joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ce78
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404830
xor eax, eax
push ebp
push 0x43cfd1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x94], 0
je 0x43cfbb
test ebx, ebx
je 0x43cfbb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00409070
xor eax, eax
push ebp
push 0x43cfa6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 8]
call fcn.00409508
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0040b158
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0040b0c0
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x64]
jle 0x43cf9c
call fcn.0040b158
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 8]
call fcn.00409304
mov eax, dword [ebp - 4]
add eax, 0x38
push eax
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x43cf86
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040b158
mov eax, dword [ebp - 4]
fstp qword [eax + 0x78]
wait
mov ecx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc4]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc4]
mov edx, dword [eax]
call dword [edx + 8]
cmp eax, 0x64
jle 0x43cf7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43cf90
mov eax, dword [ebp - 4]
add eax, 0x38
push eax
call sub.kernel32.dll_LeaveCriticalSection_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43cfb0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.0040907c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43cfd8
lea eax, [ebp - 8]
call fcn.00404394
ret
Function at 0x401840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401898
cmp byte [esi + ebx - 1], 0xa
je 0x40186c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x407084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x401df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x407094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x401fb0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x407094]
movzx eax, al
bt eax, esi
jae 0x402010
mov ecx, dword [0x407084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x401eb5
test byte [0x403018], 8
jne 0x401f50
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x403028], 8
jne 0x401f00
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401e84
cmp esi, 3
jbe 0x401ec0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x405164]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401e84
mov ecx, dword [0x407094]
test ecx, ecx
je 0x401ff0
mov dword [esp], 0x403028
call dword [0x407094]
test al, 8
je 0x401e5b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401e5b
mov ebx, dword [0x407094]
test ebx, ebx
je 0x401fd0
mov dword [esp], 0x403018
call dword [0x407094]
test al, 8
je 0x401e46
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401e4e
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x407094
call sym._load_func.part.0
jmp 0x401e0d
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x407094
call sym._load_func.part.0
jmp 0x401f5a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x407094
call sym._load_func.part.0
jmp 0x401f0e
mov eax, 0xffffffff
jmp 0x401eb5
Function at 0x402170
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x4010c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
fldz
xor eax, eax
mov word [esp], ax
fstp dword [esp]
mov dword [esp], eax
mov cx, word [0x4235a0]
movsx edx, cx
mov dword [esp], edx
xor ecx, ecx
mov edx, 1
fild dword [esp]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0x44
fadd qword [0x4240e0]
mov word [esp + 0x46], cx
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x60]
fstp qword [0x4240e0]
mov word [esp + 0x48], dx
lea edx, [esp + 0x18]
push edx
push eax
push eax
push 8
push eax
push eax
push eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x80]
push eax
push ecx
mov dword [esp + 0x68], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x58
ret
Function at 0x4016c0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x14c
mov eax, dword [0x425fa0]
xor eax, esp
mov dword [esp + 0x148], eax
fldz
push esi
fstp dword [esp + 4]
xor eax, eax
fldz
mov word [esp + 8], ax
push edi
fst qword [esp + 0x18]
fstp qword [esp + 0x20]
push 0x104
mov dword [esp + 0x14], eax
call fcn.0040b471
fld dword [esp + 0xc]
fsubr qword [0x41f3b8]
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
fcomp qword [0x41f3b0]
fnstsw ax
test ah, 0x41
jp 0x401745
fld dword [esp + 8]
fld dword [esp + 8]
fsub qword [0x41f3a8]
fsub qword [0x41f3a0]
fsubp st(1)
fstp dword [esp + 8]
fld dword [esp + 8]
fsub qword [0x41f340]
fstp dword [esp + 8]
jmp 0x401771
fld qword [0x4240e8]
fadd qword [0x41f340]
fstp qword [0x4240e8]
fld qword [0x4240e8]
fsub qword [0x41f398]
fsub qword [0x41f390]
fadd qword [esp + 0x18]
fstp qword [esp + 0x18]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [esp + 8], edi
test edi, edi
je 0x401904
lea ecx, [esp + 0x28]
push ecx
push edi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
fld dword [0x423024]
fsub qword [0x41f388]
fstp dword [0x423024]
test eax, eax
je 0x4018fd
mov edi, esi
lea edx, [esp + 0x4c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
sub edi, edx
lea eax, [esp + 0x50]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x4017c8
push esi
call fcn.0041e553
mov ecx, dword [esp + 0x160]
add esp, 4
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401804
test dl, dl
je 0x401800
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401804
add eax, 2
add ecx, 2
test dl, dl
jne 0x4017e4
xor eax, eax
jmp 0x401809
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4018d3
cmp dword [esp + 0x160], 0
mov eax, 0x21b9
mov word [esp + 0x10], ax
je 0x4018f4
mov ecx, dword [0x423a6c]
add ecx, 0x15843f5c
mov dword [esp + 0x24], ecx
fild dword [esp + 0x24]
fadd qword [esp + 0x1c]
fstp qword [esp + 0x1c]
dec dword [0x423a6c]
mov edx, dword [esp + 0x34]
push edx
push 0
push 1
call ebp
mov esi, eax
test esi, esi
je 0x4018cf
fld dword [0x423024]
inc dword [esp + 0x14]
fsubr qword [0x41f380]
push 0xffffffffffffffff
push esi
fstp qword [esp + 0x2c]
fld dword [0x423024]
fsub qword [0x41f340]
fstp dword [0x423024]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ax, word [esp + 0x10]
movsx ecx, ax
neg ecx
add ecx, 0x179f10aa
mov dword [esp + 0x24], ecx
fild dword [esp + 0x24]
fsub qword [0x4241d8]
fld qword [esp + 0x1c]
fsub qword [0x41f378]
fucompp
fnstsw ax
test ah, 0x44
jp 0x4018c8
mov edx, 0xffffea93
mov word [0x423b98], dx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x2c]
push eax
push ecx
mov dword [esp + 0x34], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4017c4
jmp 0x4018f8
inc dword [esp + 0x14]
mov edi, dword [esp + 0xc]
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040b394
mov ecx, dword [esp + 0x154]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.0040b53b
add esp, 0x14c
ret
Function at 0x401b50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
fldz
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
fstp dword [esp + 0x10]
xor eax, eax
mov word [esp + 0xc], ax
push edi
call fcn.0040b471
mov ebx, dword [esp + 0x1c]
push edi
mov esi, eax
push ebx
push esi
call fcn.0040b550
fld dword [0x425e54]
fsub qword [0x41f3f8]
mov edx, dword [0x4277c4]
add esp, 0x10
add edi, esi
fstp dword [0x425e54]
mov eax, dword [0x425174]
add eax, 0x4e297c99
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
add edx, ebx
mov ecx, esi
fadd dword [0x42419c]
fcomp qword [0x41f3f0]
fnstsw ax
fld dword [0x42419c]
fsub qword [0x41f340]
fstp dword [0x42419c]
test ah, 0x44
jp 0x401be9
fld dword [esp + 0x10]
fadd qword [0x41f3e8]
fstp dword [esp + 0x10]
sub edx, 0x423014
cmp esi, edi
je 0x401bfd
mov al, byte [edx]
xor byte [ecx], al
inc ecx
inc edx
cmp ecx, edi
jne 0x401bf3
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret

Function at 0x402c70
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
fldz
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
fstp dword [esp + 0xc]
xor eax, eax
push 3
push 0x4235b0
mov word [esp + 0x14], ax
call fcn.00401b50
mov ebx, dword [esp + 0x20]
mov esi, eax
push esi
push ebx
call fcn.0040bf0e
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x402cc8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push ebx
call fcn.0040bf0e
mov edi, eax
add esp, 8
test edi, edi
je 0x402d0e
push edi
push 1
lea ecx, [esp + 0x24]
push 4
push ecx
call fcn.0040bdc8
mov edx, dword [esp + 0x20]
inc dword [esp + 0x20]
add esp, 0x10
cmp edx, 0x721936af
jne 0x402d05
dec dword [0x42354c]
mov eax, dword [0x42354c]
mov ecx, dword [esp + 0x10]
add eax, 0xc0c24d80
imul ecx, eax
mov dword [esp + 0x10], ecx
push edi
call fcn.0040bbea
add esp, 4
xor eax, eax
xor edx, edx
mov word [esp + 0xc], dx
mov word [esi], ax
mov word [esp + 0xc], ax
mov byte [esi + 2], al
fld qword [0x425198]
fmul qword [0x41f470]
push esi
fstp qword [0x425198]
call fcn.0040b394
fld dword [0x41f4e0]
add esp, 4
pop edi
fstp dword [esp + 8]
pop esi
pop ebx
add esp, 8
ret
Function at 0x404030
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
fldz
push ebp
mov dword [esp + 8], 0
fstp dword [esp + 8]
push 0x2e
push 0x4241e0
mov dword [esp + 0xc], 0
call fcn.00401b50
add esp, 8
mov ebp, eax
lea eax, [esp + 0xc]
push eax
push ebp
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x404134
push esi
push edi
push 0x34
push 0x424114
call fcn.00401b50
mov ecx, dword [0x4239fc]
mov edx, dword [esp + 0x24]
add esp, 8
imul ecx, ecx, 0xc4f2ddc2
mov esi, eax
mov eax, edx
mov dword [0x4239fc], ecx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4040a2
sub eax, edi
push eax
push edx
mov edx, dword [esp + 0x1c]
push 1
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc word [0x42463c]
fld dword [0x423548]
mov ax, word [0x42463c]
movsx ecx, ax
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
fcompp
fnstsw ax
fld dword [0x423548]
fadd qword [0x41f340]
fstp dword [0x423548]
test ah, 1
jne 0x404100
add dword [0x42354c], 0xcac9d350
xor eax, eax
push 0x34
xor edx, edx
push eax
mov word [esp + 0x14], dx
mov word [esp + 0x14], ax
push esi
call fcn.0040b8c0
fld qword [0x425198]
fmul qword [0x41f470]
push esi
fstp qword [0x425198]
call fcn.0040b394
add esp, 0x10
pop edi
pop esi
xor edx, edx
push 0x2e
xor ecx, ecx
push edx
mov word [esp + 0xc], cx
mov word [esp + 0xc], dx
push ebp
call fcn.0040b8c0
fld qword [0x425198]
fmul qword [0x41f470]
push ebp
fstp qword [0x425198]
call fcn.0040b394
movzx eax, word [0x423a2c]
mov ecx, dword [esp + 0x1c]
add esp, 0x10
sub eax, 0x394fcd48
mov word [0x423a2c], ax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
fld dword [esp + 4]
fsub qword [0x41f5f0]
fmul dword [esp + 4]
fstp dword [esp + 4]
add esp, 0xc
ret
Function at 0x40b53b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425fa0]
jne 0x40b545
repz ret
jmp fcn.0040f8c7

Function at 0x416934
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040fc97
and dword [ebp - 4], 0
cmp dword [0x428234], 0
mov ebx, eax
jne 0x4169e5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x416a96
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420b50
push edi
call esi
test eax, eax
je 0x416a96
push eax
call fcn.0040fc25
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428234], eax
call esi
push eax
call fcn.0040fc25
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428238], eax
call esi
push eax
call fcn.0040fc25
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42823c], eax
call esi
push eax
call fcn.0040fc25
pop ecx
mov dword [0x428244], eax
test eax, eax
je 0x4169e5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040fc25
pop ecx
mov dword [0x428240], eax
mov eax, dword [0x428240]
cmp eax, ebx
je 0x416a3d
cmp dword [0x428244], ebx
je 0x416a3d
push eax
call fcn.0040fca0
push dword [0x428244]
mov esi, eax
call fcn.0040fca0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x416a3d
test edi, edi
je 0x416a3d
call esi
test eax, eax
je 0x416a34
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416a34
test byte [ebp - 0xc], 1
jne 0x416a3d
or dword [ebp + 0x10], 0x200000
jmp 0x416a76
mov eax, dword [0x428238]
cmp eax, ebx
je 0x416a76
push eax
call fcn.0040fca0
pop ecx
test eax, eax
je 0x416a76
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x416a76
mov eax, dword [0x42823c]
cmp eax, ebx
je 0x416a76
push eax
call fcn.0040fca0
pop ecx
test eax, eax
je 0x416a76
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428234]
call fcn.0040fca0
pop ecx
test eax, eax
je 0x416a96
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416a98
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x452273
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0045221c
test eax, eax
je 0x4523cc
lea ecx, [esp + 0x18]
call fcn.0045221c
lea ecx, [esp + 0x18]
test eax, eax
je 0x45233b
call fcn.0045221c
test eax, eax
je 0x4522fd
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0045221c
lea edi, [eax + edi*2]
dec ebx
jne 0x4522d3
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x4522f4
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x4522f7
mov byte [edx], 0
inc edx
jmp 0x4523de
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x452333
test ecx, ecx
je 0x4523c7
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x452325
jmp 0x4523c3
xor ebp, ebp
inc ebp
jmp 0x4523c7
call fcn.00452252
test edi, edi
jne 0x452370
cmp eax, 2
jne 0x45236b
lea ecx, [esp + 0x18]
call fcn.00452252
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x4523c7
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x452360
jmp 0x4523c3
sub eax, 3
jmp 0x452373
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.00452252
mov ecx, eax
cmp esi, 0x7d00
jb 0x45239a
inc ecx
cmp esi, 0x500
jb 0x4523a3
inc ecx
cmp esi, 0x80
jae 0x4523ae
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x4523c7
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x4523ba
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x4523e4
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x4522a3
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452569
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x45259b
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x45257c
jmp 0x45259f
mov eax, dword [esp + 0x10]
test edi, edi
je 0x4525a9
xor byte [esi], al
inc esi
dec edi
jne 0x4525a3
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x4010d4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, str._ccav_
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00401224
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401108
push ebx
call fcn.0040fae3
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [0x41bef1]
test ebx, ebx
je 0x40111f
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [0x41bef1], eax
push 0x41b216
push dword [0x41bef1]
call fcn.00401037
add esp, 8
cmp eax, 0
jne 0x401165
mov dword [ebp - 8], esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401448
call fcn.00403124
call main
call fcn.004033f7
call fcn.0040d441
mov eax, str._c8c61bd7da46918b_
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401194
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x40119d
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4011ad
push ebx
call fcn.0040fae3
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x100017a5
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.10002c67
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.10002c67
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
jne 0x10001821
call fcn.100019b5
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 9
call fcn.10002c5b
cmp dword [ebp - 0x18], esp
je 0x10001857
push 0x75
push 0x4011050
push 6
call fcn.10002c55
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 0xa
call fcn.10002c5b
cmp dword [ebp - 0x18], esp
je 0x1000188f
push 0xa2
push 0x4011050
push 6
call fcn.10002c55
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push 0x1007eaf8
push 0
mov eax, 0xb
call fcn.10002c5b
cmp dword [ebp - 0x18], esp
je 0x100018c5
push 0xcc
push 0x4011050
push 6
call fcn.10002c55
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0xc
call fcn.10002c5b
cmp dword [ebp - 0x18], esp
je 0x1000195e
push 0x1dc
push 0x4011050
push 6
call fcn.10002c55
add esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 0xd
call fcn.10002c5b
cmp dword [ebp - 0x18], esp
je 0x1000198d
push 0x21c
push 0x4011050
push 6
call fcn.10002c55
add esp, 0xc
mov eax, dword [ebp - 0x14]
jmp 0x10001995
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.10002c4f
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.10002c4f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8