joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413b4e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x46a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.0042f8e0
add esp, 0xc
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, 0x104
push eax
push esi
call dword [sym.imp.kernel32.dll_GetTempPathW]
test eax, eax
jne 0x413bec
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x413bc3
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x413bca
mov esi, 0x80004005
push esi
push 0x28d
push str.logging.cpp
call fcn.00403821
push str.Failed_to_get_temp_folder.
push esi
call main
pop ecx
pop ecx
jmp 0x413cdd
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call main
mov esi, eax
test esi, esi
jns 0x413c0d
push str.Failed_to_get_length_of_temp_folder.
jmp 0x413bdf
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.kernel32.dll_ProcessIdToSessionId]
test eax, eax
je 0x413cb5
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push 0x453f98
push eax
call main
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x413c54
push str.Failed_to_format_session_id_as_a_string.
jmp 0x413cd4
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
push dword [ebp - 0x210]
call main
mov esi, eax
test esi, esi
jns 0x413c78
push str.Failed_to_get_length_of_session_id_string.
jmp 0x413cd4
push dword [ebp - 0x214]
mov esi, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
mov edi, esi
sub edi, dword [ebp - 0x214]
push dword [ebp - 0x214]
lea eax, [eax + edi*2]
push eax
push 0
push 0
call dword [sym.imp.kernel32.dll_CompareStringW]
cmp eax, 2
jne 0x413cbb
mov esi, edi
jmp 0x413cbb
mov esi, dword [ebp - 0x218]
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call main
mov esi, eax
test esi, esi
jns 0x413cdc
push str.Failed_to_copy_temp_folder.
push esi
call main
pop ecx
pop ecx
pop edi
cmp dword [ebp - 0x210], 0
je 0x413cf1
push dword [ebp - 0x210]
call main
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e06f
mov esp, ebp
pop ebp
ret 4

Function at 0x413f9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x413faa
pop dword [ebp - 0x30]
mov eax, 0xcc52987e
add eax, 0x33eea72c
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x52a8a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x52e4
mov edx, eax
mov esi, 0x170dd6fa
sub esi, 0x16c558fa
add esi, dword [ebp - 0x30]
mov ebx, 0x562c2d1b
sub ebx, 0x8c473d56
add dword [ebp - 8], 0x3f43ea89
mov edi, dword [esi]
sub dword [ebp - 4], esi
add edi, ebx
xor dword [ebp - 0x1c], 0x301a0aa
mov dword [edx], edi
add edx, 4
add esi, 4
loop 0x413ffe
add eax, 0x13e63
mov ebx, eax
add eax, 0x9d408e36
add eax, 0x62bf71cf
mov ecx, 0x44982360
add ecx, 0xbba7dca0
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000c482
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000c491
pop dword [ebp - 0x4c]
mov eax, 0xed35b989
sub eax, 0xdd34f4f8
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3ceb6
push 0
mov eax, 0x38a2e929
sub eax, 0x28a107c5
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x573d
xor esi, esi
add esi, eax
mov edx, 0x78dbfbe6
sub edx, 0x68d7bde6
add edx, dword [ebp - 0x4c]
mov edi, 0x4f772505
sub dword [ebp - 0x2c], ecx
mov ebx, dword [edx]
add dword [ebp - 0x44], 0x435f4747
xor ebx, edi
xor dword [ebp - 0x34], 0x777349ef
mov dword [esi], ebx
add dword [ebp - 0x14], 0x777eac1c
add esi, 4
add edx, 0x46baa899
add edx, 0xb945576b
loop 0x1000c4e6
add eax, 0x4894b896
add eax, 0xb76c9731
mov ebx, eax
add eax, 0xe14f1f61
sub eax, 0xe14f1f5c
mov ecx, 0x3a0ae675
sub ecx, 0x2a0ae675
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x1000d4ea
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, 0x84
test esi, esi
lea edx, [esi + 0xc]
cmove edx, eax
push edx
mov eax, dword [edx]
call dword [eax + 0x18]
push 0x50
test esi, esi
lea eax, [esi - 0x28]
pop ecx
cmove eax, ecx
pop esi
cmp dword [eax], 0
je 0x1000d51b
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 8

Function at 0x1000fd3c
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x1003e4c0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebx
push dword [edi]
call fcn.1000c482
mov esi, eax
test esi, esi
jne 0x1000fdeb
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000fdc6
lea eax, [esp + 0x28]
push eax
call fcn.1000fd3c
mov esi, eax
test esi, esi
jne 0x1000fdeb
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x30], 0x100
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x1000fda1
call fcn.1000ce21
push ebx
mov ecx, edi
call fcn.1000d242
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.1000ce21
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10019a3d
add esp, 0x11c
ret 4
Function at 0x41b2f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, 6
lodsd eax, dword [esi]
bswap eax
ror eax, 0xd
mov edx, eax
not edx
lodsd eax, dword [esi]
rol eax, 0xb
bswap eax
xor eax, edx
stosd dword es:[edi], eax
lodsd eax, dword [esi]
rol eax, 9
bswap eax
mov edx, eax
not edx
stosd dword es:[edi], eax
lodsd eax, dword [esi]
rol eax, 7
bswap eax
xor eax, edx
mov edx, eax
not edx
stosd dword es:[edi], eax
rol eax, 5
xor eax, edx
stosd dword es:[edi], eax
lea esi, [edi - 0x10]
dec ebx
test ebx, ebx
jne 0x41b305
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b348
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, 0xfffefdfc
mov ecx, 0x40
mov ebx, dword [ebp + 0x10]
mov dword [ebx + ecx*4 - 4], eax
sub eax, 0x4040404
dec ecx
jne 0x41b35b
mov edi, dword [ebp + 0xc]
mov esi, 0x40
xor ebx, ebx
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x41b375
pop ebp
xor ecx, ecx
mov edi, dword [ebp + 8]
mov esi, 0x20
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x41b3ae
pop ebp
xor ecx, ecx
mov edi, dword [ebp + 0xc]
mov esi, 0x40
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x41b3e7
pop ebp
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x41b41c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
xor edx, edx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
je 0x41b468
push ebp
mov ebp, dword [ebp + 0x10]
mov dl, byte [ebp + ecx]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
mov dl, byte [ebp + edx]
inc dl
mov al, byte [ebp + edx]
xor byte [edi], al
mov dl, byte [ebp + ebx]
xchg byte [ebp + ecx], dl
mov byte [ebp + ebx], dl
inc cl
inc edi
dec esi
test esi, esi
jne 0x41b439
pop ebp
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x100115e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100115ef
pop dword [ebp - 0x40]
mov eax, 0xe543dac9
add eax, 0x2abd3b26
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x74e37be2
sub dword [ebp - 0x50], 0x26913697
mov dword [ebp - 0x4c], 0xd4b7ac05
add dword [ebp - 0x4c], 0x5d7ba040
mov dword [ebp - 0x48], 0xfdb4037d
sub dword [ebp - 0x48], 0xb167bf4f
mov dword [ebp - 0x44], 0x69eecada
add dword [ebp - 0x44], 0x96113526
lea eax, [ebp - 0x50]
push eax
mov eax, 0x61a5c9b1
sub eax, 0x51a46951
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xa274cc80
sub dword [ebp - 0x50], 0x2e02632a
mov dword [ebp - 0x4c], 0x86531d53
sub dword [ebp - 0x4c], 0x44e6bbde
mov dword [ebp - 0x48], 0xd220d025
sub dword [ebp - 0x48], 0x6eb163b9
mov dword [ebp - 0x44], 0xfebc6fc1
sub dword [ebp - 0x44], 0xfebc6fc1
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x99ad9111
sub eax, 0x89ac30ad
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x37cc2
push 0
call eax
mov ecx, 0x45ab
mov edx, eax
mov edi, 0x10023600
add edi, dword [ebp - 0x40]
mov esi, 0x30fc30cb
add esi, 0x4055598
xor dword [ebp - 0x2c], 0x3ced59c7
mov ebx, dword [edi]
sub dword [ebp - 0x24], ecx
add ebx, esi
add dword [ebp - 0x3c], eax
mov dword [edx], ebx
xor dword [ebp - 0x2c], 0x87bb3bbb
add edx, 0x69e19af1
sub edx, 0x69e19aed
add edi, 0x7a767dc3
add edi, 0x85898241
loop 0x10011705
add eax, 0x647303d3
add eax, 0x9b8e05ac
mov ebx, eax
add eax, 5
mov ecx, 0x77ceb5df
add ecx, 0x98314a21
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x404f00
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4442f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x514
push ebx
push ebp
push esi
push edi
mov ebp, ecx
or esi, 0xffffffff
mov dword [esp + 0x14], ebp
mov dword [ebp + 4], esi
xor ebx, ebx
mov dword [ebp], 0x447520
mov dword [esp + 0x52c], ebx
mov dword [ebp + 0x20], esi
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
lea ecx, [ebp + 0x28]
mov byte [esp + 0x544], 1
call fcn.0043f078
mov dword [ebp + 0x60], esi
push ebx
push ebx
push 1
push ebx
mov byte [ebp + 0x40], bl
mov byte [ebp + 0x41], bl
mov byte [ebp + 0x25], bl
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0x866], bl
mov dword [ebp + 0xc], ebx
mov byte [ebp + 0x864], bl
mov byte [ebp + 0x865], bl
mov byte [ebp + 0x24], bl
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp + 0x20], eax
push str..CONFIG.ini
mov byte [ebp + 0x874], bl
mov ecx, 7
mov esi, str.shaiyanoxius.online
mov edi, 0x45b9c0
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push 0x447078
push str.TEST_IP
push str.LOGIN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4050db
mov edi, str.GERMANY
lea esi, [esp + 0x18]
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x405035
mov edi, str.FRANCE
lea esi, [esp + 0x18]
mov ecx, 7
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x405035
mov edi, str.POLAND
lea esi, [esp + 0x18]
mov ecx, 7
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4050db
push 0x44741c
push str.UpdaterURL.txt
call fcn.00420efc
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x405065
push ebx
push str.Error
push str.Cant_Find_UpdaterURL.txt
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.00420ceb
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0x120]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x120]
push eax
push 0x4470bc
push esi
call fcn.00420f0f
lea eax, [esp + 0x12c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x405095
sub eax, edx
cmp eax, 1
jae 0x4050bb
push ebx
push str.Error
push str.Cant_Read_UpdaterURL.txt
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.00420ceb
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x120]
mov byte [eax + 0x45b9c0], cl
inc eax
cmp cl, bl
jne 0x4050c0
push esi
call fcn.00420e4f
add esp, 4
mov ecx, dword [esp + 0x524]
pop edi
mov eax, ebp
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4014eb
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x28], 1
push eax
push 0x104
mov word [ebp - 0x24], 5
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x25c]
push eax
call esi
xor edi, edi
cmp word [ebp + eax*2 - 0x25e], 0x5c
jne 0x40155a
lea eax, [ebp - 0x25c]
push eax
call esi
mov word [ebp + eax*2 - 0x25e], di
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x25c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
leave
ret

Function at 0x401588
Capabilities:
Read file on windows

Disassembly:
push esi
push 0x403040
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x4015a2
pop esi
ret
push edi
push 2
push 0xffffffffffffffd0
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov edi, dword [esp + 0x1c]
push 0xc
pop ecx
xor eax, eax
push esi
push 0x30
rep stosd dword es:[edi], eax
push 1
pop edi
push edi
push dword [esp + 0x28]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
cmp eax, 0x30
je 0x4015d4
xor edi, edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x4015e1
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push 0
push dword [esp + 0x1c]
shr ecx, 2
push dword [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0x10
cmp eax, 0xffffffff
je 0x401632
push dword [esp + 0x10]
push esi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x40163e
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor eax, eax
jmp 0x401640
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x420a92
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
pushal
call fcn.00420aa1

Function at 0x421262
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
pushal
call fcn.0042126e

Function at 0x434a92
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
pushal
call fcn.00434aa1

Function at 0x435262
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
pushal
call fcn.0043526e

Function at 0x4358e7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
call fcn.004358fa
Function at 0x435961
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov dword [ebp - 4], 0
call fcn.00435974

Function at 0x43a847
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cld
cld
nop
cmp eax, dword [esp + 4]
cld
not dh
not dh
cld
jne 0x43a87d
lea eax, [ebp + 0x3d]
mov esi, dword [edx + 0x24]
mov edi, dword [edx + 0x1c]
add esi, ebx
jmp 0x43a778
xchg edx, edx
not dh
cld
xchg dl, dh
mov esi, dword [edi + eax*4]
add esi, ebx
ret 4
je 0x43a846
nop
xor eax, eax
push eax
sub dh, bl
add dh, bl
shl eax, 4
jmp 0x43a6d9
nop
nop
xchg dword [esp], eax
sub dword [esp], eax
movzx eax, byte [edi]
test edi, ebp
cld
wait
inc edi
nop
sub dword [esp], eax
jmp 0x43a753
cmp byte [edi], 0
not esp
not esp
pop eax
jne 0x4367b9
xor eax, 0x741ee5c
jmp 0x436686
add edi, ebx
xchg dh, dh
cmp edx, ebx
mov eax, dword [esi + ecx*2]
and eax, 0xffff
jmp 0x4366c5
ret
mov eax, dword [ebx + 0x3c]
jmp 0x43a84f
dec ecx
mov edx, dword [eax + ebx + 0x78]
mov ah, 0xcf
lea edx, [edx + ebx]
xchg ah, cl
mov ecx, 0x494a93c0
not edi
sub al, bl
mov esi, dword [edx + 0x20]
add esi, ebx
mov eax, 0x459984c8
xor al, 0xa5
xor eax, 0x17ef5c5d
or ecx, 0xffffffff
jmp 0x43a87d
inc ecx
cld
lodsd eax, dword [esi]
lea edi, [eax + ebx]
cmp ecx, dword [edx + 0x18]
jmp 0x4367b0
Function at 0x100253aa
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x100925b9
call fcn.100871aa
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.10024d95
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 0xc], eax
je 0x100253e2
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x14]
call fcn.10078e66
jmp 0x1002541d
push eax
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x400
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1002541d
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x10]
call fcn.10078e66
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.1007924a
call fcn.10087296
ret 4

Function at 0x1002555c
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10094c42
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x100ae210]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
push edi
mov eax, dword [0x100ae210]
xor eax, esp
push eax
lea eax, [esp + 0x1a0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 9
mov dword [esp + 0x18], eax
xor esi, esi
mov dword [esp + 0x1c], esi
pop ecx
xor eax, eax
mov dword [esp + 0x4c], 0x10018740
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea edi, [esp + 0x74]
lea ebx, [esp + 0x4c]
mov dword [esp + 0x1a8], esi
call fcn.1002500d
test al, al
jne 0x100255f8
push 0x1000481c
push dword [esp + 0x18]
call fcn.100580f9
mov eax, dword [esp + 0x14]
jmp 0x100256d9
push 8
pop ecx
xor eax, eax
mov dword [esp + 0x28], esi
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
call fcn.10025788
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
lea esi, [esp + 0x74]
lea edi, [esp + 0x24]
mov byte [esp + 0x1a8], 1
call fcn.10025917
mov esi, eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x1b0], 2
call fcn.100258a8
mov edi, eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1a8], 3
call fcn.100254e6
lea ecx, [esp + 0x88]
push ecx
mov byte [esp + 0x1ac], 4
push dword [esi]
push dword [edi]
push dword [eax]
lea eax, [esp + 0x28]
push 0x10004834
push eax
call fcn.10078ea6
mov eax, dword [esp + 0x38]
add esp, 0x18
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.1007924a
mov byte [esp + 0x1a8], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.1007924a
mov esi, dword [esp + 0x18]
lea eax, [esi - 0x10]
call fcn.100791e7
mov edi, dword [esp + 0x14]
add eax, 0x10
mov dword [edi], eax
lea eax, [esi - 0x10]
call fcn.1007924a
mov eax, edi
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x188]
xor ecx, esp
call fcn.1007b431
mov esp, ebp
pop ebp
ret 4