joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ed68
Capabilities:
Encode data using xor

Disassembly:
test dword [eax], edx
or byte [esi - 0x4e5fb507], al
sal byte [edx - 0x63], 0x36
enter 0x453a, 0xffffffffffffffe0
jbe 0x41edb4
sbb eax, 0x3fde0b6b
rcl dword [esi + ebp*2 + 0x293ff649]
xchg esp, eax
invalid
sbb byte [eax + 0x20], cl
xchg ecx, eax
sub byte [edx], ah
xor byte [ebp + 0x38], al
cli
dec eax
and byte [ecx + 0x45302228], dl
cmp dl, bh
and al, 0x48
dec eax
push eax
xchg ecx, eax
pop eax
and ah, byte [eax + 0x44]
push 0x12788970
and byte [eax + ecx*4], 0x48
nop
xchg ecx, eax
cwde
and ah, byte [eax - 0x764f57bc]
mov eax, 0x225c012
jne 0x41edb3
sub byte [esp + eax - 0x72], ch
inc edi
add eax, 0x65946423
and esp, dword [esp + edx*4 + 0x65]
or al, cl
push 0xffffffffffffffe1
aam 0x77
inc eax
or al, 0x2c
inc esi
js 0x41ee18
test byte [eax - 0x6f3b86c8], cl
jb 0x41ede5
cmp esi, edx
jp 0x41ee32
hlt
inc esi
jle 0x41ee44
in al, 8
add cl, 0x1e
pop ecx
and byte [edx], dl
push ebp
fisub word [ebx + 0x20ce1134]
dec esi
out dx, al
xor dword [eax - 0x14], esi
sti
cdq
adc ah, bh
cld
or dword [esi + edx*8], ecx
add al, 0x20
dec eax
xor byte [edi + 0x64895044], bh
adc dh, byte [esp - 0x7c]
dec eax
cwde
xchg ecx, eax
test al, 0x22
mov eax, 0x89d8c844
call 0x864e264
std
add al, 0x18
dec eax
sub byte [ecx + 0x2ca683c], dl
xor al, 6
push ecx
add al, 0xb
dec eax
adc al, 0x27

Function at 0x41eecc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
lock add byte [eax + 0x18], al
sti
enter 0xffffffffffffcc10, 0xffffffffffffff9c
mov al, byte [0xdc11a45c]
xor ecx, dword [edx]
lock and dl, byte gs:[ecx]
add ah, byte [eax]
or byte [eax + 0x44], cl
or al, 0x20
mov dword [ecx], eax
adc bh, byte [eax]
and al, 0xf
dec eax
push eax
xchg ecx, eax
adc al, 0x22
inc esp
adc byte [ecx + ecx*4 + 0x12], bh
adc dl, byte [eax - 0x5bb7f6dc]
mov cl, 3
and byte [ecx + ebx*4 - 0x2fdee4ef], bh
adc bl, byte [esp + ecx*4]
pop eax
adc dword [ecx], edx
mov byte [ecx + ecx*2], dl
or dword [0xe242812], 0x1a913c48
and dl, byte [esp + eax*2 + 0xb]
push 0x84120389
and al, 0x13
dec eax
mov al, byte [0xc0221891]
inc esp
pop ss
aam 0x89

Function at 0x41ef30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add al, 0x12
call 0xf88a0d5b
xchg ecx, eax
sbb eax, 0x224a0c10
pop es
inc ebp
and al, 0x11
invalid
Function at 0x41f630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jnp 0x41e618
or al, 0x7c
mov al, al
in al, 0x64
jno 0x41e627
jge 0x41e620
loop 0x41e687
cmp dword [esp + ebx*2], ebx
cwde
xor byte [esi + 0x7e], al
sub esp, esp
or byte [edx + 0x20591ec1], al
adc dl, byte [ebp - 0x22]
mov dword [0x20ce1134], eax
adc esi, ecx
and byte [esi - 0x12], cl
mov word [esi + 0x22], es
jo 0x41e605
imul ebx, dword [eax + edx + 0x46b09a19], 0xc0451110
adc byte [ecx], bl
lcall 0xc045, 0x111046b0
add dl, byte [ecx]
shr byte [eax + 0x20abe004], 1
sub dl, byte [eax]
hlt
add esp, dword [eax]
mov esp, 0x211b1199
rcl byte [edx]
sbb al, 0x8c
mov eax, dword [ecx]
mov edx, dword [esp + 4]
sub eax, 0x10
push esi
mov esi, dword [eax + 4]
cmp esi, edx
jle 0x41f643
mov edx, esi
cmp dword [eax + 0xc], 1
pop esi
jle 0x41f653
mov dword [esp + 4], edx
jmp 0x41e680
mov eax, dword [eax + 8]
cmp eax, edx
jge 0x41f679
cmp eax, 0x400
jle 0x41f668
add eax, 0x400
jmp 0x41f66a
add eax, eax
cmp eax, edx
jge 0x41f670
mov eax, edx
mov dword [esp + 4], eax
jmp 0x41e700
ret 4

Function at 0x41fe30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jnp 0x41ee18
or al, 0x7c
mov al, al
in al, 0x64
jno 0x41ee27
jge 0x41ee20
loop 0x41ee87
cmp dword [esp + ebx*2], ebx
cwde
xor byte [esi + 0x7e], al
sub esp, esp
or byte [edx + 0x20591ec1], al
adc dl, byte [ebp - 0x22]
mov dword [0x20ce1134], eax
adc esi, ecx
and byte [esi - 0x12], cl
mov word [esi + 0x22], es
jo 0x41ee05
adc byte [ecx], bl
lcall 0xc045, 0x111046b0
add esp, dword [eax]
mov esp, 0x211b1199
rcl byte [edx]
sbb al, 0x8c
mov eax, dword [ecx]
mov edx, dword [esp + 4]
sub eax, 0x10
push esi
mov esi, dword [eax + 4]
cmp esi, edx
jle 0x41fe43
mov edx, esi
cmp dword [eax + 0xc], 1
pop esi
jle 0x41fe53
mov dword [esp + 4], edx
jmp 0x41ee80
mov eax, dword [eax + 8]
cmp eax, edx
jge 0x41fe79
cmp eax, 0x400
jle 0x41fe68
add eax, 0x400
jmp 0x41fe6a
add eax, eax
cmp eax, edx
jge 0x41fe70
mov eax, edx
mov dword [esp + 4], eax
jmp 0x41ef00
ret 4
Function at 0x430430
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jge 0x430452
mov eax, 0xfffffffd
jmp 0x4304ca
mov ebx, dword [0x10]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x430498
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x10]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x4304c0
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x4304ca
mov esp, ebp
pop ebp
ret 4

Function at 0x45f7d9
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword fs:[0x30]
mov al, byte [ecx + 2]
leave
ret
Function at 0x401cb0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
push edi
push 0x40715c
push 0x40ced4
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.00401890
call fcn.00401f10
mov ebx, dword [esp + 0x58]
xor esi, esi
push 0x70
push ebx
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], 0x401980
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 4
mov dword [esp + 0x44], ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push esi
mov dword [esp + 0x48], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x48], 6
mov dword [esp + 0x4c], esi
mov dword [esp + 0x44], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x54], 0x40ced4
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x401d44
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0x10
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push esi
mov dword [0x40ce50], ebx
call edi
mov ecx, dword [0x407a64]
push 1
sub eax, ecx
mov dword [0x407a1c], ecx
cdq
sub eax, edx
mov esi, eax
sar esi, 1
call edi
mov ecx, dword [0x407a68]
mov edi, dword [0x407a1c]
add ecx, 0x1e
push 0
sub eax, ecx
push ebx
mov edx, eax
mov eax, 0x55555556
imul edx
mov eax, edx
push 0
shr eax, 0x1f
add edx, eax
mov eax, 0x2e8ba2e9
mov dword [esp + 0x64], edx
imul edi
sar edx, 2
mov eax, edx
push 0
shr eax, 0x1f
add edx, eax
mov eax, 0x66666667
mov ebp, edx
imul edi
sar edx, 2
mov eax, edx
mov dword [0x407a20], ecx
shr eax, 0x1f
add edx, eax
mov eax, 0x66666667
sub edx, ebp
push ecx
mov dword [0x407ab4], edx
imul ecx
sar edx, 1
mov eax, edx
push edi
shr eax, 0x1f
lea edx, [edx + eax - 0xa]
lea eax, [ecx - 0x3c]
mov ecx, dword [esp + 0x70]
mov dword [0x407ab8], edx
push ecx
push esi
push 0xa0000
push 0x40ced4
push 0x40ced4
push 0
mov dword [0x407acc], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x401e19
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 0x10
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x65
push ebx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push 0
push 0x4016d0
push esi
push 0x75
push ebx
mov dword [0x40ce4c], eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea edx, [esp + 0x18]
push 0
push edx
call edi
test eax, eax
je 0x401ea1
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov ecx, dword [0x40ce4c]
lea eax, [esp + 0x10]
push eax
push ecx
push esi
call ebx
test eax, eax
jne 0x401e90
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
call edi
test eax, eax
jne 0x401e6b
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 0x10
Function at 0x401f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x40ce50]
push ebx
push ebp
push esi
push edi
push 0xa
xor esi, esi
push 0x81
push eax
mov dword [0x407a78], esi
mov dword [0x407ab0], esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x40ce50]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, esi
jne 0x401f50
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [esi]
mov ebp, dword [esi + 4]
push eax
call fcn.00402c89
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x401f7b
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebp
add esi, 8
push ebx
push esi
push 0x64
call fcn.00402a20
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x2e]
lea esi, [ebx + 0xe]
test eax, eax
jne 0x401fa6
mov cl, byte [esi + 0xe]
mov eax, 1
shl eax, cl
cmp word [esi + 0xe], 8
jbe 0x401fc7
mov ebp, dword [esi + 0x10]
mov eax, dword [esi + 0x20]
xor edx, edx
cmp ebp, 3
setne dl
dec edx
and edx, 3
add edx, eax
lea edi, [esi + edx*4 + 0x28]
jmp 0x401fcb
lea edi, [esi + eax*4 + 0x28]
mov eax, dword [0x407a10]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0
push esi
push edi
mov ebp, eax
push 4
push esi
push ebp
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
test eax, eax
mov dword [0x407a78], eax
jne 0x401ff5
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x407a60
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, 0xb
xor eax, eax
mov edi, 0x407a7c
rep stosd dword es:[edi], eax
mov eax, dword [0x407a64]
mov ecx, dword [0x407a68]
mov dword [0x407a80], eax
mov dword [0x407a7c], 0x28
lea eax, [eax + eax*2 + 3]
mov dword [0x407a84], ecx
and al, 0xfc
mov word [0x407a88], 1
imul eax, ecx
push eax
mov word [0x407a8a], 0x18
mov dword [0x407a90], eax
call fcn.00402c89
add esp, 4
mov dword [0x407ab0], eax
test eax, eax
jne 0x402068
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [0x407a68]
mov edx, dword [0x407a78]
push 0
push 0x407a7c
push eax
push ecx
push 0
push edx
push ebp
call dword [sym.imp.GDI32.dll_GetDIBits]
mov eax, dword [0x407a10]
push ebp
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
call fcn.00402c7e
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x404251
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x407470
cmp edx, dword [eax]
je 0x404273
add eax, 8
inc ecx
cmp eax, 0x407500
jl 0x404264
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x407470]
jne 0x4043a1
mov eax, dword [0x42d668]
cmp eax, 1
je 0x40437b
test eax, eax
jne 0x4042a4
cmp dword [0x4071a4], 1
je 0x40437b
cmp edx, 0xfc
je 0x4043a1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4042db
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004050c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404b30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40431e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404b30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x406544
push edi
call fcn.00405570
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004050c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004050d0
lea eax, [ebp - 0xa0]
push 0x406524
push eax
call fcn.004050d0
push dword [esi + 0x407474]
lea eax, [ebp - 0xa0]
push eax
call fcn.004050d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004054e5
add esp, 0x2c
pop edi
jmp 0x4043a1
lea eax, [ebp + 8]
lea esi, [esi + 0x407474]
push 0
push eax
push dword [esi]
call fcn.00404b30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4013f6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x150
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
call esi
push edx
mov dword [ebp - 0x124], eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x118], 6
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push edx
push edx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x11c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push ecx
push ecx
mov dword [esp], 0
mov dword [ebp - 0x120], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
lea eax, [ebp - 0x134]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push eax
mov dword [esp], 0
call esi
lea esi, [ebp - 0x10c]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathA]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
sub esp, 0x1c
call ebx
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 5]
push esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x401628
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.004013f6
test eax, eax
jne 0x4016c2
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x40212e
sub eax, 0x4016cc
mov dword [esp], 0x4016cc
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4016c2
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.0040136e
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.0040159c
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b400
mov dword [esp], 0x40300c
call fcn.00401e31
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x5d8e3e
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x5d8b64
push edx
pop eax
sub edx, eax
call fcn.005d8e73
sub edx, eax
sub edx, eax
xor dword [ebx], ecx
or eax, eax
and eax, eax
add ebx, 2
sub edx, eax
add eax, 1
sub edx, eax
cmp ebx, edi
jl fcn.005d8e3e
or eax, edx
ret
Function at 0x2f38bf7
Capabilities:
Set registry value

Disassembly:
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
cmp eax, 1
sbb eax, eax
neg eax
ret 8
Function at 0x2f3a784
Capabilities:
Read file via mapping

Disassembly:
push 0x2f29878
push 0x8000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x2f59460], eax
test eax, eax
jne 0x2f3a7b9
push 0x2f2507c
push 0x42d
push 0x2f25118
call sub.HWDLL.dll_Ordinal_26
xor eax, eax
push eax
push eax
push eax
push 6
push dword [0x2f59460]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x2f59318], eax
ret

Function at 0x2f3ab0b
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 0x11
sub esp, 0x244
push ebx
push esi
push edi
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
mov ebx, 0xffffffff
mov ecx, ebx
sub eax, eax
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], pe_nt_image_headers32
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp - 0x244]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x2f22acc
mov ecx, ebx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, ebx
lea edi, [ebp - 0x244]
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebx
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x2f59bf4]
push eax
push dword [ebp + 8]
call sub.HWDLL.dll_Ordinal_3
mov edi, eax
mov ecx, ebx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, ebx
lea edi, [ebp - 0x244]
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebx
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x2f59450
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x44]
push eax
xor eax, eax
push eax
lea ecx, [ebp - 0x244]
push eax
push 0x20
push eax
push eax
push eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2f3ae6f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x2f3af32
call sub.MSVCRT.dll__EH_prolog
sub esp, 4
push esi
push edi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x2f3aefa
test al, 0x10
jne 0x2f3aefa
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x2f3aeeb
test al, 1
je 0x2f3aeeb
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
push esi
lea eax, [ebp - 0x10]
push 0x401
mov dword [ebp - 4], edi
push eax
call sub.MFC42.DLL_AfxFormatString1
push edi
push 4
push dword [ebp - 0x10]
call sub.MFC42.DLL_AfxMessageBox
mov dword [ebp - 4], 0xffffffff
cmp eax, 7
jne 0x2f3aee6
call fcn.02f3aef2
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.02f3aef2
mov eax, 1
jmp 0x2f3aed4
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
push 0x13ad
push eax
call sub.MFC42.DLL_AfxFormatString1
push 0
push 0
push dword [ebp - 0x10]
call sub.MFC42.DLL_AfxMessageBox
mov dword [ebp - 4], 0xffffffff
call fcn.02f3af3c
jmp 0x2f3aed2
Function at 0x2f474c7
Capabilities:
Read file via mapping

Disassembly:
mov eax, 0x2f475d1
call sub.MSVCRT.dll__EH_prolog
sub esp, 8
push ebx
push esi
mov dword [ebp - 0x14], ecx
push edi
mov ebx, ecx
xor esi, esi
call fcn.02f43ab9
mov dword [ebp - 4], esi
mov dword [ebx], 0x2f26d04
mov eax, dword [0x2f59a54]
mov dword [0x2f59be8], ebx
mov dword [0x2f59a58], eax
cmp dword [0x2f59668], esi
jne 0x2f4754c
push 0x2f26c78
push 0x1000
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x2f59668], eax
cmp eax, esi
jne 0x2f47534
push 0x2f26cc4
push 0x68
push 0x2f26cb8
call sub.HWDLL.dll_Ordinal_26
xor eax, eax
push eax
push eax
push eax
push 6
push dword [0x2f59668]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x2f59bec], eax
mov eax, dword [0x2f59bec]
push 0x42d
mov dword [ebp - 0x10], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x9c], 0
call sub.HWDLL.dll_Ordinal_76
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
shr ecx, 2
mov esi, edi
mov edi, dword [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0x7e8
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 0x20]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, ebx
pop edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x2f51210
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2f2a048
push 0x2f51502
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x2f59c0c], 0xffffffff
mov eax, dword [0x2f59c0c]
mov dword [0x2f59c10], eax
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x2f592b8]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x2f592b4]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x2f59c08], eax
call fcn.02f51500
cmp dword [0x2f592b0], 0
jne 0x2f512a0
push 0x2f514f0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.02f514d0
push 0x2f5802c
push 0x2f58028
call sub.MSVCRT.dll__initterm
add esp, 8
mov eax, dword [0x2f592ac]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x2f592a8]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x2f58024
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x2f51314
mov al, byte [ebp - 0x40]
inc esi
mov al, byte [esi]
test al, al
je 0x2f5130c
cmp al, 0x22
jne 0x2f51301
cmp byte [esi], 0x22
jne 0x2f5131e
inc esi
jmp 0x2f5131e
cmp al, 0x20
jbe 0x2f5131e
inc esi
cmp byte [esi], 0x20
ja 0x2f51318
cmp byte [esi], 0
je 0x2f5132e
cmp byte [esi], 0x20
ja 0x2f5132e
inc esi
cmp byte [esi], 0
jne 0x2f51323
mov dword [ebp - 0x5c], 0
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x5c], 1
mov eax, 0xa
je 0x2f51355
mov eax, dword [ebp - 0x58]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x2f51398
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret