joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405bc2
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.0040633f
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405be6
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405d1f
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42d990], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x42d990
je 0x405c2a
push 1
push 0
push esi
call fcn.00405b4b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405d25
cmp eax, edi
jg 0x405d25
mov esi, 0x42d408
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405d25
cmp eax, edi
jg 0x405d25
push esi
push ebp
push str._s_s_r_n
push 0x42d008
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x430fb0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405e96
push 4
push 0xc0000000
push esi
call fcn.00405b4b
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405d1f
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405d18
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405d18
cmp edi, dword [esp + 0x18]
jne 0x405d18
push str._Rename__r_n
push esi
call fcn.00405ac0
test eax, eax
jne 0x405d2c
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405e74
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x42d008
push eax
call fcn.00405b0c
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x431030]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40aab0
push eax
call fcn.00405ac0
test eax, eax
je 0x405ce3
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405d53
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405d48
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405ce5
Function at 0x405d5b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405dcc
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405dbb
cmp dword [ebp + 0x14], 1
je 0x405dbd
cmp dword [ebp + 0x14], 2
je 0x405dbd
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x40616b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406190
mov eax, dword [0x40a880]
cmp eax, 0xffffffff
je 0x406187
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a880], 0xffffffff
jmp 0x406203
cmp dword [0x42f720], ebx
je 0x406203
cmp byte [0x42f320], bl
je 0x4061cf
cmp dword [0x40a880], 0xffffffff
jne 0x4061d8
push 4
push 0x40000000
push 0x42f320
call fcn.00405b4b
cmp eax, 0xffffffff
mov dword [0x40a880], eax
je 0x406203
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a880], 0xffffffff
je 0x406203
push esi
mov esi, 0x42ff40
push 0x40aac8
push esi
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp + 8]
push ebx
push eax
push esi
call sub.KERNEL32.dll_lstrlenA
push eax
push esi
push dword [0x40a880]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4063ab
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42dd94], 0
push esi
jne 0x4063e2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4063bc
mov dword [ecx*4 + 0x42dd90], eax
inc ecx
cmp ecx, 0x100
jl 0x4063b7
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406413
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42dd90]
xor eax, esi
inc ecx
dec edx
jne 0x4063f5
pop edi
not eax
pop esi
ret 0xc
Function at 0x40686f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x4068ad
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406883
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x40687e
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4068da
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068bb
not eax
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4a2940
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6c000]
push edi
jmp 0x4a295a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a2961
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a2950
mov eax, 1
add ebx, ebx
jne 0x4a2973
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a2984
jne 0x4a29a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a29a3
dec eax
add ebx, ebx
jne 0x4a2990
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a2968
add ebx, ebx
jne 0x4a299f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a29f5
xor ecx, ecx
sub eax, 3
jb 0x4a29bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a2a2a
sar eax, 1
mov ebp, eax
jmp 0x4a29c6
add ebx, ebx
jne 0x4a29c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a2994
inc ecx
add ebx, ebx
jne 0x4a29d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a2994
add ebx, ebx
jne 0x4a29e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a29d6
jne 0x4a29f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a29d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a2a14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a2a06
jmp 0x4a2956
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a2a14
add edi, ecx
jmp 0x4a2956
pop esi
mov edi, esi
mov ecx, 0x3057
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a2a32
cmp byte [edi], 0x27
jne 0x4a2a32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a2a37
lea edi, [esi + 0x9f000]
mov eax, dword [edi]
or eax, eax
je 0x4a2aaf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbeafc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbec14]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a2a64
mov ecx, edi
jns 0x4a2a93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbec18]
or eax, eax
je 0x4a2aa9
mov dword [ebx], eax
add ebx, 4
jmp 0x4a2a81
call dword [esi + 0xbec28]
mov ebp, dword [esi + 0xbec1c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a2ae3
sub esp, 0xffffff80
jmp 0x45311e
Function at 0x40c630
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40c652
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c659
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c648
mov eax, 1
add ebx, ebx
jne 0x40c66b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c660
jne 0x40c67c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c660
xor ecx, ecx
sub eax, 3
jb 0x40c690
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c702
mov ebp, eax
add ebx, ebx
jne 0x40c69b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c6a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c6cc
inc ecx
add ebx, ebx
jne 0x40c6b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c6ad
jne 0x40c6c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c6ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c6ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c6dd
jmp 0x40c64e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c6ec
add edi, ecx
jmp 0x40c64e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c74b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc03c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c709
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc040]
or eax, eax
je 0x40c745
mov dword [ebx], eax
add ebx, 4
jmp 0x40c726
call dword [esi + 0xc050]
mov ebp, dword [esi + 0xc044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c77f
sub esp, 0xffffff80
jmp 0x40a71c
Function at 0x1f152050
Capabilities:
Write file on windows

Disassembly:
push ebp
push esi
push edi
add esp, 0xfffffef4
mov edi, dword [esp + 0x11c]
mov al, byte [edi]
test al, al
je 0x1f152072
xor esi, esi
inc esi
mov al, byte [edi + esi]
test al, al
jne 0x1f152068
jmp 0x1f152074
xor esi, esi
test esi, esi
je 0x1f15211e
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1f1520c5
call fcn.1f152440
test al, al
jne 0x1f1520c5
push 0
lea eax, [esp + 0x10c]
push eax
push esi
push edi
push ebp
mov dword [esp + 0x11c], esi
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [esp + 0x10c]
push ecx
push 2
push 0x1f155108
push ebp
call sub.KERNEL32.DLL_WriteFile
jmp 0x1f15210f
push 0
mov dword [esp + 0x10c], esi
call sub.KERNEL32.DLL_GetModuleHandleA
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
test eax, eax
jne 0x1f1520eb
mov byte [esp], 0
push 0x1f155118
call sub.KERNEL32.DLL_LoadLibraryA
push str.MessageBoxA
push eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x12010
lea ecx, [esp + 4]
push ecx
push edi
push 0
call eax
mov eax, dword [0x1f157010]
test eax, eax
je 0x1f15211e
push edi
call fcn.1f1523e0
sub esp, 0xfffffef4
pop edi
pop esi
pop ebp
ret 4

Function at 0x1f1522d0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
add esp, 0xfffffaec
mov al, byte [0x1f157014]
test al, al
je 0x1f1522e6
mov al, 1
jmp 0x1f1523d6
push dword [0x1f157010]
push str.SYSTEMCurrentControlSetServicesEventLogApplication_s
lea ecx, [esp + 0x11c]
push ecx
call fcn.1f151fc0
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x11c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x13c]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0xfffffff4
test eax, eax
je 0x1f15233b
xor al, al
jmp 0x1f1523d6
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 0x104
lea ecx, [esp + 8]
push ecx
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
test eax, eax
je 0x1f1523d4
lea eax, [esp + 4]
push eax
call fcn.1f152710
inc eax
push eax
lea ecx, [esp + 8]
push ecx
push 2
push 0
push str.EventMessageFile
mov eax, dword [esp + 0x120]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
mov ecx, eax
mov eax, dword [esp + 0x10c]
test ecx, ecx
je 0x1f152394
push eax
call sub.ADVAPI32.DLL_RegCloseKey
xor al, al
jmp 0x1f1523d6
push 4
lea ecx, [esp + 4]
push ecx
push 4
push 0
push str.TypesSupported
push eax
mov dword [esp + 0x18], 7
call sub.ADVAPI32.DLL_RegSetValueExA
mov edx, eax
mov eax, dword [esp + 0x10c]
test edx, edx
je 0x1f1523c9
push eax
call sub.ADVAPI32.DLL_RegCloseKey
xor al, al
jmp 0x1f1523d6
mov byte [0x1f157014], 1
mov al, 1
jmp 0x1f1523d6
xor al, al
sub esp, 0xfffffaec
ret

Function at 0x1f152460
Capabilities:
Parse pe header

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp word [edi], 0x5a4d
je 0x1f152476
push str.Invalid_DOS_signature
call fcn.1f152130
add edi, dword [edi + 0x3c]
cmp dword [edi], 0x4550
je 0x1f15248b
push str.Invalid_PE_signature
call fcn.1f152130
mov eax, edi
pop edi
ret 4
Function at 0x445c45
Capabilities:
Encode data using xor

Disassembly:
push es
nop
arpl si, sp
mov byte [esi + 0x42], al
jae 0x445c5a
outsb dx, byte [esi]
stosd dword es:[edi], eax
push edx
adc al, 0x77
mov esp, 0xbf139e46
lahf
into
dec ecx
fnstsw ax
call 0x320311a5
xor byte [esi], bh
lodsb al, byte [esi]
invalid

Function at 0x458b46
Capabilities:
Encode data using xor

Disassembly:
add byte [ebp + 0xff], al
cmp dword [esi], 0x65676900
jne 0x458b7b
push ebx
add byte [esi + 8], bh
jae 0x458bcf
jne 0x458b7b
mov eax, dword [eax]
add dh, cl
push edi
push dword [ebx + 0x54]
add al, byte [eax]
or al, 0xff
jne 0x458b73
call fcn.00459586
add esp, 0x10
mov dword [ebp - 0x3e], eax
add byte [esi - 0x7effffff], dh
jle 0x458b82
cmp dword [esi + 4], 0x64610000
add byte [eax], al
popal
jne 0x458bd4
jne 0x458bd4
mov al, byte [0x72650800]
jne 0x458bd4
mov edx, dword [ebx]
add byte [eax], al
in al, dx
push edi
push eax
lea eax, [ebp - 0x79]
add dh, cl
push eax
movzx eax, word [edx + 8]
push eax
add byte [eax], al
or al, 0xff
jne 0x458bac
call 0x468bfd
add esp, 0x18
mov dword [ebp], eax
add al, bh
dec dword [edi]
test byte [eax - 0x79], ch
add byte [eax], al
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0
add byte [eax], al
inc esp
add dword [eax], eax
add byte [ebx + 0x18900e7], cl
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
add byte [ecx + 1], cl
add byte [eax], al
sbb dword [ebp], 0x6c626174
jne 0x458c0b
add byte [eax], al
or byte [ebp + 0x32], ah
jne 0x458c0b
fiadd dword [eax]
int3
cmp dword [esi + 4], 0x756c0000
jne 0x462c2e
cmp word [esi + 8], 0x656d
add byte [eax], al
or al, byte [ecx]
add byte [eax], al
mov ebp, dword [0x57d68b00]
push dword [ebx + 4]
inc dword [eax]
add bh, bh
jne 0x458c3b
call fcn.0045b766
mov ecx, 1
add byte [eax], al
mov dword [eax], eax
add byte [ebx + 0x4d8910c4], al
or eax, dword [eax]
jmp 0x83458c4c
fistp qword [eax + 0x7edbbf3a]
je 0x462bff
out 0x73, al
xlatb
mov ah, 0x31
aad 0x70
cmc
jo 0x462c13
jo 0x462bf5
mov bh, 0x32
mov bh, 0xd2
ja 0x462c19
jnp 0x462c0c
mov ecx, 0x7fddb83c
fnstsw word [edi - 6]
cli
jle 0x462c10
add esi, dword [esi - 0x88d29cd]
xor edx, esi
jb 0x462c35
jb 0x462c17
mov dl, 0x37
mov dl, 0xd7
jno 0x462c3a
jno 0x462c1c
xor dword [ecx + esi + 0x70f471d4], esi
aad 0xb0
xor eax, 0xf570d5b0
aam 0x71
hlt
jo 0x462c2d
aaa
mov dl, 0x37
sal byte [edi - 0xe], cl
jbe 0x462c33
mov dh, 0x33
mov dh, 0xd3
jne 0x462c56
jne 0x462c38
xor eax, 0x7bde34b1
cld
js 0x462c4b
mov ebp, 0x73d68306
div dword [ecx - 0x2c]
xor byte [ebp + 0x2a75d336], dh
iretd
Function at 0x410000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x440059]
shl eax, 2
mov dword [0x44005d], eax
push edi
push ecx
xor eax, eax
mov edi, 0x448988
mov ecx, 0x44913c
cmp ecx, edi
jbe 0x410024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
mov edx, dword fs:[4]
mov eax, dword [edx - 8]
mov dword [0x440061], eax
mov eax, dword [edx - 4]
mov dword [0x440065], eax
sub edx, 4
mov dword [0x448cf4], edx
sub edx, 4
cmp edx, esp
jae 0x41004e
mov esp, edx
push 0
call fcn.0042c0d3
pop ecx
push 0x44002c
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x44006a], eax
push 0
jmp fcn.0042fb78
Function at 0x414753
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [0x448988]
mov eax, dword [eax + 0x20]
push eax
mov eax, dword [ebx + 0x2c]
push dword [eax + 0x10]
call sub.USER32.dll_SetWindowTextA
mov dword [ebp - 0xc], 0x5fb
push 0xa
push dword [ebp - 0xc]
mov eax, dword [ebx]
mov eax, dword [eax + 0x68]
push dword [eax + 0xc]
call sub.KERNEL32.dll_FindResourceA
mov edi, eax
test edi, edi
jne 0x41479f
mov esi, 3
jmp 0x4148c9
mov esi, edi
push esi
mov eax, dword [ebx]
mov eax, dword [eax + 0x68]
push dword [eax + 0xc]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.KERNEL32.dll_LockResource
mov dword [ebp - 8], eax
push dword [0x4420d8]
mov eax, dword [0x448988]
push dword [eax + 0x24]
lea eax, [ebp - 0x90]
push eax
call fcn.0042d310
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebx + 0x2c]
push dword [eax + 0x10]
call sub.USER32.dll_SetWindowTextA
mov ax, word [ebp + 0xc]
push eax
mov esi, edi
push esi
mov eax, dword [ebx]
mov eax, dword [eax + 0x68]
push dword [eax + 0xc]
call sub.KERNEL32.dll_SizeofResource
push eax
push dword [ebp - 8]
push ebx
call fcn.004152e0
add esp, 0x10
mov esi, eax
test esi, esi
jne 0x414873
cmp dword [0x440310], 0
je 0x414873
push dword [0x4420d8]
mov eax, dword [0x448988]
push dword [eax + 0x1b0]
lea eax, [ebp - 0x90]
push eax
call fcn.0042d310
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebx + 0x2c]
push dword [eax + 0x10]
call sub.USER32.dll_SetWindowTextA
mov ax, word [ebp + 0xc]
push eax
mov esi, edi
push esi
mov eax, dword [ebx]
mov eax, dword [eax + 0x68]
push dword [eax + 0xc]
call sub.KERNEL32.dll_SizeofResource
push eax
push dword [ebp - 8]
push ebx
call fcn.004153d1
add esp, 0x10
mov esi, eax
cmp dword [0x4489ae], 2
jne 0x4148c1
cmp dword [0x4489ae], 2
jne 0x4148c1
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0x90020
push dword [0x441fd0]
call sub.KERNEL32.dll_DeviceIoControl
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0x9001c
push dword [0x441fd0]
call sub.KERNEL32.dll_DeviceIoControl
push dword [ebp - 4]
call sub.KERNEL32.dll_FreeResource
cmp dword [0x441fd0], 0
je 0x4148ed
cmp dword [0x441fd0], 0xffffffff
je 0x4148ed
push dword [0x441fd0]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov dword [0x441fd0], eax
push esi
push ebx
call fcn.00414900
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417d0a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0x200
mov ebx, 1
cmp dword [0x441fd0], 0
jne 0x417de2
cmp dword [0x4489ae], 1
jne 0x417d5e
push 0
push 0x4000000
push 0
push 0
push 0
push 0xc0000000
push 0x442022
call sub.KERNEL32.dll_CreateFileA
mov dword [0x441fd0], eax
jmp 0x417dcb
push 0x44202d
lea eax, [ebp - 0x3c]
push eax
call fcn.0042a26c
add esp, 8
test di, di
jne 0x417d87
push 0x442032
lea eax, [ebp - 0x3c]
push eax
call fcn.0042a204
add esp, 8
jmp 0x417d98
push 0x442035
lea eax, [ebp - 0x3c]
push eax
call fcn.0042a204
add esp, 8
mov dword [ebp - 0x18], 0xc
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
push 0
push 0x80
push 3
lea eax, [ebp - 0x18]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x3c]
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [0x441fd0], eax
cmp dword [0x441fd0], 0xffffffff
jne 0x417de2
xor eax, eax
mov dword [0x441fd0], eax
xor eax, eax
jmp 0x417eab
cmp dword [0x4489ae], 1
jne 0x417e73
lea eax, [ebp - 0xb]
push eax
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 9]
push eax
mov ax, word [ebp + 0x14]
push eax
call fcn.00417b14
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
movzx eax, di
xor edx, edx
mov dl, byte [ebp - 0xa]
shl edx, 8
or eax, edx
mov dword [ebp - 0x54], eax
xor eax, eax
mov al, byte [ebp - 9]
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 0xb]
or eax, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0x201
mov dword [ebp - 0x40], 1
push 0
lea eax, [ebp - 8]
push eax
push 0x1c
lea eax, [ebp - 0x58]
push eax
push 0x1c
lea eax, [ebp - 0x58]
push eax
push 4
push dword [0x441fd0]
call sub.KERNEL32.dll_DeviceIoControl
test eax, eax
je 0x417e6c
test byte [ebp - 0x40], 1
jne 0x417e6c
mov byte [esi], 0
jmp 0x417ea9
xor ebx, ebx
mov byte [esi], 0x80
jmp 0x417ea9
xor eax, eax
mov dword [ebp - 0x20], eax
movzx eax, word [ebp + 0x14]
shl eax, 9
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [0x441fd0]
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x417ea9
xor ebx, ebx
mov byte [esi], 0x80
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41813a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, 1
cmp dword [0x4489ae], 1
jne 0x4181fc
push esi
push edi
mov esi, 0x441fd4
lea edi, [ebp - 0x28]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x1c
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.0042a1d4
add esp, 0xc
lea eax, [ebp - 7]
push eax
lea eax, [ebp - 6]
push eax
lea eax, [ebp - 5]
push eax
push esi
call fcn.00417b14
add esp, 0x10
xor eax, eax
mov al, byte [ebp + 0x14]
or eax, 0x300
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], edi
xor eax, eax
mov al, byte [ebp - 5]
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 7]
or eax, edx
mov dword [ebp - 0x20], eax
xor eax, eax
mov al, byte [ebp - 6]
shl eax, 8
xor edx, edx
mov dl, byte [ebp + 8]
dec edx
or eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 1
push 0
lea eax, [ebp - 4]
push eax
push 0x1c
lea eax, [ebp - 0x28]
push eax
push 0x1c
lea eax, [ebp - 0x28]
push eax
push 4
push dword [0x441fd0]
call sub.KERNEL32.dll_DeviceIoControl
test eax, eax
je 0x4181f8
test byte [ebp - 0x10], 1
je 0x418242
xor ebx, ebx
jmp 0x418242
movzx eax, word [ebp + 0x14]
shl eax, 9
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x30], eax
shl esi, 9
mov dword [ebp - 0x34], esi
xor eax, eax
mov dword [ebp - 0x2c], eax
push 1
call sub.KERNEL32.dll_SetErrorMode
mov esi, eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push dword [0x441fd0]
call sub.KERNEL32.dll_WriteFile
test eax, eax
jne 0x41823c
xor ebx, ebx
push esi
call sub.KERNEL32.dll_SetErrorMode
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret