joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e1f0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4a86f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x45e2c2
push 0x20
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x45e299
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x45e26d
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call fcn.0045e530
add esp, 0xc
mov edi, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004698aa
mov esp, ebp
pop ebp
ret
push str.StopService____ControlService_failed
call fcn.0045f520
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004698aa
mov esp, ebp
pop ebp
ret
push str.StopService____OpenService_failed
call fcn.0045f520
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
push ebx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004698aa
mov esp, ebp
pop ebp
ret
push str.StopService____OpenSCManager_failed
call fcn.0045f520
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004698aa
mov esp, ebp
pop ebp
ret

Function at 0x45e2f0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4a86f0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x45e327
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004698aa
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x45e317
push eax
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.004698aa
mov esp, ebp
pop ebp
ret
Function at 0x45e530
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x14]
mov ebx, dword [esi + 0x18]
cmp ebx, 0x3e8
mov dword [ebp + 0x10], eax
mov eax, 0x1388
cmovb ebx, eax
cmp dword [esi + 4], ecx
je 0x45e5f0
mov eax, 0xcccccccd
mov ecx, 0x2710
mul ebx
push edi
mov edi, edx
shr edi, 3
cmp edi, 0x3e8
jae 0x45e586
mov eax, 0x3e8
jmp 0x45e591
cmp edi, 0x2710
mov eax, edi
cmova eax, ecx
push eax
call fcn.0045d7a0
add esp, 4
push esi
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x45e5ec
mov eax, dword [ebp + 0x10]
cmp dword [esi + 0x14], eax
jbe 0x45e5cd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x14]
mov dword [ebp - 4], eax
mov dword [ebp + 0x10], ecx
jmp 0x45e5df
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
lea eax, [ebx + ebx*2]
sub ecx, dword [ebp - 4]
cmp ecx, eax
ja 0x45e5ec
mov eax, dword [ebp + 0xc]
mov ecx, 0x2710
cmp dword [esi + 4], eax
jne 0x45e577
mov ecx, dword [ebp + 0xc]
pop edi
mov eax, dword [esi + 4]
pop esi
pop ebx
cmp eax, ecx
jne 0x45e60f
push str.WaitForServiceToReachState____Success
call fcn.0045f520
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
push eax
push str.WaitForServiceToReachState____Failed___CurrentState_d
call fcn.0045f520
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x45fbc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x45fc17
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x45fc10
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x45fc10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.0045fc30
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
pop esi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x487854
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0046bf5a
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4601f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4a86f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x4602fa
movzx eax, word [ebx]
test ax, ax
je 0x4602fa
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x460230
cmp ax, 0x5c
jne 0x460232
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x460224
cmp edi, ebx
je 0x46029a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0046a390
sub edi, ebx
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push ebx
push eax
call fcn.0046f6e4
add edi, edi
add esp, 0x18
cmp edi, 0x208
jae 0x46030a
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.004601f0
add esp, 8
lea ecx, [ebp - 0x414]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4602a2
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x4602b4
lea edi, [ebp - 0x414]
sub ebx, esi
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4602d0
mov ecx, ebx
lea eax, [ebp - 0x414]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004698aa
mov esp, ebp
pop ebp
ret
call fcn.0046be7e
int3
Function at 0x460980
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x460a19
cmp dword [esi + 4], 0xffffffff
jne 0x460a19
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4609b0
cmp dword [ebp + 0x10], 1
mov eax, dword [0x488db8]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x4609e3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4609e3
pop edi
mov eax, 0x2000000
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00463560
add esp, 0x10
test eax, eax
jne 0x460a03
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
push eax
call fcn.00463b10
add esp, 4
mov dword [esi], eax
mov eax, dword [0x4c423c]
pop edi
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x4636a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x4636de
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4636d2
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x4636ef
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.00469d40
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x463790
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x46379e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x463873
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497210]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497210]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497210]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497210]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497210]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497210]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497210]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497210]
dec edi
jne 0x4637b6
pop edi
test esi, esi
je 0x463892
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497210]
dec esi
jne 0x463877
not eax
pop esi
pop ebp
ret
Function at 0x4643a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x18
push edi
mov edi, dword [ebp + 8]
cmp byte [edi], 0
je 0x4643d5
cmp byte [edi + 1], 0
je 0x4643ce
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4643db
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
mov dword [edi + 0x18], eax
cmp byte [edi], 0
push ebx
je 0x464400
cmp byte [edi + 1], 0
je 0x4643f9
push 1
push 0
push 0
push dword [edi + 4]
call ecx
mov ebx, eax
sub ebx, dword [edi + 0xc]
jmp 0x464403
xor ebx, ebx
mov dword [ebp - 4], ebx
jmp 0x464412
mov ebx, dword [edi + 0x18]
mov eax, 0xffff
mov dword [ebp - 4], ebx
mov dword [ebp + 8], eax
cmp ebx, eax
jae 0x464415
mov dword [ebp + 8], ebx
push esi
push 0x404
call fcn.0046a5db
mov esi, eax
add esp, 4
test esi, esi
jne 0x464430
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov eax, 4
mov dword [ebp - 0xc], 0
cmp ecx, eax
jbe 0x464530
add eax, 0x400
cmp eax, ecx
mov edx, eax
mov eax, 0x404
cmova edx, ecx
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x18], edx
sub ebx, ecx
mov dword [ebp - 0x14], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x464491
cmp byte [edi + 1], 0
je 0x464530
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x464494
mov dword [edi + 0x18], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 8], ebx
je 0x4644bc
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4644b7
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x10]
jmp 0x4644e5
mov edx, dword [edi + 0x18]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x14]
jbe 0x4644cf
mov ecx, dword [edi + 0x14]
sub ecx, edx
mov dword [ebp - 8], ecx
push ecx
mov ecx, dword [edi + 0x10]
add ecx, edx
push ecx
push esi
call fcn.00469d40
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [edi + 0x18], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x464530
lea eax, [ebx - 3]
test eax, eax
jle 0x46451f
dec eax
cmp byte [eax + esi], 0x50
jne 0x464511
cmp byte [eax + esi + 1], 0x4b
jne 0x464511
cmp byte [eax + esi + 2], 5
jne 0x464511
cmp byte [eax + esi + 3], 6
je 0x464517
test eax, eax
jg 0x4644f5
jmp 0x46451f
add eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jne 0x464530
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
cmp eax, ecx
jb 0x464447
push esi
call fcn.004697b3
mov eax, dword [ebp - 0xc]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x47f345
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a86f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00471781
mov dword [ebp - 0x14], eax
cmp dword [0x4c53d4], esi
jne 0x47f438
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x47f3c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x47f518
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x47f518
push 0x49d860
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47f518
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4c53d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4c53d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4c53dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c53e4], eax
test eax, eax
je 0x47f435
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c53e0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x47f45d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47f450
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x47f472
push 4
pop eax
jmp 0x47f51a
cmp dword [ebp - 0x14], esi
je 0x47f472
push dword [0x4c53d4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x47f457
mov eax, dword [0x4c53e0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x47f4d0
cmp dword [0x4c53e4], edi
je 0x47f4d0
push eax
call ebx
push dword [0x4c53e4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x47f4d0
test eax, eax
je 0x47f4d0
call ecx
test eax, eax
je 0x47f4c5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x47f4c5
test byte [ebp - 8], 1
jne 0x47f4d0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x47f500
mov eax, dword [0x4c53d8]
cmp eax, edi
je 0x47f4fd
push eax
call ebx
test eax, eax
je 0x47f4fd
call eax
mov esi, eax
test esi, esi
je 0x47f4fd
mov eax, dword [0x4c53dc]
cmp eax, edi
je 0x47f4fd
push eax
call ebx
test eax, eax
je 0x47f4fd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4c53d4]
call ebx
test eax, eax
je 0x47f518
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x47f51a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004698aa
mov esp, ebp
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x532753a6
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x76ac2d55
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10021298
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x100212a7
pop dword [ebp - 0x38]
mov eax, 0x6d491afc
add eax, 0xa2b8f7ab
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x790b7e00
add dword [ebp - 0x48], 0xd546c74b
mov dword [ebp - 0x44], 0x92cef309
sub dword [ebp - 0x44], 0x609ba6c4
mov dword [ebp - 0x40], 0xa678cd6d
add dword [ebp - 0x40], 0xa5d376c1
mov dword [ebp - 0x3c], 0xddc8da07
sub dword [ebp - 0x3c], 0xddc8da07
lea eax, [ebp - 0x48]
push eax
mov eax, 0x5648c626
add eax, 0xb9bccae6
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x399c83e8
sub dword [ebp - 0x48], 0xc52a1a92
mov dword [ebp - 0x44], 0x430d0215
sub dword [ebp - 0x44], 0x1a0a0a0
mov dword [ebp - 0x40], 0x364f516b
add dword [ebp - 0x40], 0x2d201b01
mov dword [ebp - 0x3c], 0xd5518f22
add dword [ebp - 0x3c], 0x2aae70de
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x60e3c
push 0
call eax
mov ecx, 0x559d
xor edi, edi
add edi, eax
mov ebx, 0x10069400
add ebx, dword [ebp - 0x38]
mov esi, 0xa03174b5
add esi, 0xc29ecec9
sub dword [ebp - 4], edi
mov edx, dword [ebx]
xor dword [ebp - 0x10], 0x7d7fa238
add edx, esi
xor dword [ebp - 4], edx
mov dword [edi], edx
xor dword [ebp - 0x2c], esi
add edi, 4
add ebx, 4
loop 0x100213ba
add eax, 0xe981855e
add eax, 0x167fc3e9
mov ebx, eax
add eax, 0xe46e5b96
add eax, 0x1b91a46f
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x1000b542
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000b551
pop dword [ebp - 0x30]
mov eax, 0x4e83d536
sub eax, 0x3e831fe5
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x22c41ae3
sub dword [ebp - 0x40], 0xd471d598
mov dword [ebp - 0x3c], 0x59868715
add dword [ebp - 0x3c], 0xd8acc530
mov dword [ebp - 0x38], 0x4fa43f7
sub dword [ebp - 0x38], 0xb8adffc9
mov dword [ebp - 0x34], 0xc0474e16
sub dword [ebp - 0x34], 0xc0474e16
lea eax, [ebp - 0x40]
push eax
mov eax, 0xc7864bb0
sub eax, 0xb7857b30
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xeb30f6f0
add dword [ebp - 0x40], 0x89417266
mov dword [ebp - 0x3c], 0x10b9a4c8
sub dword [ebp - 0x3c], 0xcf4d4353
mov dword [ebp - 0x38], 0x7c1e37fc
add dword [ebp - 0x38], 0xe7513470
mov dword [ebp - 0x34], 0xfdafb3c2
add dword [ebp - 0x34], 0x2504c3e
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xe1a39c70
sub eax, 0xd1a2cbf8
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38ff4
push 0
call eax
mov ecx, 0x4b0c
xor esi, esi
add esi, eax
mov edx, 0x1001b400
add edx, dword [ebp - 0x30]
mov edi, 0x3981a5ea
xor dword [ebp - 0x10], 0x85ef0fa6
mov ebx, dword [edx]
mov dword [ebp - 0x20], 0x93bf7a74
sub ebx, edi
mov dword [ebp - 0x18], 0x9fed0bb0
mov dword [esi], ebx
xor dword [ebp - 0xc], 0xb03d6eff
add esi, 0xc5fb68e1
sub esi, 0xc5fb68dd
add edx, 0x20c9ddf5
sub edx, 0x20c9ddf1
loop 0x1000b663
add eax, 0xe6424241
sub eax, 0xe641233e
mov ebx, eax
add eax, 0x883c0b9f
add eax, 0x77c3f466
mov ecx, 0x6611844f
sub ecx, 0x5611844f
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x402aa0
Capabilities:
Accept command line arguments

Disassembly:
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.004029e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
ret 0x10

Function at 0x402d76
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406018]
jne 0x402d80
repz ret
jmp fcn.004031ad
Function at 0x405f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x405f7f
pop dword [ebp - 0x4c]
mov eax, 0x25bdfa33
sub eax, 0x257d9ab4
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xa23c25d8
add dword [ebp - 0x5c], 0xac161f73
mov dword [ebp - 0x58], 0xb32292c7
sub dword [ebp - 0x58], 0x80ef4682
mov dword [ebp - 0x54], 0xeebb180
add dword [ebp - 0x54], 0x3d6092ae
mov dword [ebp - 0x50], 0xc889bf13
add dword [ebp - 0x50], 0x377640ed
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xfc8df351
sub dword [ebp - 0x5c], 0x881b89fb
mov dword [ebp - 0x58], 0x5021b132
add dword [ebp - 0x58], 0xf14ab043
mov dword [ebp - 0x54], 0xf0756076
add dword [ebp - 0x54], 0x72fa0bf6
mov dword [ebp - 0x50], 0x4f6c05f7
sub dword [ebp - 0x50], 0x4f6c05f7
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c3ff
push 0
call eax
mov ecx, 0xe6d60c8a
sub ecx, 0xe6d5bebb
mov edi, eax
mov ebx, 0xfe37495d
sub ebx, 0xfdf5895d
add ebx, dword [ebp - 0x4c]
mov edx, 0x7e76a358
xor dword [ebp - 0x34], ecx
mov esi, dword [ebx]
mov dword [ebp - 0x34], 0x9c1e2bf9
add esi, edx
mov dword [edi], esi
add dword [ebp - 0x48], ebx
add edi, 4
add ebx, 0x747c8ce8
sub ebx, 0x747c8ce4
loop 0x406091
add eax, 0x9561236
add eax, 0xf6ab17d9
mov ebx, eax
add eax, 5
mov ecx, 0x569b689c
sub ecx, 0x565b689c
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4013e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.004026c0
mov eax, dword [0x423100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push 0xfffc
push eax
mov word [ebp - 0x10004], ax
lea eax, [ebp - 0x10002]
push eax
call fcn.004026f0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x7fff
lea eax, [ebp - 0x10004]
push eax
push str.STEAM_COMPAT_PROTON
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
push 0
setne bl
call dword [sym.imp.KERNEL32.dll_SetLastError]
test bl, bl
pop ebx
jne 0x401460
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026af
mov esp, ebp
pop ebp
ret
push 0xa
lea eax, [ebp - 0x10004]
push 0
push eax
call fcn.00402697
mov ecx, dword [ebp - 4]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.004026af
mov esp, ebp
pop ebp
ret

Function at 0x401510
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20004
call fcn.004026c0
mov eax, dword [0x423100]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0xfffc
push eax
mov word [ebp - 0x20004], ax
lea eax, [ebp - 0x20002]
push eax
call fcn.004026f0
xor eax, eax
push 0xfffc
push eax
mov word [ebp - 0x10004], ax
lea eax, [ebp - 0x10002]
push eax
call fcn.004026f0
add esp, 0x18
lea eax, [ebp - 0x20004]
push 0x7fff
push eax
push 0x40e260
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x4241e0
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
call fcn.0040242b
lea eax, [ebp - 0x20004]
push 0x7fff
push eax
call fcn.00402497
add esp, 0x14
test eax, eax
je 0x4015d6
push 0x40e25c
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
call fcn.0040242b
lea eax, [ebp - 0x20004]
push eax
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
call fcn.0040242b
add esp, 0x18
lea eax, [ebp - 0x10004]
push eax
push 0x40e260
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026af
mov esp, ebp
pop ebp
ret