joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d484
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44d49b
add esp, 0xfffffff0
call fcn.004039e8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b990
mov eax, dword [0x454e18]
cmp word [eax + 2], 0
jne 0x44d4c3
mov eax, dword [0x454e18]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044eb48
mov eax, dword [0x454eac]
cmp word [eax + 2], 0
jne 0x44d4dd
mov eax, dword [0x454eac]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044ed40
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4119f0]
call fcn.00403654
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4119f0]
call fcn.00403654
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41ddd8]
call fcn.0042531c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44d664
mov eax, dword [0x454d58]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004256ec
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44f2b0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x454d58]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ab54
test eax, eax
je 0x44d5d2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408b60
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ab7c
test eax, eax
je 0x44d5e6
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040471c
mov eax, dword [0x454c40]
cmp byte [eax], 0
jne 0x44d61a
mov eax, ebx
call fcn.0044d78c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044f48c
mov eax, ebx
call fcn.0044fdcc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44d65a
call fcn.00403a40
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44da00
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x456c00]
cmp dword [eax + 0x30], 0
je 0x44daaa
cmp dword [ebx + 0x94], 0
jne 0x44daa4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44d990
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44daa4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44da6a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44daa4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414090
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44da79
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44e588
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44e5bd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004045a4
jmp 0x44e5ca
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404508
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44f668
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44f6a9
mov eax, esi
call fcn.00435bdc
test al, al
je 0x44f6a9
mov eax, dword [ebx + 0x84]
call fcn.004358d8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44f6a9
push 0
mov eax, dword [ebx + 0x84]
call fcn.004358d8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4525ac
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x452640
push 0
mov eax, ebx
call fcn.00404964
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x45261b
mov eax, esi
call fcn.0040476c
inc eax
push eax
mov eax, esi
call fcn.00404964
push eax
push 1
push 0
mov eax, edi
call fcn.00404964
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x452636
mov ecx, dword [0x454d54]
mov dl, 1
mov eax, dword [0x450d00]
call fcn.0040a150
call fcn.00403f14
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x10001000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1f99
push 0x1001356f
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
test eax, eax
je 0x10001069
mov dword [ebp - 4], esp
mov eax, 0
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x1000401b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x10001069
push 6
call fcn.10004ec8
add esp, 4
mov eax, 0
jmp 0x10001073
mov esp, ebp
pop ebp
ret
Function at 0x100037a5
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x20
call fcn.10004ed4
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 3
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebp - 8], ebx
push 0x80000004
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x100037fb
mov eax, 0x10013243
push eax
push 1
mov ebx, 0x198
call fcn.100056a0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x1001325e
push dword [ebp - 0xc]
mov ecx, 2
call fcn.100011e7
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10003839
push ebx
call fcn.10004eda
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x1000384f
push ebx
call fcn.10004eda
add esp, 4
pop eax
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov ebx, dword [ebp - 4]
add ebx, 0x10
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov word [ebx], 0x37
mov dword [ebp - 8], esp
mov eax, dword [ebp - 4]
push eax
push 0x1e
call fcn.10004ed4
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
test eax, eax
je 0x100038a4
add eax, 8
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
test eax, eax
je 0x100038b5
add eax, 8
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x100038ff
push 6
call fcn.10004ec8
add esp, 4
push eax
mov ebx, dword [ebp - 0xc]
push ebx
mov edi, dword [ebp - 0x10]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
add edi, 8
add ebx, 8
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.1000376e
call fcn.10004eda
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
mov eax, 0
sete al
jmp 0x10003962
push eax
mov ebx, dword [ebp - 4]
push ebx
add ebx, 8
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x1000397a
push ebx
call fcn.10004eda
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x1000398e
push ebx
call fcn.10004eda
add esp, 4
pop ebx
add ebx, 0x10
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x100039a2
push ebx
call fcn.10004eda
add esp, 4
pop ebx
call fcn.10004eda
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100043c9
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x1c
call fcn.10004ed4
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
add ebx, 8
push ebx
push 0x40c
call fcn.10004ed4
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x10013408
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x101
rep stosd dword es:[edi], eax
add ebx, 4
push ebx
push 0x20c
call fcn.10004ed4
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x10013410
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x81
rep stosd dword es:[edi], eax
mov dword [ebp - 8], esp
mov eax, dword [ebp - 4]
push eax
push 0x614
call fcn.10004ed4
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x101
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x81
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
pop ebx
add ebx, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x100044e0
push 6
call fcn.10004ec8
add esp, 4
push eax
mov ebx, dword [ebp - 0xc]
push ebx
mov edi, dword [ebp - 0x10]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
add edi, 8
add ebx, 0x608
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.10004eda
add esp, 4
pop eax
mov ebx, dword [ebp - 4]
push ebx
add ebx, 8
push ebx
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x10004555
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x10004551
imul eax, dword [ebx]
jmp 0x10004546
mov ecx, eax
test ecx, ecx
je 0x10004574
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x1000456d
push ebx
push eax
call fcn.10004eda
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x1000455b
call fcn.10004eda
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x1000459e
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x1000459a
imul eax, dword [ebx]
jmp 0x1000458f
mov ecx, eax
test ecx, ecx
je 0x100045bd
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x100045b6
push ebx
push eax
call fcn.10004eda
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x100045a4
call fcn.10004eda
add esp, 4
pop ebx
call fcn.10004eda
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x10005760
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x10005773
xor eax, eax
pop esi
add esp, 8
ret
push esi
call fcn.10006640
add esp, 4
test eax, eax
jne 0x10005785
pop esi
add esp, 8
ret
mov eax, dword [esi]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x100057fc
mov eax, dword [esp + 0x1c]
mov edi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x1000582e
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x100057e8
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x100057b8
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 8
ret
cmp eax, 2
jne 0x1000582e
mov eax, dword [esp + 0x1c]
mov esi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x1000582e
lea edi, [esp + 0x2c]
lea ebx, [eax - 1]
mov eax, dword [edi]
mov edx, dword [esi]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, esi
call dword [edx + 0x24]
add edi, 0xc
dec ebx
jne 0x10005817
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret

Function at 0x10005b20
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x10005b2e
or eax, 0xffffffff
pop esi
ret
push esi
call fcn.10006640
add esp, 4
test eax, eax
jne 0x10005b40
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
or eax, 0xffffffff
cmp ecx, 1
jne 0x10005b5b
mov esi, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
ret
cmp ecx, 2
jne 0x10005b68
mov ecx, dword [esi + 4]
call fcn.10006f20
pop esi
ret
Function at 0x10005b70
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
jne 0x10005b83
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.10006640
add esp, 4
test eax, eax
jne 0x10005b95
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x24]
test edi, edi
jg 0x10005ba4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x10005bfb
mov ebx, dword [ebx + 4]
push edi
call fcn.10007376
add esp, 4
mov ebp, eax
lea eax, [esp + 0x18]
push esi
push eax
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10005bde
push ebp
call fcn.1000736b
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.100063d0
push ebp
mov esi, eax
call fcn.1000736b
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x10005c3d
mov ebx, dword [ebx + 4]
lea edx, [edi + 8]
push edx
call fcn.10005040
mov esi, eax
add esp, 4
lea ecx, [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], edi
mov eax, dword [ebx]
push edi
push ecx
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
jne 0x10005c3a
push esi
call fcn.100050d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10005cf0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0
push 0x20
push 3
push 0
push 3
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10005d18
pop edi
or eax, eax
pop esi
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], 0xffffffff
jne 0x10005d3a
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0x10006220
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x10006236
mov eax, 1
pop esi
add esp, 0xc
ret
push esi
call fcn.10006640
add esp, 4
test eax, eax
jne 0x1000624d
mov eax, 1
pop esi
add esp, 0xc
ret
mov eax, dword [esi]
push ebx
push ebp
cmp eax, 1
push edi
mov dword [esp + 0x10], 1
jne 0x100062fd
mov esi, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
mov ebx, eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x10006365
cmp edi, ebx
jae 0x10006365
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x10006365
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10006365
lea ecx, [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x2c]
push 1
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push edi
push esi
mov ebx, eax
call ebp
test ebx, ebx
je 0x10006365
mov al, byte [esp + 0x24]
test al, al
je 0x1000635d
cmp al, 0x1a
jne 0x10006365
pop edi
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
cmp eax, 2
jne 0x10006365
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.10006f20
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov edi, eax
cmp edi, ebx
jae 0x10006365
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x10006365
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10006365
mov edx, dword [esi]
lea eax, [esp + 0x24]
push 1
push eax
mov ecx, esi
call dword [edx + 0x20]
mov edx, dword [esi]
push 0
push edi
mov ecx, esi
mov ebp, eax
call dword [edx + 0x18]
test ebp, ebp
je 0x10006365
mov al, byte [esp + 0x24]
test al, al
je 0x1000635d
cmp al, 0x1a
jne 0x10006365
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x946df0
Capabilities:
Access peb ldr_data

Disassembly:
inc ecx
add eax, 0x508486fa
cmpsd dword [esi], dword es:[edi]
lodsb al, byte [esi]
lahf
invalid
and al, 0x79
pop dword [ecx + eax*8 - 0x38abeda3]
adc al, 4
mov dl, 0x6e
push es
mov ebx, 0x3d4eb9bd
sub eax, 0x9f1b57e2
inc eax
mov dword [reloc.USER32.dll_MessageBoxA], eax
push ds
adc byte [ebx + esi*2 - 0x1c], 0xae
jp 0x94103a
xor dword [edi + 0x7f], ecx
mov esi, 0x2398e41c
sahf
sbb ch, byte [edi - 0x13654455]
add ecx, dword [edi + edi]
jbe 0x940fd9
lodsb al, byte [esi]
dec edi
inc edi
fnsave dword [ecx]
inc eax
stosd dword es:[edi], eax
invalid
lea edx, [eax*4]
cld
mov al, ah
mov ebp, dword [esp]
mov dl, byte [esp]
call fcn.00943a91
lea ebp, [edi*4]
pop bp
btc ebp, ebx
xchg byte [esp + 0x15], cl
jmp 0x943b61
cmc
sub esp, 0x1c
lea esp, [esp + 0x30]
pushal
bswap ebp
rol di, cl
jmp 0x943ab0
add esp, 3
lea edi, [ecx*4]
xchg ah, bl
lea ebp, [edx*4]
mov al, 0x6e
lea ebp, [ecx + edi]
jmp 0x943b3a
add cx, 0x5a3e
cld
pop ax
bswap edi
mov si, word [esp + 1]
lea esp, [esp]
jmp 0x943b05
lea ebx, [ebp*4]
pop dx
mov ax, word [esp]
mov dl, byte [esp]
clc
mov edi, dword [esp]
jmp 0x943bcc
ror ecx, 9
add al, dh
mov edi, 0xf5cefa18
add esp, 0x11
lea eax, [eax - 0xa1]
pop ebp
jmp 0x943b26
inc dword [eax + 0x86c01e]
pushfd
sub esp, 0
push esp
sub esp, 0x10
jmp 0x943af5
mov ax, 0x6b9
mov al, ah
bsf bp, ax
add edi, ebp
mov edx, dword [esp]
call fcn.00943b98
dec ebp
fimul word [ebx + ebp - 0x1a]
imul eax, ecx
leave
sbb dword [esi - 0x75], esp
retf 0xcf0f
ror ecx, 0x19
mov cx, dx
bswap edi
btc ebp, edi
clc
mov cl, ch
jmp 0x943bb1
push eax
jmp 0x9440ee
call 0x9440f3
jmp 0x944bf4
lea ecx, reloc.USER32.dll_MessageBoxA
mov edx, ecx
add esp, 4
lea esp, [esp + 1]
popal
stc
add dword [ecx - 7], esp
call fcn.00944bac
jns 0x944b6b
not bh
xlatb
lea esp, [esp + 3]
xchg ah, bl
lea esi, [ecx*4]
btc ebp, ebx
lea ebx, [edx*4]
jmp 0x944b5d
lea esi, reloc.USER32.dll_MessageBoxA
neg eax
mov ebx, dword [esp + 5]
ror ah, 1
xchg byte [esp + 4], cl
sete dh
jmp 0x944b74
cmp dword [eax + reloc.USER32.dll_MessageBoxA], 0
jmp 0x944c89
pop eax
sub eax, 0x9440f3
jmp 0x944bda
lea esp, [esp + 8]
popal
jmp 0x940ffd
je 0x943b85
jne 0x944c6e
or dl, byte [edx + ecx - 0x7ee46393]
add dword [ecx + reloc.USER32.dll_MessageBoxA], edx
add edi, dword [edx - reloc.USER32.dll_MessageBoxA]
inc esp
and al, 3
xchg dword [esp], ebp
bswap ebp
pop cx
mov dword [esp + 3], eax
lea eax, [esi*4]
jmp 0x944bc3
call 0x94604e
jmp 0x946e2f
movzx ebx, word [eax + 0x3c]
jmp 0x946e6d
push esp
lea esp, [esp + 1]
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
jmp 0x946e93
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x946e51
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x946049
je 0x94609b
sub eax, 0x10000
jmp 0x946e33
in eax, dx
add ebx, eax
cmp word [ebx], 0x4550
je 0x943c66
jne 0x946e57
jle 0x946e6b
mov eax, dword [esi - reloc.USER32.dll_MessageBoxA]
cmpsb byte [esi], byte es:[edi]
push ebp
mov cl, 0x47
aam 0x4a
sub eax, 0x80c135dc
inc ebx
cli
aad 0x64
mov eax, dword [0x30]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x946e46
Function at 0x4013cf
Capabilities:
Encode data using xor

Disassembly:
jmp 0x411f5d
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x41207c
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebx, str.Soviet_aristo_baristo
mov ebp, 0x4f9448
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
sub byte [esi + edi], 0x70
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xef
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xfe
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0xee
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xdc
push ebx
push ebp
call fcn.00403490
add esp, 0x44
push eax
call fcn.004013b6
xor byte [esi + edi], 0xdf
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x7e
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x29
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0xb6
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0xd5
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x70
add esp, 0x40
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x67
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x4f
add esp, 0x24
inc esi
cmp esi, dword [esp + 0x18]
jb 0x411f7b
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x402946
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x41266f
sub esp, 0x20
mov eax, dword [0x4f7024]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + esi + 0x78]
add edi, esi
mov ebx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
add ebx, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4126ee
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401e2e
push str.Hardline
push 0x4f9530
call fcn.00402d60
push eax
call fcn.00406082
lea eax, [esp + 0x20]
push 0x36c
push eax
call fcn.00402cc5
add esp, 0x14
cmp eax, dword [esp + 0x38]
je 0x412708
lea ecx, [esp + 0x14]
add ebx, 4
call fcn.00402982
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x4126a0
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403030
add esp, 0x20
ret 8
mov eax, dword [edi + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00402982
jmp 0x4126f0
Function at 0x406000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x64
push 0x805cc408
call fcn.00401330
push eax
push 0x403840
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], 0x405960
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8