joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x454994
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x37
mov byte [ebp - 3], 0x3c
mov byte [ebp - 2], 0x2f
mov byte [ebp - 1], 0x49
push 4
lea ecx, [ebp - 4]
push ecx
push 0x454998
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x44
mov byte [ebp - 3], 0x3e
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x45499c
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x4549a4
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x34
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x3c
mov byte [ebp - 1], 0x2f
push 4
lea ecx, [ebp - 4]
push ecx
push 0x4549a8
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x3e
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x4549ac
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x4549b4
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x31
mov byte [ebp - 1], 0x3c
push 4
lea ecx, [ebp - 4]
push ecx
push 0x4549b8
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x2f
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea edx, [ebp - 4]
push edx
push 0x4549bc
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x4549c4
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x35
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x33
mov byte [ebp - 1], 0x3c
push 4
lea ecx, [ebp - 4]
push ecx
push 0x4549c8
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x2f
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea edx, [ebp - 4]
push edx
push 0x4549cc
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x4549d4
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x34
mov byte [ebp - 2], 0x3c
mov byte [ebp - 1], 0x2f
push 4
lea ecx, [ebp - 4]
push ecx
push 0x4549d8
call fcn.00403530
add esp, 0xc
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x3e
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x4549dc
call fcn.00403530
add esp, 0xc
call fcn.00429880
mov esp, ebp
pop ebp
ret 4
Function at 0x429b30
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x429b83
mov dword [ebp - 0x14], 0xffffffff
jmp 0x429c4d
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
jmp 0x429b9e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jae 0x429c46
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 5
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x429bdc
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x429c46
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
cmp edx, dword [ebp - 4]
jne 0x429c04
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x453e38
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x429c2b
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x453e30]
shl eax, 8
add eax, 0x453f38
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [0x453e30]
add ecx, 1
mov dword [0x453e30], ecx
cmp dword [ebp - 0x10], 0
je 0x429c41
mov edx, dword [ebp - 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x10], 0
jmp 0x429b95
jmp 0x429c4d
cmp dword [ebp - 0x10], 0
je 0x429c5c
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 0x18], 0
je 0x429c6b
mov ecx, dword [ebp - 0x18]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x429f10
Capabilities:
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], str.Accept:___r_nPragma:_no_cache_r_nCache_Control:_no_cache_r_n
mov dword [ebp - 0x20], str.Content_Type:_application_x_www_form_urlencoded_r_n
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0x438f7c
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x429f66
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
cmp dword [ebp + 0x10], 0
je 0x429f8c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 8], eax
mov eax, dword [0x43bf84]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x248
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x429fd4
mov dword [ebp - 0x1c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x42a035
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x42a00b
mov dword [ebp - 0x1c], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x42a035
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x42a02e
mov dword [ebp - 0x1c], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x42a035
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42a0f0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [0x43bf84], 0x100
push 0
push 0
push 0
push 0
push str.UserAgent_1.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x42a143
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x42a28a
cmp dword [ebp + 0x10], 0
je 0x42a15d
push 4
lea eax, [ebp + 0x10]
push eax
push 3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x3c
mov ecx, dword [ebp + 8]
add ecx, 0x48
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0x100
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov edx, dword [ebp + 8]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 0x800
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x42a1cd
mov dword [ebp - 8], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x42a28a
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 2
jne 0x42a203
mov dword [ebp - 0xc], 0xa00
push 4
lea edx, [ebp - 0xc]
push edx
push 0x54
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov edx, dword [0x43bf84]
or edx, 0x800000
mov dword [0x43bf84], edx
mov dword [0x453154], 1
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [0x453e28], eax
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov dword [0x453e2c], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x24]
mov dword [0x44d088], eax
push 0
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x24]
push edx
mov eax, dword [ebp + 8]
add eax, 0x48
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x42a283
mov dword [ebp - 8], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov dword [0x453154], 0
mov dword [0x453e2c], 0
jmp 0x42a28a
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42bd60
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x42bdaf
mov dword [ebp - 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42beec
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jge 0x42bdd2
mov dword [ebp - 0x18], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42bee6
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42bdfe
mov dword [ebp - 0x18], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42be89
lea edx, [ebp - 8]
push edx
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42be24
mov dword [ebp - 0x18], 0xfffffffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42be89
lea eax, [ebp - 4]
push eax
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42be4a
mov dword [ebp - 0x18], 0xfffffffb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42be89
cmp dword [ebp - 0x10], 0
je 0x42be5f
push 0x453a58
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 8], 0
je 0x42be74
push 0x453b58
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 4], 0
je 0x42be89
push 0x453c58
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 4], 0
je 0x42bea1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 0x14]
call edx
cmp dword [ebp - 8], 0
je 0x42beb9
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x14]
call ecx
cmp dword [ebp - 0x10], 0
je 0x42bed1
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 0x14]
call eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 8]
call ecx
jmp 0x42bee6
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 4
Function at 0x42d3b0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x43b2c4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x214], 0x100
mov dword [ebp - 0x218], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x42d42a
mov dword [ebp - 4], 0
jmp 0x42d473
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42d473
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00401e17
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42d740
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x43b2c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x110], 0x7c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x43c04c], eax
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00401e30
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00401e30
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x42d896
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x21c], 0
jmp 0x42d7e9
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
test edx, edx
je 0x42d842
mov eax, dword [ebp - 0x21c]
movzx ecx, word [ebp + eax*2 - 0x218]
cmp ecx, 0x61
jl 0x42d840
mov edx, dword [ebp - 0x21c]
movzx eax, word [ebp + edx*2 - 0x218]
cmp eax, 0x7a
jg 0x42d840
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
sub edx, 0x20
mov eax, dword [ebp - 0x21c]
mov word [ebp + eax*2 - 0x218], dx
jmp 0x42d7da
lea ecx, [ebp - 0x218]
push ecx
push str.ADMINISTRATOR
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42d863
xor edx, edx
mov word [0x453158], dx
jmp 0x42d896
lea eax, [ebp - 0x218]
push eax
push 0x43912c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42d884
xor ecx, ecx
mov word [0x453158], cx
jmp 0x42d896
lea edx, [ebp - 0x108]
push edx
push 0x453158
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
call fcn.0042d490
push 0x43913c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x42d8df
push 0x439158
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x42d8df
mov dword [0x43c850], 2
jmp 0x42d919
cmp dword [ebp - 0x10c], 0
je 0x42d912
push str.AddAccessAllowedAceEx
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x43c850], eax
cmp dword [0x43c850], 0
jne 0x42d912
mov dword [0x43c850], 3
jmp 0x42d919
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401e17
mov esp, ebp
pop ebp
ret 4
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x403e59
pop dword [ebp - 0x14]
mov eax, 0xede91b60
add eax, 0x125722f9
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x2cca9606
sub dword [ebp - 0x24], 0xde7850bb
mov dword [ebp - 0x20], 0x91bfd933
sub dword [ebp - 0x20], 0x5f8c8cee
mov dword [ebp - 0x1c], 0xa325aa98
add dword [ebp - 0x1c], 0xa9269996
mov dword [ebp - 0x18], 0x15fd2ff4
add dword [ebp - 0x18], 0xea02d00c
lea eax, [ebp - 0x24]
push eax
mov eax, 0xfd869d5c
sub eax, 0xfd461cd0
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x4756731b
sub dword [ebp - 0x24], 0xd2e409c5
mov dword [ebp - 0x20], 0x930cf52e
add dword [ebp - 0x20], 0xae5f6c47
mov dword [ebp - 0x1c], 0xe31c0b85
sub dword [ebp - 0x1c], 0x7fac9f19
mov dword [ebp - 0x18], 0x21f09883
add dword [ebp - 0x18], 0xde0f677d
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x44b27b0f
sub eax, 0x4471fa3b
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x34409
push 0
call eax
mov ecx, 0x3e05
xor edx, edx
add edx, eax
mov ebx, 0xa4d09228
add ebx, 0x5b707dd8
add ebx, dword [ebp - 0x14]
mov edi, 0x94f3bea9
mov dword [ebp - 0x10], 0x2649d267
mov esi, dword [ebx]
add dword [ebp - 0xc], 0x36c8b38a
xor esi, edi
xor dword [ebp - 8], ebx
mov dword [edx], esi
add edx, 4
add ebx, 0xe347aee1
add ebx, 0x1cb85123
loop 0x403f71
add eax, 0xc4b4c64e
sub eax, 0xc4b3db67
mov ebx, eax
add eax, 5
mov ecx, 0xdc7b08bc
add ecx, 0x23c4f744
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00402767
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00402767
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00402767
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00402767
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00402767
mov dword [0x41203c], eax
call fcn.00402767
test eax, eax
jge 0x402550
push 8
call fcn.00402767
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00402767
pop ecx
push 1
call fcn.00402767
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00402767
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00402767
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00402767
jmp 0x402495

Function at 0x402767
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x402776
pop dword [ebp - 0x20]
mov eax, 0xaf7deb5
add eax, 0xf54848c1
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x37866
push 0
mov eax, 0xd332d7f8
sub eax, 0xd2f1f720
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x3ed3
mov ebx, eax
mov esi, 0x91d0111a
sub esi, 0x918ed556
add esi, dword [ebp - 0x20]
mov edi, 0xbbf521e5
add edi, 0xa77ab4fb
xor dword [ebp - 8], esi
mov edx, dword [esi]
sub edx, edi
sub dword [ebp - 0x1c], edi
mov dword [ebx], edx
xor dword [ebp - 8], ebx
add ebx, 4
add esi, 4
loop 0x4027cf
add eax, 0xee1f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb02f7c86
add ecx, 0x5010837a
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10002fc7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10002fd6
pop dword [ebp - 0x44]
mov eax, 0x9bdb90bd
add eax, 0x74249f19
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x9ec03880
sub dword [ebp - 0x54], 0x506df335
mov dword [ebp - 0x50], 0xf1b74f6c
add dword [ebp - 0x50], 0x407bfcd9
mov dword [ebp - 0x4c], 0xf1e4c3d3
add dword [ebp - 0x4c], 0x5a67805b
mov dword [ebp - 0x48], 0x3132d054
add dword [ebp - 0x48], 0xcecd2fac
lea eax, [ebp - 0x54]
push eax
mov eax, 0xf34847e8
add eax, 0x1cba089c
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x413bd13c
add dword [ebp - 0x54], 0x3336981a
mov dword [ebp - 0x50], 0xeb93c328
add dword [ebp - 0x50], 0x55d89e4d
mov dword [ebp - 0x4c], 0x2853a90e
sub dword [ebp - 0x4c], 0xc4e43ca2
mov dword [ebp - 0x48], 0xc8e7d300
add dword [ebp - 0x48], 0x37182d00
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xfb647398
sub eax, 0xeb62231c
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3970b
push 0
call eax
mov ecx, 0xaa4190b1
sub ecx, 0xaa4150b2
xor edi, edi
add edi, eax
mov esi, 0x10030c00
add esi, dword [ebp - 0x44]
mov ebx, 0x3b4f0ca8
sub dword [ebp - 0x34], edi
mov edx, dword [esi]
sub dword [ebp - 0xc], 0x8bf44eb1
xor edx, ebx
add dword [ebp - 0xc], 0xbe000814
mov dword [edi], edx
xor dword [ebp - 0x10], edx
add edi, 0x88ca412c
sub edi, 0x88ca4128
add esi, 0x5360fc79
sub esi, 0x5360fc75
loop 0x100030ee
add eax, 0x93c19cc2
sub eax, 0x93c0a9f3
mov ebx, eax
add eax, 0xfc57190f
add eax, 0x3a8e6f6
mov ecx, 0x204b0607
add ecx, 0xefb4f9f9
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x1001c6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c73b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c6f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c6f2
cmp esi, ebx
jge 0x1001c6f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c74d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc