joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100168be
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100168f3
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100168f1
push 0x23c6
push 0x2235
push 0
push 0xa60
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1001690a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1001ca5e
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001cab9
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001ca9a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1001cab7
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016fe2
mov dword [eax], 0x84cb
jmp 0x1001ca8f
jmp 0x1001cae8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001cae8
push 0x23c6
push 0x2235
push 0
push 0xa60
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x1002bd05
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002bd4d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1002bd5a
push 0x1704
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x1002fc08
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002fc2c
xor eax, eax
jmp 0x1002fd9f
lea eax, [ebp - 0x10]
push eax
push 0x3ca3
push 0x7640
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.1002fa26
add esp, 0x18
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002fc5e
xor eax, eax
jmp 0x1002fd9f
push 0x507a
lea eax, [ebp - 0xc]
push eax
push 0x3923
push 0x1315
push dword [ebp - 8]
push 1
call fcn.1002f6c4
add esp, 0x18
cmp dword [ebp - 0xc], 0
jne 0x1002fc8b
xor eax, eax
jmp 0x1002fd9f
lea eax, [ebp - 0x24]
push eax
push 0x4d17
push 1
push dword [ebp - 8]
push 0x3aa5
push dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002f8aa
add esp, 0x20
push 0x1bd0
push dword [ebp - 4]
push dword [ebp + 8]
push dword [ebp - 8]
push 0
call fcn.1002dc36
add esp, 0x14
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push 0x3036
call fcn.1002fabb
add esp, 0x14
cmp dword [ebp - 0x14], 0
je 0x1002fd06
push 0x6b0e
push 0x53a1
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1002fb27
add esp, 0x14
push dword [ebp - 4]
call fcn.1002e9a7
pop ecx
test eax, eax
jne 0x1002fd1a
xor eax, eax
jmp 0x1002fd9f
push 0x5694
push 0
push 0x1f11
push 0x6386
lea eax, [ebp - 4]
push eax
call fcn.1002fda3
add esp, 0x14
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002fd87
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002fd56
xor eax, eax
jmp 0x1002fd9f
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002fd6f
xor eax, eax
jmp 0x1002fd9f
push 1
push 0x4297
push 0x2df9
lea eax, [ebp - 4]
push eax
call fcn.1002fbba
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002fd98
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002fd9c
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10046000
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1004604f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1004604a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x217
push 0x1910
push 0x249b
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1004618d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jg 0x10046094
mov dword [ebp - 0x10], 1
jmp 0x10046098
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp dword [ebp - 0x10], 6
jge 0x100460af
mov dword [ebp - 0x40], 1
jmp 0x100460b3
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jle 0x100460d0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x100460d0
mov dword [ebp - 0x14], 1
jmp 0x100460d4
and dword [ebp - 0x14], 0
push 0
mov ecx, dword [ebp - 8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax]
je 0x100460f7
mov eax, 0x8d46758e
test eax, eax
je 0x100460f7
mov dword [ebp - 0x44], 1
jmp 0x100460fb
and dword [ebp - 0x44], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 0x4392f209
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x3529
jl 0x1004611e
mov dword [ebp - 0x18], 1
jmp 0x10046122
and dword [ebp - 0x18], 0
push 0
mov ecx, dword [ebp - 8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax]
jge 0x1004613c
mov dword [ebp - 0x1c], 1
jmp 0x10046140
and dword [ebp - 0x1c], 0
push 0
mov ecx, dword [ebp - 8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax]
cmp ecx, 1
ja 0x1004615d
mov dword [ebp - 0x20], 1
jmp 0x10046161
and dword [ebp - 0x20], 0
mov esi, dword [ebp - 0x20]
add esi, 0x649bc00e
push 0
mov ecx, dword [ebp - 8]
call fcn.10016fe2
cmp esi, dword [eax]
jle 0x10046181
mov dword [ebp - 0x24], 1
jmp 0x10046185
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100468e3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10046900
push 0x1704
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x1004694b
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004692e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1004694b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016fe2
mov dword [eax], 0x14c405b4
jmp 0x10046923
mov esp, ebp
pop ebp
ret

Function at 0x10047442
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004746b
push 0x23c6
push 0x2235
push 0
push 0xa60
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x100474b6
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10047499
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x100474b6
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016fe2
mov dword [eax], 1
jmp 0x1004748e
mov esp, ebp
pop ebp
ret
Function at 0x10089485
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10094330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1007be56
mov dword [ebp - 0x14], eax
cmp dword [0x10681850], esi
jne 0x10089578
push 0x800
push esi
push 0x1000803c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10089505
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10089658
push esi
push esi
push 0x1000803c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10089658
push 0x10008054
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10089658
push eax
call ebx
push 0x10008060
push edi
mov dword [0x10681850], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008070
push edi
mov dword [0x10681854], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008084
push edi
mov dword [0x10681858], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10681860], eax
test eax, eax
je 0x10089575
push 0x100080a0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1068185c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1008959d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10089590
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100895b2
push 4
pop eax
jmp 0x1008965a
cmp dword [ebp - 0x14], esi
je 0x100895b2
push dword [0x10681850]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10089597
mov eax, dword [0x1068185c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10089610
cmp dword [0x10681860], edi
je 0x10089610
push eax
call ebx
push dword [0x10681860]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10089610
test eax, eax
je 0x10089610
call ecx
test eax, eax
je 0x10089605
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10089605
test byte [ebp - 8], 1
jne 0x10089610
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10089640
mov eax, dword [0x10681854]
cmp eax, edi
je 0x1008963d
push eax
call ebx
test eax, eax
je 0x1008963d
call eax
mov esi, eax
test esi, esi
je 0x1008963d
mov eax, dword [0x10681858]
cmp eax, edi
je 0x1008963d
push eax
call ebx
test eax, eax
je 0x1008963d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10681850]
call ebx
test eax, eax
je 0x10089658
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1008965a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x432006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xaf040f2
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..text_1
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6c6529e6
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x13cc478
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.013cc5c8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x13cc49e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13cc48a
add dl, dl
jne 0x13cc4a9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13cc4fc
xor eax, eax
add dl, dl
jne 0x13cc4b6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13cc59d
add dl, dl
jne 0x13cc4c5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13cc4d0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13cc4db
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13cc4e6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x13cc4f2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x13cc495
mov eax, 1
add dl, dl
jne 0x13cc50a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13cc515
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13cc501
sub eax, ebx
mov ebx, 1
jne 0x13cc548
mov ecx, 1
add dl, dl
jne 0x13cc52e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x13cc539
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13cc525
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13cc495
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x13cc55f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x13cc56a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13cc556
cmp eax, 0x7d00
jae 0x13cc58d
cmp eax, 0x500
jb 0x13cc588
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13cc495
cmp eax, 0x7f
ja 0x13cc590
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13cc495
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x13cc5be
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x13cc495
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4050f5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x443d70
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042e8c4
add esp, 0x10
leave
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x40511b

Function at 0x40693c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x406964
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x406956
pop edi
pop esi
pop ebp
ret 4

Function at 0x408810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
mov ebx, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x30], ebx
push esi
push edi
test ebx, ebx
je 0x446545
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov eax, dword [esi]
mov ecx, dword [esi + 0x50]
mov dword [ebp - 0x28], ecx
cmp eax, dword [esi + 4]
jae 0x44e68f
mov edx, dword [ebp - 8]
cmp dword [ebp + 0x18], 0
jne 0x446567
push 1
push 0
push 0
push 0
push 0
xor edx, edx
lea ecx, [ebp + 0x18]
call fcn.00408810
add esp, 0x14
jmp 0x4089db
lea eax, [ebp + 0x18]
sub eax, dword [ebp - 8]
cdq
xor eax, edx
sub eax, edx
neg eax
jmp 0x4089db
Function at 0x47ce44
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, ecx
push edi
push 0x4c6a94
push dword [esi + 0x34]
call fcn.0042e5eb
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x47ce70
mov dword [esi + 0x18], 0x1f
jmp 0x47ceea
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 8]
call dword [0x49c7bc]
test eax, eax
je 0x47cee3
cmp dword [ebp - 4], 0
je 0x47cebb
push edi
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x404]
push eax
call fcn.0042dbb3
mov eax, dword [ebp - 4]
add esp, 0x10
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x47ce76
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x47cecc
mov dword [esi + 0x18], 0x21
jmp 0x47ceea
and dword [esi + 0x18], 0
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x47cf06
push eax
call dword [0x49c2d4]
jmp 0x47cf06
mov dword [esi + 0x18], 0x20
call dword [0x49c334]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x47cf04
push eax
call dword [0x49c2d4]
xor bl, bl
test edi, edi
je 0x47cf11
push edi
call fcn.0042e678
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4

Function at 0x47d208
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xd0], 0
je 0x47d244
cmp byte [ebp + 8], 0
je 0x47d244
sub esp, 0x10
lea ecx, [esi + 0xd4]
call fcn.0047c118
push esi
push 0
push 0x47d2d8
call fcn.0042d1cc
add esp, 0xc
cmp dword [esi + 0x18], 0
sete al
jmp 0x47d24c
push dword [ebp + 8]
call fcn.0047c364
pop esi
pop ebp
ret 4

Function at 0x499576
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
push ecx
push ecx
or bh, bh
adc eax, 0xebffc578
xor ebx, ebx
or al, 0x48
cmp eax, 0xe
inc edi
add al, 0x8b
sub esp, 0x896607a8
jle 0x4995dd
retf
add byte [eax], al
cmp ecx, 0xfffffd09
je 0x499640
cmp ecx, 0xfffffd0e
je 0x499637
cmp ecx, 0xfffffd0f
je 0x499605
cmp ecx, 0xfffffd16
jne 0x499620
push ecx
jmp fcn.004497df
cmp byte [esi + 0x1c24449a], 1
jne 0x499617
push ecx
push dword [edi + 4]
call fcn.00497ead
mov word [esi - 0x1374aa67], 0
cmp byte [esi - 0x1374aa67], 0
mov byte [esi + 0x1c24449a], 1
jne 0x499620
mov byte [esi + 0x1c24449a], 0
push dword [edi + 8]
jmp 0xeccc97df
Function at 0x426ea0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426ecd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426ecd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1254294
Capabilities:
Encode data using xor

Disassembly:
jmp 0x125429e
pushal
call 0x12542a4
pop ebp
sub ebp, 0x10
sub ebp, 0xe54294
jmp 0x12542ba
mov eax, 0xe54294
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e6
mov edx, 0x15ae1f9e
xor byte [eax], dl
inc eax
dec ecx
jne 0x12542d1
jmp 0x12542e4
adc eax, 0xa2171553
sahf
sahf
sahf
pop ds
pop edi
sahf
sahf
sahf
popfd
push ebx
wait
sahf
sahf
sahf
and al, 0xb6
sahf
sahf
sahf
imul edi, dword [ebp + ebx*4 + 0x56], 0x9e921f15
sahf
sahf
popfd
pop ebx
into
into
div dh
ret 0x9ebc
Function at 0x10015037
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10015092
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10015073
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10015090
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.100185ec
mov dword [eax], 6
jmp 0x10015068
jmp 0x100150a6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100150a6
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret

Function at 0x10016004
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10016022
push 0x14a9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x10016051
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10016051
push 0x550
push 0xb02
push 0
push 0x18f9
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret

Function at 0x100163ba
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100163e0
push 0x550
push 0xb02
push 0
push 0x18f9
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x100163f4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
pop ebp
ret

Function at 0x10016f66
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10016f7b
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x10016f85
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
pop ebp
ret