joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411a57
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
push ecx
lea edi, [ebp - 0x38]
push 0xe
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
and dword [ebp - 8], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.004112a7
mov dword [ebp - 0xc], eax
push 0x208
call fcn.00411d5f
pop ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push dword [ebp - 0x10]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0x24], 0x104
and dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x30], 0xf003f
cmp dword [ebp + 0x14], 0
je 0x411ad3
mov eax, dword [ebp - 0x30]
or eax, 0x100
mov dword [ebp - 0x30], eax
push dword [ebp - 0x10]
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.004117eb
mov esi, esp
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x24], eax
mov esi, esp
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp - 0x30]
push 0
push 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x20], eax
mov esi, esp
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x30]
push 0
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x411b95
mov eax, dword [ebp - 0x24]
shl eax, 1
mov esi, esp
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
call fcn.00411d68
pop ecx
mov eax, dword [ebp - 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x411bcb]
call fcn.00411ca2
pop eax
pop edx
pop edi
pop esi
add esp, 0x38
cmp ebp, esp
call fcn.00411cf8
leave
ret 0x10
Function at 0x402390
Capabilities:
Parse pe header

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push esi
push edi
push 0
call ebx
mov esi, dword [esp + 0x18]
cmp word [esi], 0x5a4d
je 0x4023b2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push 0
call ebx
mov ebp, dword [esi + 0x3c]
add ebp, esi
cmp dword [ebp], 0x4550
je 0x4023cc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push 0
call ebx
mov eax, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x34]
push 4
push 0x2000
push eax
push ecx
call dword [0x40ca8c]
mov edi, eax
push 0
mov dword [esp + 0x14], edi
call ebx
test edi, edi
jne 0x402417
mov edx, dword [ebp + 0x50]
push 4
push 0x2000
push edx
push edi
call dword [0x40ca8c]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x402413
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, dword [esp + 0x10]
push 0x14
push 0
call dword [0x40ca88]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
xor eax, eax
push 4
push 0x1000
mov dword [ebx + 4], edi
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x50]
push eax
push edi
call dword [0x40ca8c]
mov ecx, dword [ebp + 0x54]
push 4
push 0x1000
push ecx
push edi
call dword [0x40ca8c]
mov ecx, dword [esi + 0x3c]
mov edi, dword [ebp + 0x54]
add ecx, edi
mov edi, eax
mov edx, ecx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ecx, dword [edi + 0x3c]
add eax, ecx
mov dword [ebx], eax
mov dword [eax + 0x34], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push ebp
push edi
call fcn.00402510
mov ecx, dword [ebp + 0x34]
mov eax, esi
add esp, 0xc
sub eax, ecx
je 0x4024ac
push eax
push ebx
call fcn.004026c0
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push ebx
call fcn.00402740
add esp, 4
test eax, eax
je 0x4024ee
push 0
call edi
push ebx
call fcn.004025f0
add esp, 4
push 0
call edi
mov edx, dword [ebx]
mov eax, dword [edx + 0x28]
test eax, eax
je 0x402506
add eax, esi
test eax, eax
je 0x4024ee
push 0
push 1
push esi
call eax
test eax, eax
jne 0x4024ff
push ebx
call fcn.00402970
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [ebx + 0x10], 1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x402510
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov dword [esp + 8], 0
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x4025e1
push esi
push edi
add ebx, 0x10
cmp dword [ebx], 0
jne 0x40258b
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x4025bf
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [0x40ca8c]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4025bf
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [0x40ca8c]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x402546
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4025f0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebp
push edi
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
xor ecx, ecx
xor ebp, ebp
mov edi, dword [eax]
mov cx, word [edi + 0x14]
cmp word [edi + 6], bp
lea eax, [ecx + edi + 0x18]
jbe 0x4026b7
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40264f
mov edx, dword [ebx - 0x14]
mov eax, dword [ebx - 0x1c]
push 0x4000
push edx
push eax
call dword [0x40ca84]
jmp 0x40269d
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov edx, dword [edx*4 + 0x40c3b0]
je 0x402666
or dh, 2
mov ecx, dword [ebx - 0x14]
test ecx, ecx
jne 0x40267f
test al, 0x40
je 0x402676
mov ecx, dword [edi + 0x20]
jmp 0x40267d
test al, 0x80
je 0x40269d
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x40269d
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [ebx - 0x1c]
push ecx
call dword [0x40ca80]
test eax, eax
jne 0x40269d
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40261c
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret
Function at 0x400e3a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x400e3a6
ret

Function at 0x401a1a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43af59
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.03fe3c84
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x43af70
call fcn.03fe38e0
mov eax, ebx
call fcn.03fff180
mov edi, eax
dec edi
test edi, edi
jl 0x401a260
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.03fff154
mov edx, dword [0x43e934]
call fcn.03fe2954
test al, al
je 0x401a25c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.03fff154
lea edx, [ebp - 0x14]
call fcn.0403cad0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.03fe3c84
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.03fe3954
inc esi
dec edi
jne 0x401a20e
mov al, byte [0x43af74]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43af80
mov eax, dword [ebp - 0xc]
call fcn.03fed040
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.03fe3650
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0403cad0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43af70
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0403cad0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43af70
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43af70
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x43af8c
call fcn.03fe9058
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43af60
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.03fe35dc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.03fe35dc
lea eax, [ebp - 0x14]
call fcn.03fe35b8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.03fe35dc
ret
Function at 0x4062d60
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4062dfe
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x4aaef4]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x4aaef4]
push edx
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x4aaef4]
push edx
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4aaef4]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4062d7f
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4062e14
dec edx
je 0x4062e49
jmp 0x4062e9a
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4aaef4]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x4aaef4]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4062e9a
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4aaef4]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x4aaef4]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x4aaef4]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4063cac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4063ccc
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4063cba
pop edi
pop esi
pop ebx
ret
Function at 0x4065050
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor edx, edx
push ebp
push 0x485e18
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
call fcn.03fe3894
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, dword [ebp - 4]
call fcn.03fe3c20
mov eax, esi
call fcn.03fe3894
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x406519b
mov ebx, 1
mov eax, esi
call fcn.03fe3894
lea edx, [ebx + ebx*2]
cmp eax, edx
jge 0x40650de
mov eax, esi
call fcn.03fe3894
mov ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
sub ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
lea edx, [ebp - 7]
call fcn.03fe1cd8
jmp 0x40650f4
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
lea edx, [ebp - 7]
mov ecx, 3
call fcn.03fe1cd8
mov al, byte [ebp - 7]
mov edx, eax
and dl, 0xfc
and edx, 0xff
shr edx, 2
mov ecx, 0x485e3c
mov dl, byte [ecx + edx]
mov byte [ebp - 0xb], dl
and al, 3
and eax, 0xff
shl eax, 4
mov dl, byte [ebp - 6]
and dl, 0xf0
and edx, 0xff
shr edx, 4
or eax, edx
mov edx, 0x485e3c
mov al, byte [edx + eax]
mov byte [ebp - 0xa], al
mov dl, byte [ebp - 6]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov al, byte [ebp - 5]
mov ecx, eax
and cl, 0xc0
and ecx, 0xff
shr ecx, 6
or edx, ecx
mov ecx, 0x485e3c
mov dl, byte [ecx + edx]
mov byte [ebp - 9], dl
and al, 0x3f
and eax, 0xff
mov edx, 0x485e3c
mov al, byte [edx + eax]
mov byte [ebp - 8], al
mov eax, dword [ebp - 4]
call fcn.03fe3aec
mov edx, ebx
dec edx
shl edx, 2
lea edx, [eax + edx]
lea eax, [ebp - 0xb]
mov ecx, 4
call fcn.03fe1cd8
inc ebx
dec edi
jne 0x40650ac
mov eax, esi
call fcn.03fe3894
mov ecx, 3
cdq
idiv ecx
dec edx
jne 0x40651e1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.03fe3894
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.03fe3aec
mov byte [eax + ebx - 2], 0x3d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.03fe3894
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.03fe3aec
mov byte [eax + ebx - 1], 0x3d
jmp 0x406520e
mov eax, esi
call fcn.03fe3894
mov ecx, 3
cdq
idiv ecx
cmp edx, 2
jne 0x406520e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.03fe3894
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.03fe3aec
mov byte [eax + ebx - 1], 0x3d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x406522a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406a1f8
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48af91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x48afa8
call fcn.03fe360c
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.03fe3650
mov edx, dword [ebp - 0x14]
mov eax, 0x48afb4
call fcn.03fe3bd8
test eax, eax
jg 0x406a25d
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, 0x48afc0
call fcn.03fe38e0
xor eax, eax
push ebp
push 0x48af66
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x48afc8
call fcn.04018704
mov ebx, eax
test ebx, ebx
je 0x406a35c
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.03fe3a94
push eax
push ebx
call fcn.0401870c
mov esi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov edi, 0x194
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x114]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.03fe2144
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x13
push esi
call fcn.040186f4
test eax, eax
je 0x406a2fd
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.03fe37b0
mov eax, dword [ebp - 0x118]
call fcn.03fe8118
mov edi, eax
cmp edi, 0x194
jae 0x406a34c
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x114]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.03fe2144
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
call fcn.040186f4
test eax, eax
je 0x406a34c
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x114]
call fcn.03fe37b0
test esi, esi
je 0x406a356
push esi
call fcn.040186fc
push ebx
call fcn.040186fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x406a370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48af98
lea eax, [ebp - 0x118]
call fcn.03fe35b8
lea eax, [ebp - 0x14]
call fcn.03fe35b8
ret

Function at 0x4074158
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4b3ff8
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x407417a
shr eax, 1
xor eax, 0xedb88320
jmp 0x407417c
shr eax, 1
dec edx
jne 0x4074168
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4074161
mov byte [0x4b43f8], 1
pop esi
pop ebx
ret

Function at 0x4074198
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4b43f8], 0
jne 0x40741af
call fcn.04074158
mov eax, edi
dec eax
test eax, eax
jl 0x40741d8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b3ff8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x40741b9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4076728
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4076759
dec al
je 0x4076795
dec al
je 0x40767d9
dec al
je 0x4076844
jmp 0x40768ce
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x40768ce
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4076769
jmp 0x40768ce
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x40768ce
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x40767a5
jmp 0x40768ce
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x40768ce
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4076807
xor ebp, ebp
jmp 0x4076818
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4076821
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x40767e9
jmp 0x40768ce
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x40768ce
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x407689c
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.040741e0
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4076858
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1000144a
Capabilities:
Clear file content
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb0
xor eax, eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x60], eax
jmp 0x100014bf
mov eax, dword [esp + 0x5c]
add eax, 1
cmp eax, 0xf1
mov dword [esp + 0x60], eax
jne 0x100014bf
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x58]
mov ecx, esp
mov dword [ecx + 4], 0xc3893
mov dword [ecx], 0xf11
mov ecx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x54], eax
call ecx
sub esp, 8
mov ecx, dword [esp + 0x54]
add ecx, 1
cmp ecx, 0xa
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], ecx
je 0x10001469
jmp 0x10001481
mov eax, dword [esp + 0x60]
mov ecx, esp
mov dword [ecx], 0x56f
mov ecx, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [esp + 0x5c], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx + 8], 0x802
mov dword [ecx + 4], 0x58
mov dword [ecx], str.aMOcQW_NRS9GL_3
mov ecx, dword [sym.imp.SHLWAPI.dll_StrChrNW]
mov dword [esp + 0x4c], eax
call ecx
sub esp, 0xc
xor ecx, ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x44]
mov ecx, 0xcccccccd
mov dword [esp + 0x40], eax
mul ecx
shr edx, 4
imul eax, edx, 0x14
mov ecx, dword [esp + 0x40]
sub ecx, eax
mov eax, ecx
sub eax, 7
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], eax
je 0x10001555
jmp 0x10001535
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x100015b9
jmp 0x1000153f
mov eax, esp
mov dword [eax], 0x216762
mov eax, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
call eax
sub esp, 4
mov dword [esp + 0x34], eax
xor eax, eax
mov ecx, 0x20
mov edx, dword [esp + 0x64]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x20
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
call fcn.100a3eb0
mov eax, esp
lea ecx, [esp + 0x90]
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call eax
sub esp, 4
mov eax, esp
mov dword [eax + 8], 0x194
mov dword [eax + 4], 0xb1f
mov dword [eax], 0x783c02
mov eax, dword [sym.imp.KERNEL32.dll_EraseTape]
call eax
sub esp, 0xc
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x40]
add eax, 1
cmp eax, 0x8b
mov dword [esp + 0x44], eax
jne 0x10001509
xor eax, eax
xor ecx, ecx
mov edx, dword [esp + 0x5c]
sub edx, 6
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
je 0x10001627
jmp 0x100015ec
mov eax, dword [esp + 0x5c]
sub eax, 0x23
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov dword [esp + 0x58], ecx
jne 0x10001481
jmp 0x10001607
mov eax, esp
lea ecx, [esp + 0x80]
mov dword [eax + 4], ecx
mov dword [eax], 0x369798
mov eax, dword [sym.imp.USER32.dll_GetClientRect]
call eax
sub esp, 8
mov dword [esp + 0x14], eax
mov eax, esp
mov dword [eax], 0x585b08
mov eax, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call eax
sub esp, 4
mov ecx, esp
lea edx, [esp + 0x68]
mov dword [ecx + 4], edx
mov dword [ecx], 0xd1166
mov ecx, dword [sym.imp.ole32.dll_OleCreateMenuDescriptor]
mov dword [esp + 0x10], eax
call ecx
sub esp, 8
mov dword [esp + 0xc], eax
jmp 0x10001469