joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 8]
cmp dword [edi + 0x408], 0
je 0x40c265
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.0041f7f0
add esp, 4
push eax
push ebx
call fcn.0040c520
add esp, 8
movzx eax, al
lea esi, [edi + eax*4 + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esi]
lea eax, [esi + 0x10]
push ebx
push eax
call fcn.0041f760
add esp, 8
test eax, eax
jne 0x40c1b0
mov edi, dword [esi + 8]
test edi, edi
je 0x40c2b2
mov ebx, dword [esi + 4]
push 0xc
call fcn.0041f68f
add esp, 4
test eax, eax
je 0x40c28c
mov ecx, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], ebx
mov dword [eax + 8], edi
mov edx, eax
mov eax, dword [ecx + 0x404]
test eax, eax
je 0x40c2ac
lea ecx, [edi + ebx - 1]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ecx
nop
mov edi, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 8]
cmp edi, dword [ebp - 0x14]
lea edx, [edi + eax - 1]
ja 0x40c227
cmp edx, dword [ebp - 0x14]
jae 0x40c281
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp edx, ebx
setb byte [ebp - 0xd]
cmp ecx, edi
setb al
cmp ecx, edx
seta ah
cmp edi, ebx
setb bl
cmp edx, ecx
seta cl
or cl, byte [ebp - 0xd]
cmp cl, 1
jne 0x40c281
and bl, ah
or al, bl
je 0x40c281
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
test eax, eax
jne 0x40c210
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x40c2b2
mov ecx, edi
call fcn.0040c2c0
xor esi, esi
test eax, eax
jne 0x40c2b2
mov dword [edi + 0x408], 1
jmp 0x40c189
push dword [ebp - 0x18]
call fcn.0041f205
add esp, 4
push 2
call fcn.00415889
add esp, 4
push eax
push 1
push 0x31
push str.ERROR:_file_content_collision_in_mar_find_item___n
call fcn.0041f222
add esp, 0x10
xor esi, esi
jmp 0x40c2b2
mov dword [ecx + 0x404], edx
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40da20
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x43d00c]
mov ebx, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
call fcn.0041fbd0
add esp, 4
test eax, eax
je 0x40dc0d
mov edi, eax
movzx eax, word [ebx + eax*2 - 2]
cmp eax, 0x5c
je 0x40da5b
movzx eax, ax
cmp eax, 0x2f
jne 0x40da5c
dec edi
lea eax, [edi + 2]
mov ecx, 0xffffffff
add eax, eax
cmovae ecx, eax
push ecx
call fcn.00412415
add esp, 4
mov esi, eax
lea eax, [edi + edi + 4]
push eax
push 0
push esi
call fcn.00414f70
add esp, 0xc
lea eax, [edi + 1]
push eax
push ebx
push esi
call fcn.00420049
add esp, 0xc
push esi
call fcn.0041d2f5
add esp, 4
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push 0xf0000000
push 1
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x40db7d
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40dba4
add edi, edi
push 0
push edi
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40dba4
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x20]
push 0
push eax
push ecx
push 4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
xor edi, edi
test eax, eax
je 0x40dc23
mov edi, dword [ebp - 0x20]
push edi
call fcn.00412415
add esp, 4
mov ebx, eax
push edi
push 0
push eax
call fcn.00414f70
add esp, 0xc
push 0
lea eax, [ebp - 0x20]
push eax
push ebx
push 2
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x40dba4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40db66
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0x14]
mov edi, 1
test eax, eax
je 0x40dba6
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x40dba6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x40dba4
push 0xf0000008
push 1
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40dacd
xor edi, edi
push esi
call fcn.0041241e
add esp, 4
test edi, edi
je 0x40dc0d
mov esi, dword [ebp + 0xc]
push 0x104
push 0x438158
push esi
call fcn.00420049
add esp, 0xc
cmp dword [ebp - 0x20], 0
mov edi, ebx
je 0x40dbfd
add esi, 0x48
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [edi + ebx]
push eax
push str._.2x
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc ebx
add esi, 4
cmp ebx, dword [ebp - 0x20]
jb 0x40dbe0
push edi
call fcn.0041241e
add esp, 4
mov esi, 1
jmp 0x40dc0f
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412bfe
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x40dba6
Function at 0x40e9c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x43d00c]
mov edi, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [edi], 0
je 0x40ea18
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
push dword [edi]
push 1
push 0xd
push str._Warning:
call fcn.0041f222
add esp, 0x10
mov ecx, dword [edi]
mov edx, esi
push dword [ebp - 0x10]
call fcn.0040e990
add esp, 4
push dword [edi]
push 1
push 4
push str._n
call fcn.0041f222
add esp, 0x10
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00412bfe
add esp, 8
pop esi
pop edi
pop ebp
ret
Function at 0x40ea30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x220
mov eax, dword [0x43d00c]
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x21a]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x20a
push 0
push edi
call fcn.00414f70
add esp, 0xc
push 0x104
push esi
push edi
call fcn.00420049
add esp, 0xc
lea ebx, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push ebx
push 0x4381ae
push edi
call fcn.004200da
add esp, 0xc
test eax, eax
je 0x40ec22
mov esi, eax
mov dword [ebp - 0x228], eax
nop
nop
nop
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x400
je 0x40ec00
push 0
push 0x2200000
push 3
push 0
push 7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp eax, 0xffffffff
je 0x40eb41
push 0x4000
call fcn.00412415
add esp, 4
mov ebx, eax
push 0x4000
push 0
push eax
call fcn.00414f70
add esp, 0xc
mov dword [ebp - 0x224], 0
push 0
lea eax, [ebp - 0x224]
push eax
push 0x4000
push ebx
push 0
push 0
push 0x900a8
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40eb54
mov eax, dword [ebx]
cmp eax, 0xa000000c
je 0x40eb62
cmp eax, 0xa0000003
jne 0x40eb54
movzx eax, word [ebx + 0xa]
cmp eax, 5
jb 0x40eb6b
movzx eax, word [ebx + 8]
and eax, 0xfffffffe
lea eax, [ebx + eax + 0x10]
jmp 0x40eb8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, 1
setne al
jmp 0x40ebd2
mov dword [ebp - 0x22c], 1
mov al, 1
jmp 0x40ebb1
movzx eax, word [ebx + 0xa]
cmp eax, 5
jae 0x40eb81
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x228], 0
jmp 0x40ebb7
movzx eax, word [ebx + 8]
and eax, 0xfffffffe
lea eax, [ebx + eax + 0x14]
push 4
push 0x4381a2
push eax
call fcn.0042000f
add esp, 0xc
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x228]
setne cl
mov dword [ebp - 0x22c], ecx
or al, cl
mov dword [ebp - 0x228], eax
push ebx
call fcn.0041241e
add esp, 4
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x22c]
lea ebx, [ebp - 0x220]
mov dword [ebp - 0x228], eax
mov eax, edi
inc eax
cmp eax, 2
jae 0x40ebe6
test ecx, ecx
je 0x40ec00
jmp 0x40ec2c
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
test ecx, ecx
jne 0x40ec2c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
push 0x4381ae
push 0
call fcn.004200da
add esp, 0xc
mov edi, eax
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test edi, edi
jne 0x40eaa0
mov dword [ebp - 0x228], 0
mov ebx, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
and bl, 1
call fcn.00412bfe
mov eax, ebx
add esp, 0x220
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f050
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
push 5
push str.MozillaMaintenance
call fcn.0040f110
add esp, 8
cmp eax, 1
jne 0x40f0e3
push 5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
je 0x40f0ea
mov esi, eax
push 0x10
push str.MozillaMaintenance
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x40f0f1
mov ebx, eax
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], 0
nop
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x40f0cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x64
cmp edi, 0x1388
jb 0x40f0a0
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push edi
call esi
mov eax, dword [ebp - 0x14]
jmp 0x40f0fd
add eax, 0x4e20
jmp 0x40f0fd
mov eax, 0x4269
jmp 0x40f0fd
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x426a
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f110
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [0x43d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
je 0x40f1e3
mov esi, eax
push 4
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x40f209
mov ecx, dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x30], 0xcf
imul ebx, ecx, 0x3e8
test ebx, ebx
je 0x40f231
xor esi, esi
nop
nop
nop
nop
lea eax, [ebp - 0x38]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40f1a0
cmp dword [ebp - 0x30], 1
jne 0x40f1cc
jmp 0x40f252
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
jle 0x40f26e
lea ecx, [eax - 0x41c]
cmp ecx, 0xa
ja 0x40f295
mov edx, 0x601
bt edx, ecx
jae 0x40f295
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0x32
cmp esi, ebx
jb 0x40f170
mov ebx, dword [ebp - 0x30]
jmp 0x40f2c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x429
mov ebx, 0xfd
sete cl
xor ecx, 0xff
cmp eax, 5
cmovne ebx, ecx
jmp 0x40f2d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, 0x7a
jg 0x40f23b
cmp edi, 5
je 0x40f259
cmp edi, 6
jne 0x40f267
mov ebx, 0xec
jmp 0x40f2d3
mov ebx, 0xcf
jmp 0x40f2c5
cmp edi, 0x7b
je 0x40f260
cmp edi, 0x424
jne 0x40f267
mov ebx, 0xee
jmp 0x40f2d3
mov ebx, 1
jmp 0x40f2c5
mov ebx, 0xeb
jmp 0x40f2d3
mov ebx, 0xed
jmp 0x40f2d3
mov ebx, 0xef
jmp 0x40f2d3
cmp eax, 0x56
jg 0x40f284
cmp eax, 5
je 0x40f2a8
cmp eax, 6
jne 0x40f2bd
mov ebx, 0xd9
jmp 0x40f2c2
cmp eax, 0x57
je 0x40f2af
cmp eax, 0x7a
jne 0x40f2bd
mov ebx, 0xdb
jmp 0x40f2c2
cmp eax, 0x7c
je 0x40f2b6
cmp eax, 0x45b
jne 0x40f2bd
mov ebx, 0xde
jmp 0x40f2c2
mov ebx, 0xda
jmp 0x40f2c2
mov ebx, 0xdc
jmp 0x40f2c2
mov ebx, 0xdd
jmp 0x40f2c2
mov ebx, 0xdf
mov dword [ebp - 0x30], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x3c]
call esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412bfe
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f3f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x43d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40f499
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x18]
push eax
push 4
push ecx
push 0x12
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, dword [ebp - 0x18]
mov edi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
test edi, edi
je 0x40f49b
cmp ebx, 3
jne 0x40f49b
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
test eax, eax
jne 0x40f49b
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push esi
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push str.ConsentPromptBehaviorAdmin
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov eax, dword [ebp - 0x18]
je 0x40f4af
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412bfe
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x20]
push esi
push ecx
push 0
push 0
push str.PromptOnSecureDesktop
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
test edi, edi
jne 0x40f49b
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp + 8]
mov esi, 1
or ecx, dword [ebp - 0x1c]
sete dl
mov dword [eax], edx
jmp 0x40f49b

Function at 0x40f590
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x254
mov eax, dword [0x43d00c]
mov esi, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x40f5fc
lea ecx, [ebp - 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40f632
lea eax, [ebp - 0x22c]
push 0x105
push eax
push 0x43fc68
call fcn.00420049
add esp, 0xc
mov esi, 0x43fc68
mov word [0x43fe70], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00412bfe
mov eax, esi
add esp, 0x254
pop esi
pop ebp
ret
lea ecx, [ebp - 0x258]
lea eax, [esi + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40f5c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00419e3b
cmp esi, 2
mov ecx, 9
cmove ecx, esi
xor esi, esi
mov dword [eax], ecx
jmp 0x40f5e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x12
je 0x40f5e7
call fcn.00419e3b
mov dword [eax], 2
jmp 0x40f5e7
Function at 0x40fdd0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, ecx
mov ecx, dword [esp + 0x24]
xor edi, edi
cmp dword [ebx], 4
mov eax, dword [ecx]
jne 0x40ff86
mov ebp, dword [esp + 0x28]
sub ebp, eax
cmp ebp, 5
jb 0x40ff86
mov esi, dword [ebx + 0x10]
add edx, eax
add ebp, 0xfffffffc
xor edi, edi
mov eax, 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov cl, byte [edx + edi]
and cl, 0xfe
cmp cl, 0xe8
jne 0x40fe40
mov ecx, edi
sub ecx, eax
cmp ecx, 3
jbe 0x40fe50
xor esi, esi
jmp 0x40fe90
mov ecx, edi
jmp 0x40ff61
dec ecx
shl esi, cl
mov eax, esi
mov esi, 0
and eax, 7
je 0x40fe90
mov ecx, 0x17
bt ecx, eax
jae 0x40ff59
movzx esi, byte [eax + 0x4354ec]
lea ecx, [edi + 4]
sub ecx, esi
mov cl, byte [edx + ecx]
inc cl
cmp cl, 1
jbe 0x40ff59
mov esi, eax
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [edx + edi + 4]
mov ecx, eax
inc cl
cmp cl, 1
jbe 0x40fea7
lea esi, [esi + esi + 1]
jmp 0x40ff5d
movzx ebp, byte [edx + edi + 2]
movzx ecx, byte [edx + edi + 1]
shl eax, 0x18
movzx edx, byte [edx + edi + 3]
mov dword [esp + 0xc], esi
or eax, ecx
shl ebp, 8
shl edx, 0x10
or eax, ebp
mov ebp, 0xfffffffb
sub ebp, edi
or eax, edx
sub ebp, dword [ebx + 0xc]
add eax, ebp
test esi, esi
je 0x40ff21
movzx esi, byte [esi + 0x4354ec]
mov ebx, 0x18
mov edx, eax
shl esi, 3
sub ebx, esi
mov ecx, ebx
shr edx, cl
inc dl
cmp dl, 1
ja 0x40ff21
mov ecx, 0x20
sub ecx, esi
mov esi, 0xffffffff
shl esi, cl
not esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, esi
mov ecx, ebx
add eax, ebp
mov edx, eax
shr edx, cl
inc dl
cmp dl, 2
jb 0x40ff10
mov edx, eax
mov ebp, dword [esp]
mov esi, dword [esp + 0xc]
lea ecx, [edi + 4]
and edx, 0x1000000
mov ebx, edx
neg ebx
or ebx, edx
mov edx, dword [esp + 4]
shr ebx, 0x18
mov byte [edx + edi + 1], al
mov byte [edx + edi + 2], ah
shr eax, 0x10
mov byte [edx + edi + 3], al
mov byte [edx + edi + 4], bl
mov ebx, dword [esp + 8]
jmp 0x40ff5f
lea esi, [eax + eax + 1]
mov ecx, edi
mov eax, edi
mov edi, ecx
inc edi
cmp edi, ebp
jb 0x40fe20
mov edx, edi
sub edx, eax
xor eax, eax
lea ecx, [edx - 1]
shl esi, cl
mov ecx, dword [esp + 0x24]
cmp edx, 3
cmovbe eax, esi
mov dword [ebx + 0x10], eax
mov eax, dword [ecx]
add eax, edi
mov dword [ecx], eax
add dword [ebx + 0xc], edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x427968
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00427bb3

Function at 0x4299ff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00429a0a
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x6e3a64f6
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x33345a57
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov ebp, dword [esp + 0x254]
mov esi, dword [esp + 0x250]
xor eax, eax
cmp byte [0x4487b4], 0
sete al
jmp dword [eax*4 + 0x4434f4]

Function at 0x4030f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4031d0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4031d0
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40313a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x403141
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x403120
jmp 0x403143
mov esi, 0x1505
jmp 0x403143
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x4031d0
mov eax, edi
or eax, 1
mov ebx, edi
or ebx, 0xfffffffe
add ebx, eax
and ebx, esi
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x403174
inc ebx
dec edi
je 0x4031ce
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x4031ce
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x403170
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.00409790
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x403170
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.004097b0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x403170
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4031d0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403630
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x403783
mov esi, dword [esp + 0x28]
test esi, esi
je 0x403783
cmp dword [esp + 0x2c], 0
je 0x403783
push esi
call fcn.00409790
add esp, 4
test eax, eax
je 0x40369a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x4036a1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x403680
jmp 0x4036a3
mov ebx, 0x1505
jmp 0x4036a3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x403725
mov dword [esp], eax
mov eax, edi
or eax, 1
mov esi, edi
or esi, 0xfffffffe
add esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4036d4
inc esi
dec edi
je 0x403725
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x40372a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4036d0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.00409790
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4036d0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.004097b0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4036d0
mov eax, 0xffffffff
jmp 0x403783
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jae 0x40376f
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
jmp 0x403783
call fcn.00403830
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
je 0x40378b
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.00409790
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x40381e
mov eax, edi
or eax, 1
mov esi, edi
or esi, 0xfffffffe
add esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4037c4
inc esi
dec edi
je 0x40381e
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x403732
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4037c0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00409790
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4037c0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.004097b0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4037c0
jmp 0x403732
mov ebp, 0xffffffff
jmp 0x403732