joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b540
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412654
push 0x40b668
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x2000000
call fcn.0040e150
pop ecx
mov dword [0x414e08], eax
call fcn.0040d000
test eax, eax
je 0x40b5b1
mov dword [ebp - 4], 0
call fcn.0040d230
call fcn.0040d2f0
call fcn.0040d340
call fcn.0040d750
call fcn.0040d7f0
mov ebx, 0x413664
cmp ebx, 0x413664
jae 0x40b5cb
jmp 0x40b5be
push 0xfffffffffffffffe
call fcn.0040d8b0
pop ecx
jmp 0x40b64f
call dword [ebx]
add ebx, 4
cmp ebx, 0x413664
jb 0x40b5be
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
call fcn.0040d990
test byte [ebp - 0x34], 1
je 0x40b5f7
movzx edx, word [ebp - 0x30]
jmp 0x40b5fc
mov edx, 0xa
push edx
push eax
push 0
push ebx
call fcn.00401290
mov ebx, eax
mov esi, 0x413664
cmp esi, 0x413664
jae 0x40b622
call dword [esi]
add esi, 4
cmp esi, 0x413664
jb 0x40b615
push ebx
call fcn.0040d9d0
pop ecx
jmp 0x40b64f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d750
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0
jne 0x40d782
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push esi
call fcn.0040d5b0
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.0040c310
pop ecx
mov edi, eax
test edi, edi
je 0x40d7d7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [edi + eax*4]
push eax
push edi
push esi
call fcn.0040d5b0
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x414df0], eax
mov dword [0x414df4], edi
jmp 0x40d7df
push 0xfffffffffffffffc
call fcn.0040d8b0
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d7f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edx, eax
mov dword [ebp - 4], edx
test eax, eax
jne 0x40d810
mov eax, dword [0x414ec4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esi, eax
xor ecx, ecx
jmp 0x40d831
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x40d81e
lea edi, [eax + 1]
cmp byte [esi], 0x3d
je 0x40d82f
add ecx, edi
add esi, edi
cmp byte [esi], 0
jne 0x40d819
inc ecx
push ecx
call fcn.0040c310
pop ecx
mov ebx, eax
mov dword [0x414dfc], eax
cmp dword [0x414dfc], 0
je 0x40d89d
mov eax, dword [ebp - 4]
mov esi, eax
jmp 0x40d87f
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x40d85a
lea edi, [eax + 1]
cmp byte [esi], 0x3d
je 0x40d87d
mov ecx, ebx
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x40d870
pop eax
add ebx, edi
add esi, edi
cmp byte [esi], 0
jne 0x40d855
mov byte [ebx], 0
mov eax, dword [ebp - 4]
cmp eax, dword [0x414ec4]
je 0x40d8a5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x40d8a5
push 0xfffffffffffffffc
call fcn.0040d8b0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d8b0
Capabilities:
Print debug messages

Disassembly:
push ebx
mov eax, dword [esp + 8]
lea edx, [eax + 0x10]
cmp edx, 0xe
ja 0x40d92d
jmp dword [eax*4 + 0x4127d0]
mov ebx, str.unexpected_error
push 0x4150bc
push str.CRT:
call fcn.0040e230
add esp, 8
push 0x4150bc
push ebx
call fcn.0040e230
add esp, 8
push 0x4150bc
push 0x4127de
call fcn.0040e230
add esp, 8
push str.CRT:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.____terminating_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xff
call fcn.0040e260
pop ecx
pop ebx
ret
Function at 0x4115f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
mov edx, eax
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x411613
mov edx, ecx
push edx
push edi
push 0
push 1
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x4116c0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x4125a0
push 0x416260
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
test edi, edi
je 0x41171b
push 1
push 0
push edi
call fcn.004115f0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 0x416260
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov edi, eax
test edi, edi
je 0x411876
cmp edi, 0x400
jg 0x411876
push 0x400
push 0x415a60
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov edi, eax
test edi, edi
je 0x411876
cmp edi, 0x400
jg 0x411876
push 0x415a60
push 0x416260
push str._s_s_r_n
push 0x415660
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov dword [ebp - 8], eax
push 0x800
push 0x415a60
push str._WIN_
call dword [0x414b6c]
push 4
push 0xc0000000
push 0x415a60
call fcn.004115f0
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x411876
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add eax, dword [ebp - 8]
add eax, 0xa
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x41186d
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41186d
cmp esi, dword [ebp - 4]
jne 0x41186d
push str._Rename__r_n
push edi
call fcn.00411630
test eax, eax
je 0x41181b
add eax, 0xa
push 0x412588
push eax
call fcn.00411630
test eax, eax
je 0x411831
lea edx, [esi + edi]
lea ecx, [esi + edi]
add ecx, dword [ebp - 8]
cmp edx, eax
jbe 0x411814
mov bl, byte [edx]
mov byte [ecx], bl
dec edx
dec ecx
cmp edx, eax
ja 0x41180a
sub eax, edi
lea ebx, [eax + 1]
jmp 0x411833
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ebx, esi
jmp 0x411833
mov ebx, esi
push dword [ebp - 8]
push 0x415660
add ebx, edi
push ebx
call fcn.00411690
add esi, dword [ebp - 8]
push 0
push 0
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x411d60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
mov edx, dword [ebp + 8]
lea edi, [ebp - 0x208]
xor eax, eax
mov ecx, 0x104
rep stosw word es:[edi], ax
lea edi, [ebp - 0x410]
xor eax, eax
mov ecx, 0x104
rep stosw word es:[edi], ax
push edx
push 0x104
lea eax, [ebp - 0x410]
push eax
call fcn.0040cdf0
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
call fcn.00411c60
push 0x5c
lea eax, [ebp - 0x410]
push eax
call fcn.0040ce80
add esp, 8
mov esi, eax
xor edi, edi
test esi, esi
je 0x411e5a
lea eax, [ebp - 0x410]
neg eax
add eax, esi
sar eax, 1
inc eax
push eax
lea eax, [ebp - 0x410]
push eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call fcn.0040cea0
add esp, 0x10
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x411e2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xb7
je 0x411e42
push 0x5c
lea eax, [esi + 2]
push eax
call fcn.0040ce80
add esp, 8
mov esi, eax
jmp 0x411e52
cmp byte [0x419108], 0
je 0x411e42
lea eax, [ebp - 0x208]
push eax
push 1
call dword [0x414b80]
push 0x5c
lea eax, [esi + 2]
push eax
call fcn.0040ce80
add esp, 8
mov esi, eax
test esi, esi
jne 0x411dcc
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40599a
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], cl
jne 0x4059d9
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
add dword [eax], 0x21
fldcw word [ebx]
dec eax
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esp + ebp*2]
add byte [edx], cl
add ecx, 4
js 0x4059b4
pop eax
add byte [eax], al
pop ebx
ret
and eax, 0xc90f1200
bswap edx
cmp ecx, edx
add byte [eax], al
sal byte [esp + eax - 0x7b], 0xd2
wait
add byte [ecx], bh
rol bl, 1
push 0
push edx
mov dword [eax], eax
add byte [esp + 4], al
call fcn.0040d4ae
pop edx
mov eax, dword [esp]
jmp 0x405a12
add byte [eax], al
invalid

Function at 0x41e47a
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], cl
jne 0x41e4b9
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
add dword [eax], 0x21
fldcw word [ebx]
dec eax
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esp + ebp*2]
add byte [edx], cl
add ecx, 4
js 0x41e494
pop eax
add byte [eax], al
pop ebx
ret
and eax, 0xc90f1200
bswap edx
cmp ecx, edx
add byte [eax], al
sal byte [esp + eax - 0x7b], 0xd2
wait
add byte [ecx], bh
rol bl, 1
push 0
push edx
mov dword [eax], eax
add byte [esp + 4], al
call fcn.00425f8e
pop edx
mov eax, dword [esp]
jmp 0x41e4f2
add byte [eax], al
invalid

Function at 0x436f1a
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], cl
jne 0x436f59
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
add dword [eax], 0x21
fldcw word [ebx]
dec eax
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esp + ebp*2]
add byte [edx], cl
add ecx, 4
js 0x436f34
pop eax
add byte [eax], al
pop ebx
ret
and eax, 0xc90f1200
bswap edx
cmp ecx, edx
add byte [eax], al
sal byte [esp + eax - 0x7b], 0xd2
wait
add byte [ecx], bh
rol bl, 1
push 0
push edx
mov dword [eax], eax
add byte [esp + 4], al
call fcn.0043ea2e
pop edx
mov eax, dword [esp]
jmp 0x436f92
add byte [eax], al
invalid

Function at 0x44f61a
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], cl
jne 0x44f659
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
add dword [eax], 0x21
fldcw word [ebx]
dec eax
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esp + ebp*2]
add byte [edx], cl
add ecx, 4
js 0x44f634
pop eax
add byte [eax], al
pop ebx
ret
and eax, 0xc90f1200
bswap edx
cmp ecx, edx
add byte [eax], al
sal byte [esp + eax - 0x7b], 0xd2
wait
add byte [ecx], bh
rol bl, 1
push 0
push edx
mov dword [eax], eax
add byte [esp + 4], al
call fcn.0045712e
pop edx
mov eax, dword [esp]
jmp 0x44f692
add byte [eax], al
invalid
Function at 0x4574d6
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffef
sbb bh, byte [esi - 0x43]
or eax, 0xf4cdab1d
invalid
jbe 0x457519
xor al, 0x54
imul edi, dword [ebp - 1], 0x5b
out 0xbe, eax
jge 0x4574b1
imul edi, dword [esi], 0x77
fsub st(5)
adc byte [ebp - 0x4338638c], dh
int 0x3b
dec ebp
cmp al, 0xeb
imul edx, dword [ebx + 0x72423315], 0xffffffe2
jge 0x45756f
inc ecx
push 0xffffffffffffffaa
pushal
invalid
imul eax, dword [edx], 0x1ff74c3
pop esp
sbb al, 0xfd
or eax, 0xe75bbf0a
test dword [edi + 0x5dd325bc], eax
jecxz 0x457595
scasb al, byte es:[edi]
lea esp, [edi - 0x10144ed]
cmp edi, dword [esi]
adc eax, 0x93d1b8c5
mov ebp, 0x8bb9f129
fild word [ebx - 0x756c941]
mov al, byte [0x6a178cd8]
mov dl, 0x5e

Function at 0x467c8a
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], cl
jne 0x467cc9
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
add dword [eax], 0x21
fldcw word [ebx]
dec eax
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esp + ebp*2]
add byte [edx], cl
add ecx, 4
js 0x467ca4
pop eax
add byte [eax], al
pop ebx
ret
and eax, 0xc90f1200
bswap edx
cmp ecx, edx
add byte [eax], al
sal byte [esp + eax - 0x7b], 0xd2
wait
add byte [ecx], bh
rol bl, 1
push 0
push edx
mov dword [eax], eax
add byte [esp + 4], al
call fcn.0046f79e
pop edx
mov eax, dword [esp]
jmp 0x467d02
add byte [eax], al
invalid
Function at 0x46ff46
Capabilities:
Encode data using xor

Disassembly:
inc ebp
push eax
mov ch, 0x94
mov dword [ebp + 0xf], esp
mov dl, byte [ecx]
adc eax, 0x9e609a1e
inc edi
nop
retf
dec ebx
in eax, 0x96
sahf
xchg ebp, eax
xchg dl, dl
push edx
cmc
xchg edx, eax
mov byte [esi + 0x779e8d5a], dl
loop 0x46fe61
insd dword es:[edi], dx
push 0xffffffffffffff81
or esi, eax
jb 0x46feb6
mov dl, 0xe8
movsb byte es:[edi], byte [esi]
pop ebx
rol byte [0xff901ea], cl
ficom dword cs:[eax - 0x4ba2ad09]
jns 0x46fedb
jns 0x68411500
push edx
mov dh, 0xf2
xor eax, 0x88c0c7b7
mov esi, 0x892e991a
invalid
mov esi, ebx
fisubr word [esi]
pop edi
cmp dword [esi + ecx], edx
push cs
js 0x46fefd
invalid
call 0xc04a4a75
push edi
sub al, 0x3e
cld
xor byte [esi - 0x6f], bl
shr dword [esp - 0x38], 0x49
loopne 0x46ff54
rcr dword [edx - 0x13], cl
movsd dword es:[edi], dword [esi]
cdq
mov esi, 0xc243c745
xor esp, 0xffffffd4
and ebp, dword [edi]
push 9
push edi
pop eax
mov ch, 0xcb
rcr byte [ecx + 1], 0x74
rol byte [ebx + 9], cl
mov word [eax + edx + 0x75], ss
sub edx, edx
jge 0x46ffa3
xchg edi, eax
movsb byte es:[edi], byte [esi]
mov ebp, 0x75e4ad7d
insd dword es:[edi], dx
imul edx, dword [ecx + edx*8 - 0x6d], 0xffffffb0
pop edx
cmp ebx, dword [esi]
and al, 0x59
pop ecx
cmp ebx, edi
and al, 0x18
mov edi, 0x86f072ba
or esp, dword [edx - 1]
sub al, 0xec
in al, dx
jo 0x46fee2
jle 0x46ff2d
aad 0xf6
pop es
mov ebx, 0x6db730ee
imul esp, dword [edi - 0xac47926], 0xf2c96511
or ecx, dword [edi + 0x21]
or dword [edi + 0x6d], 0x49773d6a
lodsd eax, dword [esi]
adc dh, byte [ebp + 0x7c6b36e0]
neg dword [edi]
mov ch, 0xb5
xor al, 0x14
push eax
psubb mm3, qword [ecx]
sub eax, 0x93259822
mov fs, eax
ja 0x46ffbc
xchg ebp, eax
jo 0x470013
and byte [ebx + 0x61], 0x50
sal edi, cl
sbb ecx, dword [ebx + 0x53]
and byte [esi - 0x6c], cl
push esi
adc dh, byte [ebx + 0x3f]
aas
sub edi, ebx
invalid
inc ebp
jmp 0x46ffa0
scasd eax, dword es:[edi]
dec ebp
mov esi, dword [ecx + 0x4e220a14]
inc esp
jb 0x46ffb5
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
aam 0x23
push 0xc8c1cf4
mov ecx, dword [edi + 0x3f2f63a7]
push edx
mov edx, 0xcb57bf50
mov ecx, 0xccb5944d
push ds
aad 0xb5
jns 0x46ffdb
retf
iretd
bnd js 0x470072
push esi
dec ebp
mov esi, 0x302e86ee
nop
cwde
adc edi, dword [eax]
dec ecx
imul esp, dword [eax - 0x3381bf81], 0xffffff8a
pop ss
aam 3
mov ds, word [edi]
push edx
mov fs, word [ebx - 0x116338b4]
xchg dword [edx], edi
pushal
xchg byte [eax - 0x9a3f963], cl
int3
and al, byte [ecx - 0x53a9bed]
mov dword [0xdcf95995], eax
les ebx, [ebp + 0x5dbb4f94]
mov byte [0x7ac58471], al
inc eax
fisubr dword [eax]
wait
push edx
mov dword [0xc727693], eax
mov esp, 0xb48210b1
xor dword [ebp - 0x2c], edi
mov ebp, 0x935b6ae
mov edi, dword [ebx + 8]
push esi
mov byte [0x3ea4bdf7], al
loopne 0x47011b
dec edx
push eax
invalid
sub byte [ebx], bl
retf 0x5d8a
Function at 0x48069a
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], cl
jne 0x4806d9
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
add dword [eax], 0x21
fldcw word [ebx]
dec eax
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esp + ebp*2]
add byte [edx], cl
add ecx, 4
js 0x4806b4
pop eax
add byte [eax], al
pop ebx
ret
and eax, 0xc90f1200
bswap edx
cmp ecx, edx
add byte [eax], al
sal byte [esp + eax - 0x7b], 0xd2
wait
add byte [ecx], bh
rol bl, 1
push 0
push edx
mov dword [eax], eax
add byte [esp + 4], al
call fcn.004881ae
pop edx
mov eax, dword [esp]
jmp 0x480712
add byte [eax], al
invalid

Function at 0x49a0aa
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], cl
jne 0x49a0e9
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
add dword [eax], 0x21
fldcw word [ebx]
dec eax
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esp + ebp*2]
add byte [edx], cl
add ecx, 4
js 0x49a0c4
pop eax
add byte [eax], al
pop ebx
ret
and eax, 0xc90f1200
bswap edx
cmp ecx, edx
add byte [eax], al
sal byte [esp + eax - 0x7b], 0xd2
wait
add byte [ecx], bh
rol bl, 1
push 0
push edx
mov dword [eax], eax
add byte [esp + 4], al
call fcn.004a1bbe
pop edx
mov eax, dword [esp]
jmp 0x49a122
add byte [eax], al
invalid

Function at 0x4b2b6a
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], cl
jne 0x4b2ba9
push ebx
mov ebx, dword [eax - 4]
add byte [eax], al
sub ebx, dword [edx - 4]
push ebx
add dword [eax], 0x21
fldcw word [ebx]
dec eax
cld
sub eax, ecx
add byte [eax], al
mov ebx, dword [ecx + eax]
xor ebx, dword [esp + ebp*2]
add byte [edx], cl
add ecx, 4
js 0x4b2b84
pop eax
add byte [eax], al
pop ebx
ret
and eax, 0xc90f1200
bswap edx
cmp ecx, edx
add byte [eax], al
sal byte [esp + eax - 0x7b], 0xd2
wait
add byte [ecx], bh
rol bl, 1
push 0
push edx
mov dword [eax], eax
add byte [esp + 4], al
call fcn.004ba67e
pop edx
mov eax, dword [esp]
jmp 0x4b2be2
add byte [eax], al
invalid
Function at 0x4c790e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d0440
cmp edx, dword [eax]
je 0x4c7930
add eax, 8
inc ecx
cmp eax, 0x4d04d0
jl 0x4c7921
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d0440]
jne 0x4c7a5e
mov eax, dword [0x4d4b2c]
cmp eax, 1
je 0x4c7a38
test eax, eax
jne 0x4c7961
cmp dword [0x4d0384], 1
je 0x4c7a38
cmp edx, 0xfc
je 0x4c7a5e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c7998
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c8020
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c8250
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c79db
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c8250
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cbd18
push edi
call fcn.004c9a20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c8020
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c8030
lea eax, [ebp - 0xa0]
push 0x4cbcf8
push eax
call fcn.004c8030
push dword [esi + 0x4d0444]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c8030
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c9994
add esp, 0x2c
pop edi
jmp 0x4c7a5e
lea eax, [ebp + 8]
lea esi, [esi + 0x4d0444]
push 0
push eax
push dword [esi]
call fcn.004c8250
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x452330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404748
mov eax, dword [ebp - 8]
call fcn.00404748
xor eax, eax
push ebp
push 0x452407
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 4]
push esi
call sub.kernel32.dll_LoadLibraryW
test eax, eax
push esi
call sub.kernel32.dll_GetModuleHandleW
mov dword [0x5bdb9c], eax
cmp dword [0x5bdb9c], 0
je 0x4523e1
mov eax, dword [ebp - 8]
call fcn.00404758
push eax
mov eax, dword [0x5bdb9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5bdba0], eax
mov eax, dword [0x5bdba8]
push eax
push 0x40
push 0x15751a34
push 0x5bdba0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.nTDLL_ZwProtectVirtualMemory
mov edx, 0x5bdba0
mov eax, sub.kernel32.dll_GetCPInfo
mov ecx, 4
call fcn.00402c68
push 0x5bdba8
push 4
push sub.kernel32.dll_GetCPInfo
push 0x5bdba0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.ntdll_ZwWriteVirtualMemory
mov eax, dword [0x5bdb9c]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45240e
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042bc
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x488370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x48838e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x4b1074
push ecx
mov edi, eax
call fcn.0049c198
mov esi, eax
add esp, 8
test esi, esi
jne 0x4883cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0049c02e
push esi
call fcn.0049bfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x48b850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x48b8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x4b6720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x48b8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0049c1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x48b8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x4b6720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x48b92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0049d082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x48b957
mov word [eax], si
add eax, 2
push eax
call fcn.0049d030
add esp, 4
jmp 0x48b959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x48b8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x48b8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x48bff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret