joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ed3d0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101085dd
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x1011900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x1045f9b8]
mov edi, dword [esi + 0x174]
test edi, edi
setg byte [ebp - 0x14]
cmp dword [0x1041d368], 4
jne 0x100ed439
mov edx, dword [esi + 0x4cb0]
add edx, dword [esi + 0x4cac]
mov ecx, dword [0x1045f960]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push dword [ebp - 0x14]
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x104654a0], 0
jne 0x100ed579
movaps xmm0, xmmword [0x1010e410]
xor eax, eax
movaps xmm2, xmmword [0x1010e810]
movups xmmword [ebp - 0x54], xmm0
mov word [ebp - 0x34], 0xa3a6
movaps xmm0, xmmword [0x1010e2b0]
movups xmmword [ebp - 0x44], xmm0
mov byte [ebp - 0x32], 0xe0
nop
movups xmm0, xmmword [ebp + eax - 0x54]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x54], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100ed470
cmp eax, 0x23
jae 0x100ed49b
nop
xor byte [ebp + eax - 0x54], 0xe0
inc eax
cmp eax, 0x23
jb 0x100ed490
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100ed4c0
sub ecx, edx
lea eax, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.1002f190
mov dword [ebp - 4], 0
mov edx, dword [0x1045f918]
test edx, edx
je 0x100ed4ec
mov edx, dword [edx + 0x50]
jmp 0x100ed4ee
xor edx, edx
mov eax, dword [0x1045f910]
test eax, eax
je 0x100ed4fc
mov eax, dword [eax + 0x18]
jmp 0x100ed4fe
xor eax, eax
lea ecx, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.100546d0
mov edi, dword [ebp - 0x18]
add esp, 8
mov ecx, dword [ebp - 0x1c]
inc edi
cmp ecx, 0x10
jb 0x100ed548
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100ed53e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100ed53e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100fda60
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x14], 0
call esi
lea eax, [ebp - 0x14]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov byte [0x104654a0], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100fd5e5
mov esp, ebp
pop ebp
ret
Function at 0x10002bc0
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov byte [ebp - 0x21], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 4
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10002c61
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x10002c4e
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], ecx
jne 0x10002c4e
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10002c4b
cmp byte [ebp - 0x21], 0
push esi
je 0x10002c42
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10002c48
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call ebx
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10002c13
push edi
call ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10009684
mov esp, ebp
pop ebp
ret
Function at 0x100054b0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push 0x1002c1d8
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000551e
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
push eax
push 0x11
push 0x1002c1d8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10030e98], 0
jne 0x1000552c
call fcn.10003d60
mov eax, dword [0x10030ea0]
test eax, eax
je 0x1000553d
push dword [ebp - 0xc]
push dword [ebp + 8]
call eax
push str.____ServiceMain_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10005594
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
push eax
push 0x11
push str.____ServiceMain_r_n
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10009684
mov esp, ebp
pop ebp
ret 8

Function at 0x100055b0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0x1002c200
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000561e
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
push eax
push 0x1f
push 0x1002c200
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10030e98], 0
jne 0x1000562c
call fcn.10003d60
mov eax, dword [0x10030e9c]
test eax, eax
je 0x1000563a
push dword [ebp - 0xc]
call eax
push str.____SvchostPushServiceGlobals_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push str._rdpwrap.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10005691
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
push eax
push 0x1f
push str.____SvchostPushServiceGlobals_r_n
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10009684
mov esp, ebp
pop ebp
ret 4
Function at 0x100122fa
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10012339
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10012339
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10012339
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10012339
cmp dword [ecx + 0x74], 0xe
jbe 0x10012339
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100194b8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10019555
push ebx
push esi
call fcn.10019481
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001648e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10019502
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10019554
push edi
push eax
call fcn.10017030
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10019522
call fcn.10016ff6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10019553
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001648e
add esp, 0x20
test eax, eax
jne 0x10019541
push edi
call fcn.10016ff6
jmp 0x10019549
push ebx
call fcn.10016ff6
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100199a2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10028010
push 0x10028008
push str.FlsAlloc
push 0x1f
call fcn.1001986a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100199d6
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024164]
call esi
jmp 0x100199dc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10019a20
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10028020
push 0x10028018
push str.FlsGetValue
push 0x21
call fcn.1001986a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10019a57
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024164]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10019a5f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10028028
push 0x10028020
push str.FlsSetValue
push 0x22
call fcn.1001986a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10019a99
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10024164]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x1001cd36
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10014a4c
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001cda5
cmp esi, dword [ebp - 4]
je 0x1001cda0
cmp dword [ebp + 0xc], 0
je 0x1001cda0
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1001cd7d
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1001c888
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1001cda7
xor eax, eax
inc eax
jmp 0x1001cda7
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1001ce0c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10014a4c
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10014a4c
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1001ce83
cmp word [ecx], dx
je 0x1001ce83
mov eax, dword [0x1002844c]
push edi
dec eax
push eax
push 0x10028338
call fcn.1001cdab
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1001cef6
cmp word [eax], dx
je 0x1001cef6
mov eax, dword [edi]
test eax, eax
je 0x1001cea7
cmp word [eax], dx
je 0x1001cea7
lea eax, [ebp - 0x10]
push eax
call fcn.1001c78e
jmp 0x1001ceb0
lea eax, [ebp - 0x10]
push eax
call fcn.1001c829
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1001cf20
mov eax, dword [0x10028334]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10028028
call fcn.1001cdab
add esp, 0xc
test al, al
je 0x1001cf20
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1001ceeb
cmp word [eax], di
je 0x1001ceeb
lea eax, [ebp - 0x10]
push eax
call fcn.1001c78e
pop ecx
jmp 0x1001cf22
lea eax, [ebp - 0x10]
push eax
call fcn.1001c829
jmp 0x1001cee8
mov eax, dword [edi]
test eax, eax
je 0x1001cf0d
cmp word [eax], dx
je 0x1001cf0d
lea eax, [ebp - 0x10]
push eax
call fcn.1001c743
pop ecx
jmp 0x1001cf20
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1001cfeb
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1001cc30
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1001cfeb
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1001cfeb
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1001cfeb
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1001cf78
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10019b9f
test ebx, ebx
je 0x1001cfe6
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10019b9f
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001cfeb
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001cfeb
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100209f1
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1001cfed
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009684
leave
ret
Function at 0x10022b40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10022b6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10022b6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x44d904
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x44d950
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x44d935
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x44d945
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44d960
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x44d99f
test ebx, ebx
je 0x44d974
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x44d969
cmp ecx, 0xfff1
jb 0x44d982
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x44da8a
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x44d9c4
Function at 0x4980f4
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x498140
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x498125
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x498135
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x498150
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x49818f
test ebx, ebx
je 0x498164
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x498159
cmp ecx, 0xfff1
jb 0x498172
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x49827a
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4981b4
Function at 0x4e2954
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x4e29a0
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x4e2985
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x4e2995
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4e29b0
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4e29ef
test ebx, ebx
je 0x4e29c4
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x4e29b9
cmp ecx, 0xfff1
jb 0x4e29d2
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4e2ada
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4e2a14
Function at 0x4f8f04
Capabilities:
Encode data using xor

Disassembly:
push esi
pop edi
retf
add eax, 0xf076b209
jbe 0x4f8ef9
pop eax
loope 0x4f8f07
insd dword es:[edi], dx
push 0x86102070
shl byte [ebp + ebp*4 + 0x59], cl
inc ebp
sbb eax, dword [esi - 0x682a3fa4]
invalid
Function at 0x65916c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x664470
cmp edx, dword [eax]
je 0x65918e
add eax, 8
inc ecx
cmp eax, 0x664500
jl 0x65917f
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x664470]
jne 0x6592bc
mov eax, dword [0xa67ce0]
cmp eax, 1
je 0x659296
test eax, eax
jne 0x6591bf
cmp dword [0x6622b4], 1
je 0x659296
cmp edx, 0xfc
je 0x6592bc
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6591f6
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0065a2d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a3c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659239
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a3c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65dd4c
push edi
call fcn.0065ad80
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0065a2d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a2e0
lea eax, [ebp - 0xa0]
push 0x65dd2c
push eax
call fcn.0065a2e0
push dword [esi + 0x664474]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a2e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065acf2
add esp, 0x2c
pop edi
jmp 0x6592bc
lea eax, [ebp + 8]
lea esi, [esi + 0x664474]
push 0
push eax
push dword [esi]
call fcn.0065a3c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x41f060]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x218], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x401050
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSystemDirectory___returns_0__GetLastError___d
call fcn.00401f9e
pop ecx
pop ecx
push 0xffffffffffffffc4
pop eax
jmp 0x401128
lea edi, [eax + 1]
cmp edi, esi
jb 0x401066
push str.GetSystemDirectory_buffer_overflow
call fcn.00401f9e
pop ecx
push 0xffffffffffffffbe
jmp 0x40104a
push 0x41c0a8
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.00404a5d
add esp, 0xc
push ebx
call fcn.00404cf7
add eax, edi
pop ecx
cmp eax, esi
push ebx
lea eax, [ebp - 0x214]
jb 0x4010aa
and word [ebp + edi*2 - 0x214], 0
push eax
push 0x41c0ac
call fcn.00401f9e
add esp, 0xc
push 0xffffffffffffffb4
jmp 0x40104a
push esi
push eax
call fcn.00404a5d
add esp, 0xc
push dword [ebp - 0x218]
lea eax, [ebp - 0x214]
push eax
call sub.IMM32.dll_ImmInstallIMEW
mov esi, eax
test esi, esi
jne 0x4010f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x4010ed
lea eax, [ebp - 0x214]
push eax
push esi
push str.ImmInstallIME___returns_NULL__GetLastError_____d__Filename___s
call fcn.00401f9e
add esp, 0xc
mov eax, esi
jmp 0x401128
push 1
push esi
mov ecx, str.HKEY_CURRENT_USER
mov edx, 0x80000001
call fcn.004016d4
push esi
call fcn.00401da2
add esp, 0xc
test eax, eax
jne 0x401118
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401128
push esi
call fcn.00401c3a
pop ecx
push esi
call fcn.00401f46
pop ecx
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00404331
leave
ret

Function at 0x40117c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x41f060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push edi
push 0
push 0
mov dword [ebp - 0x4c], eax
call esi
mov ebx, eax
shl eax, 2
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4011f9
push edi
push ebx
call esi
xor esi, esi
cmp ebx, esi
mov dword [ebp - 0x48], esi
jbe 0x4011ef
push 0x20
lea eax, [ebp - 0x44]
push eax
push dword [edi + esi*4]
call sub.IMM32.dll_ImmGetIMEFileNameW
push dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
push eax
call fcn.00404583
test eax, eax
pop ecx
pop ecx
je 0x4011e9
inc esi
cmp esi, ebx
jb 0x4011c2
jmp 0x4011ef
mov eax, dword [edi + esi*4]
mov dword [ebp - 0x48], eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404331
leave
ret