joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406518
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x40b208], 0
jne 0x406599
cmp dword [0x40b228], 0
jne 0x406548
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x40b228], eax
test eax, eax
jne 0x406548
push str.GetEnvironmentStrings_failed
call fcn.00405d78
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x40b228]
jmp 0x40655c
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0040287c
pop ecx
mov edi, eax
test eax, eax
jne 0x406554
lea edi, [ebp + 1]
push edi
call fcn.004019b4
pop ecx
mov ebx, eax
mov dword [0x40b20c], ebx
test ebx, ebx
jne 0x406586
xor eax, eax
jmp 0x40665c
push edi
mov edx, dword [0x40b228]
push edx
push ebx
call fcn.004026d8
add esp, 0xc
jmp 0x4065b9
xor esi, esi
mov ebx, dword [0x40b208]
jmp 0x4065b3
push eax
call fcn.0040287c
pop ecx
test eax, eax
jne 0x4065af
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4065a3
lea ebx, [esi + 4]
push 4
mov dword [0x40b210], ebx
inc ebx
push ebx
call fcn.004017b4
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4065dc
xor eax, eax
jmp 0x40665c
cmp dword [0x40b208], 0
jne 0x40660d
xor esi, esi
mov ebx, dword [0x40b20c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4065fe
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0040287c
pop ecx
mov edi, eax
test eax, eax
jne 0x4065f4
jmp 0x40663e
xor esi, esi
mov ebx, dword [0x40b208]
mov eax, dword [esp]
mov edi, eax
jmp 0x406638
push eax
call fcn.0040287c
pop ecx
test eax, eax
je 0x40662d
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x406631
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40661c
mov eax, dword [0x40b208]
test eax, eax
je 0x40664e
push eax
call fcn.004019c4
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x40b208], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401c6f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401cae
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401cae
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401cae
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401cae
cmp dword [ecx + 0x74], 0xe
jbe 0x401cae
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000d4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000d4cf
pop dword [ebp - 0x3c]
mov eax, 0x1000d4cf
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xa630bfff
sub dword [ebp - 0x4c], 0x57de7ab4
mov dword [ebp - 0x48], 0x17f75013
add dword [ebp - 0x48], 0x1a3bfc32
mov dword [ebp - 0x44], 0xc967d35
sub dword [ebp - 0x44], 0xc04a3907
mov dword [ebp - 0x40], 0x5bb6e1e0
add dword [ebp - 0x40], 0xa4491e20
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xaf12e043
add eax, 0x60f2b0c9
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xce5bb730
add dword [ebp - 0x4c], 0xa616b226
mov dword [ebp - 0x48], 0xfdf96f1c
sub dword [ebp - 0x48], 0xbc8d0da7
mov dword [ebp - 0x44], 0x1afd308b
add dword [ebp - 0x44], 0x48723be1
mov dword [ebp - 0x40], 0x947632c6
add dword [ebp - 0x40], 0x6b89cd3a
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x3c877843
sub eax, 0x2c81e803
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x5c0f1
push 0
call eax
mov ecx, 0x419e
mov edx, eax
mov edi, 0x39c427ee
sub edi, 0x29bd93ee
add edi, dword [ebp - 0x3c]
mov esi, 0x98ab803
add esi, 0x29e9c448
mov dword [ebp - 0x28], 0xc4613f6f
mov ebx, dword [edi]
xor dword [ebp - 0x2c], 0x996fd599
add ebx, esi
sub dword [ebp - 0x10], ebx
mov dword [edx], ebx
xor dword [ebp - 0x38], ebx
add edx, 0x13a0d439
sub edx, 0x13a0d435
add edi, 4
loop 0x1000d5e6
add eax, 0xf94b
mov ebx, eax
add eax, 0x1825889a
sub eax, 0x18258895
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x659a4c]
push 0x659768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x46c60f
Capabilities:
Encode data using xor

Disassembly:
pop es
fdivr qword [ebx + 0x6fbfadc3]
cmpsd dword [esi], dword es:[edi]
nop
invalid

Function at 0x46d1cf
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
dec ecx
pop ecx
int3
adc esp, dword [edi - 0x32]
scasd eax, dword es:[edi]
salc
aas
out 0xaf, eax
push esi
mov al, 0x15
pop dword [esp + ebx*2 + 0x3c97eee8]
out dx, al
mov bh, 0xbd
and al, 6
jne 0x1da5d854
push 0x54
daa
vsubsd xmm5, xmm2, qword [ebx - 0x20093db8]
sub esi, edx
fld xword [eax]
mov ecx, 0x35618852
sub byte [ecx + 0x35618852], bh
pop ebp
jp 0x46d131
push ss
ja 0x46d1ed
pop esi
mov dl, 0x6a
iretd
invalid
push esi
jecxz 0x46d170
leave
lodsw ax, word [esi]
dec ebx
pop es
std
xchg byte [ebx], dl
jae 0x46d19b
invalid
shl dword [eax + 0x5c], 0x74
and edx, dword [ebx - 0x1d7f3a8a]
pushal
pop esp
je 0x46d213
xchg ebx, eax
jbe 0x46d1b8
and dl, 0x60
mov ebx, 0x61fac0dd
jb 0x46d1eb
ret
mov eax, dword [0xaf861e84]
push eax
pop es
pushal
invalid
Function at 0x4e029f
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0051378f
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e03c2
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffabf
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e03d9
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff9cf
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5536df
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x3dff3123
xchg ebp, eax
xor cl, bh
xor cl, byte [eax + 0x7cc55c5b]
insd dword es:[edi], dx
push eax
jg 0x5536e4
mov esp, 0x67ace91b
lea ecx, [edx]
fadd st(2), st(0)
sbb al, 0xa9
adc al, 0x4f
inc edi
lodsd eax, dword [esi]
dec esi
adc al, 0x3d
cmc
xchg esi, eax
xor edi, esp
push ss
imul edi, ecx, 0x6f
add al, 0x67
mov ebx, 0x94876eb0
sub ah, bh
popfd
adc dword [esi - 0x7f], edx
invalid
Function at 0x5a64cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
jmp [esi + 0x3d4aec4a]
add ecx, dword [edi - 0x56]
inc eax
lcall 0x38e5, 0xe4d79024
test eax, 0xe2df649b
loop 0x5a6502
test byte [ebx + 0x49e15bfe], al
loop 0x5a6502
test byte [ebx + 0x49e15bfe], al
mov ah, 0x5b
cmp eax, eax
dec eax
mov cl, 0x21
xor eax, 0x14aab8af
enter 0xffffffffffff9e66, 0x31
inc dword [edx]
ja 0x5a64c0
ljmp 0x6b84:0x7b89bc55
aaa
push eax
aas
les ebp, [edx - 0x6c]
stosb byte es:[edi], al
mov ch, 0x4d
mov bl, 0xdf
in eax, 0x1a
adc dword [ecx - 0x647f7b1a], 0xfa07c407
sbb al, byte [ecx - 0x7f7b196f]
wait
pop es
les eax, [edi]
cli
movsb byte es:[edi], byte [esi]
je 0x5a64a9
xchg ebp, eax
aas
dec eax
stosb byte es:[edi], al
sahf
bound ebp, qword [edi + ebx*8 + 0x5ebc6db2]
fdiv dword [edi - 0xa]
js 0x5a6566
out dx, al
sbb bl, dl
xor byte [esi - 0x75aa05d8], cl
adc bl, byte [ebx - 0x54c234d8]
push eax
sub dl, byte [ebp - 0xe555bf1]
jg 0x5a64f6
shld dword [edx + 0x2bbc7ff1], ebp, 0x95
pop esi
mov al, byte [0x15f1b71b]
jmp 0x5a6559
sub edx, dword [ebp - 0x48e45fa2]
int1
mov bh, 0xf1
adc eax, 0x700315eb
retf
mov ebx, dword [edx - 0x2c]
pop ebx
test al, 0x58
cmc
mov dh, 0x71
sbb ebp, esi
lcall 0x286a, 0xf1349f60
lahf
xor al, 0xf1
push 0x28
add eax, 0x742a3cdf
aaa
js 0x5a65b3
sbb al, 0xda
xor al, 0x4b
int1
les ebp, ss:[edi - 0x2c]
dec edi
daa
in eax, 0x55
fist dword [eax - 0x49]
jecxz 0x5a6534
and al, 0xbf
xor al, 0xa2
inc esp
salc
adc byte [ebx + 0x3860732d], bl
pop edi
and byte [edi + eax*2 + 0x6ff8a1e8], dl
invalid
mov ch, 0xf
movsb byte es:[edi], byte [esi]
add eax, esp
add byte [edi], al
adc edx, dword [edi]
jns 0x5a653f
sub esi, ebp
scasd eax, dword es:[edi]
in eax, 0xaa
inc eax
or eax, 0xef72cb24
inc esp
jmp 0x5a6611
iretd
Function at 0x6065ef
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639adf
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606712
push ecx
lea ecx, [esi + 0x18]
call fcn.00625e0f
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606729
push ecx
lea ecx, [esi + 0x24]
call fcn.00625d1f
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x61af5f
Capabilities:
Encode data using xor

Disassembly:
cwde
xchg esi, eax
sub ebx, dword es:[ebx]
hlt
mov eax, 0x70fa5dd4
xor al, 0x16
aam 0x5d
cli
jo 0x61af73
push ss
jge 0x61aedc
cdq
aam 0x87
inc ebp
xor eax, 0xa72ee7df
cmp dword [ecx + ecx*2 - 0x29], ecx
loopne 0x61af3a
xlatb
cdq
mov ch, 0xb3
xor eax, 0x977de0f0
adc dword [edi], esi
scasb al, byte es:[edi]
dec ecx
out 0x8e, al
in eax, 0xe1
fld dword [edi + 0x17d3ca8c]
nop
inc esp
das
dec ebx
add dl, dh
xchg edx, eax
aaa
mov edx, 0x3235c526
sbb eax, 0x432b87e1
lodsd eax, dword [esi]
lds esi, [0x87e11d32]
sub eax, dword [ebx - 0x53]
xchg edi, eax
add dword [eax], 0x85b4156f
scasb al, byte es:[edi]
mov cl, 2
push esp
in eax, dx
xor byte [eax + 0x67f1ad77], 0x41
sti
jg 0x61b00c
aam 0xbe
jb 0x61af39
sub byte [eax], 0x82
push esi
jne 0x61b015
adc eax, 0x2f46bc60
push ecx
jmp 0x61b010
xchg byte [edx + 0x7d678257], dh
xor eax, 0x841a7d16
cdq
pop ecx
inc edx
int 0x70
jge 0x61b048
push ss
jge 0x61b030
sbb al, byte [ecx + ebx*4 + 0x70cd4259]
test byte [ecx + 0x70cd4259], bl
invalid
mov dh, 0x41
inc esi
dec esi
in eax, 0xae
adc al, byte [edi]
cmp bh, dl
adc esi, dword [edx - 0x80]
ret
mov dword [0x22b887b3], eax
xchg edi, eax
aad 0x15
iretd
Function at 0x630e2f
Capabilities:
Encode data using xor

Disassembly:
rcl byte [esi], cl
fbld tbyte [edx]
sbb edi, ebp
push ebx
aaa
push ebp
shl dword [ebx + 0x7ee23c6], cl
sbb al, byte [edx - 0x57]
std
xor ebx, ecx
arpl word [esi - 0x70261691], bx
xchg edx, eax
movsd dword es:[edi], dword [esi]
xchg ebx, eax
out dx, al
or al, byte [edi]
push edx
les esp, [ebp + 0x25474326]
mov eax, dword [0xfce2b816]
les esp, [esi + ebx*8 + 0x7d]
mov byte [0x9e7e61c7], al
js 0x630e4e
sar dword [eax - 0xa], cl
and dword [ebx + eax*4], esi
aaa
invalid

Function at 0x64d7dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x656338
cmp edx, dword [eax]
je 0x64d7ff
add eax, 8
inc ecx
cmp eax, 0x6563c8
jl 0x64d7f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x656338]
jne 0x64d92d
mov eax, dword [0xa59c90]
cmp eax, 1
je 0x64d907
test eax, eax
jne 0x64d830
cmp dword [0x656264], 1
je 0x64d907
cmp edx, 0xfc
je 0x64d92d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d867
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e1c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e650
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d8aa
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e650
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652a14
push edi
call fcn.00650520
lea eax, [ebp + 8]
lea esi, [esi + 0x65633c]
arpl word [ebp], sp
Function at 0x2580f5a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x2580f5b8
pop dword [ebp - 0x14]
mov eax, 0xa4e0ce2a
add eax, 0x80a0278e
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xda8f5ddb
add dword [ebp - 0x24], 0x73c2e770
mov dword [ebp - 0x20], 0xff165a26
add dword [ebp - 0x20], 0x331cf21f
mov dword [ebp - 0x1c], 0xc9d97c7b
add dword [ebp - 0x1c], 0x8272c7b3
mov dword [ebp - 0x18], 0x9637c5bb
sub dword [ebp - 0x18], 0x9637c5bb
lea eax, [ebp - 0x24]
push eax
mov eax, 0xcab6f291
add eax, 0x5acaddb3
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x18a4cd13
add dword [ebp - 0x24], 0x5bcd9c43
mov dword [ebp - 0x20], 0x2312bdfc
sub dword [ebp - 0x20], 0xe1a65c87
mov dword [ebp - 0x1c], 0x9bd78f3d
sub dword [ebp - 0x1c], 0x386822d1
mov dword [ebp - 0x18], 0x2edd3216
add dword [ebp - 0x18], 0xd122cdea
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xed66fcb
add eax, 0x16ab60b5
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3c540
push 0
call eax
mov ecx, 0x5586234c
add ecx, 0xaa7a22a5
xor ebx, ebx
add ebx, eax
mov edx, 0xb23d5416
add edx, 0x734541ea
add edx, dword [ebp - 0x14]
mov edi, 0x79fcd4c5
add edi, 0x28bcfd46
add dword [ebp - 0x10], 0x56635bcf
mov esi, dword [edx]
mov dword [ebp - 0x10], 0x483fb7ce
xor esi, edi
xor dword [ebp - 0x10], esi
mov dword [ebx], esi
add dword [ebp - 0xc], eax
add ebx, 4
add edx, 0xcbde847
add edx, 0xf34217bd
loop 0x2580f6dc
add eax, 0x3d0b1899
add eax, 0xc2f5f1fe
mov ebx, eax
add eax, 0x881fbf73
sub eax, 0x881fbf6e
mov ecx, 0xbb478701
sub ecx, 0x95c78701
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x1003eb32
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1003eb41
pop dword [ebp - 8]
mov eax, 0xd04b938a
sub eax, 0xc047a849
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x64a7b87a
add dword [ebp - 0x18], 0xe9aa8cd1
mov dword [ebp - 0x14], 0xd62076d6
sub dword [ebp - 0x14], 0xa3ed2a91
mov dword [ebp - 0x10], 0xc7731689
add dword [ebp - 0x10], 0x84d92da5
mov dword [ebp - 0xc], 0xc0739e97
sub dword [ebp - 0xc], 0xc0739e97
lea eax, [ebp - 0x18]
push eax
mov eax, 0xfc4b4ab0
add eax, 0x13ba765c
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x5d6c03dd
sub dword [ebp - 0x18], 0xe8f99a87
mov dword [ebp - 0x14], 0x3db6c274
add dword [ebp - 0x14], 0x3b59f01
mov dword [ebp - 0x10], 0x1d399437
add dword [ebp - 0x10], 0x4635d835
mov dword [ebp - 0xc], 0x3251b0c1
sub dword [ebp - 0xc], 0x3251b0c1
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x5bbe7
push 0
call eax
mov ecx, 0x4cab
xor edx, edx
add edx, eax
mov esi, 0x1b032508
sub esi, 0xafc5b08
add esi, dword [ebp - 8]
mov ebx, 0x6f2be9c9
add ebx, 0x2b039ed7
sub dword [ebp - 4], 0xb22a435a
mov edi, dword [esi]
add dword [ebp - 4], 0xae8b2329
xor edi, ebx
xor dword [ebp - 4], 0xac53b8c2
mov dword [edx], edi
mov dword [ebp - 4], 0xf6a58268
add edx, 0x54c0d7d5
sub edx, 0x54c0d7d1
add esi, 4
loop 0x1003ec5a
add eax, 0x60be6c60
add eax, 0x9f42b91f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x204d9be
add ecx, 0xdfb2642
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10014663
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10014672
pop dword [ebp - 0x34]
mov eax, 0x10014672
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3db0c
push 0
mov eax, 0x63af7f20
sub eax, 0x53ae0de0
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x572b
xor ebx, ebx
add ebx, eax
mov esi, 0x87341db9
add esi, 0x88ce3647
add esi, dword [ebp - 0x34]
mov edi, 0xb1a559fe
xor dword [ebp - 0x18], ecx
mov edx, dword [esi]
add dword [ebp - 0x10], ebx
add edx, edi
add dword [ebp - 0x14], 0x9e198096
mov dword [ebx], edx
xor dword [ebp - 0x20], ecx
add ebx, 0x2b3d5e73
sub ebx, 0x2b3d5e6f
add esi, 0x2eae9b4d
add esi, 0xd15164b7
loop 0x100146c2
add eax, 0x14f7f
xor ebx, ebx
add ebx, eax
add eax, 0x2c793cef
add eax, 0xd386c316
mov ecx, 0x595af188
add ecx, 0xb6a50e78
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x405b30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
movsx eax, byte [esi]
test eax, eax
jne 0x405b64
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push esi
call fcn.00405940
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.00406080
pop ecx
mov ebx, eax
test eax, eax
jne 0x405b97
push 1
call fcn.00405620
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [ebx + eax*4]
push eax
push ebx
push esi
call fcn.00405940
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x44b63c], eax
mov dword [0x44b638], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405bd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 8]
jmp 0x405c08
or eax, 0xffffffff
inc eax
cmp byte [ebx + eax], 0
jne 0x405bf1
inc eax
mov esi, eax
movsx eax, byte [ebx]
cmp eax, 0x3d
je 0x405c06
add dword [ebp - 4], esi
add ebx, esi
cmp byte [ebx], 0
jne 0x405bee
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.00406080
pop ecx
mov edi, eax
mov dword [0x44b744], eax
test eax, eax
jne 0x405c2b
push 1
call fcn.00405620
pop ecx
mov ebx, dword [ebp - 8]
jmp 0x405c52
or eax, 0xffffffff
inc eax
cmp byte [ebx + eax], 0
jne 0x405c33
inc eax
mov esi, eax
movsx eax, byte [ebx]
cmp eax, 0x3d
je 0x405c50
push ebx
push edi
call fcn.00406900
pop ecx
pop ecx
add edi, esi
add ebx, esi
movsx eax, byte [ebx]
test eax, eax
jne 0x405c30
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e1bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000e1cb
pop dword [ebp - 0x40]
mov eax, 0x3290959d
add eax, 0xdd704c2e
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x34059
push 0
mov eax, 0x2748a886
sub eax, 0x17476822
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x3410
mov esi, eax
mov edi, 0x2629a42b
sub edi, 0x16281e2b
add edi, dword [ebp - 0x40]
mov ebx, 0x589a4d7b
sub ebx, 0x6d122c3c
xor dword [ebp - 0x1c], ecx
mov edx, dword [edi]
mov dword [ebp - 0x34], 0x24c9517f
add edx, ebx
xor dword [ebp - 0x34], 0x8b27203d
mov dword [esi], edx
mov dword [ebp - 0x2c], 0x811b2d43
add esi, 0xd4027fbf
add esi, 0x2bfd8045
add edi, 0xfddb732c
sub edi, 0xfddb7328
loop 0x1000e224
add eax, 0xc313
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4047e2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404821
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404821
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404821
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404821
cmp dword [ecx + 0x74], 0xe
jbe 0x404821
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.00408d33
pop ecx
test eax, eax
je 0x401046
push str.Windows_original_main_args:_n
call fcn.00408bef
xor esi, esi
pop ecx
cmp dword [0x425628], esi
jle 0x401046
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408bef
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401027
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.004149e5
call fcn.0040392e
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039b0
pop ecx
pop ecx
mov esi, eax
call fcn.00403934
xor ecx, ecx
test edi, edi
jle 0x401080
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401075
mov eax, dword [0x424010]
and dword [esi + ecx*4], 0
mov ebx, eax
test eax, eax
jne 0x401091
mov ebx, dword [esi]
mov ecx, dword [0x42400c]
test ecx, ecx
jne 0x40109d
mov ecx, dword [esi]
mov eax, dword [0x425420]
push 0
push 0
push 1
test eax, eax
setne dl
movzx edx, dl
push edx
push ebx
push ecx
push 0x41c24c
push 0x41c23c
push dword [0x425424]
push 1
push eax
push 1
push esi
push edi
call fcn.00403472
add esp, 0x38
pop edi
pop esi
pop ebx
ret