joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fbfb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x74
push ebp
lea eax, [esp + 4]
push eax
push 1
xor ebp, ebp
push ebp
push str.SoftwareMicrosoftMultimediaSound_Mapper
push 0x80000001
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
call dword [0x53d008]
test eax, eax
jne 0x4fc11a
push edi
mov edi, dword [esp + 0x80]
test edi, edi
mov eax, str.Record
jne 0x4fc004
mov eax, str.Playback
mov edx, dword [esp + 8]
push esi
mov esi, dword [0x53d004]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4fc118
mov eax, dword [esp + 0x14]
inc eax
push eax
call fcn.0052b380
add esp, 4
test edi, edi
mov ebp, eax
mov eax, str.Record
jne 0x4fc044
mov eax, str.Playback
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4fc118
test edi, edi
je 0x4fc06a
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
jmp 0x4fc070
call dword [sym.imp.WINMM.dll_waveOutGetNumDevs]
xor edi, edi
test eax, eax
mov dword [esp + 0x18], eax
jle 0x4fc118
mov edi, edi
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4fc0c4
push 0x30
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.WINMM.dll_waveInGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x24]
nop
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4fc0fc
test cl, cl
je 0x4fc0c0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4fc0fc
add eax, 2
add esi, 2
test cl, cl
jne 0x4fc0a0
xor eax, eax
jmp 0x4fc101
push 0x34
lea eax, [esp + 0x50]
push eax
push edi
call dword [sym.imp.WINMM.dll_waveOutGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4fc0fc
test cl, cl
je 0x4fc0f8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4fc0fc
add eax, 2
add esi, 2
test cl, cl
jne 0x4fc0d8
xor eax, eax
jmp 0x4fc101
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4fc114
mov eax, dword [esp + 0x18]
inc edi
cmp edi, eax
jl 0x4fc080
jmp 0x4fc118
mov dword [esp + 0x10], edi
pop esi
pop edi
mov eax, dword [esp + 4]
test eax, eax
je 0x4fc129
push eax
call dword [section..rdata]
test ebp, ebp
je 0x4fc136
push ebp
call fcn.00439d00
add esp, 4
mov eax, dword [esp + 8]
pop ebp
add esp, 0x74
ret
Function at 0x4fc3e0
Capabilities:
Capture microphone audio

Disassembly:
push ecx
push ebp
mov ebp, ecx
mov ecx, dword [ebp + 4]
push esi
add ecx, 0x24
call fcn.004fc8e0
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
inc esi
mov dword [esp + 8], esi
mov byte [eax], 0
je 0x4fc4f6
mov cl, byte [ebp + 0x2aa]
test cl, cl
jne 0x4fc4cb
mov ecx, dword [ebp + 0x28c]
test ecx, ecx
jle 0x4fc4cb
push ebx
mov byte [eax], 1
mov ebx, dword [ebp + 0x24c]
push edi
lea eax, [ebp + 0x290]
push eax
call dword [0x53d2c8]
mov ecx, dword [ebp + 0x48]
mov esi, dword [ebp + ebx*4 + 8]
mov edi, dword [esp + 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x28c]
dec esi
mov eax, esi
xor ecx, ecx
test eax, eax
mov dword [ebp + 0x28c], esi
jle 0x4fc483
lea eax, [ebp + 0x24c]
mov edx, dword [eax + 4]
mov dword [eax], edx
mov edx, dword [ebp + 0x28c]
inc ecx
add eax, 4
cmp ecx, edx
jl 0x4fc470
lea eax, [ebp + 0x290]
push eax
call dword [0x53d2c4]
mov ecx, dword [ebp]
push 0x20
shl ebx, 5
lea eax, [ebx + ebp + 0x4c]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov al, byte [ebp + 0x2a8]
test al, al
pop edi
pop ebx
je 0x4fc4c1
mov edx, dword [ebp]
push edx
call dword [sym.imp.WINMM.dll_waveInStart]
mov byte [ebp + 0x2a8], 0
mov eax, dword [esp + 8]
pop esi
pop ebp
pop ecx
ret 8
mov al, byte [ebp + 0x2a9]
test al, al
je 0x4fc4ee
mov eax, dword [ebp]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov eax, esi
pop esi
mov byte [ebp + 0x2a9], 0
pop ebp
pop ecx
ret 8
push 1
call dword [0x53d2c0]
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x4fc6d0
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
lea eax, [esp + 0x10]
push eax
add ecx, 0x9c
push ecx
call fcn.004fbf20
mov edx, dword [esp + 0x30]
lea ebx, [edi + 8]
add esp, 8
mov dword [edi + 0x28c], 0
mov byte [edi + 0x2a8], 0
mov dword [edi + 0x48], edx
mov esi, ebx
mov ebp, 0x10
mov eax, dword [esp + 0x28]
push eax
call fcn.0052b380
mov dword [esi], eax
add esp, 4
add esi, 4
dec ebp
jne 0x4fc712
mov edx, dword [edi + 4]
mov eax, dword [edx + 0x50]
push 0x30000
push edi
push 0x4fc6b0
lea ecx, [esp + 0x1c]
push ecx
push eax
push edi
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x4fc7ab
xor ebp, ebp
lea esi, [edi + 0x4c]
mov edi, edi
xor ecx, ecx
mov edx, esi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
mov dword [edx + 0x18], ecx
mov dword [edx + 0x1c], ecx
mov eax, dword [ebx]
mov ecx, dword [esp + 0x28]
push 0x20
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 0xc], ebp
mov edx, dword [edi]
push esi
push edx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [edi]
push 0x20
push esi
push eax
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
inc ebp
add ebx, 4
add esi, 0x20
cmp ebp, 0x10
jl 0x4fc750
mov byte [edi + 0x2a9], 1
mov byte [edi + 0x2aa], 0
xor ecx, ecx
test eax, eax
sete cl
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
add esp, 0x14
ret 4

Function at 0x4fc840
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
push esi
call dword [0x53d2c8]
mov ebx, dword [0x53d2c4]
push esi
mov dword [edi], 1
call ebx
mov ebp, dword [0x53d284]
call ebp
mov dword [esp + 0x10], eax
lea esp, [esp]
push esi
call dword [0x53d2c8]
mov eax, dword [edi + 0x1c]
test eax, eax
push esi
je 0x4fc8a3
call ebx
push 0x14
call dword [0x53d2c0]
call ebp
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x4fc870
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
mov edi, 1
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x4fc970
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push edi
mov edi, dword [0x53d23c]
mov esi, 0x564754
lea ecx, [ecx]
call edi
mov dword [esi], eax
add esi, 4
cmp esi, 0x56475c
jl 0x4fc980
pop edi
pop esi
ret
Function at 0x4fca00
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
lea edi, [esi + 4]
push edi
call dword [0x53d2c8]
push edi
mov dword [esi + 0x1c], 1
call dword [0x53d2c4]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor edi, edi
test ebx, ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
je 0x4fca3a
mov dword [esi + 0x28], ebx
jmp 0x4fca52
lea edx, [esi + 0x28]
push edx
push 0
push esi
push 0x4fc9c0
push 0
push 0
call dword [0x53d160]
mov edi, eax
mov eax, dword [esp + 0x18]
dec eax
je 0x4fca60
dec eax
jne 0x4fca69
push 1
jmp 0x4fca62
push 0xffffffffffffffff
push edi
call dword [0x53d240]
test ebx, ebx
jne 0x4fca78
test edi, edi
je 0x4fca78
push edi
call dword [0x53d278]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x4fde70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push edi
mov edi, ecx
mov byte [eax], 0
mov eax, dword [edi]
xor esi, esi
test eax, eax
mov dword [esp + 8], edi
je 0x4fdf8e
call fcn.004fdd50
mov eax, dword [edi]
test eax, eax
je 0x4fdea1
mov byte [eax + 0x18], 0
mov eax, dword [eax]
test eax, eax
jne 0x4fde97
push ebx
push ebp
mov ecx, dword [edi]
test ecx, ecx
je 0x4fdf8c
lea ecx, [ecx]
mov al, byte [ecx + 0x18]
test al, al
jne 0x4fdedf
test esi, esi
je 0x4fdedd
fild dword [edi + 0x78]
fild dword [ecx + 0x14]
fild dword [ecx + 0x10]
fdiv st(2)
fdivp st(1)
fild dword [esi + 0x14]
fild dword [esi + 0x10]
fdiv st(3)
fdivp st(1)
fcompp
fnstsw ax
fstp st(0)
test ah, 0x41
jne 0x4fdedf
mov esi, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x4fdeb0
test esi, esi
je 0x4fdf8c
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x4fdf52
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
lea ebp, [esi + 0x3c]
push ebp
lea ecx, [esi + 0x38]
push ecx
push edx
push eax
call dword [esi + 4]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4fdf29
lea edi, [esi + 0x1c]
push edi
call dword [0x53d2c8]
push edi
mov byte [esi + 0x1a], 1
call dword [0x53d2c4]
mov edi, dword [esp + 0x10]
test ebx, ebx
mov dword [esi + 0x34], ebx
je 0x4fdf40
mov ecx, dword [esp + 0x18]
mov byte [ecx], 1
mov edx, dword [edi + 0xa0]
sub dword [ebp], edx
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x4fdf52
mov byte [esi + 0x18], 1
xor esi, esi
jmp 0x4fdea3
inc dword [esi + 0x14]
mov eax, dword [edi]
test eax, eax
je 0x4fdf73
mov ecx, dword [edi + 0x74]
movsx ecx, byte [ecx + edi + 0x10]
cmp dword [eax + 0x44], ecx
je 0x4fdf70
mov eax, dword [eax]
test eax, eax
jne 0x4fdf63
jmp 0x4fdf73
dec dword [eax + 0x14]
mov edx, dword [edi + 0x74]
mov al, byte [esi + 0x44]
mov byte [edx + edi + 0x10], al
mov eax, dword [edi + 0x74]
inc eax
cdq
mov ecx, 0x64
idiv ecx
mov dword [edi + 0x74], edx
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
pop ecx
ret 4
Function at 0x51ff10
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x55fe60]
test eax, eax
je 0x51ff5e
push esi
mov esi, dword [0x53d234]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x626d78], eax
call esi
push 0
push 0
push 0
push 0x51fed0
push 0
push 0
mov dword [0x626d74], eax
call dword [0x53d160]
mov dword [0x55fe60], 0
pop esi
mov eax, dword [0x626d78]
push eax
call dword [0x53d238]
ret
Function at 0x528610
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
cdq
and edx, 7
push ebx
mov ebx, dword [esp + 0x10]
add eax, edx
push ebp
sar eax, 3
and ecx, 7
test eax, eax
push esi
mov esi, dword [esp + 0x10]
mov ebp, ecx
jle 0x52865c
push edi
mov edi, eax
push 8
mov ecx, esi
call fcn.00523840
xor edx, edx
mov ecx, ebx
shr ecx, 8
mov dh, bl
xor eax, ecx
and eax, 0xff
xor edx, dword [eax*4 + 0x550840]
dec edi
mov ebx, edx
jne 0x528636
pop edi
test ebp, ebp
jle 0x528688
push 1
mov ecx, esi
call fcn.00523840
mov ecx, ebx
shr ecx, 0xf
and ecx, 1
and ebx, 0x7fff
xor eax, ecx
shl ebx, 1
test eax, eax
je 0x528685
xor ebx, 0x8005
dec ebp
jne 0x528660
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x52ab30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov edi, ecx
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0
call dword [0x53d29c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
lea ebx, [edi + 0x1ac]
mov ecx, ebx
mov dword [esp + 0x18], edx
call fcn.0040c250
mov esi, dword [edi + 0x1b0]
test esi, esi
je 0x52ab98
push ebp
lea ebp, [edi + 0x30]
lea ebx, [ebx]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
push ebp
push ecx
push eax
mov ecx, edi
call fcn.0052a530
mov esi, dword [esi + 8]
test esi, esi
jne 0x52ab80
pop ebp
push 0
push ebx
call dword [0x53d2b8]
lea eax, [edi + 0x30]
push eax
mov ecx, edi
call fcn.0052a860
lea ecx, [esp + 0x14]
call fcn.00529880
lea ecx, [esp + 0xc]
mov ebx, 1
push ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
call dword [0x53d29c]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push 0
mov ecx, edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov byte [edi + 0x1a8], bl
call fcn.0052a9a0
lea ecx, [esp + 0x14]
mov byte [edi + 0x1a8], 0
mov byte [edi + 0x2d], 0
call fcn.00529880
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x52ae00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [0x53d29c]
push esi
push edi
lea eax, [esp + 0x30]
push eax
mov edi, ecx
call ebx
mov esi, dword [edi + 0x18]
lea ecx, [esp + 0x10]
inc esi
push ecx
mov dword [edi + 0x18], esi
call ebx
mov eax, dword [edi + 0x30]
test eax, eax
lea esi, [edi + 0x30]
jne 0x52ae3f
mov ecx, edi
call fcn.0052ab30
jmp 0x52af34
lea edx, [esp + 0x28]
push edx
call ebx
mov eax, dword [0x626ec0]
or eax, dword [0x626ec4]
jne 0x52ae5e
push 0x626ec0
call dword [0x53d2a0]
mov ecx, dword [0x626ec4]
mov edx, dword [0x626ec0]
mov eax, dword [ebp + 8]
push ecx
push edx
push 0
push eax
call fcn.004d47a0
push 0
push 0x3e8
push edx
push eax
call fcn.004d47e0
add eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
adc edx, dword [esp + 0x14]
mov dword [esp + 0x1c], edx
mov eax, dword [esi]
test eax, eax
je 0x52aeef
mov ecx, dword [0x55ff38]
cmp eax, ecx
jbe 0x52aea7
mov eax, ecx
test eax, eax
jbe 0x52aed2
mov ebx, eax
lea ecx, [ecx]
mov eax, dword [esi]
mov edx, dword [esi + 8]
dec eax
mov dword [esi], eax
mov ecx, dword [edx + eax*8]
mov eax, dword [edx + eax*8 + 4]
push esi
push eax
push ecx
mov ecx, edi
call fcn.0052a530
dec ebx
jne 0x52aeb0
mov ebx, dword [0x53d29c]
lea eax, [esp + 0x20]
push eax
call ebx
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x1c]
jb 0x52ae95
ja 0x52aeef
mov edx, dword [esp + 0x20]
cmp edx, dword [esp + 0x18]
jb 0x52ae95
lea eax, [esp + 0x20]
push eax
call ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [edi + 0x1dc]
sub ecx, eax
mov eax, dword [esp + 0x24]
sbb eax, esi
cmp eax, edx
jb 0x52af34
ja 0x52af1e
cmp ecx, dword [edi + 0x1d8]
jbe 0x52af34
mov dword [edi + 0x1d8], ecx
mov dword [edi + 0x1dc], eax
mov dword [edi + 0x1e0], 0
lea ecx, [esp + 0x28]
push ecx
call ebx
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
sub edx, esi
mov esi, dword [edi + 0x10]
sbb eax, ecx
mov ecx, dword [edi + 0x14]
add esi, edx
adc ecx, eax
mov dword [edi + 0x14], ecx
lea ecx, [esp + 0x28]
push ecx
mov dword [edi + 0x10], esi
call ebx
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x34]
mov edx, dword [edi + 0x1dc]
sub ecx, ebx
sbb eax, esi
cmp eax, edx
jb 0x52afa4
ja 0x52af8e
cmp ecx, dword [edi + 0x1d8]
jbe 0x52afa4
mov dword [edi + 0x1d8], ecx
mov dword [edi + 0x1dc], eax
mov dword [edi + 0x1e0], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52afd0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [0x53d29c]
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov edi, ecx
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], 0
call ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov ecx, edi
mov dword [esp + 0x24], edx
mov byte [edi + 0x24], 0
mov byte [edi + 0x2d], 1
call fcn.005295b0
lea eax, [esp + 0x18]
push eax
call ebx
lea ecx, [edi + 0x1ac]
call fcn.0040c250
mov esi, dword [edi + 0x1b0]
test esi, esi
je 0x52b047
lea ebp, [edi + 0x30]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
push ebp
push ecx
push eax
mov ecx, edi
call fcn.0052a530
mov esi, dword [esi + 8]
test esi, esi
jne 0x52b030
push 0
lea eax, [edi + 0x1ac]
push eax
call dword [0x53d2b8]
lea ecx, [esp + 0x10]
push ecx
call ebx
mov edx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
mov esi, dword [edi + 0x10]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [edi + 0x14]
sub edx, ebp
sbb eax, ebx
add esi, edx
adc ecx, eax
mov dword [edi + 0x14], ecx
push 0x19
mov ecx, edi
mov dword [edi + 0x10], esi
call fcn.0052ae00
lea ecx, [esp + 0x20]
call fcn.00529880
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x402490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x402500
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x4024f8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4070c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x4024bd
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x403140
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete dl
movzx edx, dl
inc edx
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop

Function at 0x401c30
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401c55
lea ecx, [esp + 0xc]
push 0
push ecx
push 0xa000
push 0x424c68
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401c73
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop ebx
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x5d8ac7
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x5d87dc
mov edi, 0x6e798e98
call fcn.005d8b07
sub edx, 0x49aa348e
mov edx, 0x7a2332c4
xor dword [ebx], esi
sub edx, 0x94cd0fb5
add ebx, 2
mov edi, edi
cmp ebx, eax
jl fcn.005d8ac7
sub edx, 0x5d5ce200
add edx, edi
sub edi, 0xad79dd0f
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43cf67
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43ccda
mov ebx, 0x583dbf03
call fcn.0043cf7e
xor dword [ecx], eax
inc ecx
cmp ecx, esi
jne fcn.0043cf67
ret
Function at 0x401123
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x18]
mov edi, ecx
push eax
call fcn.0040117e
xor ebp, ebp
pop ecx
pop ecx
mov ebx, dword [eax]
mov dword [eax], ebp
cmp dword [esp + 0x14], ebp
je 0x401152
push 4
push dword [esp + 0x18]
call fcn.004021ef
pop ecx
pop ecx
lea esi, [edi + 4]
push esi
push ebp
push ebx
push 0x401107
push ebp
push ebp
call fcn.004073c7
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x401174
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 6
mov dword [esi], ebp
call fcn.00401f1c
int3

Function at 0x40157f
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
push esi
mov esi, ebp
cmp dword [esp + 0x10], esi
jbe 0x4016ad
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push edi
mov edi, dword [esp + 0x14]
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xcc
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x2b
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x70
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xed
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x14
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 3
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x68
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x60
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x2a
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x87
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x7d
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xc5
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x33
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x27
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xb7
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xa7
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xcf
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x27
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x6e
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xee
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xaa
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x74
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xcd
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xa2
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xef
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xb2
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xdb
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xf9
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xf9
inc esi
cmp esi, dword [esp + 0x18]
jb 0x40159b
pop edi
pop ebx
pop esi
pop ebp
ret