + 0x12a01b29], 0x94
sub dword [0x7d4d82bb], 0x1e
pop ebp
int 0x8b
test eax, 0x6ececf03
jmp 0x524066
push 0x28
dec esp
out dx, al
sub eax, 0x37f68d35
and byte [edx + 0x1a], 0x20
pushal
sbb eax, dword [eax]
imul ebp, edi, 9
xchg ebx, eax
push 0xc4e706d9
or dword [ecx + 0x112d9b75], ebx
ficomp dword [ebx + ecx*8]
or byte [edi - 0x3f], 0xbe
lahf
jg 0x524095
add esp, dword [esi + ecx + 0x54]
loope 0x524058
imul edi, dword [edi], 0xd5789349
pop es
mov byte [0x2a642447], al
dec eax
adc byte gs:[esi], 0xe1
invalid
Function at 0x560c84
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x543821d1
pop ebx
inc edx
int1
xchg ebx, eax
and dword [ebx + 0x45], esi
dec ebp
fsub qword [edx - 0x637de37e]
mov eax, dword [0x62ddb138]
mov bl, dl
loope 0x560be2
mov cl, 0xdd
bound ecx, qword [eax - 0x531b1e2d]
lodsb al, byte [esi]
inc edx
xchg ebx, eax
mov byte [edx + 0x15], cl
and eax, dword [esi]
xor al, 2
mov bl, 0x82
xlatb
push esi
ret
mov edx, 0x20f515f4
shr dword [edx - 0x5e5b22b5], cl
cmp sp, word [eax]
je 0x560c4c
imul esi, edx, 0x73
sal byte [ebx + 0x1fa83a0], 0xf2
pop edx
clc
cmp eax, 0x429b49a2
and edx, dword [eax + 0x2a]
mov eax, dword [0x7c81b123]
adc al, 0xd8
jae 0x560c60
push esi
sbb eax, 0xf6d1211a
loop 0x560bf7
mov word [eax - 0x26], es
ja 0x560c1e
wait
jae 0x560be9
out 0x62, eax
inc edx
ficomp dword [ecx + 0x1c]
scasb al, byte es:[edi]
pop edi
mov ah, byte [ebx]
dec ecx
imul ebp, ebx, 3
jb 0x560c31
mov dword [0x8fe5be20], eax
out 0xdd, eax
or al, byte [edx]
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
or ah, ch
xlatb
fisub dword [edx]
mov dword [0xb50f9be5], eax
cmp ch, byte [eax + eax + 0x52c73aa2]
lodsb al, byte [esi]
add byte [edx - 0x6bad38c6], ah
lodsb al, byte [esi]
add byte [edx - 0x6bad38c6], ah
lea esi, [ebx + 0x67]
cli
xchg esi, eax
mov dword [0xd4b7cc15], eax
loope 0x560cee
in eax, 0xef
aad 0
push ebp
fcmovbe st(0), st(0)
inc esp
ror dword [eax], 1
and esi, dword [esi]
test byte [edx + 0x252bf75], cl
adc esp, dword [edi]
jne 0x560c68
push edx
add dl, byte [ebx]
daa
stosb byte es:[edi], al
jle 0x560d17
jns 0x560ca7
push ebx
xchg esp, eax
ret 0xc7a3
pushal
inc esi
loop 0x560c73
and edx, edi
sub dword [ecx], 0x74
mov byte [0xdfa382c5], al
insb byte es:[edi], dx
loop 0x560ced
dec edi
jbe 0x560d59
arpl word [ebx], cx
add esp, dword [edi]
ret 0x46b5
les edx, [ecx]
lea eax, [0x13befc15]
and dh, byte [ebx + eax*2 - 0x48e9effa]
xor bl, byte [edx]
push ecx
inc ecx
cld
mov esi, 0x43b42213
push es
adc byte [esi], dl
mov bh, 0x32
sbb dl, byte [ecx + 0x41]
mov dh, 0xd0
bound esp, qword [ecx + 0x22]
jb 0x560d19
inc ecx
mov esi, 0xa106f4f3
xor dl, 0x62
sar byte [edx - 0x2e9a7909], 1
xor eax, dword [edx - 0x7dceddec]
shr dword [edi + edx*4], 0x2b
push 0x83079e62
xchg ebp, eax
jbe 0x560d1c
push 0xffffffffffffffc5
shr byte [esi + 0x63c0f90a], cl
push edi
stc
shl byte [ebx - 1], 0xf7
out dx, eax
insb byte es:[edi], dx
xor dword [edx - 0x2a], edx
add ah, byte [ebx]
pop esi
ret 0x5d7b

Function at 0x5e7ade
Capabilities:
Encode data using xor

Disassembly:
fst dword [esi - 0x34]
mov eax, 0xad96bcd5
wait
sub ecx, dword [eax]
bound edi, qword [eax + 0x19]
invalid

Function at 0x5fedfa
Capabilities:
Encode data using xor

Disassembly:
fidivr dword [edi + 0x415c05d5]
pop esp
inc ecx
mov word [edi - 0x30], cs
push ds
sub al, 0xf8
xor cl, ch
and esp, dword [eax + 0x4c]
pop esp
inc ebp
mul dword [0x13b09cb0]
shr byte [eax], 1
lodsb al, byte [esi]
pop esp
arpl word [eax], ax
loope 0x5fedf6
push ebx
retf 0x9d41
Function at 0x633393
Capabilities:
Encode data using xor

Disassembly:
dec dword [ecx + 0x4a]
jmp 0xa7757aed
jnp 0x63333d
mov byte [ecx + ecx*4 - 0x27dc2412], ah
pop esp
int 0x3a
test dword [edi], ecx
cwde
clc
leave
mov edx, 0xc740594b
sub dword [edi], ebx
jecxz 0x633268
sub eax, 0x71204156
invalid
jge 0x6332bf
invalid
sub dh, ch
mov esp, 0xcb1f5514
mov ah, 0x86
cmp ebp, ecx
inc ebx
xchg byte [ecx], bh
int 0x43
shr dword [edi], 1
lahf
inc edi
mov dword [ebx - 0x659b5256], eax
mov dh, 0x50
cmpsb byte [esi], byte es:[edi]
cmp eax, 0xd1eb6fb9
dec ebp
push 0xb8cf03f5
neg byte [esi]
push ss
pop esi
sbb edi, ebp
xchg esi, eax
cmp ah, byte [ecx - 0x7c]
cdq
xchg edi, eax
in al, dx
jmp 0xe4d47cf3
lcall 0x6fb9, 0x3da650b6
jmp 0x63332c
jp 0x633351
jb 0x6333f6
mov edx, 0xc3b60afe
cmp ebx, dword [ebx]
mov cl, 0xe6
fistp word [ecx + 0xb]
xor ch, byte [edi]
xor esi, ebx
adc byte [eax - 0x45], al
jl 0x633345
outsb dx, byte [esi]
dec edi
ljmp 0x572c
sub byte cs:[edi + 0x33b5d7ea], bl
leave
jp 0x633417
bswap eax
cmp bh, byte [edx + 0x552102f3]
wait
imul ebx, dword [ebp - 0x50], 0xfb1e76e4
int3
add ecx, dword [ebp + edx*8 + 0x1e]
fcmovb st(0), st(2)
je 0x63348e
sbb al, 0xe1
aam 0xf1
rcr dword [edi + edi*2 + 0x7e], 0xc7
push cs
in eax, 0x7f
aad 0xab
jge 0x63348c
lodsd eax, dword [esi]
push ds
sahf
cmp esi, ecx
dec ecx
xor byte [ecx], bl
ret 0x8a14
aam 0x31
popal
mov ebx, 0x65f9499e
xchg edx, eax
stc
xchg edx, eax
pop ebx
sbb ebx, eax
lodsb al, byte [esi]
cdq
pop edx
sub eax, 0x39f0558a
xor byte [ecx], ch
sar ebp, 0x2d
and al, 2
fld dword [edx + 2]
or dword [ebp - 0x6747bca], esp
pop ebp
mov edi, 0xfcfa768a
mov edi, 0xfcfa768a
jbe 0x63348a
cld
xchg edi, eax
pushfd
xchg esp, eax
inc eax
push 0x5c
jl 0x633466
stosd dword es:[edi], eax
xor al, 0x16
xchg ebp, eax
and al, 0xea
lodsb al, byte [esi]
fist word [edi]
cld
cmp dword [eax - 0x424fa816], edi
mov eax, 0xb3be3d03
pop ebx
mov ebp, 0xbe3d03b8
mov bl, 0x5b
mov dword [0x5d428a71], eax
movsd dword es:[edi], dword [esi]
sub byte [eax + edx*4 - 0x31], ch
leave
je 0x6334a8
jge 0x63346c
imul dword [0x1b4a0f07]
mov es, word [eax]
mov edi, 0x4656a7ad
cmpsd dword [esi], dword es:[edi]
push esi
inc esi
lodsb al, byte cs:[esi]
outsd dx, dword [esi]
sub bh, byte [edx - 0x76a3ffba]
mov edx, 0x895c0046
sub byte [esi + 0x37], 0x92
cmp dword [ecx], esp
pop esi
mov bh, 0xaa
cli
xor cl, bh
jp 0x6334b4
sbb dword [ecx], ecx
leave
test al, 0x8f
lcall 0x8033, 0xbf206c73
push ecx
into
les edi, [edi - 0x6ea638e2]
salc
push eax
mov dword [ecx], esp
or ebp, edi
cmpsb byte [esi], byte es:[edi]
sub eax, 0x54015207
sar dword [0x7c944c9d], cl
jns 0x6334c9
lodsd eax, dword [esi]
push edx
push edi
pcmpgtw mm3, qword [edi]
cmc
sbb eax, 0xc2ca8f8a
sub bh, byte [edi + edi*2 + 0x8e1968c]
adc dword [ecx], ebx
pop ds
pop ss
and dword [edi + edi*8 + 0x4668ae17], eax
pop ebx
pop eax
wait
popal
mov dword [ebp - 0x39], edx
jno 0x6334d0
aas
or ecx, dword [ebx]
dec edx
pop esi
retf 0x3a0f
Function at 0x634932
Capabilities:
Encode data using xor

Disassembly:
dec esp
pop ecx
imul eax, dword [edi + ecx], 0xf0dac0f9
push esi
mov byte [0xef0b2056], al
mov ebx, 0x43de14c6
pop esp
mov al, byte [0x39e425e8]
imul ecx, dword [ecx + 0x37bd917f], 0x2c
aam 0xbc
invalid
invalid
fidivr word [eax + 0x56]
or cl, byte [ebx + 0x37e4fe7f]
xchg dword [edi], esi
fdivr dword [eax - 0x6eeeedeb]
rol byte [ebx + edi*8 - 0x8dde78f], 0xc
lahf
jo 0x634975
js 0x63492a
push edx
ja 0x634997
push cs
fsub dword [esi + 0x1233f14a]
stc
jle 0x6348f4
invalid
inc esi
int3
mov bh, al
cmp al, 0x24
cmp eax, 0xb0060d16
dec ebp
scasd eax, dword es:[edi]
or al, 0x82
cmpsb byte [esi], byte es:[edi]
fnstcw word [esi]
cdq
dec ebp
mov esi, 0x6f12de58
jge 0x634a08
mulps xmm3, xmmword [ecx - 0x1f]
invalid
in eax, 0x75
mov word [ebx], gs
in eax, dx
mov ch, 0xfc
fmul dword [0x83f5539b]
or dl, dh
retf
Function at 0x4011fc
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x254
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
xor ebx, ebx
call dword [sym.imp.msvcrt.dll_wcslen]
mov ebp, dword [sym.imp.msvcrt.dll_wcscpy]
lea edi, [esi + eax*2]
mov dword [esp], 0x4093f0
push edi
call ebp
pop ecx
pop ecx
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
and word [edi], bx
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x401249
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40130a
lea eax, [esp + 0x40]
push 0x4093ec
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x4012bd
lea eax, [esp + 0x40]
push 0x4093e4
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x4012bd
lea eax, [esp + 0x40]
push eax
push edi
call ebp
test byte [esp + 0x1c], 0x10
pop ecx
pop ecx
je 0x40129d
push 0x4093e0
push esi
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
mov ecx, esi
call fcn.004011fc
jmp 0x4012b7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4012b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x4012e3
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401249
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x12
jne 0x4012e3
xor ebx, ebx
push dword [esp + 0x10]
and word [edi], 0
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x401308
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x401308
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
Function at 0x40405f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
neg esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x404067
mov dword [ecx*4 + 0x40a1e0], eax
inc ecx
cmp ecx, 0x100
jb 0x404062
mov ecx, 0x400
mov eax, dword [ecx + 0x409de0]
mov edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x40a1e0]
add ecx, 4
cmp ecx, 0x2000
mov dword [ecx + 0x40a1dc], eax
jb 0x404090
mov eax, 0x4040e4
mov esi, 0x40417d
mov dword [0x40a1c0], eax
mov dword [0x40c1e0], eax
mov dword [0x40a1bc], esi
call fcn.004056c2
test eax, eax
jne 0x4040e2
mov dword [0x40c1e0], esi
pop esi
ret

Function at 0x4042b8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi]
test edi, edi
je 0x404300
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x4042d1
mov eax, edi
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x404307
test ecx, ecx
je 0x404300
test edi, edi
ja 0x4042c6
xor eax, eax
pop edi
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404302

Function at 0x40430f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi]
test edi, edi
je 0x404357
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x404328
mov eax, edi
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x40435e
test ecx, ecx
je 0x404357
test edi, edi
ja 0x40431d
xor eax, eax
pop edi
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404359
Function at 0x4053a6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
push edi
xor edi, edi
and edx, 7
cmp ecx, 5
jae 0x4053c2
xor eax, eax
jmp 0x4054e8
mov eax, dword [ebp + 8]
add dword [ebp + 0xc], 5
sub ecx, 4
add ecx, eax
push ebx
mov dword [ebp - 4], ecx
push esi
lea esi, [edi + eax]
jmp 0x4053e3
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4053e8
inc esi
cmp esi, dword [ebp - 4]
jb 0x4053d8
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, eax
sub edi, eax
cmp esi, dword [ebp - 4]
jae 0x4054d2
cmp ecx, 2
jbe 0x405404
xor edx, edx
jmp 0x40542f
shr edx, cl
test edx, edx
je 0x40542f
cmp edx, 4
ja 0x4054c7
cmp edx, 3
je 0x4054c7
mov ecx, edx
shr ecx, 1
movzx ecx, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
je 0x4054c7
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x4054c7
movzx eax, byte [esi + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 0xc]
add eax, edi
add edi, 5
cmp dword [ebp + 0x14], 0
mov ebx, ecx
je 0x40546e
add ebx, eax
jmp 0x405470
sub ebx, eax
test edx, edx
je 0x4054a1
and edx, 6
shl edx, 2
mov ecx, edx
mov edx, ebx
shr edx, cl
mov dword [ebp - 8], ecx
inc edx
test dl, 0xfe
jne 0x40549f
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [ebp + 0x14], 0
je 0x40549d
add ebx, eax
jmp 0x40549f
sub ebx, eax
xor edx, edx
mov eax, ebx
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
mov byte [esi + 1], bl
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
mov eax, dword [ebp + 8]
mov byte [esi + 4], bl
jmp 0x4053d3
or edx, 8
shr edx, 1
inc edi
jmp 0x4053d3
push 2
pop eax
shr edx, cl
cmp eax, ecx
mov ecx, dword [ebp + 0x10]
sbb eax, eax
not eax
and eax, edx
pop esi
mov dword [ecx], eax
mov eax, edi
pop ebx
pop edi
leave
ret 0x10
Function at 0x407dce
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x409170
call fcn.00407f78
cmp word [0x400000], 0x5a4d
jne 0x407e0d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x407e0d
movzx ecx, word [eax + 0x400018]
cmp ecx, 0x10b
je 0x407e26
cmp ecx, 0x20b
je 0x407e13
and dword [ebp - 0x1c], 0
jmp 0x407e3d
cmp dword [eax + 0x400084], 0xe
jbe 0x407e0d
xor ecx, ecx
cmp dword [eax + 0x4000f8], ecx
jmp 0x407e37
cmp dword [eax + 0x400074], 0xe
jbe 0x407e0d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x40a1b0], 0xffffffff
or dword [0x40a1b4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x40a1ac]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x40a1a8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40a1b8], eax
call fcn.00407f72
cmp dword [section..data], 0
jne 0x407e9a
push fcn.00407f72
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00407f60
push 0x40916c
push 0x409168
call sub.msvcrt.dll__initterm
mov eax, dword [0x40a1a4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x40a1a0]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x409164
push 0x409160
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00401315
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], 0
jne 0x407f12
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x407f47
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00407fb3
ret