joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415110
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x48f00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x493c94], 0
push edi
mov edi, ecx
je 0x415140
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fe16
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00434c70
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41512f
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.00434c70
add esp, 0xc
lea eax, [ebp - 0x210]
push str.user32.dll
push eax
push str._s_s
lea eax, [ebp - 0x418]
push 0x208
push eax
call fcn.0040f160
add esp, 0x14
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x41512f
push str.UpdateLayeredWindow
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x493c94], eax
test eax, eax
je 0x41512f
xor edx, edx
push ecx
lea ecx, [edx + 6]
call fcn.00415010
add esp, 4
test al, al
je 0x415244
push 0x208
lea eax, [ebp - 0x620]
push 0
push eax
call fcn.00434c70
add esp, 0xc
lea eax, [ebp - 0x210]
push str.dwmapi.dll
push eax
push str._s_s
lea eax, [ebp - 0x620]
push 0x208
push eax
call fcn.0040f160
add esp, 0x14
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x415244
push str.DwmIsCompositionEnabled
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x493c90], eax
push 0x30
lea eax, [ebp - 0x650]
mov dword [0x48fb20], edi
push 0
push eax
call fcn.00434c70
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
add esp, 0xc
mov dword [ebp - 0x650], 0x30
mov dword [ebp - 0x64c], 3
mov dword [ebp - 0x648], eax
push 0x7f00
push 0
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x63c], edi
mov dword [ebp - 0x638], 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x634], eax
lea eax, [ebp - 0x650]
push eax
mov dword [ebp - 0x630], 6
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x628], 0x48129c
mov dword [ebp - 0x624], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.0042fe16
mov esp, ebp
pop ebp
ret
Function at 0x4199a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e3b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x4199da
xor al, al
jmp 0x419aca
cmp dword [esi + 0x14], 0x10
jb 0x4199e4
mov eax, dword [esi]
jmp 0x4199e6
mov eax, esi
test eax, eax
je 0x419a04
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419a04
shr eax, 4
and al, 1
je 0x419a04
mov al, 1
jmp 0x419aca
or edi, 0xffffffff
cmp dword [esi + 0x14], 0x10
jb 0x419a0f
mov esi, dword [esi]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push 0x480b88
push esi
mov dword [ebp - 0x2c], 0
call fcn.0043b96e
mov edx, eax
add esp, 0xc
test edx, edx
je 0x419aad
cmp byte [edx], 0
jne 0x419a50
xor ecx, ecx
jmp 0x419a5e
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419a55
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00409ca0
xor eax, eax
lea ecx, [ebp - 0x28]
cmp byte [0x480b88], al
setne al
push eax
push 0x480b88
call fcn.00409ca0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0043ceb5
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push 0x480b88
push 0
call fcn.0043b96e
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x419a47
mov ecx, dword [ebp - 0x14]
cmp edi, 0xffffffff
setne bl
cmp ecx, 0x10
jb 0x419ac8
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00409f90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fe16
mov esp, ebp
pop ebp
ret

Function at 0x419fc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x32
push 0x493da8
mov esi, ecx
mov dword [ebp - 8], 0
push edx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x41a02c
mov ecx, 0x4808d2
mov eax, 0x493da8
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41a010
test dl, dl
je 0x41a00c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41a010
add eax, 2
add ecx, 2
test dl, dl
jne 0x419ff0
xor eax, eax
jmp 0x41a015
sbb eax, eax
or eax, 1
test eax, eax
je 0x41a02c
push 0x493da8
mov ecx, esi
call fcn.00408b90
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [edx], 0
jne 0x41a057
xor ecx, ecx
push ecx
push edx
mov ecx, esi
call fcn.004099c0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, edx
push edi
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a060
sub ecx, edi
pop edi
push ecx
push edx
mov ecx, esi
call fcn.004099c0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4286f0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46fdeb
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x48f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x244], eax
push eax
lea ecx, [ebp - 0x248]
call fcn.004047b0
push 0
push 2
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x240], ebx
cmp ebx, 0xffffffff
jne 0x428757
xor edi, edi
jmp 0x428806
push 0x22c
lea eax, [ebp - 0x23c]
push 0
push eax
call fcn.00434c70
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
mov edi, 1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4287ff
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x234]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4287e2
push ecx
mov ecx, esp
push dword [ebp - 0x244]
call fcn.004047b0
mov ecx, dword [ebp - 0x234]
call fcn.00428850
add esp, 4
test eax, eax
je 0x4287db
push 0
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4287db
push eax
push esi
call ebx
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x428794
mov ebx, dword [ebp - 0x240]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42882b
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fe16
mov esp, ebp
pop ebp
ret
Function at 0x428850
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46fe28
mov eax, dword fs:[0]
push eax
mov eax, 0x1210
call fcn.0046b670
mov eax, dword [0x48f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x42892b
lea eax, [ebp - 0x121c]
push eax
push 0x1000
lea eax, [ebp - 0x1218]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x428924
xor esi, esi
test dword [ebp - 0x121c], 0xfffffffc
jbe 0x428924
mov ebx, dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
nop dword [eax]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00434c70
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x208
push eax
push dword [ebp + esi*4 - 0x1218]
push edi
call ebx
test eax, eax
je 0x428916
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call fcn.0043cf02
add esp, 8
test eax, eax
je 0x42896d
mov eax, dword [ebp - 0x121c]
inc esi
shr eax, 2
cmp esi, eax
jb 0x4288d0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42894f
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fe16
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
jmp 0x42892d
Function at 0x42ef50
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x48f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x105
lea eax, [ebp - 0x218]
mov dword [ebp - 0x438], 0
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x434], ebx
call fcn.00434c70
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push str.tutor
push eax
call edi
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4824f8
lea eax, [ebp - 0x218]
push eax
call edi
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00434c70
movzx eax, word [ebp - 0x42a]
add esp, 0xc
push eax
movzx eax, word [ebp - 0x42e]
push eax
movzx eax, word [ebp - 0x430]
push eax
push str.uninstall
push str._s__4d__02d__02d.log
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.004015f0
add esp, 0x1c
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
lea edx, [ebp - 0x218]
mov ecx, ebx
call fcn.00428aa0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.0042fe16
mov esp, ebp
pop ebp
ret

Function at 0x42f070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470812
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x48f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x220], edi
mov dword [ebp - 4], 0
push 0x47ee1c
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x21c], 0
call fcn.004047b0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x21c], 1
call fcn.00434c70
add esp, 0xc
mov dword [ebp - 0x228], 1
mov edx, esi
mov dword [ebp - 0x224], 0x207
lea ecx, [ebp - 0x220]
call fcn.00428ea0
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push str.InstallLocation
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42f149
cmp word [ebp - 0x218], ax
je 0x42f149
mov bl, 1
jmp 0x42f14b
xor bl, bl
mov edx, dword [ebp - 0x220]
or eax, 0xffffffff
mov dword [ebp - 0x21c], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42f173
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x42f19e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42f180
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.004051d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fe16
mov esp, ebp
pop ebp
ret
Function at 0x42f1c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470862
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x48f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
mov dword [ebp - 4], 0
push edx
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x21c], 0
call fcn.004047b0
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x21c], 1
call fcn.00434c70
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
js 0x42f261
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
push str.TEMP
call fcn.0042f310
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00434c70
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x42f2a3
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
push str.APPDATA
call fcn.0042f310
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00434c70
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x42f2e5
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
push str.LOCALAPPDATA
call fcn.0042f310
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fe16
mov esp, ebp
pop ebp
ret

Function at 0x4479a6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00447825

Function at 0x44bcb5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044b975

Function at 0x456ccf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4010c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x2020
mov ebp, esp
push esi
push ebx
call fcn.00401218
sub esp, eax
lea eax, [ebp + 0xc]
lea esi, [ebp - 0x2008]
mov dword [ebp - 0x200c], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x2000
mov dword [esp + 0x10], eax
mov dword [esp + 8], esi
mov dword [esp], 6
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vsprintf]
test eax, eax
jle 0x401150
mov ebx, eax
mov dword [esp], 0xfffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
xor ecx, ecx
push edx
lea edx, [ebp - 0x200c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov eax, dword [ebp - 0x200c]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x401170
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x401cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d18
cmp byte [esi + ebx - 1], 0xa
je 0x401cec
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x407084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x402710
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1e9c2d9c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3bb26014
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x65c2a0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x65c2a6
pop ebp
sub ebp, 0x45854c
lea edi, [ebp + 0x45a155]
mov esi, edi
mov ecx, 0x92
xor ebx, ebx
lodsb al, byte [esi]
xor al, 0x44
sub al, bl
rol al, 2
stosb byte es:[edi], al
inc ebx
loop 0x65c2bc
mov eax, dword [esp + 0x20]
inc eax
js 0x65c2d9
mov dword [ebp + 0x45a159], 1
cmp dword [ebp + 0x45a159], 0
jne 0x65c2e4
jmp 0x65c2fa
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.0065c389
pop ebp
jmp 0x65c30e
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.0065c616
or dword [ebx], eax
add byte [eax], al
pop ebp
mov ecx, 0x17a7
lea edi, [ebp + 0x4589ae]
mov esi, edi
lodsb al, byte [esi]
stc
test byte [edi], ah
mov al, byte [0xd6fe9fc0]
jns 0x65c309
popal
les ebp, [eax - 0x3e]
mov byte [ebp + 0x4b054ec], al
mov ah, pe_nt_image_headers32
push esi
dec eax
test al, 0x32
push esi
test al, 0x3d
jnp 0x65c357
or eax, dword [ecx]
mov al, byte [0x22100004]
out 0xf6, al
xor byte [esi], al
xchg edi, eax
push 0x6fe4097f
stosb byte es:[edi], al
loop 0x65c31b
cmp dword [ebp + 0x45a159], 0
jne 0x65c35a
add ch, bl
push ss
jmp 0x65c370
push ebp
lea eax, [ebp + 0x4591ce]
push eax
mov eax, 0x30
push eax
call fcn.0065c389
pop ebp
jmp 0x65c384
push ebp
lea eax, [ebp + 0x4591ce]
push eax
mov eax, 0x30
push eax
call fcn.0065c616
pop ebp
jmp 0x65c708
retf 0x161f
Function at 0x65c616
Capabilities:
Check for trap flag exception

Disassembly:
mov ebp, esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a1aa]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add ecx, dword [ebx + 0x33020875]
fild dword [esi]
mov edx, 0x8b030001
jge 0x65c666
push es
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
mov ecx, dword [ebp + 4]
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a1aa]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [edx + 0x7d8b0306]
or al, 6
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
push ebx
push ecx
mov cl, 0
xor ebx, ebx
mov bx, dx
and bx, 1
shl bl, cl
xor al, bl
shl dx, 1
mov bx, dx
and bx, 0x8000
mov ch, 0x80
cmp bh, ch
jne 0x65c6ed
xor dx, 0x8003
inc cl
mov ch, 8
cmp cl, ch
jne 0x65c6ca
pop ecx
pop ebx
mov byte [esi], al
inc esi
inc ebx
cmp ecx, ebx
jne 0x65c675
mov esp, ebp
ret 8
Function at 0x40892e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
and edi, edx
sub edi, 1
call main
sub edx, edi
dec edx
xor dword [esi], eax
inc esi
sub edi, 1
mov edx, edx
cmp esi, ecx
jne fcn.0040892e
dec edi
sub esp, 4
mov dword [esp], 0x1c640bab
pop edi
ret
Function at 0x442540
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x8c], 1
jne 0x4425cf
xor eax, eax
cmp dword [edi + 0x60], 8
mov word [ebp - 8], ax
mov dword [ebp - 4], eax
lea eax, [edi + 0x4c]
jb 0x44256b
mov eax, dword [eax]
push str.rb__ccsUTF_8
push eax
lea eax, [ebp - 4]
push eax
call fcn.00632384
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x4425cf
push eax
push 2
lea eax, [ebp - 8]
push 1
push eax
call fcn.00632859
push dword [ebp - 4]
call fcn.00632464
mov cl, byte [ebp - 8]
add esp, 0x14
mov al, byte [ebp - 7]
cmp cl, 0xff
jne 0x4425ac
cmp al, 0xfe
je 0x4425cf
cmp al, 0xff
jne 0x4425b5
cmp cl, 0xfe
je 0x4425cf
mov eax, dword [ebx]
test eax, eax
je 0x4425c8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], 0
mov ecx, edi
call fcn.00443b40
cmp dword [edi + 0x60], 8
lea esi, [edi + 0x4c]
jb 0x4425dc
mov eax, dword [esi]
jmp 0x4425de
mov eax, esi
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x44267c
cmp dword [esi + 0x14], 8
jb 0x442606
mov esi, dword [esi]
push 0
push 0x80
push 1
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x442631
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x8c], 1
push 0
jne 0x442661
mov ecx, 0xfeff
mov word [ebp - 4], cx
lea ecx, [ebp - 8]
push ecx
push 2
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 8]
mov word [ebp - 4], 0xbbef
push ecx
push 3
lea ecx, [ebp - 4]
mov byte [ebp - 2], 0xbf
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4