joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
mov eax, dword [0x483038]
xor eax, esp
mov dword [esp + 8], eax
mov ebx, esp
lea eax, [esp + 4]
push ebx
push 0
push eax
push 0
push dword [esp + 0x34]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
test eax, eax
jne 0x43292f
cmp dword [esp + 4], 1
jne 0x43292f
mov ebp, dword [esp]
add ebp, 1
push 0
push 1
push ebp
call fcn.004306d0
add esp, 0xc
mov ecx, edi
mov edi, eax
push ebx
push eax
lea eax, [esp + 0xc]
push eax
push 0
push dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x432926
cmp dword [esp + 4], 1
jne 0x432926
mov eax, dword [esp]
cmp eax, ebp
jb 0x43291e
push 0x6c
push str._home_simon_mem_.build_workdirs_bob_fffbk9my_putty_windows_utils_registry.c
push str.size___allocsize
call fcn.0044edd0
add esp, 0xc
mov eax, dword [esp]
mov byte [edi + eax], 0
mov esi, edi
jmp 0x43292f
push edi
call fcn.00430760
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00441724
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x432950
Capabilities:
Set registry value

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
push ebx
call fcn.00452190
add esp, 4
add eax, 1
push eax
push ebx
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
pop esi
pop edi
pop ebx
ret

Function at 0x432990
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x483038]
xor eax, esp
mov dword [esp + 8], eax
mov ebp, esp
lea ebx, [esp + 4]
push ebp
push 0
push ebx
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
test eax, eax
jne 0x432a3c
cmp dword [esp + 4], 7
jne 0x432a3c
call fcn.00430ac0
mov edi, eax
mov eax, dword [esp]
add eax, 2
push eax
push edi
call fcn.004309e0
add esp, 8
push ebp
push eax
push ebx
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x432a33
cmp dword [esp + 4], 7
jne 0x432a33
push dword [esp]
push edi
call fcn.00430a20
add esp, 8
nop
nop
nop
nop
nop
nop
push 0
push edi
call fcn.00430a90
add esp, 8
test al, al
jne 0x432a10
mov eax, edi
add eax, 0xc
push 0
push eax
call fcn.00430410
add esp, 8
mov esi, edi
jmp 0x432a3c
push edi
call fcn.00430b20
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00441724
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x432a60
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 8]
add ecx, 1
push ecx
push dword [eax]
push 7
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
ret
Function at 0x432ad0
Capabilities:
Link many functions at runtime

Disassembly:
cmp byte [0x4861e0], 1
jne 0x432adf
mov al, byte [0x4861e1]
ret
mov byte [0x4861e0], 1
push str.advapi32.dll
call fcn.00432610
add esp, 4
mov dword [0x4861e4], eax
test eax, eax
je 0x432c27
push str.GetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4861e8], eax
test eax, eax
je 0x432c27
mov eax, dword [0x4861e4]
test eax, eax
je 0x432bed
push str.SetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4861ec], eax
test eax, eax
je 0x432c27
mov eax, dword [0x4861e4]
test eax, eax
je 0x432bf9
push str.OpenProcessToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4861f0], eax
test eax, eax
je 0x432c27
mov eax, dword [0x4861e4]
test eax, eax
je 0x432c05
push str.GetTokenInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4861f4], eax
test eax, eax
je 0x432c27
mov eax, dword [0x4861e4]
test eax, eax
je 0x432c11
push str.InitializeSecurityDescriptor
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4861f8], eax
test eax, eax
je 0x432c27
mov eax, dword [0x4861e4]
test eax, eax
je 0x432c1d
push str.SetSecurityDescriptorOwner
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x4861fc], eax
xor eax, eax
test ecx, ecx
je 0x432c29
mov ecx, dword [0x4861e4]
test ecx, ecx
je 0x432be1
push str.SetEntriesInAclA
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x486200], eax
test eax, eax
setne al
jmp 0x432c29
mov dword [0x4861ec], 0
jmp 0x432c27
mov dword [0x4861f0], 0
jmp 0x432c27
mov dword [0x4861f4], 0
jmp 0x432c27
mov dword [0x4861f8], 0
jmp 0x432c27
mov dword [0x4861fc], 0
xor eax, eax
mov byte [0x4861e1], al
ret

Function at 0x435410
Capabilities:
Link many functions at runtime

Disassembly:
push edi
push esi
cmp byte [0x486290], 0
jne 0x4354fe
push str.winspool.drv
call fcn.00432610
add esp, 4
mov esi, eax
push str.spoolss.dll
call fcn.00432610
add esp, 4
test esi, esi
je 0x4354aa
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumPrintersA
push esi
call edi
mov dword [0x48628c], eax
push str.OpenPrinterA
push esi
call edi
mov dword [0x486270], eax
push str.ClosePrinter
push esi
call edi
mov dword [0x486284], eax
push str.StartDocPrinterA
push esi
call edi
mov dword [0x486274], eax
push str.EndDocPrinter
push esi
call edi
mov dword [0x486280], eax
push str.StartPagePrinter
push esi
call edi
mov dword [0x486278], eax
push str.EndPagePrinter
push esi
call edi
mov dword [0x48627c], eax
push str.WritePrinter
push esi
call edi
jmp 0x4354f2
mov dword [0x48628c], 0
mov dword [0x486270], 0
mov dword [0x486284], 0
mov dword [0x486274], 0
mov dword [0x486280], 0
mov dword [0x486278], 0
mov dword [0x48627c], 0
xor eax, eax
mov dword [0x486288], eax
mov byte [0x486290], 1
pop esi
pop edi
ret
Function at 0x440790
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x108
mov esi, dword [esp + 0x120]
mov edi, dword [esp + 0x11c]
mov al, byte [esp + 0x124]
mov ecx, dword [0x483038]
xor ecx, esp
mov dword [esp + 0x104], ecx
xor ebp, ebp
mov ebx, 0
test al, al
je 0x4407e2
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xffffffff
cmp eax, 0x103
setb bl
mov al, byte [esp + 0x128]
mov dword [esi], 0x4c
test edi, edi
je 0x4407fb
xor ebp, ebp
cmp byte [edi], 0
cmovne ebp, edi
mov dword [esi + 0x2c], ebp
test al, al
je 0x44080b
push esi
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x440812
push esi
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov esi, eax
test edi, edi
je 0x440833
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xfffffefc
cmp eax, 0xfffffefc
ja 0x440833
mov byte [edi], 0
test bl, bl
je 0x440840
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test esi, esi
setne bl
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00441724
mov eax, ebx
add esp, 0x108
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x441180
Capabilities:
Get session user name

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x483038]
xor eax, esp
mov dword [esp + 4], eax
cmp byte [0x4862c0], 0
je 0x4411a8
mov ecx, dword [0x4862bc]
test ecx, ecx
jne 0x4411eb
jmp 0x441238
push str.secur32.dll
call fcn.00432610
add esp, 4
mov esi, eax
push str.sspicli.dll
call fcn.00432610
add esp, 4
test esi, esi
je 0x4411d8
push str.GetUserNameExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x4411da
xor ecx, ecx
mov dword [0x4862bc], ecx
mov byte [0x4862c0], 1
test ecx, ecx
je 0x441238
mov dword [esp], 0
mov edi, esp
push edi
push 0
push 8
call ecx
push 0
push 1
push dword [esp + 8]
call fcn.004306d0
add esp, 0xc
mov esi, eax
push edi
push eax
push 8
call dword [0x4862bc]
test al, al
je 0x44122f
push 0x40
push esi
call fcn.004444a0
add esp, 8
test eax, eax
je 0x441285
mov byte [eax], 0
jmp 0x441285
push esi
call fcn.00430760
add esp, 4
mov dword [esp], 0
mov edi, esp
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x441253
mov eax, dword [esp]
jmp 0x44125f
mov dword [esp], 0x100
mov eax, 0x100
push 0
push 1
push eax
call fcn.004306d0
add esp, 0xc
mov esi, eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x441285
push esi
call fcn.00430760
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00441724
mov eax, esi
add esp, 8
pop esi
pop edi
ret

Function at 0x441e6f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x441eae
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x441eae
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x441eae
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x441eae
cmp dword [ecx + 0x74], 0xe
jbe 0x441eae
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x452df0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x452e1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x452e1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x45319d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x470bf0
push 0x470be8
push str.FlsAlloc
push 0x1e
call fcn.004536fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4531d1
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x4531d7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x45321b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x470c00
push 0x470bf8
push str.FlsGetValue
push 0x20
call fcn.004536fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x453252
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4584f7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x458594
push ebx
push esi
call fcn.004585e5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00458440
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x458541
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x458593
push edi
push eax
call fcn.0045531f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x458561
call fcn.00454924
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x458592
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00458440
add esp, 0x20
test eax, eax
jne 0x458580
push edi
call fcn.00454924
jmp 0x458588
push ebx
call fcn.00454924
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x458597
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4585a8
pop esi
ret
push ebx
push edi
push esi
call fcn.004585e5
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0045531f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4585d0
push ebx
push esi
push edi
call fcn.00443dc0
add esp, 0xc
push 0
call fcn.00454924
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x45861c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00458627

Function at 0x458a15
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00458a20
Function at 0x45ac45
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x486a48]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45ac85
cmp byte [ebx], 0xa
jne 0x45ac85
or byte [eax + edi + 0x28], 4
jmp 0x45ac8a
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x45ad88
mov al, byte [edx]
cmp al, 0x1a
je 0x45ad6a
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x45acb9
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x45acde
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x45ace8
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x45ac9b
jmp 0x45ad88
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45ad65
cmp dword [ebp - 0xc], 0
je 0x45ad65
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x486a48]
test byte [eax + edi + 0x28], 0x48
je 0x45ad3f
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x45ad2a
mov byte [esi], dl
jmp 0x45ad3b
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x486a48]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x45ad88
cmp byte [ebp - 1], 0xa
jne 0x45ad4e
cmp esi, ebx
jne 0x45ad4e
mov byte [esi], 0xa
jmp 0x45ad87
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00460278
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x45ad88
mov byte [esi], 0xd
jmp 0x45ad87
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x486a48]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x45ad84
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x45ad88
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x45ad91
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x486a48]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45add4
cmp word [esi], dx
jne 0x45add4
or byte [edi + eax + 0x28], 4
jmp 0x45add9
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x45af2c
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x45af0c
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x45ae1b
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x45ae51
cmp eax, edx
jae 0x45ae5d
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x45adf3
jmp 0x45af2c
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45af08
cmp dword [ebp - 0x14], 0
je 0x45af08
mov eax, dword [ebx*4 + 0x486a48]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x45aee0
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x45aea9
mov word [esi], cx
jmp 0x45aedc
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x486a48]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x486a48]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x486a48]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x45af2c
pop ebx
cmp word [ebp - 4], bx
jne 0x45aef1
cmp esi, dword [ebp + 0xc]
jne 0x45aef1
mov word [esi], bx
jmp 0x45af29
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00460278
add esp, 0x10
cmp word [ebp - 4], bx
je 0x45af2c
push 0xd
jmp 0x45af25
mov ecx, dword [ebx*4 + 0x486a48]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x45af23
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x45af2c
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x45af39
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045af44
Function at 0x461673
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
pushal
pushfd
xor edi, edx
rol esi, 0x1b
ror eax, 0x17
xor ebx, eax
xchg ebx, eax
call fcn.004062c0
shr esi, 0xb
out dx, al
or ebp, eax
in eax, 2
invalid
push edi
ror byte [eax + 0x73], 0xcb
adc dh, byte [eax - 0x33]
push edi
ror byte [eax + 0x73], 0xcb
adc dh, byte [eax - 0x33]
and esi, edi
mov esi, eax
call fcn.00401255
rol edx, 0xf
test eax, 0x1568ced4
jb 0x461657
invalid
into
push 0x8be37215
jecxz 0x461600
mov esi, esp
rol eax, 0x12
ror ecx, 0x11
xor esi, dword [0x483bdb]
xchg esi, eax
dec esi
neg esi
and edi, 0xa1bcb99
mov edx, eax
xor esi, eax
and esi, edi
mov edx, ecx
rol eax, 0x13
test esp, esi
jo 0x46166f
hlt
xor esi, ebp
not ecx
dec eax
rol esi, 0x18
xor eax, esp
add edi, eax
call fcn.004244c3
mov ecx, 0x66123b
Function at 0x40b310
Capabilities:
Write file on windows

Disassembly:
add cl, byte [ebx + 0x4568bc7]
lea ecx, [ebp - 0x41]
push 0
add byte [ecx - 0x2e], dl
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b358
mov eax, dword [ebp - 4]
mov edx, dword [esi + 0x50]
mov eax, dword [esp + edx*2]
mov word [ebx - 0x7d], cs
enter 0x2b00, 0xfffffffffffffff8
add ebx, eax
mov dword [esi + 0x50], edx
test edi, edi
jmp fcn.0040b390
mov edi, dword [0xbc40c031]
cmp al, 0x6b
adc al, al
jne 0x40b369
mov dword [ebp + 8], eax
jmp 0x40b373
call edi
add eax, 0x2d0afc80
mov dword [ecx - 0x30574f8], ebp
mov edi, edx
cld
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
add ebx, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x50], edx
adc ecx, 0
test eax, eax
mov dword [esi - 0x77], ecx
pop es
mov dword [esi + 0x3c], 0x4b0000
cmp al, 0
add byte [ebx], cl
Function at 0x438694
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4997cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00431bf5
mov dword [ebp - 0x14], eax
cmp dword [0x49b660], edi
jne 0x438785
push 0x800
push edi
push 0x43eb08
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x438712
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x438865
push 0x43eb08
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x438865
push 0x43eb20
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x438865
push eax
call ebx
push 0x43eb2c
push esi
mov dword [0x49b660], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x43eb3c
push esi
mov dword [0x49b664], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x43eb50
push esi
mov dword [0x49b668], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49b670], eax
test eax, eax
je 0x438782
push 0x43eb6c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49b66c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4387aa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43879d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4387bf
push 4
pop eax
jmp 0x438867
cmp dword [ebp - 0x14], edi
je 0x4387bf
push dword [0x49b660]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4387a4
mov eax, dword [0x49b66c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x43881d
cmp dword [0x49b670], esi
je 0x43881d
push eax
call ebx
push dword [0x49b670]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43881d
test eax, eax
je 0x43881d
call ecx
test eax, eax
je 0x438812
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x438812
test byte [ebp - 8], 1
jne 0x43881d
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x43884d
mov eax, dword [0x49b664]
cmp eax, esi
je 0x43884a
push eax
call ebx
test eax, eax
je 0x43884a
call eax
mov edi, eax
test edi, edi
je 0x43884a
mov eax, dword [0x49b668]
cmp eax, esi
je 0x43884a
push eax
call ebx
test eax, eax
je 0x43884a
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x49b660]
call ebx
test eax, eax
je 0x438865
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x438867
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dbc5
leave
ret
Function at 0x40ed68
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x40eae0
mov ebx, ebx
mov ebx, 0x82424c23
call fcn.0040ed8a
or esi, esi
xor dword [ecx], eax
inc ecx
cmp ecx, edx
jne fcn.0040ed68
mov esi, 0x2044ba14
and ebx, esi
ret