joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468b3c
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004689b3

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x408150
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
nop
push ebp
mov ebp, esp
mov eax, dword [esp + ecx]
mov ecx, dword [ebp + 1]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x18]
test eax, eax
ja 0x408172
jb 0x40816c
das
sti
push dword [edi + 4]
test ecx, ecx
xchg ebp, eax
and dword [ebp + 0x7c34bfa4], eax
or byte [ecx - 0x440005], al
jg 0x4081f4
mov edi, 0x81087c34
sti
invalid
sub al, byte [ebx + 0x257cfff8]
jg 0x40814f
cmp ebx, 0x803a00e1
jb 0x4081a8
test ecx, ecx
jne 0x4081ac
mov eax, dword [ebp + 0x1c]
mov bl, 0x55
adc al, 0x50
push edi
push edx
push ecx
and cl, ch
dec edi
invalid
test ecx, ecx
je 0x408220
mov esp, dword [ecx + 0x14]
invalid
ret
push ebp
mov ebp, esp
push ecx
invalid
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x400703ff
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1e091f83
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
cmp edi, 0
jbe 0x401e9c
xor ecx, ecx
test esp, esp
mov edx, dword [esi]
mov ebx, edx
and ebx, 0xff
xor bl, byte [eax + ecx]
and ebx, 0xff
shr edx, 8
xor edx, dword [ebx*4 + 0x418ed4]
mov dword [esi], edx
inc ecx
cmp ecx, edi
jb 0x401e78
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x4043f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
add esp, 0xfffffff4
mov edi, dword [ebp + 8]
call sub.KERNEL32.DLL_GetCommandLineW
mov esi, eax
xor ebx, ebx
mov byte [ebp - 0x10], 0
mov cl, 1
jmp 0x40444e
movzx eax, word [esi + ebx*2]
test eax, eax
je 0x404456
cmp eax, 0x22
je 0x404449
mov dl, byte [ebp - 0x10]
test dl, dl
jne 0x404429
cmp eax, 0x20
je 0x404434
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x404456
xor cl, cl
jmp 0x40444d
test cl, cl
je 0x40443e
mov byte [ebp - 0x10], 0
jmp 0x40444d
dec dword [ebp + 0x10]
mov byte [ebp - 0x10], 0
mov cl, 1
jmp 0x40444d
xor byte [ebp - 0x10], 1
inc ebx
cmp ebx, 0xffff
jbe 0x404410
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp - 0x14], eax
xor edx, edx
jmp 0x404496
mov ax, word [esi + ebx*2]
movzx ecx, ax
test ecx, ecx
je 0x4044a3
cmp byte [ebp - 0x10], 0
je 0x40447a
cmp ecx, 0x22
je 0x4044a3
cmp byte [ebp - 0x10], 0
jne 0x404485
cmp ecx, 0x20
je 0x4044a3
push eax
mov dword [ebp - 0x18], edx
call fcn.004018e0
mov edx, dword [ebp - 0x18]
mov byte [edi + edx], al
inc ebx
inc edx
cmp dword [ebp - 0x14], edx
jb 0x4044a7
cmp ebx, 0xffff
jbe 0x404464
mov byte [edi + edx], 0
sub esp, 0xfffffff4
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x404750
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
add esp, 0xfffffd00
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x100
lea eax, [ebp - 0x108]
push eax
push esi
push edi
call fcn.00404810
lea ecx, [ebp - 0x308]
push ecx
push 0x100
lea eax, [ebp - 0x108]
push eax
call fcn.00404d30
lea ecx, [ebp - 0x308]
push ecx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
push esi
push edi
push eax
call fcn.00407470
sub esp, 0xfffffd00
pop edi
pop esi
pop ebp
ret 8

Function at 0x404880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
add esp, 0xfffffe00
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x204]
push eax
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
je 0x4048c0
cmp eax, 0x100
ja 0x4048c0
push 0x100
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00401670
jmp 0x4048cf
push 1
push 0x41a7f0
call fcn.00407420
mov byte [edi], 0
sub esp, 0xfffffe00
pop edi
pop ebp
ret 8
Function at 0x405360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40546f
cmp eax, 0x40000000
jbe 0x405388
mov dword [ebp + 0x14], 0x40000000
mov ecx, dword [edi + 0x10c]
test ecx, ecx
je 0x405442
push edi
call fcn.00405190
cmp dword [ebp + 0x14], 0
jbe 0x405466
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
xor ebx, ebx
test esp, esp
mov eax, dword [edi + 0x110]
cmp dword [edi + 0x114], eax
jae 0x4053f7
cmp dword [ebp + 0x14], ebx
ja 0x4053cd
jmp 0x4053f7
cmp dword [ebp + 0x14], ebx
jbe 0x4053f7
mov eax, dword [edi + 0x10c]
mov ecx, dword [eax]
mov eax, dword [edi + 0x114]
mov dl, byte [esi + ebx]
mov byte [ecx + eax], dl
inc ebx
mov eax, dword [edi + 0x114]
inc eax
mov dword [edi + 0x114], eax
cmp dword [edi + 0x110], eax
ja 0x4053c8
mov eax, dword [edi + 0x114]
cmp dword [edi + 0x110], eax
jne 0x405437
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
mov eax, dword [edi + 0x10c]
push dword [eax]
push dword [edi + 0x104]
call sub.KERNEL32.DLL_WriteFile
push 0xff
push dword [ebp - 0x14]
push eax
call fcn.00407470
mov dword [edi + 0x114], 0
cmp dword [ebp + 0x14], ebx
ja 0x4053b0
jmp 0x405466
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0x14]
push esi
lea esi, [edi + 4]
push dword [edi + 0x104]
call sub.KERNEL32.DLL_WriteFile
push 0xff
push esi
push eax
call fcn.00407470
mov eax, dword [ebp + 0x14]
add dword [edi + 0x108], eax
sub esp, 0xfffffff8
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x405480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4055a0
cmp eax, 0x40000000
jbe 0x4054a5
mov dword [ebp + 0x14], 0x40000000
mov ecx, dword [edi + 0x10c]
test ecx, ecx
je 0x40555d
push edi
call fcn.00405130
lea ebx, [edi + 0x118]
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
xor esi, esi
jmp 0x405552
mov eax, dword [ebx]
cmp dword [edi + 0x114], eax
jb 0x405510
push 0
push ebx
push dword [edi + 0x110]
mov eax, dword [edi + 0x10c]
push dword [eax]
push dword [edi + 0x104]
call sub.KERNEL32.DLL_ReadFile
push 0xff
push dword [ebp - 0x14]
push eax
call fcn.00407470
mov dword [edi + 0x114], 0
mov ecx, dword [ebx]
test ecx, ecx
je 0x40558d
mov eax, dword [ebx]
cmp dword [edi + 0x114], eax
jae 0x405552
cmp dword [ebp + 0x14], esi
ja 0x405529
jmp 0x405552
cmp dword [ebp + 0x14], esi
jbe 0x405552
mov eax, dword [edi + 0x10c]
mov ecx, dword [eax]
mov edx, dword [edi + 0x114]
mov al, byte [ecx + edx]
mov ecx, dword [ebp + 0xc]
mov byte [ecx + esi], al
inc esi
mov eax, dword [edi + 0x114]
inc eax
mov dword [edi + 0x114], eax
cmp dword [ebx], eax
ja 0x405524
cmp dword [ebp + 0x14], esi
jne 0x4054cc
jmp 0x40558d
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0xc]
lea esi, [edi + 4]
push dword [edi + 0x104]
mov dword [ebp - 0x10], 0
call sub.KERNEL32.DLL_ReadFile
push 0xff
push esi
push eax
call fcn.00407470
mov esi, dword [ebp - 0x10]
add dword [edi + 0x108], esi
test esi, esi
sete al
mov byte [edi + 0x11c], al
jmp 0x4055a2
xor esi, esi
mov eax, esi
sub esp, 0xfffffff8
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x406480
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push dword [0x41d294]
call fcn.00406380
mov eax, dword [0x41d290]
cmp eax, 0x270
jb 0x406567
xor ecx, ecx
cmp esp, 0
mov eax, dword [ecx*4 + 0x41d298]
and eax, 0x80000000
mov edx, dword [ecx*4 + 0x41d29c]
and edx, 0x7fffffff
or edx, eax
mov eax, edx
shr eax, 1
xor eax, dword [ecx*4 + 0x41d8cc]
and edx, 1
xor eax, dword [edx*4 + 0x41aa18]
mov dword [ecx*4 + 0x41d298], eax
inc ecx
cmp ecx, 0xe2
jbe 0x4064a8
mov ecx, 0xe3
test esp, esp
mov eax, dword [ecx*4 + 0x41d298]
and eax, 0x80000000
mov edx, dword [ecx*4 + 0x41d29c]
and edx, 0x7fffffff
or edx, eax
mov eax, edx
shr eax, 1
xor eax, dword [ecx*4 + 0x41cf0c]
and edx, 1
xor eax, dword [edx*4 + 0x41aa18]
mov dword [ecx*4 + 0x41d298], eax
inc ecx
cmp ecx, 0x26e
jbe 0x4064f0
mov eax, dword [0x41dc54]
and eax, 0x80000000
mov edx, dword [0x41d298]
and edx, 0x7fffffff
or edx, eax
mov eax, dword [0x41d8c8]
mov ecx, edx
shr ecx, 1
xor ecx, eax
and edx, 1
xor ecx, dword [edx*4 + 0x41aa18]
mov dword [0x41dc54], ecx
xor eax, eax
push dword [0x41d294]
mov ecx, dword [eax*4 + 0x41d298]
inc eax
mov dword [0x41d290], eax
mov eax, ecx
shr eax, 0xb
xor eax, ecx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, eax
mov eax, ecx
shl eax, 0xf
and eax, 0xefc60000
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
mov esi, ecx
xor esi, eax
call fcn.004063c0
test edi, edi
je 0x4065b4
mov eax, esi
xor edx, edx
div edi
mov esi, edx
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
Function at 0x4065c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
add esp, 0xffffffd8
push dword [0x41d294]
call fcn.00406380
mov dword [0x41d298], 0x12bd6aa
mov dword [0x41d29c], 0x82d2ab13
mov eax, 2
mov ecx, dword [eax*4 + 0x41d294]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x41d298], edx
lea ecx, [eax + 1]
mov ebx, edx
shr ebx, 0x1e
xor ebx, edx
imul ebx, ebx, 0x6c078965
add ebx, ecx
mov dword [ecx*4 + 0x41d298], ebx
add eax, 2
cmp eax, 0x26f
jbe 0x4065ec
lea ecx, [ebp - 0x18]
push ecx
mov dword [0x41d290], 0x270
call fcn.00403050
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
call fcn.00402a70
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.004030f0
mov dword [ebp - 0x2c], eax
call fcn.004030e0
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], ebx
mov ecx, 3
mov eax, 1
xor edx, edx
jmp 0x40668e
mov ecx, ebx
mov ebx, dword [eax*4 + 0x41d294]
mov esi, ebx
shr esi, 0x1e
xor esi, ebx
imul esi, esi, 0x19660d
xor esi, dword [eax*4 + 0x41d298]
add esi, dword [ebp + edx*4 - 0x24]
add esi, edx
mov dword [eax*4 + 0x41d298], esi
inc eax
inc edx
cmp eax, 0x270
jb 0x4066d0
mov ebx, dword [0x41dc54]
mov dword [0x41d298], ebx
mov eax, 1
cmp edx, 3
jb 0x4066d7
xor edx, edx
lea ebx, [ecx - 1]
cmp ecx, 1
jne 0x40668c
mov ecx, 0x26f
jmp 0x4066ea
mov ecx, edx
mov edx, dword [eax*4 + 0x41d294]
mov ebx, edx
shr ebx, 0x1e
xor ebx, edx
imul ebx, ebx, 0x5d588b65
xor ebx, dword [eax*4 + 0x41d298]
sub ebx, eax
mov dword [eax*4 + 0x41d298], ebx
inc eax
cmp eax, 0x270
jb 0x406727
mov edx, dword [0x41dc54]
mov dword [0x41d298], edx
mov eax, 1
lea edx, [ecx - 1]
cmp ecx, 1
jne 0x4066e8
push dword [0x41d294]
mov dword [0x41d298], 0x80000000
call fcn.004063c0
sub esp, 0xffffffd8
pop esi
pop ebx
pop ebp
ret
Function at 0x4076e0
Capabilities:
Accept command line arguments

Disassembly:
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x41adf4], eax
push 0x4035e0
call fcn.004115b0
sub esp, 0xfffffffc
push 0x40770b
xor eax, eax
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4115c0
add esp, 0xfffffff4
call sub.KERNEL32.DLL_GetCommandLineA
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push eax
call fcn.004117c0
mov eax, dword [esp + 4]
test eax, eax
jle 0x411613
push 0x104
lea ecx, [esp + 4]
push ecx
call fcn.00411680
mov eax, dword [esp]
test eax, eax
je 0x411613
push 0x104
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov eax, dword [esp]
cmp ecx, 0
jbe 0x411613
mov ecx, dword [esp + 8]
mov dword [ecx], eax
push 1
call sub.KERNEL32.DLL_SetErrorMode
push fcn.00411860
call sub.KERNEL32.DLL_SetUnhandledExceptionFilter
call fcn.00411a50
mov dword [0x426e34], 0
mov dword [0x426e30], 0
call fcn.00411a90
and eax, 0xffff
cmp eax, 2
je 0x41165c
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call fcn.0040c190
pop eax
jmp 0x411664
push 0xffffffffffffffff
call fcn.0040c190
pop eax
push dword [esp + 8]
push dword [esp + 8]
call dword [0x438050]
call fcn.00409d70
sub esp, 0xffffffec
ret
Function at 0x408a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
push eax
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test ebx, ebx
setl byte [esp]
mov dword [ecx + 0x110], 0x100
mov dword [ecx + 0x114], 0x100
test byte [ecx + 0xc], 0x80
jne 0x408ac4
mov dword [ecx + 4], 1
mov eax, 0x100
sub eax, dword [ecx + 4]
jg 0x408ad5
mov dword [ecx + 4], 0xff
cmp ebx, 0x80000000
je 0x408b5b
mov al, byte [esp]
test al, al
je 0x408aed
mov edx, ebx
sar edx, 0x1f
xor ebx, edx
sub ebx, edx
test ebx, ebx
jne 0x408b00
mov edx, dword [ecx + 4]
test edx, edx
jle 0x408b70
jmp 0x408b00
xor ebx, ebx
test esp, esp
mov eax, ebx
mov edx, ebx
sar edx, 0x1f
idiv dword [0x41aeec]
mov eax, edx
sar eax, 0x1f
and eax, 0xa
add edx, eax
mov eax, edx
sar eax, 0x1f
xor edx, eax
sub edx, eax
mov eax, dword [ecx + 0x114]
dec eax
mov dword [ecx + 0x114], eax
add edx, 0x30
mov byte [ecx + eax + 0xe], dl
mov esi, ebx
sar esi, 0x1f
xor ebx, esi
mov eax, ebx
mul dword [str.gfff]
shr edx, 2
mov ebx, edx
xor ebx, esi
mov eax, dword [ecx + 4]
dec eax
mov dword [ecx + 4], eax
test ebx, ebx
jne 0x408b00
test eax, eax
jg 0x408afc
jmp 0x408b70
push 0xb
push str.2147483648
lea eax, [esp + 0x1c]
push eax
call fcn.00408a10
mov ecx, dword [esp + 0x18]
mov ax, word [ecx + 0xc]
test al, 4
je 0x408bbd
test al, 0x40
je 0x408bbd
mov edx, dword [ecx + 0x110]
sub edx, dword [ecx]
jge 0x408b88
xor edx, edx
test al, 0x12
jne 0x408b93
mov al, byte [esp]
test al, al
je 0x408b94
inc edx
cmp dword [ecx + 0x114], edx
jle 0x408bbd
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x114]
mov byte [ecx + eax + 0xe], 0x30
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 0x114], edx
jg 0x408b9c
mov ax, word [ecx + 0xc]
test al, 0x10
je 0x408bf0
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov dl, byte [esp]
test dl, dl
je 0x408be3
mov ebx, dword [ecx + 0x114]
mov byte [ebx + ecx + 0xe], 0x2d
jmp 0x408c3b
mov ebx, dword [ecx + 0x114]
mov byte [ebx + ecx + 0xe], 0x20
jmp 0x408c3b
test al, 2
je 0x408c1f
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov al, byte [esp]
test al, al
je 0x408c12
mov edx, dword [ecx + 0x114]
mov byte [edx + ecx + 0xe], 0x2d
jmp 0x408c3b
mov edx, dword [ecx + 0x114]
mov byte [edx + ecx + 0xe], 0x2b
jmp 0x408c3b
mov al, byte [esp]
test al, al
je 0x408c3b
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x114]
mov byte [ecx + edx + 0xe], 0x2d
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x408c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov al, byte [esp + 0x30]
mov dx, word [ecx + 0xc]
test dl, 0x20
je 0x408c95
mov dword [esp], 0x33323130
mov dword [esp + 4], 0x37363534
mov dword [esp + 8], 0x42413938
mov dword [esp + 0xc], 0x46454443
mov byte [esp + 0x10], 0
jmp 0x408cb9
mov dword [esp], 0x33323130
mov dword [esp + 4], 0x37363534
mov dword [esp + 8], 0x62613938
mov dword [esp + 0xc], 0x66656463
mov byte [esp + 0x10], 0
mov dword [ecx + 0x110], 0x100
mov dword [ecx + 0x114], 0x100
test dl, 8
je 0x408ce6
test al, al
je 0x408ce6
mov dword [ecx + 0x114], 0xff
mov byte [ecx + 0x10d], al
test dl, 0x80
jne 0x408cf2
mov dword [ecx + 4], 1
mov eax, dword [ecx + 0x114]
mov edx, eax
sub edx, dword [ecx + 4]
jg 0x408d03
dec eax
mov dword [ecx + 4], eax
mov eax, dword [ecx + 4]
test eax, eax
jg 0x408d10
test ebx, ebx
je 0x408d41
test esp, esp
mov eax, dword [ecx + 0x114]
lea edi, [eax - 1]
mov dword [ecx + 0x114], edi
mov eax, ebx
xor edx, edx
div esi
mov al, byte [esp + edx]
mov byte [ecx + edi + 0xe], al
mov eax, ebx
xor edx, edx
div esi
mov ebx, eax
mov edx, dword [ecx + 4]
dec edx
mov dword [ecx + 4], edx
jg 0x408d10
test ebx, ebx
jne 0x408d10
mov ax, word [ecx + 0xc]
test al, 4
je 0x408d7e
test al, 0x40
je 0x408d7e
mov eax, dword [ecx + 0x110]
sub eax, dword [ecx]
jge 0x408d59
xor eax, eax
cmp dword [ecx + 0x114], eax
jle 0x408d7e
cmp esp, 0
mov edx, dword [ecx + 0x114]
dec edx
mov dword [ecx + 0x114], edx
mov byte [ecx + edx + 0xe], 0x30
cmp dword [ecx + 0x114], eax
jg 0x408d64
sub esp, 0xffffffec
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x40c0b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [eax]
push dword [esp + 0x14]
push dword [esp + 0x14]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
sete al
and eax, 1
ret

Function at 0x40c0d0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [0x41e180]
mov edx, dword [0x41e584]
test edi, edi
je 0x40c135
cmp ecx, 0xffffffff
je 0x40c106
push 0
lea ebx, [esp + 0x14]
push ebx
push edi
push eax
push ecx
call sub.KERNEL32.DLL_WriteFile
mov edx, dword [0x41e584]
jmp 0x40c135
cmp edi, 0
jbe 0x40c135
cmp edx, 0x3ff
jae 0x40c135
xor ecx, ecx
jmp 0x40c120
cmp edx, 0x3ff
jae 0x40c135
mov dword [0x41e584], edx
mov bl, byte [eax + ecx]
mov byte [edx + 0x41e184], bl
inc edx
inc ecx
cmp ecx, edi
jb 0x40c118
mov dword [0x41e584], edx
pop edi
pop ebx
ret

Function at 0x411a90
Capabilities:
Parse pe header

Disassembly:
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x411aa7
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0x411ab4
xor ax, ax
jmp 0x411ac5
movzx ecx, word [eax + 0x14]
test ecx, ecx
je 0x411ac2
mov ax, word [eax + 0x5c]
jmp 0x411ac5
xor ax, ax
ret
Function at 0x10012e10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
push esi
mov dword [ebp - 8], esi
call fcn.10078b48
add esp, 4
test eax, eax
jne 0x10012eb9
push 2
push eax
push esi
call fcn.100797b2
push esi
call fcn.10075214
push 0
push 0
push esi
mov edi, eax
call fcn.100797b2
mov eax, dword [ebx + 4]
add esp, 0x1c
mov edx, dword [ebx]
mov ecx, eax
sub ecx, edx
mov dword [ebp - 4], eax
cmp edi, ecx
jae 0x10012e64
lea eax, [edx + edi]
jmp 0x10012e94
jbe 0x10012e97
mov eax, dword [ebx + 8]
sub eax, edx
cmp edi, eax
jbe 0x10012e7a
push ecx
push edi
mov ecx, ebx
call fcn.1002f820
jmp 0x10012e97
mov esi, edi
sub esi, ecx
push esi
push 0
push dword [ebp - 4]
call fcn.10071a10
mov eax, dword [ebp - 4]
add esp, 0xc
add eax, esi
mov esi, dword [ebp - 8]
mov dword [ebx + 4], eax
push esi
push edi
push 1
push dword [ebx]
call fcn.100819da
add esp, 0x10
cmp eax, edi
jne 0x10012eb9
push esi
call fcn.10079267
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.error_reading_from_file
lea ecx, [ebp - 0x14]
call fcn.10001e50
push 0x10110ef4
lea eax, [ebp - 0x14]
push eax
call fcn.10071c1d
int3
Function at 0x10019890
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10113900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xorps xmm0, xmm0
mov dword [ebp - 8], 0
mov edx, ecx
movq qword [ebp - 0x10], xmm0
push esi
lea ecx, [ebp - 0x10]
xor bl, bl
call fcn.10019770
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x100198f0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi]
call edi
test eax, eax
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
add esi, 4
cmp esi, dword [ebp - 0x14]
jne 0x100198d1
mov esi, dword [ebp - 0x10]
pop edi
test esi, esi
je 0x10019920
mov ecx, dword [ebp - 8]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10019916
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10019932
push ecx
push esi
call fcn.1006fe17
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1006f8b7
mov esp, ebp
pop ebp
ret
call fcn.10081cc9
int3