joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486e01
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
mov eax, dword [0x53dd0c]
mov edx, dword [0x53dd08]
cmp eax, edx
jbe 0x486e5c
call fcn.004867f4
push eax
push dword [ebp + 8]
call fcn.0045adbb
push dword [ebp + 8]
call fcn.00486da5
mov eax, dword [0x53dd04]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push 0x4000000
call fcn.00486a24
mov eax, dword [0x53dd0c]
sub eax, 0x14
mov dword [0x53dd0c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x53dd04], eax
mov eax, dword [0x53dd0c]
mov edx, dword [0x53dd08]
cmp eax, edx
jne 0x486e9b
mov eax, dword [0x53dd0c]
mov eax, dword [eax]
mov edx, eax
mov eax, 0xf000000
and eax, edx
cmp eax, 0x4000000
je 0x486e9b
mov eax, dword [0x53dd0c]
mov eax, dword [eax]
mov edx, eax
mov eax, 0xf000000
and eax, edx
cmp eax, 0x5000000
je 0x486e9b
jmp 0x486e9f
xor eax, eax
jmp 0x486ea2
xor eax, eax
inc eax
cmp eax, 0
je 0x486ec4
push dword [ebp + 8]
call fcn.0048760a
xor eax, eax
push eax
call fcn.0047623d
push 0xfffffffffffffffe
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
push dword [ebp + 8]
call fcn.004876b9
mov eax, 0x7fffffff
jmp 0x486ed4
leave
cmp dword [ebp - 4], eax
jb 0x486ed3
mov edx, eax
mov eax, dword [0x51502c]
mov dword [eax + 0x24], edx
mov edi, dword [ebp - 8]
cmp edi, 0
je 0x486ef0
jmp edi
pop edi
cmp edi, 0
je 0x486ef8
jmp edi
leave
ret 4
Function at 0x49272a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, 0x54a81c
mov dword [ebp - 0x14], str.0000000000000000000000000000000
mov eax, dword [ebp + 0x10]
sar eax, 1
mov edx, eax
mov eax, dword [ebp + 0xc]
mov cl, dl
shl eax, cl
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
jle 0x492778
mov eax, dword [ebp + 0xc]
inc eax
sar eax, 2
inc eax
shl eax, 2
sub esp, eax
and esp, 0xfffffffc
mov eax, esp
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004429fd
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and edx, 0xff
cmp eax, 0x27
je 0x4927cd
mov eax, dword [ebp - 0xc]
and edx, 0xff
cmp eax, 0x2c
jne 0x4927bd
mov eax, 0x2e
and eax, 0xff
mov dword [ebp - 0xc], 0x2e
mov eax, dword [ebp - 0xc]
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov byte [eax], dl
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
add eax, edx
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x49277e
mov al, 0
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov byte [eax], dl
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 0xc]
add eax, edx
push eax
push dword [ebp - 0x18]
call fcn.0048e3fe
xor al, 1
cmp eax, 0
je 0x492824
mov eax, 0xffffffff
xchg edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
push 0x7ff80000
push 0
fld qword [esp]
add esp, 8
jmp 0x492832
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.00441fb4
leave
ret 0x10

Function at 0x492ee2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov edx, eax
mov eax, 0xffffffff
cmp eax, edx
setne al
xor ah, ah
cwde
leave
ret 4

Function at 0x492f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
mov eax, 0
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x492f61
mov eax, 0xffffffff
jmp 0x492f64
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 0xc

Function at 0x492f6e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
mov eax, 0
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x492faf
mov eax, 0xffffffff
jmp 0x492fb2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 0xc
Function at 0x49a3f0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xe4
push 8
call fcn.0048764b
push eax
call fcn.004543ba
mov dword [ebp - 0xc], eax
call fcn.0048764b
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax]
add eax, 0x14
mov dword [ebp - 0x10], eax
mov eax, 0x9c
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax + 0x14], edx
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xb4]
mov al, byte [eax + 0x9a]
cmp al, 1
setne al
xor ah, ah
cwde
mov dword [ebp - 0xec], eax
push 0
push dword [ebp - 0x18]
push 8
push str.Windows
call fcn.004441d1
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 4]
cmp eax, 5
je 0x49a53b
cmp eax, 6
je 0x49a596
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a508
mov eax, dword [ebp - 0xe8]
cmp eax, 0x4f3d
jl 0x49a4d8
mov eax, str.Server_2022
jmp 0x49a506
mov eax, dword [ebp - 0xe8]
cmp eax, 0x42ee
jl 0x49a4ec
mov eax, str.Server_2019
jmp 0x49a506
xor eax, eax
inc eax
je 0x49a4f8
mov eax, str.Server_2016
jmp 0x49a506
call fcn.0049a4fd
mov eax, dword [ebp - 0xe8]
cmp eax, 0x55f0
jl 0x49a51c
mov eax, 0x54aa9c
jmp 0x49a536
xor eax, eax
inc eax
je 0x49a528
mov eax, 0x54aa9f
jmp 0x49a536
call fcn.0049a52d
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49a56a
cmp eax, 1
je 0x49a571
cmp eax, 2
je 0x49a578
call fcn.0049a561
mov eax, 0x54aa16
jmp 0x49a591
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a58c
mov eax, str.Server_2003_R2
jmp 0x49a591
mov eax, str.Server_2003
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49a5cc
cmp eax, 1
je 0x49a5e7
cmp eax, 2
je 0x49a602
cmp eax, 3
je 0x49a61d
call fcn.0049a5c3
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a5fb
mov eax, str.Server_2008_R1
jmp 0x49a600
mov eax, 0x54aa55
jmp 0x49a636
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a616
mov eax, str.Server_2012
jmp 0x49a61b
mov eax, 0x54aa63
jmp 0x49a636
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49a631
mov eax, str.Server_2012_R2
jmp 0x49a636
mov eax, 0x54aa74
Function at 0x5005ac
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 4

Function at 0x5019d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xf
je 0x5019fe
cmp eax, 5
je 0x501a35
mov dword [ebp - 0x20], 0
jmp 0x501aea
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
jmp 0x501aea
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
call fcn.0043d9e6
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call fcn.0043da1c
mov dword [ebp - 0x14], eax
jmp 0x501ac0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf
je 0x501a79
mov eax, dword [ebp - 0x1c]
cmp eax, 0x11
je 0x501a79
xor eax, eax
jmp 0x501a7c
xor eax, eax
inc eax
cmp eax, 0
je 0x501ab5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
xor al, 1
cmp eax, 0
je 0x501ad8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp eax, edx
jae 0x501ad8
jmp 0x501adc
xor eax, eax
jmp 0x501adf
xor eax, eax
inc eax
cmp eax, 0
jne 0x501a54
mov eax, dword [0x53dcfc]
mov dword [ebp - 0x18], eax
mov eax, 4
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
leave
ret 8

Function at 0x5024dd
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 5
je 0x50250b
cmp eax, 0xf
je 0x502539
mov eax, 0
jmp 0x502780
push dword [ebp + 8]
call fcn.0043d9e6
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.0043d912
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x502537
mov eax, 0
jmp 0x502780
jmp 0x50254b
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x50277d
Function at 0x504821
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xc], 0
mov eax, 1
mov dword [ebp - 0x28], 1
mov eax, 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [0x5489e8]
dec eax
mov edx, eax
mov eax, dword [0x5489e4]
add eax, edx
mov dword [ebp - 0x30], eax
jmp 0x5049df
call fcn.00504385
xor al, 1
cmp eax, 0
je 0x504881
jmp 0x5049e8
mov eax, dword [0x5489e4]
mov edi, dword [0x5489e8]
dec edi
mov al, byte [eax + edi]
mov byte [ebp - 0x2c], al
mov al, byte [ebp - 0x2c]
cmp al, 0x3c
jne 0x5048a6
mov dword [ebp - 0xc], 1
jmp 0x5049df
mov al, byte [ebp - 0x2c]
cmp al, 0x30
jb 0x5048b6
mov al, byte [ebp - 0x2c]
cmp al, 0x39
ja 0x5048b6
jmp 0x5048ba
xor eax, eax
jmp 0x5048bd
xor eax, eax
inc eax
cmp eax, 0
je 0x5048ef
mov eax, dword [ebp - 0x10]
push edx
mov edx, 0xa
mov ecx, edx
imul ecx
pop edx
mov dword [ebp - 0x10], eax
mov al, byte [ebp - 0x2c]
sub al, 0x30
mov edx, eax
mov eax, dword [ebp - 0x10]
and edx, 0xff
add eax, edx
mov dword [ebp - 0x10], eax
jmp 0x5049df
mov al, byte [ebp - 0x2c]
cmp al, 0x3b
jne 0x504917
mov eax, dword [ebp - 0x10]
xchg edx, eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
dec edi
mov dword [eax + edi*4], edx
mov eax, 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
mov al, byte [ebp - 0x2c]
cmp al, 0x40
jb 0x504935
mov al, byte [ebp - 0x2c]
cmp al, 0x7e
ja 0x504935
mov al, byte [ebp - 0x2c]
cmp al, 0x3c
je 0x504935
mov al, byte [ebp - 0x2c]
cmp al, 0x5b
je 0x504935
jmp 0x504939
xor eax, eax
jmp 0x50493c
xor eax, eax
inc eax
cmp eax, 0
je 0x5049d3
mov eax, dword [ebp - 0x10]
xchg edx, eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
dec edi
mov dword [eax + edi*4], edx
mov eax, 0
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x2c]
cmp al, 0x4d
je 0x50498a
cmp al, 0x6d
je 0x5049a3
cmp al, 0x52
je 0x5049bc
mov eax, dword [0x5489e8]
dec eax
mov edx, eax
mov eax, dword [0x5489e4]
add eax, edx
push eax
push dword [ebp - 0x30]
call fcn.005045c0
jmp 0x5049ce
mov eax, dword [ebp - 0x28]
cmp eax, 3
jne 0x5049a1
push dword [ebp - 0x24]
push 0
push dword [ebp - 0xc]
call fcn.005043b6
jmp 0x5049ce
mov eax, dword [ebp - 0x28]
cmp eax, 3
jne 0x5049ba
push dword [ebp - 0x24]
push 1
push dword [ebp - 0xc]
call fcn.005043b6
jmp 0x5049ce
mov eax, dword [ebp - 0x28]
cmp eax, 2
jne 0x5049ce
push dword [ebp - 0x24]
call fcn.0050459b
jmp 0x5049e8
mov al, byte [ebp - 0x2c]
cmp al, 0x1b
jne 0x5049df
jmp 0x5049e8
xor eax, eax
inc eax
jne 0x50486e
leave
ret
Function at 0x507dbc
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x24
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add eax, edx
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004429fd
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and edx, 0xff
cmp eax, 0x5b
je 0x507df9
mov eax, 0
jmp 0x5086ec
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 1
mov dword [ebp - 0x14], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, 0
mov dword [ebp - 0x1c], 0
mov eax, 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add eax, edx
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
Function at 0x5131cf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, 0
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
push 1
push dword [0x548e2c]
push dword [0x515008]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, eax
mov eax, 0
cmp eax, edx
jne 0x513214
mov eax, 0xffffffff
jmp 0x513356
mov eax, dword [0x548e2c]
mov al, byte [eax]
and eax, 0xff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0x80
cmp eax, 0
jne 0x513240
mov eax, 1
mov dword [ebp - 0x14], 1
jmp 0x5132a5
mov eax, dword [ebp - 0x10]
and eax, 0xe0
cmp eax, 0xc0
jne 0x51325d
mov eax, 2
mov dword [ebp - 0x14], 2
jmp 0x5132a5
mov eax, dword [ebp - 0x10]
and eax, 0xf0
cmp eax, 0xe0
jne 0x51327a
mov eax, 3
mov dword [ebp - 0x14], 3
jmp 0x5132a5
mov eax, dword [ebp - 0x10]
and eax, 0xf8
cmp eax, 0xf0
jne 0x513297
mov eax, 4
mov dword [ebp - 0x14], 4
jmp 0x5132a5
call fcn.0051329c

Function at 0x513755
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [0x548e80]
mov ecx, edx
cdq
idiv ecx
pop edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [0x548e80]
mov ecx, edx
cdq
idiv ecx
mov eax, edx
bt eax, 0x1f
jae 0x513793
bt ecx, 0x1f
jae 0x513791
neg ecx
add eax, ecx
pop edx
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.0051392b
cmp eax, 0
je 0x5137b9
mov eax, dword [0x548e80]
mov edx, dword [ebp - 0xc]
sub eax, edx
cmp eax, 1
jne 0x5137b9
jmp 0x5137bd
xor eax, eax
jmp 0x5137c0
xor eax, eax
inc eax
cmp eax, 0
je 0x5137da
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0xc], 0
mov eax, dword [0x548e24]
mov edx, dword [ebp - 0x10]
add eax, edx
shl eax, 0x10
mov edx, dword [ebp - 0xc]
or eax, edx
push eax
push dword [0x515004]
call dword [sym.imp.KERNEL32.DLL_SetConsoleCursorPosition]
leave
ret 0xc
Function at 0x513ca8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0x1f
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 2
jge 0x513ce3
mov eax, 2
mov dword [ebp - 0xc], 2
push dword [ebp + 8]
call fcn.004425f7
push eax
push dword [ebp + 0xc]
call fcn.004425f7
pop edx
xchg edx, eax
add eax, edx
push eax
push dword [ebp - 0xc]
pop eax
bsr eax, eax
pop edx
xchg edx, eax
mov cl, dl
shl eax, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [0x548e7c]
cmp eax, edx
jle 0x513d85
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [0x548e7c], eax
push dword [0x548e34]
call dword [sym.imp.MSVCRT.DLL_free]
add esp, 4
push dword [0x548e7c]
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [0x548e34], eax
mov eax, 0
mov edx, dword [0x548e34]
cmp eax, edx
jne 0x513d85
push 0
push dword [ebp - 0x14]
push 2
push 0
push str.Cannot_allocate_memory:_init_buffer:
push 6
push 0x18
lea esi, [esp + 4]
push esi
push 2
call fcn.004219c6
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [0x548e34]
mov dword [0x548e38], eax
leave
ret 8

Function at 0x514be5
Capabilities:
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push dword [ebp + 8]
call fcn.00442639
push eax
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
mov dword [ebp - 0xc], eax
mov eax, 0
mov edx, dword [ebp - 0xc]
cmp eax, edx
jne 0x514c2f
push 0
push str.SetConsoleTitle_failed_
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.004219c6
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
call fcn.00513847
call fcn.0051390a
push 5
push dword [0x54797c]
call fcn.0044c49f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov edx, eax
mov eax, 0
cmp eax, edx
je 0x514c75
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, 0
cmp eax, edx
je 0x514c75
xor eax, eax
jmp 0x514c78
xor eax, eax
inc eax
cmp eax, 0
je 0x514c9d
mov eax, 0x50
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, 0x32
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], edx
leave
ret 4
Function at 0x106994d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [ebp + 8], ebx
je 0x1069a5e
cmp dword [edi + 8], ebx
je 0x1069a5e
cmp dword [edi + 0x10], ebx
je 0x1069a5e
push ebx
push 0x80
push 1
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x1069a5e
mov ecx, dword [edi + 0x10]
cmp ecx, ebx
push esi
mov esi, dword [edi + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
jle 0x1069a48
cmp dword [edi + 0x18], ebx
je 0x1069a34
cmp dword [edi + 0xc], 0x28
jb 0x1069a4b
mov eax, dword [esi + 0x20]
mov edx, 0x4d42
shl eax, 2
mov word [ebp - 0x18], dx
lea edx, [eax + 0x36]
mov dword [ebp - 0xe], edx
lea edx, [ecx + 0xe]
mov dword [ebp - 0x16], edx
xor edx, edx
mov word [ebp - 0x12], dx
mov word [ebp - 0x10], dx
cmp dword [esi + 8], ebx
jne 0x1069a19
sub ecx, eax
movzx eax, word [esi + 0xe]
imul eax, dword [esi + 4]
add eax, 0x1f
cdq
and edx, 7
add eax, edx
mov edi, eax
add ecx, 0xffffffd8
sar edi, 3
and edi, 0xfffffffc
mov eax, ecx
xor edx, edx
div edi
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 8], eax
push ebx
lea eax, [ebp - 4]
push eax
push 0xe
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1069a4b
mov ecx, dword [ebp - 8]
push ebx
lea eax, [ebp - 4]
push eax
push ecx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1069a4b
xor ebx, ebx
inc ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x1d3b5268
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x311a7e1c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x406864
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406888
xor eax, eax
test eax, eax
je 0x40689b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40689b
xor ecx, ecx
jmp 0x40689e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069c1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dac], 0
push esi
jne 0x4069f8
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4069d2
mov dword [ecx*4 + 0x427da8], eax
inc ecx
cmp ecx, 0x100
jl 0x4069cd
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a29
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427da8]
xor eax, esi
inc ecx
dec edx
jne 0x406a0b
pop edi
not eax
pop esi
ret 0xc

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x731e066b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..rdata
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x3e3749a1
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x103bada4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103badae
pushal
call 0x103badb4
pop ebp
sub ebp, 0x10
sub ebp, 0x3bada4
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103badd8
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103bade1
mov eax, 0x3bada4
add eax, ebp
add eax, 0x63
mov ecx, 0x5ef
mov edx, 0xcee637ba
xor byte [eax], dl
inc eax
dec ecx
jne 0x103badf8
jmp 0x103bae0b
xor dword [edi + 0x31], esi
xor eax, dword [esi + 0x3bbababa]
jnp 0x103bae58
mov edx, 0x77b9baba
add bh, byte [esi + 0xbababa]
xchg edx, eax
mov edx, 0x584dbaba
mov ecx, 0xb63b3172
mov edx, 0x7fb9baba
ljmp 0xbe33
xor dword [edi], edi
mov dl, 0xba
mov edx, 0xb62f31ba
mov edx, 0x3731baba
stosb byte es:[edi], al
mov edx, 0x537bbaba
mov eax, 0x7839b88b
mov esi, 0x4e3fb5f3
inc ebp
inc ebp
inc ebp
out 0x78, eax
mov dh, 0xba
xor dword [esi], esi
sahf
mov esi, 0xd2bababa
xchg cl, al
mov ah, 0xba
rcr ah, cl
mov byte [edi - 0x61694446], dl
jmp 0x103baee5
push ebx
mov ch, 0x3e
stosd dword es:[edi], eax
mov edx, 0x3bdcbaba
inc ecx
inc ebp
lahf
mov ch, 0x3e
scasd eax, dword es:[edi]
mov edx, 0x53fbbaba
jbe 0x103baf40
inc ebp
inc ebp
xchg ebx, eax
test byte [ebx - 0x4084c645], 0x39
push edx
mov esi, 0x45450753
inc ebp
xchg ebx, eax
out dx, al
cmp dword [eax + 0x39bc7b39], 0x50
mov esi, 0x53bf5239
adc dword [ebp + 0x45], eax
inc ebp
out 0x78, eax
mov dh, 0xba
out dx, eax
xor dword [esi - 0x14], edx
in eax, dx
out dx, eax
xor edi, ecx
mov dh, 0x31
invalid
mov edx, 0xbabab801
mov edx, 0x3fb568b8
mov edi, 0x30bababa
lodsb al, byte [esi]
cld
test al, 0x68
mov ch, 0x39
bound eax, qword [ebp + 0x45]
inc ebp
mov eax, 0xbf3fb568
mov edx, 0xac30baba
cld
test al, 0x68
mov ch, 0x39
sar byte [edx + 0x7a89baba], 1
mov eax, 0xbf3fb568
mov edx, 0xac30baba
cld
test al, 0x68
mov ch, 0x39
nop
mov ebx, 0x68b8baba
mov ch, 0x3f
mov edi, 0x30bababa
lodsb al, byte [esi]
cld
test al, 0x68
test eax, 0xb568b87a
aas
mov edi, 0x30bababa
lodsb al, byte [esi]
cld
test al, 0x68
test eax, 0xb568b87a
aas
mov edi, 0x30bababa
lodsb al, byte [esi]
cld
test al, 0x68
test eax, 0xb568b87a
aas
mov edi, 0x30bababa
lodsb al, byte [esi]
cld
test al, 0x68
test eax, 0xbc3eb57a
mov edx, 0x6531baba
xchg ecx, eax
bound esi, qword [eax]
mov ecx, 0x1fdbd32
mov eax, 0x53bababa
retf 0x4545