joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d1a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [ebp + 8]
mov dword [0x6d6444], 0x8f6
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [0x6d6440], 0xfffff6fa
mov ecx, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0x6c
mov edi, edx
add edi, esi
add edi, 0x68
mov esi, dword [edi]
imul edi, eax, 0x6c
add edx, edi
add edx, 0x50
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x1d1
mov ecx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jne 0x5d1a2d
lea eax, [0x6c6494]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x6d6444], 0xb99
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
call fcn.005d1e10
mov eax, dword [0x6d6444]
add eax, 0xfffff64c
mov dword [0x6d6440], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.005d1590
mov ecx, eax
mov dword [0x6d6460], eax
mov eax, esp
mov edx, dword [ebp - 0x3c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, dword [0x6d6444]
add edx, 0xffffef93
mov dword [0x6d6440], edx
mov edx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
lea edx, section..data
imul esi, eax, 0x6c
mov edi, edx
add edi, esi
add edi, 0x68
mov esi, dword [edi]
imul edi, eax, 0x6c
mov ebx, edx
add ebx, edi
add ebx, 0x4c
mov edi, dword [ebx]
imul ebx, eax, 0x6c
add edx, ebx
add edx, 0x50
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x48]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edx
call fcn.005d1bf0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
add eax, ecx
mov edx, dword [ebp - 0x54]
add edx, 1
cmp edx, 0x1d1
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
jne 0x5d1b0a
mov dword [0x6d6440], 0x23de
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 8], ecx
call fcn.005d2170
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x177f06
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [0x6d6440], 0x26a1
mov dword [edx + 4], 0x129400
mov ecx, dword [ebp - 0x48]
add ecx, 0x7a477
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x1f60
mov dword [0x6d6444], 0x1a84
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5d1c80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x6d6444], 0x12cc
mov dword [0x6d6448], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov dword [0x6d644c], 0
mov dword [0x6d6458], 0
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov dword [ebp - 0x20], eax
je 0x5d1dfc
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x6d6444], 0x79c
mov edx, dword [0x6d6448]
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x6d6448], edx
mov dword [0x6d6440], 0x11e9
mov esi, dword [0x6d644c]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x6d644c], edx
mov dword [0x6d6440], 0x18c
mov ecx, dword [0x6d6448]
mov bl, byte [edi + ecx]
mov byte [0x6d6450], bl
mov dword [0x6d6440], 0x82
mov ecx, dword [0x6d644c]
mov bl, byte [edi + ecx]
mov ecx, dword [0x6d6448]
mov byte [edi + ecx], bl
mov bl, byte [0x6d6450]
mov ecx, dword [0x6d644c]
mov byte [edi + ecx], bl
mov ecx, dword [0x6d6444]
add ecx, 0xffffede2
mov dword [0x6d6440], ecx
mov ecx, dword [0x6d6448]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x6d644c]
movzx edx, byte [edi + edx]
add edx, ecx
and edx, 0xff
mov dword [0x6d6458], edx
mov dword [0x6d6444], 0x9b0
mov dword [0x6d6440], 0xeba
mov bl, byte [edi + edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
movzx esi, byte [ecx + edx]
mov dword [esp], esi
movzx esi, bl
mov dword [esp + 4], esi
call fcn.00401000
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov byte [ecx + edx], al
mov dword [0x6d6440], 0x15cf
add edx, 1
mov esi, dword [ebp - 0x10]
cmp edx, esi
mov dword [ebp - 0x20], edx
jne 0x5d1cdd
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5d1fb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.005d1fb0]
mov dword [0x6d6440], 0x2505
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
jne 0x5d1ff2
mov eax, dword [ebp - 8]
add eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
jne 0x5d1ff2
mov eax, dword [ebp - 8]
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [ebp - 0x10], eax
mov dword [0x6d6444], 0x1296
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x5d1fc9
Function at 0x5d24f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x30
mov dword [ebp - 8], 0
mov dword [0x6d6440], 0x2ca5
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x6d6440], 0x261f
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x5d2625
mov dword [0x6d6440], 0x17cf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0x19]
test al, 1
jne 0x5d25d4
jmp 0x5d267f
mov eax, dword [ebp - 0x20]
mov dword [0x6d6444], 0x6af
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x5d267f
mov dword [0x6d6440], 0x1f57
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x5d2644
jmp 0x5d267f
mov dword [0x6d6440], 0x6eb
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
setl cl
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x29], cl
mov al, byte [ebp - 0x29]
test al, 1
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], edx
jne 0x5d2625
jmp 0x5d255d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x5d25fa
jmp 0x5d267f
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
mov dword [0x6d6440], ecx
add esp, 0x30
pop esi
pop ebp
ret
mov eax, 0x5b7
mov ecx, 1
mov dword [0x6d6440], 0x23a3
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
je 0x5d25e8
jmp 0x5d267f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
je 0x5d255d
jmp 0x5d259f
mov eax, dword [0x6d6444]
add eax, 0xffffec0d
mov dword [0x6d6440], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x5d267f
mov dword [0x6d6444], 0x681
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x5d2534
mov eax, 0x1567
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
jmp 0x5d25e8
Function at 0x403800
Capabilities:
Get common file path

Disassembly:
sub esp, 0x428
mov eax, dword [esp + 0x42c]
push ebx
mov ebx, dword [0x43176c]
push ebp
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
push edi
mov edi, dword [0x431768]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 0
call fcn.004037c0
add dword [esp + 0x28], 0x23f
cmp dword [0x4417a4], 0x14
jne 0x403852
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, dword [0x431770]
mov edx, dword [0x431774]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edx
mov ebp, 0x20
jmp 0x403870
mov dword [esp + 0x18], 2
add dword [esp + 0x18], 3
mov eax, esi
shl eax, 4
add eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [0x4417a4]
cmp eax, 0xfa9
jne 0x4038a2
mov dword [0x4417a0], 0xedeb2e40
jmp 0x4038b3
cmp eax, 0x3eb
jne 0x4038b3
mov dword [0x441710], 0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
add dword [esp + 0x20], eax
mov ecx, dword [esp + 0x18]
mov edx, esi
shr edx, cl
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x24]
mov dword [0x44179c], 0xf4ea3dee
mov dword [esp + 0x24], edx
call fcn.004037d0
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
cmp dword [0x4417a4], 0x9e6
jne 0x403907
mov eax, dword [esp + 0x2c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov ecx, dword [esp + 0x10]
xor dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
add dword [esp + 0x14], 0x64
sub dword [esp + 0x14], eax
sub dword [esp + 0x14], 0x64
cmp dword [0x4417a4], 0xc
jne 0x40394a
lea edx, [esp + 0x38]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
call fcn.00403740
add dword [esp + 0x10], edi
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x28]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
nop
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
shr edx, cl
mov ecx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x24], edx
call fcn.004037e0
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00403750
mov eax, dword [esp + 0x10]
push eax
mov eax, esi
call fcn.004037f0
add dword [esp + 0x28], 0x61c88647
sub ebp, 1
mov esi, eax
mov dword [esp + 0x24], esi
jne 0x403870
mov eax, dword [esp + 0x43c]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov dword [eax + 4], ecx
pop ebx
add esp, 0x428
ret 4
Function at 0x403a00
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x241c
call fcn.004114a0
mov eax, dword [0x4417a4]
mov ecx, dword [0x441714]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403b22
mov esi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x4417a4], 0x959
jne 0x403b08
push 0
lea eax, [esp + 0x82c]
push eax
push 0
push 0
push 0
push 0
call esi
push 0
lea ecx, [esp + 0x142c]
push ecx
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
lea edx, [esp + 0x30]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0
lea ecx, [esp + 0xc2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [esp + 0x20]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov edx, dword [esp + 0x10]
push edx
call fcn.00403800
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403a44
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x241c
ret
Function at 0x404410
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x42e07b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, 0x1c30
call fcn.004114a0
push ebx
push ebp
push esi
xor ebp, ebp
cmp dword [0x4417a4], 0xc
push edi
jne 0x404516
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
push ebp
push ebp
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push ebp
push 0x402e50
push 0x402e60
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push ebp
lea ecx, [esp + 0x1044]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x402e80
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push ebp
lea edx, [esp + 0x844]
push edx
push 0x402e90
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0x402eb8
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push ebp
push ebp
call fcn.00405ac2
mov eax, esp
mov dword [eax], ebp
mov dword [eax + 4], ebp
call fcn.00405c9a
fstp st(0)
push ebp
call fcn.00405e75
add esp, 0xc
push 4
call fcn.00406040
add esp, 4
cmp eax, ebp
je 0x4044ef
lea ecx, [esp + 0x28]
mov dword [eax], ecx
jmp 0x4044f1
xor eax, eax
mov dword [esp + 0x28], eax
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x1c80], 0xffffffff
call fcn.00404db0
mov edi, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov ebx, dword [sym.imp.USER32.dll_GetSysColorBrush]
xor esi, esi
cmp esi, 0x9458
jge 0x40453a
push ebp
lea eax, [esp + 0x1444]
push eax
call edi
push ebp
call ebx
inc esi
cmp esi, 0x14ee8
jl 0x404524
mov ecx, dword [0x431ae4]
mov edx, dword [0x431ab8]
mov dword [0x4417a4], ecx
mov dword [0x6c8d7c], edx
call fcn.00403c30
mov ecx, dword [esp + 0x1c74]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405030
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42dfdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x402ee4
call fcn.00405640
push 4
mov dword [esp + 0x18], 0
call fcn.00406040
mov edi, eax
add esp, 4
test edi, edi
je 0x4050a4
push ebx
call fcn.0040581e
mov dword [edi], eax
call fcn.004056e7
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00405525
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405098
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040554d
pop ebx
jmp 0x4050a6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40672b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430cf0]
jne 0x406735
repz ret
jmp fcn.0040b1ec
Function at 0x40e7f9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407765
and dword [ebp - 4], 0
cmp dword [0x4328c4], 0
mov ebx, eax
jne 0x40e8aa
push 0x402bd4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40e95b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402bc8
push edi
call esi
test eax, eax
je 0x40e95b
push eax
call fcn.004076f3
mov dword [esp], 0x402bb8
push edi
mov dword [0x4328c4], eax
call esi
push eax
call fcn.004076f3
mov dword [esp], 0x402ba4
push edi
mov dword [0x4328c8], eax
call esi
push eax
call fcn.004076f3
mov dword [esp], 0x402b88
push edi
mov dword [0x4328cc], eax
call esi
push eax
call fcn.004076f3
pop ecx
mov dword [0x4328d4], eax
test eax, eax
je 0x40e8aa
push 0x402b70
push edi
call esi
push eax
call fcn.004076f3
pop ecx
mov dword [0x4328d0], eax
mov eax, dword [0x4328d0]
cmp eax, ebx
je 0x40e902
cmp dword [0x4328d4], ebx
je 0x40e902
push eax
call fcn.0040776e
push dword [0x4328d4]
mov esi, eax
call fcn.0040776e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40e902
test edi, edi
je 0x40e902
call esi
test eax, eax
je 0x40e8f9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40e8f9
test byte [ebp - 0xc], 1
jne 0x40e902
or dword [ebp + 0x10], 0x200000
jmp 0x40e93b
mov eax, dword [0x4328c8]
cmp eax, ebx
je 0x40e93b
push eax
call fcn.0040776e
pop ecx
test eax, eax
je 0x40e93b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40e93b
mov eax, dword [0x4328cc]
cmp eax, ebx
je 0x40e93b
push eax
call fcn.0040776e
pop ecx
test eax, eax
je 0x40e93b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4328c4]
call fcn.0040776e
pop ecx
test eax, eax
je 0x40e95b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40e95d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40dd47
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x415a70]
je 0x40dd6d
inc esi
cmp esi, 0x17
mov dword [ebp - 4], esi
jb 0x40dd5b
cmp esi, 0x17
jae 0x40dec7
push 3
call fcn.00410caf
cmp eax, 1
pop ecx
je 0x40de91
push 3
call fcn.00410caf
test eax, eax
pop ecx
jne 0x40dda0
cmp dword [0x4160f0], 1
je 0x40de91
cmp edi, 0xfc
je 0x40dec7
push 0x401cec
mov edi, 0x314
push edi
mov esi, 0x416720
push esi
call fcn.0040e434
add esp, 0xc
test eax, eax
je 0x40ddd6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c0d5
add esp, 0x14
mov byte [0x41683d], bl
push 0x104
mov ebx, 0x416739
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40de19
push 0x401cd4
push 0x2fb
push ebx
call fcn.0040e434
add esp, 0xc
test eax, eax
je 0x40de19
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040c0d5
add esp, 0x14
push ebx
push edi
push esi
call fcn.0040f595
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x40de37
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c0d5
add esp, 0x14
push 0x401cd0
push edi
push esi
call fcn.0040f595
add esp, 0xc
test eax, eax
je 0x40de57
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c0d5
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x415a74]
push edi
push esi
call fcn.0040f595
add esp, 0xc
test eax, eax
je 0x40de7c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c0d5
add esp, 0x14
push 0x12010
push 0x401ca8
push esi
call fcn.00410b0a
add esp, 0xc
jmp 0x40dec7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x40dec7
cmp edi, 0xffffffff
je 0x40dec7
mov edx, dword [esi*8 + 0x415a74]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40deb0
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40e070
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x40e083
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40e07f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x40e0b0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x40e0ef
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x40e0e5
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x40e0f1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40e0d5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40fa14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040f645
push eax
push esi
push dword [ebp + 8]
call fcn.0040f5fa
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040f645
push eax
push esi
push dword [ebp + 8]
call fcn.0040f5fa
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040f635
pop edx
mov ebx, 0x9d886c3c
jl 0x40faba
invalid
invalid

Function at 0x4116c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x4116d6
jmp 0x4116db
jmp fcn.00410fd7
cmp dword [ebp - 0x37c], 0
jne 0x411785
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f811
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x411771
lea eax, [ebp - 0x714]
push eax
call fcn.0040f645
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.0040f6da
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret