joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180c62b3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jg 0x180c616f
movzx ecx, byte [0x181c21ae]
neg ecx
sbb ecx, ecx
and ecx, 0x181c1480
je 0x180c614a
push 7
pop edx
xor eax, eax
mov dword [ebp - 0x10], ecx
inc eax
mov dword [ebp - 0xc], edx
push eax
push edx
mov dword [ebp - 8], eax
call fcn.1809dcc2
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push str._Google_Update_core_is_shutting_down..._
push eax
call fcn.1809dcc2
pop ecx
pop ecx
push 0
push 0
push 0x12
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x180c616f
push 0x80004004
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
xor eax, eax
pop esi
leave
ret
push esi
mov esi, ecx
call fcn.1809dcc2
mov ecx, esi
pop esi
test al, al
je 0x180c60f9
jmp fcn.180c62cb
Function at 0x180c7f14
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x181ba008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc8], ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0xd4], ecx
mov ecx, dword [ebx + 0x10]
push esi
mov dword [ebp - 0xd8], ecx
xor ecx, ecx
push edi
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x34], cl
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], ecx
lea ecx, [ebp - 0xfc]
push eax
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0x20], 0xf
call fcn.1809dcc2
push 0xc
call fcn.1809dcc2
mov esi, eax
lea edi, [ebp - 0xfc]
pop ecx
mov dword [ebp - 0xe4], esi
lea ecx, [esi + 0xc]
mov dword [ebp - 0xdc], ecx
push edi
mov ecx, esi
call fcn.1809dcc2
add edi, 0xc
lea eax, [ebp - 0xf0]
add esi, 0xc
cmp edi, eax
jne 0x180c7fae
mov edi, dword [ebp - 0xc8]
lea eax, [ebp - 0xbc]
push 3
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xc0], eax
push dword [edi]
call fcn.1809dcc2
mov ecx, dword [ebp - 0xc0]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], al
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x180c8005
sub ecx, edx
push ecx
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x1c]
call fcn.1809dcc2
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 0x34]
push ecx
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1809dcc2
add esp, 0x10
lea ecx, [ebp - 0x1c]
test eax, eax
setne byte [ebp - 0xc1]
call fcn.1800dfeb
lea eax, [ebp - 0xbc]
cmp dword [ebp - 0xc0], eax
je 0x180c806c
push dword [ebp - 0xc0]
call fcn.18143ba6
pop ecx
lea ecx, [ebp - 0xe4]
call fcn.1809dcc2
lea ecx, [ebp - 0xfc]
call fcn.1800b04e
lea ecx, [ebp - 0xf0]
call fcn.1800b04e
cmp byte [ebp - 0xc1], 0
je 0x180c80a2
mov dword [ebp - 0xcc], 0x80092009
jmp 0x180c811b
mov esi, dword [ebp - 0xd4]
mov ecx, edi
mov edx, esi
call fcn.1809dcc2
test al, al
jne 0x180c80c1
mov dword [ebp - 0xcc], 0x8000ffff
jmp 0x180c811b
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.18006ae9
add eax, 0x10
lea ecx, [ebp - 0xc8]
push str.GoogleUpdateSetup.exe
mov dword [ebp - 0xc8], eax
call fcn.1809dcc2
mov esi, dword [ebp - 0xc8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180c8101
mov dword [ebp - 0xcc], 0x80070002
jmp 0x180c8113
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xc8]
push eax
call fcn.1809dcc2
lea ecx, [esi - 0x10]
call fcn.180042a6
lea ecx, [ebp - 0x34]
call fcn.1800dfeb
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xcc]
xor ecx, ebp
pop edi
pop esi
call fcn.1813d268
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x2a33eb69
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x2a33eb78
pop dword [ebp - 0x20]
mov eax, 0x2a3b796e
sub eax, 0x78df6
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x13ebd415
sub dword [ebp - 0x30], 0xc5998eca
mov dword [ebp - 0x2c], 0x2bafef46
sub dword [ebp - 0x2c], 0xf97ca301
mov dword [ebp - 0x28], 0x9584c0ae
add dword [ebp - 0x28], 0xb6c78380
mov dword [ebp - 0x24], 0x38009f6a
add dword [ebp - 0x24], 0xc7ff6096
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xf62be7e7
sub dword [ebp - 0x30], 0x81b97e91
mov dword [ebp - 0x2c], 0x17b871a0
add dword [ebp - 0x2c], 0x29b3efd5
mov dword [ebp - 0x28], 0xf84e27f3
sub dword [ebp - 0x28], 0x94debb87
mov dword [ebp - 0x24], 0x1034616d
sub dword [ebp - 0x24], 0x1034616d
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x4bdd4
push 0
call eax
mov ecx, 0x4d93
xor edx, edx
add edx, eax
mov ebx, 0xc372bdd7
sub ebx, 0x993aa7d7
add ebx, dword [ebp - 0x20]
mov edi, 0xd7fcfad5
add edi, 0xa1ba0d06
mov dword [ebp - 0x14], 0x78af459a
mov esi, dword [ebx]
xor dword [ebp - 0x18], 0xdde7dbc
xor esi, edi
sub dword [ebp - 0x18], 0x684682f9
mov dword [edx], esi
sub dword [ebp - 0x10], ebx
add edx, 0x8a49cc52
sub edx, 0x8a49cc4e
add ebx, 4
loop 0x2a33ec8c
add eax, 0x2b682c7c
add eax, 0xd498fca3
xor ebx, ebx
add ebx, eax
add eax, 0x57a3074
add eax, 0xfa85cf91
mov ecx, 0xf6cc6946
add ecx, 0x336396ba
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10007ad6
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x10016114]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebx
push dword [edi]
call fcn.1000bb8b
mov esi, eax
test esi, esi
jne 0x10007b85
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x10007b60
lea eax, [esp + 0x28]
push eax
call fcn.10007ad6
mov esi, eax
test esi, esi
jne 0x10007b85
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x30], 0x100
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x10007b3b
call fcn.100044c8
push ebx
mov ecx, edi
call fcn.10005152
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.100044c8
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000b5fc
add esp, 0x11c
ret 4
Function at 0x10008ec6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x401440
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push edi
push esi
push eax
mov edi, dword [esp + 0x14]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40
push 0x3000
push edi
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x401498
mov esi, eax
mov eax, dword [esp + 0x10]
mov dword [esp], 0
mov ecx, esp
push ecx
push edi
push eax
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401498
mov eax, dword [esp + 0x18]
mov dword [eax], 0
call esi
add esp, 4
pop esi
pop edi
ret
xor eax, eax
add esp, 4
pop esi
pop edi
ret

Function at 0x4014a0
Capabilities:
Check for outputdebugstring error
Print debug messages

Disassembly:
push esi
push eax
push 0x457
call dword [sym.imp.KERNEL32.dll_SetLastError]
push section..rdata
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x457
jne 0x40151d
call fcn.00423120
cmp byte [eax + 2], 0
jne 0x40151d
test byte [eax + 0x68], 0x70
jne 0x40151d
call fcn.00423610
mov dword [esp], 0xffffffff
mov eax, dword [0x4262e8]
mov ecx, dword [0x4262ec]
mov edx, esp
mov esi, dword [0x4262e4]
push dword [ecx]
push 1
push edx
push dword [eax]
push esi
call fcn.00401440
add esp, 0x14
test eax, eax
sete al
cmp dword [esp], 0xffffffff
sete cl
or cl, al
movzx eax, cl
neg eax
add esp, 4
pop esi
ret
push 0
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x420d18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1dc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1f0]
push edi
mov ebp, dword [esi + 0x3c]
mov eax, dword [esi + ebp + 0x78]
test eax, eax
je 0x420e1d
lea edi, [eax + esi]
mov ebx, dword [edi + 0x18]
test ebx, ebx
je 0x420e1d
mov eax, dword [edi + 0x1c]
xor edx, edx
add eax, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x20]
add eax, esi
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x24]
add eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0xc]
add eax, esi
mov cl, byte [eax]
test cl, cl
je 0x420d9c
mov esi, dword [esp + 0x10]
lea edx, [esp + 0xe8]
sub edx, eax
or cl, 0x20
inc esi
mov byte [edx + eax], cl
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x420d7f
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1f4]
mov edx, dword [esp + 0x10]
push dword [esp + 0x204]
lea eax, [esp + 0xec]
mov byte [esp + edx + 0xec], 0
push dword [esp + 0x204]
push eax
call fcn.00422c56
mov dword [esp + 0x24], eax
add esp, 0xc
mov eax, dword [esp + 0x14]
add eax, 0xfffffffc
mov dword [esp + 0x1c], edx
lea eax, [eax + ebx*4]
mov dword [esp + 0x10], eax
push dword [esp + 0x204]
mov ecx, dword [eax]
push dword [esp + 0x204]
add ecx, esi
push ecx
call fcn.00422c56
xor eax, dword [esp + 0x24]
add esp, 0xc
xor edx, dword [esp + 0x1c]
cmp eax, dword [esp + 0x1f8]
jne 0x420e0d
cmp edx, dword [esp + 0x1fc]
je 0x420e2a
mov eax, dword [esp + 0x10]
sub eax, 4
mov dword [esp + 0x10], eax
sub ebx, 1
jne 0x420dd8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1dc
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
movzx eax, word [eax + ebx*2 - 2]
mov edx, dword [ecx + eax*4]
add edx, esi
cmp edx, edi
jb 0x420eb6
mov eax, dword [esi + ebp + 0x7c]
add eax, edi
cmp edx, eax
jae 0x420eb6
xor ecx, ecx
cmp byte [edx], cl
je 0x420e6d
lea ebx, [esp + 0x28]
mov edi, edx
sub ebx, edx
cmp ecx, 0x3c
jae 0x420e6d
mov al, byte [edi]
mov byte [ebx + edi], al
cmp al, 0x2e
je 0x420e6d
inc ecx
inc edi
cmp byte [edi], 0
jne 0x420e58
inc edx
mov dword [esp + ecx + 0x29], 0x6c6c64
add ecx, edx
xor edx, edx
cmp byte [ecx], dl
je 0x420e95
lea edi, [esp + 0x68]
sub edi, ecx
cmp edx, 0x7f
jae 0x420e95
mov al, byte [ecx]
inc edx
mov byte [edi + ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x420e84
lea eax, [esp + 0x68]
mov byte [esp + edx + 0x68], 0
push eax
lea eax, [esp + 0x2c]
push eax
push esi
push dword [esp + 0x1fc]
call fcn.00420ebd
add esp, 0x10
mov edx, eax
mov eax, edx
jmp 0x420e1f
Function at 0x420ebd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov edi, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
cmp dword [esi + 0x18], ecx
je 0x420f06
mov ebx, dword [ebp + 0xc]
test ecx, ecx
jne 0x420f22
cmp dword [esi + 0x18], ebx
je 0x420efa
push ecx
push dword [ebp + 0x14]
push dword [esi + 0x18]
push edi
call fcn.00422ab8
add esp, 0x10
mov ecx, eax
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
jne 0x420edf
test ecx, ecx
jne 0x420f22
push dword [ebp + 0x10]
push edi
call fcn.00422a1a
pop ecx
pop ecx
test eax, eax
je 0x420f20
push dword [ebp + 0x14]
push eax
call dword [edi + 0x34]
mov ecx, eax
jmp 0x420f22
xor ecx, ecx
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x422a1a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x40
xor ecx, ecx
push ebx
push esi
or ebx, 0xffffffff
push edi
cmp byte [edx], cl
je 0x422a45
lea esi, [ebp - 0x40]
sub esi, edx
cmp ecx, 0x40
jae 0x422a45
mov al, byte [edx]
inc ecx
mov byte [esi + edx], al
inc edx
cmp byte [edx], 0
jne 0x422a34
cmp byte [ebp + ecx - 0x44], 0x2e
mov byte [ebp + ecx - 0x40], 0
je 0x422a5e
mov dword [ebp + ecx - 0x40], 0x6c6c642e
mov byte [ebp + ecx - 0x3c], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x18]
test esi, esi
je 0x422aa5
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
xor eax, eax
test ecx, ecx
je 0x422a9b
mov eax, dword [ecx + esi + 0xc]
add eax, esi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004230e8
mov ebx, eax
xor eax, eax
pop ecx
pop ecx
test ebx, ebx
je 0x422ab4
mov edi, dword [edi]
test ebx, ebx
jne 0x422a6d
test eax, eax
jne 0x422aaf
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x30]
pop edi
pop esi
pop ebx
leave
ret
mov eax, esi
jmp 0x422aaf
Function at 0x422ab8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xa8]
xor esi, esi
test edi, edi
je 0x422c06
mov ecx, dword [edi + 0x3c]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + edi + 0x78]
test eax, eax
je 0x422c06
lea ebx, [eax + edi]
mov eax, dword [ebx + 0x20]
mov edx, dword [ebx + 0x1c]
add eax, edi
mov dword [esp + 0x10], eax
add edx, edi
mov eax, dword [ebx + 0x24]
add eax, edi
mov dword [esp + 0x1c], edx
cmp dword [esp + 0xac], esi
je 0x422bf2
mov ebp, dword [ebx + 0x18]
test ebp, ebp
je 0x422c06
lea eax, [eax + ebp*2]
add eax, 0xfffffffe
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea eax, [eax + ebp*4]
add eax, 0xfffffffc
mov dword [esp + 0x10], eax
mov eax, dword [eax]
push dword [esp + 0xac]
add eax, edi
push eax
call fcn.004230c1
pop ecx
pop ecx
test eax, eax
jne 0x422b57
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
movzx eax, word [eax]
mov esi, dword [ecx + eax*4]
add esi, edi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], 2
sub eax, 4
mov dword [esp + 0x10], eax
sub ebp, 1
je 0x422b70
test esi, esi
je 0x422b30
mov ecx, dword [esp + 0x18]
cmp esi, ebx
jb 0x422bee
mov eax, dword [ecx + edi + 0x7c]
add eax, ebx
cmp esi, eax
jae 0x422bee
xor ecx, ecx
cmp byte [esi], cl
je 0x422ba5
lea ebx, [esp + 0x20]
mov edx, esi
sub ebx, esi
cmp ecx, 0x3c
jae 0x422ba5
mov al, byte [edx]
mov byte [ebx + edx], al
cmp al, 0x2e
je 0x422ba5
inc ecx
inc edx
cmp byte [edx], 0
jne 0x422b90
mov dword [esp + ecx + 0x21], 0x6c6c64
xor edx, edx
inc ecx
add ecx, esi
cmp byte [ecx], dl
je 0x422bcd
lea esi, [esp + 0x60]
sub esi, ecx
cmp edx, 0x3f
jae 0x422bcd
mov al, byte [ecx]
inc edx
mov byte [esi + ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x422bbc
lea eax, [esp + 0x60]
mov byte [esp + edx + 0x60], 0
push eax
lea eax, [esp + 0x24]
push eax
push edi
push dword [esp + 0xb0]
call fcn.00420ebd
add esp, 0x10
mov esi, eax
mov eax, esi
jmp 0x422c08
mov eax, dword [esp + 0xb0]
sub eax, dword [ebx + 0x10]
mov esi, dword [edx + eax*4]
add esi, edi
jmp 0x422b74
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret

Function at 0x422c13
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
xor ecx, ecx
push esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
jmp 0x422c4a
test ecx, ecx
jne 0x422c51
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00420d18
mov esi, dword [esi]
add esp, 0x18
mov ecx, eax
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x422c2a
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x422d1d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
lea edi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x28], ecx
mov ecx, esi
ror eax, 8
mov esi, dword [esp + 0x28]
add eax, edx
ror esi, 8
xor eax, edi
add esi, edi
rol edx, 3
xor esi, ebx
rol edi, 3
xor edx, eax
mov dword [esp + 0x28], ebp
xor edi, esi
mov ebp, ecx
inc ebx
cmp ebx, 0x1b
jb 0x422d4e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x423130
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
ret
Function at 0x423a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp + 0x3c]
mov dword [esp], eax
mov esi, dword [ebp + eax + 0x54]
push esi
push ebx
push ebp
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x423ac3
lea edi, [esp + 0xc]
push edi
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x423ac3
push esi
push ebp
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
push dword [esp + 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp]
movzx eax, word [ebp + eax + 6]
test ax, ax
je 0x423b61
mov edx, ebp
mov ecx, dword [ebp + 0x3c]
add ebp, ecx
add ebp, 0x100
xor esi, esi
jmp 0x423b07
mov edx, dword [esp + 0x24]
mov eax, dword [esp]
movzx eax, word [edx + eax + 6]
inc esi
movzx ecx, ax
add ebp, 0x28
cmp esi, ecx
jae 0x423b61
cmp dword [ebp + 0x1c], 0
js 0x423afc
mov edi, dword [ebp]
mov ebx, dword [ebp + 4]
lea eax, [edx + ebx]
add ebx, dword [esp + 0x28]
push edi
push ebx
mov dword [esp + 0x10], eax
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x423af0
lea eax, [esp + 4]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x423af0
push edi
push dword [esp + 0xc]
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x423af0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x423bd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x24]
xor eax, eax
test edi, edi
je 0x423d6a
mov esi, dword [esp + 0x28]
mov edx, dword [edi + 0x3c]
mov ecx, dword [edx + edi + 0x78]
mov ebx, dword [ecx + edi + 0x1c]
add ebx, edi
cmp esi, 0xffff
ja 0x423c0f
movzx eax, si
sub eax, dword [edi + ecx + 0x10]
add edi, dword [ebx + eax*4]
mov eax, edi
jmp 0x423d6a
mov esi, dword [edi + ecx + 0x18]
test esi, esi
je 0x423d6a
mov dword [esp + 4], ebx
mov dword [esp], edx
mov ebx, dword [edi + ecx + 0x20]
add ebx, edi
mov dword [esp + 8], ecx
mov ebp, dword [edi + ecx + 0x24]
add ebp, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebx]
add eax, edi
push dword [esp + 0x28]
push eax
call sub.msvcrt.dll_strcmp
add esp, 8
test eax, eax
je 0x423c65
add ebx, 4
add ebp, 2
dec esi
jne 0x423c40
xor eax, eax
jmp 0x423d6a
movzx eax, word [ebp]
mov ecx, dword [esp + 4]
mov esi, dword [ecx + eax*4]
mov eax, dword [esp + 8]
cmp eax, esi
ja 0x423d66
mov ecx, dword [esp]
add eax, dword [edi + ecx + 0x7c]
cmp esi, eax
jae 0x423d66
add esi, edi
push 0x2e
push esi
call sub.msvcrt.dll_strchr
add esp, 8
mov edi, eax
inc edi
mov ebp, edi
sub ebp, esi
lea eax, [ebp + 4]
push 2
push eax
call sub.msvcrt.dll_calloc
add esp, 8
test eax, eax
je 0x423c5e
mov ebx, eax
lea eax, [ebp + 1]
push ebp
push esi
push eax
push ebx
push 0
call dword [sym.imp.msvcrt.dll_mbstowcs_s]
add esp, 0x14
mov dword [ebx + ebp*2], 0x6c0064
mov word [ebx + ebp*2 + 4], 0x6c
push 4
push 0x42602c
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x423cfd
push 4
push str.ext_
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x423d48
lea eax, [esp + 0xc]
push eax
push ebx
push dword [esp + 0x34]
call fcn.00423140
add esp, 0xc
test eax, eax
je 0x423d48
mov ebp, eax
push ebx
call sub.msvcrt.dll_free
add esp, 4
mov esi, dword [esp + 0xc]
lea eax, [esi + 1]
push 2
push eax
call sub.msvcrt.dll_calloc
add esp, 8
mov ebx, eax
test eax, eax
mov eax, 0
je 0x423d6a
add esi, esi
push esi
push ebp
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push edi
push eax
call fcn.00423bd0
mov esi, eax
push ebx
call sub.msvcrt.dll_free
mov eax, esi
add esp, 4
jmp 0x423d6a
add esi, edi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x424040
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00424de0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00424de0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]