joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002043
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x18]
test ebx, ebx
push esi
mov esi, dword [ebp + 0x10]
je 0x1002383
and dword [ebx], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x1001164
push esi
call edi
test eax, eax
jne 0x1002088
mov eax, dword [ebp + 0x1c]
and byte [eax], 0
mov dword [ebp - 4], 1
jmp 0x1002382
push 0x1001174
push dword [ebp + 0x10]
call edi
test eax, eax
jne 0x10020ae
mov eax, dword [ebp + 0x1c]
and byte [eax], 0
mov dword [ebp - 4], 1
mov dword [ebx], 0x10
jmp 0x1002382
push 0x10013f4
push dword [ebp + 0x10]
call edi
test eax, eax
je 0x1002353
push 0x10013f0
push dword [ebp + 0x10]
call edi
test eax, eax
je 0x1002353
push 0x1001154
push dword [ebp + 0x10]
call edi
test eax, eax
jne 0x1002101
push dword [ebp + 0x1c]
push 0x1804
push 0x7d4
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01001e94
test eax, eax
jmp 0x100231e
push 0x100115c
push dword [ebp + 0x10]
call edi
test eax, eax
jne 0x100211e
push dword [ebp + 0x1c]
push 0x804
push 0x7d6
jmp 0x10020ed
push 7
push 0x100117c
push esi
call fcn.01001f71
test eax, eax
jne 0x100217d
add esi, 7
je 0x1002382
mov al, byte [esi]
test al, al
je 0x100214f
cmp al, 0x20
jne 0x100214f
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
test esi, esi
jne 0x1002138
test esi, esi
je 0x1002382
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1002382
push esi
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
inc eax
mov dword [ebx], eax
mov dword [ebp - 4], eax
jmp 0x1002382
push 0xd
push 0x100118c
push esi
call fcn.01001f71
test eax, eax
jne 0x10021da
add esi, 0xd
je 0x1002382
mov al, byte [esi]
test al, al
je 0x10021ae
cmp al, 0x20
jne 0x10021ae
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
test esi, esi
jne 0x1002197
test esi, esi
je 0x1002382
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1002382
push esi
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebx], 0x1000
jmp 0x100207c
push 7
push 0x1001184
push esi
call fcn.01001f71
test eax, eax
jne 0x1002218
add esi, 6
je 0x1002382
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1002382
push esi
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebx], 0x100
jmp 0x100207c
push 5
push 0x10011a8
push esi
jmp 0x1012408
je 0x1002382
jmp 0x100207c
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0x7d7
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x40
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0x18
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40288e
pop dword [ebp - 0x2c]
mov eax, 0xa275d0b3
add eax, 0x5dca57db
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xd0bf8547
sub dword [ebp - 0x3c], 0x826d3ffc
mov dword [ebp - 0x38], 0x90e0d2af
add dword [ebp - 0x38], 0xa1527996
mov dword [ebp - 0x34], 0x56c302d5
sub dword [ebp - 0x34], 0xa76bea7
mov dword [ebp - 0x30], 0x97dd23d2
sub dword [ebp - 0x30], 0x97dd23d2
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x34bdf723
sub eax, 0x347d7697
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xe214d9d9
sub dword [ebp - 0x3c], 0x6da27083
mov dword [ebp - 0x38], 0xa7e072c3
sub dword [ebp - 0x38], 0x6674114e
mov dword [ebp - 0x34], 0xf28d51c5
add dword [ebp - 0x34], 0x70e21aa7
mov dword [ebp - 0x30], 0x41b099f3
add dword [ebp - 0x30], 0xbe4f660d
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x39962
push 0
call eax
mov ecx, 0xeb8a67ae
sub ecx, 0xeb8a13b8
xor ebx, ebx
add ebx, eax
mov edx, 0x55b64233
add edx, 0xaa8acdcd
add edx, dword [ebp - 0x2c]
mov edi, 0x41941b63
sub dword [ebp - 0xc], 0xc5c5cd6e
mov esi, dword [edx]
xor dword [ebp - 8], edi
xor esi, edi
mov dword [ebx], esi
sub dword [ebp - 0x18], esi
add ebx, 0x3a818f1d
sub ebx, 0x3a818f19
add edx, 4
loop 0x4029a7
add eax, 0x522aa937
sub eax, 0x5229668c
xor ebx, ebx
add ebx, eax
add eax, 0x4231bcfb
sub eax, 0x4231bcf6
mov ecx, 0x3582c02d
sub ecx, 0x3542c02d
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x401cc5
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4d0c887
call fcn.00416f40
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040ee46
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040ee46
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
call fcn.0040ee46
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40295f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0x10]
lea eax, [esi + 1]
push eax
push 0x40
call dword [0x4d10024]
and dword [ebp - 4], 0
mov ecx, eax
mov dword [ebp - 8], ecx
mov byte [ecx + esi], 0
test esi, esi
je 0x4029fa
mov eax, dword [ebp + 8]
mov esi, dword [0x4d10020]
push ebx
sub eax, ecx
push edi
mov edi, dword [0x4d1001c]
mov dword [ebp - 0xc], eax
push 0x4d13160
call esi
push 0x4d131d0
call esi
push 0x4d13260
call esi
mov ebx, dword [ebp - 4]
push dword [ebp + 0xc]
add ebx, dword [ebp - 8]
call fcn.00416f46
mov ecx, eax
mov eax, dword [ebp - 4]
xor edx, edx
div ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [esp], 0x4d132d8
mov al, byte [edx + eax]
xor al, byte [ecx + ebx]
mov byte [ebx], al
call edi
push 0x4d133b8
call edi
push 0x4d13498
call edi
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jb 0x40299c
pop edi
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x404f3d
Capabilities:
Check http status code

Disassembly:
mov eax, 0x4d0cc38
call fcn.00416f40
sub esp, 0x598
push ebx
push esi
push edi
sub esp, 0xc
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
mov dword [ebp - 4], 1
call fcn.0040ee46
lea eax, [ebp - 0xa4]
push eax
call fcn.004047df
add esp, 0x10
push 0xf
pop ecx
push 0x5f5e0ff
mov esi, eax
xor ebx, ebx
lea edi, [ebp - 0x68]
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [0x4f2d164]
push eax
call dword [0x4f2d0fc]
push ebx
push ebx
xor edi, edi
push ebx
inc edi
push ebx
lea ecx, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
call fcn.0040f046
push eax
call dword [0x4f2d060]
push dword [0x4f1c338]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x64]
xor esi, esi
call dword [0x4f2d13c]
test eax, eax
jne 0x404fcf
mov esi, edi
cmp dword [ebp - 0x18], ebx
je 0x405103
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x50]
push dword [ebp - 0x58]
push dword [ebp - 0x18]
call dword [0x4f2d160]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x4050fa
mov eax, esi
neg eax
push ebx
sbb eax, eax
and eax, 0x800000
add eax, 0x400100
push eax
push ebx
push ebx
push dword [0x4f1c188]
push dword [ebp - 0x3c]
push 0x4d136d0
push dword [ebp - 0x24]
call dword [0x4f2d194]
mov edi, eax
cmp edi, ebx
je 0x4050f3
cmp esi, ebx
je 0x405047
or dword [ebp - 0x20], 0x10300
push 4
lea eax, [ebp - 0x20]
push eax
push 0x1f
push edi
call dword [0x4f2cf68]
push ebx
push ebx
push ebx
push ebx
push edi
call dword [0x4f2d128]
push ebx
mov esi, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x13
push edi
mov dword [ebp - 0x28], 0x100
call dword [0x4f2d1ac]
test eax, eax
jne 0x405097
lea ecx, [ebp + 8]
xor esi, esi
mov byte [ebp - 4], bl
call fcn.0040ee7a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040ee7a
mov eax, dword [ebp - 0x2c]
mov edx, esi
jmp 0x405129
lea eax, [ebp - 0x1a4]
push eax
call fcn.00410019
pop ecx
cmp eax, 0xc8
jne 0x405074
cmp esi, ebx
je 0x4050f3
jmp 0x4050ee
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x5a4]
push eax
push edi
call dword [0x4f2d088]
xor esi, esi
cmp dword [ebp - 0x10], ebx
jbe 0x4050f3
push 1
lea eax, [ebp + esi - 0x5a4]
push eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
push eax
call fcn.0041006a
inc dword [ebp - 0x14]
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x4050cf
cmp dword [ebp - 0x10], ebx
ja 0x4050b1
push edi
call dword [0x4f2d05c]
push dword [ebp - 0x24]
call dword [0x4f2d05c]
push dword [ebp - 0x18]
call dword [0x4f2d05c]
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0040ee7a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040ee7a
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x405c91
Capabilities:
Check http status code

Disassembly:
mov eax, 0x4d0ce46
call fcn.00416f40
sub esp, 0x978
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x14], ebx
sub esp, 0xc
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov dword [ebp - 4], 2
call fcn.0040ee46
lea eax, [ebp - 0xb4]
push eax
call fcn.004047df
add esp, 0x10
push 0xf
pop ecx
mov esi, eax
lea edi, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
push 0x4d136aa
lea ecx, [ebp - 0x30]
call fcn.0040ee0f
push ebx
push ebx
push ebx
push 1
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 3
call fcn.0040f046
push eax
call dword [0x4f2d060]
push dword [0x4f1c338]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x74]
xor esi, esi
call dword [0x4f2d13c]
test eax, eax
jne 0x405d18
inc esi
cmp dword [ebp - 0x10], ebx
je 0x405e5c
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x60]
push dword [ebp - 0x68]
push dword [ebp - 0x10]
call dword [0x4f2d160]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x405e53
mov eax, esi
neg eax
push ebx
sbb eax, eax
and eax, 0x800000
add eax, 0x400100
push eax
push ebx
push ebx
push dword [0x4f1c188]
push dword [ebp - 0x4c]
push 0x4d137d8
push dword [ebp - 0x1c]
call dword [0x4f2d194]
mov edi, eax
cmp edi, ebx
je 0x405e4a
cmp esi, ebx
je 0x405d90
or dword [ebp - 0x20], 0x10300
push 4
lea eax, [ebp - 0x20]
push eax
push 0x1f
push edi
call dword [0x4f2cf68]
push ebx
push ebx
push ebx
push ebx
push edi
call dword [0x4f2d128]
push ebx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1b4]
push eax
push 0x13
push edi
mov dword [ebp - 0x18], 0x100
call dword [0x4f2d1ac]
test eax, eax
jne 0x405dcf
mov ecx, dword [ebp + 8]
push 0x4d137dc
call fcn.0040ee0f
jmp 0x405e68
lea eax, [ebp - 0x1b4]
push eax
call fcn.00410019
pop ecx
cmp eax, 0xc8
jne 0x405ea4
cmp esi, ebx
je 0x405e43
mov esi, 0x7cf
jmp 0x405e2c
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x405e43
mov byte [ebp + eax - 0x984], bl
lea eax, [ebp - 0x984]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040ef88
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.0040eecd
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.0040ee7a
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp - 0x984]
push eax
push edi
call dword [0x4f2d088]
cmp eax, ebx
jne 0x405df2
push edi
call dword [0x4f2d05c]
push dword [ebp - 0x1c]
call dword [0x4f2d05c]
push dword [ebp - 0x10]
call dword [0x4f2d05c]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
call fcn.0040ee46
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 2
call fcn.0040ee7a
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040ee7a
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], bl
call fcn.0040ee7a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
mov ecx, dword [ebp + 8]
push 0x4d137e4
call fcn.0040ee0f
jmp 0x405e68
Function at 0x40671c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
push 0x40
push 0
push esi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
jne 0x40673a
xor eax, eax
inc eax
jmp 0x4067cc
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4067c9
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4067c9
push dword [ebp + 0xc]
lea edi, [esi + 0x40]
push 0xf8
push eax
push edi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
je 0x406732
cmp dword [edi], 0x4550
jne 0x4067c9
mov eax, 0x10b
cmp word [esi + 0x58], ax
jne 0x4067c9
movzx eax, word [esi + 0x46]
test ax, ax
je 0x4067c9
imul eax, eax, 0x28
push eax
mov dword [esi + 0x140], eax
call fcn.0041009d
pop ecx
mov dword [esi + 0x138], eax
test eax, eax
jne 0x4067a0
push 3
jmp 0x4067cb
push dword [ebp + 0xc]
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
push dword [esi + 0x140]
lea ecx, [ecx + edx + 0x18]
push ecx
push eax
mov dword [esi + 0x13c], ecx
call dword [ebp + 8]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
jmp 0x4067cc
push 2
pop eax
pop edi
pop ebp
ret

Function at 0x406db2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x406dec
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x406dec
mov edx, 0x10b
cmp word [eax + ecx + 0x18], dx
jne 0x406dec
push dword [ebp + 0xc]
push ecx
push dword [eax + ecx + 0x78]
call fcn.00406d16
add esp, 0xc
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x411ebd
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4d0e80d
call fcn.00416f40
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040ee46
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040ee46
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040ee46
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
add edi, 0x34
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
mov dword [esi + 0x30], eax
call fcn.0040ee46
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x407320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40732f
pop dword [ebp - 0x14]
mov eax, 0x40732f
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x35a5c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xee79df9f
add ecx, 0x118659d2
xor edi, edi
add edi, eax
mov ebx, 0x7d9e9dca
add ebx, 0x82a29dfa
add ebx, dword [ebp - 0x14]
mov edx, 0xc0a2f1ae
add edx, 0xa4a273c5
add dword [ebp - 0xc], ecx
mov esi, dword [ebx]
sub dword [ebp - 4], 0xfe3569e9
xor esi, edx
add dword [ebp - 0x10], ebx
mov dword [edi], esi
add dword [ebp - 0x10], edx
add edi, 0x3e23ebbb
sub edi, 0x3e23ebb7
add ebx, 0xa9b39ed9
add ebx, 0x564c612b
loop 0x407386
add eax, 0xd897
mov ebx, eax
add eax, 0x1e166999
add eax, 0xe1e9966c
mov ecx, 0x3944495c
add ecx, 0xc6fbb6a4
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x403508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x403517
pop dword [ebp - 0xc]
mov eax, 0x403517
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x19cac1d8
add dword [ebp - 0x1c], 0x34878373
mov dword [ebp - 0x18], 0xf80ac21a
add dword [ebp - 0x18], 0x3a288a2b
mov dword [ebp - 0x14], 0x1e38b512
sub dword [ebp - 0x14], 0xd1ec70e4
mov dword [ebp - 0x10], 0x18602db6
add dword [ebp - 0x10], 0xe79fd24a
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x5378b842
sub eax, 0x5337e7f6
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x2478a4f2
sub dword [ebp - 0x1c], 0xb0063b9c
mov dword [ebp - 0x18], 0x67129032
add dword [ebp - 0x18], 0xda59d143
mov dword [ebp - 0x14], 0x9c59b524
add dword [ebp - 0x14], 0xc715b748
mov dword [ebp - 0x10], 0x5554a34
add dword [ebp - 0x10], 0xfaaab5cc
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x3a3b03cf
sub eax, 0x39fa3387
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3b2c4
push 0
call eax
mov ecx, 0x29da9110
sub ecx, 0x29da427b
mov edx, eax
mov ebx, 0x35ca96a8
sub ebx, 0x3588e6a8
add ebx, dword [ebp - 0xc]
mov esi, 0x72fb009e
add dword [ebp - 4], edx
mov edi, dword [ebx]
mov dword [ebp - 4], 0xf5face57
sub edi, esi
xor dword [ebp - 4], ecx
mov dword [edx], edi
add dword [ebp - 8], 0xad3eb9e9
add edx, 0xcfe70634
add edx, 0x3018f9d0
add ebx, 0xdb60d461
add ebx, 0x249f2ba3
loop 0x40362e
add eax, 0x12d27
xor ebx, ebx
add ebx, eax
add eax, 0x43df3446
add eax, 0xbc20cbbf
mov ecx, 0xf0893eed
add ecx, 0xfb6c113
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4019b5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [0x40b0cc], ebx
push esi
jne 0x406c8b
mov esi, dword [ebp + 0x14]
cmp esi, ebx
jle 0x406ca2
mov eax, dword [ebp + 0xc]
push 6
shr eax, 4
inc eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, ebx
je 0x401a32
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, ebx
je 0x401a32
and dword [ebp + 0xc], 0xf
je 0x401a0b
invalid
mov ecx, dword [ebp + 0xc]
movzx edx, word [eax]
dec ecx
lea eax, [eax + edx*2 + 2]
jne 0x401a01
movzx ebx, word [eax]
lea ecx, [esi - 1]
cmp ebx, ecx
jge 0x406ca9
lea ecx, [ebx + ebx]
lea esi, [eax + 2]
mov eax, ecx
push edi
mov edi, dword [ebp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp + 0x10]
and word [eax + ebx*2], 0
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 0x10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_LoadStringW]
jmp 0x401a3c
xor eax, eax
jmp 0x401a3c
mov ebx, ecx
jmp 0x401a19

Function at 0x402317
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x40b9b0]
or eax, dword [0x40b9b4]
jne 0x40244c
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x104
push eax
push 0x20019
push 0
push 0x4042b4
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x40244c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4042ac
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x402443
cmp dword [ebp - 0x14], 1
jne 0x402443
lea eax, [ebp - 0x118]
push ebx
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 4]
push edi
push eax
call fcn.00402459
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.00402483
lea eax, [ebp - 4]
push eax
call fcn.00402459
mov edi, eax
lea eax, [ebp - 4]
push eax
call fcn.00402483
lea eax, [ebp - 4]
push eax
call fcn.00402459
mov ebx, eax
lea eax, [ebp - 4]
push eax
call fcn.00402483
lea eax, [ebp - 4]
push eax
call fcn.00402459
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
call fcn.00402483
movzx eax, si
push 0x10
cdq
pop ecx
call fcn.004024a2
mov esi, eax
push 0x10
movzx eax, di
mov edi, esi
mov esi, edx
pop ecx
cdq
or edi, eax
or esi, edx
mov eax, edi
mov edx, esi
call fcn.004024a2
mov esi, eax
mov edi, edx
movzx eax, bx
cdq
or esi, eax
or edi, edx
push 0x10
mov eax, esi
pop ecx
mov edx, edi
call fcn.004024a2
mov ecx, eax
mov esi, edx
movzx eax, word [ebp - 0x10]
cdq
or ecx, eax
or esi, edx
mov dword [0x40b9b4], esi
pop edi
pop esi
mov dword [0x40b9b0], ecx
pop ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, dword [0x40b9b0]
mov edx, dword [0x40b9b4]
leave
ret