joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401128
Capabilities:
Encode data using xor

Disassembly:
inc eax
add bh, bh
and eax, sym.imp.MSVBVM60.DLL__CIatan
jmp dword [sym.imp.MSVBVM60.DLL__CIcos]
push 0x402ddc
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bl, dh
jbe 0x4010de
fmul st(4), st(0)
pushfd
inc esi
movsb byte es:[edi], byte [esi]
inc ebx
and eax, 0xba242c8c
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
je 0x4011c9
add byte [ecx], al
add byte [eax], al
add byte [ecx + ebp*2 + 0x6f], dh
outsd dx, dword [esi]
outsb dx, byte [esi]
and byte [eax], ah
mov ecx, 0x31ccb3a4
add byte [eax], ah
cmp eax, 0
dec esp
xor dword [eax], eax
or dl, byte [edx + ecx - 0x70]
mov cl, 0xff
jo 0x401159
inc edx
mov eax, 0xbd734c1a
arpl word [ebx], cx
cmpsd dword [esi], dword es:[edi]
bound eax, qword [eax]
lcall 0x9d94, 0x450dd7c0
sar byte [0xe1c3888f], 1
cmp cl, byte [edi - 0x53]
xor ebx, dword [ecx - 0x48ee309a]
or al, 0
stosb byte es:[edi], al
add byte [eax - 0x2d], ah
xchg ebx, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
rcr byte [ebx], 0
add byte [esi], bh
add byte [eax], al
add byte [eax], al
add eax, 0x726f4600
insd dword es:[edi], dx
xor dword [eax], eax
or eax, 0x46000501
outsd dx, dword [esi]
jb 0x40124f
xor dword [eax], eax
sbb dword [ecx], eax
add byte [edx], al
and edi, edi
invalid
add byte [eax], al
add al, ch
add al, byte [eax]
add byte [esi], ah
add byte [eax], al
add byte [eax], dl
adc byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], ch
add dword [eax], eax
add byte [esi], cl
add eax, dword [eax]
add byte [eax], ch
add byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add al, 0
add byte [eax], al
add byte [eax], al
add byte [edx], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x800000], al
add byte [eax], al
add byte [eax + 0x8000], 0
add byte [eax], 0x80
add byte [eax - 0x7fffff80], al
add byte [eax - 0x3f3f4000], 0
add byte [eax], al
inc dword [eax]
add bh, bh
add byte [eax], al
add bh, bh
inc dword [eax]
inc dword [eax]
add byte [eax], al
inc dword [eax]
inc dword [eax]
invalid
Function at 0x40343c
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4141b4], 0
jne 0x40344a
call fcn.00403412
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x403477
test cl, 7
je 0x403477
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4141b0]
dec esi
inc ecx
jmp 0x403458
cmp esi, 8
jb 0x4034fb
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141b0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141b0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141b0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4141b0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141b0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141b0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141b0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141b0]
dec edi
jne 0x403481
xor edx, edx
test esi, esi
jbe 0x40351b
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4141b0]
inc edx
cmp edx, esi
jb 0x403502
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x403957
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00401200
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4039e6
push esi
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407e17
lea eax, [ebp - 0x800]
push eax
call fcn.0040b1f5
mov esi, eax
lea eax, [ebp - 0x800]
push eax
call fcn.00408629
test al, al
jne 0x4039c5
lea eax, [ebp - 0x1000]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040b1f5
lea esi, [esi + eax + 1]
mov eax, 0x104
pop edi
cmp esi, eax
pop esi
jbe 0x4039e6
push eax
push 0xe6e
call fcn.0040a4db
push eax
push 0
call fcn.004033ed
add esp, 0xc
leave
ret 8
Function at 0x405718
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30c0
call fcn.00401200
push ebx
push esi
push edi
lea ecx, [ebp - 0x30c0]
call fcn.00403d82
xor edi, edi
push edi
lea eax, [ebp - 0x30c0]
push eax
push dword [ebp + 8]
push edi
call fcn.00406d17
test al, al
je 0x4058bd
cmp word [ebp - 0x2440], di
je 0x4058bd
lea eax, [ebp - 0x2440]
push eax
lea eax, [ebp - 0x2cc0]
push eax
call fcn.00407ef1
push eax
call fcn.0040c47e
test eax, eax
je 0x4058bd
lea eax, [ebp - 0x2440]
push eax
push dword [ebp + 8]
call fcn.00407ef1
push eax
call fcn.0040c47e
test eax, eax
jne 0x4058bd
mov word [ebp - 0x800], ax
xor ebx, ebx
mov esi, 0x400
cmp word [ebp - 0x800], di
jne 0x40580e
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x800]
push eax
call fcn.0040bcca
push ebx
push str.rtmp_d
push esi
lea eax, [ebp - 0x800]
push eax
call fcn.00407ef1
push eax
call fcn.0040b433
add esp, 0x10
lea eax, [ebp - 0x800]
push eax
push edi
call fcn.004064d7
test al, al
je 0x4057f6
xor eax, eax
mov word [ebp - 0x800], ax
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x4057a7
cmp word [ebp - 0x800], di
je 0x4058bd
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040bcca
lea eax, [ebp - 0x2cc0]
push eax
call fcn.00407ef1
push eax
lea eax, [ebp - 0x1000]
push eax
call fcn.00407ef1
push eax
call fcn.0040b21f
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x4058bd
lea ecx, [ebp - 0x1c20]
call fcn.00405b6c
push dword [ebp + 8]
xor bl, bl
push edi
call fcn.004064d7
test al, al
jne 0x405884
push 1
push dword [ebp + 8]
lea ecx, [ebp - 0x1c20]
push edi
call fcn.00405ed9
mov bl, al
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x800]
push eax
call esi
test bl, bl
je 0x4058ae
lea ecx, [ebp - 0x1c20]
call fcn.00405bd7
lea ecx, [ebp - 0x1c20]
call fcn.00405c5c
lea ecx, [ebp - 0x1c20]
call fcn.00405d5b
mov al, 1
jmp 0x4058bf
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x405d7e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], bl
je 0x405d98
mov byte [ebp + 0x10], 1
mov dword [ebp - 4], 0x80000000
cmp byte [ebp + 0x14], bl
je 0x405dab
mov dword [ebp - 4], 0xc0000000
mov dword [ebp + 0x14], 1
cmp byte [ebp + 0x10], bl
je 0x405dbe
mov dword [ebp + 0x14], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.00406de6
test eax, eax
je 0x405df7
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x405df7
cmp word [eax], bx
je 0x405df7
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x405e0b
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405e27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x405e27
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x405e9f
mov dword [esi + 4], edi
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x405e60
push edi
call fcn.0040b1f5
lea eax, [eax + eax + 2]
push eax
push edi
lea eax, [esi + 0x418]
push eax
call fcn.0040af76
jmp 0x405e69
xor eax, eax
mov word [esi + 0x418], ax
cmp dword [ebp + 8], ebx
je 0x405e86
push dword [ebp + 8]
call fcn.0040afc1
inc eax
push eax
push dword [ebp + 8]
lea eax, [esi + 0x17]
push eax
call fcn.0040af76
jmp 0x405e95
push 0x1000000
lea eax, [esi + 0x17]
push eax
push edi
call fcn.0040c26b
push dword [esi + 4]
mov ecx, esi
call fcn.00405bb0
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x405fd6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x405ffc
cmp dword [ebp + 0xc], esi
jbe 0x405ff1
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40604c
mov ecx, edi
call fcn.00405d38
test al, al
je 0x406032
cmp dword [ebp + 0xc], esi
jbe 0x406032
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.00405fd6
jmp 0x40604f
cmp dword [edi + 0xc], 1
jne 0x406047
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x406047
xor eax, eax
jmp 0x40604f
or eax, 0xffffffff
jmp 0x40604f
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x406290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
je 0x4063a0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4062bd
dec eax
je 0x4062b2
dec eax
jne 0x4062bd
push 0xfffffffffffffff4
jmp 0x4062b4
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x40630c
cmp dword [ebp + 0xc], edi
jbe 0x406327
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov eax, 0x4000
cmp ecx, eax
jae 0x4062e4
mov eax, ecx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
je 0x406327
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x4062d4
jmp 0x406323
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
test al, al
jne 0x40639a
cmp byte [esi + 0x14], 0
je 0x40639a
cmp dword [esi + 0xc], 0
jne 0x40639a
push 0
lea eax, [esi + 0x418]
push eax
lea eax, [esi + 0x17]
mov edi, 0x415674
push eax
mov ecx, edi
call fcn.00403aff
test al, al
je 0x406384
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x4062c5
test eax, eax
jbe 0x4062c5
push 0
mov ecx, esi
call fcn.00405c8c
mov ecx, dword [ebp - 4]
xor edi, edi
sub eax, ecx
sbb edx, edi
push edx
push eax
mov ecx, esi
call fcn.004061f1
jmp 0x4062c5
lea eax, [esi + 0x418]
push eax
lea eax, [esi + 0x17]
push eax
push 0
push 0
mov ecx, edi
call fcn.00403c89
pop edi
mov byte [esi + 8], 1
pop ebx
pop esi
leave
ret 8

Function at 0x406490
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 8]
call fcn.00407da3
movsx eax, byte [ebp - 0x400]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x400]
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x4064d0
cmp eax, 5
je 0x4064d0
xor eax, eax
jmp 0x4064d3
xor eax, eax
inc eax
leave
ret 4

Function at 0x4064d7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00406de6
test eax, eax
je 0x406501
mov eax, dword [esp + 8]
test eax, eax
je 0x406501
cmp word [eax], 0
je 0x406501
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x40651e
cmp dword [esp + 4], 0
je 0x40651c
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40651c
xor eax, eax
inc eax
jmp 0x40651e
xor eax, eax
ret 8

Function at 0x40653e
Capabilities:
Get file attributes

Disassembly:
call fcn.00406de6
test eax, eax
je 0x40655e
mov eax, dword [esp + 8]
test eax, eax
je 0x40655e
cmp word [eax], 0
je 0x40655e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x406568
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8
Function at 0x40656b
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
call fcn.00406de6
test eax, eax
je 0x406590
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x406590
cmp word [eax], 0
je 0x406590
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x4065a2
cmp dword [ebp + 8], 0
je 0x4065a9
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
jmp 0x4065ab
xor al, al
pop ebp
ret 0xc

Function at 0x4065e1
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call fcn.00406de6
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test eax, eax
je 0x406607
cmp esi, ebx
je 0x406607
cmp word [esi], bx
je 0x406607
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x406616
cmp dword [ebp + 8], ebx
je 0x406644
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, ebx
je 0x40662f
cmp byte [ebp + 0x10], bl
je 0x40662b
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.0040656b
xor eax, eax
jmp 0x406647
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x406644
cmp eax, 3
je 0x406644
xor eax, eax
inc eax
jmp 0x406647
push 2
pop eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4086f2
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5b08
call fcn.00401200
push 1
call fcn.0040bee3
push 1
mov ecx, 0x415674
call fcn.00403a80
call fcn.0040bb51
push 0x400
lea eax, [ebp - 0x800]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1000000
lea eax, [ebp - 0xc00]
push eax
lea eax, [ebp - 0x800]
push eax
call fcn.0040c26b
push 0x8005
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x800]
push eax
mov ecx, 0x415680
call fcn.0040a391
lea ecx, [ebp - 0x5b08]
call fcn.00402dfc
push 0x41042c
lea eax, [ebp - 0x2445]
push eax
call fcn.0040b0b4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x4087fd
cmp byte [eax], 0x22
jne 0x408793
push 0x22
inc eax
push eax
call fcn.0040afea
test eax, eax
je 0x4087fd
push esi
push 0x410428
push eax
call fcn.0040b053
mov esi, eax
test esi, esi
je 0x4087fc
jmp 0x4087ac
inc esi
movsx eax, byte [esi]
push eax
call fcn.0040bc85
test al, al
jne 0x4087ab
movsx eax, byte [esi]
push eax
lea ecx, [ebp - 0x5b08]
call fcn.00402ad2
test al, al
je 0x4087fc
movzx eax, byte [esi + 1]
push eax
call fcn.0040bc3f
movzx eax, al
mov ecx, eax
sub ecx, 0x3f
je 0x4087f1
sub ecx, 0x15
je 0x4087e9
dec ecx
dec ecx
jne 0x4087fc
mov byte [ebp - 0x2445], al
jmp 0x4087fc
lea ecx, [ebp - 0x5b08]
call fcn.004028f1
pop esi
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0xc00]
push eax
lea ecx, [ebp - 0x5b08]
call fcn.00402aa7
lea ecx, [ebp - 0x5b08]
call fcn.00402afd
push dword [ebp - 0x2de8]
push dword [ebp - 0x2dec]
call fcn.00402e40
lea eax, [ebp - 0x31ef]
push eax
call fcn.00402e2f
cmp byte [ebp - 0x2da0], 0
jne 0x408854
cmp dword [ebp - 0x2dec], 3
je 0x408854
xor al, al
jmp 0x408856
mov al, 1
mov byte [0x41567d], al
mov al, byte [ebp - 0x285e]
lea ecx, [ebp - 0x5b08]
mov byte [0x41567e], al
call fcn.00402897
lea ecx, [ebp - 0x5b08]
call fcn.00402a27
lea ecx, [ebp - 0x5b08]
call fcn.00402d26
call fcn.00406176
mov eax, dword [0x415674]
leave
ret
Function at 0x40a5af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 8], ecx
call fcn.0040aec3
xor eax, eax
push 4
xor ecx, ecx
mov dword [ebp + 8], eax
xor ebx, ebx
pop edx
cmp eax, 0xa
jg 0x40a6bd
cmp ebx, edx
jge 0x40a604
lea esi, [ebp + ebx*4 - 0x28]
mov dword [ebp - 4], esi
cmp ecx, edx
jge 0x40a606
mov edi, dword [ebp - 8]
lea esi, [ecx + eax*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, dword [ebp - 4]
add dword [ebp - 4], edx
inc ebx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a5e9
cmp ecx, edx
jne 0x40a60e
inc eax
mov dword [ebp + 8], eax
xor ecx, ecx
cmp ebx, edx
jl 0x40a5d5
cmp eax, 0xa
jg 0x40a6bd
mov dword [ebp - 4], 0x4196a8
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x4197c8]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x4197c8]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x4197c8]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x4197c8]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x24]
pop edi
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x40a669
add eax, edx
dec edi
jne 0x40a667
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x40a6bd
cmp ebx, edx
jge 0x40a6a6
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x40a6a8
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a68a
cmp ecx, edx
jne 0x40a6af
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x40a67c
cmp dword [ebp + 8], 0xa
jle 0x40a622
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40a6c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
add ecx, 0x24
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 9
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x4166a8]
xor dl, byte [eax + ebx*4 + 0x416ea8]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x4172a8]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x416aa8]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x40a6ec
inc eax
cmp eax, edi
jl 0x40a6df
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0040aec3
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x40a6dd
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b95b
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4
Function at 0x401491
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x42a610]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x408004]
cmp eax, ebx
jne 0x401526
mov esi, dword [section..rdata]
mov edi, 0x105
jmp 0x4014e3
cmp dword [ebp + 0x10], ebx
jne 0x40151a
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.00401491
test eax, eax
jne 0x4014f5
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014ca
push dword [ebp - 4]
call dword [0x408008]
push 2
call fcn.00405eee
cmp eax, ebx
je 0x40152d
push ebx
push dword [0x42a610]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401526
push dword [ebp - 4]
call dword [0x408008]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a610], ebx
jne 0x401523
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x40800c]
test eax, eax
jne 0x401523
jmp 0x401526
Function at 0x405cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x408004]
test eax, eax
jne 0x405d29
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x800
push dword [ebp + 0x18]
call dword [0x40801c]
test eax, eax
jne 0x405d12
cmp dword [ebp + 0x14], 1
je 0x405d17
cmp dword [ebp + 0x14], 2
je 0x405d17
xor eax, eax
mov word [esi], ax
push dword [ebp + 0x18]
xor eax, eax
mov word [esi + 0x7fe], ax
call dword [0x408008]
pop esi
pop ebp
ret 0x14
Function at 0x4095aa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bb468]
jne 0x4095b4
repz ret
jmp fcn.0040bd76

Function at 0x40ba0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bb468]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00408428
and dword [ebp - 0x14], 0
cmp dword [0x4bff30], 0
mov dword [ebp - 0x18], eax
jne 0x40babe
push 0x4029b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40bb66
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4029a4
push ebx
call edi
test eax, eax
je 0x40bb66
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402994
push ebx
mov dword [0x4bff30], eax
call edi
push eax
call esi
push 0x402980
push ebx
mov dword [0x4bff34], eax
call edi
push eax
call esi
push 0x402964
push ebx
mov dword [0x4bff38], eax
call edi
push eax
call esi
mov dword [0x4bff40], eax
test eax, eax
je 0x40babe
push 0x40294c
push ebx
call edi
push eax
call esi
mov dword [0x4bff3c], eax
mov eax, dword [0x4bff3c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40bb17
cmp dword [0x4bff40], ecx
je 0x40bb17
push eax
call esi
push dword [0x4bff40]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40bb17
test ebx, ebx
je 0x40bb17
call edi
test eax, eax
je 0x40bb0e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40bb0e
test byte [ebp - 8], 1
jne 0x40bb17
or dword [ebp + 0x10], 0x200000
jmp 0x40bb4a
mov eax, dword [0x4bff34]
cmp eax, dword [ebp - 0x18]
je 0x40bb4a
push eax
call esi
test eax, eax
je 0x40bb4a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40bb4a
mov eax, dword [0x4bff38]
cmp eax, dword [ebp - 0x18]
je 0x40bb4a
push eax
call esi
test eax, eax
je 0x40bb4a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4bff30]
call esi
test eax, eax
je 0x40bb66
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40bb68
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004095aa
leave
ret