joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476d94
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0047e073
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004368aa
push dword [ebp + 8]
mov dword [ebp - 4], eax
push eax
call fcn.0047e051
add esp, 0x10
call fcn.00478349
test al, al
je 0x476dea
push eax
pop edx
pop edi
pop edi
push ebp
pop ecx
push ecx
push edi
push esp
push edi
push esi
push ebp
pop esi
pop ecx
pop esp
push esi
pop esp
push ecx
push esp
push eax
pop ecx
pop ecx
call fcn.00478418
test al, al
je 0x476e0f
pop ebx
push ecx
pop edx
push ebp
push edx
pop edi
pop edi
pop esp
push ebp
pop esi
pop edx
pop ebp
pop esi
pop edx
push edi
pop ebp
push ebp
push edi
push ebp
pop edx
push ebp
push esi
pop esi
pop esi
pop ebp
push edx
push ebp
pop esp
call fcn.00478349
test al, al
je 0x476e2f
pop esi
push ebp
pop edx
pop edx
push ebp
push edi
pop eax
push ebp
pop edx
pop ecx
pop esp
push esp
pop edi
push esp
pop edx
push ebp
push esi
push edi
push edi
pop ebx
pop ebp
pop ebx
push esp
mov eax, dword [ebp - 8]
xor edi, edi
mov esi, dword [ebp - 4]
xor ebx, ebx
inc edi
test eax, eax
js 0x476e9f
cmp word [esi + ebx*2], 0x5c
jne 0x476e97
call fcn.0047827a
test al, al
je 0x476e6e
push edi
pop ecx
push esi
push ebx
push edi
push ebp
push ebp
push esp
pop eax
pop edi
pop ecx
pop ebp
pop ecx
pop esp
push esi
pop eax
pop ebp
push ebp
push ebp
push eax
pop edi
push edx
push eax
push eax
pop ebp
push ebx
pop edx
push ebp
pop esi
mov esi, dword [ebp - 4]
movzx edi, word [esi + ebx*2]
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call fcn.00476a35
pop ecx
test al, al
jne 0x476e90
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x476eaf
mov eax, dword [ebp - 8]
mov word [esi + ebx*2], di
inc ebx
cmp ebx, eax
jle 0x476e3e
xor edi, edi
inc edi
push esi
call fcn.00435fca
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
jmp 0x476e9f

Function at 0x476eb3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4f230c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
xor esi, esi
push 0x208
push esi
push eax
mov dword [ebp - 0x210], esi
call fcn.0047a570
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.0047827a
test al, al
je 0x476f20
push edi
pop ecx
push esi
push ebx
push edi
push ebp
push ebp
push esp
pop eax
pop edi
pop ecx
pop ebp
pop ecx
pop esp
push esi
pop eax
pop ebp
push ebp
push ebp
push eax
pop edi
push edx
push eax
push eax
pop ebp
push ebx
pop edx
push ebp
pop esi
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00401e2f
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435ea6
mov esp, ebp
pop ebp
ret
Function at 0x477037
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4f230c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x210], eax
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], esi
push esi
push eax
call fcn.0047a570
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x26
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.004781f0
test al, al
je 0x4770a4
push esi
push edx
push edx
push ecx
pop eax
push ebp
push esp
pop edx
pop edi
push eax
push edx
pop ecx
pop ecx
push edi
push ebx
pop edx
pop esi
push esi
push edi
pop edx
pop eax
push eax
push eax
call fcn.00478235
test al, al
je 0x4770c4
pop esi
push ebp
pop ebx
push ecx
pop esp
pop ebx
push esi
push ecx
pop ebp
pop esi
pop edi
pop ebp
push esp
pop esi
pop edx
push ebp
push esp
push ecx
pop edx
pop esi
pop esp
pop eax
pop ebx
call fcn.004785fb
test al, al
je 0x4770e0
pop esi
push eax
pop edx
pop esp
push edi
push ebp
push eax
push esp
pop edx
push esp
pop esi
pop esi
pop ebp
pop ebx
pop eax
pop eax
pop edi
pop ebx
push esi
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00401e2f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00435ea6
mov esp, ebp
pop ebp
ret

Function at 0x477109
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4f230c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x214], 0
push ebx
push esi
push edi
push 0x208
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0047a570
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.004781f0
test al, al
je 0x477177
push esi
push edx
push edx
push ecx
pop eax
push ebp
push esp
pop edx
pop edi
push eax
push edx
pop ecx
pop ecx
push edi
push ebx
pop edx
pop esi
push esi
push edi
pop edx
pop eax
push eax
push eax
call fcn.00478235
test al, al
je 0x477197
pop esi
push ebp
pop ebx
push ecx
pop esp
pop ebx
push esi
push ecx
pop ebp
pop esi
pop edi
pop ebp
push esp
pop esi
pop edx
push ebp
push esp
push ecx
pop edx
pop esi
pop esp
pop eax
pop ebx
call fcn.004785fb
test al, al
je 0x4771b3
pop esi
push eax
pop edx
pop esp
push edi
push ebp
push eax
push esp
pop edx
push esp
pop esi
pop esi
pop ebp
pop ebx
pop eax
pop eax
pop edi
pop ebx
push esi
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00401e2f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00435ea6
mov esp, ebp
pop ebp
ret
Function at 0x4771dc
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x4f230c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x210], esi
call fcn.0047e073
pop ecx
test eax, eax
je 0x47732b
call fcn.00478640
test al, al
je 0x477228
pop edx
pop eax
pop eax
push ebp
push edx
pop ebx
push esi
pop ecx
push esp
push eax
push esp
pop ebp
push ebx
pop ebp
pop ecx
pop ebp
push eax
pop edx
push ebx
pop ebp
push ebp
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x200]
push str.Program_FilesInternet_Exploreriexplore.exe
push eax
call fcn.0047e051
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00481b10
push 0x3c
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.0047a570
add esp, 0x1c
mov dword [ebp - 0x240], str.open
mov dword [ebp - 0x248], 0x200
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x230], 1
call fcn.004781ab
test al, al
je 0x4772b5
push esi
push ebp
push edi
push ebx
pop edx
push esi
pop ebp
pop edx
pop edx
pop ebp
push ecx
pop esp
push esp
pop ecx
pop eax
push edx
push edx
pop ebp
pop ebp
pop ebx
push ebx
pop edx
push eax
pop ecx
push eax
push esp
push ebp
push ecx
pop esp
call fcn.00478754
test al, al
je 0x4772e2
push edi
pop esi
pop ebp
pop esp
pop eax
pop ecx
push esi
pop esp
push ebp
push esp
push esp
pop edi
push esi
push ebp
pop ebx
push ecx
push eax
pop edx
pop edx
pop esi
push esp
push eax
push edx
push esi
pop ebp
push esp
push ebx
push ebx
push edi
push esi
mov esi, dword [ebp - 0x210]
call fcn.00478097
test al, al
je 0x4772fd
pop edx
pop esp
pop edi
push edx
pop esp
push esi
push ebp
pop esp
pop eax
push eax
pop eax
pop ecx
pop ebp
pop ebp
pop eax
push edx
pop ebx
pop esp
push 1
xor ebx, ebx
push ebx
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x477328
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x20c]
push ebx
push ecx
call fcn.00476ab8
add esp, 0x14
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435ea6
mov esp, ebp
pop ebp
ret
Function at 0x48e28c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048df4c

Function at 0x4a5ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx - 4]
jle 0x4a605a
mov ecx, dword [ebp + 8]
sub ecx, ebx
push esi
mov dword [ebp + 8], ecx
push edi
nop word [eax + eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [ebp + 8]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
sub dword [ebp + 0x10], 1
mov dword [ebx - 4], eax
jne 0x4a6010
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a6060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jle 0x4a60d3
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub ecx, eax
sub dword [ebp + 0x14], eax
push ebx
push esi
mov dword [ebp + 0xc], ecx
push edi
nop word [eax + eax]
mov ebx, dword [ecx + eax]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov ecx, ebx
and ecx, 0xffff00ff
mov edi, esi
and edi, 0xffff00ff
mov edx, esi
add edi, ecx
and edx, 0xff00
movzx ecx, bx
and esi, 0xff00ff00
add edx, ecx
and ebx, 0xff00ffff
mov ecx, dword [ebp + 0x14]
xor edi, edx
and edi, 0xff00ff
add ebx, esi
xor edi, ebx
sub dword [ebp + 0x10], 1
mov dword [ecx + eax - 4], edi
mov ecx, dword [ebp + 0xc]
jne 0x4a6080
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a68d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
lea eax, [ebx + eax*4]
mov edi, eax
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x4a6944
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [ebx]
lea esi, [esi + 2]
mov ecx, edx
lea ebx, [ebx + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xd
xor cl, al
mov eax, edx
and cl, 7
shr eax, 0x10
xor cl, al
mov eax, edx
mov byte [esi - 2], cl
mov ecx, edx
shr ecx, 5
shr eax, 3
xor cl, al
shr edx, 5
mov eax, dword [ebp + 8]
and cl, 0x1f
xor cl, dl
inc eax
mov byte [esi - 1], cl
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x4a6900
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4a6950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x4a69bb
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
xor al, dl
mov byte [esi - 2], cl
and al, 0xf
xor al, dl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x4a6980
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001e34
Capabilities:
Parse pe header

Disassembly:
push 0x60
push 0x10011e0
call fcn.01002c88
mov edi, 0x94
mov eax, edi
call fcn.01002df0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x10010a8]
mov ecx, dword [esi + 0x10]
mov dword [0x10062b8], ecx
mov eax, dword [esi + 4]
mov dword [0x10062c4], eax
mov edx, dword [esi + 8]
mov dword [0x10062c8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x10062bc], esi
cmp ecx, 2
je 0x1001e94
or esi, 0x8000
mov dword [0x10062bc], esi
shl eax, 8
add eax, edx
mov dword [0x10062c0], eax
cmp word [0x1000000], 0x5a4d
jne 0x1001ed0
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1001ed0
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1001ee9
cmp ecx, 0x20b
je 0x1001ed6
and dword [ebp - 0x1c], 0
jmp 0x1001efd
cmp dword [eax + 0x84], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1001ef7
cmp dword [eax + 0x74], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 0
call fcn.01002c2a
pop ecx
test eax, eax
jne 0x1001f2a
cmp dword [0x10062a8], 1
jne 0x1001f17
call fcn.01002406
push 0x1c
call fcn.01002219
push 0xff
call fcn.01002078
pop ecx
pop ecx
and dword [ebp - 4], 0
call fcn.01002a5a
test eax, eax
jge 0x1001f3f
push 0x1b
call fcn.01001e05
pop ecx
call dword [0x10010ac]
mov dword [0x1006854], eax
call fcn.0100292d
mov dword [0x10062a0], eax
call fcn.01002884
test eax, eax
jge 0x1001f65
push 8
call fcn.01001e05
pop ecx
call fcn.0100262a
test eax, eax
jge 0x1001f76
push 9
call fcn.01001e05
pop ecx
call 0x10020d2
mov dword [ebp - 0x28], eax
test eax, eax
je 0x1001f89
push eax
call fcn.01001e05
pop ecx
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [0x10010b0]
call fcn.010025bc
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x1001fab
movzx eax, word [ebp - 0x40]
jmp 0x1001fae
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push 0
push 0x1000000
call fcn.01001c3d
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1001fcf
push esi
call 0x10021b2
call fcn.010021ea
jmp 0x1002001
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x7c]
call fcn.01002cc3
ret
Function at 0x10032bb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.01003241
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call 0x103df5d
leave
ret
Function at 0x5e4288
Capabilities:
Encode data using xor

Disassembly:
js 0x5e42c5
add al, 0xce
iretd
rol byte [eax - 0x7f3fb2b2], 0x40
dec ebx
shr byte [esi + 0x42], 0x53
jo 0x5e4341
fiadd dword [esp + ebx*2]
mov dword [0x1145725f], eax
inc edx
mov byte [0xd3425a45], al
shl ecx, 0xc
fstp xword [edi]
movsb byte es:[edi], byte [esi]
jns 0x5e4363
jo 0x5e42e7
retf 0x5c40
outsb dx, byte [esi]
iretd
and byte [esi - 0x37], 0x68
aam 0xe2
add dword [ebx - 0x5dbdeebe], ebp
inc ebp
jno 0x5e4392
rol ecx, cl
inc ebx
or eax, 0xdae6bea3
out 0xda, al
rol ecx, cl
outsb dx, byte [esi]
push ebx
push edi
xor ebp, dword [ecx + 0x42]
ror dword [edx + 0x3da25da5], cl
loope 0x5e43a9
movsd dword es:[edi], dword [esi]
pop ebp
mov byte [0xd341e13d], al
shl ebx, 0xc
rol ecx, cl
jecxz 0x5e4378
invalid
jo 0x5e4332
loope 0x5e4360
fild qword [ebp - 4]
or al, 0xdb
imul edi, dword [ecx - 0x62acd52c], 0x171a517
fdivp st(0)
shr dword [esi - 0x1e], 0x28
outsb dx, byte [esi]
loop 0x5e43b9
add byte [esi - 0x32], bh
jle 0x5e4362
jge 0x5e4356
outsb dx, byte [esi]
inc edx
push esi
add dword [eax + eax*2], ebx
xor byte [ebx - 0x7fa8ac92], 0x6e
inc edx
rol dword [edx + 0x2e], cl
pushfd
mov eax, 0xa242789c
inc ebp
pop edx
inc edx
rol ecx, cl
jecxz 0x5e43c0
pushfd
js 0x5e43ee
mov byte [0xd3425a45], al
shl ebx, 0xc
mov ecx, 0xd7456a59
xlatb
outsb dx, byte [esi]
inc edx
sub byte [eax], al
jle 0x5e438e
mov ah, 0xc1
outsb dx, byte [esi]
inc edx
and byte [edi + 0x57d21116], al
adc eax, 0x2bd29742
sub eax, 0xd587c712
adc eax, 0x122d
add byte [eax], al
mov dword [edi + 0x124a71af], 1
push dword [ebp + 8]
call fcn.005e37b0
jmp 0x5e43f9
pop es
add byte [eax], al
add bh, al
inc ebp
clc
add byte [eax], al
add byte [eax], al
mov eax, dword [ebp - 8]
leave
ret 0x14
Function at 0x401040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 8]
push esi
push 0x41f42c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4010fd
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4010fd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x4010fd
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x4010fc
mov ecx, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push ebx
push 0
push 4
push 0
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
je 0x4010fc
push edi
push 0
push 0
push 0
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp + 8]
push ebx
mov edi, eax
push edx
push edi
call fcn.0040c330
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebp - 4]
push eax
call esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4015d0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x426ad0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0040cf20
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x401620
lea eax, [ebp + 0xc]
push 0
push eax
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [ebp + 0x20], 0x10
jb 0x401642
mov eax, dword [ebp + 0xc]
push eax
call fcn.00401cee
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cf11
mov esp, ebp
pop ebp
ret
Function at 0x40cf11
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426ad0]
jne 0x40cf1b
repz ret
jmp fcn.00412a4c

Function at 0x41a21d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00412436
and dword [ebp - 4], 0
cmp dword [0x42a7e0], 0
mov ebx, eax
jne 0x41a2ce
push 0x4219ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41a37f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4219e0
push edi
call esi
test eax, eax
je 0x41a37f
push eax
call fcn.004123c4
mov dword [esp], 0x4219d0
push edi
mov dword [0x42a7e0], eax
call esi
push eax
call fcn.004123c4
mov dword [esp], 0x4219bc
push edi
mov dword [0x42a7e4], eax
call esi
push eax
call fcn.004123c4
mov dword [esp], 0x4219a0
push edi
mov dword [0x42a7e8], eax
call esi
push eax
call fcn.004123c4
pop ecx
mov dword [0x42a7f0], eax
test eax, eax
je 0x41a2ce
push 0x421988
push edi
call esi
push eax
call fcn.004123c4
pop ecx
mov dword [0x42a7ec], eax
mov eax, dword [0x42a7ec]
cmp eax, ebx
je 0x41a326
cmp dword [0x42a7f0], ebx
je 0x41a326
push eax
call fcn.0041243f
push dword [0x42a7f0]
mov esi, eax
call fcn.0041243f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41a326
test edi, edi
je 0x41a326
call esi
test eax, eax
je 0x41a31d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41a31d
test byte [ebp - 0xc], 1
jne 0x41a326
or dword [ebp + 0x10], 0x200000
jmp 0x41a35f
mov eax, dword [0x42a7e4]
cmp eax, ebx
je 0x41a35f
push eax
call fcn.0041243f
pop ecx
test eax, eax
je 0x41a35f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41a35f
mov eax, dword [0x42a7e8]
cmp eax, ebx
je 0x41a35f
push eax
call fcn.0041243f
pop ecx
test eax, eax
je 0x41a35f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42a7e0]
call fcn.0041243f
pop ecx
test eax, eax
je 0x41a37f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41a381
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45c9ff
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x540]
call fcn.0045d08e
lea eax, [ebp - 0x13c]
push 0x104
push eax
push 0
call dword [0x48d290]
lea eax, [ebp - 0x13c]
push 0x49c010
push eax
call fcn.004613c6
pop ecx
mov dword [esi], eax
test eax, eax
pop ecx
jne 0x45ca4d
push 1
pop eax
jmp 0x45cbdd
xor eax, eax
mov cl, byte [eax + 0x49c008]
mov byte [ebp + eax - 0x24], cl
mov cl, byte [eax + section..data]
mov byte [ebp + eax - 0x1c], cl
inc eax
cmp eax, 8
jl 0x45ca4f
mov edi, dword [ebp + 0xc]
push edi
call fcn.00462350
and dword [esi + 0x110], 0
pop ecx
lea ecx, [esi + 0x110]
xor edx, edx
test eax, eax
jle 0x45ca91
movsx ebx, byte [edx + edi]
add dword [ecx], ebx
inc edx
cmp edx, eax
jl 0x45ca86
push 2
push 0xfffffffffffffff8
push dword [esi]
call fcn.004622c8
push dword [esi]
lea edi, [esi + 4]
push 1
pop ebx
push ebx
push 4
push edi
call fcn.00462221
push dword [esi]
call fcn.00461f72
push dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push ebx
push 4
push eax
call fcn.00462221
push 0
push 0
push dword [esi]
call fcn.004622c8
and dword [ebp + 0xc], 0
add esp, 0x3c
cmp dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
jle 0x45cb10
mov ecx, dword [esi]
test byte [ecx + 0xc], 0x10
jne 0x45cb10
push ecx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00462221
add esp, 0x10
lea ecx, [ebp - 0x540]
push dword [ebp - 0x14]
call fcn.0045d0cd
inc dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 8]
jl 0x45cae0
xor eax, 0xaaaaaaaa
cmp dword [ebp - 0x10], eax
jne 0x45cb51
push 0
push dword [edi]
push dword [esi]
call fcn.004622c8
push dword [esi]
lea eax, [ebp - 0x34]
push ebx
push 0x10
push eax
call fcn.00462221
add esp, 0x1c
test eax, eax
je 0x45cb51
xor eax, eax
mov cl, byte [ebp + eax - 0x34]
cmp cl, byte [ebp + eax - 0x24]
jne 0x45cb4c
inc eax
cmp eax, 0x10
jl 0x45cb3c
cmp eax, 0x10
je 0x45cb55
push 3
jmp 0x45cb6d
push dword [esi]
lea eax, [ebp - 1]
push ebx
push ebx
push eax
call fcn.00462221
add esp, 0x10
cmp byte [ebp - 1], 3
je 0x45cb7a
push 4
pop edi
push dword [esi]
call fcn.0046161b
pop ecx
mov eax, edi
jmp 0x45cbdd
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.00462221
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0xfac1
lea ebx, [esi + 0xc]
push edi
push 1
push ebx
call fcn.00462221
add esp, 0x20
lea eax, [edi + 0xc3d2]
mov ecx, esi
push eax
push edi
push ebx
call fcn.0045cbf2
and byte [edi + esi + 0xc], 0
lea eax, [esi + 0x110]
xor ecx, ecx
cmp edi, ecx
mov dword [eax], ecx
jle 0x45cbd0
movsx edx, byte [ebx + ecx]
add dword [eax], edx
inc ecx
cmp ecx, edi
jl 0x45cbc5
push dword [esi]
call fcn.00461f72
mov dword [esi + 8], eax
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x45cbf2
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call 0x3f8710
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x45cc1c
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call 0x3f8880
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x45cc06
pop esi
pop edi
ret 0xc