joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468a26
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48e530]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0045cade
mov dword [ebp - 0x14], eax
cmp dword [0x4aee14], esi
jne 0x468b19
push 0x800
push esi
push 0x480db0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x468aa6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x468bf9
push esi
push esi
push 0x480db0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x468bf9
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x468bf9
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4aee14], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4aee18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4aee1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4aee24], eax
test eax, eax
je 0x468b16
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4aee20], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x468b3e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x468b31
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x468b53
push 4
pop eax
jmp 0x468bfb
cmp dword [ebp - 0x14], esi
je 0x468b53
push dword [0x4aee14]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x468b38
mov eax, dword [0x4aee20]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x468bb1
cmp dword [0x4aee24], edi
je 0x468bb1
push eax
call ebx
push dword [0x4aee24]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x468bb1
test eax, eax
je 0x468bb1
call ecx
test eax, eax
je 0x468ba6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x468ba6
test byte [ebp - 8], 1
jne 0x468bb1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x468be1
mov eax, dword [0x4aee18]
cmp eax, edi
je 0x468bde
push eax
call ebx
test eax, eax
je 0x468bde
call eax
mov esi, eax
test esi, esi
je 0x468bde
mov eax, dword [0x4aee1c]
cmp eax, edi
je 0x468bde
push eax
call ebx
test eax, eax
je 0x468bde
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4aee14]
call ebx
test eax, eax
je 0x468bf9
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x468bfb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460e59
mov esp, ebp
pop ebp
ret
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x2161058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.021611a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x216107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x216106a
add dl, dl
jne 0x2161089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x21610dc
xor eax, eax
add dl, dl
jne 0x2161096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x216117d
add dl, dl
jne 0x21610a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21610b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21610bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21610c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x21610d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x2161075
mov eax, 1
add dl, dl
jne 0x21610ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21610f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x21610e1
sub eax, ebx
mov ebx, 1
jne 0x2161128
mov ecx, 1
add dl, dl
jne 0x216110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2161119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2161105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2161075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x216113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x216114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2161136
cmp eax, 0x7d00
jae 0x216116d
cmp eax, 0x500
jb 0x2161168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2161075
cmp eax, 0x7f
ja 0x2161170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2161075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x216119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x2161075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, reloc.kernel32.dll_GetVersionExW
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x7f21b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007f2140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007f2140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007f2140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007f2140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7f2bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7f2c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x80487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7f2c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7f2c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x428568
Capabilities:
Encode data using xor

Disassembly:
invalid
mov esp, 0x5aa797ab
loop 0x4285a8
xor al, byte [ebx + 0x39]
sbb eax, dword [ebx + edx*4 + 0x6c119bbf]
das
xlatb
xchg byte [eax - 0x3cd0c1ac], bl
jmp 0x428589
inc edi
xchg ecx, eax
mov bh, 0x56
loop 0x428607
jecxz 0x428527
in eax, dx
mov byte [0x24c5e671], al
dec esp
popfd
salc
popal
pushal
movsb byte es:[edi], byte [esi]
pop ss
push esi
and cl, byte [0x3af454a0]
mov esp, 0x7507c596
aaa
pop es
jne 0x4285e2
into
sub byte [edi + ebx*2], dh
push edi
invalid
ret
popfd
dec edi
push eax
lahf
push ecx
push esi
scasb al, byte es:[edi]
adc eax, dword [edi]
xlatb
dec esi
pop esi
test al, 0xda
dec esp
rcl cl, cl
fimul dword [edx + edx*8 - 0x2f]
mov eax, dword [0x5083ea9d]
push eax
loopne 0x4285ec
scasd eax, dword es:[edi]
pop edi
jle 0x4285de
sub dh, byte [esi + 0x22eb759f]
aad 0x59
lahf
jne 0x4285da
and dl, ch
pop ecx
invalid
sub byte [edx], 0xfc

Function at 0x444df3
Capabilities:
Encode data using xor

Disassembly:
iretd
lahf
stosd dword es:[edi], eax
inc esi
mov al, 0x25
xchg edi, eax
push edi
or eax, 0x1d64dd15
in al, dx
enter 0x4d11, 3
loopne 0x444df1
mov ds, word [eax]
mul edi
salc
clc
inc esp
mov ch, 0x70
shl dword [ebp - 0x2b2beeb7], 0xd5
popal
arpl si, sp
pushfd
invalid
Function at 0x44f5dd
Capabilities:
Encode data using xor

Disassembly:
imul eax, esp, 0x9fa5251f
pop edx
wait
xor esp, dword [edi + 0x46]
fimul dword [ebp + 0x84a5b7f]
mov esi, dword cs:[eax - 0x3b3d4ab8]
test al, 0x1a
or eax, 0x9cececdb
salc
cmp dword [edi - 0x37], ebx
arpl word [esi], bp
mov ebx, 0x7b66ea27
push ebx
insd dword es:[edi], dx
loopne 0x44f5f5
sal dword [esi - 0x789339e8], cl
loopne 0x44f622
into
jle 0x44f644
sbb edi, dword [ecx + 0x44]
and byte [0x586d9d99], bh
push ebp
fcom st(7)
sub al, 0x85
cdq
imul esp, ebx, 0xe5f2d788
mov esi, 0x16561649
pop ebx
mov ch, bh
pop eax
loopne 0x44f59f
push ds
aam 0x89
mov bl, 0xc3
pop ecx
popal
dec edx
popal
jnp 0x44f677
or esi, dword [edi + ebx - 0x1b]
xchg byte [eax + 6], dl
imul esp, dword [esi - 0x5fdbeeb8], 0x7f
and al, 0x8a
cmpsb byte [esi], byte es:[edi]
add dword [ebp - 0x5cd10bbe], ebx
xor esp, dword [edx - 0x2ea9d747]
dec eax
adc dword [eax], esp
jg 0x44f638
mov ah, byte [esi - 0xbbd62ff]
mov dword cs:[0x28b9a233], eax
push esi
rcr dword [edx - 0x7acf84d2], 1
and al, 0x2c
lcall 0x2c24, 0x85307b2e
out 0x7a, eax
mov eax, dword [0xf4ce9118]
xor cl, byte [ebx + 0x4d]
cld
cli
jne 0x44f60e
dec eax
cmp dword [ebx], ebx
arpl word [edx + 0x4c5d7c06], di
sti
in al, 0x77
xor byte [ebp - 0x73], dl
mov cl, 0x8b
cmp dh, byte [ebp - 0x25a735d6]
mov byte [ebx + edi*8 + 0x57a6f6e2], dl
sub eax, 0x5e2949b
fld qword [edx + 0x54c3b454]
push ebp
lea esi, [ecx + 0x2ab53a8b]
retf 0xda58
push esp
mov ah, 0xc3
push esp
test al, 0x73
imul edx, ebp, 0x57
je 0x44f6ab
sbb eax, 0x60da441a
clc
xchg byte [ebx - 0x54], cl
lodsb al, byte [esi]
into
jl 0x44f66f
mov esp, 0xc8e73b15
scasd eax, dword es:[edi]
lea ecx, [ebp + 0x17]
enter 0xffffffffffff8daf, 0x4d
pop ss
adc byte [ecx + 0x65b6834c], bh
js 0x44f65c
xor dword [esi - 0x5727879b], 0xffffffdf
test al, 0xdf
dec edx
in al, 0x8a
js 0x44f67f
insb byte es:[edi], dx
sub dh, byte [0xbe497550]
pop ebx
aam 0xf
xchg ecx, eax
mov ch, 0x94
dec ebx
mov dh, 0x1f
scasb al, byte es:[edi]
salc
cmpsd dword [esi], dword es:[edi]
push ecx
lcall 0xa141, 0x64d595b6
inc edi
pop eax
jnp 0x44f660
xor dl, byte [edx - 0x69b58e6f]
xchg edx, eax
xchg ecx, eax
jno 0x44f6f9
xchg esi, eax
lahf
fisttp word [ebx]
mov ah, 0x88
int3
ljmp 0xc8b9:0xb71660ea

Function at 0x45b6a2
Capabilities:
Check for vm using instruction vpcext

Disassembly:
add dh, al
cmp byte [ecx + ebx*8 + 0xe], bh
sar byte [esi - 0x56], 1
invalid

Function at 0x46c7d4
Capabilities:
Encode data using xor

Disassembly:
aaa
lds ecx, [eax + 0x17]
dec eax
pop ss
dec eax
pop ss
xchg edi, eax
stc
salc
xor byte [edx - 0x665a5935], ah
aam 0xbb
sub edx, dword [ebp + esi*4 - 0x63]
jb 0x46c7d2
fcom dword [esi]
jo 0x46c810
test byte [edi + ecx], dl
scasd eax, dword es:[edi]
sbb byte [esi], 0x87
sub eax, 0x637938b0
aam 0x39
test byte [eax - 0x2c6d9c5], dl
and al, 0x38
xchg ebx, eax
sbb dword [ecx - 0x1c], edi
sti
pop ebp
xchg edi, eax
stosb byte es:[edi], al
inc edi
pop esi
mov edx, 0xcb3782
adc eax, 0x3d98e013
add ebp, edx
imul eax, dword [ebp - 0x6125a356], 0x17b91e94
aam 0xbb
cmp bh, byte [0x177b127e]
into
inc ecx
fmul qword [edx + 0x7d]
cld
fadd st(6)
push es
jmp dword [ebp + 0x5259eaf2]
Function at 0x493020
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xchg edi, eax
fistp dword [ebx]
movsd dword es:[edi], dword [esi]
pop es
dec edx
nop
mov ebx, 0xdc1b7b91
invalid

Function at 0x495060
Capabilities:
Encode data using xor

Disassembly:
and ebx, dword [esp - 0xd212afa]
and al, 0x4a
ljmp 0x7b6c
cmc
xor byte [edi + edx*2 - 0x74], ch
pop ebx
mov word [eax], ds
mov ebx, 0x9ca38541
and eax, 0x6b8c2b7c
mov eax, ebx
jl 0x49502f
push cs
mov bl, 0x14
leave
loopne 0x49507a
ja 0x495004
and dword [ebp - 0x5d6b8ffe], esi
insd dword es:[edi], dx
cmp ah, ch
fistp dword [edx - 0x533fb5b7]
sti
invalid
add dh, byte [eax - 0x6c]
mov byte [0xdbec386d], al
lcall 0x8ffb, 0xacc04a49
mov ch, 0xbd
popfd
jns 0x4950df
cmp al, 0xb7
fsubr qword [esi + 0x1b181d31]
jl 0x495063
cld
stosd dword es:[edi], eax
cli
adc cl, byte [ebp + 0x2b]
jae 0x495098
sub esi, dword [ebx + 0x23]
movsb byte es:[edi], byte [esi]
stosb byte es:[edi], al
inc ebx
dec ebx
in eax, 0xe3
sub dword [0x625fb991], edi
jecxz 0x4950a5
cmp eax, 0x625fb991
mov ecx, 0x7402625f
pop ebx
loope 0x495072
add dh, byte [ebx + ebx*2 - 0x1f]
in al, dx
cld
pushfd
loopne 0x4950b7
jecxz 0x4950a1
loope 0x49504f
and byte [eax], dh
jns 0x49502f
xchg esp, eax
ficom word [ebx]
ret
adc ebx, dword [ebp - 0x7ee51fbf]
daa
dec edx
mov eax, 0xb9f9461a
inc ecx
loopne 0x4950b7
sbb al, byte [ecx + 0x1ab84a27]
inc esi
and dword [edi], 0x461ab84a
sbb al, byte [esi - 7]
stc
mov ecx, 0xb33cc63f
cmp byte [edx - 0x6695c758], ch
inc ebx
jl 0x4950f8
aas
invalid
in eax, dx
cld
sbb al, 0xb3
pop eax
inc edi
std
mov edi, 0x96981db3
insb byte es:[edi], dx
cmp byte [ebp - 0x7385a484], bh
mov esp, 0xcc24038
jb 0x49509a
les esp, [esi + 0x1e]
imul edi, dword es:[ebp + 0x71], 0xb29a32ec
mov ah, 0xf6
push edx
mov dword [0x230cabf9], eax
js 0x49509c
or al, 0x7b
jl 0x49511b
push es
push es
mov al, 0x73
js 0x49507e
cmc
push ebx
salc
ror ebp, cl
or byte [ecx + edx*8 - 0x58], bl
in eax, dx
mov ah, 0xb2
mov al, 0xcb
fcompp
sbb byte [ebx], al
mov byte [0x6073f9ea], al
cld
jns 0x495108
retf
cmp dl, byte [ebx]
push es
jmp 0x4950e6
mov dl, 7
scasb al, byte es:[edi]
and dh, ah
mov byte [0xb635cc04], al
mov edx, 0xe16cd291
mov byte [edx + 0x30], 0x52
mov ecx, 0x7d68937b
mov eax, 0xe1424dfe
mov ecx, 0xd60bdaa0
int3

Function at 0x4b7f33
Capabilities:
Encode data using xor

Disassembly:
adc dl, byte ds:[ecx + 0x58a17e7f]
shl dword [edx + ecx*4], 0x9a
jb 0x4b7f48
push cs
invalid
dec ebx
aam 0xd0
sbb edx, ebx
std
mov edi, 0x4b497f87
adc eax, 0xdfe93453
adc bh, bh
insd dword es:[edi], dx
dec ecx
mov byte [edi + 0x7e], ch
call 0xe42d3919
jbe 0x4b7ee1
jle 0x4b7f32
retf
or byte [esi + 0x6ebf39c5], dh
dec esp
and dword [edi], esp
insd dword es:[edi], dx
and dword [ebp - 0x50a2b760], eax
invalid

Function at 0x4b937b
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
adc byte [eax], al
add byte [ecx - 0x7b], bl
sal byte [ebp + 8], 0x6a
sbb al, 0xe8
ret
Function at 0x4b99cb
Capabilities:
Terminate process

Disassembly:
and byte [eax + eax - 0x18], cl
inc ebx
add byte [eax], al
add byte [ecx + 0x59], bl
push 0x4c2020
push 0x4c201c
call fcn.004b9a16
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4b99f2
call fcn.004b9a0d
pop edi
ret
push dword [esp + 8]
mov dword [0x4c6db0], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4ba4cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23e8
cmp edx, dword [eax]
je 0x4ba4ef
add eax, 8
inc ecx
cmp eax, 0x4c2478
jl 0x4ba4e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23e8]
jne 0x4ba61d
mov eax, dword [0x4c6d6c]
cmp eax, 1
je 0x4ba5f7
test eax, eax
jne 0x4ba520
cmp dword [0x4c2314], 1
je 0x4ba5f7
cmp edx, 0xfc
je 0x4ba61d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba557
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baeb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb340
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba59a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb340
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf93c
push edi
call fcn.004bd210
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baeb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baec0
lea eax, [ebp - 0xa0]
push 0x4bf91c
push eax
call fcn.004baec0
push dword [esi + 0x4c23ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baec0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd184
add esp, 0x2c
pop edi
jmp 0x4ba61d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23ec]
push 0
push eax
push dword [esi]
call fcn.004bb340
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403371
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x40339c
mov ecx, dword [0x4702b8]
push esi
add eax, ecx
push esi
push eax
mov dword [0x4326f4], eax
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403479
cmp eax, esi
jl 0x403473
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.004061db
test eax, eax
je 0x403463
push dword [ebp + 8]
add dword [0x4326f4], 4
call fcn.00403479
mov ebx, eax
cmp ebx, esi
jl 0x403471
cmp dword [ebp + 0x10], esi
jne 0x40343f
cmp dword [ebp + 8], esi
jle 0x403471
mov esi, 0x4266f0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x403401
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.004061db
test eax, eax
je 0x403463
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.0040620a
test eax, eax
je 0x40343b
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x4326f4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4033f0
jmp 0x403471
push 0xfffffffffffffffe
jmp 0x403465
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40344a
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403468
push 0xfffffffffffffffd
pop eax
jmp 0x403473
mov ebx, dword [ebp - 4]
add dword [0x4326f4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10

Function at 0x403cd1
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x403d0c
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x403cf3
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x403d04
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x403d0e
inc edi
add eax, 0x28
cmp edi, esi
jb 0x403ce9
xor eax, eax
pop edi
pop esi
ret

Function at 0x40603f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x45a750
push esi
call fcn.00406668
push esi
call fcn.00405fe2
mov edi, eax
test edi, edi
jne 0x406060
xor eax, eax
jmp 0x4060b8
push edi
call fcn.004068ef
test byte [0x470278], 0x80
je 0x40607d
mov ax, word [edi]
test ax, ax
je 0x40605c
cmp ax, 0x5c
je 0x40605c
sub edi, esi
sar edi, 1
jmp 0x406097
call fcn.0040699e
test eax, eax
je 0x406091
test byte [eax], 0x10
je 0x40605c
push esi
call fcn.00405f83
push esi
call sub.KERNEL32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x406083
call fcn.00405f37
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4
Function at 0x401370
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x358
push ebx
mov ebx, dword [esp + 0x360]
push ebp
push esi
push edi
push str.Nodata
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4014f6
mov al, byte [ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp al, 0x22
je 0x4013e0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x164]
push 0x4060d4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x168]
push eax
call ebp
lea ecx, [esp + 0x164]
push ebx
push ecx
call esi
lea edx, [esp + 0x164]
push 0x4060d4
push edx
call esi
mov edi, dword [esp + 0x370]
test edi, edi
je 0x401420
push 0x408828
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x401420
lea eax, [esp + 0x164]
lea ecx, [esp + 0x64]
push eax
push ecx
call ebp
lea edx, [esp + 0x64]
push 0x4060d0
push edx
call esi
lea eax, [esp + 0x64]
push edi
push eax
call esi
jmp 0x40142f
lea ecx, [esp + 0x164]
lea edx, [esp + 0x64]
push ecx
push edx
call ebp
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push 0
push 0
push 1
push 0
lea edx, [esp + 0x80]
push 0
push edx
push 0
call ebx
test eax, eax
jne 0x401503
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
push 0x1388
call ebp
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push 0
push 0
push 1
push 0
lea edx, [esp + 0x80]
push 0
push edx
push 0
call ebx
test eax, eax
jne 0x401503
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc edi
mov esi, eax
cmp edi, 0xc
jl 0x401474
push str.RunApplication
lea eax, [esp + 0x68]
push esi
push eax
push 0
call fcn.004017b0
push str.IS013_00002
lea ecx, [esp + 0x78]
push esi
push ecx
lea edx, [esp + 0x284]
push 0x408b00
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
lea eax, [esp + 0x64]
push 0
push str.Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x358
ret
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [0x408ae4], ecx
mov eax, 1
pop ebx
add esp, 0x358
ret