joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4255d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push edi
push 0x98
xor ebx, ebx
lea eax, [esi + 0x110]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 0x34]
add eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x28]
lea edi, [ecx + eax]
mov dword [esi + 0x40], eax
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [esi + 0x18]
shr edx, 3
imul edx, edx, 0x54
mov ecx, edi
sub ecx, edx
add esp, 0xc
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0xc], eax
mov edx, eax
cmp eax, 0xc
jb 0x42562b
mov edx, 0xc
or eax, 0xffffffff
sub eax, edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
lea eax, [edi - 0xc]
lea edx, [ecx + 0x600]
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 8], ecx
mov edx, 0x100
mov word [eax], dx
mov edx, 0x101
mov word [eax + 2], dx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
xor edx, edx
lea eax, [ecx + 2]
lea esp, [esp]
xor ecx, ecx
mov byte [eax - 2], dl
mov byte [eax - 1], 1
mov word [eax], cx
mov word [eax + 2], cx
inc edx
add eax, 6
cmp edx, 0x100
jb 0x425670
lea edx, [esi + 0x9fc]
mov dword [esp + 8], edx
push ebp
jmp 0x4256a0
mov edi, dword [esp + 0xc]
xor ebp, ebp
jmp 0x4256b0
movzx eax, word [ebp + 0x42dab0]
xor edx, edx
lea ecx, [ebx + 2]
div ecx
mov edx, 0x4000
sub edx, eax
movzx ecx, dx
xor eax, eax
lea ebx, [ebx]
mov word [edi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x4256d0
add ebp, 2
add edi, 2
cmp ebp, 0x10
jb 0x4256b0
sub dword [esp + 0xc], 0xffffff80
inc ebx
cmp ebx, 0x80
jb 0x4256a0
mov ecx, 0x50
lea edi, [esi + 0x3bc]
lea ebx, [ecx - 0x4c]
pop ebp
mov eax, edi
mov edx, 0x10
jmp 0x425710
mov word [eax], cx
mov word [eax + 2], 0x403
add eax, ebx
dec edx
jne 0x425710
add ecx, 0x28
add edi, 0x40
cmp ecx, 0x438
jb 0x425704
pop edi
mov dword [esi + 0x3b8], 0x40070000
pop ebx
pop ecx
ret
Function at 0x426640
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x426668
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x426677
mov eax, 1
ret 4

Function at 0x4272d0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x433158]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x4278e0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
and eax, 0x3f
mov byte [eax + esi + 0x40], 0x80
inc eax
push edi
mov edi, edx
cmp eax, 0x38
jbe 0x427923
cmp eax, 0x40
je 0x427915
mov edx, 0x40
sub edx, eax
push edx
lea ecx, [eax + esi + 0x40]
push 0
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
xor eax, eax
mov ecx, 0x38
sub ecx, eax
push ecx
lea edx, [eax + esi + 0x40]
push 0
push edx
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
add esp, 0xc
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
lea ecx, [esi + 0x20]
mov edx, 4
mov eax, dword [ecx + 4]
mov ebp, dword [ecx]
bswap ebp
bswap eax
mov dword [edi], ebp
mov dword [edi + 4], eax
add edi, 8
add ecx, 8
dec edx
jne 0x427968
xor eax, eax
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret
Function at 0x40b0e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
lea edi, [ebp - 0x64]
mov ecx, 0x19
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x529844]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], 0
mov esi, esp
push 0x40
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp esi, esp
call fcn.004035b2
mov eax, 1
imul ecx, eax, 0x3f
mov dword [ebp - 0x120], ecx
cmp dword [ebp - 0x120], 0x40
jae 0x40b13a
jmp 0x40b13f
call fcn.0040137f
mov edx, dword [ebp - 0x120]
mov byte [ebp + edx - 0x48], 0
push 3
call fcn.00402437
add esp, 4
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.004031b6
add esp, 8
push 0x4f9a8c
mov eax, dword [ebp - 0x54]
push eax
call fcn.004031b6
add esp, 8
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.004031b6
add esp, 8
push 0x4f9a90
mov eax, dword [ebp - 0x54]
push eax
call fcn.004031b6
add esp, 8
push 0
mov eax, dword [ebp - 0x54]
push eax
call fcn.004042a5
add esp, 8
push 0
mov eax, dword [ebp - 0x54]
push eax
call fcn.00401bef
add esp, 8
push edx
mov ecx, ebp
push eax
lea edx, [0x40b1e4]
call fcn.00402f72
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a8
add esp, 0x124
cmp ebp, esp
call fcn.004035b2
mov esp, ebp
pop ebp
ret
Function at 0x4bb470
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00401956
mov eax, dword [0x529844]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x52bea0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x4bb648
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x4bb597
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x4bb597
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x4bb575
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x4bb4f9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4bb601
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x4bb668
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x4bb643
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x4bb668
jmp 0x4bb4d2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a8
mov esp, ebp
pop ebp
ret
Function at 0x4bb700
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00401956
mov eax, dword [0x529844]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x52bea0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x4bb8eb
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x4bb836
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x4bb836
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x4bb812
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x4bb789
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4bb8a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x4bb90b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x4bb8e6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x4bb90b
jmp 0x4bb762
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a8
mov esp, ebp
pop ebp
ret
Function at 0x4dff30
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x529844]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x1a
jbe 0x4dffc6
call fcn.004015a0
mov dword [eax], 0xf
xor eax, eax
je 0x4dff60
mov dword [ebp - 0x14], 1
jmp 0x4dff67
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x4dff96
push str.__Invalid_Drive_Index___0_
push 0x500bf8
push 0
push 0x1f
push str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
push 2
call fcn.00401c9e
add esp, 0x18
cmp eax, 1
jne 0x4dff96
int3
cmp dword [ebp - 0x18], 0
jne 0x4dffc6
call fcn.00402d4c
mov dword [eax], 0xd
push 0
push 0x1f
push str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
push str.is_valid_drive
push str.__Invalid_Drive_Index___0_
call fcn.004048d1
add esp, 0x14
xor eax, eax
jmp 0x4e001f
cmp dword [ebp + 8], 0
jne 0x4dffd3
mov eax, 1
jmp 0x4e001f
mov eax, dword [ebp + 8]
add eax, 0x40
mov word [ebp - 0x10], ax
mov cx, word [ebp - 0x10]
mov word [ebp - 0xc], cx
mov edx, 0x3a
mov word [ebp - 0xa], dx
mov eax, 0x5c
mov word [ebp - 8], ax
xor ecx, ecx
mov word [ebp - 6], cx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4e0016
cmp dword [ebp - 0x1c], 1
jne 0x4e001a
xor eax, eax
jmp 0x4e001f
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a8
mov esp, ebp
pop ebp
ret
Function at 0x436940
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x26000]
push edi
jmp 0x43695a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x436961
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x436950
mov eax, 1
add ebx, ebx
jne 0x436973
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x436968
jne 0x436984
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x436968
xor ecx, ecx
sub eax, 3
jb 0x436998
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x436a0a
mov ebp, eax
add ebx, ebx
jne 0x4369a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4369b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4369d4
inc ecx
add ebx, ebx
jne 0x4369c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4369b5
jne 0x4369d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4369b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4369f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4369e5
jmp 0x436956
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4369f4
add edi, ecx
jmp 0x436956
pop esi
mov edi, esi
mov ecx, 0xa57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x436a12
cmp byte [edi], 0x12
jne 0x436a12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x436a17
lea edi, [esi + 0x34000]
mov eax, dword [edi]
or eax, eax
je 0x436a8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x47b58]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x47c38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x436a44
mov ecx, edi
jns 0x436a73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x47c40]
or eax, eax
je 0x436a89
mov dword [ebx], eax
add ebx, 4
jmp 0x436a61
call dword [esi + 0x47c3c]
mov ebp, dword [esi + 0x47c44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x436ac3
sub esp, 0xffffff80
jmp 0x41942f
Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0x15e1de5
Capabilities:
Encode data using xor

Disassembly:
stc
cmp byte [edi - 1], 0
call fcn.01885eb4
invalid

Function at 0x18615c5
Capabilities:
Encode data using xor

Disassembly:
pushfd
call fcn.01884c16
sub esi, dword [eax - 0x7a47b443]
in al, 0x47
push dword [edi + 0x561a7c55]
push esi
xlatb
and al, 0x15
salc
aaa
xor al, 0x65
fcom dword [0xffffd057]
in eax, dx
push esi
adc al, 0xa2
mov dword [0xd170655], eax
adc edx, dword [esi - 0x2d]
cli
lahf
xchg esi, eax
push edi
xchg esi, eax
adc byte [edx - 0x54cbbe5f], dh
add dh, byte [esi + eax*4 + 0x42c60561]
jge 0x18615d8
push 0x1f651697
arpl sp, dx
retf
Function at 0x403854
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push 0
lea edi, [ebp - 0xc]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.kernel32.dll_WriteFile
mov dword [ebp - 8], eax
test eax, eax
jne 0x403894
call sub.kernel32.dll_GetLastError
mov dword [0x468480], eax
call fcn.00403d64
jmp 0x4038bd
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4038bd
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x403868
mov eax, dword [ebp - 0x10]
leave
ret 0xc

Function at 0x4038c4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push dword [ebp + 8]
call sub.kernel32.dll_GetFileType
cmp eax, 2
jne 0x403915
push 0
lea edi, [ebp - 0x10]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
mov dword [ebp - 8], eax
test eax, eax
jne 0x40397b
call sub.kernel32.dll_GetLastError
mov dword [0x468480], eax
call fcn.00403d64
jmp 0x40397b
push 0
lea edi, [ebp - 0xc]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
mov dword [ebp - 8], eax
test eax, eax
jne 0x403952
call sub.kernel32.dll_GetLastError
mov dword [0x468480], eax
cmp eax, 0x6d
jne 0x40394b
mov dword [0x468480], 0
jmp 0x40397b
call fcn.00403d64
jmp 0x40397b
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40397b
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x403915
mov eax, dword [ebp - 0x10]
leave
ret 0xc
Function at 0x10003f80
Capabilities:
Encode data using xor

Disassembly:
retf
cdq
in eax, dx
inc ecx
and al, byte [0xd8f3e2ad]
fbld tbyte [ebp + 0x50]
dec ecx
jp 0x10003fd4
ljmp 0xf4aa:0xdb2d8a6c
ror byte [edx], cl
test eax, 0x4edbcc5
inc esi
xchg ebx, eax
jne 0x10003f6f
cmc
jns 0x10003fa2
mov byte [0x103af6b2], al
fdivr st(0)
stosb byte es:[edi], al
xchg edx, eax
pop ecx
out dx, al
mov bh, 4
sub dword [ebx + 0x77], ebx
lodsb al, byte [esi]
or byte [ebx - 0x64], cl
xchg edi, eax
jb 0x1000406c
and byte [edi], bh
jo 0x1000402d
xor eax, 0x2691620
mov ebp, 0x16efb058
stc
mov ebp, 0x6609bdc5
mov ecx, 0x1f84740a
xchg byte [ecx - 0x1e], cl
and al, 0x23
or eax, dword [edx + ecx + 0x4f]
mov byte ds:[0x8c5a5788], al
xchg ecx, eax
pop ss
mov dh, 0xb
mov word [edi + 0x594fc9e], cs
retf
dec esi
test dword [ebx + ebx*4], 0x84f2599
pushfd
insb byte es:[edi], dx
and dword [edi - 0x4627681b], 0x66
pushfd
int 0xc8
jp 0x1000406d
wait
add al, 0x48
mov ah, 0xf2
invalid
cmpsb byte [esi], byte es:[edi]
rcl byte [ecx + 0x3f]
aam 0xa7
lds esp, [ebx + 0x23826299]
mov ebp, 0x3a276e74
and eax, 0x2a2dfc0d
je 0x100040ea
daa
cmp ah, byte [0x2a2dfc0d]
push 0x6c3a939b
push ss
adc al, 0x92
xor al, byte [ebx - 0x16d033fa]
outsb dx, byte [esi]
inc eax
inc dword [edi + 0x55ac8718]
aas
arpl word [edx + 0x731e0534], si
mov cs, word [ebx - 0x343581c4]
add dl, byte [eax]
test edi, 0x8a6043a8
pop edi
and al, 0xc8
sbb dword [edi], ebx
ficom word [eax + ebx*8 - 0x4909678c]
jae 0x1000407a
sbb dword [edx + 0xaf98dc9], ebp
mov ecx, 0xb6d09bb6
bound ebp, qword [eax + 0x3b79bea2]
ljmp 0xf05a
cmp eax, 0xb11a674b
mov esi, 0x407c07df
stc
mov bh, byte [edx + ecx*8 + 0x4491afc9]
rol ch, 0x3a
or ebx, ebp
test al, ch
jecxz 0x100040bc
invalid
Function at 0x405bdc
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405ec1
test byte [ebp + 0xc], 8
mov dword [ebp - 4], eax
je 0x405c10
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x44bb88], eax
jmp 0x405dd9
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp + 8], ebx
je 0x405c2e
test eax, eax
je 0x405d5d
test byte [ebp + 0xc], 2
je 0x405d5d
mov esi, 0x4364d8
push edi
push esi
call fcn.004062da
test ebx, ebx
je 0x405c4b
push 0x40a9f4
push esi
call fcn.004062f8
jmp 0x405c51
push edi
call fcn.00405e26
push 0x40a268
push edi
call fcn.004062f8
push edi
call fcn.004062eb
mov ebx, eax
lea eax, [ebp - 0x144]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405d53
cmp byte [ebp - 0x118], 0x2e
jne 0x405ca2
cmp byte [ebp - 0x117], 0x2e
je 0x405d36
cmp byte [ebp - 0x117], 0
je 0x405d36
lea eax, [ebp - 0x118]
push eax
push ebx
call fcn.004062da
test byte [ebp - 0x144], 0x10
je 0x405ccd
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405d36
push dword [ebp + 0xc]
push edi
call fcn.00405bdc
jmp 0x405d36
push edi
push str.Delete:_DeleteFile___s__
call fcn.00406762
mov eax, dword [ebp - 0x144]
pop ecx
pop ecx
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405d2e
test byte [ebp + 0xc], 4
push edi
je 0x405d1a
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.00406762
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.004055b7
push 0
push edi
call fcn.00406023
jmp 0x405d36
push str.Delete:_DeleteFile_failed___s__
call fcn.00406762
inc dword [0x44bb88]
pop ecx
pop ecx
jmp 0x405d36
push edi
push 0xfffffffffffffff2
call fcn.004055b7
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405c7f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405d5d
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp + 8], esi
je 0x405dd9
cmp dword [ebp - 4], esi
push edi
jne 0x405d7f
push str.RMDir:_RemoveDirectory_invalid_input___s__
call fcn.00406762
inc dword [0x44bb88]
pop ecx
pop ecx
jmp 0x405dd9
call fcn.0040677e
test eax, eax
je 0x405dd9
push edi
call fcn.00405ddf
push edi
push str.RMDir:_RemoveDirectory___s__
call fcn.00406762
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405dd1
test byte [ebp + 0xc], 4
push edi
je 0x405dca
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.00406762
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.004055b7
push esi
push edi
call fcn.00406023
jmp 0x405dd9
push str.RMDir:_RemoveDirectory_failed___s__
jmp 0x405d70
push edi
push 0xffffffffffffffe5
call fcn.004055b7
pop edi
pop esi
leave
ret 8