joyce8/EMBER2024-capa huggingface dataset:
Function at 0x683c2250
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
test byte [0x683c4030], 8
jne 0x683c2300
test esi, esi
je 0x683c2334
test ebx, ebx
je 0x683c22eb
mov edx, dword [esi]
add edx, dword [ebx]
shl edx, 2
mov dword [esp + 0xc], edx
mov eax, dword [esi + 4]
mov dword [ebp - 0x20], edx
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
sub esp, 0x10
test eax, eax
mov edi, eax
je 0x683c2340
mov edx, dword [ebx]
test edx, edx
je 0x683c22e6
xor eax, eax
nop
mov edx, dword [ebx + 4]
mov ecx, dword [edx + eax*4]
mov edx, dword [esi]
add edx, eax
add eax, 1
mov dword [edi + edx*4], ecx
mov edx, dword [ebx]
cmp eax, edx
jb 0x683c22d0
add dword [esi], edx
mov dword [esi + 4], edi
mov eax, 1
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p___p__n
mov dword [esp + 8], str.SnmpUtilOidAppend
mov dword [esp + 4], 0x683c4030
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
test esi, esi
jne 0x683c227e
xor eax, eax
jmp 0x683c22f0
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x683c2384
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp], edi
shl eax, 2
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call sym._memcpy
jmp 0x683c22c7
mov dword [ecx + 0x34], 0
xor eax, eax
jmp 0x683c22f0
Function at 0x683c23a0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x683c4030], 8
jne 0x683c2460
test ebx, ebx
je 0x683c2448
test esi, esi
je 0x683c2498
mov eax, dword [esi]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
shl eax, 2
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x683c2448
mov edx, dword [esi]
mov dword [ebx], edx
test edx, edx
je 0x683c2433
mov edx, dword [esi + 4]
mov edx, dword [edx]
mov dword [eax], edx
cmp dword [ebx], 1
mov eax, 1
jbe 0x683c2433
lea esi, [esi]
nop
mov edx, dword [esi + 4]
mov ecx, dword [edx + eax*4]
mov edx, dword [ebx + 4]
mov dword [edx + eax*4], ecx
add eax, 1
cmp eax, dword [ebx]
jb 0x683c2420
mov eax, 1
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
lea esp, [ebp - 0xc]
xor eax, eax
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p___p__n
mov dword [esp + 8], str.SnmpUtilOidCpy
mov dword [esp + 4], 0x683c4030
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x683c23c5
mov dword [ebx], 0
mov eax, 1
mov dword [ebx + 4], 0
jmp 0x683c2438

Function at 0x683c24b0
Capabilities:
Contain obfuscated stackstrings
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x683c4030], 8
jne 0x683c2518
test ebx, ebx
je 0x683c2505
mov edx, dword [ebx + 4]
mov dword [ebx], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebx + 4], 0
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.SnmpUtilOidFree
mov dword [esp + 4], 0x683c4030
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x683c24cd
Function at 0x683c2700
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
test byte [0x683c4030], 8
jne 0x683c27c0
test esi, esi
je 0x683c27f4
test ebx, ebx
je 0x683c2800
mov eax, dword [ebx]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
shl eax, 2
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi + 4], eax
sub esp, 0xc
test eax, eax
je 0x683c27f4
mov edx, dword [ebx]
test edx, edx
je 0x683c279d
mov edx, dword [ebx + 4]
mov edx, dword [edx]
mov dword [eax], edx
mov edx, dword [ebx]
mov eax, 1
cmp edx, 1
jbe 0x683c279d
lea esi, [esi]
nop
mov edx, dword [ebx + 4]
mov ecx, dword [edx + eax*4]
mov edx, dword [esi + 4]
mov dword [edx + eax*4], ecx
mov edx, dword [ebx]
add eax, 1
cmp eax, edx
jb 0x683c2788
mov dword [esi], edx
lea eax, [esi + 8]
lea edx, [ebx + 8]
call dbg.asn_any_copy
test eax, eax
je 0x683c2810
mov eax, 1
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p___p__n
mov dword [esp + 8], str.SnmpUtilVarBindCpy
mov dword [esp + 4], 0x683c4030
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
test esi, esi
jne 0x683c272d
xor eax, eax
jmp 0x683c27b3
mov byte [esi + 8], 5
jmp 0x683c27ae
mov edx, dword [esi + 4]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
jmp 0x683c27b3

Function at 0x683c2840
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x683c4030], 8
jne 0x683c28b0
test ebx, ebx
je 0x683c289d
lea eax, [ebx + 8]
call dbg.asn_any_free
mov edx, dword [ebx + 4]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebx], 0
mov dword [ebx + 4], 0
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.SnmpUtilVarBindFree
mov dword [esp + 4], 0x683c4030
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x683c285d
Function at 0x683c28e0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
test byte [0x683c4030], 8
jne 0x683c29f0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x683c2a2a
mov esi, dword [ebp - 0x1c]
mov edx, dword fs:[0x18]
mov eax, dword [esi + 4]
mov dword [esp + 4], 0
lea eax, [eax + eax*2]
shl eax, 3
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x20]
sub esp, 0xc
mov dword [eax], ebx
test ebx, ebx
je 0x683c29dc
mov eax, esi
mov esi, dword [esi]
mov eax, dword [eax + 4]
test eax, eax
je 0x683c2a35
xor edi, edi
jmp 0x683c2987
mov eax, dword [ebp - 0x1c]
add edi, 1
add esi, 0x18
add ebx, 0x18
mov eax, dword [eax + 4]
cmp edi, eax
jae 0x683c2a35
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.SnmpUtilVarBindCpy@8
sub esp, 8
test eax, eax
jne 0x683c2970
sub edi, 1
je 0x683c29b3
nop
sub ebx, 0x18
mov dword [esp], ebx
call dbg.SnmpUtilVarBindFree@4
sub esp, 4
sub edi, 1
jne 0x683c29a0
mov edx, dword [ebp - 0x20]
mov eax, dword fs:[0x18]
mov edx, dword [edx]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], str.__p___p__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.SnmpUtilVarBindListCpy
mov dword [esp + 4], 0x683c4030
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x683c2917
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
xor eax, eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 4], eax
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
Function at 0x683c2a50
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov edi, dword [ecx]
test byte [0x683c4030], 8
jne 0x683c2ae0
mov eax, dword [edi + 4]
mov ebx, dword [edi]
test eax, eax
je 0x683c2a9a
xor esi, esi
lea esi, [esi]
mov eax, ebx
add esi, 1
add ebx, 0x18
mov dword [esp], eax
call dbg.SnmpUtilVarBindFree@4
sub esp, 4
cmp esi, dword [edi + 4]
jb 0x683c2a80
mov ebx, dword [edi]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [edi], 0
mov dword [edi + 4], 0
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.SnmpUtilVarBindListFree
mov dword [esp + 4], 0x683c4030
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x683c2a6f

Function at 0x683c3610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x683c366b
cmp byte [esi + ebx - 1], 0xa
je 0x683c363f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x683c72c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x683c3bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x683c72d4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x683c3d80
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x683c72d4]
movzx eax, al
bt eax, esi
jae 0x683c3de0
mov ecx, dword [0x683c72c4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x683c3c86
test byte [0x683c4048], 8
jne 0x683c3d20
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x683c4058], 8
jne 0x683c3cd0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x683c3c55
cmp esi, 3
jbe 0x683c3c90
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + str._bg_h]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x683c3c55
mov ecx, dword [0x683c72d4]
test ecx, ecx
je 0x683c3dc0
mov dword [esp], 0x683c4058
call dword [0x683c72d4]
test al, 8
je 0x683c3c2c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x683c3c2c
mov ebx, dword [0x683c72d4]
test ebx, ebx
je 0x683c3da0
mov dword [esp], 0x683c4048
call dword [0x683c72d4]
test al, 8
je 0x683c3c19
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x683c3c1f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x683c72d4
call sym._load_func.part.0
jmp 0x683c3be0
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x683c72d4
call sym._load_func.part.0
jmp 0x683c3d2a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x683c72d4
call sym._load_func.part.0
jmp 0x683c3cde
mov eax, 0xffffffff
jmp 0x683c3c86
Function at 0x10006600
Capabilities:
Create thread

Disassembly:
mov eax, dword [section..bss]
test eax, eax
je 0x10006610
xor eax, eax
ret
push ebp
mov ebp, esp
push ebx
sub esp, 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
sub esp, 0x10
mov ebx, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10003af0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov dword [section..bss], eax
test eax, eax
je 0x100066b9
mov dword [esp + 4], 0xf
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
sub esp, 8
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
sub esp, 4
mov ebx, dword [ebp - 4]
leave
ret
test byte [0x10015090], 2
jne 0x100066d5
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 0x80004005
sub esp, 4
jmp 0x100066b4
mov dword [esp + 0xc], str.Failed_to_create_main_loop_thread_n
mov dword [esp + 8], str.main_loop_start
mov dword [esp + 4], 0x10015090
mov dword [esp], 1
call fcn.100034c0
jmp 0x100066c2
Function at 0x10013c90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100219a0]
test eax, eax
je 0x10013d48
mov dword [esp], ebx
call eax
sub esp, 4
test eax, eax
mov dword [ebx + 8], eax
jns 0x10013cd0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x10013cbc
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x10013d7d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
mov dword [0x100219a0], eax
test eax, eax
jne 0x10013cad
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x10013cbe

Function at 0xc654d8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub eax, dword [edx + ecx + 0x10]
jmp 0xbd6afd
je 0xd27633
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x837261
je 0xd27633
mov eax, dword [eax + ecx + 0x7c]
cmp cl, 0xc7
clc
cmc
push ebx
push edi
cmc
clc
mov dword [ebp - 0x10], eax
stc
mov dword [ebp - 8], 0xffffffff
clc
cmc
cmp esi, 0xffff
jmp 0x891b09
mov edi, dword [edx + ecx + 0x18]
jmp 0xc9647b
je 0xd27633
mov eax, 0x5a4d
cmp al, 0xa1
jmp 0xc13037
ja 0x81fcac
mov eax, esi
test ecx, ecx
jmp 0x7a22c7
cmp dword [eax + ecx], 0x4550
jmp 0xbe98bc
mov dword [ebp - 8], eax
jmp 0xd08ac7
jne 0xd27633
mov edx, dword [eax + ecx + 0x78]
cmp ax, di
jmp 0xca3894
add eax, ecx
cmp ah, 0xb
cmp bp, si
xor ebx, ebx
jmp 0xd01ca8
cmp word [ecx], ax
jmp 0xd2762d
push ebp
mov ebp, esp
xor cl, 0xf2
ror cl, cl
mov ecx, dword [ebp + 8]
lea esp, [esp - 0x114]
push esi
clc
test ecx, ecx
jmp 0x7ca930
js 0x8302a4
jmp 0xd16cda
je 0x8302a4
mov eax, dword [edx + ecx + 0x20]
test bx, 0x78ab
cmp ah, dl
jmp 0xbefab2
mov eax, dword [ecx + 0x3c]
jmp 0xbd537c
test edi, edi
jmp 0xc74b18
mov dword [ebp - 4], edx
test edx, edx
jmp 0x81bf06
ret
dec edi
jmp 0xd1b746
jmp 0x8302a4
mov dword [ebp - 0xc], eax
jmp 0xc66898
je 0xc85398
xor eax, eax
pop esi
mov esp, ebp
pop ebp
jmp 0xcd1877
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x407db7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x407dc6
pop dword [ebp - 0x28]
mov eax, 0x1530293f
sub eax, 0x14efab79
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xece6e9ff
sub dword [ebp - 0x38], 0x9e94a4b4
mov dword [ebp - 0x34], 0x4db593fb
add dword [ebp - 0x34], 0xe47db84a
mov dword [ebp - 0x30], 0xdcbb3479
sub dword [ebp - 0x30], 0x906ef04b
mov dword [ebp - 0x2c], 0xb38e42d6
add dword [ebp - 0x2c], 0x4c71bd2a
lea eax, [ebp - 0x38]
push eax
mov eax, 0xb421d17f
sub eax, 0xb3e10133
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xf7abfacf
sub dword [ebp - 0x38], 0x83399179
mov dword [ebp - 0x34], 0xe82a0c9d
sub dword [ebp - 0x34], 0xa6bdab28
mov dword [ebp - 0x30], 0x1ccc9693
add dword [ebp - 0x30], 0x46a2d5d9
mov dword [ebp - 0x2c], 0xa3c9a9ee
add dword [ebp - 0x2c], 0x5c365612
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xe1cc76c8
sub eax, 0xe18ba680
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3938d
push 0
call eax
mov ecx, 0xb14d504
sub ecx, 0xb148def
mov edi, eax
mov ebx, 0xe07c51df
sub ebx, 0xe03aa1df
add ebx, dword [ebp - 0x28]
mov edx, 0x2ba8f744
sub dword [ebp - 0x14], esi
mov esi, dword [ebx]
sub dword [ebp - 0x1c], 0x2429a07a
sub esi, edx
add dword [ebp - 0x24], edi
mov dword [edi], esi
xor dword [ebp - 0x24], 0xc8758e08
add edi, 4
add ebx, 0x1986f2fa
add ebx, 0xe6790d0a
loop 0x407ee2
add eax, 0xdc6ac11e
add eax, 0x23964e09
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xca1fcd13
add ecx, 0x362032ed
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x2f7258e
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push esi
push edi
xor esi, esi
cmp dword [0x2f793c0], esi
je 0x2f72600
cmp dword [0x2f7802c], esi
je 0x2f72600
push esi
mov edi, 0x2f78fc0
push esi
push 0xc8
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push dword [0x2f7802c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
lea ecx, [ebp - 4]
push ecx
push 2
push 0x2f764b8
push dword [0x2f7802c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x2f7802c]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [0x2f793c4], 0
je 0x2f7261e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x2f791c8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x2f793c8], 0
je 0x2f72645
mov eax, dword [0x2f78024]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x2f72645
push dword [ebp + 8]
push dword [0x2f78024]
call fcn.02f72c89
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x2f739e0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2f764c0
push 0x2f74a94
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x2f7836c], eax
xor eax, eax
mov al, byte [0x2f7836d]
mov dword [0x2f78378], eax
mov eax, dword [0x2f7836c]
shr dword [0x2f7836c], 0x10
and eax, 0xff
mov dword [0x2f78374], eax
shl eax, 8
add eax, dword [0x2f78378]
mov dword [0x2f78370], eax
call fcn.02f74a50
test eax, eax
jne 0x2f73a54
push 0x1c
call fcn.02f73b80
add esp, 4
mov dword [ebp - 4], 0
call fcn.02f74870
call fcn.02f74860
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x2f79d90], eax
call fcn.02f74410
mov dword [0x2f78134], eax
test eax, eax
je 0x2f73a87
cmp dword [0x2f79d90], 0
jne 0x2f73a91
push 0xffffffffffffffff
call fcn.02f73cb0
add esp, 4
call fcn.02f74190
call fcn.02f740a0
call fcn.02f73c80
mov esi, dword [0x2f79d90]
mov al, byte [esi]
cmp al, 0x22
je 0x2f73ab8
cmp al, 0x20
jbe 0x2f73ae5
inc esi
cmp byte [esi], 0x20
ja 0x2f73ab0
jmp 0x2f73ae5
inc esi
cmp byte [esi], 0x22
je 0x2f73ae4
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x2f73adf
xor eax, eax
mov al, bl
push eax
call fcn.02f74040
add esp, 4
test eax, eax
je 0x2f73ad9
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x2f73ac1
cmp byte [esi], 0x22
jne 0x2f73ae5
inc esi
cmp byte [esi], 0
je 0x2f73af5
cmp byte [esi], 0x20
ja 0x2f73af5
inc esi
cmp byte [esi], 0
jne 0x2f73aea
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x2f73b19
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.02f73cb0
jmp 0x2f73b5a
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x2f73cf0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x2f783a8], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x2f73d0e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x2f783a4], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x2f783a0], bl
jne 0x2f73d68
cmp dword [0x2f79d88], 0
je 0x2f73d56
mov edi, dword [0x2f79d84]
sub edi, 4
cmp edi, dword [0x2f79d88]
jb 0x2f73d56
mov eax, dword [edi]
test eax, eax
je 0x2f73d4b
call eax
sub edi, 4
cmp edi, dword [0x2f79d88]
jae 0x2f73d43
push 0x2f78014
push 0x2f78010
call fcn.02f73da0
add esp, 8
push 0x2f7801c
push 0x2f78018
call fcn.02f73da0
add esp, 8
test ebx, ebx
jne 0x2f73d8f
mov dword [0x2f783a8], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret