joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a268
Capabilities:
Accept command line arguments

Disassembly:
push 0xc
mov eax, 0x413137
call fcn.00411e45
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x10]
xor ebx, ebx
push ecx
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x10], 2
mov esi, eax
je 0x40a29a
xor eax, eax
inc eax
jmp 0x40a391
mov eax, dword [esi + 4]
mov ecx, str._terminate
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40a2c8
test dx, dx
je 0x40a2c4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40a2c8
add eax, 4
add ecx, 4
test dx, dx
jne 0x40a2a2
mov eax, ebx
jmp 0x40a2cd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40a2db
call fcn.0040dba4
jmp 0x40a391
push dword [esi + 4]
lea ecx, [ebp - 0x14]
call fcn.00403925
mov dword [ebp - 4], ebx
mov edi, dword [0x41b51c]
test edi, edi
jne 0x40a317
push 0x1b0
call fcn.00410e0c
pop ecx
mov dword [ebp - 0x18], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040a755
mov edi, eax
mov byte [ebp - 4], bl
mov dword [0x41b51c], edi
push ebx
lea ecx, [ebp - 0x14]
call fcn.00401abc
push eax
mov ecx, edi
call fcn.0040aa82
test eax, eax
jne 0x40a332
test edi, edi
je 0x40a384
jmp 0x40a372
mov ecx, edi
cmp dword [edi + 0x5c], ebx
je 0x40a33d
push 0x10
jmp 0x40a360
call fcn.0040ade5
cmp dword [edi + 0x48], ebx
je 0x40a365
push ecx
mov ecx, esp
push 0x414c20
call fcn.00403925
push ecx
mov ecx, edi
call fcn.0040adac
push 0xe
mov ecx, edi
call fcn.0040ac12
mov ecx, edi
call fcn.0040ade5
mov ebx, dword [edi + 0x138]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x414370]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004015b2
mov eax, ebx
call fcn.00411e0e
ret

Function at 0x40a397
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x41b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push 0x28
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40a3fe
push edi
lea eax, [ebp - 0x10]
xor edi, edi
push eax
push str.SeDebugPrivilege
inc edi
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40a3fd
push esi
push esi
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
cmovne esi, edi
pop edi
cmp dword [ebp - 0x18], 0
je 0x40a40d
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00410c00
leave
ret
Function at 0x40aa82
Capabilities:
Check mutex on windows

Disassembly:
push 0x10
mov eax, 0x4131c9
call fcn.00411e45
mov edi, ecx
lea esi, [edi + 0x130]
push str.Unspecified_error___init.
mov ecx, esi
mov dword [ebp - 0x1c], esi
call fcn.00401a77
push dword [ebp + 8]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x18], eax
call fcn.00404ef3
test eax, eax
je 0x40aafc
mov ecx, dword [edi + 0x12c]
sub ecx, 0x10
call fcn.00401bdc
add eax, 0x10
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea ecx, [ebp - 0x10]
push ebx
mov dword [ebp - 4], ebx
call fcn.00401abc
push eax
push str.Error_reading_crash_info:__s
push esi
call fcn.00403c3f
mov ecx, dword [ebp - 0x10]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.004015b2
xor eax, eax
jmp 0x40abc1
push dword [ebp + 8]
lea esi, [edi + 0x1a8]
push 0x414e80
push esi
call fcn.00403c3f
add esp, 0xc
call fcn.004015d8
push eax
lea ecx, [ebp - 0x10]
call fcn.00401b64
xor ebx, ebx
mov dword [ebp - 4], 1
push ebx
mov ecx, esi
call fcn.00401abc
push eax
lea eax, [ebp - 0x10]
push str.LocalCrashRptEvent__s
push eax
call fcn.00403c3f
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [edi + 0x10]
lea ecx, [ebp - 0x14]
push str.RTLReading
push str.Settings
mov dword [edi + 0x1ac], eax
call fcn.00402d60
mov byte [ebp - 4], 2
push 0x415a84
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 0x10
test eax, eax
jne 0x40ab8d
push 1
call dword [sym.imp.USER32.dll_SetProcessDefaultLayout]
cmp dword [edi + 0x5c], ebx
jne 0x40abc9
push 1
mov ecx, edi
call fcn.0040ac12
xor ebx, ebx
mov eax, str.Success.
inc ebx
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.00401a77
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004015b2
lea ecx, [esi - 0x10]
call fcn.004015b2
mov eax, ebx
call fcn.00411e0e
ret 4
push 0x415a88
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40abea
mov eax, str.Another_CrashSender.exe_already_tries_to_resend_recent_reports.
jmp 0x40aba3
mov eax, dword [edi + 0xfc]
sub eax, dword [edi + 0xf8]
jne 0x40abff
mov eax, str.There_are_no_reports_for_us_to_send.
jmp 0x40aba3
mov ecx, dword [ebp - 0x18]
call fcn.00406cc2
test eax, eax
jne 0x40ab9b
mov eax, str.Not_enough_time_elapsed_to_remind_user_about_recent_crash_reports.
jmp 0x40aba3

Function at 0x40ac12
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x18c], eax
xor eax, eax
push eax
push eax
push esi
push 0x40ac50
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x140], eax
test eax, eax
pop esi
setne cl
mov eax, ecx
pop ebp
ret 4
Function at 0x40d3af
Capabilities:
Enumerate files on windows

Disassembly:
push 0x284
mov eax, 0x413716
call fcn.00411e79
mov dword [ebp - 0x264], ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x278], esi
call fcn.004015d8
push eax
lea ecx, [ebp - 0x274]
call fcn.00401b64
xor edi, edi
lea eax, [ebp - 0x274]
mov dword [ebp - 4], edi
push dword [esi + 4]
push str.Looking_for_files_using_search_template:__s
push eax
call fcn.00403c3f
mov eax, dword [ebp - 0x274]
add esp, 0xc
add eax, 0xfffffff0
push 1
push edi
push ecx
mov esi, esp
mov ecx, eax
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x270], eax
call fcn.00401bdc
mov ecx, dword [ebp - 0x264]
add eax, 0x10
add ecx, 0x148
mov dword [esi], eax
call fcn.004040b4
mov esi, dword [ebp - 0x278]
lea eax, [ebp - 0x260]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x268], eax
cmp eax, 0xffffffff
jne 0x40d47c
push 1
push edi
push ecx
mov ecx, esp
push str.Could_not_find_any_files_matching_the_search_template.
call fcn.00403925
mov ecx, dword [ebp - 0x264]
lea ecx, [ecx + 0x148]
call fcn.004040b4
jmp 0x40d5d5
push 0x5c
lea ecx, [esi + 4]
call fcn.00403587
push eax
push edi
lea eax, [ebp - 0x26c]
push eax
lea ecx, [esi + 4]
call fcn.004034f5
mov edi, dword [ebp - 0x264]
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x268]
lea ecx, [edi + 0x148]
call fcn.00404169
test al, al
jne 0x40d5bd
test byte [ebp - 0x260], 0x10
jne 0x40d5a7
push 0x414be8
lea edx, [ebp - 0x26c]
lea ecx, [ebp - 0x268]
call fcn.0040343f
pop ecx
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x268]
call fcn.004037f5
lea ecx, [ebp - 0x290]
call fcn.00404630
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28c]
call fcn.00403888
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x290]
call fcn.00401a77
mov edi, dword [ebp - 0x278]
lea ecx, [ebp - 0x288]
lea eax, [edi + 8]
push eax
call fcn.00403888
mov eax, dword [edi + 0xc]
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x284], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x280], eax
mov eax, dword [ebx + 4]
push ecx
cmp eax, dword [ebx + 8]
je 0x40d56a
mov ecx, eax
call fcn.00407ff3
add dword [ebx + 4], 0x18
jmp 0x40d572
push eax
mov ecx, ebx
call fcn.0040dd4e
mov ecx, dword [ebp - 0x264]
lea eax, [ebp - 0x290]
push eax
call fcn.0040cec5
lea ecx, [ebp - 0x290]
call fcn.0040636c
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x268]
lea ecx, [ecx - 0x10]
call fcn.004015b2
mov edi, dword [ebp - 0x264]
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40d4a7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x26c]
lea ecx, [ecx - 0x10]
call fcn.004015b2
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x270]
call fcn.004015b2
mov eax, edi
call fcn.00411e23
ret 8
Function at 0x40dba4
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x234
mov eax, 0x4137d7
call fcn.00411e79
call fcn.004015d8
push eax
lea ecx, [ebp - 0x240]
call fcn.00401b64
and dword [ebp - 4], 0
lea eax, [ebp - 0x240]
push 0x57b
push str.CrashSender_d.exe
push eax
call fcn.00403c3f
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, dword [ebp - 0x240]
cmp eax, 1
jne 0x40dc69
jmp 0x40dc56
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40dc56
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x234], eax
je 0x40dc56
push dword [ebp - 0x234]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x40dc12
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.004015b2
xor eax, eax
call fcn.00411e23
ret

Function at 0x40fb62
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040fa2a
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40fb9d
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
pop ecx
test eax, eax
je 0x40fb9d
push ebx
push ebx
jmp 0x40fc1b
push 2
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push 0
cdq
push 0
push edi
mov ebx, eax
mov dword [ebp - 4], edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov edx, dword [ebp - 4]
mov ecx, ebx
and ecx, edx
add esp, 0x1c
cmp ecx, 0xffffffff
jne 0x40fbd4
push 0
push 0
jmp 0x40fc1b
xor ecx, ecx
cmp edx, ecx
ja 0x40fc19
cmp ebx, 0xffffffff
jae 0x40fc19
mov eax, ebx
or eax, edx
jne 0x40fbeb
push ecx
push ecx
push 0xd
jmp 0x40fc1d
lea eax, [ebx + 1]
push eax
call fcn.004112c3
push edi
push ebx
push 1
push eax
mov dword [esi + 0x50], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x14
cmp eax, ebx
jne 0x40fbce
mov eax, dword [esi + 0x50]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.0040fd41
jmp 0x40fc26
push ecx
push ecx
push 5
push esi
call fcn.0040fc8f
add esp, 0x10
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40fed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x40], 0
je 0x40feef
push dword [ecx + 0x40]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
jmp 0x40ff2a
push esi
lea esi, [ecx + 0xd0]
mov eax, dword [esi + 0x1c]
mov ecx, esi
push edi
mov edi, dword [ebp + 0xc]
add eax, edi
push eax
call fcn.004109f2
mov ecx, dword [esi + 0x1c]
push edi
push dword [ebp + 8]
lea eax, [ecx + edi]
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
lea esi, [ecx - 1]
add esi, eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [esi + edi], 0
pop edi
pop esi
pop ebp
ret 8
Function at 0x40a210
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x411050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406cfe
and dword [ebp - 0x14], 0
cmp dword [0x412ba0], 0
mov dword [ebp - 0x18], eax
jne 0x40a2c3
push 0x402128
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a36b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40211c
push ebx
call edi
test eax, eax
je 0x40a36b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40210c
push ebx
mov dword [0x412ba0], eax
call edi
push eax
call esi
push 0x4020f8
push ebx
mov dword [0x412ba4], eax
call edi
push eax
call esi
push 0x4020dc
push ebx
mov dword [0x412ba8], eax
call edi
push eax
call esi
mov dword [0x412bb0], eax
test eax, eax
je 0x40a2c3
push 0x4020c4
push ebx
call edi
push eax
call esi
mov dword [0x412bac], eax
mov eax, dword [0x412bac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40a31c
cmp dword [0x412bb0], ecx
je 0x40a31c
push eax
call esi
push dword [0x412bb0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a31c
test ebx, ebx
je 0x40a31c
call edi
test eax, eax
je 0x40a313
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a313
test byte [ebp - 8], 1
jne 0x40a31c
or dword [ebp + 0x10], 0x200000
jmp 0x40a34f
mov eax, dword [0x412ba4]
cmp eax, dword [ebp - 0x18]
je 0x40a34f
push eax
call esi
test eax, eax
je 0x40a34f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a34f
mov eax, dword [0x412ba8]
cmp eax, dword [ebp - 0x18]
je 0x40a34f
push eax
call esi
test eax, eax
je 0x40a34f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x412ba0]
call esi
test eax, eax
je 0x40a36b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a36d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405bb1
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x53de00]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x10], 0x71
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 0xd], 0x6b
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x38
mov byte [ebp - 0xa], 0x76
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x46
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x77
mov byte [ebp - 5], 0x31
lea ecx, [ebp - 0x10]
push ecx
call 0x4c48c0
add esp, 4
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
push edx
call 0x4bfad9
add esp, 4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], 0
jmp 0x40107f
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xc
jae 0x40109b
mov edx, 0xc
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x28]
mov cl, byte [ebp + edx - 0x10]
mov byte [eax], cl
jmp 0x401076
mov dword [ebp - 0x2c], 0x80000002
jmp 0x4010ad
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0x80000005
jae 0x40114d
push 0
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x20]
call 0x4be410
push 4
lea ecx, [ebp - 0x20]
call 0x4be8e0
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call 0x4c1e20
add esp, 0xc
mov edx, dword [ebp - 0x24]
add edx, 4
mov dword [ebp - 0x24], edx
push 4
lea ecx, [ebp - 0x20]
call 0x4be900
push eax
mov eax, dword [ebp - 0x24]
push eax
call 0x4c1e20
add esp, 0xc
mov ecx, dword [ebp - 0x24]
add ecx, 4
mov dword [ebp - 0x24], ecx
push 4
lea ecx, [ebp - 0x20]
call 0x4be920
push eax
mov edx, dword [ebp - 0x24]
push edx
call 0x4c1e20
add esp, 0xc
mov eax, dword [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x24], eax
push 4
lea ecx, [ebp - 0x20]
call 0x4be940
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call 0x4c1e20
add esp, 0xc
mov edx, dword [ebp - 0x24]
add edx, 4
mov dword [ebp - 0x24], edx
jmp 0x4010a4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x4bfae2
mov esp, ebp
pop ebp
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10007c2e
pop dword [ebp - 0x10]
mov eax, 0xf23df2f1
sub eax, 0xe23d76c3
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd7a60274
add dword [ebp - 0x20], 0x76ac42d7
mov dword [ebp - 0x1c], 0x59dc5a6e
sub dword [ebp - 0x1c], 0x27a90e29
mov dword [ebp - 0x18], 0x3f0ae718
add dword [ebp - 0x18], 0xd415d16
mov dword [ebp - 0x14], 0x6225294d
add dword [ebp - 0x14], 0x9ddad6b3
lea eax, [ebp - 0x20]
push eax
mov eax, 0xf7484e42
sub eax, 0xe747cdee
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xaf4a1897
sub dword [ebp - 0x20], 0x3ad7af41
mov dword [ebp - 0x1c], 0x700baa2f
sub dword [ebp - 0x1c], 0x2e9f48ba
mov dword [ebp - 0x18], 0x14e62b08
add dword [ebp - 0x18], 0x4e894164
mov dword [ebp - 0x14], 0x6609ca4c
sub dword [ebp - 0x14], 0x6609ca4c
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x37fb50e9
sub eax, 0x27fad099
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3a4c6
push 0
call eax
mov ecx, 0x5686
mov esi, eax
mov edx, 0xb645e2cc
sub edx, 0xa644e8cc
add edx, dword [ebp - 0x10]
mov edi, 0x5f0ddc5d
sub dword [ebp - 4], eax
mov ebx, dword [edx]
add dword [ebp - 4], eax
xor ebx, edi
add dword [ebp - 4], 0x42e24d26
mov dword [esi], ebx
sub dword [ebp - 0xc], edi
add esi, 0xbe6e771e
sub esi, 0xbe6e771a
add edx, 0xfd4f8df6
sub edx, 0xfd4f8df2
loop 0x10007d44
add eax, 0xc37853ef
add eax, 0x3c88f8fc
mov ebx, eax
add eax, 0x88b21038
sub eax, 0x88b21033
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x45b07f
Capabilities:
Encode data using xor

Disassembly:
adc edi, dword [ecx]
shl dword [edx - 0x152109fe], 1
out 0xba, al
sbb byte [di - 0x2a], al
inc ebp
salc
aad 0xf4
or eax, 0x87c32dd9
xor al, 0x19
sti
in eax, dx
mov ch, 0xa4
wait
out dx, al
invalid
jne 0x45afa3
not dword [esp + eax*8 - 0x3f]
sbb bl, bh
loop 0x45b008
mov dword [0x40fa6d5b], eax
daa
adc al, 0xe4
in al, 0xbf
inc ecx
inc eax
invalid
xchg ebx, eax
jge 0x45b046
push edi
cmp al, 0x5f
pop edi
mov word [eax - 0x6c], ss
retf 0xd8f0
invalid
invalid
dec esp
insd dword es:[edi], dx
jg 0x45b0e6
cmpsd dword [esi], dword es:[edi]
jae 0x45b028
cmp byte [ebx], ch
dec edi
mov byte [0x8b24d398], al
invalid

Function at 0x4b94f9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1358
cmp edx, dword [eax]
je 0x4b951b
add eax, 8
inc ecx
cmp eax, 0x4c13e8
jl 0x4b950c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1358]
jne 0x4b9649
mov eax, dword [0x4c5cdc]
cmp eax, 1
je 0x4b9623
test eax, eax
jne 0x4b954c
cmp dword [0x4c1280], 1
je 0x4b9623
cmp edx, 0xfc
je 0x4b9649
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b9583
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9ee0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba370
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b95c6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba370
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be9b4
push edi
call fcn.004bc240
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9ee0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9ef0
lea eax, [ebp - 0xa0]
push 0x4be994
push eax
call fcn.004b9ef0
push dword [esi + 0x4c135c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9ef0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc1b4
add esp, 0x2c
pop edi
jmp 0x4b9649
lea eax, [ebp + 8]
lea esi, [esi + 0x4c135c]
push 0
push eax
push dword [esi]
call fcn.004ba370
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403b94
Capabilities:
Get common file path

Disassembly:
push 0x228
mov eax, 0x439513
call fcn.004219bf
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x234], eax
call fcn.0040bac9
push eax
lea ecx, [ebp - 0x220]
call main
xor ebx, ebx
lea eax, [esi + 8]
push ebx
push 0x43da1c
mov ecx, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x228], eax
call main
mov edi, dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
push ebx
push ebx
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov byte [ebp - 4], 1
call edi
xor ecx, ecx
mov esi, eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call main
mov ebx, eax
mov dword [ebp - 0x230], ebx
pop ecx
test ebx, ebx
je 0x403db1
lea ecx, [esi + esi]
push ecx
push 0
push ebx
call fcn.00421080
add esp, 0xc
push ebx
push esi
call edi
test eax, eax
setne al
test al, al
je 0x403db1
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.00421080
push str.TRANSFORMS_
lea eax, [ebp - 0x21c]
push 0x104
push eax
call main
push ebx
call main
mov esi, eax
lea eax, [ebp - 0x21c]
push eax
call main
add eax, 2
xor ecx, ecx
add esi, eax
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call main
mov edi, eax
add esp, 0x24
mov dword [ebp - 0x22c], edi
test edi, edi
je 0x403cd5
lea ecx, [esi + esi]
push ecx
push 0
push edi
call fcn.00421080
push ebx
push esi
push edi
call main
lea eax, [ebp - 0x21c]
push eax
push esi
push edi
call main
add esp, 0x24
mov eax, dword [ebp - 0x224]
cmp eax, 0xffffffff
jne 0x403d16
mov ecx, dword [ebp - 0x234]
and dword [ebp - 0x224], 0
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
jne 0x403d0d
lea eax, [ebp - 0x220]
push str.TRANSFORMS__
push eax
call main
pop ecx
pop ecx
jmp 0x403d97
push eax
push edi
push str.TRANSFORMS__s_s_
jmp 0x403d88
mov ecx, dword [ebp - 0x228]
add eax, 0xa
push eax
push 0x22
call main
mov esi, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x224], eax
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0
jne 0x403d53
push ecx
lea eax, [ebp - 0x220]
push 0x43da98
push eax
call main
add esp, 0xc
jmp 0x403d97
mov ecx, dword [ebp - 0x228]
push eax
push 0x5c
call main
cmp eax, 0xffffffff
jne 0x403d80
push ebx
push dword [esi]
lea eax, [ebp - 0x220]
push edi
push str._s_s__s_
push eax
call main
add esp, 0x14
jmp 0x403d97
push dword [esi]
push edi
push 0x43dab4
lea eax, [ebp - 0x220]
push eax
call main
add esp, 0x10
mov esi, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x228]
push esi
push dword [ebp - 0x224]
call main
jmp 0x403ddb
push ebx
call fcn.0040b4d1
pop ecx
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
jmp 0x403df0
and dword [ebp - 4], 0
push edi
call fcn.0040b4d1
push ebx
call fcn.0040b4d1
pop ecx
pop ecx
lea ecx, [esi - 0x10]
call fcn.00401856
call fcn.00421911
ret 4