joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51a3b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5823a1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x28], ebx
call fcn.00414a70
mov edi, 1
push edi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], edi
call fcn.004238d0
mov eax, dword [eax]
push 0x5a34f4
push eax
mov dword [esp + 0x2c], edi
call fcn.004aeff5
add esp, 8
cmp eax, ebx
mov eax, dword [esp + 0x18]
setne byte [esp + 0x13]
add eax, 0xfffffff0
mov byte [esp + 0x24], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x51a449
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x13], bl
je 0x51a45c
push edi
push 0x5a34f4
mov ecx, esi
call fcn.00417770
mov edi, dword [esp + 0x34]
cmp edi, ebx
jne 0x51a468
xor eax, eax
jmp 0x51a479
mov eax, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x51a470
sub eax, edx
push eax
push edi
mov ecx, esi
call fcn.00417770
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x51a7c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x582438
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0051a660
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0
call fcn.0051a6e0
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 8], eax
call dword [0x587340]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0xc], 0x5b08e8
call dword [0x58731c]
lea ecx, [esp + 8]
call fcn.004a6c38
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4
Function at 0x521100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x582e96
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], 0x5b0f84
lea edi, [esi + 8]
call fcn.0047cfdc
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x52114f
push 0x80004005
call fcn.00414da0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x1c], ebx
call fcn.0047cfdc
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x52117b
push 0x80004005
call fcn.00414da0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x40], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x24], ecx
push eax
mov ecx, edi
mov byte [esp + 0x20], 1
mov dword [esi + 0xc], edx
call fcn.00417aa0
mov cl, byte [esp + 0x30]
mov byte [esi + 5], bl
mov byte [esi + 4], cl
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], bl
mov byte [esi + 0x2d], bl
mov dword [esi + 0x10], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10

Function at 0x529720
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x5eabd8]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
push 2
lea eax, [esp + 0x10]
push 1
push eax
xor edi, edi
mov byte [esp + 0x18], 0
mov byte [esp + 0x19], 0
call fcn.004b3b30
add esp, 0x10
cmp eax, 2
jne 0x529837
mov al, byte [esp + 8]
cmp al, 0x42
jne 0x529791
cmp byte [esp + 9], 0x4d
jne 0x529837
cmp dword [esp + 0x20], 1
jne 0x529837
mov edi, 1
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.004adaab
add esp, 0x10
ret
cmp al, 0xff
jne 0x5297d0
cmp byte [esp + 9], 0xd8
jne 0x529837
cmp dword [esp + 0x20], 2
jne 0x529837
push esi
call fcn.0056ba33
add esp, 4
cmp al, 0xff
jne 0x529837
mov edi, 2
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.004adaab
add esp, 0x10
ret
cmp al, 0x89
jne 0x529837
cmp byte [esp + 9], 0x50
jne 0x529837
cmp dword [esp + 0x20], 3
jne 0x529837
push esi
push 6
xor eax, eax
lea ecx, [esp + 0x14]
push 1
push ecx
mov byte [esp + 0x1c], 0
mov dword [esp + 0x1d], eax
mov byte [esp + 0x21], al
call fcn.004b3b30
add esp, 0x10
cmp eax, 6
jne 0x529837
cmp byte [esp + 0xc], 0x4e
jne 0x529837
cmp byte [esp + 0xd], 0x47
jne 0x529837
cmp byte [esp + 0xe], 0xd
jne 0x529837
mov al, 0xa
cmp byte [esp + 0xf], al
jne 0x529837
cmp byte [esp + 0x10], 0x1a
jne 0x529837
cmp byte [esp + 0x11], al
jne 0x529837
mov edi, 4
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004adaab
add esp, 0x10
ret
Function at 0x531b90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584a53
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5eabd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0052fbd0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x5b63e8
push 0
push 0x5b6300
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.00496d11
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x18], 0
push 0x20000
call fcn.00473c84
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x1c], ecx
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x30], 0
mov ecx, dword [ebp - 0x14]
call fcn.00531d30
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x54cb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax]
shl ecx, 0x11
mov edx, dword [ebp + 0x10]
movzx eax, byte [edx + 1]
shl eax, 9
or ecx, eax
mov edx, dword [ebp + 0x10]
movzx eax, byte [edx + 2]
and eax, 0xfffffff8
shl eax, 1
or ecx, eax
or ecx, 8
mov edx, dword [ebp + 0x10]
movzx eax, byte [edx + 2]
and eax, 7
or ecx, eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
and ecx, 0xff
movzx edx, byte [ecx + 0x5f0440]
shl edx, 0x11
mov eax, dword [ebp - 0x10]
shr eax, 8
and eax, 0xff
movzx ecx, byte [eax + 0x5f0440]
shl ecx, 9
or edx, ecx
mov eax, dword [ebp - 0x10]
shr eax, 0x10
and eax, 0xff
movzx ecx, byte [eax + 0x5f0440]
shl ecx, 1
or edx, ecx
mov eax, dword [ebp - 0x10]
shr eax, 0x18
or edx, eax
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx + 4]
movzx eax, byte [edx + 0x5f0440]
shl eax, 9
or eax, 0x100
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx + 3]
movzx ecx, byte [edx + 0x5f0440]
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x10]
shr eax, 0xc
mov ecx, dword [ebp - 0x10]
shr ecx, 4
xor eax, ecx
mov edx, dword [ebp - 0x10]
shr edx, 3
xor eax, edx
xor eax, dword [ebp - 0x10]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
shr eax, 0xe
and eax, 7
xor eax, dword [ebp - 0xc]
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
shl ecx, 3
movzx edx, byte [ebp - 2]
shl edx, 6
xor ecx, edx
movzx eax, byte [ebp - 2]
xor eax, ecx
mov byte [ebp - 2], al
mov ecx, dword [ebp - 0xc]
shr ecx, 8
movzx edx, byte [ebp - 2]
shl edx, 9
xor ecx, edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x10]
shr eax, 8
movzx ecx, byte [ebp - 1]
shl ecx, 0x11
xor eax, ecx
mov dword [ebp - 0x10], eax
movzx edx, byte [ebp - 1]
not edx
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 2]
not eax
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp - 2]
add edx, dword [ebp - 8]
add edx, ecx
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
sub eax, 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
mov byte [edx], cl
mov eax, dword [ebp - 8]
sar eax, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0xc], 0
jg 0x54cc0f
mov esp, ebp
pop ebp
ret
Function at 0x559a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 0x1c]
push ebx
push ebp
mov ebp, dword [ecx + 4]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, 0x80
mov dword [esi + 4], edi
mov dword [esi + 8], 0x40
mov ecx, dword [eax + 0xb74]
mov dword [esi + 0xc], ecx
mov dword [esi], ebp
mov dword [esi + 0xa4], edi
mov eax, dword [eax + 4]
cdq
sub eax, edx
mov ebx, 4
sar eax, 1
push ebx
push edi
mov dword [esi + 0xb0], eax
call fcn.004af899
lea edx, [esi + 0x10]
push edi
push edx
mov dword [esi + 0x24], eax
call fcn.00558c00
add esp, 0x10
xor eax, eax
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
mov ecx, dword [esi + 0x24]
fmul qword [0x5b9d80]
fsin
fstp dword [ecx + eax*4]
mov edx, dword [esi + 0x24]
fld dword [edx + eax*4]
lea ecx, [edx + eax*4]
fld st(0)
fmul st(1)
inc eax
cmp eax, edi
mov dword [esp + 0x1c], eax
fstp dword [ecx]
fstp st(0)
jl 0x559ac3
mov eax, 6
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov eax, 8
mov dword [esi + 0x28], 2
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], 5
mov dword [esi + 0x58], 9
mov dword [esi + 0x5c], eax
mov dword [esi + 0x68], 0xd
mov dword [esi + 0x6c], eax
mov dword [esi + 0x78], 0x11
mov dword [esi + 0x7c], eax
mov dword [esi + 0x88], 0x16
mov dword [esi + 0x8c], eax
lea edi, [esi + 0x34]
mov dword [esp + 0x18], 7
lea esp, [esp]
mov ebx, dword [edi - 8]
lea eax, [ebx*4]
push eax
mov dword [esp + 0x14], ebx
call fcn.004b0c90
xor ecx, ecx
add esp, 4
test ebx, ebx
mov dword [edi - 4], eax
mov dword [esp + 0x1c], ecx
jle 0x559ba6
fild dword [esp + 0x10]
fild dword [esp + 0x1c]
inc ecx
cmp ecx, ebx
mov dword [esp + 0x1c], ecx
fadd qword [0x5c2580]
fdiv st(1)
fmul qword [0x5b9d78]
fsin
fstp dword [eax + ecx*4 - 4]
mov eax, dword [edi - 4]
fld dword [eax + ecx*4 - 4]
fadd dword [edi]
fstp dword [edi]
jl 0x559b78
fstp st(0)
fld dword [edi]
mov eax, dword [esp + 0x18]
fdivr qword [0x5c2578]
add edi, 0x10
dec eax
mov dword [esp + 0x18], eax
fstp dword [edi - 0x10]
jne 0x559b50
imul ebp, ebp, 7
push 0x90
push ebp
call fcn.004af899
mov ecx, dword [esi + 0xa4]
push 4
push ecx
mov dword [esi + 0x98], eax
call fcn.004af899
add esp, 0x10
pop edi
mov dword [esi + 0xa0], eax
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x560af0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x560b91
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
cmp esi, edx
push edi
jle 0x560b3f
mov edi, dword [ecx]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
mov ebp, dword [ebx*4 + 0x5b9dc8]
shl eax, 8
xor eax, ebp
inc edx
cmp edx, esi
jl 0x560b21
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x560b6c
mov edi, dword [ecx + 8]
lea esp, [esp]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
mov ebp, dword [ebx*4 + 0x5b9dc8]
shl eax, 8
xor eax, ebp
inc edx
cmp edx, esi
jl 0x560b50
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
pop edi
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop esi
shr eax, 0x18
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret

Function at 0x562b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 8
mov ecx, dword [esp + 0x30]
mov eax, 1
shl eax, cl
mov dword [esp], eax
mov eax, dword [esp + 0x24]
shr eax, cl
mov dword [esp + 4], eax
mov edi, dword [esp + 4]
sub edi, dword [esp + 0x28]
xor esi, esi
xor ecx, ecx
mov ebp, dword [esp + 0x1c]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + esi*4]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
add esi, 1
cmp esi, edi
jb 0x562b50
add edi, dword [esp + 4]
mov eax, dword [esp + 0x20]
mov dword [eax + ecx*8], ebx
mov dword [eax + ecx*8 + 4], 0
xor ebx, ebx
add ecx, 1
cmp ecx, dword [esp]
jb 0x562b50
mov esi, dword [esp + 0x20]
mov eax, dword [esp]
lea edi, [esi + eax*8]
mov ecx, dword [esp + 0x30]
sub ecx, 1
cmp ecx, dword [esp + 0x2c]
jl 0x562bc3
mov edx, 1
shl edx, cl
nop
nop
nop
mov eax, dword [esi]
mov ebx, dword [esi + 4]
add eax, dword [esi + 8]
adc ebx, dword [esi + 0xc]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 0x10
add edi, 8
sub edx, 1
jne 0x562ba0
sub ecx, 1
jmp 0x562b90
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40275c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403a08
test esi, esi
jne 0x402792
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403af8
jmp 0x4027b0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402610
mov edi, eax
test esi, esi
je 0x4027b0
cmp dword [ebx], 0
je 0x4027b0
dec esi
jmp 0x402799
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402f9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40c00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403034
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403014
xor eax, eax
push ebp
push 0x40300d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403050
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403014
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40c00c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40c00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x40388c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40d03c], 0
je 0x4038ed
cmp word [0x40d210], 0xd7b2
jne 0x4038b5
cmp dword [0x40d218], 0
jbe 0x4038b5
mov eax, 0x40d20c
call dword [0x40d228]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40c050
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403914
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40c018], 0
jne 0x403909
push 0
push 0x40c070
push 0x40c050
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404bd4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x404bf0
mov eax, ebx
call fcn.00403d44
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x40656c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 8], 1
jne 0x40658a
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
je 0x40658a
mov dword [ebx + 8], 2
cmp dword [ebx + 8], 2
sete al
pop ebx
ret
Function at 0x40661c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
sub eax, 1
jb 0x40663d
je 0x406710
jmp 0x40671f
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004064e0
test al, al
je 0x40671f
xor eax, eax
push ebp
push 0x406709
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 4]
test al, al
je 0x4066f3
mov eax, dword [ebp - 4]
mov dword [eax + 8], 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
xor edx, edx
call fcn.00405cb8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
xor edx, edx
call fcn.00405cb8
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push 0x406594
push 0
push 0
call sub.kernel32.dll_CreateThread
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
test esi, esi
je 0x4066f3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
push esi
call sub.kernel32.dll_SetThreadPriority
test eax, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.00405cd0
test al, al
jne 0x4066f3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40671f
mov eax, dword [ebp - 4]
call fcn.00406560
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 4]
call fcn.0040656c
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 2
sete al
mov edx, dword [ebp - 4]
cmp byte [edx + 0x1b], 0
je 0x406739
mov edx, dword [ebp - 4]
mov byte [edx + 0x1a], 1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x406a24
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x406a2d
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406b63
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403b5c
mov esi, eax
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00403e88
test esi, esi
jle 0x406a89
lea eax, [ebp - 0xc]
call fcn.00403d9c
push eax
mov eax, edi
call fcn.00403d44
mov ecx, esi
pop edx
call fcn.004025d0
cmp dword [ebp - 0xc], 0
jne 0x406a96
mov esi, 0x406b74
jmp 0x406aa0
mov eax, dword [ebp - 0xc]
call fcn.00403d44
mov esi, eax
mov eax, dword [ebx + 4]
call fcn.00403d44
push eax
push 0xffff
lea eax, [ebp - 0x1000b]
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.00403d44
push eax
mov eax, dword [ebx + 8]
call fcn.00403d44
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov esi, eax
cmp dword [ebp - 0xc], 0
jne 0x406b3d
cmp esi, 1
jne 0x406b3d
cmp byte [ebp - 0x1000b], 0x30
jne 0x406b3d
mov esi, 0x406b78
mov eax, dword [ebx + 4]
call fcn.00403d44
push eax
push 3
lea eax, [ebp - 7]
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.00403d44
push eax
mov eax, dword [ebx + 8]
call fcn.00403d44
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov esi, eax
cmp esi, 1
jne 0x406b28
cmp byte [ebp - 7], 0x32
jne 0x406b28
mov eax, dword [ebp + 8]
mov edx, edi
call fcn.00403a5c
jmp 0x406b4d
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x1000b]
mov ecx, 0xffff
call fcn.00403b44
jmp 0x406b4d
lea edx, [ebp - 0x1000b]
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.00403af8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b6a
lea eax, [ebp - 0xc]
call fcn.00403a08
ret
Function at 0x406d7c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00404bd4
test al, al
je 0x406e93
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, ebx
call fcn.00403d44
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x406e93
push 2
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov ebx, eax
push 0
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp ebx, edi
jbe 0x406df2
sub ebx, edi
jmp 0x406df4
xor ebx, ebx
test ebx, ebx
jbe 0x406e8a
mov eax, 0x186a0
call fcn.004024cc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x406e83
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, dword [ebp - 4]
jbe 0x406e6d
mov eax, ebx
sub eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x186a0
jbe 0x406e34
mov dword [ebp - 0x10], 0x186a0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x406e6d
cmp dword [ebp - 0x10], 0
jbe 0x406e6d
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebp - 0x10]
add dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
ja 0x406e1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e8a
mov eax, dword [ebp - 0xc]
call fcn.004024ec
ret
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407638
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x40764d
add esp, 0xfffffff0
call fcn.00403210
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004063d0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
mov dword [ebx + 0x48], eax
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle_1
mov dword [ebx + 0x44], eax
lea eax, [ebx + 0x2d]
push eax
mov eax, dword [ebx + 0x48]
push eax
call sub.kernel32.dll_GetConsoleScreenBufferInfo
mov eax, dword [ebp - 8]
call fcn.00403d44
push eax
call sub.kernel32.dll_SetConsoleTitleA
test esi, esi
je 0x4076ac
push esi
push 1
push 0x80
push 0
call sub.user32.dll_SendMessageA
test edi, edi
je 0x4076ba
push edi
mov eax, dword [ebx + 0x48]
push eax
call sub.kernel32.dll_SetConsoleTextAttribute
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
mov byte [ebx + 0x2c], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4076db
call fcn.00403268
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x40a24c
Capabilities:
Create process on windows

Disassembly:
and edx, 0xffff
sub edx, 0xa
jne 0x40a26e
push 1
push 0
push 0
push 0x40a274
push 0x40a290
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219