joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00408518
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00408518
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00408518
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00408518
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00408518
mov dword [0x41203c], eax
call fcn.00408518
test eax, eax
jge 0x402550
push 8
call fcn.00408518
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00408518
pop ecx
push 1
call fcn.00408518
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00408518
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00408518
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00408518
jmp 0x402495

Function at 0x408518
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x408527
pop dword [ebp - 0x2c]
mov eax, 0x8c2f9dff
sub eax, 0x8bef18d8
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3bb78
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x38f6091f
sub ecx, 0x38f5b793
xor ebx, ebx
add ebx, eax
mov edx, 0x3fb77583
sub edx, 0x3f7639bf
add edx, dword [ebp - 0x2c]
mov edi, 0xccd9c4
add edi, 0xfe368fb2
xor dword [ebp - 0x20], 0x9e61cfba
mov esi, dword [edx]
mov dword [ebp - 0x14], 0xd3194bd8
xor esi, edi
mov dword [ebx], esi
xor dword [ebp - 0x18], ebx
add ebx, 0x72bc5cda
add ebx, 0x8d43a32a
add edx, 0x7bc36973
sub edx, 0x7bc3696f
loop 0x408583
add eax, 0xc5f4b671
add eax, 0x3a0c8292
xor ebx, ebx
add ebx, eax
add eax, 0xcb3161cf
add eax, 0x34ce9e36
mov ecx, 0x2667c411
sub ecx, 0x2627c411
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x49d054], 1
mov dword [0x49d050], 1
mov dword [0x49d04c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x49d00c], eax
mov eax, dword [0x49d060]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x49d074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x49d05c]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x455ad4], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x405370
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4053d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x49d068]
test esi, esi
jle 0x4054f0
mov eax, dword [0x49d06c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x405404
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x405487
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4053f0
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x405517
mov eax, dword [0x49d06c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x49d06c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4054f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x405480
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x405490
add dword [0x49d068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x49d06c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x405480
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40540e
mov eax, dword [0x49d06c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop
Function at 0x405a30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x49d084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x49d07c]
sub esp, 4
test ebx, ebx
je 0x405a85
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x405a7e
test esi, esi
je 0x405a7e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x405a60
mov dword [esp], 0x49d084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x405dc0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x405de5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x405df0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x405de5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x405e38
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x405e2e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x405e3a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x405e20
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a004]
jne 0x40100a
repz ret
jmp fcn.0040133d

Function at 0x40403b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040270a
and dword [ebp - 0x14], 0
cmp dword [0x44cad4], 0
mov dword [ebp - 0x18], eax
jne 0x4040ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404196
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404196
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44cad4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44cad8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44cadc], eax
call edi
push eax
call esi
mov dword [0x44cae4], eax
test eax, eax
je 0x4040ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44cae0], eax
mov eax, dword [0x44cae0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404147
cmp dword [0x44cae4], ecx
je 0x404147
push eax
call esi
push dword [0x44cae4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404147
test ebx, ebx
je 0x404147
call edi
test eax, eax
je 0x40413e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40413e
test byte [ebp - 8], 1
jne 0x404147
or dword [ebp + 0x10], 0x200000
jmp 0x40417a
mov eax, dword [0x44cad8]
cmp eax, dword [ebp - 0x18]
je 0x40417a
push eax
call esi
test eax, eax
je 0x40417a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40417a
mov eax, dword [0x44cadc]
cmp eax, dword [ebp - 0x18]
je 0x40417a
push eax
call esi
test eax, eax
je 0x40417a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44cad4]
call esi
test eax, eax
je 0x404196
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404198
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x409ce0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x44af60]
sub esp, 0x10
push esi
mov esi, dword [0x454640]
push edi
mov edi, dword [0x45491c]
push eax
call fcn.00409be0
add esp, 4
cmp dword [0x45491c], 0x2f
jne 0x409d3d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push esi
call fcn.00409c30
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409fa0
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x45491c]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
nop
cmp eax, 0x8cf
jne 0x409fc2
push 0
push 0
call edi
mov eax, dword [0x45491c]
cmp esi, 0x845013
jne 0x409fd9
mov eax, dword [0x44bd80]
add eax, 0xa231
mov dword [0x45491c], eax
cmp eax, 0x141
jne 0x409ff4
mov dword [0x44d018], 0xec58acac
mov dword [0x44d01c], 0xffffffff
inc esi
cmp esi, 0xbbe2a98
jl 0x409fb0
call fcn.00409d50
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40288e
pop dword [ebp - 0x28]
mov eax, 0x40288e
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x19354d4e
add dword [ebp - 0x38], 0x351cf7fd
mov dword [ebp - 0x34], 0xb8e26a6b
sub dword [ebp - 0x34], 0x86af1e26
mov dword [ebp - 0x30], 0x424a989a
add dword [ebp - 0x30], 0xa01ab94
mov dword [ebp - 0x2c], 0x51ba9a65
sub dword [ebp - 0x2c], 0x51ba9a65
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x72b8a99
sub dword [ebp - 0x38], 0x92b92143
mov dword [ebp - 0x34], 0x26bba897
sub dword [ebp - 0x34], 0xe54f4722
mov dword [ebp - 0x30], 0xdbec50cf
add dword [ebp - 0x30], 0x87831b9d
mov dword [ebp - 0x2c], 0xce76e34d
sub dword [ebp - 0x2c], 0xce76e34d
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x1cd83cac
add eax, 0xe36833fc
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x398a6
push 0
call eax
mov ecx, 0xd3d4da7c
add ecx, 0x2c2b794b
xor edi, edi
add edi, eax
mov ebx, 0xf7bb5637
sub ebx, 0xf77a5637
add ebx, dword [ebp - 0x28]
mov edx, 0x213855d0
add edx, 0x4c258b16
xor dword [ebp - 0x18], 0x264c1fd9
mov esi, dword [ebx]
mov dword [ebp - 0x20], 0x407a7ab8
sub esi, edx
add dword [ebp - 0x10], 0x2ab99882
mov dword [edi], esi
add edi, 0x2f2a26ec
sub edi, 0x2f2a26e8
add ebx, 0x851d4956
add ebx, 0x7ae2b6ae
loop 0x4029a8
add eax, 0x1c25b35
add eax, 0xfe3ee6ba
mov ebx, eax
add eax, 5
mov ecx, 0x5d3fd7e
add ecx, 0xfa6c0282
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401758
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea ecx, [ebp - 0x10]
mov dword [esp], eax
call fcn.0040167a
mov eax, dword [ebp - 0x10]
push ebx
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesW
lea ecx, [ebp - 0x10]
mov ebx, eax
push edx
call fcn.00401742
inc ebx
mov ebx, dword [ebp - 4]
setne al
leave
ret

Function at 0x40178a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea ecx, [ebp - 0x10]
mov dword [esp], eax
call fcn.0040167a
mov eax, dword [ebp - 0x10]
push ecx
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesW
lea ecx, [ebp - 0x10]
push ebx
mov ebx, eax
call fcn.00401742
cmp ebx, 0xffffffff
je 0x4017c2
shr ebx, 4
mov al, bl
and eax, 1
jmp 0x4017c4
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x40198a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call method.string.string_string_const_
mov ecx, esi
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
push eax
mov dword [edi + 0x1c], 0
mov dword [esp], edi
call fcn.0040167a
push eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileW
mov ecx, esi
sub esp, 0x1c
mov ebx, eax
call fcn.00401742
cmp ebx, 0xffffffff
je 0x401a57
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [ebp - 0x20], 0
call sub.KERNEL32.dll_GetFileSize
push esi
push esi
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
cmp esi, 0xffffffff
push eax
je 0x401a5e
mov eax, esi
mov ecx, dword [ebp - 0x20]
jmp 0x401a64
or eax, 0xffffffff
xor ecx, ecx
jmp 0x401a64
or eax, 0xffffffff
or ecx, 0xffffffff
mov dword [edi + 8], eax
mov eax, dword [edi]
mov dword [edi + 0xc], ecx
mov dword [esp], 0x2c
lea ebx, [eax + 4]
call sub.msvcrt.dll_malloc
mov dword [esp], ebx
mov dword [esp + 4], 0x24
mov ecx, eax
mov esi, eax
call fcn.00404d68
cmp byte [ebp - 0x2c], 0
mov dword [edi + 0x18], esi
push ebx
push ebx
je 0x401ae4
mov ecx, edi
call fcn.00401870
mov ebx, dword [edi + 0x18]
test al, al
jne 0x401abc
test ebx, ebx
je 0x401ab3
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov dword [edi + 0x18], 0
jmp 0x401ae4
mov dword [esp], 0x28
mov dword [edi + 0x1c], ebx
call sub.msvcrt.dll_malloc
mov dword [esp + 4], 1
mov dword [esp], ebx
mov ecx, eax
mov esi, eax
call fcn.004064a4
mov dword [edi + 0x18], esi
push ecx
push ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x405ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 1
push ebx
mov ebx, ecx
sub esp, 0x3c
mov edx, dword [ecx + 0x10]
mov edi, dword [ecx + 0x14]
sub edi, edx
je 0x405d37
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0x11c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [ebp - 0x1c], 0
call sub.KERNEL32.dll_WriteFile
mov eax, dword [ebp - 0x1c]
sub esp, 0x14
cmp eax, edi
je 0x405d34
xor esi, esi
jmp 0x405d37
sub dword [ebx + 0x14], eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4083ca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov edx, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [eax + 0x2c]
mov edi, eax
add edi, eax
mov dword [ebp - 0x1c], eax
imul eax, eax, 0xfffffffe
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], eax
mov edi, dword [edx + 0x3c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x6c]
add ecx, dword [edx + 0x2c]
mov dword [ebp - 0x20], edi
mov edi, dword [edx + 0x74]
sub dword [ebp - 0x20], edi
sub ecx, 0x106
sub dword [ebp - 0x20], eax
cmp eax, ecx
jb 0x408477
mov eax, dword [edx + 0x38]
mov ecx, dword [ebp - 0x1c]
mov edi, eax
lea esi, [eax + ecx]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x4c]
sub dword [edx + 0x70], ecx
sub dword [edx + 0x6c], ecx
sub dword [edx + 0x5c], ecx
imul esi, eax, 0xfffffffe
lea ecx, [eax + eax]
add ecx, dword [edx + 0x44]
add esi, ecx
movzx ebx, word [esi + eax*2 - 2]
xor ecx, ecx
mov edi, ebx
sub edi, dword [ebp - 0x1c]
cmp ebx, dword [ebp - 0x1c]
cmovae ecx, edi
mov word [esi + eax*2 - 2], cx
dec eax
jne 0x408431
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
add esi, dword [edx + 0x40]
add esi, dword [ebp - 0x28]
movzx ebx, word [esi + eax*2 - 2]
xor ecx, ecx
mov edi, ebx
sub edi, dword [ebp - 0x1c]
cmp ebx, dword [ebp - 0x1c]
cmovae ecx, edi
mov word [esi + eax*2 - 2], cx
dec eax
jne 0x408457
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x20], eax
mov ebx, dword [edx]
mov eax, dword [ebx + 4]
test eax, eax
je 0x40854f
mov edi, dword [edx + 0x38]
cmp eax, dword [ebp - 0x20]
mov esi, dword [edx + 0x6c]
mov dword [ebp - 0x24], edi
mov edi, dword [edx + 0x74]
jbe 0x40849f
xor ecx, ecx
cmp dword [ebp - 0x20], 0
je 0x40850d
jmp 0x4084a2
mov dword [ebp - 0x20], eax
sub eax, dword [ebp - 0x20]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4084d0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], edx
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call fcn.0040a2a8
jmp 0x4084f0
cmp eax, 2
jne 0x4084f6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], edx
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call fcn.00409f79
mov edx, dword [ebp - 0x30]
mov dword [ebx + 0x30], eax
lea eax, [edi + esi]
mov ecx, dword [ebp - 0x20]
add eax, dword [ebp - 0x24]
mov esi, dword [ebx]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
add dword [ebx], ecx
add dword [ebx + 8], ecx
mov ebx, dword [edx + 0x74]
add ebx, ecx
cmp ebx, 2
mov dword [edx + 0x74], ebx
ja 0x408528
mov eax, dword [edx]
cmp dword [eax + 4], 0
jne 0x4083e8
jmp 0x40854f
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x6c]
movzx esi, byte [ecx + eax]
mov dword [edx + 0x48], esi
movzx eax, byte [ecx + eax + 1]
mov ecx, dword [edx + 0x58]
shl esi, cl
xor eax, esi
and eax, dword [edx + 0x54]
cmp ebx, 0x105
mov dword [edx + 0x48], eax
jbe 0x40851a
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40c9dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
lea esi, [ebp + 0xc]
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], esi
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x40ca28
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
test ecx, ecx
jne 0x40ca44
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], 0x1c
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x3c], ecx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
mov ecx, dword [ebp - 0x3c]
je 0x40caf4
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
je 0x40cae8
cmp eax, 4
je 0x40cae8
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
cmp eax, 0x40
mov edx, dword [ebp - 0x40]
je 0x40ca39
cmp eax, 4
je 0x40ca39
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040c9dc
Function at 0x40cd78
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.0040cd54
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
push ecx
test ebx, ebx
je 0x40cdeb
nop
mov al, byte [ebx]
cmp al, 0x20
je 0x40cdb2
cmp al, 9
jne 0x40cdb8
inc ebx
jmp 0x40cda8
cmp al, 0x22
jne 0x40cdcb
jmp 0x40cdd8
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x40ce30
cmp al, 9
je 0x40ce34
test al, al
jne 0x40cdc0
jmp 0x40cde3
test al, al
je 0x40cde3
inc ebx
mov al, byte [ebx]
cmp al, 0x22
jne 0x40cdd4
nop
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x40cde0
cmp al, 9
je 0x40cde0
test byte [ebp - 0x30], 1
je 0x40ce28
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
push edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00402ab4
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
leave
lea esp, [ecx - 4]
ret
mov esi, 0xa
jmp 0x40cdf5
mov al, 0x20
jmp 0x40cde3
mov al, 9
jmp 0x40cde3