joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9e0b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a9e38
xor eax, eax
jmp 0x4a9e88
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0xc]
mov dword [esi], eax
cmp eax, ebx
jne 0x4a9e4e
xor eax, eax
jmp 0x4a9e87
push eax
mov dword [ebp - 8], ebx
call fcn.0046fc33
pop ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push dword [esi]
mov dword [ebp - 4], eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
cmp eax, dword [esi]
je 0x4a9e84
push dword [ebp - 4]
call fcn.004b77c3
pop ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
leave
ret

Function at 0x4b06b9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x4b06de
cmp eax, esi
jge 0x4b06d6
mov eax, edi
call fcn.004b00d6
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
mov esi, dword [edi + 8]
xor ecx, ecx
test esi, esi
jle 0x4b070b
mov eax, dword [edi + 0xc]
push ebx
mov dl, byte [edi + 0xc]
sub esi, 8
mov byte [ebp + ecx - 4], dl
shr eax, 8
mov ebx, esi
inc ecx
mov dword [edi + 0xc], eax
test ebx, ebx
jg 0x4b06eb
mov dword [edi + 8], ebx
pop ebx
cmp ecx, 4
jge 0x4b0727
mov esi, dword [edi + 4]
mov eax, dword [edi]
cmp eax, esi
jb 0x4b0718
xor dl, dl
jmp 0x4b071d
mov dl, byte [eax]
inc eax
mov dword [edi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x4b070e
movzx esi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl esi, 8
add esi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, esi
xor ecx, 0xffff
cmp eax, ecx
je 0x4b0759
mov eax, str.zlib_corrupt
call fcn.004ab97f
jmp 0x4b0795
mov eax, dword [edi]
add eax, esi
cmp eax, dword [edi + 4]
jbe 0x4b0769
mov eax, str.read_past_buffer
jmp 0x4b0752
mov eax, dword [edi + 0x10]
lea ecx, [eax + esi]
cmp ecx, dword [edi + 0x18]
jbe 0x4b077f
push esi
call fcn.004b0219
pop ecx
test eax, eax
je 0x4b0795
push esi
push dword [edi]
push dword [edi + 0x10]
call fcn.004ba8a0
add dword [edi], esi
add dword [edi + 0x10], esi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret

Function at 0x4b6111
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5441b4]
jne 0x4b611b
repz ret
jmp fcn.004c2764
Function at 0x4d0d56
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4d0d7d
call fcn.004bdcdd
mov dword [eax], esi
call fcn.004bdcca
push 0x16
pop esi
mov dword [eax], esi
call fcn.004c3100
mov eax, esi
jmp 0x4d0dd2
test dword [ebp + 0xc], 0xfffffff9
jne 0x4d0d63
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4d0daa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004bdcf0
pop ecx
call fcn.004bdcca
mov eax, dword [eax]
jmp 0x4d0dd2
test al, 0x10
jne 0x4d0dd0
test al, 1
je 0x4d0dd0
test byte [ebp + 0xc], 2
je 0x4d0dd0
call fcn.004bdcdd
mov dword [eax], 5
call fcn.004bdcca
mov dword [eax], 0xd
jmp 0x4d0da1
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4dc766
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5441b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004c69a9
and dword [ebp - 0x14], 0
cmp dword [0x547db8], 0
mov dword [ebp - 0x18], eax
jne 0x4dc819
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4dc8c1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x506414
push ebx
call edi
test eax, eax
je 0x4dc8c1
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x547db8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x547dbc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x547dc0], eax
call edi
push eax
call esi
mov dword [0x547dc8], eax
test eax, eax
je 0x4dc819
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x547dc4], eax
mov eax, dword [0x547dc4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4dc872
cmp dword [0x547dc8], ecx
je 0x4dc872
push eax
call esi
push dword [0x547dc8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4dc872
test ebx, ebx
je 0x4dc872
call edi
test eax, eax
je 0x4dc869
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4dc869
test byte [ebp - 8], 1
jne 0x4dc872
or dword [ebp + 0x10], 0x200000
jmp 0x4dc8a5
mov eax, dword [0x547dbc]
cmp eax, dword [ebp - 0x18]
je 0x4dc8a5
push eax
call esi
test eax, eax
je 0x4dc8a5
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4dc8a5
mov eax, dword [0x547dc0]
cmp eax, dword [ebp - 0x18]
je 0x4dc8a5
push eax
call esi
test eax, eax
je 0x4dc8a5
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x547db8]
call esi
test eax, eax
je 0x4dc8c1
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4dc8c3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b6111
leave
ret
Function at 0x30ed844
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x30ed90b
mov dword [esp + 0xc], eax
call fcn.030ed849

Function at 0x30ed853
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edi
pop word [esp]
mov word [esp], sp
lea esp, [esp]
jmp 0x30ed88a
lea esp, [esp + 2]
mov dword [esp + 8], edx
call fcn.030ed874
jmp 0x30ed8da
pushfd
mov word [esp + 4], bx
mov word [esp + 1], cx
jmp 0x30ed8eb
mov dword [esp + 0x10], ebx
call fcn.030ed92a

Function at 0x30ed86a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 2]
call fcn.030ed844

Function at 0x30ed8ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 3], bh
pop dword [esp]
push dword [esp + 1]
jae 0x30ed897
pushfd
mov word [esp + 4], bx
mov word [esp + 1], cx
mov dword [esp + 0x10], ebx
call fcn.030ed8f4
Function at 0x30ed8f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf30ded64
jmp 0x30ed97a
push di
lea esp, [esp + 2]
xchg dword [esp], ebp
push esi
jmp 0x30ed914
mov byte [esp], bl
push word [esp]
lea esp, [esp + 2]
lea ebp, [ebp + 0x21]
call fcn.030ed966
sbb eax, 0x89577f6c
push edi
mov dword [esp + 2], ecx
pop dword [esp]
jmp 0x30ed94f
push word [esp + 2]
jbe 0x30ed998
lea esp, [esp + 2]
mov dword [esp + 0x10], esp
jmp 0x30ed9a0
pushfd
jmp 0x30ed879
bsr bx, dx
jle 0x30ed9bb
mov bh, byte [esp]
bswap edi
jmp 0x30ed9d6
lea esp, [esp + 2]
mov dword [esp + 0x10], esp
call fcn.030ed96f
bswap edi
jmp 0x30ed9d6
mov bh, byte [esp]
jmp 0x30ed9a5
xchg dh, bh
jmp 0x30edab3
mov edi, dword [esp + 0x2c]
neg bx
jns 0x30ed9c0
xchg dh, bh
rcl si, 5
jmp 0x30edab7
mov dword [eax - 0x3a], edi
ficom word [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
lahf
inc esp
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x30ed974
add byte [eax], al
jmp 0x30edace
jp 0x30eda5b
not al
rdtsc
jmp 0x30eda5f
not al
rdtsc
call fcn.030eda8b
cld
insb byte es:[edi], dx
loop 0x30ed9ed
je 0x30eda30
ljmp 0xd8cc:0x7b88e979
rcl si, 5
lea ebp, [esp]
mov bx, 0xf1d8
neg ebx
jmp 0x30eda42
mov esi, esp
mov dh, bl
adc cx, 0xa70f
jne 0x30edb05
je 0x30edaef
pushfd
setg dl
or ebx, edx
and bl, byte [ebp - 0x54]
mov edi, 0x48b3186
and al, 0xe8
sar edi, cl
invalid
bsr cx, bx
mov ax, bp
jmp 0x30edb0c
bsr cx, bx
mov ax, bp
mov ebx, edi
lea ecx, [ecx + ebp]
rdtsc
jmp 0x30edb19
sub esp, 0xa
jle 0x30edb5a
lea esp, [esp + 2]
sub esp, 5
dec cl
jmp 0x30edb79
dec cl
xchg word [esp + 2], cx
xchg edx, eax
mov byte [esp + 3], dh
lea esp, [esp + 1]
jmp 0x30edb63
lea esp, [esp + 2]
sub esp, 5
jmp 0x30edb44
ror edi, 0
jne 0x30edb97
xchg dh, ah
jmp 0x30edb81
xchg word [esp + 2], cx
xchg edx, eax
jmp 0x30edb4c
mov ch, 0xd1
rdtsc
mov dx, 0x146f
jmp 0x30edba1
xchg dh, ah
mov ch, 0xd1
rdtsc
mov dx, 0x146f
jmp 0x30eddb9
sub esp, 7
jmp 0x30edbaf
sub esp, 0xd
jmp 0x30edc79
rcr ax, 1
lea esp, [esp + 0x20]
jmp 0x30edbe6
sub edi, 0x195e207b
bswap ecx
mov al, ch
lea edx, reloc.oleaut32.dll_SysFreeString
xchg dl, ah
jmp 0x30edc44
rcr dx, 6
je 0x30edbd9
rcr ax, 1
jmp 0x30edbdc
ror dh, 5
jmp 0x30edc22
ror dh, 5
add edi, dword [ebp]
call 0x30edc2b
mov ch, 0x66
pop dword [esp]
dec eax
jge 0x30edc54
lea esp, [esp + 2]
jmp 0x30edc59
sub edi, 0x6c982d08
mov edx, dword [esp]
bsr ecx, eax
jns 0x30edc1f
js 0x30edc09
jmp 0x30edd62
lea esp, [esp + 0x18]
xor edi, 0x22719caf
mov edx, eax
pushal
mov cx, dx
jmp 0x30edbfe
lea esp, [esp + 2]
jmp 0x30edc59
ror edi, 0
not ch
inc edx
js 0x30edba6
sub esp, 7
sub esp, 0xd
jmp 0x30edc79
Function at 0x30ed92a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf30ded64
jmp 0x30ed97a
push di
lea esp, [esp + 2]
xchg dword [esp], ebp
push esi
jmp 0x30ed914
mov byte [esp], bl
push word [esp]
lea esp, [esp + 2]
lea ebp, [ebp + 0x21]
call fcn.030ed966
sbb eax, 0x89577f6c
push edi
mov dword [esp + 2], ecx
pop dword [esp]
jmp 0x30ed94f
push word [esp + 2]
jbe 0x30ed998
lea esp, [esp + 2]
mov dword [esp + 0x10], esp
jmp 0x30ed9a0
pushfd
jmp 0x30ed879
bsr bx, dx
jle 0x30ed9bb
mov bh, byte [esp]
bswap edi
jmp 0x30ed9d6
lea esp, [esp + 2]
mov dword [esp + 0x10], esp
call fcn.030ed96f
bswap edi
jmp 0x30ed9d6
mov bh, byte [esp]
jmp 0x30ed9a5
xchg dh, bh
jmp 0x30edab3
mov edi, dword [esp + 0x2c]
neg bx
jns 0x30ed9c0
xchg dh, bh
rcl si, 5
jmp 0x30edab7
mov dword [eax - 0x3a], edi
ficom word [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
lahf
inc esp
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x30ed974
add byte [eax], al
jmp 0x30edace
jp 0x30eda5b
not al
rdtsc
jmp 0x30eda5f
not al
rdtsc
call fcn.030eda8b
cld
insb byte es:[edi], dx
loop 0x30ed9ed
je 0x30eda30
ljmp 0xd8cc:0x7b88e979
rcl si, 5
lea ebp, [esp]
mov bx, 0xf1d8
neg ebx
jmp 0x30eda42
mov esi, esp
mov dh, bl
adc cx, 0xa70f
jne 0x30edb05
je 0x30edaef
pushfd
setg dl
or ebx, edx
and bl, byte [ebp - 0x54]
mov edi, 0x48b3186
and al, 0xe8
sar edi, cl
invalid
bsr cx, bx
mov ax, bp
jmp 0x30edb0c
bsr cx, bx
mov ax, bp
mov ebx, edi
lea ecx, [ecx + ebp]
rdtsc
jmp 0x30edb19
sub esp, 0xa
jle 0x30edb5a
lea esp, [esp + 2]
sub esp, 5
dec cl
jmp 0x30edb79
dec cl
xchg word [esp + 2], cx
xchg edx, eax
mov byte [esp + 3], dh
lea esp, [esp + 1]
jmp 0x30edb63
lea esp, [esp + 2]
sub esp, 5
jmp 0x30edb44
ror edi, 0
jne 0x30edb97
xchg dh, ah
jmp 0x30edb81
xchg word [esp + 2], cx
xchg edx, eax
jmp 0x30edb4c
mov ch, 0xd1
rdtsc
mov dx, 0x146f
jmp 0x30edba1
xchg dh, ah
mov ch, 0xd1
rdtsc
mov dx, 0x146f
jmp 0x30eddb9
sub esp, 7
jmp 0x30edbaf
sub esp, 0xd
jmp 0x30edc79
rcr ax, 1
lea esp, [esp + 0x20]
jmp 0x30edbe6
sub edi, 0x195e207b
bswap ecx
mov al, ch
lea edx, reloc.oleaut32.dll_SysFreeString
xchg dl, ah
jmp 0x30edc44
rcr dx, 6
je 0x30edbd9
rcr ax, 1
jmp 0x30edbdc
ror dh, 5
jmp 0x30edc22
ror dh, 5
add edi, dword [ebp]
call 0x30edc2b
mov ch, 0x66
pop dword [esp]
dec eax
jge 0x30edc54
lea esp, [esp + 2]
jmp 0x30edc59
sub edi, 0x6c982d08
mov edx, dword [esp]
bsr ecx, eax
jns 0x30edc1f
js 0x30edc09
jmp 0x30edd62
lea esp, [esp + 0x18]
xor edi, 0x22719caf
mov edx, eax
pushal
mov cx, dx
jmp 0x30edbfe
lea esp, [esp + 2]
jmp 0x30edc59
ror edi, 0
not ch
inc edx
js 0x30edba6
sub esp, 7
sub esp, 0xd
jmp 0x30edc79

Function at 0x30eda8b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ch, cl
rcl esi, 0xa
mov eax, dword [esp]
sub esp, 0x1c
jmp 0x30edb2f
xchg dl, ch
xchg al, dl
lea ecx, [ebx*4]
mov ax, di
xchg dword [esp], ebx
jmp 0x30eda75
mov eax, dword [esp]
call 0x30edac2
lea ebx, [ebx - 0x38]
neg si
mov cx, sp
rdtsc
xchg edx, eax
xchg dword [esp + 0x1c], ebx
jmp 0x30edae7
Function at 0x30edbc6
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.030ed86a
sub esp, 0xc0
push edi
push edi
push word [esp + 6]
jge 0x30eda27
jl 0x30eda27

Function at 0x30f1ed3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], bx
lea eax, [ebp*4]
rdtsc
cmc
jmp 0x30f1ef6
jno 0x30f1f0c
stc
xchg ebx, edx
jmp 0x30f1fdc
stc
xchg ebx, edx
xchg ah, al
jmp 0x30f1fa7
mov eax, dword [esp]
jmp 0x30f1f7c
mov eax, dword [esp]
mov ax, word [esp]
cmc
mov ebx, edi
sbb edx, 0x2ef42f68
jmp 0x30f1f85
not edx
dec edi
rcl eax, 0x14
jl 0x30f1f3c
jge 0x30f1f45
sbb edx, 0x2ef42f68
jmp 0x30f1f85
mov ax, word [esp]
cmc
mov ebx, edi
jmp 0x30f1f66
ror edi, 0
sub esp, 0x12
jmp 0x30f1fba
ror bx, 8
mov eax, dword [esp + 0xe]
push word [esp + 1]
jmp 0x30f1fc6
dec edi
not ax
mov ebx, 0xa34e272e
mov eax, 0x47dcb436
mov ebx, dword [esp]
jmp 0x30f1f5c
jns 0x30f1f91
ror bx, 8
mov eax, dword [esp + 0xe]
jmp 0x30f1ff6
mov dx, 0x89f9
bswap ebx
ror edx, cl
jmp 0x30f205b
xchg ah, al
jmp 0x30f1fa7
push word [esp + 1]
mov dx, 0x89f9
bswap ebx
call fcn.030f1fe0
and byte [ebp + 0xbd1c], cl
add byte [eax], al
mov ax, word [esp]
mov ax, word [esp]
xchg dword [esp], esi
call fcn.030f20a0
arpl word [edx - 0x2642f09a], bx
rcl ecx, 0xf
jmp 0x30f1837
lea esp, [esp + 0x14]
sub edi, 0x4563cbcf
lea ebx, reloc.oleaut32.dll_SysFreeString
jmp 0x30f2079
rdtsc
mov ax, word [esp]
mov ax, si
mov edx, dword [esp]
add dh, 0xf8
jo 0x30f2158
jno 0x30f20f4
and al, 0xae
cmp al, 0x5b
mov dh, 7
ret
clc
push si
lea esp, [esp + 2]
jmp 0x30f20cf
mov edx, 0x8ec246e3
clc
push si
lea esp, [esp + 2]
jmp 0x30f2125
mov ah, byte [esp]
xchg dx, ax
jmp 0x30f2100
xchg dx, ax
lea ebx, [eax*4]
jmp fcn.030f212f
rol edi, 0
jge 0x30f20c3
mov edx, 0x8ec246e3
jmp 0x30f20a5
lea ebx, [eax*4]
jmp fcn.030f212f
add edi, dword [esi]
clc
jo 0x30f20d1
mov ah, byte [esp]
jmp 0x30f20dc
jmp 0x30f20f4

Function at 0x30fbb0a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x30fbafb
pushal
lea esi, [eax*4]
popal
pushfd
call fcn.030fbae5
push word [esp + 3]
jmp 0x30fbb6e
mov bl, byte [esp + 3]
lea ebx, reloc.oleaut32.dll_SysFreeString
mov dword [esp + 7], esi
jmp 0x30fbb9b
push edi
lea edi, [ebx*4]
push ebx
mov bl, cl
push esp
pushfd
jmp 0x30fbb3e
lea esp, [esp + 2]
lea esp, [esp + 4]
push ebx
setle bh
lea ebx, reloc.oleaut32.dll_SysFreeString
lea ebx, [ebx + ebx]
jmp 0x30fbb54
mov ebx, esi
mov edi, dword [esp]
mov di, word [esp]
xchg bx, di
xchg edi, ebx
jmp 0x30fbbf9
lea edi, reloc.oleaut32.dll_SysFreeString
not bh
mov edi, dword [esp]
mov esi, dword [esp]
mov esi, dword [esp + 7]
lea edi, [ecx + 0xe5]
jmp 0x30fbb85
mov edi, dword [esp + 0xc]
mov ebx, dword [esp]
setl bh
call fcn.030fbbda
call fcn.030fbc2b
Function at 0x312d624
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
jmp 0x312d692
call fcn.0312d43d
rol byte [edx - 0x54], 0x7d
jmp 0x312d475
jmp 0x312d6f5
wait
lds esp, [eax - 0x6b]
int3
lea esp, [esp + 3]
lea esp, [esp]
jmp 0x312d65c
lea esp, [esp + 1]
cmp word [eax + 0x18], dx
je 0x312d40c
jne 0x312d646
xor eax, dword [ebp + eax*8 + reloc.oleaut32.dll_SysFreeString]
fild dword [eax]
add byte [eax], al
std
adc cl, byte [ebp + 0x50666f1c]
mov dword [esp], esi
bsf si, si
stc
jmp 0x312d86a
lea esp, [esp + 8]
je 0x312d438
mov al, 0x77
mov ah, ch
clc
jmp 0x312d6e4
add esi, ecx
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x18], eax
jmp 0x312d6c4
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x312d422
je 0x312d438
xor eax, eax
jmp 0x312d4d6
popal
add edi, 0x78
mov esi, dword [edi]
pop edi
sub esp, 8
jmp 0x312d6da
push edi
pushal
btc di, ax
mov dword [esp], eax
jmp 0x312d70d

Function at 0x3192fa3
Capabilities:
Access peb ldr_data

Disassembly:
push dword [esp + 1]
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
jmp 0x3192fd8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x3192fc2
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x402ee4
pop dword [ebp - 0x20]
mov eax, 0x402ee4
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xeb36ceab
add dword [ebp - 0x30], 0x631b76a0
mov dword [ebp - 0x2c], 0x79d96ac
add dword [ebp - 0x2c], 0x2a95b599
mov dword [ebp - 0x28], 0x7462f59e
sub dword [ebp - 0x28], 0x2816b170
mov dword [ebp - 0x24], 0x8a911ffb
add dword [ebp - 0x24], 0x756ee005
lea eax, [ebp - 0x30]
push eax
mov eax, 0xef9ad375
sub eax, 0xef5a5271
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xa45179c4
sub dword [ebp - 0x30], 0x2fdf106e
mov dword [ebp - 0x2c], 0x59baf79c
add dword [ebp - 0x2c], 0xe7b169d9
mov dword [ebp - 0x28], 0x547cd49
add dword [ebp - 0x28], 0x5e279f23
mov dword [ebp - 0x24], 0x1b743800
add dword [ebp - 0x24], 0xe48bc800
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xb9f261c6
sub eax, 0xb9b1e0c6
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3dbe7
push 0
call eax
mov ecx, 0x33412cd0
sub ecx, 0x3340c9fb
xor edi, edi
add edi, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0x20]
mov edx, 0x561604d7
add edx, 0xf44ea7a7
add dword [ebp - 0x18], 0x67e26828
mov esi, dword [ebx]
xor esi, edx
mov dword [edi], esi
sub dword [ebp - 0x18], esi
add edi, 4
add ebx, 0x4a58945e
add ebx, 0xb5a76ba6
loop 0x402ffd
add eax, 0x79df2ed4
sub eax, 0x79ddb0ad
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x404b30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push 7
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.k_usrok
mov byte [ecx], 0
call fcn.004060d0
call fcn.0044ac40
add esp, 0x18
mov byte [esi + 0x3b1], 1
mov byte [esi + 0x3bc], 1
push 0
push 0
push 0x4c9
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404ba0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push 0xa
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.k_usrclose
mov byte [ecx], 0
call fcn.004060d0
call fcn.0044ac40
mov al, byte [esi + 0x3b0]
add esp, 0x18
mov byte [esi + 0x3b1], al
mov byte [esi + 0x3bc], 1
push 0
push 0
push 0x4c9
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404f10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push dword [ecx + 0x248]
mov byte [ecx + 0x3bc], 1
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 0x18
mov ecx, esp
push 0xd
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.k_unknowclose
mov byte [ecx], 0
call fcn.004060d0
call fcn.0044ac40
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x409130
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x3a8]
cmp dword [eax + 0x174], 3
jne 0x409165
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x469
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0xf060
push 0x112
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret
Function at 0x409950
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x469
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret

Function at 0x409980
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567290
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5b906c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x40]
push 4
push str.EULA
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
call fcn.00405cb0
mov byte [ebp - 4], 1
call fcn.00450310
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.0044fc50
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x409a09
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00406fa0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 1
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push str.explorer
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x409a40
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00406fa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00484900
mov esp, ebp
pop ebp
ret
Function at 0x40af20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5674e2
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5b906c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
call fcn.00481bda
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
jne 0x40afb4
mov dword [ebp - 0x18], str.bad_locale_name
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.00401b20
push eax
push esi
call fcn.00481f22
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4