joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4060f9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x50
mov esi, dword [0x42bc20]
mov dword [esp], 3
call fcn.00408295
test eax, eax
push ecx
je 0x406132
call eax
jmp loc.0045498f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x429200
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktopResourceLocale
mov dword [esp], 0x80000001
mov dword [0x435000], 0x7830
call fcn.00407b36
sub esp, 0x14
cmp byte [0x429200], 0
jne 0x4061a3
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x429200
mov dword [esp + 8], 0x40b47e
mov dword [esp + 4], str..DEFAULTControl_PanelInternational
mov dword [esp], 0x80000003
call fcn.00407b36
sub esp, 0x14
mov dword [esp + 4], 0x429200
mov dword [esp], 0x435000
call fcn.00407ce4

Function at 0x4076ac
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x38]
lea edi, [ebp - 0x2c]
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov byte [ebp - 0x2c], 1
mov byte [ebp - 0x2b], 0
mov word [ebp - 0x2a], 4
mov dword [ebp - 0x28], 0x40b6b0
mov dword [ebp - 0x24], 0x40b6b0
mov dword [ebp - 0x20], 0
jmp loc.00451cc5

Function at 0x407747
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edx
push edx
jmp loc.00454cc2

Function at 0x407a42
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
je 0x407a6d
and eax, 0xfffffffe
jmp loc.0044f661
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x407a74
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
mov edx, 0
cmove eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
jmp loc.00457326

Function at 0x407ad0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x1c]
mov esi, 0x65
sub esp, 0x2c
mov ebx, dword [ebp + 8]
dec esi
je 0x407b27
jmp loc.0045a323
mov byte [ebx], 0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x407b36
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea edx, [ebp - 0x14]
sub esp, 0x34
cmp dword [ebp + 0x18], 1
mov ebx, dword [ebp + 0x14]
mov byte [ebx], 0
mov dword [esp + 0x10], edx
sbb eax, eax
mov dword [esp + 8], 0
xor al, al
add eax, 0x20119
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x407bd8
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x400
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x407bc1
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
jbe 0x407bc4
mov byte [ebx], 0
mov eax, dword [ebp - 0x14]
mov byte [ebx + 0x3ff], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x44fffa
Function at 0x408157
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], 0x42af40
mov dword [esp + 4], eax
call fcn.00407cb2
push ebx
push ebx
mov dword [esp], 0x42af40
call fcn.00407931
test eax, eax
push esi
jne 0x408189
xor eax, eax
jmp 0x408201
mov dword [esp], eax
mov ebx, eax
call fcn.00407d33
test byte [0x42bc84], 0x80
push ecx
je 0x4081a7
mov al, byte [ebx]
test al, al
je 0x408185
cmp al, 0x5c
je 0x408185
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub ebx, 0x42af40
mov dword [esp], 0x42af40
call esi
push ecx
cmp ebx, eax
mov dword [esp], 0x42af40
jge 0x4081e6
call fcn.0040811f
test eax, eax
push edx
je 0x4081d7
test byte [eax], 0x10
je 0x408185
mov dword [esp], 0x42af40
call fcn.004078ca
push eax
jmp 0x4081b3
call fcn.00407cee
push eax
mov dword [esp], 0x42af40
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
push edx
setne al
movzx eax, al
lea esp, [ebp - 8]
pop ebx
jmp 0x45598e

Function at 0x40820a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x126]
sub esp, 0x134
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408247
xor edx, edx
cmp byte [ebp + eax - 0x127], 0x5c
sete dl
jmp 0x40824e
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, 0x40b4a0
add eax, ebx
jmp 0x45465c

Function at 0x40830d
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [esp], 2
call fcn.00408295
test eax, eax
push edx
jne 0x408343
test ebx, ebx
mov dword [0x42ab40], 0x4c554e
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jne 0x408361
jmp 0x4083b1
mov dword [esp + 8], 5
mov dword [esp + 4], ebx
mov dword [esp], esi
call eax
sub esp, 0xc
test eax, eax
jne 0x4085a4
jmp 0x40832d
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00407a74
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x42ab40
mov dword [esp], ebx
call edi
sub esp, 0xc
test eax, eax
je 0x4085aa
cmp eax, 0x400
jg 0x4085aa
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x42a740
mov dword [esp], esi
call edi
sub esp, 0xc
test eax, eax
je 0x4085aa
cmp eax, 0x400
jg 0x4085aa
mov dword [esp + 0xc], 0x42a740
mov dword [esp + 8], 0x42ab40
mov dword [esp + 4], str._s_s_r_n
mov dword [esp], 0x42a340
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x42bc20]
mov eax, dword [eax + 0x128]
mov dword [esp], 0x42a740
jmp 0x452ff7
inc dword [0x42bbf0]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x408894
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42b7a4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4088b1
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4088df
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4088ba
mov dword [ecx*4 + 0x42b7a0], eax
inc ecx
cmp ecx, 0x100
jne 0x4088b3
jmp 0x4088a5
cmp edx, ebx
je 0x4088f8
jmp 0x452991
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x431004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x4ac5354
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x51fb24ed
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4010f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x811004]
jne 0x4010fa
repz ret
jmp fcn.004013f9

Function at 0x403c9b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x811004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040253c
and dword [ebp - 0x14], 0
cmp dword [0x813ad0], 0
mov dword [ebp - 0x18], eax
jne 0x403d4e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403df6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x403df6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x813ad0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x813ad4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x813ad8], eax
call edi
push eax
call esi
mov dword [0x813ae0], eax
test eax, eax
je 0x403d4e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x813adc], eax
mov eax, dword [0x813adc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403da7
cmp dword [0x813ae0], ecx
je 0x403da7
push eax
call esi
push dword [0x813ae0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403da7
test ebx, ebx
je 0x403da7
call edi
test eax, eax
je 0x403d9e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x403d9e
test byte [ebp - 8], 1
jne 0x403da7
or dword [ebp + 0x10], 0x200000
jmp 0x403dda
mov eax, dword [0x813ad4]
cmp eax, dword [ebp - 0x18]
je 0x403dda
push eax
call esi
test eax, eax
je 0x403dda
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x403dda
mov eax, dword [0x813ad8]
cmp eax, dword [ebp - 0x18]
je 0x403dda
push eax
call esi
test eax, eax
je 0x403dda
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x813ad0]
call esi
test eax, eax
je 0x403df6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403df8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010f0
leave
ret
Function at 0x7ffdc0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x804
mov eax, dword [0x811004]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
xor esi, esi
test edi, edi
jle 0x7ffe2b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
cmp edi, 0x2d
jne 0x7ffe07
push 0
push 0
call ebp
push str.mipipoyoto_vatelicahujuhasazagupu_zagepidexejexofu_pigilapisitacumayonetaperi_vazaw
push str.wudarureheb_sed_kukexuriyekigobu_jatutuzovaninuguxorepapivi_zaxipatoxo
push str.zabazevafij
push str.vufizu
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.007ffd40
xor byte [ebx + esi], al
cmp edi, 0xf
jne 0x7ffe25
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
inc esi
cmp esi, edi
jl 0x7ffde2
pop ebp
pop esi
cmp edi, 0x2d
jne 0x7ffe45
mov dword [0x8147e0], 0xa62e7790
mov dword [0x8147e4], 0xffffffff
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004010f0
add esp, 0x804
ret
Function at 0x800270
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x811004]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [0x8147d4]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push edi
mov ebx, 0x1519a5
mov edi, 0x8e46a7b8
lea esp, [esp]
mov dword [0x81443c], edi
cmp eax, 0x3dc
jne 0x8002b6
push 0
call esi
mov eax, dword [0x8147d4]
dec ebx
jne 0x8002a0
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CancelIo]
xor esi, esi
cmp eax, 0x997
jne 0x800300
xor eax, eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
lea ecx, [esp + 0x30]
push ecx
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call edi
push 0
call ebx
mov eax, dword [0x8147d4]
cmp esi, 0x845f8b
jne 0x800317
mov eax, dword [0x812940]
add eax, 0xa231
mov dword [0x8147d4], eax
cmp eax, 0x141
jne 0x800332
mov dword [0x814010], 0xec58acac
mov dword [0x814014], 0xffffffff
inc esi
cmp esi, 0x12cca12
jl 0x8002c7
call fcn.007ffea0
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004010f0
add esp, 0x41c
ret 0x10
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x8e12f8
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e12fe
pop ebp
sub ebp, 6
sub ebp, 0x4e12f8
jmp 0x8e135c
jmp 0x8e1365
mov eax, 0x4e12f8
add eax, ebp
add eax, 0x93
mov ecx, 0x62d
mov edx, 0x81ae50db
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e137c
jmp 0x8e138f
mov cl, 0x9b
mov bl, 0xdb
retf
Function at 0x100178c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10029b00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x10034060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100370fc]
test dword [ebp + 8], eax
je 0x10029baa
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.100296be
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x100370f8]
test eax, eax
je 0x10029b9d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.10029c8f
mov eax, dword [0x10034058]
pop ecx
pop ecx
test eax, eax
jle 0x10029baa
push esi
mov esi, dword [0x10037100]
push edi
mov edi, dword [0x10037104]
cdq
push edx
push eax
push edi
push esi
call fcn.1002a520
add esi, 1
mov dword [0x10037100], esi
adc edi, 0
or eax, edx
mov dword [0x10037104], edi
pop edi
pop esi
jne 0x10029baa
push dword [0x100370f8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10029baa
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029e50
leave
ret
Function at 0x8e14b4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e14ba
pop ebp
sub ebp, 6
sub ebp, 0x4e14b4
jmp 0x8e1518
jmp 0x8e1521
mov eax, 0x4e14b4
add eax, ebp
add eax, 0x93
mov ecx, 0x631
mov edx, 0x7fde240b
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e1538
jmp 0x8e154b
popal
dec ebx
arpl word [ebx], cx
sbb ecx, dword [ebx]
or esp, dword [ebx + 0xb]
invalid
Function at 0x402bdc
Capabilities:
Packed with generic packer

Disassembly:
dec esp
inc ebp
inc ebp
outsd dx, dword [esi]
inc ebp
mov dword [ebx], esi
jb 0x402c51
push esi
add al, 0x50
insb byte es:[edi], dx
mov byte [0xc7896345], al
push eax
or al, 4
jae 0x402c26
add byte [edx - 0x77], dh
or ebp, dword [esi + 0x7a]
jb 0x402c6e
push esi
pushal
mov dword [eax], 0x6050c8d7
push edx
inc dword [eax*2 + 0x64455046]
ror byte [ecx + 0x6c89c36e], 0x53
push ebx
mov dword [esi - 1], 0x458dc789
add byte [ebx + 0x53], dh
push esi
push eax
inc ecx
call 0x40b56b
inc ebp
inc ebp
jbe 0x402c12
jp 0x402ca0
mov dword [ecx + 0xe], eax
inc edi
jb 0x402c96
push esi
jbe 0x402c7c
add dh, ch
outsb dx, byte [esi]
outsb dx, byte fs:[esi]
imul edi, edi, 0xffffffde
imul ebx, eax, 0x563100c7
popal
ret
outsb dx, byte fs:[esi]
inc ebp
push edi
jb 0x402c9c
outsb dx, byte [esi]
popal
mov edx, 0x6e6e64
mov dword [eax], 0x89814560
push ebx
inc ebx
jbe 0x402cb8
jbe 0x402cde
add byte [ecx + 0x41], ch
push esi
mov dword [esi - 0x75], eax
add byte [ecx], dh
inc ebp
inc ebp
invalid
jb 0x402cc3
add bh, 0x6f
popal
insb byte es:[edi], dx
jp 0x402cd7
push ecx
insb byte es:[edi], dx
outsd dx, dword [esi]
inc ebp
shr eax, cl
add byte [ebp + 0x4cc77264], cl
bound edi, qword gs:[ecx + 0x6c]
jb 0x402cdf
dec eax
jne 0x402cfe
jb 0x402cf1
mov edx, 0x6e003145
inc ebp
xor dword [eax], eax
outsb dx, byte [esi]
invalid
je 0x402d28
outsb dx, byte [esi]
push ebx
invalid
outsb dx, byte [esi]
invalid
inc ebp
inc ebp
push edx
mov dword gs:[ebp + 0x45], esp
invalid
invalid
shl byte [edi + eax*8 + 0x63], 0xc7
inc esi
lea esi, [esi + 0x45]
je 0x402c85
dec dword [ecx - 0x40]
inc ebp
push esi
push eax
rol byte [ebp + 0x56], 0x50
lea eax, [ebp - 0x39]
inc ebp
jb 0x402d5b
invalid
insb byte es:[edi], dx
dec ebp
outsb dx, byte gs:[esi]
push eax
mov edi, 0x4f754550
pop esp
push esi
invalid
add byte fs:[esi - 0x39], al
inc esi
insb byte es:[edi], dx
outsb dx, byte [esi]
insb byte es:[edi], dx
jb 0x402d65
push esi
lea eax, [ebp + 0x56]
mov dword [ebp - 0x39], eax
add edx, edi
jb 0x402dce
inc ebp
mov dword [eax], 0xeb636a45
add byte [ebx + 0x45bf8945], al
pop ebp
add al, byte [eax]
add byte [eax - 1], bh
jae 0x402db1
mov edi, edi
invalid
mov dword [ebp], eax
push ecx
push esi
add al, 0xfa
push 0x30722a40
out dx, al
jne 0x402dbf
dec dword [eax + 0x3008a68]
mov byte [eax - 0x76], ch
add byte [ebx], al
outsb dx, byte [esi]
invalid
jmp [edi - 1]

Function at 0x430004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401000
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4010ae
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4010a7
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
je 0x4010a7
lea ebx, [ebx]
lea eax, [ebp - 0x10c]
mov ecx, str.UniCRSLocalServer.exe
jmp 0x401070
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401090
test dl, dl
je 0x40108c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401090
add ecx, 2
add eax, 2
test dl, dl
jne 0x401070
xor eax, eax
jmp 0x401095
sbb eax, eax
or eax, 1
test eax, eax
je 0x4010c0
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
jne 0x401060
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401203
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00401203
mov esp, ebp
pop ebp
ret

Function at 0x4010e0
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00406de0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
call section..text
test eax, eax
jne 0x401188
push 0x7ff
push eax
mov byte [ebp - 0x808], al
lea eax, [ebp - 0x807]
push eax
call fcn.004031c0
add esp, 0xc
mov byte [ebp - 0x1008], 0
lea eax, [ebp - 0x1007]
push 0x7ff
push 0
push eax
call fcn.004031c0
add esp, 0xc
lea eax, [ebp - 0x808]
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp eax, 1
jne 0x401188
push str.CrossCertUniSignCRSV3UniCRSLocalServer.exe
lea eax, [ebp - 0x808]
push eax
push str._s_s
lea eax, [ebp - 0x1008]
push 0x800
push eax
call fcn.00401212
add esp, 0x14
lea eax, [ebp - 0x1008]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401203
mov esp, ebp
pop ebp
ret