joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10bbcfc
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x458]
push ebx
push eax
mov dword [ebp - 0x468], edi
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], ebx
call sub.msvcrt.dll_memset
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
cmp esi, ebx
jne 0x10bbd9d
mov dword [ebp - 0x460], 0x57
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bbf61
test byte [eax + 0x1c], 1
je 0x10bbf61
push 0x100b42c
push 0x62
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
jmp 0x10bbf61
cmp edi, ebx
jne 0x10bbdce
mov dword [ebp - 0x460], 0x57
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bbf61
test byte [eax + 0x1c], 1
je 0x10bbf61
push 0x100b42c
push 0x63
jmp 0x10bbd8d
push esi
push edi
mov ebx, 0x100aecc
push ebx
mov edi, 0x104
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.010ad159
add esp, 0x14
test eax, eax
jge 0x10bbe31
mov ecx, eax
and ecx, 0x1000ffff
mov dword [ebp - 0x460], ecx
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10bbf61
test byte [ecx + 0x1c], 1
je 0x10bbf61
push eax
push 0x100b42c
push 0x64
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010294b2
jmp 0x10bbf61
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x464], eax
cmp eax, 0xffffffff
jne 0x10bbe88
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bbf61
test byte [eax + 0x1c], 4
je 0x10bbf61
lea ecx, [ebp - 0x20c]
push ecx
push 0x100b42c
push 0x65
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
jmp 0x10bbf61
cmp dword [ebp - 0x45c], 0x10
je 0x10bbf3a
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x468]
lea eax, [ebp - 0x20c]
push ebx
push edi
push eax
call fcn.010ad159
mov esi, eax
add esp, 0x14
test esi, esi
jl 0x10bbf09
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10bbf3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x460], eax
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bbf3a
test byte [eax + 0x1c], 1
je 0x10bbf3a
push dword [ebp - 0x460]
lea ecx, [ebp - 0x20c]
push ecx
push 0x100b42c
push 0x66
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059d60
jmp 0x10bbf3a
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bbf2e
test byte [eax + 0x1c], 1
je 0x10bbf2e
push esi
push 0x100b42c
push 0x67
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
and esi, 0x1000ffff
mov dword [ebp - 0x460], esi
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10bbe88
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x460]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010a0c4b
leave
ret 8
Function at 0x10bfd76
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
xor ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], eax
mov word [esi + 8], cx
cmp dword [0x10f1744], eax
jne 0x10bfe0b
push 0x110
push eax
lea eax, [ebp - 0x114]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [0x10f1744], 1
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10bfe0b
cmp dword [ebp - 0x114], 5
jb 0x10bfdef
cmp dword [ebp - 0x110], 1
jae 0x10bfdf8
cmp dword [ebp - 0x114], 6
jb 0x10bfe0b
cmp dword [ebp - 0x108], 2
jne 0x10bfe0b
mov dword [0x10edaa0], 0x7f
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.010a0c4b
leave
ret
Function at 0x10c338b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push dword [ebp + 0x10]
push 0x50
call fcn.010c22bd
test eax, eax
mov dword [ebp - 4], eax
jne 0x10c33a6
leave
ret
push ebx
push esi
push edi
cld
mov edi, dword [ebp - 4]
mov eax, 0
mov ecx, 0x50
or ecx, ecx
je 0x10c33bd
rep stosb byte es:[edi], al
mov eax, dword [ebp - 4]
push 0x14
xor esi, esi
pop ebx
mov eax, esi
shr eax, 2
mov edx, eax
mov eax, dword [ebp - 4]
shl edx, 2
add eax, edx
mov ecx, esi
sub ecx, edx
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
shl ecx, 3
shl edx, cl
or dword [eax], edx
inc esi
cmp esi, ebx
jb 0x10c33c5
and dword [ebp - 0x24], 0
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x4c], 0x123174bb
mov dword [ebp - 0x48], 0x86521ff8
mov dword [ebp - 0x44], 0x98d2438b
mov dword [ebp - 0x40], 0x7966ce12
mov dword [ebp - 0x3c], 0xc5d92014
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov esi, 0x10eef54
mov ecx, dword [ebp - 8]
mov eax, edi
cld
or ecx, ecx
je 0x10c3438
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
xor edx, edx
push 5
mov eax, ecx
pop esi
div esi
mov eax, dword [ebp + edx*4 - 0x4c]
xor dword [ebp + ecx*4 - 0x24], eax
inc ecx
cmp ecx, esi
jb 0x10c343a
lea eax, [ebp - 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
cld
or ecx, ecx
je 0x10c3471
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0x10]
lea eax, [ebp - 0x38]
push dword [ebp + 0xc]
push 0
push 0x10ef9e4
push dword [0x10eef68]
push eax
push ebx
push dword [ebp - 4]
call fcn.010cb135
lea eax, [ebp - 0x38]
mov byte [eax], 0
inc eax
dec ebx
jne 0x10c3494
mov eax, dword [ebp - 4]
push 0x50
pop ecx
pop edi
pop esi
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x10c34a4
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.010c22dd
xor eax, eax
inc eax
leave
ret
Function at 0x10c5f50
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x10c608b
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x10c6060
test eax, eax
jne 0x10c6060
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x10c5fa0
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x10c608b
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x10c6060
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc
Function at 0x10c706f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
test esi, esi
je 0x10c70bc
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp + 8]
sub edi, edx
sub ecx, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], esi
mov esi, dword [edi + edx]
mov ecx, dword [edx]
lea ebx, [ecx + esi]
add eax, ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebx + edx], eax
mov ebx, ecx
xor ebx, esi
and ebx, eax
or ecx, esi
xor ebx, ecx
shr ebx, 0x1f
add edx, 4
dec dword [ebp + 0x14]
mov eax, ebx
jne 0x10c7093
pop edi
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x10c72b4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
je 0x10c7301
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub ebx, esi
sub ecx, esi
push edi
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], edx
mov edi, dword [ebx + esi]
mov edx, dword [esi]
mov ecx, edi
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + esi], ecx
xor ecx, edi
xor edx, edi
or ecx, edx
xor ecx, edi
shr ecx, 0x1f
add esi, 4
dec dword [ebp + 0x14]
mov eax, ecx
jne 0x10c72d8
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x10cc4fa
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
call fcn.010cc479
test eax, eax
je 0x10cc53b
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
push 0
push 0x1026bbc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 8

Function at 0x10cdd20
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
call fcn.010a0d8d
push 2
call sub.msvcrt.dll___set_app_type
or dword [0x10f2af4], 0xffffffff
or dword [0x10f2af8], 0xffffffff
mov dword [esp], 0x10016f0
push 0x10016ec
call sub.msvcrt.dll__initterm
push 0x10016e8
push 0x1001604
call sub.msvcrt.dll__initterm
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [ebp - 0x44]
xor esi, esi
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
je 0x10cdd8a
movzx eax, word [ebp - 0x14]
jmp 0x10cdd8d
push 0xa
pop eax
push eax
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.01028c80
mov esi, eax
call sub.msvcrt.dll__cexit
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x10d0628
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x10d0669
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x10d0642
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x10d0687
dec esi
je 0x10d067e
dec esi
jne 0x10d068c
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10d1b7c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
and dword [ebx + 0x28], 0
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 4], eax
xor eax, eax
cmp byte [ebp + 0x24], 0
mov word [ebx + 0xc], ax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x24], ecx
mov esi, 0x8000
jne 0x10d1bcc
push esi
push eax
add eax, esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
and dword [ebx + 0x30], eax
mov word [ebx + 0x2c], ax
call fcn.010d15b3
and dword [ebx + 0x20], 0
mov eax, esi
push 2
mov word [ebx + 0x3c], ax
mov eax, dword [ebx + 0x14]
pop ecx
mov dword [ebx + 0x34], esi
add eax, esi
push edi
movzx edi, byte [eax]
mov edx, dword [ebx + 0x20]
shl edx, 5
xor edx, edi
and edx, 0x7fff
inc eax
dec ecx
mov dword [ebx + 0x20], edx
jne 0x10d1bf0
cmp byte [ebp + 0x24], cl
je 0x10d1c16
mov edi, ebx
call fcn.010d13f4
jmp 0x10d1c28
xor eax, eax
mov ecx, esi
mov edx, dword [ebx + 0x18]
xor edi, edi
mov word [eax + edx], di
inc eax
inc eax
dec ecx
jne 0x10d1c1a
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.010d07b4
push 0x4b
pop edx
call fcn.010d07b4
call fcn.010d18f9
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
pop edi
je 0x10d1c67
mov eax, dword [ebx + 0x14]
push esi
lea ecx, [eax + 0x8000]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebx + 0x28]
neg eax
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24
Function at 0x10d41ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc9c
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc88], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0xc8c], eax
mov eax, dword [esi + 0x870]
add eax, 0x20
mov ecx, eax
shl ecx, 3
mov dword [ebp - 0xc9c], ecx
cmp ecx, 0x320
jb 0x10d41f9
xor eax, eax
jmp 0x10d43db
push ebx
push edi
mov edi, eax
shl edi, 4
push edi
lea eax, [ebp - 0xc84]
push 0
push eax
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x644]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 0x18]
add esp, 0x18
test ecx, ecx
jbe 0x10d4358
mov eax, dword [ebp + 0x14]
mov ebx, dword [esi + 0x34]
mov edi, dword [esi + 0x30]
shl eax, 2
mov dword [ebp - 0xc90], eax
mov eax, dword [ebp + 0x10]
shl eax, 2
mov dword [ebp - 0xc94], eax
mov dword [ebp - 0xc98], ecx
jmp 0x10d4258
mov eax, dword [ebp - 0xc94]
mov ecx, dword [ebp - 0xc88]
and ecx, 7
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [ebp - 0xc88]
shr ecx, 3
mov cl, byte [ecx + ebx]
test cl, dl
jne 0x10d4282
mov eax, dword [ebp - 0xc88]
movzx eax, byte [edi + eax]
jmp 0x10d42c6
mov ecx, dword [ebp - 0xc88]
cmp byte [edi + ecx], 7
mov ecx, dword [esi + 0x2c]
push dword [ecx + eax]
push esi
jae 0x10d42b0
call fcn.010d2436
mov ecx, dword [ebp - 0xc88]
movzx ecx, byte [edi + ecx]
movzx eax, al
lea eax, [ecx + eax*8 + 0x100]
jmp 0x10d42bf
call fcn.010d2436
movzx eax, al
lea eax, [eax*8 + 0x107]
add dword [ebp - 0xc94], 4
inc dword [ebp - 0xc88]
lea eax, [ebp + eax*2 - 0xc84]
inc word [eax]
mov eax, dword [ebp - 0xc8c]
xor edx, edx
mov ecx, eax
and ecx, 7
inc edx
shl edx, cl
mov ecx, eax
shr ecx, 3
mov cl, byte [ecx + ebx]
test cl, dl
jne 0x10d42f8
movzx eax, byte [edi + eax]
jmp 0x10d433c
cmp byte [edi + eax], 7
mov ecx, dword [ebp - 0xc90]
mov eax, dword [esi + 0x2c]
push dword [eax + ecx]
push esi
jae 0x10d4326
call fcn.010d2436
mov ecx, dword [ebp - 0xc8c]
movzx ecx, byte [edi + ecx]
movzx eax, al
lea eax, [ecx + eax*8 + 0x100]
jmp 0x10d4335
call fcn.010d2436
movzx eax, al
lea eax, [eax*8 + 0x107]
add dword [ebp - 0xc90], 4
inc dword [ebp - 0xc8c]
lea eax, [ebp + eax*2 - 0x644]
inc word [eax]
dec dword [ebp - 0xc98]
jne 0x10d4252
xor esi, esi
xor ebx, ebx
cmp dword [ebp - 0xc9c], esi
jbe 0x10d43d7
mov edi, 0x100
movzx eax, word [ebp + esi*2 - 0xc84]
mov ecx, edi
cmp ax, cx
movzx eax, ax
jae 0x10d4384
movzx eax, byte [eax + 0x1026eb0]
jmp 0x10d4391
shr eax, 8
movzx eax, byte [eax + 0x1026eb0]
add eax, 8
movzx ecx, word [ebp + esi*2 - 0x644]
mov edx, edi
cmp cx, dx
movzx ecx, cx
jae 0x10d43ac
movzx ecx, byte [ecx + 0x1026eb0]
jmp 0x10d43b9
shr ecx, 8
movzx ecx, byte [ecx + 0x1026eb0]
add ecx, 8
mov eax, dword [eax*4 + 0x1026e68]
sub eax, dword [ecx*4 + 0x1026e68]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
inc esi
cmp esi, dword [ebp - 0xc9c]
jb 0x10d4369
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.010a0c4b
leave
ret 0x14
Function at 0x4af1e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4af211
call fcn.0047eb2f
mov dword [eax], esi
call fcn.0047eb1c
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00476701
add esp, 0x14
push 0x16
pop eax
jmp 0x4af266
test dword [ebp + 0xc], 0xfffffff9
jne 0x4af1ed
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4af23e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047eb42
pop ecx
call fcn.0047eb1c
mov eax, dword [eax]
jmp 0x4af266
test al, 0x10
jne 0x4af264
test al, 1
je 0x4af264
test byte [ebp + 0xc], 2
je 0x4af264
call fcn.0047eb2f
mov dword [eax], 5
call fcn.0047eb1c
mov dword [eax], 0xd
jmp 0x4af235
xor eax, eax
pop esi
pop ebp
ret

Function at 0x408921
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop edx
call fcn.00408944
sub edi, edi
sub edi, eax
xor dword [ecx], edx
inc ecx
or eax, eax
cmp ecx, ebx
jne fcn.00408921
sub edi, 0x55ed3de7
and eax, eax
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x61325d4f
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x15194667
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x404f45
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x4c121d
call fcn.004c0d90
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x24], edi
mov eax, dword [edi + 0x10]
xor ebx, ebx
mov ecx, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
cmp ebx, ecx
jae 0x4052b4
mov dword [ebp - 0x20], 0x3f4b
cmp dword [ebp - 0x20], 0x42c6
jle 0x404fea
xor edi, edi
xor esi, esi
xor ebx, ebx
lea eax, [esi + edi]
mov ecx, ebx
shl eax, cl
cdq
push edx
push eax
lea ecx, [ebp - 0x48]
call fcn.00404f11
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x404fa7
mov eax, dword [eax]
push eax
call fcn.00494ce8
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00402e5a
inc ebx
mov eax, 0xffdea0e8
inc dword [ebx - 0x7f]
sti
push 0x7c00007f
enter 0xffffffffffff8146, 0xfffffffffffffffe
pop edi
pop ds
add byte [eax], al
mov al, byte [0x43ffffde]
cmp ebx, 0x7f68
jl 0x404f8b
inc esi
cmp esi, 0x1f5f
jl 0x404f89
inc edi
cmp edi, 0x1626
jl 0x404f87
mov dl, 0x8b
jge 0x404fb4
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x1c]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov dword [ebp - 0x28], 0x9e3
jecxz 0x404ff8
add byte [eax], al
cmp dword [ebp - 0x28], 0x23cc
jle 0x405085
rol ebp, cl
push eax
stosb byte es:[edi], al
or byte [0xbc5f11c6], al
sal byte [edx - 0x7e6f94ba], 0x3c
fcmovnb st(0), st(3)
inc eax
push ss
or edx, dword [edi]
and ecx, dword [eax + 0x1a]
fcom st(4)
push edx
mov edx, 0x4acbaaf2
pop ds
jl 0x404fb6
inc esi
lodsd eax, dword [esi]
jecxz 0x404fd4
arpl word [edi - 0x1d0d44d1], si
mov eax, dword [0x90e8858]
cmp dh, byte [eax - 0x3660d82b]
div edx
fld xword [eax]
fld xword [0x502a928a]
rcr dword [eax], 1
add al, 0x58
push ebp
jb 0x404fed
mov byte [esi], dh
cmp dword [edi + 0x10], ebx
ja 0x405094
push str.SJQswcdQFOUMyEIbbDaCCXX
call fcn.00492003
cmp dword [edi + 0x14], 0x10
jb 0x40509e
mov eax, dword [edi]
jmp 0x4050a0
mov eax, edi
mov dl, byte [eax + ebx]
mov byte [ebp - 0x11], dl
and dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0x24
cmp dword [ebp - 0x2c], 0x1770
jle 0x405190
cmp dword [ebp - 0x20], 0x3c53
jge 0x4051a7
push str.tmfhmhz_cemxib_nfqoakemt_kapx
call fcn.00494ce8
pop ecx
mov dl, byte [ebp - 0x11]
or dword [ebp - 4], 0xffffffff
jmp 0x405286
lea ecx, [ebx + 0x7b]
mov al, cl
and al, dl
add al, al
sub cl, al
add cl, dl
movsx esi, cl
movsx eax, dl
add eax, ebx
xor edx, edx
push 0x19
pop ecx
div ecx
mov ecx, edx
shl esi, cl
mov eax, dword [ebp - 0x18]
add eax, esi
inc ebx
mov ecx, dword [ebp - 0x30]
jmp 0x404f67
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435464
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4354c6
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4354b2
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.00435544
add esp, 0xc
jmp 0x4354c4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 0
call fcn.0043cb10
pop ecx
pop ecx
jmp 0x435540
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x435528
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x435511
push 0
push 0xa95
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x435526
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
jmp 0x435540
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push 0x60cc
push 0
call fcn.0043a918
add esp, 0xc
mov esp, ebp
pop ebp
ret