joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401af0
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x47c478
call fcn.00401d04
xor edi, edi
push edi
call dword [0x47c170]
cmp word [eax], 0x5a4d
jne 0x401b2b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b2b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401b43
cmp eax, 0x20b
je 0x401b30
mov dword [ebp - 0x1c], edi
jmp 0x401b57
cmp dword [ecx + 0x84], 0xe
jbe 0x401b2b
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x401b51
cmp dword [ecx + 0x74], 0xe
jbe 0x401b2b
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [0x47c428]
pop ecx
or dword [0x4a058c], 0xffffffff
or dword [0x4a0590], 0xffffffff
call dword [0x47c424]
mov ecx, dword [0x4884cc]
mov dword [eax], ecx
call dword [0x47c420]
mov ecx, dword [0x4884c8]
mov dword [eax], ecx
mov eax, dword [0x47c41c]
mov eax, dword [eax]
mov dword [0x4a0588], eax
call fcn.00401cfe
cmp dword [section..data], edi
jne 0x401bb4
push fcn.00401cfe
call dword [0x47c418]
pop ecx
call fcn.00401cec
push 0x47c474
push 0x47c470
call fcn.00401ce6
mov eax, dword [0x4884c4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x4884c0]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [0x47c410]
mov dword [ebp - 0x30], eax
push 0x47c46c
push 0x47c448
call fcn.00401ce6
add esp, 0x24
mov eax, dword [0x47c40c]
mov esi, dword [eax]
cmp esi, edi
jne 0x401c1a
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x401cd4
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x401c68
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x401c36
cmp ax, 0x22
jne 0x401c23
cmp word [esi], 0x22
jne 0x401c41
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x401c4f
cmp ax, 0x20
jbe 0x401c3c
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [0x47c174]
test byte [ebp - 0x4c], 1
je 0x401c75
movzx eax, word [ebp - 0x48]
jmp 0x401c78
cmp word [esi], 0x20
jbe 0x401c41
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x401c68
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [0x47c170]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x401c99
push esi
call dword [0x47c408]
call dword [0x47c404]
jmp 0x401cce
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00401d3d
ret
Function at 0x409f40
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x474
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x208
mov edi, eax
lea eax, [esp + 0x276]
push esi
push eax
mov word [esp + 0x27c], si
call fcn.0047b0b0
add esp, 0xc
cmp dword [0x48ba20], esi
jne 0x409f98
mov ebx, str.shell32.dll
call fcn.004651a0
cmp eax, esi
mov dword [0x48ba20], eax
je 0x409f98
push str.SHGetSpecialFolderPathW
push eax
call dword [0x47c188]
mov dword [0x48ba1c], eax
cmp dword [0x48ba1c], esi
je 0x409fd4
cmp dword [0x48b90c], esi
jne 0x409fbd
push 0x48b908
mov dword [0x48b908], 0x114
call dword [0x47c0c0]
push esi
push 0x22
lea ecx, [esp + 0x278]
push ecx
push esi
call dword [0x48ba1c]
jmp 0x40a075
push 0x206
lea edx, [esp + 0x6e]
push esi
push edx
mov word [esp + 0x74], si
call fcn.0047b0b0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [0x47c014]
cmp eax, esi
jne 0x40a059
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x6c]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
push esi
lea ecx, [esp + 0x38]
push ecx
push edx
mov dword [esp + 0x30], 0x208
call dword [0x47c008]
test eax, eax
jne 0x40a04e
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x40a049
shr eax, 1
mov word [esp + eax*2 + 0x68], si
jmp 0x40a04e
mov word [esp + 0x68], si
mov eax, dword [esp + 0x14]
push eax
call dword [section..rdata]
xor eax, eax
jmp 0x40a060
movzx ecx, word [esp + eax + 0x68]
mov word [esp + eax + 0x270], cx
add eax, 2
cmp cx, si
jne 0x40a060
mov esi, dword [edi + 0x24]
lea ecx, [esp + 0x270]
push ecx
mov ecx, edi
call fcn.00409c00
lea eax, [edi + 8]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 0x4854bc
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
call fcn.0040b140
cmp esi, dword [edi + 0x24]
jne 0x40a1ab
mov ebp, 0xfa00
push ebp
call fcn.00401a1c
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
push 0x4852e4
mov dword [esp + 0x20], ebp
call dword [0x47c360]
mov edi, eax
test edi, edi
mov dword [esp + 0x1c], edi
je 0x40a19e
mov eax, dword [esi + 4]
push 0x40
push eax
call fcn.00401a22
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40a140
mov edi, dword [esp + 0x18]
add ebx, 2
push 0
call 0x462e30
cmp eax, 0xffffffff
jne 0x40a110
push eax
push ebx
mov eax, edi
call 0x463510
mov eax, dword [esi + 4]
push 0x3f
push eax
call fcn.00401a22
add esp, 8
test eax, eax
je 0x40a13c
push 0
mov word [eax], 0
call 0x462e30
cmp eax, 0xffffffff
jne 0x40a13c
push eax
push ebx
mov eax, edi
call 0x463510
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push esi
push edi
mov dword [esp + 0x20], ebp
call dword [0x47c358]
test eax, eax
jne 0x40a0e0
call dword [0x47c184]
cmp eax, 0x7a
jne 0x40a197
mov ebp, dword [esp + 0x14]
push esi
add ebp, 0x2710
call fcn.00401a16
add esp, 4
push ebp
call fcn.00401a1c
add esp, 4
lea edx, [esp + 0x14]
push edx
mov esi, eax
push esi
push edi
mov dword [esp + 0x20], ebp
call dword [0x47c358]
test eax, eax
jne 0x40a0e0
push edi
call dword [0x47c35c]
test esi, esi
je 0x40a1ab
push esi
call fcn.00401a16
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x474
ret
Function at 0x40b140
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x678
push ebx
push esi
xor esi, esi
push 0x208
lea eax, [esp + 0x476]
push esi
push eax
mov word [esp + 0x47c], si
call fcn.0047b0b0
add esp, 0xc
push 0x208
lea ecx, [esp + 0x5e]
push esi
push ecx
mov word [esp + 0x64], si
call fcn.0047b0b0
add esp, 0xc
cmp dword [0x48ba20], esi
jne 0x40b1ac
mov ebx, str.shell32.dll
call fcn.004651a0
cmp eax, esi
mov dword [0x48ba20], eax
je 0x40b1ac
push str.SHGetSpecialFolderPathW
push eax
call dword [0x47c188]
mov dword [0x48ba1c], eax
cmp dword [0x48ba1c], esi
je 0x40b1e8
cmp dword [0x48b90c], esi
jne 0x40b1d1
push 0x48b908
mov dword [0x48b908], 0x114
call dword [0x47c0c0]
push esi
push 0x1c
lea edx, [esp + 0x478]
push edx
push esi
call dword [0x48ba1c]
jmp 0x40b298
push 0x206
lea eax, [esp + 0x26e]
push esi
push eax
mov word [esp + 0x274], si
call fcn.0047b0b0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [0x47c014]
cmp eax, esi
jne 0x40b27c
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x26c]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push esi
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x28], 0x208
call dword [0x47c008]
test eax, eax
jne 0x40b271
mov eax, dword [esp + 0x10]
cmp eax, 2
jb 0x40b269
shr eax, 1
mov word [esp + eax*2 + 0x268], si
jmp 0x40b271
mov word [esp + 0x268], si
mov ecx, dword [esp + 0xc]
push ecx
call dword [section..rdata]
xor eax, eax
mov edi, edi
movzx ecx, word [esp + eax + 0x268]
mov word [esp + eax + 0x470], cx
add eax, 2
cmp cx, si
jne 0x40b280
push 0x104
push 0x4852f8
lea eax, [esp + 0x60]
lea ecx, [esp + 0x478]
call 0x465830
mov esi, dword [0x47c0d4]
add esp, 8
lea edx, [esp + 0x58]
push edx
call esi
cmp eax, 0xffffffff
jne 0x40b2e4
push 0x104
push 0x485350
lea eax, [esp + 0x60]
lea ecx, [esp + 0x478]
call 0x465830
add esp, 8
lea eax, [esp + 0x58]
push eax
call esi
cmp eax, 0xffffffff
je 0x40b30d
mov edx, dword [esp + 0x684]
lea ecx, [esp + 0x58]
push ecx
push edx
call fcn.0040af40
pop esi
pop ebx
add esp, 0x678
ret 4
pop esi
xor eax, eax
pop ebx
add esp, 0x678
ret 4

Function at 0x40d300
Capabilities:
Encrypt data using des

Disassembly:
mov ecx, dword [eax]
push ebx
push esi
mov esi, dword [0x488dbc]
mov eax, dword [esi]
xor eax, ecx
push edi
mov edi, eax
mov ebx, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x487188]
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x487388]
mov ebx, eax
and eax, 0x3f
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x487588]
add esi, 4
xor edi, dword [eax*4 + 0x487788]
add esi, 4
xor dword [edx], edi
ror ecx, 4
xor ecx, dword [esi - 4]
mov dword [0x488dbc], esi
mov eax, ecx
shr eax, 0x18
and eax, 0x3f
mov eax, dword [eax*4 + 0x487088]
mov esi, ecx
shr esi, 0x10
and esi, 0x3f
xor eax, dword [esi*4 + 0x487288]
mov esi, ecx
shr esi, 8
and esi, 0x3f
xor eax, dword [esi*4 + 0x487488]
and ecx, 0x3f
xor eax, dword [ecx*4 + 0x487688]
pop edi
xor dword [edx], eax
pop esi
pop ebx
ret
Function at 0x4144f0
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x460
push esi
xor esi, esi
push 0x208
lea eax, [esp + 0x25e]
push esi
push eax
mov word [esp + 0x264], si
call fcn.0047b0b0
add esp, 0xc
cmp dword [0x48ba20], esi
jne 0x414545
push ebx
mov ebx, str.shell32.dll
call fcn.004651a0
cmp eax, esi
mov dword [0x48ba20], eax
pop ebx
je 0x414545
push str.SHGetSpecialFolderPathW
push eax
call dword [0x47c188]
mov dword [0x48ba1c], eax
cmp dword [0x48ba1c], esi
je 0x414581
cmp dword [0x48b90c], esi
jne 0x41456a
push 0x48b908
mov dword [0x48b908], 0x114
call dword [0x47c0c0]
push esi
push 0x1a
lea ecx, [esp + 0x260]
push ecx
push esi
call dword [0x48ba1c]
jmp 0x414645
push 0x206
lea edx, [esp + 0x56]
push esi
push edx
mov word [esp + 0x5c], si
call fcn.0047b0b0
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [0x47c014]
cmp eax, esi
jne 0x414622
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + str.AppData]
mov word [esp + eax + 0x10], cx
add eax, 2
cmp cx, si
jne 0x4145c0
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x54]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x1c], 0x208
call dword [0x47c008]
test eax, eax
jne 0x414617
mov eax, dword [esp + 4]
cmp eax, 2
jb 0x414612
shr eax, 1
mov word [esp + eax*2 + 0x50], si
jmp 0x414617
mov word [esp + 0x50], si
mov eax, dword [esp + 8]
push eax
call dword [section..rdata]
xor eax, eax
jmp 0x414630
movzx ecx, word [esp + eax + 0x50]
mov word [esp + eax + 0x258], cx
add eax, 2
cmp cx, si
jne 0x414630
push 0x104
push str.Apple_ComputerPreferenceskeychain.plist
mov eax, edi
lea ecx, [esp + 0x260]
call 0x465830
add esp, 8
push edi
call dword [0x47c0d4]
cmp eax, 0xffffffff
jne 0x41466f
mov word [edi], si
pop esi
add esp, 0x460
ret
Function at 0x461de0
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x254
cmp dword [0x48ba20], 0
push ebp
mov ebp, dword [esp + 0x25c]
jne 0x461e1d
push ebx
mov ebx, str.shell32.dll
call fcn.004651a0
test eax, eax
mov dword [0x48ba20], eax
pop ebx
je 0x461e1d
push str.SHGetSpecialFolderPathW
push eax
call dword [0x47c188]
mov dword [0x48ba1c], eax
cmp dword [0x48ba1c], 0
je 0x461e70
cmp dword [0x48b90c], 0
jne 0x461e44
push 0x48b908
mov dword [0x48b908], 0x114
call dword [0x47c0c0]
cmp dword [0x48b918], 1
jne 0x461e5c
cmp esi, 0x19
je 0x461e70
cmp esi, 0x17
je 0x461e70
cmp esi, 0x16
je 0x461e70
push 0
push esi
push ebp
push 0
call dword [0x48ba1c]
pop ebp
add esp, 0x254
ret
push 0x206
lea eax, [esp + 0x56]
push 0
push eax
mov word [esp + 0x5c], 0
call fcn.0047b0b0
add esp, 0xc
cmp esi, 0x19
je 0x461e9a
cmp esi, 0x17
je 0x461e9a
cmp esi, 0x16
jne 0x461eb2
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
jmp 0x461ec8
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [0x47c014]
test eax, eax
jne 0x461f30
lea eax, [esp + 0x10]
mov ecx, esi
call fcn.00461af0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0
lea eax, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x20], 0x208
call dword [0x47c008]
test eax, eax
jne 0x461f25
mov eax, dword [esp + 8]
cmp eax, 2
jb 0x461f1e
shr eax, 1
mov word [esp + eax*2 + 0x50], 0
jmp 0x461f25
mov word [esp + 0x50], 0
mov edx, dword [esp + 4]
push edx
call dword [section..rdata]
lea eax, [esp + 0x50]
mov edx, ebp
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x461f40
xor eax, eax
cmp word [ebp], ax
pop ebp
setne al
add esp, 0x254
ret

Function at 0x469ab0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x18
xor eax, eax
mov dword [esp + 1], eax
mov dword [esp + 5], eax
push esi
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov word [esp + 0x19], ax
mov byte [esp + 0x1b], al
mov byte [esp + 8], 0x28
mov byte [esp + 9], 0xd1
mov byte [esp + 0xa], 0xf2
mov byte [esp + 6], 0xba
mov byte [esp + 7], 0x5e
mov byte [esp + 4], 0xc8
mov byte [esp + 5], 0x13
mov byte [esp + 0xb], 0x12
xor ecx, ecx
lea esi, [esp + 0xb]
mov al, cl
mov dl, 0xd
imul dl
xor al, byte [esp + ecx + 4]
add ecx, 1
xor al, byte [esi]
sub esi, 1
cmp ecx, 8
mov byte [esp + ecx + 0xb], al
jl 0x469b01
xor ecx, ecx
lea esi, [esp + 0xb]
mov al, cl
mov dl, 0xe
imul dl
xor al, byte [esi]
add ecx, 1
xor al, 0x45
mov byte [esp + ecx + 0x13], al
sub esi, 1
cmp ecx, 8
jl 0x469b22
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0xc]
call fcn.0040d630
add esp, 8
pop esi
add esp, 0x18
ret 4
Function at 0x46caa0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
xor esi, esi
mov word [edi], si
mov al, byte [ebx]
test al, al
je 0x46cae2
lea ecx, [ecx]
xor al, 0x42
movzx ax, al
mov ecx, 0xf2
sub ecx, esi
xor ax, cx
movzx edx, ax
push 1
lea eax, [esp + 8]
push eax
push edi
mov dword [esp + 0x10], edx
call fcn.00401a8a
mov al, byte [esi + ebx + 1]
add esi, 1
add esp, 0xc
test al, al
jne 0x46cab0
pop esi
pop ecx
ret
Function at 0x471fe0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x60]
push esi
push eax
push ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.00471ef0
add esp, 8
lea esi, [esp + 8]
call fcn.00471e60
xor eax, eax
pop esi
add esp, 0x5c
ret

Function at 0x414b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x414b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b80
mov eax, 1
add ebx, ebx
jne 0x414ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b98
jne 0x414bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b98
xor ecx, ecx
sub eax, 3
jb 0x414bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c3a
mov ebp, eax
add ebx, ebx
jne 0x414bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c04
inc ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414be5
jne 0x414c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c15
jmp 0x414b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c24
add edi, ecx
jmp 0x414b86
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c42
cmp byte [edi], 5
jne 0x414c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c47
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19be8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c74
mov ecx, edi
jns 0x414ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c2c]
or eax, eax
je 0x414cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x414c91
call dword [esi + 0x19c28]
mov ebp, dword [esi + 0x19c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cf3
sub esp, 0xffffff80
jmp 0x401150
Function at 0x40f5e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
mov ebx, 0x4848e8
call fcn.0040f580
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00413990
push esi
call fcn.004112ef
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040f6a0
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f6d0
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x40f631
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x4876c8
push eax
call fcn.00414e06
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42b2ee
push edi
call fcn.0040f450
cmp eax, ebx
je 0x42b2f8
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414e94
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x40f690
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.004151b0
add esp, 0x10
push 0x72467ea4
push 0x10
lea ecx, [esp + 0x10]
push ecx
call fcn.0044afdc
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x42b324
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.00415484
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x40f690

Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x4103e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4972c8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4972c8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4972c0], eax
call esi
mov edx, dword [0x4972c0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4972bc], eax
call esi
mov eax, dword [0x4972c0]
push 0
push eax
call esi
pop esi
ret

Function at 0x421fa7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490e80]
jne 0x421fb1
repz ret
jmp fcn.00426243
Function at 0x4523ce
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
push edi
xor ebp, ebp
mov eax, dword [esi]
push eax
push 4
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.004151b0
add esp, 0x10
push 0x8a68c56f
push 4
lea edx, [esp + 0x1c]
push edx
call fcn.0044afdc
lea eax, [esp + 0x14]
push 0x487704
push eax
mov byte [esp + 0x20], 0
call fcn.004151d0
add esp, 8
test eax, eax
jne 0x452562
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x18]
push 4
push edx
inc ebp
call fcn.004151b0
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
push eax
xor edi, 0xd1d5e356
lea ebx, [edi + edi]
push ebx
lea ecx, [esp + 0x38]
push 1
push ecx
call fcn.004151b0
add esp, 0x20
add edi, 0x1b1ba05f
push edi
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0044afdc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x234]
xor eax, eax
push edx
mov word [esp + ebx + 0x28], ax
call fcn.00411691
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.004151b0
mov edi, dword [esp + 0x28]
mov edx, dword [esi]
push edx
xor edi, 0x661f894
lea ebx, [edi + edi]
push ebx
lea eax, [esp + 0x40]
push 1
push eax
call fcn.004151b0
add esp, 0x28
add edi, 0x9e89f4ef
push edi
push ebx
lea ecx, [esp + 0x28]
push ecx
call fcn.0044afdc
mov ecx, dword [esp + 0x44c]
lea eax, [esp + 0x20]
push eax
xor edx, edx
push ecx
mov word [esp + ebx + 0x28], dx
call fcn.00411691
mov edi, dword [esp + 0x450]
lea edx, [esp + 0x238]
push edi
push edx
call fcn.004133e4
add esp, 0x10
test eax, eax
je 0x452553
push 0x4876f8
push edi
call fcn.004133e4
add esp, 8
test eax, eax
jne 0x452510
test ebp, ebp
je 0x452553
mov eax, dword [esi]
push 1
push 1
push eax
call fcn.0041557c
mov ecx, dword [esi]
add esp, 0xc
push ecx
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.004151b0
mov eax, dword [esp + 0x2c]
xor eax, 0x87bc
mov dword [esp + 0x2c], eax
add eax, 0x18
push 1
push eax
mov eax, dword [esi]
push eax
call fcn.0041557c
add esp, 0x1c
jmp 0x4523e1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x430
ret 0xc